feat: add all domain layers (dotfiles, packages, remote, containers)

- Dotfiles: models, module resolution, path resolution, link planning
- Packages: models, catalog parsing, resolution, install/remove planning
- Remote: target parsing, SSH command building
- Containers: image refs, mount resolution, container specs

All domain code is pure functions + frozen dataclasses. 88 tests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/test_domain_containers.py

@@ -0,0 +1,80 @@
+"""Tests for containers domain."""
+
+from pathlib import Path
+
+from flow.domain.containers.models import ContainerSpec, ImageRef, Mount
+from flow.domain.containers.resolution import (
+    build_container_spec,
+    container_name,
+    parse_image_ref,
+    resolve_mounts,
+)
+
+
+class TestParseImageRef:
+    def test_simple_name(self):
+        ref = parse_image_ref("devbox")
+        assert ref.registry == "registry.tomastm.com"
+        assert ref.name == "devbox"
+        assert ref.tag == "latest"
+
+    def test_with_tag(self):
+        ref = parse_image_ref("devbox:v2")
+        assert ref.tag == "v2"
+
+    def test_full_ref(self):
+        ref = parse_image_ref("ghcr.io/user/image:main")
+        assert ref.registry == "ghcr.io"
+        assert ref.name == "user/image"
+        assert ref.tag == "main"
+
+    def test_full_image_string(self):
+        ref = parse_image_ref("devbox")
+        assert ref.full == "registry.tomastm.com/devbox:latest"
+
+
+class TestContainerName:
+    def test_basic(self):
+        assert container_name("personal", "devbox") == "flow-personal-devbox"
+
+
+class TestResolveMounts:
+    def test_projects_mount(self, tmp_path):
+        projects = tmp_path / "projects"
+        projects.mkdir()
+        mounts = resolve_mounts(tmp_path, str(projects))
+        project_mounts = [m for m in mounts if m.target == "/home/user/projects"]
+        assert len(project_mounts) == 1
+
+    def test_extra_mounts(self, tmp_path):
+        mounts = resolve_mounts(
+            tmp_path, str(tmp_path),
+            extra_mounts=[{"source": str(tmp_path), "target": "/data"}],
+        )
+        extra = [m for m in mounts if m.target == "/data"]
+        assert len(extra) == 1
+
+
+class TestBuildContainerSpec:
+    def test_basic(self):
+        image = ImageRef(registry="reg", name="img", tag="v1")
+        spec = build_container_spec("personal", image, [])
+        assert spec.name == "flow-personal-img"
+        assert spec.env["DF_NAMESPACE"] == "personal"
+        assert spec.env["DF_PLATFORM"] == "container"
+
+    def test_with_mounts(self):
+        image = ImageRef(registry="reg", name="img", tag="v1")
+        mounts = [Mount(source=Path("/a"), target="/b")]
+        spec = build_container_spec("ns", image, mounts)
+        assert len(spec.mounts) == 1
+
+
+class TestMount:
+    def test_to_flag(self):
+        m = Mount(source=Path("/src"), target="/dst")
+        assert m.to_flag() == "-v /src:/dst"
+
+    def test_to_flag_readonly(self):
+        m = Mount(source=Path("/src"), target="/dst", readonly=True)
+        assert ":ro" in m.to_flag()

