cheshire-cli.test.mjs

/**
 * Package tests for Cheshire Terminal CLI — drives shipped modules.
 * Run: npm test   (or: node --test ./cheshire-cli.test.mjs ./arena-register.test.mjs)
 */
import { describe, it } from "node:test";
import assert from "node:assert/strict";
import { spawnSync } from "node:child_process";
import { dirname, join } from "node:path";
import { fileURLToPath } from "node:url";
import { readFile } from "node:fs/promises";
import {
  resolveSiteUrl,
  DEFAULT_SITE_URL,
  registrationJsonPath,
  loadRegistrationJson,
} from "./src/config.mjs";
import {
  buildAgentRegistryPayload,
  runCommand,
  usageText,
  cmdStatus,
  cmdProviders,
  cmdRegisterUser,
  cmdRegisterAgent,
  cmdRegisterAll,
  cmdAgents,
  cmdSync,
  cmdConnect,
  cmdElizaGenerate,
  cmdElizaDeploy,
} from "./src/commands.mjs";
import {
  normalizeBrowserAgents,
  catalogAgentToRegisterBody,
  toRegistryName,
  hubLinks,
  API_SURFACES,
  SITE_SURFACES,
} from "./src/catalog.mjs";
import {
  PROVIDER_ENV_NAMES,
  buildProvidersStatusReport,
} from "./src/providers.mjs";

const __dirname = dirname(fileURLToPath(import.meta.url));
const CLI = join(__dirname, "cheshire-cli.mjs");
const SITE = process.env.CHESHIRE_SITE_URL || DEFAULT_SITE_URL;

// Keep credential side-effects out of the user's home during tests.
if (!process.env.CHESHIRE_CREDENTIALS_PATH) {
  process.env.CHESHIRE_CREDENTIALS_PATH = join(
    process.env.TMPDIR || "/tmp",
    `cheshire-cli-test-creds-${process.pid}.json`,
  );
}

describe("config", () => {
  it("defaults site URL to cheshireterminal.ai", () => {
    const prev = process.env.CHESHIRE_SITE_URL;
    delete process.env.CHESHIRE_SITE_URL;
    delete process.env.CHESHIRE_API_URL;
    try {
      assert.equal(resolveSiteUrl(), "https://cheshireterminal.ai");
      assert.equal(DEFAULT_SITE_URL, "https://cheshireterminal.ai");
      assert.equal(resolveSiteUrl("https://example.test/"), "https://example.test");
    } finally {
      if (prev !== undefined) process.env.CHESHIRE_SITE_URL = prev;
    }
  });

  it("registration JSON points primary services at cheshireterminal.ai", async () => {
    const reg = await loadRegistrationJson(registrationJsonPath("cheshire-registration.json"));
    assert.equal(reg.name, "cheshire-terminal");
    assert.ok(Array.isArray(reg.services));
    for (const svc of reg.services) {
      // Primary registration stays on cheshireterminal.ai (companion dual-hub is dual-hubs.json)
      assert.match(
        String(svc.endpoint),
        /cheshireterminal\.ai/,
        `service ${svc.name} should host on cheshireterminal.ai`,
      );
    }
  });

  it("dual-hubs.json wires cheshireterminal.ai/cli + solanaclawd.com/cli", async () => {
    const dual = JSON.parse(
      await readFile(join(__dirname, "dual-hubs.json"), "utf8"),
    );
    assert.equal(dual.primary.cliHub, "https://cheshireterminal.ai/cli");
    assert.equal(dual.companion.cliHub, "https://solanaclawd.com/cli");
    assert.equal(dual.primary.apiCli, "https://cheshireterminal.ai/api/cli");
    assert.equal(dual.companion.apiCli, "https://solanaclawd.com/api/cli");
    assert.ok(dual.agenticWallet?.package?.includes("cheshire-agentic-wallet"));
  });

  it("cheshire-config includes companion solanaclawd CLI services", async () => {
    const cfg = JSON.parse(
      await readFile(join(__dirname, "cheshire-config.json"), "utf8"),
    );
    assert.equal(cfg.siteUrl, "https://cheshireterminal.ai");
    assert.equal(cfg.companionSiteUrl, "https://solanaclawd.com");
    const endpoints = cfg.services.map((s) => s.endpoint);
    assert.ok(endpoints.includes("https://cheshireterminal.ai/cli"));
    assert.ok(endpoints.includes("https://solanaclawd.com/cli"));
  });

