PaperClipAI/packages/paperclip-runner/scripts/patch-kimi-runtime.test.mjs

import assert from "node:assert/strict";
import { createHash } from "node:crypto";
import { access, mkdir, mkdtemp, readFile, realpath, rm, writeFile } from "node:fs/promises";
import { createServer } from "node:http";
import { createRequire } from "node:module";
import { tmpdir } from "node:os";
import { dirname, join } from "node:path";
import { fileURLToPath, pathToFileURL } from "node:url";
import test from "node:test";
import { runInNewContext } from "node:vm";
import { createKimiInstructionRuntime } from "./kimi-instructions-runtime.mjs";
import { KIMI_RUNTIME_PATCH, patchKimiRuntime, patchKimiRuntimeSource, replaceKimiPatchAnchor } from "./patch-kimi-runtime.mjs";

const sha = text => createHash("sha256").update(text, "utf8").digest("hex");
const binding = content => JSON.stringify({ schema: "paperclip.kimi.instructions.v1", content,
  digest: `sha256:${sha(content)}`, byteLength: Buffer.byteLength(content) });
const runtime = raw => createKimiInstructionRuntime(raw, { createHash, byteLength: text => Buffer.byteLength(text, "utf8") });

test("native instruction binding preserves exact literals and rejects false readback", () => {
  const content = "\nGovernance: résumé 日本語 ${cwd} ${base_prompt}\n\n";
  const state = runtime(binding(content));
  const native = "Original native system prompt";
  const effective = `${native}\n\n${content}`;
  assert.equal(state.append(native), effective);
  assert.equal(state.append(effective), effective);
  const receipt = state.receipt("native-session", effective);
  assert.deepEqual(receipt, { schema: "paperclip.kimi.instructions.v1", sessionId: "native-session",
    digest: `sha256:${sha(content)}`, byteLength: Buffer.byteLength(content),
    effectiveDigest: `sha256:${sha(effective)}`, effectiveByteLength: Buffer.byteLength(effective) });
  assert.throws(() => state.receipt("native-session", native), /binding/);
  assert.throws(() => state.receipt("", effective), /binding/);
  assert.throws(() => state.append("x".repeat(2_097_153)), /binding/);
  assert.ok(Object.isFrozen(receipt));
});

test("explicit empty instructions retain the native prompt and acknowledge zero bytes", () => {
  const state = runtime(binding(""));
  assert.equal(state.append("native"), "native");
  assert.equal(state.receipt("s", "native").byteLength, 0);
});

test("malformed, changed, oversized, and ill-formed instruction bindings fail closed", () => {
  const valid = JSON.parse(binding("test"));
  for (const raw of [undefined, "{", "[]", "null", " ".repeat(200_001),
    binding("x\0y"), binding("x".repeat(32_769)), binding("\ud800"),
    JSON.stringify({ ...valid, byteLength: 1 }), JSON.stringify({ ...valid, digest: "sha256:" + "0".repeat(64) }),
    JSON.stringify({ ...valid, extra: true }), JSON.stringify({ schema: valid.schema, content: "test", digest: valid.digest })]) {
    assert.throws(() => runtime(raw), /binding/);
  }
});

test("patch rejects unknown source and ambiguous anchors before writing", async () => {
  assert.throws(() => patchKimiRuntimeSource("unverified runtime"), /input digest/);
  assert.throws(() => replaceKimiPatchAnchor("absent", "needle", "replacement"), /exactly one/);
  assert.throws(() => replaceKimiPatchAnchor("needle needle", "needle", "replacement"), /exactly one/);
  const root = await mkdtemp(join(tmpdir(), "kimi-patch-test-"));
  const path = join(root, "main.mjs");
  try {
    await writeFile(path, "unverified runtime");
    await assert.rejects(patchKimiRuntime(path), /input digest/);
    assert.equal(await readFile(path, "utf8"), "unverified runtime");
  } finally { await rm(root, { recursive: true, force: true }); }
});

function segment(source, start, end) {
  const first = source.indexOf(start);
  assert.ok(first >= 0, `Missing native start: ${start}`);
  const last = source.indexOf(end, first + start.length);
  assert.ok(last > first, `Missing native end: ${end}`);
  return source.slice(first, last);
}

test("pinned native package binds new/load and rejects failed turns", {
  skip: !process.env.PAPERCLIP_KIMI_VENDOR_MAIN,
}, async () => {
  const input = await readFile(process.env.PAPERCLIP_KIMI_VENDOR_MAIN, "utf8");
  const patched = patchKimiRuntimeSource(input);
  assert.equal(sha(patched), KIMI_RUNTIME_PATCH.patchedSha256);
  const { build } = await import("esbuild");
  const bundledRoot = await mkdtemp(join(tmpdir(), "kimi-bundled-patch-test-"));
  try {
    const bundledPath = join(bundledRoot, "patch-kimi-runtime.bundle.cjs");
    await build({ entryPoints: [fileURLToPath(new URL("./patch-kimi-runtime.mjs", import.meta.url))],
      outfile: bundledPath, bundle: true, platform: "node", format: "cjs", target: "node24", logLevel: "silent",
      define: { "import.meta.url": JSON.stringify(pathToFileURL(bundledPath).href) } });
    const bundled = (await import(pathToFileURL(bundledPath))).default;
    assert.equal(sha(bundled.patchKimiRuntimeSource(input)), KIMI_RUNTIME_PATCH.patchedSha256,
      "installed bundled patcher produces exactly the same pinned native bytes");
  } finally { await rm(bundledRoot, { recursive: true, force: true }); }
  const content = " Exact ${cwd} instructions\n日本語\n";
  const env = { PAPERCLIP_KIMI_INSTRUCTIONS: binding(content) };
  const helper = segment(patched, "let paperclipKimiInstructionSnapshot;", "import { fileURLToPath");
  const context = { process: { env }, Buffer, paperclipKimiCreateHash: createHash };
  const state = runInNewContext(`${helper};paperclipKimiInstructionState()`, context);
  assert.equal(env.PAPERCLIP_KIMI_INSTRUCTIONS, undefined);
  env.PAPERCLIP_KIMI_INSTRUCTIONS = binding("replacement");
  assert.equal(runInNewContext("paperclipKimiInstructionState()", context), state);
  env.KIMI_API_KEY = "fake-provider-key";
