refactor: rename gbrain_sync_mode → artifacts_sync_mode (v1.27.0.0 prep)

Hard rename, no dual-read alias (codex Finding D4). The on-disk migration
script (Phase C, separate commit) renames the config key in users'
~/.gstack/config.yaml and any CLAUDE.md blocks.

Touched call sites:
- bin/gstack-config defaults + validation + list/defaults output
- bin/gstack-gbrain-detect (gstack_brain_sync_mode field still emitted
  with the same name for downstream-tool compat; reads new key)
- bin/gstack-brain-sync, bin/gstack-brain-enqueue, bin/gstack-brain-uninstall
- bin/gstack-timeline-log (comment ref)
- scripts/resolvers/preamble/generate-brain-sync-block.ts: renames key,
  branches on gbrain_mcp_mode=remote-http to emit "ARTIFACTS_SYNC:
  remote-mode (managed by brain server <host>)" instead of the local
  mode/queue/last_push line (codex Finding #11)
- bin/gstack-brain-restore + bin/gstack-gbrain-source-wireup: read
  ~/.gstack-artifacts-remote.txt with ~/.gstack-brain-remote.txt fallback
  during the migration window
- bin/gstack-artifacts-init: tolerant of unrecognized URL forms (local
  paths, file://, self-hosted gitea) so test infrastructure and unusual
  remotes work without canonicalization
- test/brain-sync.test.ts: gstack-brain-init → gstack-artifacts-init
- test/skill-e2e-brain-privacy-gate.test.ts: artifacts_sync_mode keys
- test/gen-skill-docs.test.ts: budget 35K → 36.5K for the new MCP-mode
  probe in the preamble resolver
- health/SKILL.md.tmpl, sync-gbrain/SKILL.md.tmpl: comment + verdict line

Hard delete:
- bin/gstack-brain-init (replaced by bin/gstack-artifacts-init in v1.27.0.0)
- test/gstack-brain-init-gh-mock.test.ts (replaced by gstack-artifacts-init.test.ts)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-05-06 09:32:56 -07:00
parent 7b9c2f68d4
commit 8abe27338c
17 changed files with 138 additions and 625 deletions
+30 -30
View File
@@ -6,7 +6,7 @@
* - bin/gstack-brain-enqueue (atomicity, skip list, no-op gates)
* - bin/gstack-jsonl-merge (3-way, ts-sort, hash-fallback)
* - bin/gstack-brain-sync --once (drain, commit, push, secret-scan, skip-file)
* - bin/gstack-brain-init + --restore round-trip
* - bin/gstack-artifacts-init + --restore round-trip
* - bin/gstack-brain-uninstall preserves user data
* - env isolation (GSTACK_HOME never bleeds into real ~/.gstack/config.yaml)
*
@@ -69,30 +69,30 @@ afterEach(() => {
// Config key validation + env isolation
// ---------------------------------------------------------------
describe('gstack-config gbrain keys', () => {
test('default gbrain_sync_mode is off', () => {
const r = run(['gstack-config', 'get', 'gbrain_sync_mode']);
test('default artifacts_sync_mode is off', () => {
const r = run(['gstack-config', 'get', 'artifacts_sync_mode']);
expect(r.status).toBe(0);
expect(r.stdout.trim()).toBe('off');
});
test('default gbrain_sync_mode_prompted is false', () => {
const r = run(['gstack-config', 'get', 'gbrain_sync_mode_prompted']);
test('default artifacts_sync_mode_prompted is false', () => {
const r = run(['gstack-config', 'get', 'artifacts_sync_mode_prompted']);
expect(r.stdout.trim()).toBe('false');
});
test('accepts full / artifacts-only / off', () => {
for (const val of ['full', 'artifacts-only', 'off']) {
const set = run(['gstack-config', 'set', 'gbrain_sync_mode', val]);
const set = run(['gstack-config', 'set', 'artifacts_sync_mode', val]);
expect(set.status).toBe(0);
const get = run(['gstack-config', 'get', 'gbrain_sync_mode']);
const get = run(['gstack-config', 'get', 'artifacts_sync_mode']);
expect(get.stdout.trim()).toBe(val);
}
});
test('invalid gbrain_sync_mode value warns + defaults', () => {
const r = run(['gstack-config', 'set', 'gbrain_sync_mode', 'bogus']);
test('invalid artifacts_sync_mode value warns + defaults', () => {
const r = run(['gstack-config', 'set', 'artifacts_sync_mode', 'bogus']);
expect(r.stderr).toContain('not recognized');
const get = run(['gstack-config', 'get', 'gbrain_sync_mode']);
const get = run(['gstack-config', 'get', 'artifacts_sync_mode']);
expect(get.stdout.trim()).toBe('off');
});
@@ -102,11 +102,11 @@ describe('gstack-config gbrain keys', () => {
const realConfig = path.join(os.homedir(), '.gstack', 'config.yaml');
const before = fs.existsSync(realConfig) ? fs.readFileSync(realConfig, 'utf-8') : null;
run(['gstack-config', 'set', 'gbrain_sync_mode', 'full']);
run(['gstack-config', 'set', 'artifacts_sync_mode', 'full']);
// The override actually took effect — temp config got the new value.
