@allbluecn/web-app 0.10.3 → 0.11.0

package/src/shared/ai-cli/__tests__/cli-detector.test.ts

@@ -0,0 +1,99 @@
+import { describe, expect, it, vi, beforeEach } from 'vitest'
+
+const execFileSyncMock = vi.hoisted(() => vi.fn())
+const execSyncMock = vi.hoisted(() => vi.fn())
+
+vi.mock('child_process', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('child_process')>()
+  return {
+    ...actual,
+    execFileSync: execFileSyncMock,
+    execSync: execSyncMock,
+  }
+})
+
+import { detectAgents, getApiAgent } from '../cli-detector'
+
+describe('getApiAgent', () => {
+  beforeEach(() => {
+    vi.resetModules()
+    delete process.env.OPENAI_API_KEY
+    delete process.env.AI_MODEL
+  })
+
+  it('未设置 API key 时返回 undefined', async () => {
+    const { getApiAgent: fn } = await import('../cli-detector')
+    expect(fn()).toBeUndefined()
+  })
+
+  it('API key 为占位符时返回 undefined', async () => {
+    process.env.OPENAI_API_KEY = 'sk-your-api-key-here'
+    const { getApiAgent: fn } = await import('../cli-detector')
+    expect(fn()).toBeUndefined()
+  })
+
+  it('API key 有效时返回 agent 信息', async () => {
+    process.env.OPENAI_API_KEY = 'sk-real-key'
+    const { getApiAgent: fn } = await import('../cli-detector')
+    const agent = fn()
+    expect(agent).toBeDefined()
+    expect(agent?.id).toBe('openai-api')
+    expect(agent?.available).toBe(true)
+  })
+
+  it('使用 AI_MODEL 环境变量显示模型名', async () => {
+    process.env.OPENAI_API_KEY = 'sk-real-key'
+    process.env.AI_MODEL = 'gpt-4'
+    const { getApiAgent: fn } = await import('../cli-detector')
+    expect(fn()?.name).toContain('gpt-4')
+  })
+})
+
+describe('detectAgents 安全探测', () => {
+  beforeEach(() => {
+    execFileSyncMock.mockReset()
+    execSyncMock.mockReset()
+  })
+
+  it('用 execFileSync 数组参数探测版本（无 shell 拼接）', async () => {
+    execFileSyncMock.mockReturnValueOnce('v1.2.3')
+    const agents = await detectAgents()
+    const claude = agents.find((a) => a.id === 'claude-code')!
+    expect(claude.available).toBe(true)
+    expect(claude.version).toBe('v1.2.3')
+    expect(execFileSyncMock).toHaveBeenCalledWith(
+      expect.any(String),
+      expect.arrayContaining(['--version']),
+      expect.objectContaining({ timeout: expect.any(Number), encoding: 'utf-8' })
+    )
+    expect(execSyncMock).not.toHaveBeenCalled()
+  })
+
+  it('--version 失败时回退 version 子命令（两步探测，无 shell ||）', async () => {
+    execFileSyncMock
+      .mockImplementationOnce(() => { throw new Error('not found') })
+      .mockReturnValueOnce('2.0.0')
+    const agents = await detectAgents()
+    const first = agents[0]!
+    expect(first.available).toBe(true)
+    expect(first.version).toBe('2.0.0')
+    const calls = execFileSyncMock.mock.calls
+    expect(calls[0]?.[1]).toEqual(['--version'])
+    expect(calls[1]?.[1]).toEqual(['version'])
+    expect(calls[0]![0]).toBe(calls[1]![0])
+  })
+
+  it('两步都失败标记不可用且不抛错', async () => {
+    execFileSyncMock.mockImplementation(() => { throw new Error('not found') })
+    const agents = await detectAgents()
+    expect(agents).toHaveLength(16)
+    expect(agents.every((a) => a.available === false)).toBe(true)
+    expect(agents.every((a) => a.version === '')).toBe(true)
+  })
+
+  it('版本串截断到 50 字符且去除首尾空白', async () => {
+    execFileSyncMock.mockReturnValue(`  ${'x'.repeat(80)}  \n`)
+    const agents = await detectAgents()
+    expect(agents[0]!.version).toBe('x'.repeat(50))
+  })
+})

package/src/shared/ai-cli/adapter.ts

@@ -50,8 +50,8 @@ export async function executeViaAgent(
     return data.choices[0]?.message?.content || ""
   }
 