  env.PAPERCLIP_TASK_SCOPED = "assigned-task-value";
  const childEnvironment = segment(patched, "function buildEnv(overrides) {", "function waitForSpawn(child)");
  const buildEnvironment = runInNewContext(`${childEnvironment};buildEnv`, context);
  for (const overrides of [undefined, { KIMI_API_KEY: "override-key", PAPERCLIP_KIMI_INSTRUCTIONS: "private", EXTRA: "assigned" }]) {
    const child = buildEnvironment(overrides);
    assert.equal(child.KIMI_API_KEY, undefined);
    assert.equal(child.PAPERCLIP_KIMI_INSTRUCTIONS, undefined);
    assert.equal(child.PAPERCLIP_TASK_SCOPED, "assigned-task-value");
    assert.equal(child.EXTRA, overrides?.EXTRA);
  }
  assert.equal(env.KIMI_API_KEY, "fake-provider-key");
  const terminalBinding = segment(patched, "\t\tbindTerminalCapability(terminal) {", "\n\t\tget terminalEnabled()");
  const bindTerminal = runInNewContext(`({${terminalBinding}}).bindTerminalCapability`);
  const terminalHolder = {};
  bindTerminal.call(terminalHolder, true);
  assert.equal(terminalHolder._terminalEnabled, false);
  const getter = segment(patched, "\t\tget systemPrompt() {", "\t\tget thinkingLevel()");
  const native = runInNewContext(`({profileState:{systemPrompt:"native"},${getter}})`, context);
  assert.equal(native.systemPrompt, `native\n\n${content}`);
  assert.equal(native.profileState.systemPrompt, "native");
  const receipt = state.receipt("s", native.systemPrompt);
  const baseline = segment(patched, "\t\tmerged() {\n\t\t\treturn {};", "\n\t\tasync watchConfigFiles()");
  const merged = runInNewContext(`({${baseline}}).merged`, context);
  assert.deepEqual(Object.keys(merged.call(new Proxy({}, { get: () => assert.fail("ambient MCP was read") }))), []);
  const policy = segment(patched, '\t\tasync evaluate(context) {\n\t\t\treturn { policyName: "paperclip-runner"', '\n\t};');
  const evaluate = runInNewContext(`({${policy}}).evaluate`, context);
  assert.equal((await evaluate.call(new Proxy({}, { get: () => assert.fail("native heuristic was read") }), {})).result.kind, "ask");
  const userRoots = segment(patched, "async function userRoots(homeDir, osHomeDir, options = {}) {", "async function projectRoots(");
  const discovered = [];
  const roots = await runInNewContext(`(${userRoots})`, { USER_BRAND_DIRS$1: ["skills"],
    pushBrandGroup: async (_roots, _dirs, home) => { discovered.push(home); },
    pushFirstExisting$1: () => assert.fail("global skills were read") })("/owned-kimi", "/ambient-home");
  assert.deepEqual(discovered, ["/owned-kimi"]);
  assert.equal(roots.length, 0);
  const host = { klient: { session: () => ({ agent: () => ({}) }) },
    bindDefaultModel: async () => {}, bindSessionRuntime: async () => undefined };
  const wire = segment(patched, "\t\tasync wireSession(sessionId) {", "\n\t\t/**");
  await assert.rejects(runInNewContext(`({${wire}}).wireSession`, context).call(host, "s"), /native instruction receipt/);
  const admitted = { ensureAuthed: async () => {}, klient: { global: { sessions: { create: async () => ({ id: "s" }) } } },
    activateSession: async () => ({}), paperclipInstructionReceipts: new Map([["s", receipt]]) };
  const create = segment(patched, "\t\tasync newSession(params) {", "\n\t\t/**");
  const createContext = { ...context, acpMcpServersToConfigRecord: value => value };
  const created = await runInNewContext(`({${create}}).newSession`, createContext).call(admitted, { cwd: "/workspace", mcpServers: [] });
  assert.equal(created._meta.paperclipKimiInstructions, receipt);
  for (const [name, next] of [["loadSession", "resumeSession"], ["resumeSession", "listSessions"]]) {
    const method = segment(patched, `\t\tasync ${name}(params) {`, `\t\tasync ${next}(params)`);
    const response = await runInNewContext(`({${method}}).${name}`, createContext).call({ ...admitted,
      warnIgnoredAdditionalDirs() {}, scheduleAvailableCommandsUpdate() {},
      resumeAcpSession: async () => ({ replayHistory: async () => {}, configOptions: async () => [], modeState: () => ({}) }) },
    { sessionId: "s", mcpServers: [] });
    assert.equal(response._meta.paperclipKimiInstructions, receipt);
  }
  const terminal = segment(patched, "\t\tonTurnEnded(event) {", "\n\t\t/**");
  const rejection = [];
  const RequestError = { authRequired: () => ({ kind: "auth" }), internalError: data => data };
  const end = runInNewContext(`({${terminal}}).onTurnEnded`, { RequestError$1: RequestError,
    isAuthError: error => error?.code === "provider.auth_error", turnEndReasonToStopReason: () => "end_turn" });
  for (const code of ["provider.auth_error", "provider.server_error"]) {
    end.call({ driverFor: () => ({ reject: error => rejection.push(error), resolve: () => assert.fail("failed turn resolved") }),
      settleDriver: (_driver, action) => action(), emitUsageUpdate() {} }, { turnId: 1, reason: "failed", error: { code } });
  }
  assert.equal(rejection[0].kind, "auth");
  assert.equal(rejection[1].kind, "provider_failed");
  const infer = segment(patched, "function inferToolKind(name) {", "\n/**");
  const approval = segment(patched, "function buildPermissionToolCallUpdate(req) {", "\n/**");
  const permission = runInNewContext(`${infer}\n${approval}\nbuildPermissionToolCallUpdate`, {
    displayBlockToAcpContent: () => null, acpToolCallId: (turn, id) => `${turn}:${id}`,
  });
  for (const [toolName, kind] of [["Write", "edit"], ["Edit", "edit"], ["Read", "read"], ["Bash", "execute"], ["mcp__paperclip__read_workspace_file", "other"]]) {
    const args = { path: "/workspace/exact.txt", content: "body" };
    const request = permission({ toolName, toolInput: args, toolCallId: "native-tool", turnId: 1, display: {}, action: "test" });
    assert.equal(request.kind, kind);
    assert.equal(request.rawInput, args);
    assert.equal(request.toolCallId, "1:native-tool");