const tempConfig = fs.readFileSync(path.join(tmpHome, 'config.yaml'), 'utf-8');
expect(tempConfig).toContain('gbrain_sync_mode: full');
expect(tempConfig).toContain('artifacts_sync_mode: full');
// Real ~/.gstack/config.yaml must not be touched.
const after = fs.existsSync(realConfig) ? fs.readFileSync(realConfig, 'utf-8') : null;
@@ -133,7 +133,7 @@ describe('gstack-brain-enqueue', () => {
test('enqueues when mode is full and .git exists', () => {
fs.mkdirSync(path.join(tmpHome, '.git'), { recursive: true });
run(['gstack-config', 'set', 'gbrain_sync_mode', 'full']);
run(['gstack-config', 'set', 'artifacts_sync_mode', 'full']);
run(['gstack-brain-enqueue', 'projects/foo/learnings.jsonl']);
const queue = fs.readFileSync(path.join(tmpHome, '.brain-queue.jsonl'), 'utf-8');
expect(queue).toContain('projects/foo/learnings.jsonl');
@@ -144,7 +144,7 @@ describe('gstack-brain-enqueue', () => {
test('skip list honored', () => {
fs.mkdirSync(path.join(tmpHome, '.git'), { recursive: true });
run(['gstack-config', 'set', 'gbrain_sync_mode', 'full']);
run(['gstack-config', 'set', 'artifacts_sync_mode', 'full']);
fs.writeFileSync(path.join(tmpHome, '.brain-skip.txt'), 'projects/foo/secret.jsonl\n');
run(['gstack-brain-enqueue', 'projects/foo/secret.jsonl']);
run(['gstack-brain-enqueue', 'projects/foo/ok.jsonl']);
@@ -155,7 +155,7 @@ describe('gstack-brain-enqueue', () => {
test('concurrent enqueues all land (atomic append)', async () => {
fs.mkdirSync(path.join(tmpHome, '.git'), { recursive: true });
run(['gstack-config', 'set', 'gbrain_sync_mode', 'full']);
run(['gstack-config', 'set', 'artifacts_sync_mode', 'full']);
const procs = [];
for (let i = 0; i < 10; i++) {
procs.push(new Promise<void>((resolve) => {
@@ -218,7 +218,7 @@ describe('gstack-jsonl-merge', () => {
// ---------------------------------------------------------------
describe('init + sync + restore round-trip', () => {
test('init creates canonical files + registers drivers', () => {
const r = run(['gstack-brain-init', '--remote', bareRemote]);
const r = run(['gstack-artifacts-init', '--remote', bareRemote]);
expect(r.status).toBe(0);
expect(fs.existsSync(path.join(tmpHome, '.git'))).toBe(true);
expect(fs.existsSync(path.join(tmpHome, '.gitignore'))).toBe(true);
@@ -232,18 +232,18 @@ describe('init + sync + restore round-trip', () => {
});
test('refuses init on different remote', () => {
run(['gstack-brain-init', '--remote', bareRemote]);
run(['gstack-artifacts-init', '--remote', bareRemote]);
const otherRemote = fs.mkdtempSync(path.join(os.tmpdir(), 'brain-other-'));
spawnSync('git', ['init', '--bare', '-q', '-b', 'main', otherRemote]);
const r = run(['gstack-brain-init', '--remote', otherRemote]);
const r = run(['gstack-artifacts-init', '--remote', otherRemote]);
expect(r.status).not.toBe(0);
expect(r.stderr).toContain('already a git repo pointing at');
fs.rmSync(otherRemote, { recursive: true, force: true });
});
test('full sync: init → enqueue → --once → commit pushed', () => {
run(['gstack-brain-init', '--remote', bareRemote]);
run(['gstack-config', 'set', 'gbrain_sync_mode', 'full']);
run(['gstack-artifacts-init', '--remote', bareRemote]);
run(['gstack-config', 'set', 'artifacts_sync_mode', 'full']);
fs.mkdirSync(path.join(tmpHome, 'projects', 'p'), { recursive: true });
fs.writeFileSync(path.join(tmpHome, 'projects/p/learnings.jsonl'),
'{"skill":"x","insight":"y","ts":"2026-04-22T10:00:00Z"}\n');
@@ -257,8 +257,8 @@ describe('init + sync + restore round-trip', () => {
test('restore round-trip: writes on machine A visible on machine B', () => {
// Machine A.
