fix(schema): block scalars keep '#' as literal content

Inside a YAML block scalar '#' is content, not a comment; parseBlockScalar
was routing lines through stripComment/isBlank, truncating descriptions
like 'see issue #2029' and blanking comment-looking lines. Use the raw
line inside the scalar. Adds a pinning test.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/cli.ts

@@ -24,7 +24,6 @@ import type { GBrainConfig } from './core/config.ts';
 import type { AIGatewayConfig } from './core/ai/types.ts';
 import type { BrainEngine } from './core/engine.ts';
 import { operations, OperationError } from './core/operations.ts';
-import { resolveSourceIdEngineFree } from './core/source-resolver.ts';
 import { formatVolunteeredPage } from './core/context/volunteer.ts';
 import type { Operation, OperationContext } from './core/operations.ts';
 import { shouldForceExitAfterMain, finishCliTeardown, flushThenExit, currentExitCode, setCliExitVerdict } from './core/cli-force-exit.ts';
@@ -383,15 +382,6 @@ async function main() {
     if (op.localOnly) {
       refuseThinClient(command, cfgPre!.remote_mcp!.mcp_url);
     }
-    // #2098: the local path resolves --source / GBRAIN_SOURCE / .gbrain-source
-    // inside makeContext (ctx.sourceId), which this route never reaches — so
-    // scope must be mapped onto the op's source_id wire param before the call.
-    try {
-      applyThinClientSourceScope(op, params);
-    } catch (e: unknown) {
-      console.error(e instanceof Error ? e.message : String(e));
-      process.exit(1);
-    }
     await runThinClientRouted(op, params, cfgPre!, cliOpts);
     return;
   }
@@ -812,60 +802,6 @@ export function parseOpArgs(op: Operation, args: string[]): Record<string, unkno
   return params;
 }
 
-/**
- * #2098: thin-client source scoping. Locally, --source / GBRAIN_SOURCE /
- * .gbrain-source resolve to ctx.sourceId in makeContext; the thin-client
- * route short-circuits before that, so `gbrain query --source X` against a
- * remote brain silently searched unscoped. This runs the engine-free tiers
- * (flag → env → dotfile; the DB-backed tiers can't run without an engine —
- * the server's grant scoping covers the rest) and maps the result onto the
- * op's `source_id` wire param.
- *
- * Ops that declare their OWN `source` param (facts add, etc.) are left
- * untouched — their --source is an op param, not scope. An explicit --source
- * on an op with no source_id wire param throws (loud beats silent drop);
- * ambient env/dotfile scope with nowhere to send it is ignored, matching the
- * pre-fix behavior for non-scopeable ops. Exported for tests.
- */
-// Ops whose `source_id` wire param is NOT read-scope semantics: get_skill's
-// source_id flips the lookup from host catalog to brain-resident-pack
-// (getResidentSkillDetail). Ambient env/dotfile scope must never leak into
-// these; an explicit --source-id still passes through untouched above.
-const NON_SCOPE_SOURCE_ID_OPS = new Set(['get_skill']);
-
-export function applyThinClientSourceScope(
-  op: Operation,
-  params: Record<string, unknown>,
-  cwd?: string,
-): void {
-  if ('source' in op.params) return; // the op owns --source; not a scope flag
-  const explicit = typeof params.source === 'string' && params.source.length > 0
-    ? (params.source as string)
-    : null;
-  delete params.source; // never a wire param on these ops — don't leak it
-  // Explicit per-call scope already on the wire wins over ambient tiers.
-  if (params.source_id !== undefined || params.all_sources === true) {
-    if (explicit) {
-      throw new Error('Pass either --source or --source-id/--all-sources, not both.');
-    }
-    return;
-  }
-  const resolved = resolveSourceIdEngineFree(explicit, cwd);
-  if (!resolved) return;
-  if (!('source_id' in op.params) || NON_SCOPE_SOURCE_ID_OPS.has(op.name)) {
-    if (explicit) {
-      const hint = NON_SCOPE_SOURCE_ID_OPS.has(op.name)
-        ? `(its source_id parameter is not a scope filter; pass --source-id explicitly if you mean it)`
-        : `(the remote op has no source_id parameter; the server scopes it to your grant)`;
-      throw new Error(
-        `gbrain ${op.cliHints?.name || op.name} does not accept --source on a thin-client install ${hint}.`,
-      );
-    }
-    return; // ambient env/dotfile scope with nowhere to send it
-  }
-  params.source_id = resolved;
-}
-
 async function makeContext(engine: BrainEngine, params: Record<string, unknown>): Promise<OperationContext> {
   // v0.31.8 (D11): resolve sourceId via the canonical 6-tier chain. Honors
   // --source / GBRAIN_SOURCE / .gbrain-source / path-match / brain default /