tests/test_domain_dotfiles_models.py

@@ -0,0 +1,47 @@
+"""Tests for dotfiles domain models."""
+
+from pathlib import Path
+
+from flow.domain.dotfiles.models import (
+    LinkOp,
+    LinkPlan,
+    LinkTarget,
+    LinkedState,
+    ModuleRef,
+    Package,
+    PlanSummary,
+)
+
+
+def test_link_op_str_create():
+    op = LinkOp(type="create_link", target=Path("/home/x/.zshrc"),
+                source=Path("/dots/zsh/.zshrc"), package="_shared/zsh", needs_sudo=False)
+    assert "LINK:" in str(op)
+    assert ".zshrc" in str(op)
+
+
+def test_link_op_str_sudo():
+    op = LinkOp(type="create_link", target=Path("/etc/hosts"),
+                source=Path("/dots/dns/hosts"), package="_shared/dns", needs_sudo=True)
+    assert "(sudo)" in str(op)
+
+
+def test_linked_state_roundtrip():
+    lt = LinkTarget(source=Path("/a"), target=Path("/b"), package="p", from_module=False, needs_sudo=False)
+    state = LinkedState(links={Path("/b"): lt})
+    data = state.as_dict()
+    restored = LinkedState.from_dict(data)
+    assert Path("/b") in restored.links
+    assert restored.links[Path("/b")].source == Path("/a")
+    assert restored.links[Path("/b")].package == "p"
+
+
+def test_linked_state_empty():
+    state = LinkedState.from_dict({})
+    assert state.links == {}
+
+
+def test_package_has_id():
+    pkg = Package(name="zsh", layer="_shared", package_id="_shared/zsh",
+                  source_dir=Path("/dots/_shared/zsh"), module=None, local_files=())
+    assert pkg.package_id == "_shared/zsh"

tests/test_domain_dotfiles_modules.py

@@ -0,0 +1,99 @@
+"""Tests for dotfiles module resolution -- the core bug fix."""
+
+from pathlib import Path
+
+import pytest
+
+from flow.core.errors import ConfigError
+from flow.domain.dotfiles.modules import (
+    compute_mount_path,
+    module_cache_dir,
+    normalize_source,
+    parse_module_ref,
+)
+
+
+class TestComputeMountPath:
+    def test_nested_module(self):
+        """_shared/nvim/.config/nvim/_module.yaml -> .config/nvim"""
+        result = compute_mount_path(
+            module_yaml=Path("/dots/_shared/nvim/.config/nvim/_module.yaml"),
+            package_dir=Path("/dots/_shared/nvim"),
+        )
+        assert result == Path(".config/nvim")
+
+    def test_root_level_module(self):
+        """_shared/nvim/_module.yaml -> Path('.')"""
+        result = compute_mount_path(
+            module_yaml=Path("/dots/_shared/nvim/_module.yaml"),
+            package_dir=Path("/dots/_shared/nvim"),
+        )
+        assert result == Path(".")
+
+    def test_deeply_nested(self):
+        result = compute_mount_path(
+            module_yaml=Path("/dots/_shared/pkg/.config/a/b/c/_module.yaml"),
+            package_dir=Path("/dots/_shared/pkg"),
+        )
+        assert result == Path(".config/a/b/c")
+
+
+class TestModuleCacheDir:
+    def test_simple_name(self):
+        result = module_cache_dir("_shared/nvim", Path("/home/x/.local/share/flow/modules"))
+        assert result == Path("/home/x/.local/share/flow/modules/_shared--nvim")
+
+    def test_profile_name(self):
+        result = module_cache_dir("linux-work/nvim", Path("/m"))
+        assert result == Path("/m/linux-work--nvim")
+
+
+class TestNormalizeSource:
+    def test_github_shorthand(self):
+        assert normalize_source("github:org/repo") == "https://github.com/org/repo.git"
+
+    def test_full_url_passthrough(self):
+        assert normalize_source("https://example.com/repo.git") == "https://example.com/repo.git"
+
+    def test_ssh_passthrough(self):
+        assert normalize_source("git@github.com:org/repo.git") == "git@github.com:org/repo.git"
+
+
+class TestParseModuleRef:
+    def test_branch_ref(self):
+        raw = {"source": "github:org/nvim-config", "ref": {"branch": "main"}}
+        ref = parse_module_ref(
+            raw, package_id="_shared/nvim",
+            mount_path=Path(".config/nvim"),
+            modules_base=Path("/modules"),
+        )
+        assert ref.source == "https://github.com/org/nvim-config.git"
+        assert ref.ref_type == "branch"
+        assert ref.ref_value == "main"
+        assert ref.mount_path == Path(".config/nvim")
+        assert ref.cache_dir == Path("/modules/_shared--nvim")
+
+    def test_tag_ref(self):
+        raw = {"source": "github:org/repo", "ref": {"tag": "v1.0"}}
+        ref = parse_module_ref(raw, "p/x", Path("."), Path("/m"))
+        assert ref.ref_type == "tag"
+        assert ref.ref_value == "v1.0"
+
+    def test_missing_source_raises(self):
+        with pytest.raises(ConfigError):
+            parse_module_ref({}, "p/x", Path("."), Path("/m"))
+
+    def test_missing_ref_raises(self):
+        raw = {"source": "github:org/repo"}
+        with pytest.raises(ConfigError):
+            parse_module_ref(raw, "p/x", Path("."), Path("/m"))
+
+    def test_ref_not_dict_raises(self):
+        raw = {"source": "github:org/repo", "ref": "main"}
+        with pytest.raises(ConfigError):
+            parse_module_ref(raw, "p/x", Path("."), Path("/m"))
+
+    def test_ambiguous_ref_raises(self):
+        raw = {"source": "github:org/repo", "ref": {"branch": "main", "tag": "v1"}}
+        with pytest.raises(ConfigError):
+            parse_module_ref(raw, "p/x", Path("."), Path("/m"))