-  const { execSync } = await import("child_process")
-  const result = execSync(`${agent.binary} -p "${prompt.replace(/"/g, '\\"')}"`, {
+  const { execFileSync } = await import("child_process")
+  const result = execFileSync(agent.binary, ["-p", prompt], {
     timeout: 60000,
     encoding: "utf-8",
   })

package/src/shared/ai-cli/cli-detector.ts

@@ -36,18 +36,27 @@ const KNOWN_AGENTS: { id: string; name: string; binary: string }[] = [
   { id: "mcp-cli",        name: "MCP CLI",            binary: "mcp" },
 ]
 
-export async function detectAgents(): Promise<CLIAgentInfo[]> {
-  const { execSync } = await import("child_process")
-  return KNOWN_AGENTS.map(({ id, name, binary }) => {
+function probeVersion(
+  execFileSync: (file: string, args: string[], options: { timeout: number; encoding: "utf-8" }) => string,
+  binary: string,
+): string {
+  const opts = { timeout: 3000, encoding: "utf-8" } as const
+  try {
+    return execFileSync(binary, ["--version"], opts).trim().slice(0, 50)
+  } catch {
     try {
-      const version = execSync(`${binary} --version 2>/dev/null || ${binary} version 2>/dev/null`, {
-        timeout: 3000,
-        encoding: "utf-8",
-      }).trim().slice(0, 50)
-      return { id, name, binary, version, available: true }
+      return execFileSync(binary, ["version"], opts).trim().slice(0, 50)
     } catch {
-      return { id, name, binary, version: "", available: false }
+      return ""
     }
+  }
+}
+
+export async function detectAgents(): Promise<CLIAgentInfo[]> {
+  const { execFileSync } = await import("child_process")
+  return KNOWN_AGENTS.map(({ id, name, binary }) => {
+    const version = probeVersion(execFileSync, binary)
+    return { id, name, binary, version, available: version !== "" }
   })
 }
 

package/src/start.ts

@@ -16,6 +16,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { createStart, createCsrfMiddleware, createMiddleware } from '@tanstack/react-start'
+import { securityHeadersMiddleware } from '@/server/middlewares/security-headers'
 import { requestContextMiddleware } from '@/server/middlewares/request'
 import { auditRequestMiddleware } from '@/server/middlewares/audit'
 import { neonKeepaliveMiddleware } from '@/server/keepalive/middleware'
@@ -97,6 +98,6 @@ export const startInstance = createStart(async () => {
     } as any)
   }
   return {
-    requestMiddleware: [requestContextMiddleware, neonKeepaliveMiddleware, aiPortsMiddleware, apiCorsMiddleware, csrfMiddleware, auditRequestMiddleware],
+    requestMiddleware: [securityHeadersMiddleware, requestContextMiddleware, neonKeepaliveMiddleware, aiPortsMiddleware, apiCorsMiddleware, csrfMiddleware, auditRequestMiddleware],
   }
 })