src/core/ai/anthropic-key.ts

@@ -18,12 +18,22 @@
 import { loadConfig } from '../config.ts';
 
 export function hasAnthropicKey(): boolean {
-  if (process.env.ANTHROPIC_API_KEY) return true;
+  return resolveAnthropicKey() !== undefined;
+}
+
+/**
+ * Resolve the actual key value: env first, then the gbrain config file.
+ * Callers constructing an Anthropic client directly (e.g. the legacy
+ * subagent path) must pass this as `apiKey` — a bare `new Anthropic()`
+ * only sees env, so launchd/MCP workers with config-stored keys fail.
+ */
+export function resolveAnthropicKey(): string | undefined {
+  if (process.env.ANTHROPIC_API_KEY) return process.env.ANTHROPIC_API_KEY;
   try {
     const cfg = loadConfig();
-    if (cfg?.anthropic_api_key) return true;
+    if (cfg?.anthropic_api_key) return cfg.anthropic_api_key;
   } catch {
     // loadConfig may throw on first-run installs; treat as no key available.
   }
-  return false;
+  return undefined;
 }

src/core/minions/handlers/subagent.ts

@@ -48,6 +48,7 @@ import {
   logSubagentHeartbeat,
 } from './subagent-audit.ts';
 import { resolveModel, isAnthropicProvider, TIER_DEFAULTS } from '../../model-config.ts';
+import { resolveAnthropicKey } from '../../ai/anthropic-key.ts';
 import { buildSystemPrompt, DEFAULT_SUBAGENT_SYSTEM } from '../system-prompt.ts';
 import { toolLoop as gatewayToolLoop } from '../../ai/gateway.ts';
 import type { ChatToolDef, ChatMessage, ChatBlock, ChatResult, ToolHandler } from '../../ai/gateway.ts';
@@ -186,7 +187,10 @@ export function makeSubagentHandler(deps: SubagentDeps) {
   // lives at sdk.messages.create. Assigning sdk.messages directly gets the
   // right object; JS method-call semantics preserve `this` at the call
   // site (subagent.ts invokes client.create(...) with client === sdk.messages).
-  const makeAnthropic = deps.makeAnthropic ?? (() => new Anthropic());
+  // Resolve the key env-first, then config (anthropic_api_key) — a bare
+  // new Anthropic() only reads env, so launchd/MCP workers whose key lives
+  // in the gbrain config file would fail auth (#2048).
+  const makeAnthropic = deps.makeAnthropic ?? (() => new Anthropic({ apiKey: resolveAnthropicKey() }));
   const client: MessagesClient = deps.client ?? makeAnthropic().messages;
   const config = deps.config ?? loadConfig() ?? ({ engine: 'postgres' } as GBrainConfig);
   const rateLeaseKey = deps.rateLeaseKey ?? DEFAULT_RATE_KEY;

src/core/operations.ts

@@ -4562,7 +4562,8 @@ const list_schema_packs: Operation = {
     const { existsSync, readdirSync } = await import('node:fs');
     const { join } = await import('node:path');
     const { gbrainPath } = await import('./config.ts');
-    const bundled = ['gbrain-base', 'gbrain-recommended'];
+    const { BUNDLED_PACK_NAMES } = await import('./schema-pack/bundled.ts');
+    const bundled = [...BUNDLED_PACK_NAMES];
     const installedDir = gbrainPath('schema-packs');
     const installed: string[] = [];
     if (existsSync(installedDir)) {