  }
});

test("native step identity separates identical commentary/final text and retains empty boundaries", {
  skip: !process.env.PAPERCLIP_KIMI_VENDOR_MAIN,
}, async () => {
  const patched = patchKimiRuntimeSource(await readFile(process.env.PAPERCLIP_KIMI_VENDOR_MAIN, "utf8"));
  const methods = segment(patched, "\t\tpaperclipKimiMessageFailure(driver) {", "\n\t\tonToolCallStarted(event)");
  const host = () => {
    const events = [], rejected = [];
    const driver = { reject: value => rejected.push(value) };
    const session = runInNewContext(`new class {${methods}}`, { paperclipKimiCreateHash: createHash,
      RequestError$1: { internalError: value => value } });
    Object.assign(session, { sessionId: "native-session", emit: value => events.push(value),
      driverFor: turnId => turnId === 7 && !driver.settled ? driver : undefined,
      settleDriver: (value, action) => { value.settled = true; action(); } });
    return { session, events, rejected, driver };
  };
  const h = host();
  h.session.paperclipKimiStep({ turnId: 7, step: 1, stepId: "native-step-uuid-one" }, "start");
  h.session.onAssistantDelta({ turnId: 7, delta: "SAME café" });
  h.session.onThinkingDelta({ turnId: 7, delta: "reasoning" });
  h.session.paperclipKimiStep({ turnId: 7, step: 1, stepId: "native-step-uuid-one", finishReason: "tool_use" }, "end");
  h.session.paperclipKimiStep({ turnId: 7, step: 2, stepId: "native-step-uuid-two" }, "start");
  h.session.onAssistantDelta({ turnId: 7, delta: "SAME café" });
  h.session.paperclipKimiStep({ turnId: 7, step: 2, stepId: "native-step-uuid-two", finishReason: "end_turn" }, "end");
  h.session.paperclipKimiStep({ turnId: 7, step: 3, stepId: "native-step-uuid-empty" }, "start");
  h.session.paperclipKimiStep({ turnId: 7, step: 3, stepId: "native-step-uuid-empty", finishReason: "end_turn" }, "end");
  const chunks = h.events.map(event => event.update);
  assert.equal(h.rejected.length, 0);
  assert.deepEqual(chunks.map(chunk => chunk._meta.kind), ["start", "delta", "delta", "end:tool_use", "start", "delta", "end:end_turn", "start", "end:end_turn"]);
  assert.equal(chunks[0].messageId, `kimi-message-${sha(JSON.stringify(["native-session", 7, "native-step-uuid-one"]))}`);
  assert.equal(new Set(chunks.map(chunk => chunk.messageId)).size, 3);
  assert.equal(chunks[2].sessionUpdate, "agent_thought_chunk");
  assert.ok(chunks.every(chunk => chunk._meta.origin === "kimi-native-assistant" && chunk._meta.source === "kimi-turn-step-v1"));
  assert.ok(chunks.filter(chunk => chunk._meta.kind !== "delta").every(chunk => chunk.content.text === ""));
  h.session.onAssistantDelta({ turnId: 8, delta: "foreign turn" });
  assert.equal(h.events.length, 9);
  for (const mutate of [
    value => value.session.onAssistantDelta({ turnId: 7, delta: "orphan" }),
    value => { value.session.paperclipKimiStep({ turnId: 7, step: 1, stepId: "uuid" }, "start"); value.session.paperclipKimiStep({ turnId: 7, step: 2, stepId: "other" }, "start"); },
    value => { value.session.paperclipKimiStep({ turnId: 7, step: 1, stepId: "uuid" }, "start"); value.session.paperclipKimiStep({ turnId: 7, step: 1, stepId: "foreign", finishReason: "end_turn" }, "end"); },
    value => { value.session.paperclipKimiStep({ turnId: 7, step: 1, stepId: "uuid" }, "start"); value.session.paperclipKimiStep({ turnId: 7, step: 1, stepId: "uuid", finishReason: "invented" }, "end"); },
    value => { value.session.paperclipKimiStep({ turnId: 7, step: 1, stepId: "uuid" }, "start"); value.session.paperclipKimiStep({ turnId: 7, step: 1, reason: "aborted" }, "interrupted"); value.session.paperclipKimiStep({ turnId: 7, step: 2, stepId: "uuid" }, "start"); },
  ]) {
    const invalid = host(); mutate(invalid);
    assert.equal(invalid.rejected.length, 1);
    assert.equal(invalid.rejected[0].kind, "message_boundary_invalid");
    const count = invalid.events.length;
    invalid.session.onAssistantDelta({ turnId: 7, delta: "late after failure" });
    assert.equal(invalid.events.length, count);
  }
});

test("real pinned Kimi and ACPX exchange instructions/tools/denial/errors with a simulated local model service", {
  skip: process.env.PAPERCLIP_TEST_KIMI_MODEL_PEER !== "1",
  timeout: 60_000,
}, async t => {
  const packageRoot = await realpath(fileURLToPath(new URL("../", import.meta.url)));
  const assets = join(packageRoot, "provider-assets/kimi", `${process.platform}-${process.arch}`);
  try { await access(join(assets, "native-closure.json")); }
  catch (error) {
    if (error.code !== "ENOENT") throw error;
    t.skip("Install the pinned Kimi runtime with paperclipai runtime setup kimi first");
    return;
  }
  const { tsImport } = await import("tsx/esm/api");
  const selectorPeer = process.env.PAPERCLIP_TEST_KIMI_FAULT_SELECTOR_PEER === "1";
  let compiledFactory;
  if (selectorPeer) {
    assert.equal(process.platform, "darwin"); assert.equal(process.arch, "arm64");
    const cli = join(packageRoot, "dist/cli/acpx-runtime-sidecar.cjs");
    const compiled = await readFile(cli, "utf8");
    const boundary = "var lines = (0, import_node_readline.createInterface)({";
    const at = compiled.indexOf(boundary);
    assert.ok(at > 0 && compiled.lastIndexOf(boundary) === at && Buffer.byteLength(compiled) <= 16 * 1024 * 1024);
    const module = { exports: {} };
    new Function("require", "module", "exports", "__filename", "__dirname", compiled.slice(0, at).replace(/^#![^\n]*\n/, "\n")
      + "\nmodule.exports={verifyKimiInstallation,QUALIFIED_ACPX_PROFILES,acquireAcpxProviderLifetimeLease,createAcpxSidecarHostEnvironment,createSanitizedAcpxSpawnInput};")(
      createRequire(cli), module, module.exports, cli, dirname(cli));
    compiledFactory = module.exports;
  }
  // Mirrors the runtime adapter: the exact outbound permission reply proves delivery.