package/src/styles/globals.css

@@ -247,6 +247,120 @@
   --color-5: oklch(90.7% 0.231 133);
 }
 
+/* 知识库快捷文档标签莫兰迪色板（LABEL_COLORS 消费，light 原色 / dark 从种子色派生） */
+:root {
+  --kb-row-mix: 45%;
+  --kb-seed-mrd: #9CAF97;
+  --kb-label-mrd-bg: #E8EFE5;
+  --kb-label-mrd-border: #9CAF97;
+  --kb-label-mrd-text: #5C705A;
+  --kb-seed-brd: #9FB2C4;
+  --kb-label-brd-bg: #E5EBF1;
+  --kb-label-brd-border: #9FB2C4;
+  --kb-label-brd-text: #54687A;
+  --kb-seed-feasibility: #C4B896;
+  --kb-label-feasibility-bg: #F1EDDF;
+  --kb-label-feasibility-border: #C4B896;
+  --kb-label-feasibility-text: #7A6E4C;
+  --kb-seed-competitor: #C4A48E;
+  --kb-label-competitor-bg: #F1E8E2;
+  --kb-label-competitor-border: #C4A48E;
+  --kb-label-competitor-text: #7A5F4C;
+  --kb-seed-charter: #B0A0B8;
+  --kb-label-charter-bg: #EDE7F0;
+  --kb-label-charter-border: #B0A0B8;
+  --kb-label-charter-text: #6A5A72;
+  --kb-seed-infoArchitecture: #96B8B0;
+  --kb-label-infoArchitecture-bg: #E2EFEC;
+  --kb-label-infoArchitecture-border: #96B8B0;
+  --kb-label-infoArchitecture-text: #4E6E68;
+  --kb-seed-techArchitecture: #8FA3AD;
+  --kb-label-techArchitecture-bg: #E1E8EB;
+  --kb-label-techArchitecture-border: #8FA3AD;
+  --kb-label-techArchitecture-text: #4E626C;
+  --kb-seed-dataStructure: #C09898;
+  --kb-label-dataStructure-bg: #F0E4E4;
+  --kb-label-dataStructure-border: #C09898;
+  --kb-label-dataStructure-text: #755050;
+  --kb-seed-integration: #B3A48E;
+  --kb-label-integration-bg: #EEE9E0;
+  --kb-label-integration-border: #B3A48E;
+  --kb-label-integration-text: #6E6046;
+  --kb-seed-copywriting: #C4A0A8;
+  --kb-label-copywriting-bg: #F2E7E9;
+  --kb-label-copywriting-border: #C4A0A8;
+  --kb-label-copywriting-text: #77545C;
+  --kb-seed-dictionary: #A8A88E;
+  --kb-label-dictionary-bg: #EBEBE0;
+  --kb-label-dictionary-border: #A8A88E;
+  --kb-label-dictionary-text: #68684C;
+  --kb-seed-legal: #8FA8B3;
+  --kb-label-legal-bg: #DCE8EC;
+  --kb-label-legal-border: #8FA8B3;
+  --kb-label-legal-text: #4C626C;
+  --kb-seed-compliance: #9FA88C;
+  --kb-label-compliance-bg: #E4E8DC;
+  --kb-label-compliance-border: #9FA88C;
+  --kb-label-compliance-text: #5E664E;
+  --kb-seed-kbDictionary: #B09A8C;
+  --kb-label-kbDictionary-bg: #EAE4DC;
+  --kb-label-kbDictionary-border: #B09A8C;
+  --kb-label-kbDictionary-text: #6E5A4C;
+  --kb-seed-website: #98A4B8;
+  --kb-label-website-bg: #E0E4EA;
+  --kb-label-website-border: #98A4B8;
+  --kb-label-website-text: #545E70;
+}
+
+.dark {
+  --kb-row-mix: 65%;
+  --kb-label-mrd-bg: color-mix(in srgb, var(--kb-seed-mrd) 20%, #1d1f1c);
+  --kb-label-mrd-border: color-mix(in srgb, var(--kb-seed-mrd) 45%, #1d1f1c);
+  --kb-label-mrd-text: color-mix(in srgb, var(--kb-seed-mrd) 60%, #dfe3dc);
+  --kb-label-brd-bg: color-mix(in srgb, var(--kb-seed-brd) 20%, #1c1e21);
+  --kb-label-brd-border: color-mix(in srgb, var(--kb-seed-brd) 45%, #1c1e21);
+  --kb-label-brd-text: color-mix(in srgb, var(--kb-seed-brd) 60%, #dce1e7);
+  --kb-label-feasibility-bg: color-mix(in srgb, var(--kb-seed-feasibility) 20%, #1f1d16);
+  --kb-label-feasibility-border: color-mix(in srgb, var(--kb-seed-feasibility) 45%, #1f1d16);
+  --kb-label-feasibility-text: color-mix(in srgb, var(--kb-seed-feasibility) 60%, #e6e2d5);
+  --kb-label-competitor-bg: color-mix(in srgb, var(--kb-seed-competitor) 20%, #1f1b18);
+  --kb-label-competitor-border: color-mix(in srgb, var(--kb-seed-competitor) 45%, #1f1b18);
+  --kb-label-competitor-text: color-mix(in srgb, var(--kb-seed-competitor) 60%, #e6ddd6);