tests/test_domain_dotfiles_planning.py

@@ -0,0 +1,97 @@
+"""Tests for dotfiles link planning."""
+
+from pathlib import Path
+from typing import Optional
+
+from flow.domain.dotfiles.models import (
+    LinkOp,
+    LinkTarget,
+    LinkedState,
+)
+from flow.domain.dotfiles.planning import plan_link, plan_unlink
+
+
+def _lt(target, source="/a", pkg="_shared/zsh", module=False, sudo=False):
+    return LinkTarget(
+        source=Path(source), target=Path(target),
+        package=pkg, from_module=module, needs_sudo=sudo,
+    )
+
+
+def _fs_check_none(path: Path) -> Optional[str]:
+    """Fake filesystem_check: nothing exists."""
+    return None
+
+
+def _fs_check_file(path: Path) -> Optional[str]:
+    """Fake: everything is a file."""
+    return "file"
+
+
+class TestPlanLink:
+    def test_new_target_creates_link(self):
+        desired = [_lt("/home/x/.zshrc")]
+        plan = plan_link(desired, LinkedState(), _fs_check_none)
+        assert len(plan.operations) == 1
+        assert plan.operations[0].type == "create_link"
+        assert plan.summary.added == 1
+
+    def test_existing_correct_link_unchanged(self):
+        lt = _lt("/home/x/.zshrc")
+        current = LinkedState(links={Path("/home/x/.zshrc"): lt})
+        plan = plan_link([lt], current, _fs_check_none)
+        assert len(plan.operations) == 0
+        assert plan.summary.unchanged == 1
+
+    def test_stale_link_removed(self):
+        old = _lt("/home/x/.old")
+        current = LinkedState(links={Path("/home/x/.old"): old})
+        plan = plan_link([], current, _fs_check_none)
+        assert len(plan.operations) == 1
+        assert plan.operations[0].type == "remove_link"
+        assert plan.summary.removed == 1
+
+    def test_changed_source_produces_remove_then_create(self):
+        old = _lt("/home/x/.zshrc", source="/old")
+        new = _lt("/home/x/.zshrc", source="/new")
+        current = LinkedState(links={Path("/home/x/.zshrc"): old})
+        plan = plan_link([new], current, _fs_check_none)
+        types = [op.type for op in plan.operations]
+        assert types == ["remove_link", "create_link"]
+
+    def test_unmanaged_file_at_target_is_conflict(self):
+        desired = [_lt("/home/x/.zshrc")]
+        plan = plan_link(desired, LinkedState(), _fs_check_file)
+        assert len(plan.conflicts) == 1
+        assert ".zshrc" in plan.conflicts[0]
+
+    def test_module_targets_counted(self):
+        desired = [_lt("/home/x/.config/nvim/init.lua", module=True)]
+        plan = plan_link(desired, LinkedState(), _fs_check_none)
+        assert plan.summary.from_modules == 1
+
+
+class TestPlanUnlink:
+    def test_unlink_all(self):
+        lt = _lt("/home/x/.zshrc")
+        current = LinkedState(links={Path("/home/x/.zshrc"): lt})
+        plan = plan_unlink(current, packages=None)
+        assert len(plan.operations) == 1
+        assert plan.operations[0].type == "remove_link"
+
+    def test_unlink_specific_package(self):
+        zsh = _lt("/home/x/.zshrc", pkg="_shared/zsh")
+        git = _lt("/home/x/.gitconfig", pkg="_shared/git")
+        current = LinkedState(links={
+            Path("/home/x/.zshrc"): zsh,
+            Path("/home/x/.gitconfig"): git,
+        })
+        plan = plan_unlink(current, packages=["_shared/zsh"])
+        assert len(plan.operations) == 1
+        assert plan.operations[0].target == Path("/home/x/.zshrc")
+
+    def test_unlink_by_basename(self):
+        zsh = _lt("/home/x/.zshrc", pkg="_shared/zsh")
+        current = LinkedState(links={Path("/home/x/.zshrc"): zsh})
+        plan = plan_unlink(current, packages=["zsh"])
+        assert len(plan.operations) == 1