  const { createAcpxPermissionReplyConfirmations } = await tsImport("../src/drivers/acpx/interaction-delivery.ts", import.meta.url);
  const [{ verifyKimiInstallation }, { QUALIFIED_ACPX_PROFILES }, { kimiManagedConfiguration }, instructionModule, { createKimiMessageProjection }, { normalizeAcpxPermission }, environmentModule, { configuredEnvironmentProjection, CONFIGURED_ENVIRONMENT_KEYS }] = await Promise.all([
    tsImport("../src/drivers/acpx/kimi-installation.ts", import.meta.url),
    tsImport("../src/drivers/acpx/qualified-profiles.ts", import.meta.url),
    tsImport("../src/drivers/acpx/kimi-config.ts", import.meta.url),
    tsImport("../src/drivers/acpx/kimi-instructions.ts", import.meta.url),
    tsImport("../src/drivers/acpx/kimi-message-boundary.ts", import.meta.url),
    tsImport("../src/drivers/acpx/acp-permission-adapter.ts", import.meta.url),
    tsImport("../src/drivers/acpx/environment.ts", import.meta.url),
    tsImport("../src/configured-environment.ts", import.meta.url),
  ]);
  const { createAcpRuntime, createFileSessionStore } = await import(pathToFileURL(join(packageRoot, "node_modules/acpx/dist/runtime.js")));
  const root = await realpath(await mkdtemp(join(tmpdir(), "kimi-simulated-model-peer-")));
  const home = join(root, "home"), workspace = join(root, "workspace");
  await mkdir(home, { mode: 0o700 }); await mkdir(workspace);
  const instructions = "\nExact governance café 日本語 ${cwd} ${base_prompt}\nKeep the final LF.\n";
  const selectedModel = "kimi-for-coding";
  const binding = instructionModule.kimiInstructionBinding(instructions);
  const argumentsObject = { payload: "café 🧪\n${literal}", nested: { count: 0, empty: {}, flag: false } };
  const toolReceipt = sha(JSON.stringify(argumentsObject));
  const deniedPath = join(workspace, "denied-peer.txt");
  const notificationEnvironment = {
    PAPERCLIP_RUNTIME_NOTIFICATION_CONTEXT: join(root, "controlled-notification-context.json"),
    PAPERCLIP_RUNTIME_NOTIFICATION_HELPER: join(root, "controlled-notification-helper"),
  };
  await writeFile(notificationEnvironment.PAPERCLIP_RUNTIME_NOTIFICATION_CONTEXT, '{"controlledEnvironmentOnly":true}\n', { flag: "wx", mode: 0o600 });
  await writeFile(notificationEnvironment.PAPERCLIP_RUNTIME_NOTIFICATION_HELPER, "controlled path fixture\n", { flag: "wx", mode: 0o700 });
  const shellQuote = value => "'" + value.replaceAll("'", "'\\''") + "'";
  const notificationChecks = Object.entries(notificationEnvironment).map(([key, value]) => `if test "$${key}" != ${shellQuote(value)}; then printf "NOTIFICATION_DISCOVERY_CHANGED"; exit 1; fi; `).join("");
  const bashArguments = { command: 'if test -n "${KIMI_API_KEY+x}"; then printf "PROVIDER_KEY_PRESENT"; exit 1; fi; if test -n "${PAPERCLIP_KIMI_INSTRUCTIONS+x}"; then printf "PRIVATE_BINDING_PRESENT"; exit 1; fi; if test "$PAPERCLIP_TASK_SCOPED" != "assigned-task-canary"; then printf "TASK_VARIABLE_MISSING"; exit 1; fi; ' + notificationChecks + 'printf "KIMI_CHILD_CREDENTIAL_FENCE_OK"', timeout: 5 };
  const modelRequests = [], mcpCalls = [], permissions = [], deliveries = [], nativeMessages = [], owners = [];
  let scenario = "echo", modelStep = 0, peerFailure, permissionGate;
  const complete = (response, chunks) => {
    response.writeHead(200, { "content-type": "text/event-stream" });
    const bytes = Buffer.from(chunks.map(chunk => `data: ${JSON.stringify({ id: "simulated-peer", ...chunk })}\n\n`).join("") + "data: [DONE]\n\n");
    const index = bytes.indexOf(Buffer.from("é"));
    if (index >= 0) { response.write(bytes.subarray(0, index + 1)); response.end(bytes.subarray(index + 1)); }
    else response.end(bytes);
  };
  const server = createServer(async (request, response) => {
    try {
      if (request.method !== "POST") { response.writeHead(405); response.end(); return; }
      let body = "";
      for await (const chunk of request) { body += chunk; assert.ok(Buffer.byteLength(body) < 2_097_152); }
      const value = JSON.parse(body);
      if (request.url === "/v1/chat/completions") {
        assert.equal(request.headers.authorization, "Bearer simulated-peer-not-a-credential");
        assert.equal(value.model, selectedModel);
        const system = value.messages.find(message => message.role === "system")?.content;
        assert.equal(typeof system, "string");
        assert.ok(system.endsWith(`\n\n${instructions}`), "exact literal instructions reached native HTTP request");
        const ack = nativeMessages.map(entry => entry.message.result?._meta?.paperclipKimiInstructions).filter(Boolean).at(-1);
        assert.equal(ack?.digest, binding.digest);
        assert.equal(ack?.effectiveDigest, `sha256:${sha(system)}`, "native instruction receipt matches the full actual model-request prompt");
        modelRequests.push({ scenario, value });
        assert.ok(modelRequests.length <= 9, "bounded simulated model requests");
        modelStep++;
        if (scenario === "error") {
          response.writeHead(418, { "content-type": "application/json" });
          response.end(JSON.stringify({ error: { type: "simulated_provider_error", message: "private-peer-error-canary" } }));
          return;
        }
        if (modelStep === 1) {
          const tools = scenario === "echo"
            ? [{ id: "peer-echo", name: "mcp__peer__echo_peer", args: argumentsObject }, { id: "peer-empty", name: "mcp__peer__empty_peer", args: {} }]
            : scenario === "bash" ? [{ id: "peer-bash", name: "Bash", args: bashArguments }]
              : [{ id: `peer-${scenario}`, name: "Write", args: { path: permissionGate?.path ?? deniedPath, content: "must never be written" } }];
          for (const tool of tools) assert.ok(value.tools.some(declared => declared.function?.name === tool.name), `native request discloses ${tool.name}`);
          complete(response, [
            { choices: [{ index: 0, delta: { content: "Before tool café." } }] },
            { choices: [{ index: 0, delta: { tool_calls: tools.map((tool, index) => ({ index, id: tool.id, type: "function", function: { name: tool.name, arguments: JSON.stringify(tool.args).slice(0, 1) } })) } }] },
            ...tools.map((tool, index) => ({ choices: [{ index: 0, delta: { tool_calls: [{ index, function: { arguments: JSON.stringify(tool.args).slice(1) } }] } }] })),
            { choices: [{ index: 0, delta: {}, finish_reason: "tool_calls" }] },