  it("legacy registration files still primary-brand cheshireterminal.ai", async () => {
    for (const name of [
      "clawd-registration.json",
      "solana-clawd-registration.json",
      "clawd-openclaw-config.json",
    ]) {
      const raw = await readFile(join(__dirname, name), "utf8");
      assert.match(raw, /cheshireterminal\.ai/);
    }
  });
});

describe("buildAgentRegistryPayload", () => {
  it("builds DNS-label name and Cheshire register path", () => {
    const payload = buildAgentRegistryPayload(
      {
        name: "My Cool Agent!",
        description: "test",
        services: [{ name: "api", endpoint: "https://cheshireterminal.ai/api" }],
      },
      { siteUrl: "https://cheshireterminal.ai" },
    );
    assert.equal(payload.name, "my-cool-agent");
    assert.equal(payload._cheshire.siteUrl, "https://cheshireterminal.ai");
    assert.equal(payload._cheshire.registerPath, "/api/agent-registry/register");
    assert.equal(payload.labels.app, "cheshire-terminal");
  });
});

describe("usage / help", () => {
  it("usage text documents dual-tier access verify", () => {
    const text = usageText();
    assert.match(text, /access:challenge|access --wallet/);
    assert.match(text, /access:verify/);
    assert.match(text, /access:status/);
    assert.match(text, /public non-holder|public/);
  });

  it("usage text documents Ink interactive shell", () => {
    const text = usageText();
    assert.match(text, /Ink|tui|repl/);
    assert.match(text, /--ink-smoke|ink-smoke/);
  });

  it("usage text is Cheshire branded with dual-host companion", () => {
    const text = usageText();
    assert.match(text, /Cheshire Terminal/);
    assert.match(text, /cheshireterminal\.ai/);
    // Primary hub remains cheshireterminal.ai; companion mesh is solanaclawd.com/cli
    assert.match(text, /cheshireterminal\.ai\/cli/);
    assert.match(text, /solanaclawd\.com\/cli|SOLANA_CLAWD_SITE_URL/);
    assert.match(text, /wallet:status|agentic wallet/i);
  });

  it("usage text is open-source public posture (no holder/sandbox funnel)", () => {
    const text = usageText();
    assert.match(text, /Open-source CLI/);
    assert.match(text, /status/);
    assert.match(text, /skills/);
    assert.match(text, /register:user|SIWS/);
    assert.match(text, /https:\/\/cheshireterminal\.ai/);
    // Scrubbed premium / exclusive / sandbox marketing
    assert.doesNotMatch(text, /holder-gated/i);
    assert.doesNotMatch(text, /\$CLAWD holder developer/i);
    assert.doesNotMatch(text, /ct_os_/);
    assert.doesNotMatch(text, /\/api\/e2b\/install\.sh/);
    assert.doesNotMatch(text, /Oneshot terminal claim/i);
    assert.doesNotMatch(text, /exclusive/i);
    assert.doesNotMatch(text, /monorepo tree/i);
  });

  it("usage text documents eliza:* studio commands", () => {
    const text = usageText();
    assert.match(text, /eliza:status/);
    assert.match(text, /eliza:catalog/);
    assert.match(text, /eliza:package/);
    assert.match(text, /eliza:solizard/);
    assert.match(text, /eliza:generate/);
    assert.match(text, /eliza:deploy/);
    assert.match(text, /\/api\/eliza-agents/);
    assert.match(text, /\/eliza-agents/);
    assert.match(text, /@elizaos\/cheshire-eliza|cheshire-eliza/);
  });

  it("runCommand help returns usage", async () => {
    const { exitCode, text, result } = await runCommand(["help"]);
    assert.equal(exitCode, 0);
    assert.ok(text?.includes("Cheshire Terminal") || result?.help);
  });
});

describe("eliza commands (offline)", () => {
  it("cmdElizaGenerate requires --name", async () => {
    await assert.rejects(
      () => cmdElizaGenerate({ siteUrl: "https://example.test" }),
      /eliza:generate requires --name/,
    );
    await assert.rejects(
      () => cmdElizaGenerate({ siteUrl: "https://example.test", name: "x" }),
      /eliza:generate requires --name/,
    );
  });

  it("cmdElizaDeploy requires --name", async () => {
    await assert.rejects(
      () => cmdElizaDeploy({ siteUrl: "https://example.test" }),
      /eliza:deploy requires --name/,
    );
  });