run(['gstack-brain-init', '--remote', bareRemote]);
run(['gstack-config', 'set', 'gbrain_sync_mode', 'full']);
run(['gstack-artifacts-init', '--remote', bareRemote]);
run(['gstack-config', 'set', 'artifacts_sync_mode', 'full']);
fs.mkdirSync(path.join(tmpHome, 'projects', 'myproj'), { recursive: true });
const aLearning = '{"skill":"x","insight":"machine A wisdom","ts":"2026-04-22T10:00:00Z"}\n';
fs.writeFileSync(path.join(tmpHome, 'projects/myproj/learnings.jsonl'), aLearning);
@@ -296,8 +296,8 @@ describe('gstack-brain-sync secret scan', () => {
for (const [name, content] of SECRETS) {
test(`blocks ${name}`, () => {
run(['gstack-brain-init', '--remote', bareRemote]);
run(['gstack-config', 'set', 'gbrain_sync_mode', 'full']);
run(['gstack-artifacts-init', '--remote', bareRemote]);
run(['gstack-config', 'set', 'artifacts_sync_mode', 'full']);
fs.mkdirSync(path.join(tmpHome, 'projects', 'p'), { recursive: true });
fs.writeFileSync(path.join(tmpHome, 'projects/p/learnings.jsonl'),
`{"leaked":"${content}"}\n`);
@@ -314,8 +314,8 @@ describe('gstack-brain-sync secret scan', () => {
}
test('--skip-file unblocks specific file', () => {
run(['gstack-brain-init', '--remote', bareRemote]);
run(['gstack-config', 'set', 'gbrain_sync_mode', 'full']);
run(['gstack-artifacts-init', '--remote', bareRemote]);
run(['gstack-config', 'set', 'artifacts_sync_mode', 'full']);
fs.mkdirSync(path.join(tmpHome, 'projects', 'p'), { recursive: true });
const leakPath = 'projects/p/leaked.jsonl';
fs.writeFileSync(path.join(tmpHome, leakPath),
@@ -335,7 +335,7 @@ describe('gstack-brain-sync secret scan', () => {
// ---------------------------------------------------------------
describe('gstack-brain-uninstall', () => {
test('removes sync config but preserves learnings/project data', () => {
run(['gstack-brain-init', '--remote', bareRemote]);
run(['gstack-artifacts-init', '--remote', bareRemote]);
fs.mkdirSync(path.join(tmpHome, 'projects', 'user-data'), { recursive: true });
const preservedContent = '{"keep":"me","ts":"2026-04-22T12:00:00Z"}\n';
fs.writeFileSync(path.join(tmpHome, 'projects/user-data/learnings.jsonl'), preservedContent);
@@ -349,7 +349,7 @@ describe('gstack-brain-uninstall', () => {
const preserved = fs.readFileSync(path.join(tmpHome, 'projects/user-data/learnings.jsonl'), 'utf-8');
expect(preserved).toBe(preservedContent);
// Config key reset.