src/core/schema-pack/bundled.ts

@@ -0,0 +1,24 @@
+// Bundled schema-pack registry — single source of truth for the packs that
+// ship in src/core/schema-pack/base/. Keep every bundled-pack consumer
+// (CLI/MCP inspection, active-pack loading, mutation guards, upgrade
+// discovery) on this one list so they cannot drift.
+//
+// v0.39 T8 — gbrain-base + gbrain-recommended.
+// v0.41 T4 — lens packs: creator, investor, engineer, everything (meta-pack).
+// v0.42 type-unification — gbrain-base-v2, the 15-type canonical successor.
+
+export const BUNDLED_PACK_NAMES = [
+  'gbrain-base',
+  'gbrain-recommended',
+  'gbrain-creator',
+  'gbrain-investor',
+  'gbrain-engineer',
+  'gbrain-everything',
+  'gbrain-base-v2',
+] as const;
+
+export type BundledPackName = typeof BUNDLED_PACK_NAMES[number];
+
+export function isBundledPackName(name: string): name is BundledPackName {
+  return (BUNDLED_PACK_NAMES as readonly string[]).includes(name);
+}

src/core/schema-pack/load-active.ts

@@ -37,6 +37,7 @@ import {
   type ResolutionInput,
   type ResolutionResult,
 } from './registry.ts';
+import { isBundledPackName } from './bundled.ts';
 
 /**
  * Inputs the caller (operations.ts handler / engine query path) provides.
@@ -92,28 +93,7 @@ export function _resetPackLocatorForTests(): void {
  * throwing UnknownPackError with a paste-ready install hint.
  */
 function defaultPackLocator(name: string): string | null {
-  // v0.39 T8 — bundled packs registry. gbrain-base + gbrain-recommended
-  // ship in src/core/schema-pack/base/. Add a new entry here to bundle
-  // additional canonical packs.
-  //
-  // v0.41 T4 — lens packs join the bundle: creator (atoms + concepts +
-  // extract_atoms/synthesize_concepts phases), investor (theses + bet
-  // resolution + 3 calibration domains), engineer (gstack-learnings bridge
-  // + 3 calibration domains), everything (meta-pack stacking all three
-  // via extends + borrow_from). Each ships as a real YAML at base/<name>.yaml.
-  const BUNDLED: ReadonlyArray<string> = [
-    'gbrain-base',
-    'gbrain-recommended',
-    'gbrain-creator',
-    'gbrain-investor',
-    'gbrain-engineer',
-    'gbrain-everything',
-    // v0.42 type-unification: 15-type canonical successor to gbrain-base.
-    // Ships as install default (Lane E T17) + via gbrain onboard pack
-    // upgrade flow (the unify-types Minion handler).
-    'gbrain-base-v2',
-  ];
-  if (BUNDLED.includes(name)) {
+  if (isBundledPackName(name)) {
     // Resolve bundled YAML relative to this source file. Works in both
     // direct-bun execution and bun --compile binaries.
     const here = dirname(fileURLToPath(import.meta.url));

src/core/schema-pack/loader.ts

@@ -159,6 +159,29 @@ export function parseYamlMini(content: string): unknown {
     return parseMapping(baseIndent);
   }
 