  it("runCommand dispatches eliza:generate missing name as error exit", async () => {
    const { exitCode, result } = await runCommand(["eliza:generate", "--site", "https://example.test"]);
    assert.equal(exitCode, 1);
    assert.ok(result?.error || result?.message);
    const msg = String(result?.error || result?.message || "");
    assert.match(msg, /eliza:generate requires --name/);
  });

  it("cmdConnect maps eliza agents hubs and APIs", async () => {
    const result = await cmdConnect({ siteUrl: "https://cheshireterminal.ai" });
    assert.equal(result.hubs.elizaAgents, "https://cheshireterminal.ai/eliza-agents");
    assert.equal(result.endpoints.elizaAgents, "https://cheshireterminal.ai/eliza-agents");
    assert.equal(
      result.endpoints.elizaStatus,
      "https://cheshireterminal.ai/api/eliza-agents/status",
    );
    assert.equal(
      result.endpoints.elizaCatalog,
      "https://cheshireterminal.ai/api/eliza-agents/catalog",
    );
    assert.equal(
      result.endpoints.elizaPackage,
      "https://cheshireterminal.ai/api/eliza-agents/package",
    );
    assert.match(result.sourceOfTruth.eliza, /eliza-agents/);
  });
});

describe("CLI process entry", () => {
  it("cheshire-cli.mjs help exits 0 with brand", () => {
    const proc = spawnSync(process.execPath, [CLI, "help"], {
      encoding: "utf8",
      env: { ...process.env, CHESHIRE_SITE_URL: SITE },
    });
    assert.equal(proc.status, 0, proc.stderr);
    assert.match(proc.stdout, /Cheshire Terminal/);
    assert.match(proc.stdout, /cheshireterminal\.ai/);
    assert.match(proc.stdout, /\/cli|install\.sh/);
    // Companion dual-host is documented (not the primary default site).
    assert.match(proc.stdout, /solanaclawd\.com\/cli|SOLANA_CLAWD/);
    assert.doesNotMatch(proc.stdout, /ct_os_/);
    assert.doesNotMatch(proc.stdout, /\/api\/e2b\/install\.sh/);
    assert.doesNotMatch(proc.stdout, /holder-gated/i);
    assert.doesNotMatch(proc.stdout, /exclusive/i);
  });

  it("cheshire-cli.mjs connect reports hub at cheshireterminal.ai/cli", () => {
    const proc = spawnSync(process.execPath, [CLI, "connect"], {
      encoding: "utf8",
      env: { ...process.env, CHESHIRE_SITE_URL: "https://cheshireterminal.ai" },
    });
    assert.equal(proc.status, 0, proc.stderr);
    assert.match(proc.stdout, /cheshireterminal\.ai/);
    assert.match(proc.stdout, /"cliHub":\s*"https:\/\/cheshireterminal\.ai\/cli"/);
    assert.match(proc.stdout, /"cli":\s*"https:\/\/cheshireterminal\.ai\/cli"/);
    // Dual mesh companion hub is present for agentic wallet discovery.
    assert.match(proc.stdout, /solanaclawd\.com\/cli/);
    assert.match(proc.stdout, /agenticWallet|wallet:status/);
  });

  it("cheshire-cli.mjs --ink-smoke mounts Ink and prints success marker", () => {
    const proc = spawnSync(process.execPath, [CLI, "--ink-smoke"], {
      encoding: "utf8",
      env: { ...process.env, CHESHIRE_SITE_URL: "https://cheshireterminal.ai" },
      timeout: 15_000,
    });
    assert.equal(proc.status, 0, proc.stderr || proc.stdout);
    assert.match(proc.stdout, /ink-smoke ok/);
    assert.match(proc.stdout, /Cheshire Terminal|cheshire-cli/);
    assert.match(proc.stdout, /cheshireterminal\.ai/);
  });
});

describe("offline connect command", () => {
  it("cmdConnect defaults site and cliHub to cheshireterminal.ai/cli", async () => {
    const result = await cmdConnect({ siteUrl: "https://cheshireterminal.ai" });
    assert.equal(result.siteUrl, "https://cheshireterminal.ai");
    assert.equal(result.endpoints.cliHub, "https://cheshireterminal.ai/cli");
    assert.equal(result.hubs.cli, "https://cheshireterminal.ai/cli");
    assert.equal(result.npm?.hub, "https://cheshireterminal.ai/cli");
  });
});

