test: deepen safe file and transfer live fixtures

[altaywtf]

Summary

• Replace arbitrary account archive and event probes with deterministic, SDK-owned ZIP, torrent, failed-transfer, and ordering fixtures that clean up their mutations.
• Make live-test iteration reuse provisioned tokens. One explicit bootstrap writes an ignored 0600 cache; target runs never call password login, and repeated bootstrap is refused unless --refresh is explicit.
• Closes Deepen safe live fixtures for branch-heavy file and transfer behavior #173.

Verification

• vp run verify
• Additional targeted checks (vp run test:live, vp run test:compat, single-target live commands):
  • pnpm test:live:targets -- test/live/file-tasks.test.ts test/live/transfers.test.ts test/live/events.test.ts — 3 files, 29 tests passed from the cached token pair.
  • vp run test:compat — Node, Bun, Chromium, Firefox, and WebKit passed.

Notes

• A successful events.getTorrent(...) check remains unseeded: uploaded torrents did not create deterministic owned history events, so the suite retains only the missing-event branch instead of reading arbitrary history.
• Sanitized live safety proof:

explicit bootstrap -> one password login -> .env.live-tokens (mode 0600)
cached target run -> 3 files / 29 tests passed -> zero password logins
repeated bootstrap -> refused locally unless --refresh is explicit

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-29T09:22:11.733194Z	a6374c1	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟡 Changes recommended

scripts/test-live-targets.ts currently rejects valid live-test paths (e.g. ./test/live/..., absolute paths, Windows separators), making the new live-target workflow brittle until path validation is fixed.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR improves the determinism and safety of the live test suite by introducing SDK-owned binary fixtures (ZIP + torrent), tightening fixture cleanup behavior, and switching live iteration to reuse a cached runtime token pair written to an ignored .env.live-tokens file.

Changes:

• Add deterministic binary fixture generators (stored ZIP + minimal torrent metainfo) and use them in live file-task/transfer coverage.
• Replace nondeterministic “probe real account/history” behaviors with controlled, SDK-prefixed resources that are created and cleaned up within the same test runs.
• Introduce a token cache + refreshed bootstrap flow and replace the “fresh token per run” live-target runner with a cached-token runner + improved error formatting.

File summaries

File	Description
test/live/support/secrets.ts	Loads .env.live-tokens ahead of other env files to support cached live tokens.
test/live/support/binary-fixtures.ts	New deterministic ZIP/torrent File fixtures for live tests.
test/live/domains/transfers.ts	Uses uploaded torrent fixture + adds safer lifecycle assertions/cleanup.
test/live/domains/file-tasks.ts	Uses uploaded ZIP fixture and polls extraction to terminal state with cleanup.
test/live/domains/events.ts	Removes nondeterministic “pick arbitrary non-upload event” torrent probe; uses tag assertions for validation errors.
scripts/test-live-targets.ts	New runner for explicit live test targets using provisioned/cached tokens.
scripts/test-live-fresh.ts	Removed fresh-token-per-run runner.
scripts/live-token-cache.ts	Implements .env.live-tokens cache writer with 0600 permissions.
scripts/live-token-cache.spec.ts	Tests token cache output content and permissions.
scripts/live-error.ts	Formats live-runner errors without leaking arbitrary payload fields.
scripts/live-error.spec.ts	Tests formatting behavior for common and tagged SDK error shapes.
scripts/bootstrap-tokens.ts	Bootstraps tokens once and writes them to .env.live-tokens; refuses overwrite unless --refresh.
package.json	Replaces test:live:fresh with test:live:targets; cleans .env.live-tokens in secrets:clean.
docs/TESTING.md	Documents new deterministic fixtures and cached-token live target workflow.

Review details

• Files reviewed: 14/14 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ac00fb840b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f069f6f045

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".