const mode = run(['gstack-config', 'get', 'gbrain_sync_mode']);
const mode = run(['gstack-config', 'get', 'artifacts_sync_mode']);
expect(mode.stdout.trim()).toBe('off');
});
});
@@ -359,8 +359,8 @@ describe('gstack-brain-uninstall', () => {
// ---------------------------------------------------------------
describe('gstack-brain-sync --discover-new', () => {
test('enqueues new allowlisted files; idempotent on re-run', () => {
run(['gstack-brain-init', '--remote', bareRemote]);
run(['gstack-config', 'set', 'gbrain_sync_mode', 'full']);
run(['gstack-artifacts-init', '--remote', bareRemote]);
run(['gstack-config', 'set', 'artifacts_sync_mode', 'full']);
fs.mkdirSync(path.join(tmpHome, 'retros'), { recursive: true });
fs.writeFileSync(path.join(tmpHome, 'retros/week-1.md'), '# retro\n');
run(['gstack-brain-sync', '--discover-new']);
+5 -3
View File
@@ -313,15 +313,17 @@ describe('gen-skill-docs', () => {
];
// Plan skills carry the same preamble surface as other tier-≥2 skills
// (Brain Sync, Context Recovery, Routing Injection are load-bearing
// (Artifacts Sync, Context Recovery, Routing Injection are load-bearing
// functionality, not optional). Budget is set to current size + small
// headroom; ratchet down if a future slim trims real bytes.
// Ratcheted from 33000 → 35000 when the gbrain context-load block was
// added to generate-brain-sync-block.ts (per /sync-gbrain plan §4).
// added (per /sync-gbrain plan §4). Ratcheted 35000 → 36500 in v1.27.0.0
// when generate-brain-sync-block.ts gained the gbrain_mcp_mode probe +
// remote-mode ARTIFACTS_SYNC status line (Path 4 of /setup-gbrain).
for (const skill of reviewSkills) {
const content = fs.readFileSync(skill.path, 'utf-8');
const preamble = extractPreambleBeforeWorkflow(content, skill.markers);
expect(Buffer.byteLength(preamble, 'utf-8')).toBeLessThan(35_000);
expect(Buffer.byteLength(preamble, 'utf-8')).toBeLessThan(36_500);
}
});
-236
View File
@@ -1,236 +0,0 @@
/**
* gstack-brain-init mocked-gh integration tests.
*
* The regular brain-sync tests pass `--remote <bare-git-url>` to skip the
* gh-repo-creation path entirely. That left the happy path (user just
* presses Enter, gstack-brain-init calls `gh repo create --private`)
* with zero coverage you'd only know it broke when a real user tried
* it with a real GitHub account.
*
* These tests put a fake `gh` binary on PATH that records every call
* into a file, then run gstack-brain-init in its non-flag interactive
* mode and assert the fake `gh` was invoked with the expected arguments.
*
* No real GitHub account, no live API, deterministic per-run.
*/
import { describe, test, expect, beforeEach, afterEach } from 'bun:test';
import * as fs from 'fs';
import * as os from 'os';
import * as path from 'path';
import { spawnSync } from 'child_process';
const ROOT = path.resolve(import.meta.dir, '..');
const BIN_DIR = path.join(ROOT, 'bin');
const INIT_BIN = path.join(BIN_DIR, 'gstack-brain-init');
let tmpHome: string;
let bareRemote: string;
let fakeBinDir: string;
let ghCallLog: string;
function makeFakeGh(opts: {
authStatus?: 'ok' | 'fail';
repoCreate?: 'success' | 'already-exists' | 'fail';
sshUrl?: string;
}) {
const authStatus = opts.authStatus ?? 'ok';
const repoCreate = opts.repoCreate ?? 'success';
const sshUrl = opts.sshUrl ?? bareRemote;
const script = `#!/bin/bash
echo "gh $@" >> "${ghCallLog}"
case "$1" in
auth)
${authStatus === 'ok' ? 'exit 0' : 'exit 1'}
;;
repo)
shift
case "$1" in
create)
${
repoCreate === 'success'
? 'exit 0'
: repoCreate === 'already-exists'
? 'echo "GraphQL: Name already exists on this account" >&2; exit 1'
: 'echo "network error" >&2; exit 1'
}
;;
view)
# Emulate \`gh repo view <name> --json sshUrl -q .sshUrl\`
echo "${sshUrl}"
exit 0
;;
esac
;;
esac
exit 0
`;
const ghPath = path.join(fakeBinDir, 'gh');
fs.writeFileSync(ghPath, script, { mode: 0o755 });
return ghPath;
}
function run(
argv: string[],
opts: { env?: Record<string, string>; input?: string } = {}
) {
const env = {
// Put the fake bin dir FIRST on PATH so our mock gh wins.