+  function parseBlockScalar(parentIndent: number, folded: boolean): string {
+    const contentIndent = parentIndent + 2;
+    const out: string[] = [];
+    while (i < lines.length) {
+      const raw = lines[i];
+      // Inside a block scalar everything is literal content — '#' is NOT a
+      // comment here, so use the raw line (no stripComment / isBlank).
+      if (raw.trim() === '') {
+        out.push('');
+        i++;
+        continue;
+      }
+      const indent = indentOf(raw);
+      if (indent <= parentIndent) break;
+      out.push(raw.slice(Math.min(contentIndent, indent)));
+      i++;
+    }
+    if (folded) {
+      return out.join(' ').replace(/\s+$/u, '');
+    }
+    return out.join('\n').replace(/\n+$/u, '');
+  }
+
   function parseSequence(baseIndent: number): unknown[] {
     const result: unknown[] = [];
     while (i < lines.length) {
@@ -227,6 +250,10 @@ export function parseYamlMini(content: string): unknown {
           i++;
           if (rest2 === '') {
             map[key2] = parseBlock(nextIndent + 2);
+          } else if (rest2 === '|' || rest2 === '|-' || rest2 === '|+') {
+            map[key2] = parseBlockScalar(nextIndent, false);
+          } else if (rest2 === '>' || rest2 === '>-' || rest2 === '>+') {
+            map[key2] = parseBlockScalar(nextIndent, true);
           } else {
             map[key2] = parseScalar(rest2);
           }
@@ -257,6 +284,10 @@ export function parseYamlMini(content: string): unknown {
       i++;
       if (rest === '') {
         result[key] = parseBlock(indent + 2);
+      } else if (rest === '|' || rest === '|-' || rest === '|+') {
+        result[key] = parseBlockScalar(indent, false);
+      } else if (rest === '>' || rest === '>-' || rest === '>+') {
+        result[key] = parseBlockScalar(indent, true);
       } else {
         result[key] = parseScalar(rest);
       }

src/core/schema-pack/mutate.ts

@@ -65,6 +65,7 @@ import { invalidateQueryCache } from './query-cache-invalidator.ts';
 import { logMutationFailure, logMutationSuccess, type MutationActor, type MutationOp } from './mutate-audit.ts';
 import { runFilePlaneLintRules } from './lint-rules.ts';
 import { withPackLock, type PackLockOpts } from './pack-lock.ts';
+import { BUNDLED_PACK_NAMES as BUNDLED_PACK_NAME_LIST } from './bundled.ts';
 import type { BrainEngine } from '../engine.ts';
 
 export type PackFileFormat = 'json' | 'yaml';
@@ -93,7 +94,7 @@ export class SchemaPackMutationError extends Error {
   }
 }
 
-export const BUNDLED_PACK_NAMES = new Set(['gbrain-base', 'gbrain-recommended', 'gbrain-base-v2']);
+export const BUNDLED_PACK_NAMES = new Set<string>(BUNDLED_PACK_NAME_LIST);
 
 export interface MutateResult {
   /** Pack name that was mutated. */

src/core/source-resolver.ts

@@ -160,33 +160,6 @@ export async function resolveSourceId(
   return 'default';
 }
 
-/**
- * Engine-free tiers (1-3) of the resolution chain: explicit flag →
- * GBRAIN_SOURCE env → .gbrain-source dotfile walk. Used by the thin-client
- * CLI path (#2098), which has no local engine to run tiers 4-6 or
- * assertSourceExists against — the remote server enforces existence + grant.
- * Returns null when no engine-free tier fires.
- */
-export function resolveSourceIdEngineFree(
-  explicit: string | null | undefined,
-  cwd: string = process.cwd(),
-): string | null {
-  if (explicit) {
-    if (!SOURCE_ID_RE.test(explicit)) {
-      throw new Error(`Invalid --source value "${explicit}". Must match [a-z0-9-]{1,32}.`);
-    }
-    return explicit;
-  }
-  const env = process.env.GBRAIN_SOURCE;
-  if (env && env.length > 0) {
-    if (!SOURCE_ID_RE.test(env)) {
-      throw new Error(`Invalid GBRAIN_SOURCE value "${env}". Must match [a-z0-9-]{1,32}.`);
-    }
-    return env;
-  }
-  return readDotfileWalk(cwd);
-}
-
 /**
  * Returns the id of the SINGLE registered non-default source with a
  * local_path, when exactly one such row exists. Returns null when:

test/ai/anthropic-key.test.ts

@@ -10,7 +10,7 @@ import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { withEnv } from '../helpers/with-env.ts';
-import { hasAnthropicKey } from '../../src/core/ai/anthropic-key.ts';
+import { hasAnthropicKey, resolveAnthropicKey } from '../../src/core/ai/anthropic-key.ts';
 