tests/test_domain_dotfiles_resolution.py

@@ -0,0 +1,144 @@
+"""Tests for dotfiles path resolution."""
+
+from pathlib import Path
+
+import pytest
+
+from flow.core.errors import PlanConflict
+from flow.domain.dotfiles.models import LinkTarget, ModuleRef, Package
+from flow.domain.dotfiles.resolution import resolve_all_targets, resolve_package_targets
+
+RESERVED_ROOT = "_root"
+HOME = Path("/home/testuser")
+
+
+def _pkg(name, layer="_shared", files=(), module=None):
+    return Package(
+        name=name,
+        layer=layer,
+        package_id=f"{layer}/{name}",
+        source_dir=Path(f"/dots/{layer}/{name}"),
+        module=module,
+        local_files=tuple(files),
+    )
+
+
+class TestResolvePackageTargets:
+    def test_simple_file(self):
+        pkg = _pkg("zsh", files=[
+            (Path("/dots/_shared/zsh/.zshrc"), Path(".zshrc")),
+        ])
+        targets = resolve_package_targets(pkg, HOME, set())
+        assert len(targets) == 1
+        assert targets[0].target == HOME / ".zshrc"
+        assert targets[0].source == Path("/dots/_shared/zsh/.zshrc")
+        assert targets[0].from_module is False
+
+    def test_nested_config(self):
+        pkg = _pkg("git", files=[
+            (Path("/dots/_shared/git/.config/git/config"), Path(".config/git/config")),
+        ])
+        targets = resolve_package_targets(pkg, HOME, set())
+        assert targets[0].target == HOME / ".config" / "git" / "config"
+
+    def test_root_marker(self):
+        pkg = _pkg("dns", files=[
+            (Path("/dots/_shared/dns/_root/etc/hosts"), Path("_root/etc/hosts")),
+        ])
+        targets = resolve_package_targets(pkg, HOME, set())
+        assert targets[0].target == Path("/etc/hosts")
+        assert targets[0].needs_sudo is True
+
+    def test_root_marker_skipped_when_in_skip_set(self):
+        pkg = _pkg("dns", files=[
+            (Path("/dots/_shared/dns/_root/etc/hosts"), Path("_root/etc/hosts")),
+        ])
+        targets = resolve_package_targets(pkg, HOME, {"_root"})
+        assert len(targets) == 0
+
+    def test_skip_package_by_name(self):
+        pkg = _pkg("nvim", files=[
+            (Path("/dots/_shared/nvim/.config/nvim/init.lua"), Path(".config/nvim/init.lua")),
+        ])
+        targets = resolve_package_targets(pkg, HOME, {"nvim"})
+        assert len(targets) == 0
+
+    def test_module_files_linked_under_mount_path(self):
+        module = ModuleRef(
+            source="https://github.com/org/nvim-config.git",
+            ref_type="branch",
+            ref_value="main",
+            mount_path=Path(".config/nvim"),
+            cache_dir=Path("/modules/_shared--nvim"),
+            module_files=(
+                (Path("/modules/_shared--nvim/init.lua"), Path("init.lua")),
+                (Path("/modules/_shared--nvim/lua/plugins.lua"), Path("lua/plugins.lua")),
+            ),
+        )
+        pkg = _pkg("nvim", files=[
+            (Path("/dots/_shared/nvim/.local/bin/nvim-wrapper"), Path(".local/bin/nvim-wrapper")),
+        ], module=module)
+
+        targets = resolve_package_targets(pkg, HOME, set())
+
+        # Local file outside mount_path
+        local_targets = [t for t in targets if not t.from_module]
+        assert len(local_targets) == 1
+        assert local_targets[0].target == HOME / ".local" / "bin" / "nvim-wrapper"
+
+        # Module files under mount_path
+        module_targets = [t for t in targets if t.from_module]
+        assert len(module_targets) == 2
+        module_target_paths = {t.target for t in module_targets}
+        assert HOME / ".config" / "nvim" / "init.lua" in module_target_paths
+        assert HOME / ".config" / "nvim" / "lua" / "plugins.lua" in module_target_paths
+
+    def test_module_yaml_file_not_linked(self):
+        """The _module.yaml marker itself should never be linked."""
+        pkg = _pkg("nvim", files=[
+            (Path("/dots/_shared/nvim/.config/nvim/_module.yaml"), Path(".config/nvim/_module.yaml")),
+        ], module=ModuleRef(
+            source="x", ref_type="branch", ref_value="main",
+            mount_path=Path(".config/nvim"),
+            cache_dir=Path("/m"), module_files=(),
+        ))
+        targets = resolve_package_targets(pkg, HOME, set())
+        assert not any(t.target.name == "_module.yaml" for t in targets)
+
+    def test_root_level_module_skips_all_local_files(self):
+        """When mount_path is '.', all local files are from the module, not dotfiles repo."""
+        module = ModuleRef(
+            source="x", ref_type="branch", ref_value="main",
+            mount_path=Path("."),
+            cache_dir=Path("/m"),
+            module_files=(
+                (Path("/m/init.lua"), Path("init.lua")),
+            ),
+        )
+        pkg = _pkg("nvim", files=[
+            (Path("/dots/_shared/nvim/_module.yaml"), Path("_module.yaml")),
+            (Path("/dots/_shared/nvim/stale-file.txt"), Path("stale-file.txt")),
+        ], module=module)
+        targets = resolve_package_targets(pkg, HOME, set())
+        # Only module files should appear, local files skipped
+        assert len(targets) == 1
+        assert targets[0].from_module is True
+        assert targets[0].target == HOME / "init.lua"
+
+
+class TestResolveAllTargets:
+    def test_no_conflicts(self):
+        pkgs = [
+            _pkg("zsh", files=[(Path("/a/.zshrc"), Path(".zshrc"))]),
+            _pkg("git", files=[(Path("/a/.gitconfig"), Path(".gitconfig"))]),
+        ]
+        targets = resolve_all_targets(pkgs, HOME, set())
+        assert len(targets) == 2
+
+    def test_duplicate_target_raises(self):
+        pkgs = [
+            _pkg("zsh", layer="_shared", files=[(Path("/a/.zshrc"), Path(".zshrc"))]),
+            _pkg("zsh", layer="work", files=[(Path("/b/.zshrc"), Path(".zshrc"))]),
+        ]
+        with pytest.raises(PlanConflict):
+            resolve_all_targets(pkgs, HOME, set())