PATH: `${fakeBinDir}:/usr/bin:/bin:/opt/homebrew/bin`,
GSTACK_HOME: tmpHome,
USER: 'testuser',
HOME: tmpHome,
...(opts.env || {}),
};
const res = spawnSync(INIT_BIN, argv, {
env,
encoding: 'utf-8',
input: opts.input,
cwd: ROOT,
});
return {
stdout: res.stdout || '',
stderr: res.stderr || '',
status: res.status ?? -1,
};
}
function readGhCalls(): string[] {
if (!fs.existsSync(ghCallLog)) return [];
return fs.readFileSync(ghCallLog, 'utf-8').trim().split('\n').filter(Boolean);
}
beforeEach(() => {
tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'brain-init-gh-mock-'));
bareRemote = fs.mkdtempSync(path.join(os.tmpdir(), 'brain-init-bare-'));
fakeBinDir = fs.mkdtempSync(path.join(os.tmpdir(), 'brain-init-fake-bin-'));
ghCallLog = path.join(fakeBinDir, 'gh-calls.log');
spawnSync('git', ['init', '--bare', '-q', '-b', 'main', bareRemote]);
});
afterEach(() => {
fs.rmSync(tmpHome, { recursive: true, force: true });
fs.rmSync(bareRemote, { recursive: true, force: true });
fs.rmSync(fakeBinDir, { recursive: true, force: true });
const remoteFile = path.join(os.homedir(), '.gstack-brain-remote.txt');
if (fs.existsSync(remoteFile)) {
const contents = fs.readFileSync(remoteFile, 'utf-8');
if (contents.includes(bareRemote)) fs.unlinkSync(remoteFile);
}
});
describe('gstack-brain-init uses gh CLI when present + authed', () => {
test('calls gh repo create --private with the computed default name', () => {
makeFakeGh({ authStatus: 'ok', repoCreate: 'success' });
// Interactive mode; pressing Enter accepts the gh default.
const r = run([], { input: '\n' });
expect(r.status).toBe(0);
const calls = readGhCalls();
// First call: auth status check
expect(calls.some((c) => c.startsWith('gh auth'))).toBe(true);
// The create call
const createCall = calls.find((c) => c.startsWith('gh repo create'));
expect(createCall).toBeDefined();
expect(createCall).toContain('gstack-brain-testuser');
expect(createCall).toContain('--private');
expect(createCall).toContain('--description');
// --source is intentionally omitted: gh requires the source dir to already
// be a git repo, but brain-init doesn't `git init $GSTACK_HOME` until later.
// Creating bare and wiring up the remote explicitly avoids that ordering bug.
expect(createCall).not.toContain('--source');
});
test('falls back to gh repo view when create reports already-exists', () => {
makeFakeGh({ authStatus: 'ok', repoCreate: 'already-exists' });
const r = run([], { input: '\n' });
expect(r.status).toBe(0);
const calls = readGhCalls();
// create was attempted
expect(calls.some((c) => c.startsWith('gh repo create'))).toBe(true);
// then view was called to recover the URL
expect(calls.some((c) => c.startsWith('gh repo view') && c.includes('gstack-brain-testuser'))).toBe(true);
// The view output (bareRemote URL) should have been wired up as origin.
const remote = spawnSync('git', ['-C', tmpHome, 'remote', 'get-url', 'origin'], {
encoding: 'utf-8',
});
expect(remote.stdout.trim()).toBe(bareRemote);
});
test('user-provided URL bypasses gh create entirely', () => {
makeFakeGh({ authStatus: 'ok', repoCreate: 'fail' });
const r = run([], { input: `${bareRemote}\n` });
expect(r.status).toBe(0);
const calls = readGhCalls();
// gh auth was still checked
expect(calls.some((c) => c.startsWith('gh auth'))).toBe(true);
// but create was NOT called (user bypassed the default)
expect(calls.some((c) => c.startsWith('gh repo create'))).toBe(false);
});
});
describe('gstack-brain-init without gh CLI', () => {
test('prompts for URL when gh is not on PATH', () => {
// Don't install fake gh — PATH will not have it.