 const tmpDirs: string[] = [];
 function freshHome(withConfig?: Record<string, unknown>): string {
@@ -62,3 +62,35 @@ describe('hasAnthropicKey', () => {
     );
   });
 });
+
+describe('resolveAnthropicKey (#2048 — subagent config-key auth)', () => {
+  test('env wins over config', async () => {
+    const home = freshHome({ anthropic_api_key: 'sk-from-config' });
+    await withEnv(
+      { ANTHROPIC_API_KEY: 'sk-from-env', GBRAIN_HOME: home, DATABASE_URL: undefined, GBRAIN_DATABASE_URL: undefined },
+      async () => {
+        expect(resolveAnthropicKey()).toBe('sk-from-env');
+      },
+    );
+  });
+
+  test('config key returned when env unset', async () => {
+    const home = freshHome({ anthropic_api_key: 'sk-from-config' });
+    await withEnv(
+      { ANTHROPIC_API_KEY: undefined, GBRAIN_HOME: home, DATABASE_URL: undefined, GBRAIN_DATABASE_URL: undefined },
+      async () => {
+        expect(resolveAnthropicKey()).toBe('sk-from-config');
+      },
+    );
+  });
+
+  test('neither → undefined', async () => {
+    const home = freshHome();
+    await withEnv(
+      { ANTHROPIC_API_KEY: undefined, GBRAIN_HOME: home, DATABASE_URL: undefined, GBRAIN_DATABASE_URL: undefined },
+      async () => {
+        expect(resolveAnthropicKey()).toBeUndefined();
+      },
+    );
+  });
+});

test/lens-pack-manifests.test.ts

@@ -55,13 +55,13 @@ describe('v0.41 T4: all 4 bundled lens packs parse cleanly', () => {
 });
 
 describe('v0.41 T4: bundled registry includes lens packs', () => {
-  test('load-active.ts BUNDLED array source includes the 4 lens pack names', () => {
-    const loadActiveSrc = readFileSync(
-      join(here, '..', 'src', 'core', 'schema-pack', 'load-active.ts'),
-      'utf-8',
-    );
+  test('BUNDLED_PACK_NAMES includes the 4 lens pack names', async () => {
+    // The bundled list moved from load-active.ts to bundled.ts (the
+    // single source of truth); assert the array directly instead of
+    // grepping source text.
+    const { BUNDLED_PACK_NAMES } = await import('../src/core/schema-pack/bundled.ts');
     for (const name of PACK_NAMES) {
-      expect(loadActiveSrc).toContain(`'${name}'`);
+      expect(BUNDLED_PACK_NAMES).toContain(name);
     }
   });
 });

test/operations-schema-pack.test.ts

@@ -149,6 +149,9 @@ describe('list_schema_packs', () => {
       seedPack('mine');
       const result = await operationsByName.list_schema_packs!.handler(ctxOf(), {}) as { bundled: string[]; installed: string[] };
       expect(result.bundled).toContain('gbrain-base');
+      expect(result.bundled).toContain('gbrain-recommended');
+      expect(result.bundled).toContain('gbrain-base-v2');
+      expect(result.bundled).toContain('gbrain-investor');
       expect(result.installed).toContain('mine');
     });
   });

test/schema-cli.test.ts

@@ -64,11 +64,14 @@ describe('gbrain schema CLI (Phase C)', () => {
     expect(r.stdout + r.stderr).toMatch(/schema|active|list|show|validate|use/i);
   });
 
-  test('schema list shows gbrain-base bundled', () => {
+  test('schema list shows all bundled packs', () => {
     const r = gbrain(['schema', 'list']);
     expect(r.code).toBe(0);
     expect(r.stdout).toContain('Bundled packs:');
     expect(r.stdout).toContain('gbrain-base');
+    expect(r.stdout).toContain('gbrain-recommended');
+    expect(r.stdout).toContain('gbrain-base-v2');
+    expect(r.stdout).toContain('gbrain-investor');
   });
 
   test('schema show gbrain-base prints manifest details', () => {
@@ -97,6 +100,40 @@ describe('gbrain schema CLI (Phase C)', () => {
     expect(r.stdout).toContain('valid manifest');
   });
 