describe("provider env keys (DFLOW/HELIUS/SOLANA_TRACKER/JUPITER/PHANTOM/OKX)", () => {
  const REQUIRED = [
    "DFLOW_API_KEY",
    "HELIUS_API_KEY",
    "SOLANA_TRACKER_API_KEY",
    "JUPITER_API_KEY",
    "PHANTOM_APP_ID",
    "OKX_API_KEY",
  ];
  const DUMMY = {
    DFLOW_API_KEY: "dflow_cli_dummy_secret_aaa111",
    HELIUS_API_KEY: "helius_cli_dummy_secret_bbb222",
    SOLANA_TRACKER_API_KEY: "solanatracker_cli_dummy_ccc333",
    JUPITER_API_KEY: "jupiter_cli_dummy_secret_ddd444",
    PHANTOM_APP_ID: "phantom_cli_dummy_app_eee555",
    OKX_API_KEY: "okx_cli_dummy_secret_fff666",
  };

  it("usage documents all six provider env names", () => {
    const text = usageText();
    for (const name of REQUIRED) {
      assert.match(text, new RegExp(name));
    }
    assert.match(text, /providers/);
  });

  it("PROVIDER_ENV_NAMES matches the six required names", () => {
    assert.deepEqual([...PROVIDER_ENV_NAMES].sort(), [...REQUIRED].sort());
  });

  it("cmdProviders and connect report set/unset without leaking secrets", async () => {
    const prev = {};
    for (const name of REQUIRED) {
      prev[name] = process.env[name];
      process.env[name] = DUMMY[name];
    }
    try {
      const providers = cmdProviders();
      assert.equal(providers.ok, true);
      assert.deepEqual([...providers.envNames].sort(), [...REQUIRED].sort());
      assert.equal(providers.setCount, 6);
      assert.ok(providers.providers.every((p) => p.set === true));

      const connect = await cmdConnect({ siteUrl: "https://cheshireterminal.ai" });
      assert.ok(connect.providers);
      assert.equal(connect.providers.setCount, 6);

      const blob = JSON.stringify({ providers, connect });
      for (const v of Object.values(DUMMY)) {
        assert.equal(
          blob.includes(v),
          false,
          `secret value must not appear in CLI output: ${v.slice(0, 12)}…`,
        );
      }
    } finally {
      for (const name of REQUIRED) {
        if (prev[name] === undefined) delete process.env[name];
        else process.env[name] = prev[name];
      }
    }
  });

  it("runCommand providers dispatches to cmdProviders", async () => {
    const { exitCode, result } = await runCommand(["providers"]);
    assert.equal(exitCode, 0);
    assert.ok(result?.envNames);
    for (const name of REQUIRED) {
      assert.ok(result.envNames.includes(name), `missing ${name}`);
    }
  });

  it("cheshire-config.json lists provider env placeholders", async () => {
    const raw = await readFile(join(__dirname, "cheshire-config.json"), "utf8");
    const cfg = JSON.parse(raw);
    for (const name of REQUIRED) {
      assert.ok(
        Object.prototype.hasOwnProperty.call(cfg.env, name),
        `cheshire-config.json env missing ${name}`,
      );
    }
  });

  it("buildProvidersStatusReport never embeds values", () => {
    process.env.HELIUS_API_KEY = "must_not_leak_helius_xyz";
    const report = buildProvidersStatusReport();
    const text = JSON.stringify(report);
    assert.equal(text.includes("must_not_leak_helius_xyz"), false);
    assert.ok(report.envNames.includes("HELIUS_API_KEY"));
  });
});

/**
 * True when an error/result came from a dead network path (DNS, timeout,
 * unreachable host) rather than a real assertion-worthy failure. Live tests
 * skip instead of failing so `npm test` stays green in offline/sandboxed dev
 * environments (see [[client.mjs]] which normalizes these into
 * CheshireHttpError with this message shape).
 */
const isNetworkError = (err) => {
  const text = String(err?.message || err?.error || JSON.stringify(err) || "");
  return /Network error reaching|Request timed out|fetch failed|ETIMEDOUT|EHOSTUNREACH|ENOTFOUND|ECONNREFUSED/i.test(
    text,
  );
};