          ]);
        } else {
          const result = value.messages.find(message => message.role === "tool" && message.tool_call_id === `peer-${scenario}`);
          assert.ok(result, "the exact native tool result returned to the model");
          if (scenario === "echo") {
            assert.ok(JSON.stringify(result).includes(toolReceipt), `MCP receiver result reached the next native request: ${JSON.stringify({ result, mcpCalls: mcpCalls.length, permissions })}`);
            assert.ok(value.messages.some(message => message.role === "tool" && message.tool_call_id === "peer-empty" && JSON.stringify(message).includes("EMPTY_TOOL_ACCEPTED")), "zero-argument MCP result returned to the native model");
          }
          else if (scenario === "bash") assert.match(result.content, /^(?:Wall time: [0-9.]+ seconds\n)?KIMI_CHILD_CREDENTIAL_FENCE_OK\n?$/, "native Bash excluded provider/private credentials and retained the assigned task variable plus owned Runner notification discovery");
          else assert.match(JSON.stringify(result), /denied|rejected|approval/i);
          complete(response, [{ choices: [{ index: 0, delta: { content: scenario === "echo" ? "PEER_ECHO_OK café" : scenario === "bash" ? "PEER_BASH_OK" : "PEER_DENIED_OK" } }] },
            { choices: [{ index: 0, delta: {}, finish_reason: "stop" }], usage: { prompt_tokens: 12, completion_tokens: 3, total_tokens: 15 } }]);
        }
        return;
      }
      assert.equal(request.url, "/mcp");
      if (value.id === undefined) { response.writeHead(202); response.end(); return; }
      if (value.method === "tools/call") {
        assert.ok(["echo_peer", "empty_peer"].includes(value.params.name));
        assert.deepEqual(value.params.arguments, value.params.name === "echo_peer" ? argumentsObject : {});
        mcpCalls.push(value.params);
      }
      const result = value.method === "initialize"
        ? { protocolVersion: value.params.protocolVersion, capabilities: { tools: {} }, serverInfo: { name: "simulated-peer", version: "1" } }
        : value.method === "tools/list" ? { tools: [{ name: "echo_peer", description: "Echo the supplied JSON through the controlled peer.",
          inputSchema: { type: "object", properties: { payload: { type: "string" }, nested: { type: "object", additionalProperties: true } }, required: ["payload", "nested"] } },
          { name: "empty_peer", description: "Return a receipt from an empty object argument.", inputSchema: { type: "object", properties: {}, additionalProperties: false } }] }
          : { content: [{ type: "text", text: value.params.name === "empty_peer" ? "EMPTY_TOOL_ACCEPTED" : JSON.stringify({ echoed: argumentsObject, receipt: toolReceipt }) }] };
      response.writeHead(200, { "content-type": "application/json" });
      response.end(JSON.stringify({ jsonrpc: "2.0", id: value.id, result }));
    } catch (error) {
      peerFailure ??= error;
      if (!response.headersSent) response.writeHead(400, { "content-type": "application/json" });
      response.end(JSON.stringify({ error: { type: "peer_assertion_failed", message: "simulated peer assertion failed" } }));
    }
  });
  const keys = ["PAPERCLIP_ACPX_PROVIDER_PACKAGE_ROOT", "PAPERCLIP_ACPX_PROVIDER_PACKAGE_MANIFEST"];
  const previous = keys.map(key => process.env[key]);
  const closeOwner = async owner => {
    if (owner.closed) return;
    owner.closed = true;
    const started = Date.now();
    const terminate = setTimeout(() => { for (const child of owner.children) if (child.exitCode === null && child.signalCode === null) child.kill("SIGTERM"); }, 2_000);
    const kill = setTimeout(() => { for (const child of owner.children) if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL"); }, 3_000);
    try {
      if (owner.handle) await owner.runtime.close({ handle: owner.handle, reason: "simulated peer cleanup" });
    } finally {
      try {
        await Promise.all(owner.completions);
        assert.ok(Date.now() - started < 5_000, "native process cleanup is bounded");
      } finally { clearTimeout(terminate); clearTimeout(kill); await owner.lease.close(); await owner.fence?.close(); }
    }
  };
  try {
    await new Promise((resolve, reject) => { server.once("error", reject); server.listen(0, "127.0.0.1", resolve); });
    const endpoint = `http://127.0.0.1:${server.address().port}`;
    const config = kimiManagedConfiguration(selectedModel).replace(/^base_url = .+$/m, `base_url = ${JSON.stringify(`${endpoint}/v1`)}`)
      + "\n[loop_control]\nmax_attempts_per_step = 1\n";
    await writeFile(join(home, "config.toml"), config, { mode: 0o600 });
    process.env[keys[0]] = packageRoot; process.env[keys[1]] = join(packageRoot, "package.json");
    const installation = compiledFactory
      ? await compiledFactory.verifyKimiInstallation(compiledFactory.QUALIFIED_ACPX_PROFILES.kimi)
      : await verifyKimiInstallation(QUALIFIED_ACPX_PROFILES.kimi);
    const store = createFileSessionStore({ stateDir: join(root, "acpx-state") });
    const taskEnvironment = configuredEnvironmentProjection({ PAPERCLIP_TASK_SCOPED: "assigned-task-canary",
      ...Object.fromEntries(Object.keys(notificationEnvironment).map(key => [key, "forged-task-override"])) });
    for (const key of Object.keys(notificationEnvironment)) assert.ok(!Object.hasOwn(taskEnvironment, key));
    const explicitEnvironment = { ...taskEnvironment, ...notificationEnvironment, PATH: "/usr/bin:/bin", LANG: "C.UTF-8", KIMI_API_KEY: "simulated-peer-not-a-credential" };
    const sessionId = "controlled-native-environment";
    const compose = compiledFactory ?? environmentModule;
    const sidecarEnvironment = compose.createAcpxSidecarHostEnvironment({ ...explicitEnvironment,
      [environmentModule.ACPX_CREDENTIAL_BINDING_ENV]: environmentModule.createAcpxCredentialBinding(explicitEnvironment, "kimi", sessionId) }, "kimi", sessionId);
    const launchEnvironment = compose.createSanitizedAcpxSpawnInput(sidecarEnvironment, "kimi").env;
    for (const [key, value] of Object.entries(notificationEnvironment)) {
      assert.equal(launchEnvironment[key], value);
      assert.throws(() => compose.createSanitizedAcpxSpawnInput({ ...sidecarEnvironment,
        [CONFIGURED_ENVIRONMENT_KEYS]: JSON.stringify([key]), [key]: "forged-task-override" }, "kimi"), /configured environment projection/);
    }
