Harden companion platform tests

tests/brainstorm-server/auth.test.js

@@ -107,6 +107,22 @@ async function waitForServer(server) {
   });
 }
 
+function serverStartedMessage(out) {
+  const line = out.trim().split('\n').find(l => l.includes('server-started'));
+  assert(line, 'server-started JSON should be present');
+  return JSON.parse(line);
+}
+
+function assertStartedOnExpectedPort(out) {
+  const msg = serverStartedMessage(out);
+  assert.strictEqual(
+    msg.port,
+    TEST_PORT,
+    `auth.test.js expected fixed port ${TEST_PORT}, got ${msg.port}; fixed-port tests must not run through fallback`
+  );
+  return msg;
+}
+
 async function runTests() {
   cleanup();
   fs.mkdirSync(CONTENT_DIR, { recursive: true });
@@ -116,7 +132,6 @@ async function runTests() {
   const server = startServer();
   let stdoutAccum = '';
   server.stdout.on('data', (d) => { stdoutAccum += d.toString(); });
-  const { stdout: initialStdout } = await waitForServer(server);
 
   let passed = 0, failed = 0;
   async function test(name, fn) {
@@ -125,10 +140,13 @@ async function runTests() {
   }
 
   try {
+    const { stdout: initialStdout } = await waitForServer(server);
+    assertStartedOnExpectedPort(initialStdout);
+
     console.log('\n--- Startup URL ---');
 
     await test('server-started url includes the session key', () => {
-      const msg = JSON.parse(initialStdout.trim());
+      const msg = serverStartedMessage(initialStdout);
       assert(msg.url.includes(`key=${TOKEN}`), `url should carry the key, got: ${msg.url}`);
     });
 

tests/brainstorm-server/start-server.test.sh

@@ -48,6 +48,7 @@ make_fake_uname "$TEST_DIR/fake-bin"
 cat > "$TEST_DIR/fake-bin/node" <<'EOF'
 #!/usr/bin/env bash
 echo "CAPTURED_OWNER_PID=${BRAINSTORM_OWNER_PID:-__UNSET__}"
+echo "CAPTURED_ARGV=$*"
 exit 0
 EOF
 chmod +x "$TEST_DIR/fake-bin/node"
@@ -66,6 +67,26 @@ else
        "expected empty or unset, got '$owner_pid_value'"
 fi
 
+captured_argv=$(echo "$captured" | grep "CAPTURED_ARGV=" | head -1 | sed 's/CAPTURED_ARGV=//')
+if echo "$captured_argv" | grep -Eq -- '--brainstorm-server-id=[A-Za-z0-9_-]{32,64}'; then
+  pass "passes shell-safe server instance id argv"
+else
+  fail "passes shell-safe server instance id argv" \
+       "expected --brainstorm-server-id=<safe id>, got: $captured_argv"
+fi
+
+server_id_file=$(find "$TEST_DIR/project/.superpowers/brainstorm" -name server-instance-id -print 2>/dev/null | head -1)
+server_id_value=""
+if [[ -n "$server_id_file" ]]; then
+  server_id_value="$(tr -d '\r\n' < "$server_id_file")"
+fi
+if [[ "$server_id_value" =~ ^[A-Za-z0-9_-]{32,64}$ ]]; then
+  pass "writes shell-safe server-instance-id state file"
+else
+  fail "writes shell-safe server-instance-id state file" \
+       "expected valid id in state, got '$server_id_value'"
+fi
+
 rm -rf "$TEST_DIR/project"/*
 
 cat > "$TEST_DIR/fake-bin/node" <<'EOF'

tests/brainstorm-server/windows-lifecycle.test.sh

@@ -162,6 +162,7 @@ if [[ "$is_windows" == "true" ]]; then
   cat > "$FAKE_NODE_DIR/node" <<'FAKENODE'
 #!/usr/bin/env bash
 echo "CAPTURED_OWNER_PID=${BRAINSTORM_OWNER_PID:-__UNSET__}"
+echo "CAPTURED_ARGV=$*"
 exit 0
 FAKENODE
   chmod +x "$FAKE_NODE_DIR/node"
@@ -176,6 +177,14 @@ FAKENODE
          "Expected empty or unset, got '$owner_pid_value'"
   fi
 
+  captured_argv=$(echo "$captured" | grep "CAPTURED_ARGV=" | head -1 | sed 's/CAPTURED_ARGV=//')
+  if echo "$captured_argv" | grep -Eq -- '--brainstorm-server-id=[A-Za-z0-9_-]{32,64}'; then
+    pass "start-server.sh passes server instance id argv on Windows"
+  else
+    fail "start-server.sh passes server instance id argv on Windows" \
+         "Expected --brainstorm-server-id=<safe id>, output: $captured"
+  fi
+
   rm -rf "$FAKE_NODE_DIR" "$TEST_DIR/session"
 else
   skip "start-server.sh passes empty BRAINSTORM_OWNER_PID" "not on Windows"