describe("live site commands (network)", () => {
  it("status returns developer/skills/registry fields", async (t) => {
    const result = await cmdStatus({ siteUrl: SITE });
    if (result.errors?.length && result.errors.every(isNetworkError)) {
      t.skip("offline — cheshireterminal.ai unreachable");
      return;
    }
    assert.equal(result.brand, "Cheshire Terminal");
    assert.equal(result.siteUrl.replace(/\/$/, ""), SITE.replace(/\/$/, ""));
    assert.ok(
      result.developer?.status === "ok" ||
        (typeof result.skills?.count === "number" && result.skills.count > 0) ||
        result.registry?.ok === true,
      `expected healthy public surface, got ${JSON.stringify(result.errors)}`,
    );
    if (result.developer?.status) {
      assert.equal(result.developer.status, "ok");
    }
    if (typeof result.skills?.count === "number") {
      assert.ok(result.skills.count > 0);
    }
  });

  it("register:user challenge returns signable payload", async (t) => {
    // Valid ed25519 pubkey shape (from live probe earlier / generated-like)
    const wallet = "HLzhCjtss8z7Ava8fq3nqfpaVSJTEd69HCA9fP1dbSYU";
    let result;
    try {
      result = await cmdRegisterUser({ siteUrl: SITE, wallet });
    } catch (err) {
      if (isNetworkError(err)) return t.skip("offline — cheshireterminal.ai unreachable");
      throw err;
    }
    assert.equal(result.mode, "siws-challenge");
    assert.ok(result.challenge?.message);
    assert.ok(result.challenge?.nonce);
    assert.match(result.challenge.message, /Wallet:/);
    assert.match(result.siteUrl, /cheshireterminal\.ai/);
    assert.doesNotMatch(JSON.stringify(result), /solanaclawd\.com/);
  });

  it("register:agent dry-run targets Cheshire register path", async () => {
    const result = await cmdRegisterAgent({
      siteUrl: SITE,
      file: registrationJsonPath("cheshire-registration.json"),
      name: `cli-test-${Date.now().toString(36)}`,
      confirm: false,
    });
    assert.equal(result.mode, "dry-run");
    assert.equal(result.ok, true);
    assert.match(result.targetUrl, /cheshireterminal\.ai\/api\/agent-registry\/register/);
    assert.ok(result.payload?.name);
    // Register payload targets Cheshire primary (not companion marketplace).
    assert.match(result.targetUrl, /cheshireterminal\.ai/);
  });

  it("connect surfaces Cheshire endpoints including gateway + dual mesh", async () => {
    const result = await cmdConnect({ siteUrl: SITE });
    assert.match(result.endpoints.api, /cheshireterminal\.ai\/api/);
    assert.match(result.endpoints.gateway, /cheshireterminal\.ai\/gateway/);
    assert.match(result.endpoints.gatewayStatus, /\/api\/gateway\/status/);
    assert.match(result.endpoints.cliHub, /\/cli/);
    assert.match(result.endpoints.elizaAgents || "", /\/eliza-agents/);
    assert.match(result.endpoints.elizaStatus || "", /\/api\/eliza-agents\/status/);
    assert.equal(result.endpoints.agentsGithub, "https://github.com/Solizardking/agents");
    assert.equal(result.endpoints.cliGithub, "https://github.com/Solizardking/cli");
    assert.equal(result.endpoints.elizaGithub, "https://github.com/Solizardking/eliza");
    assert.equal(
      result.endpoints.cheshireTerminalGithub,
      "https://github.com/Solizardking/cheshire-terminal",
    );
    assert.ok(
      (result.openSource?.repos?.length ?? 0) >= 4,
      "open-source repo catalog should list at least the core four",
    );
    assert.equal(result.openSource?.productHubs?.agents, "https://cheshireterminal.ai/agents");
    assert.equal(
      result.openSource?.productHubs?.elizaAgents,
      "https://cheshireterminal.ai/eliza-agents",
    );
    assert.equal(result.credentials.envApiKey, "CHESHIRE_API_KEY");
    assert.equal(result.credentials.envCompanion, "SOLANA_CLAWD_SITE_URL");
    assert.equal(result.npm?.package, "cheshire-terminal-cli");
    assert.match(result.npm?.install || "", /cheshire-terminal-cli/);
    assert.equal(result.npm?.companionHub, "https://solanaclawd.com/cli");
    assert.equal(result.forgePackage.npm, "cheshire-terminal-agents");
    assert.ok(result.agenticWallet?.package?.includes("cheshire-agentic-wallet"));
    assert.ok(result.dualHubs?.some((h) => h.cliHub === "https://cheshireterminal.ai/cli"));
    assert.ok(result.dualHubs?.some((h) => h.cliHub === "https://solanaclawd.com/cli"));
  });