tests/test_domain_packages.py

@@ -0,0 +1,187 @@
+"""Tests for packages catalog and resolution."""
+
+import pytest
+
+from flow.core.errors import ConfigError, FlowError
+from flow.domain.packages.catalog import normalize_profile_entry, parse_catalog
+from flow.domain.packages.resolution import (
+    detect_package_manager,
+    pm_install_command,
+    pm_update_command,
+    resolve_binary_asset,
+    resolve_download_url,
+    resolve_source_name,
+    resolve_spec,
+)
+from flow.domain.packages.models import PackageDef, ProfilePackageRef
+
+
+class TestParseCatalog:
+    def test_list_format(self):
+        manifest = {"packages": [
+            {"name": "fd", "type": "pkg", "apt": "fd-find"},
+            {"name": "ripgrep", "type": "pkg"},
+        ]}
+        catalog = parse_catalog(manifest)
+        assert "fd" in catalog
+        assert catalog["fd"].sources.get("apt") == "fd-find"
+        assert "ripgrep" in catalog
+
+    def test_dict_format(self):
+        manifest = {"packages": {
+            "fd": {"type": "pkg", "apt": "fd-find"},
+        }}
+        catalog = parse_catalog(manifest)
+        assert "fd" in catalog
+        assert catalog["fd"].type == "pkg"
+
+    def test_empty_manifest(self):
+        assert parse_catalog({}) == {}
+
+
+class TestNormalizeProfileEntry:
+    def test_string_shorthand_with_type(self):
+        ref = normalize_profile_entry("binary/neovim")
+        assert ref.name == "neovim"
+        assert ref.type == "binary"
+
+    def test_plain_name(self):
+        ref = normalize_profile_entry("fd")
+        assert ref.name == "fd"
+        assert ref.type is None
+
+    def test_dict_entry(self):
+        ref = normalize_profile_entry({"name": "nvim", "type": "binary", "version": "0.10"})
+        assert ref.name == "nvim"
+        assert ref.type == "binary"
+        assert ref.version == "0.10"
+
+
+class TestResolveSpec:
+    def test_merge_with_catalog(self):
+        catalog = {"fd": PackageDef(
+            name="fd", type="pkg", sources={"apt": "fd-find"},
+            source=None, version=None, asset_pattern=None,
+            platform_map={}, extract_dir=None, install={},
+            post_install=None, allow_sudo=False,
+        )}
+        ref = ProfilePackageRef(name="fd", type=None, source=None, version="1.0", asset_pattern=None)
+        result = resolve_spec(ref, catalog)
+        assert result.type == "pkg"  # from catalog
+        assert result.version == "1.0"  # from profile
+        assert result.sources == {"apt": "fd-find"}  # from catalog
+
+    def test_not_in_catalog(self):
+        ref = ProfilePackageRef(name="unknown", type="binary", source="github:u/r", version=None, asset_pattern=None)
+        result = resolve_spec(ref, {})
+        assert result.name == "unknown"
+        assert result.type == "binary"
+
+
+class TestResolveSourceName:
+    def test_with_pm_mapping(self):
+        pkg = PackageDef(
+            name="fd", type="pkg", sources={"apt": "fd-find"},
+            source=None, version=None, asset_pattern=None,
+            platform_map={}, extract_dir=None, install={},
+            post_install=None, allow_sudo=False,
+        )
+        assert resolve_source_name(pkg, "apt") == "fd-find"
+
+    def test_fallback_to_name(self):
+        pkg = PackageDef(
+            name="fd", type="pkg", sources={},