+  test('schema show/validate exposes bundled gbrain-recommended', () => {
+    const show = gbrain(['schema', 'show', 'gbrain-recommended']);
+    expect(show.code).toBe(0);
+    expect(show.stdout).toContain('gbrain-recommended v1.0.0');
+    expect(show.stdout).toContain('Page types (');
+    expect(show.stdout).toContain('meeting :: temporal');
+
+    const validate = gbrain(['schema', 'validate', 'gbrain-recommended']);
+    expect(validate.code).toBe(0);
+    expect(validate.stdout).toContain('valid manifest');
+  });
+
+  test('schema show exposes bundled gbrain-base-v2 successor pack', () => {
+    const r = gbrain(['schema', 'show', 'gbrain-base-v2']);
+    expect(r.code).toBe(0);
+    expect(r.stdout).toContain('gbrain-base-v2 v1.0.0');
+    expect(r.stdout).toContain('Page types (');
+    expect(r.stdout).toContain('Link verbs (14)');
+  });
+
+  test('schema active loads configured gbrain-recommended with real types', () => {
+    const home = mkdtempSync(join(tmpdir(), 'gbrain-schema-active-recommended-'));
+    try {
+      mkdirSync(join(home, '.gbrain'), { recursive: true });
+      writeFileSync(join(home, '.gbrain', 'config.json'), JSON.stringify({ schema_pack: 'gbrain-recommended' }), 'utf-8');
+      const r = gbrain(['schema', 'active'], { GBRAIN_HOME: home });
+      expect(r.code).toBe(0);
+      expect(r.stdout).toContain('Active pack: gbrain-recommended');
+      expect(r.stdout).not.toContain('Page types: 0');
+    } finally {
+      rmSync(home, { recursive: true, force: true });
+    }
+  });
+
   test('schema active reports default resolution', () => {
     const r = gbrain(['schema', 'active']);
     expect(r.code).toBe(0);

test/schema-pack-loader.test.ts

@@ -345,6 +345,34 @@ describe('YAML mini-parser', () => {
     expect(result.types[1].weight).toBe(2);
   });
 
+  test('parses block scalar without swallowing following keys', () => {
+    const yaml = `name: blocky
+description: |
+  First line.
+  Second line.
+page_types:
+  - name: meeting
+    primitive: temporal
+    path_prefixes:
+      - meetings/
+    aliases: []
+    extractable: true
+    expert_routing: false`;
+    const result = parseYamlMini(yaml) as { description: string; page_types: Array<Record<string, unknown>> };
+    expect(result.description).toBe('First line.\nSecond line.');
+    expect(result.page_types).toHaveLength(1);
+    expect(result.page_types[0].name).toBe('meeting');
+  });
+
+  test('block scalar keeps # as literal content, not a comment', () => {
+    const yaml = `description: |
+  See issue #2029 for context.
+name: hashy`;
+    const result = parseYamlMini(yaml) as Record<string, unknown>;
+    expect(result.description).toBe('See issue #2029 for context.');
+    expect(result.name).toBe('hashy');
+  });
+
   test('strips comments', () => {
     const result = parseYamlMini('# top comment\nname: value # inline comment') as Record<string, unknown>;
     expect(result.name).toBe('value');
@@ -374,6 +402,27 @@ extends: null`;
     const pack = loadPackFromString(json, 'fixture.json');
     expect(pack.name).toBe('json-pack');
   });
+
+  test('loads block-scalar pack descriptions without losing page types', () => {
+    const pack = loadPackFromString(`api_version: gbrain-schema-pack-v1
+name: recommended-fixture
+version: 1.0.0
+extends: gbrain-base
+description: |
+  Operational starter pack.
+page_types:
+  - name: meeting
+    primitive: temporal
+    path_prefixes:
+      - meetings/
+    aliases: []
+    extractable: true
+    expert_routing: false
+link_types: []`, 'fixture.yaml');
+    expect(pack.name).toBe('recommended-fixture');
+    expect(pack.extends).toBe('gbrain-base');
+    expect(pack.page_types.map((t) => t.name)).toContain('meeting');
+  });
 });
 