  it("eliza:status hits public studio API", async () => {
    const { exitCode, result } = await runCommand(["eliza:status", "--site", SITE]);
    // Live site may or may not expose the route yet; accept ok or structured HTTP error
    if (exitCode === 0 && result?.ok) {
      assert.equal(result.brand, "Cheshire Terminal");
      assert.match(result.page || "", /\/eliza-agents/);
      assert.ok(result.status || result.cli);
      if (result.cli?.commands) {
        assert.ok(result.cli.commands.some((c) => String(c).includes("eliza:")));
      }
    } else {
      assert.ok(
        result?.error || result?.status >= 400 || exitCode === 1,
        `unexpected eliza:status shape: ${JSON.stringify(result)}`,
      );
    }
  });

  it("eliza:catalog returns characters when available", async () => {
    const { exitCode, result } = await runCommand(["eliza:catalog", "--site", SITE]);
    if (exitCode === 0 && result?.ok) {
      const chars = result.catalog?.characters;
      assert.ok(Array.isArray(chars) || result.catalog);
    } else {
      assert.ok(result?.error || exitCode === 1);
    }
  });

  it("runCommand status via dispatcher", async (t) => {
    const { exitCode, result } = await runCommand(["status", "--site", SITE]);
    if (exitCode !== 0 && result?.errors?.length && result.errors.every(isNetworkError)) {
      t.skip("offline — cheshireterminal.ai unreachable");
      return;
    }
    assert.equal(exitCode, 0);
    assert.ok(result.siteUrl.includes("cheshireterminal.ai"));
  });

  const isStaleHost402 = (err) => {
    const text = String(err?.message || err?.error || JSON.stringify(err) || "");
    return /Payment required|"status":\s*402|status:\s*402|x402Version/i.test(text);
  };
  const isSkippableLiveError = (err) => isStaleHost402(err) || isNetworkError(err);

  it("agents:list returns catalog ids from live browser-agents", async (t) => {
    // The catalog GET is free-bootstrapped in source (isX402FreeBootstrapPath),
    // but a stale production host may still 402 until redeployed, and a dev
    // sandbox may simply be offline. Skip instead of failing in either case.
    let result;
    try {
      result = await cmdAgents({ siteUrl: SITE, list: true });
    } catch (err) {
      if (isSkippableLiveError(err)) return t.skip("offline or stale host — skipping");
      throw err;
    }
    assert.ok(result.count > 0);
    assert.ok(Array.isArray(result.identifiers));
    assert.ok(result.identifiers.length > 0);
    assert.match(result.hub, /\/agents$/);
  });

  it("register:agent --id dry-run uses catalog agent", async (t) => {
    let list;
    try {
      list = await cmdAgents({ siteUrl: SITE, list: true });
    } catch (err) {
      if (isSkippableLiveError(err)) return t.skip("offline or stale host — skipping");
      throw err;
    }
    const id = list.identifiers?.[0];
    assert.ok(id, "need at least one catalog agent");
    const result = await cmdRegisterAgent({
      siteUrl: SITE,
      id,
      confirm: false,
    });
    assert.equal(result.mode, "dry-run");
    assert.equal(result.source, "browser-agents");
    assert.ok(result.payload?.name);
    assert.match(result.frontend?.registry || "", /agent-registry/);
  });

  it("register:all dry-run covers catalog slice", async (t) => {
    // Same deployment-lag / offline tolerance (prepublishOnly runs this suite).
    let result;
    try {
      result = await cmdRegisterAll({
        siteUrl: SITE,
        confirm: false,
        limit: 3,
      });
    } catch (err) {
      if (isSkippableLiveError(err)) return t.skip("offline or stale host — skipping");
      throw err;
    }
    assert.equal(result.mode, "dry-run");
    assert.equal(result.attempted, 3);
    assert.equal(result.succeeded, 3);
  });