    assert.equal(launchEnvironment.PAPERCLIP_TASK_SCOPED, "assigned-task-canary");
    assert.equal(launchEnvironment.KIMI_API_KEY, "simulated-peer-not-a-credential");
    const spawnNative = (lease, owner) => {
      const child = lease.spawn([], { cwd: workspace, stdio: "pipe", env: { ...launchEnvironment, HOME: home,
        CI: "1", NO_COLOR: "1", TERM: "dumb", KIMI_CODE_HOME: home,
        KIMI_CODE_NO_AUTO_UPDATE: "1", KIMI_DISABLE_TELEMETRY: "1",
        KIMI_CODE_WATCH: "0", KIMI_DISABLE_CRON: "1", PAPERCLIP_KIMI_INSTRUCTIONS: binding.payload,
        ...(selectorPeer ? { PAPERCLIP_FAULT_ENV_CANARY: "must-not-appear-in-observed-argv" } : {}) } },
      owner.fence ? { credentialFenceFds: owner.fence.lifetimeFenceFds, activateCredentialFenceOwner: pid => owner.fence.activateLifetimeOwner(pid) } : undefined);
      owner.children.push(child);
      owner.completions.push(new Promise((resolve, reject) => { child.once("close", resolve); child.once("error", reject); }));
      return child;
    };
    const connect = async (resumeSessionId, sessionKey = "scripted-kimi-peer") => {
      const lease = await installation.openCommand();
      const admission = instructionModule.createKimiInstructionAdmission(instructions);
      const fence = compiledFactory ? await compiledFactory.acquireAcpxProviderLifetimeLease({ agentHomeDirectory: home }) : undefined;
      const owner = { lease, fence, children: [], completions: [], handle: undefined, runtime: undefined, closed: false };
      owners.push(owner);
      const replies = createAcpxPermissionReplyConfirmations();
      owner.runtime = createAcpRuntime({ cwd: workspace, sessionStore: store,
        agentRegistry: { resolve: () => "paperclip-verified-kimi-command", list: () => ["kimi"] },
        mcpServers: [{ type: "http", name: "peer", url: `${endpoint}/mcp`, headers: [] }],
        permissionMode: "approve-all", permissionPolicy: { defaultAction: "escalate" }, timeoutMs: 15_000,
        protocolGuardFactory: () => admission.createGuard(),
        onAcpMessage: (direction, message) => { replies.observe(direction, message); nativeMessages.push({ owner, direction, message }); },
        onPermissionRequest: async (request, stockContext) => {
          const reply = replies.bind(request, stockContext.signal);
          const decision = await (async (context) => {
          permissions.push(request.raw);
          assert.ok(context.responseDelivery instanceof Promise);
          assert.ok(request.raw.options.every(option => option.kind !== "allow_always"));
          const normalized = normalizeAcpxPermission(request, { provider: "kimi", workingDirectory: workspace });
          if (request.raw.toolCall.title === "Write") {
            assert.equal(request.raw.toolCall.kind, "edit", "native approval carries the actual tool's canonical kind");
            const path = request.raw.toolCall.rawInput.path;
            assert.equal(normalized.title, `Change file: ${path.slice(workspace.length + 1)}`);
            assert.equal(normalized.kind, "edit");
            assert.deepEqual(normalized.choices.map(choice => choice.key), ["accept", "decline", "cancel"]);
            for (const workingDirectory of [undefined, home]) {
              const unsafe = normalizeAcpxPermission(request, { provider: "kimi", workingDirectory });
              assert.equal(unsafe.title, "File change requested; target unavailable. Deny or cancel this request.");
              assert.deepEqual(unsafe.choices.map(choice => choice.key), ["decline", "cancel"]);
              assert.throws(() => unsafe.resolve({ action: "accept" }), /not an offered choice/);
            }
          }
          if (permissionGate) {
            assert.equal(request.raw.toolCall.title, "Write");
            assert.deepEqual(request.raw.toolCall.rawInput, { path: permissionGate.path, content: "must never be written" });
            permissionGate.context = context;
            permissionGate.delivery = context.responseDelivery.then(() => "delivered", () => "suppressed");
            permissionGate.requestId = nativeMessages.findLast(entry => entry.owner === owner && entry.direction === "inbound"
              && entry.message.method === "session/request_permission"
              && entry.message.params.toolCall.rawInput?.path === permissionGate.path)?.message.id;
            assert.ok(permissionGate.requestId !== undefined);
            permissionGate.markSeen();
            return permissionGate.decision;
          }
          deliveries.push(context.responseDelivery);
          if (request.raw.toolCall.title === "Write") {
            assert.deepEqual(request.raw.toolCall.rawInput, { path: deniedPath, content: "must never be written" });
            await assert.rejects(access(deniedPath), { code: "ENOENT" });
            return { outcome: "reject_once" };
          }
          if (request.raw.toolCall.title === "Bash") {
            assert.deepEqual(request.raw.toolCall.rawInput, bashArguments);
            return { outcome: "allow_once" };
          }
          assert.ok(["mcp__peer__echo_peer", "mcp__peer__empty_peer"].includes(request.raw.toolCall.title));
          assert.deepEqual(request.raw.toolCall.rawInput, request.raw.toolCall.title === "mcp__peer__echo_peer" ? argumentsObject : {});
          return { outcome: "allow_once" };
          })({ ...stockContext, responseDelivery: reply.delivery });
          reply.select(decision);
          return decision;
        },
        spawnAgent: () => spawnNative(lease, owner),
      });
      owner.handle = await owner.runtime.ensureSession({ sessionKey, agent: "kimi", mode: "persistent", cwd: workspace,
        ...(resumeSessionId ? { resumeSessionId } : {}),
        sessionOptions: { model: selectedModel } });
      return owner;
    };
    const prompt = async (owner, name) => {
      scenario = name; modelStep = 0;
      const turn = owner.runtime.startTurn({ handle: owner.handle, mode: "prompt", text: `Controlled ${name} boundary.`, requestId: `peer-${name}` });
      const events = [];
      const drained = (async () => { for await (const event of turn.events) events.push(event); })();
      const result = await turn.result;
      await drained;
      if (peerFailure) throw peerFailure;
      if (name !== "error") {
        const chunks = events.filter(event => event.type === "text_delta" && event.stream === "output");