 describe('ReDoS guard', () => {

test/schema-pack-mutate.test.ts

@@ -103,7 +103,10 @@ describe('locateMutablePackFile — bundled guard', () => {
     expect(BUNDLED_PACK_NAMES.has('gbrain-recommended')).toBe(true);
     // v0.42 (T22): gbrain-base-v2 joins the bundled set.
     expect(BUNDLED_PACK_NAMES.has('gbrain-base-v2')).toBe(true);
-    expect(BUNDLED_PACK_NAMES.size).toBe(3);
+    // Derived from the single bundled registry — the lens packs (creator,
+    // investor, engineer, everything) are read-only too.
+    expect(BUNDLED_PACK_NAMES.has('gbrain-investor')).toBe(true);
+    expect(BUNDLED_PACK_NAMES.size).toBe(7);
   });
 
   it('rejects gbrain-base-v2 with PACK_READONLY (bundled guard)', () => {

test/thin-client-source-scope.test.ts

@@ -1,142 +0,0 @@
-/**
- * #2098: thin-client routing dropped --source / GBRAIN_SOURCE / .gbrain-source.
- *
- * The local CLI path resolves source scope in makeContext (ctx.sourceId); the
- * thin-client route short-circuits before that and sent params verbatim, so
- * `gbrain query --source X` against a remote brain silently searched unscoped
- * (the server op ignores the unknown `source` key).
- *
- * applyThinClientSourceScope runs the engine-free tiers (flag → env → dotfile)
- * and maps the result onto the op's `source_id` wire param. These tests fail
- * without the fix (params.source_id stays undefined / params.source leaks).
- */
-
-import { describe, test, expect } from 'bun:test';
-import { mkdtempSync, rmSync, writeFileSync } from 'fs';
-import { join } from 'path';
-import { tmpdir } from 'os';
-import { applyThinClientSourceScope, parseOpArgs } from '../src/cli.ts';
-import { operationsByName } from '../src/core/operations.ts';
-import { withEnv } from './helpers/with-env.ts';
-
-const queryOp = operationsByName.query;
-
-describe('applyThinClientSourceScope (#2098)', () => {
-  test('--source maps onto the query op wire param source_id', async () => {
-    await withEnv({ GBRAIN_SOURCE: undefined }, () => {
-      const params = parseOpArgs(queryOp, ['find things', '--source', 'wiki']);
-      expect(params.source).toBe('wiki'); // pre-fix state: wrong key
-      applyThinClientSourceScope(queryOp, params, '/');
-      expect(params.source_id).toBe('wiki');
-      expect('source' in params).toBe(false); // never leaks the unknown key
-    });
-  });
-
-  test('GBRAIN_SOURCE env tier fires when no flag is passed', async () => {
-    await withEnv({ GBRAIN_SOURCE: 'gstack' }, () => {
-      const params = parseOpArgs(queryOp, ['find things']);
-      applyThinClientSourceScope(queryOp, params, '/');
-      expect(params.source_id).toBe('gstack');
-    });
-  });
-
-  test('.gbrain-source dotfile tier fires when flag and env are absent', async () => {
-    await withEnv({ GBRAIN_SOURCE: undefined }, () => {
-      const tmp = mkdtempSync(join(tmpdir(), 'gbrain-thin-scope-'));
-      try {
-        writeFileSync(join(tmp, '.gbrain-source'), 'essays\n');
-        const params = parseOpArgs(queryOp, ['find things']);
-        applyThinClientSourceScope(queryOp, params, tmp);
-        expect(params.source_id).toBe('essays');
-      } finally {
-        rmSync(tmp, { recursive: true, force: true });
-      }
-    });
-  });
-
-  test('explicit --source-id on the wire wins over ambient env scope', async () => {
-    await withEnv({ GBRAIN_SOURCE: 'gstack' }, () => {
-      const params = parseOpArgs(queryOp, ['find things', '--source-id', 'wiki']);
-      applyThinClientSourceScope(queryOp, params, '/');
-      expect(params.source_id).toBe('wiki');
-    });
-  });
-