+            source=None, version=None, asset_pattern=None,
+            platform_map={}, extract_dir=None, install={},
+            post_install=None, allow_sudo=False,
+        )
+        assert resolve_source_name(pkg, "apt") == "fd"
+
+
+class TestResolveBinaryAsset:
+    def test_platform_map(self):
+        pkg = PackageDef(
+            name="nvim", type="binary", sources={},
+            source="github:neovim/neovim",
+            version="v0.10.4",
+            asset_pattern=None,
+            platform_map={"linux-x64": "nvim-linux-x86_64.tar.gz"},
+            extract_dir=None, install={},
+            post_install=None, allow_sudo=False,
+        )
+        assert resolve_binary_asset(pkg, "linux-x64") == "nvim-linux-x86_64.tar.gz"
+
+    def test_asset_pattern(self):
+        pkg = PackageDef(
+            name="fd", type="binary", sources={},
+            source="github:sharkdp/fd",
+            version="v10.2.0",
+            asset_pattern="fd-v10.2.0-{arch}-unknown-{os}-gnu.tar.gz",
+            platform_map={},
+            extract_dir=None, install={},
+            post_install=None, allow_sudo=False,
+        )
+        result = resolve_binary_asset(pkg, "linux-x64")
+        assert "x64" in result
+        assert "linux" in result
+
+
+class TestResolveDownloadUrl:
+    def test_github_shorthand_with_version(self):
+        pkg = PackageDef(
+            name="nvim", type="binary", sources={},
+            source="github:neovim/neovim",
+            version="v0.10.4",
+            asset_pattern=None, platform_map={},
+            extract_dir=None, install={},
+            post_install=None, allow_sudo=False,
+        )
+        url = resolve_download_url(pkg, "nvim.tar.gz")
+        assert "github.com/neovim/neovim" in url
+        assert "v0.10.4" in url
+
+    def test_github_latest(self):
+        pkg = PackageDef(
+            name="nvim", type="binary", sources={},
+            source="github:neovim/neovim",
+            version=None,
+            asset_pattern=None, platform_map={},
+            extract_dir=None, install={},
+            post_install=None, allow_sudo=False,
+        )
+        url = resolve_download_url(pkg, "nvim.tar.gz")
+        assert "latest" in url
+
+    def test_direct_url(self):
+        pkg = PackageDef(
+            name="x", type="binary", sources={},
+            source="https://example.com/download/",
+            version=None,
+            asset_pattern=None, platform_map={},
+            extract_dir=None, install={},
+            post_install=None, allow_sudo=False,
+        )
+        url = resolve_download_url(pkg, "x.tar.gz")
+        assert url == "https://example.com/download/x.tar.gz"
+
+
+class TestPmCommands:
+    def test_apt_update(self):
+        assert "apt-get update" in pm_update_command("apt")
+
+    def test_dnf_update(self):
+        assert "dnf" in pm_update_command("dnf")
+
+    def test_brew_install(self):
+        cmd = pm_install_command("brew", ["fd", "rg"])
+        assert "brew install" in cmd
+        assert "fd" in cmd
+
+    def test_apt_install(self):
+        cmd = pm_install_command("apt", ["fd-find"])
+        assert "apt-get install" in cmd
+
+    def test_detect_package_manager_returns_something(self):
+        # Just verify it doesn't error
+        result = detect_package_manager()
+        assert result is None or result in ("apt", "dnf", "brew")