  it("sync reports skills + agents + registry hubs", async (t) => {
    const result = await cmdSync({ siteUrl: SITE });
    if (!result.ok && result.errors?.length && result.errors.every(isNetworkError)) {
      t.skip("offline — cheshireterminal.ai unreachable");
      return;
    }
    assert.ok(result.skills?.count > 0 || result.agents?.count > 0);
    assert.match(result.hubs?.skills || "", /\/skills/);
    assert.match(result.hubs?.agents || "", /\/agents/);
    assert.match(result.hubs?.registry || "", /agent-registry/);
    assert.ok(result.sourceOfTruth?.hubUi);
  });
});

describe("catalog helpers", () => {
  it("toRegistryName and hubLinks", () => {
    assert.equal(toRegistryName("Air Drop Hunter!"), "air-drop-hunter");
    const hubs = hubLinks("https://cheshireterminal.ai");
    assert.equal(hubs.cli, "https://cheshireterminal.ai/cli");
    assert.equal(hubs.gateway, "https://cheshireterminal.ai/gateway");
    assert.equal(hubs.agents, "https://cheshireterminal.ai/agents");
    assert.equal(hubs.elizaAgents, "https://cheshireterminal.ai/eliza-agents");
    assert.equal(hubs.api.elizaStatus, "https://cheshireterminal.ai/api/eliza-agents/status");
    assert.equal(hubs.api.elizaGenerate, "https://cheshireterminal.ai/api/eliza-agents/generate");
    assert.equal(SITE_SURFACES.elizaAgents, "/eliza-agents");
    assert.equal(API_SURFACES.elizaDeploy, "/api/eliza-agents/deploy");
  });

  it("normalizeBrowserAgents + register body", () => {
    const n = normalizeBrowserAgents({
      count: 1,
      agents: [
        {
          id: "airdrop-hunter",
          title: "DeFi Airdrop Hunter",
          description: "Hunt airdrops",
          category: "trading",
          tags: ["airdrop"],
        },
      ],
    });
    assert.equal(n.count, 1);
    assert.equal(n.agents[0].registryName, "airdrop-hunter");
    const body = catalogAgentToRegisterBody(n.agents[0]);
    assert.equal(body.name, "airdrop-hunter");
    assert.match(body.title, /Airdrop/);
  });
});

describe("open-source package cleanliness", () => {
  it("tracked package files have no full secrets", async () => {
    const { readdir, readFile, stat } = await import("node:fs/promises");
    const { join } = await import("node:path");
    const secretRes = [
      /ct_sk_[A-Za-z0-9]{16,}/,
      /sk_live_[A-Za-z0-9]{10,}/,
      /BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY/,
      /PRIVATE_KEY\s*=\s*['"]?[A-Za-z0-9+/=]{20,}/i,
    ];
    const skip = new Set([".git", "node_modules"]);
    async function walk(dir, out = []) {
      for (const name of await readdir(dir)) {
        if (skip.has(name) || name.startsWith(".")) continue;
        const full = join(dir, name);
        const st = await stat(full);
        if (st.isDirectory()) await walk(full, out);
        else if (/\.(mjs|js|ts|json|md|sh|svg)$/i.test(name) || name === "LICENSE" || name === ".gitignore") {
          out.push(full);
        }
      }
      return out;
    }
    const files = await walk(__dirname);
    const hits = [];
    for (const file of files) {
      const body = await readFile(file, "utf8");
      for (const re of secretRes) {
        if (re.test(body)) hits.push(`${file}: ${re}`);
      }
    }
    assert.deepEqual(hits, [], `secret-like material: ${hits.join("; ")}`);
  });

  it("README is standalone OSS without premium sandbox funnel", async () => {
    const raw = await readFile(join(__dirname, "README.md"), "utf8");
    assert.match(raw, /Open-source CLI|open-source/i);
    assert.match(raw, /npm i -g cheshire-terminal-cli|npm i -g cheshire-terminal-cli/);
    assert.match(raw, /\/api\/cli\/install\.sh/);
    assert.match(raw, /MIT/);
    assert.doesNotMatch(raw, /holder-gated/i);
    assert.doesNotMatch(raw, /holder mint/i);
    assert.doesNotMatch(raw, /ct_os_/);
    assert.doesNotMatch(raw, /\/api\/e2b\/install\.sh/);
    assert.doesNotMatch(raw, /From this monorepo/);
    assert.doesNotMatch(raw, /pnpm test:cli/);
    assert.doesNotMatch(raw, /server\/routes\/cli\.test/);
  });
});