-  test('--source together with --source-id is rejected loudly', async () => {
-    await withEnv({ GBRAIN_SOURCE: undefined }, () => {
-      const params = parseOpArgs(queryOp, ['q', '--source', 'a', '--source-id', 'b']);
-      expect(() => applyThinClientSourceScope(queryOp, params, '/')).toThrow(/not both/);
-    });
-  });
-
-  test('invalid --source value is rejected loudly', async () => {
-    await withEnv({ GBRAIN_SOURCE: undefined }, () => {
-      const params = parseOpArgs(queryOp, ['q', '--source', 'Bad_Value!']);
-      expect(() => applyThinClientSourceScope(queryOp, params, '/')).toThrow(/Invalid --source/);
-    });
-  });
-
-  test('--source on an op with no source_id wire param errors instead of silently dropping', async () => {
-    await withEnv({ GBRAIN_SOURCE: undefined }, () => {
-      const op = operationsByName.add_tag;
-      expect('source_id' in op.params).toBe(false);
-      const params = { slug: 'x', tag: 'y', source: 'wiki' };
-      expect(() => applyThinClientSourceScope(op, params, '/')).toThrow(/--source/);
-    });
-  });
-
-  test('ambient env scope on an op with no source_id wire param is ignored (no throw)', async () => {
-    await withEnv({ GBRAIN_SOURCE: 'wiki' }, () => {
-      const op = operationsByName.add_tag;
-      const params: Record<string, unknown> = { slug: 'x', tag: 'y' };
-      applyThinClientSourceScope(op, params, '/');
-      expect(params.source_id).toBeUndefined();
-    });
-  });
-
-  test('ops that declare their OWN source param are left untouched', async () => {
-    await withEnv({ GBRAIN_SOURCE: undefined }, () => {
-      const op = operationsByName.put_raw_data;
-      expect('source' in op.params).toBe(true);
-      const params: Record<string, unknown> = { slug: 'x', source: 'crustdata', data: {} };
-      applyThinClientSourceScope(op, params, '/');
-      expect(params.source).toBe('crustdata');
-      expect(params.source_id).toBeUndefined();
-    });
-  });
-
-  test('get_skill: ambient scope never leaks into its non-scope source_id param', async () => {
-    await withEnv({ GBRAIN_SOURCE: 'wiki' }, () => {
-      const op = operationsByName.get_skill;
-      expect('source_id' in op.params).toBe(true); // has the param, but it is a mode switch
-      const params: Record<string, unknown> = { name: 'ingest' };
-      applyThinClientSourceScope(op, params, '/');
-      expect(params.source_id).toBeUndefined(); // would flip host catalog → brain-pack lookup
-    });
-  });
-
-  test('get_skill: explicit --source errors instead of masquerading as --source-id', async () => {
-    await withEnv({ GBRAIN_SOURCE: undefined }, () => {
-      const op = operationsByName.get_skill;
-      const params: Record<string, unknown> = { name: 'ingest', source: 'wiki' };
-      expect(() => applyThinClientSourceScope(op, params, '/')).toThrow(/--source-id/);
-    });
-  });
-
-  test('get_skill: explicit --source-id passes through untouched', async () => {
-    await withEnv({ GBRAIN_SOURCE: 'gstack' }, () => {
-      const op = operationsByName.get_skill;
-      const params: Record<string, unknown> = { name: 'ingest', source_id: 'wiki' };
-      applyThinClientSourceScope(op, params, '/');
-      expect(params.source_id).toBe('wiki');
-    });
-  });
-
-  test('no scope from any tier leaves params unchanged', async () => {
-    await withEnv({ GBRAIN_SOURCE: undefined }, () => {
-      const params = parseOpArgs(queryOp, ['find things']);
-      applyThinClientSourceScope(queryOp, params, '/');
-      expect(params.source_id).toBeUndefined();
-    });
-  });
-});