        assert.deepEqual(chunks.map(event => event.meta?.kind), ["start", "delta", "end:tool_use", "start", "delta", "end:end_turn"]);
        assert.ok(chunks.every(event => /^kimi-message-[a-f0-9]{64}$/.test(event.messageId)
          && event.meta.origin === "kimi-native-assistant" && event.meta.source === "kimi-turn-step-v1"));
        assert.equal(new Set(chunks.map(event => event.messageId)).size, 2);
        assert.equal(chunks[0].messageId, chunks[2].messageId);
        assert.equal(chunks[3].messageId, chunks[5].messageId);
        assert.notEqual(chunks[0].messageId, chunks[3].messageId);
        assert.equal(chunks[1].text, "Before tool café.");
        assert.ok(chunks.filter(event => event.meta.kind !== "delta").every(event => event.text === ""));
        const projection = createKimiMessageProjection();
        const projected = events.map(event => projection.normalize(event));
        projection.settle();
        assert.deepEqual(projected.filter(event => event.assistantMessageBoundary).map(event => event.assistantMessageBoundary), [
          { phase: "start" }, { phase: "end", stopReason: "toolUse" },
          { phase: "start" }, { phase: "end", stopReason: "stop" },
        ]);
      }
      return { result, events };
    };
    const first = await connect();
    const echoed = await prompt(first, "echo");
    assert.equal(echoed.result.status, "completed");
    assert.equal(mcpCalls.length, 2);
    assert.ok(echoed.events.some(event => event.type === "text_delta" && event.text.includes("PEER_ECHO_OK")));
    const shell = await prompt(first, "bash");
    assert.equal(shell.result.status, "completed");
    assert.ok(shell.events.some(event => event.type === "text_delta" && event.text.includes("PEER_BASH_OK")));
    assert.ok(nativeMessages.some(entry => entry.direction === "outbound" && entry.message.method === "initialize" && entry.message.params.clientCapabilities.terminal === true), "actual ACPX offered its mandatory client terminal");
    assert.ok(!nativeMessages.some(entry => entry.direction === "inbound" && entry.message.method === "terminal/create"), "Kimi kept Bash in its native fenced process service despite ACPX client terminal capability");
    await closeOwner(first);
    const second = await connect(first.handle.backendSessionId);
    const denied = await prompt(second, "deny");
    assert.equal(denied.result.status, "completed");
    await assert.rejects(access(deniedPath), { code: "ENOENT" });
    const failed = await prompt(second, "error");
    assert.equal(failed.result.status, "failed");
    assert.match(JSON.stringify(failed.result), /Kimi provider turn failed/);
    assert.ok(!JSON.stringify(failed.result).includes("private-peer-error-canary"));
    assert.ok(nativeMessages.some(entry => entry.direction === "outbound" && ["session/load", "session/resume"].includes(entry.message.method)), "ACPX restored the native session before the second model turn");
    assert.ok(permissions.some(request => request.toolCall.title === "Write"));
    assert.equal(permissions.length, 4);
    await Promise.all(deliveries);
    assert.equal(modelRequests.length, 7);
    await closeOwner(second);
    assert.ok(owners.every(owner => owner.children.every(child => child.exitCode !== null || child.signalCode !== null)));
    await assert.rejects(access(deniedPath), { code: "ENOENT" });
    t.diagnostic("SIMULATED provider service; real pinned Kimi 2.3.3 + ACPX manager: 7 native model requests with provider auth intact, exact create/resume instruction suffix, native UUID start/end separates pre-tool commentary from final text despite reused model response IDs, actual provider projection yields toolUse/stop boundaries, two MCP JSON/result round trips including terminal {}, native Bash excludes provider/private credentials and retains the assigned task variable and exact owned Runner notification paths after actual configured-environment projection rejected forged task overrides, rejected Write with no file, typed provider failure, owned process closure; zero external model calls");
    if (process.env.PAPERCLIP_TEST_KIMI_LIFECYCLE_PEER === "1") {
      const { readProcessTable, observeDescendantProcessTree } = await tsImport("../../../tests/runner-e2e/process-tree.ts", import.meta.url);
      const bounded = async (promise, label, milliseconds = 5_000) => {
        let timer;
        try {
          return await Promise.race([promise, new Promise((_, reject) => {
            timer = setTimeout(() => reject(new Error(`${label} exceeded its bound`)), milliseconds);
          })]);
        } finally { clearTimeout(timer); }
      };
      const nativeWorker = async owner => {
        assert.equal(owner.children.length, 1);
        if (selectorPeer) {
          const { readKimiLocalProcesses, selectKimiLocalTarget } = await tsImport("../../../tests/runner-e2e/kimi-local-provider-fault.ts", import.meta.url);
          const { kimiFaultRuntimeContract } = await tsImport("../../../tests/runner-e2e/kimi-provider-fault-contract.ts", import.meta.url);
          const table = await readProcessTable(); assert.ok(table);
          const root = table.find(row => row.pid === process.pid); assert.ok(root && root.processGroupId === process.pid);
          const tree = observeDescendantProcessTree(table, process.pid);
          const observed = tree.members.map(row => row.process);
          const processes = readKimiLocalProcesses(observed.map(row => row.pid));
          assert.ok(!JSON.stringify(processes).includes("must-not-appear-in-observed-argv"));
          const runId = process.argv[process.argv.indexOf("--run-id") + 1];
          const input = { authority: { pid: root.pid, groupId: root.processGroupId, startedAt: root.started, runId },
            journal: observed.map(row => ({ pid: row.pid, parent: row.parentPid, start: row.started })), processes,
            workspacePath: workspace, guardLoaderSha256: kimiFaultRuntimeContract("darwin-arm64").guardLoaderSha256 };
          const selected = selectKimiLocalTarget(input);
          assert.equal(selected.target.command, "kimi-code");
          assert.equal(selected.target.argv[0], "kimi-code");
          assert.ok(selected.ancestry.some(row => row.pid === owner.children[0].pid));
          for (const kind of ["missing", "foreign", "ambiguous"]) {
            const wrong = structuredClone(input);