// Use a bare-minimum PATH so nothing else shadows.
const stripped = `${fakeBinDir}:/usr/bin:/bin`;
const res = spawnSync(INIT_BIN, [], {
env: {
PATH: stripped,
GSTACK_HOME: tmpHome,
USER: 'testuser',
HOME: tmpHome,
},
encoding: 'utf-8',
input: `${bareRemote}\n`,
cwd: ROOT,
});
expect(res.status).toBe(0);
expect(res.stdout).toContain('gh CLI not found');
// Remote got set from the stdin paste
const remote = spawnSync('git', ['-C', tmpHome, 'remote', 'get-url', 'origin'], {
encoding: 'utf-8',
});
expect(remote.stdout.trim()).toBe(bareRemote);
});
test('prompts for URL when gh is present but not authed', () => {
makeFakeGh({ authStatus: 'fail' });
const r = run([], { input: `${bareRemote}\n` });
expect(r.status).toBe(0);
expect(r.stdout).toContain('gh CLI not found or not authenticated');
const calls = readGhCalls();
// Only `gh auth status` was called; no create attempt.
expect(calls.some((c) => c.startsWith('gh auth'))).toBe(true);
expect(calls.some((c) => c.startsWith('gh repo create'))).toBe(false);
});
});
describe('idempotency via flag', () => {
test('--remote <url> skips all gh calls', () => {
makeFakeGh({ authStatus: 'ok', repoCreate: 'success' });
const r = run(['--remote', bareRemote]);
expect(r.status).toBe(0);
const calls = readGhCalls();
// Zero calls to gh — the --remote flag short-circuits the interactive path.
expect(calls.length).toBe(0);
});
test('re-run with matching --remote is safe (no conflicting-remote error)', () => {
run(['--remote', bareRemote]);
const r2 = run(['--remote', bareRemote]);
expect(r2.status).toBe(0);
});
test('re-run with DIFFERENT --remote exits 1 with a conflict message', () => {
run(['--remote', bareRemote]);
const otherRemote = fs.mkdtempSync(path.join(os.tmpdir(), 'brain-init-other-'));
spawnSync('git', ['init', '--bare', '-q', '-b', 'main', otherRemote]);
try {
const r2 = run(['--remote', otherRemote]);
expect(r2.status).not.toBe(0);
expect(r2.stderr).toContain('already a git repo');
} finally {
fs.rmSync(otherRemote, { recursive: true, force: true });
}
});
});
+5 -5
View File
@@ -4,7 +4,7 @@
* The gbrain-sync preamble block instructs the model to fire a one-time
* AskUserQuestion when:
* - `BRAIN_SYNC: off` in the preamble echo (sync mode not on)
* - config `gbrain_sync_mode_prompted` is "false"
* - config `artifacts_sync_mode_prompted` is "false"
* - gbrain is detected on the host (binary on PATH or `gbrain doctor`
* --fast --json succeeds)
*
@@ -31,14 +31,14 @@ const describeE2E = shouldRun ? describe : describe.skip;
describeE2E('gbrain-sync privacy gate fires once via preamble', () => {
test('gstack skill preamble fires the 3-option AskUserQuestion when gbrain is detected', async () => {
// Stage a fresh GSTACK_HOME with gbrain_sync_mode_prompted=false.
// Stage a fresh GSTACK_HOME with artifacts_sync_mode_prompted=false.
const gstackHome = fs.mkdtempSync(path.join(os.tmpdir(), 'privacy-gate-gstack-'));
const fakeBinDir = fs.mkdtempSync(path.join(os.tmpdir(), 'privacy-gate-bin-'));
// Seed the config so the gate's condition passes.
fs.writeFileSync(
path.join(gstackHome, 'config.yaml'),
'gbrain_sync_mode: off\ngbrain_sync_mode_prompted: false\n',
'artifacts_sync_mode: off\nartifacts_sync_mode_prompted: false\n',
{ mode: 0o600 }
);
@@ -151,14 +151,14 @@ describeE2E('gbrain-sync privacy gate fires once via preamble', () => {
}
}, 180_000);
test('privacy gate does NOT fire when gbrain_sync_mode_prompted is already true', async () => {
test('privacy gate does NOT fire when artifacts_sync_mode_prompted is already true', async () => {
// Same staging, but prompted=true this time. Gate should be silent.
const gstackHome = fs.mkdtempSync(path.join(os.tmpdir(), 'privacy-gate-off-'));
const fakeBinDir = fs.mkdtempSync(path.join(os.tmpdir(), 'privacy-gate-off-bin-'));
fs.writeFileSync(
path.join(gstackHome, 'config.yaml'),
'gbrain_sync_mode: off\ngbrain_sync_mode_prompted: true\n',
'artifacts_sync_mode: off\nartifacts_sync_mode_prompted: true\n',
{ mode: 0o600 }
);