refactor(cli): route agent setup session writes through context

src/lib/agent/onboard.test.ts

@@ -1,6 +1,9 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+import fs from "node:fs";
+import path from "node:path";
+
 import { describe, it, expect, beforeEach, afterEach, afterAll, vi } from "vitest";
 // Import from compiled dist/ so coverage is attributed correctly.
 import {
@@ -129,6 +132,15 @@ describe("printDashboardUi — regression for #2078 (port 8642 is not a chat UI)
   });
 });
 
+describe("agent setup session boundaries", () => {
+  it("does not write onboard session state directly", () => {
+    const source = fs.readFileSync(path.join(__dirname, "onboard.ts"), "utf8");
+
+    expect(source).not.toContain("../state/onboard-session");
+    expect(source).not.toMatch(/onboardSession\.markStep/);
+  });
+});
+
 describe("handleAgentSetup guards", () => {
   it("accepts an executable configured binary path when PATH lookup is empty", () => {
     let script = "";