            if (kind === "missing") wrong.processes = wrong.processes.filter(row => row.pid !== selected.target.pid);
            if (kind === "foreign") wrong.processes.find(row => row.pid === selected.target.ppid).argv[2] = "foreign loader";
            if (kind === "ambiguous") { const extra = { ...selected.target, pid: 2147483000 }; wrong.processes.push(extra); wrong.journal.push({ pid: extra.pid, parent: extra.ppid, start: new Date(Number(extra.startUs) / 1000).toISOString() }); }
            assert.throws(() => selectKimiLocalTarget(wrong), /kimi_local_provider_fault:/);
          }
          owner.selectorInput = input;
          return table.find(row => row.pid === selected.target.pid);
        }
        const rootPid = owner.children[0].pid;
        const table = await readProcessTable();
        assert.ok(table);
        const tree = observeDescendantProcessTree(table, rootPid);
        const candidates = tree.members.filter(member => member.depth === 1);
        assert.equal(candidates.length, 1, `one native Kimi worker belongs directly to the verified command root: ${JSON.stringify(tree.members.map(member => ({ depth: member.depth, kind: member.process.kind })))}`);
        const rootProcess = table.find(row => row.pid === rootPid);
        const worker = candidates[0].process;
        assert.ok(rootProcess && worker.pid > 1 && worker.pid !== rootPid && worker.pid !== process.pid);
        const fresh = await readProcessTable();
        assert.ok(fresh?.some(row => row.pid === rootPid && row.started === rootProcess.started && row.processGroupId === rootProcess.processGroupId));
        assert.ok(fresh?.some(row => row.pid === worker.pid && row.started === worker.started
          && row.parentPid === rootPid && row.processGroupId === worker.processGroupId));
        return worker;
      };
      const assertRetired = async worker => {
        const deadline = Date.now() + 5_000;
        while (Date.now() < deadline) {
          const table = await readProcessTable();
          assert.ok(table);
          if (!table.some(row => row.pid === worker.pid && row.started === worker.started)) return;
          await new Promise(resolve => setTimeout(resolve, 25));
        }
        assert.fail("the observed native worker survived owned cleanup");
      };
      for (const boundary of ["stop", "loss"]) {
        const path = join(workspace, `${boundary}-must-not-exist.txt`);
        let markSeen, decide;
        const seen = new Promise(resolve => { markSeen = resolve; });
        const decision = new Promise(resolve => { decide = resolve; });
        permissionGate = { path, markSeen, decision, decide };
        const owner = await connect(undefined, `scripted-kimi-peer-${boundary}`);
        scenario = boundary; modelStep = 0;
        const turn = owner.runtime.startTurn({ handle: owner.handle, mode: "prompt", text: `Controlled pending permission ${boundary}.`, requestId: `peer-${boundary}` });
        const drained = (async () => { for await (const _event of turn.events) {} })();
        try {
          await bounded(seen, `${boundary} native permission observation`);
          await assert.rejects(access(path), { code: "ENOENT" });
          const worker = await nativeWorker(owner);
          if (boundary === "stop") await bounded(turn.cancel({ reason: "controlled pending permission Stop" }), "native Stop");
          else if (selectorPeer) {
            const { terminateKimiLocalProvider } = await tsImport("../../../tests/runner-e2e/kimi-local-provider-fault.ts", import.meta.url);
            const receipt = terminateKimiLocalProvider(owner.selectorInput);
            assert.equal(receipt.target.pid, worker.pid); assert.equal(receipt.workerSignalled, false);
          } else process.kill(worker.pid, "SIGKILL");
          const result = await bounded(turn.result, `${boundary} terminal result`);
          await bounded(drained, `${boundary} event drain`);
          if (peerFailure) throw peerFailure;
          assert.equal(result.status, boundary === "stop" ? "cancelled" : "failed");
          if (boundary === "loss") assert.equal(typeof result.error?.code, "string");
          assert.equal(permissionGate.context.signal.aborted, true, "pending host callback was revoked at settlement");
          const countAtSettlement = modelRequests.length;
          permissionGate.decide({ outcome: "allow_once" });
          assert.equal(await bounded(permissionGate.delivery, `${boundary} stale permission suppression`), "suppressed");
          await new Promise(resolve => setTimeout(resolve, 100));
          assert.equal(modelRequests.length, countAtSettlement, "a stale callback cannot restart provider inference");
          assert.ok(!nativeMessages.some(entry => entry.owner === owner && entry.direction === "outbound" && entry.message.id === permissionGate.requestId && entry.message.result?.outcome?.outcome === "selected"), "no stale allow response crossed the provider connection");
          await assert.rejects(access(path), { code: "ENOENT" });
          await closeOwner(owner);
          await assertRetired(worker);
          await assert.rejects(access(path), { code: "ENOENT" });
        } finally { permissionGate.decide({ outcome: "reject_once" }); permissionGate = undefined; }
      }
      assert.equal(modelRequests.length, 9);
      assert.equal(permissions.length, 6);
      if (selectorPeer) t.diagnostic("Compiled production factories and real lifetime fences selected the exact native Kimi child despite ps rendering; actual title mutation and environment exclusion passed, missing/foreign/ambiguous targets were refused, and sealed-byte/inode/run-bound fault injection retired only the owned native tree");
      t.diagnostic("SIMULATED provider service; pending native Write permission Stop and exact observed native-worker SIGKILL both revoked host callbacks, suppressed stale allow responses, produced no file/model continuation, settled typed results and retired owned native processes; zero external model calls");
    }
  } finally {
    try { await Promise.all(owners.map(closeOwner)); }
    finally {
      server.closeAllConnections();
      await new Promise(resolve => server.close(resolve));
      keys.forEach((key, index) => { if (previous[index] === undefined) delete process.env[key]; else process.env[key] = previous[index]; });
      await rm(root, { recursive: true, force: true });
    }
  }
});