tests/test_domain_packages_models.py

@@ -0,0 +1,43 @@
+"""Tests for packages domain models."""
+
+from pathlib import Path
+
+import pytest
+
+from flow.core.errors import ConfigError
+from flow.domain.packages.models import InstalledPackage, InstalledState, PackageDef
+
+
+def test_installed_state_roundtrip():
+    state = InstalledState(packages={
+        "neovim": InstalledPackage(
+            name="neovim", version="0.10.4", type="binary",
+            files=[Path("/home/x/.local/bin/nvim")],
+        ),
+    })
+    data = state.as_dict()
+    restored = InstalledState.from_dict(data)
+    assert "neovim" in restored.packages
+    assert restored.packages["neovim"].version == "0.10.4"
+    assert restored.packages["neovim"].files == [Path("/home/x/.local/bin/nvim")]
+
+
+def test_installed_state_empty():
+    state = InstalledState.from_dict({})
+    assert state.packages == {}
+
+
+def test_installed_state_version_mismatch():
+    with pytest.raises(ConfigError):
+        InstalledState.from_dict({"version": 99, "packages": {}})
+
+
+def test_package_def_fields():
+    pkg = PackageDef(
+        name="fd", type="pkg", sources={"apt": "fd-find"},
+        source=None, version=None, asset_pattern=None,
+        platform_map={}, extract_dir=None, install={},
+        post_install=None, allow_sudo=False,
+    )
+    assert pkg.name == "fd"
+    assert pkg.type == "pkg"

tests/test_domain_packages_planning.py

@@ -0,0 +1,64 @@
+"""Tests for package install/remove planning."""
+
+from pathlib import Path
+
+from flow.domain.packages.models import (
+    InstalledPackage,
+    InstalledState,
+    PackageDef,
+)
+from flow.domain.packages.planning import plan_install, plan_remove
+
+
+def _pkg(name, type="pkg", sources=None, source=None, version=None,
+         asset_pattern=None, platform_map=None):
+    return PackageDef(
+        name=name, type=type, sources=sources or {},
+        source=source, version=version, asset_pattern=asset_pattern,
+        platform_map=platform_map or {}, extract_dir=None, install={},
+        post_install=None, allow_sudo=False,
+    )
+
+
+class TestPlanInstall:
+    def test_new_pm_package(self):
+        pkgs = [_pkg("fd", sources={"apt": "fd-find"})]
+        plan = plan_install(pkgs, InstalledState(), "linux-x64", pm="apt")
+        assert len(plan.install_ops) == 1
+        assert plan.install_ops[0].method == "pm"
+        assert plan.install_ops[0].source_name == "fd-find"
+        assert plan.pm_update_needed is True
+
+    def test_skip_already_installed(self):
+        pkgs = [_pkg("fd")]
+        installed = InstalledState(packages={
+            "fd": InstalledPackage(name="fd", version="1.0", type="pkg"),
+        })
+        plan = plan_install(pkgs, installed, "linux-x64", pm="apt")
+        assert len(plan.install_ops) == 0
+
+    def test_binary_package(self):
+        pkgs = [_pkg("nvim", type="binary", source="github:neovim/neovim",
+                      version="v0.10.4",
+                      platform_map={"linux-x64": "nvim-linux-x86_64.tar.gz"})]
+        plan = plan_install(pkgs, InstalledState(), "linux-x64", pm="apt")
+        assert len(plan.install_ops) == 1
+        assert plan.install_ops[0].method == "binary"
+        assert plan.install_ops[0].download_url is not None
+
+
+class TestPlanRemove:
+    def test_remove_installed(self):
+        installed = InstalledState(packages={
+            "fd": InstalledPackage(
+                name="fd", version="1.0", type="pkg",
+                files=[Path("/usr/bin/fd")],
+            ),
+        })
+        plan = plan_remove(["fd"], installed)
+        assert len(plan.remove_ops) == 1
+        assert plan.remove_ops[0].name == "fd"
+
+    def test_remove_not_installed(self):
+        plan = plan_remove(["missing"], InstalledState())
+        assert len(plan.remove_ops) == 0

tests/test_domain_remote.py

@@ -0,0 +1,79 @@
+"""Tests for remote domain."""
+
+import pytest
+
+from flow.core.config import TargetConfig
+from flow.core.errors import FlowError
+from flow.domain.remote.models import SSHCommand, Target
+from flow.domain.remote.resolution import (
+    build_ssh_command,
+    list_targets,
+    parse_target,
+    resolve_target,
+    terminfo_fix_command,
+)
+
+
+class TestParseTarget:
+    def test_valid_spec(self):
+        ns, plat = parse_target("personal@orb")
+        assert ns == "personal"
+        assert plat == "orb"
+
+    def test_missing_at_raises(self):
+        with pytest.raises(FlowError):
+            parse_target("invalid")
+
+    def test_empty_parts_raises(self):
+        with pytest.raises(FlowError):
+            parse_target("@orb")
+
+
+class TestResolveTarget:
+    def test_found(self):
+        targets = [TargetConfig(namespace="personal", platform="orb", host="personal.orb")]
+        result = resolve_target("personal@orb", targets)
+        assert result.host == "personal.orb"
+        assert result.label == "personal@orb"
+
+    def test_not_found(self):
+        with pytest.raises(FlowError, match="Unknown target"):
+            resolve_target("missing@host", [])
+
+
+class TestBuildSSHCommand:
+    def test_basic(self):
+        target = Target(namespace="personal", platform="orb", host="personal.orb")
+        cmd = build_ssh_command(target)
+        assert "ssh" in cmd.argv
+        assert "personal.orb" in cmd.argv
+        assert cmd.env["DF_NAMESPACE"] == "personal"
+
+    def test_with_identity(self):
+        target = Target(namespace="work", platform="ec2", host="work.ec2", identity="~/.ssh/id_work")
+        cmd = build_ssh_command(target)
+        assert "-i" in cmd.argv
+        assert "~/.ssh/id_work" in cmd.argv
+
+    def test_with_remote_command(self):
+        target = Target(namespace="p", platform="o", host="h")
+        cmd = build_ssh_command(target, remote_command="ls -la")
+        assert cmd.argv[-1] == "ls -la"
+
+
+class TestListTargets:
+    def test_converts_configs(self):
+        configs = [
+            TargetConfig(namespace="a", platform="b", host="a.b"),
+            TargetConfig(namespace="c", platform="d", host="c.d"),
+        ]
+        targets = list_targets(configs)
+        assert len(targets) == 2
+        assert targets[0].label == "a@b"
+
+
+class TestTerminfoFix:
+    def test_returns_commands(self):
+        cmds = terminfo_fix_command()
+        assert len(cmds) == 2
+        assert "infocmp" in cmds[0]