+  --kb-label-charter-bg: color-mix(in srgb, var(--kb-seed-charter) 20%, #1d1b1f);
+  --kb-label-charter-border: color-mix(in srgb, var(--kb-seed-charter) 45%, #1d1b1f);
+  --kb-label-charter-text: color-mix(in srgb, var(--kb-seed-charter) 60%, #e2dde6);
+  --kb-label-infoArchitecture-bg: color-mix(in srgb, var(--kb-seed-infoArchitecture) 20%, #1b1e1d);
+  --kb-label-infoArchitecture-border: color-mix(in srgb, var(--kb-seed-infoArchitecture) 45%, #1b1e1d);
+  --kb-label-infoArchitecture-text: color-mix(in srgb, var(--kb-seed-infoArchitecture) 60%, #dbe4e1);
+  --kb-label-techArchitecture-bg: color-mix(in srgb, var(--kb-seed-techArchitecture) 20%, #1b1d1f);
+  --kb-label-techArchitecture-border: color-mix(in srgb, var(--kb-seed-techArchitecture) 45%, #1b1d1f);
+  --kb-label-techArchitecture-text: color-mix(in srgb, var(--kb-seed-techArchitecture) 60%, #dbe1e5);
+  --kb-label-dataStructure-bg: color-mix(in srgb, var(--kb-seed-dataStructure) 20%, #1f1b1b);
+  --kb-label-dataStructure-border: color-mix(in srgb, var(--kb-seed-dataStructure) 45%, #1f1b1b);
+  --kb-label-dataStructure-text: color-mix(in srgb, var(--kb-seed-dataStructure) 60%, #e6dcdc);
+  --kb-label-integration-bg: color-mix(in srgb, var(--kb-seed-integration) 20%, #1e1c18);
+  --kb-label-integration-border: color-mix(in srgb, var(--kb-seed-integration) 45%, #1e1c18);
+  --kb-label-integration-text: color-mix(in srgb, var(--kb-seed-integration) 60%, #e3ded4);
+  --kb-label-copywriting-bg: color-mix(in srgb, var(--kb-seed-copywriting) 20%, #1f1b1c);
+  --kb-label-copywriting-border: color-mix(in srgb, var(--kb-seed-copywriting) 45%, #1f1b1c);
+  --kb-label-copywriting-text: color-mix(in srgb, var(--kb-seed-copywriting) 60%, #e6dce0);
+  --kb-label-dictionary-bg: color-mix(in srgb, var(--kb-seed-dictionary) 20%, #1d1d19);
+  --kb-label-dictionary-border: color-mix(in srgb, var(--kb-seed-dictionary) 45%, #1d1d19);
+  --kb-label-dictionary-text: color-mix(in srgb, var(--kb-seed-dictionary) 60%, #e2e2da);
+  --kb-label-legal-bg: color-mix(in srgb, var(--kb-seed-legal) 20%, #1a1e20);
+  --kb-label-legal-border: color-mix(in srgb, var(--kb-seed-legal) 45%, #1a1e20);
+  --kb-label-legal-text: color-mix(in srgb, var(--kb-seed-legal) 60%, #d9e2e7);
+  --kb-label-compliance-bg: color-mix(in srgb, var(--kb-seed-compliance) 20%, #1c1e1a);
+  --kb-label-compliance-border: color-mix(in srgb, var(--kb-seed-compliance) 45%, #1c1e1a);
+  --kb-label-compliance-text: color-mix(in srgb, var(--kb-seed-compliance) 60%, #dee2d6);
+  --kb-label-kbDictionary-bg: color-mix(in srgb, var(--kb-seed-kbDictionary) 20%, #1e1c1a);
+  --kb-label-kbDictionary-border: color-mix(in srgb, var(--kb-seed-kbDictionary) 45%, #1e1c1a);
+  --kb-label-kbDictionary-text: color-mix(in srgb, var(--kb-seed-kbDictionary) 60%, #e3ddd6);
+  --kb-label-website-bg: color-mix(in srgb, var(--kb-seed-website) 20%, #1b1d21);
+  --kb-label-website-border: color-mix(in srgb, var(--kb-seed-website) 45%, #1b1d21);
+  --kb-label-website-text: color-mix(in srgb, var(--kb-seed-website) 60%, #dbe0e8);
+}
+
 @layer base {
   * {
     border-color: var(--color-border);

package/src/types/jest-dom-vitest.d.ts

@@ -15,17 +15,18 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-// Vitest 4 类型兼容层：@testing-library/jest-dom 的 vitest.d.ts 增强 `module 'vitest'` 的
-// Assertion 接口，但 Vitest 4 的 `vitest` 模块仅 re-export `@vitest/expect` 的
-// `Assertion`（dist/index.d.ts:15），接口定义在 `@vitest/expect` 包内，跨包接口合并不生效。
-// 这里显式对 `@vitest/expect` 的 `Assertion` / `AsymmetricMatchersContaining` 做增强，
+// Vitest 5 类型兼容层：Vitest 5 将 expect 断言内联进主包（不再依赖 @vitest/expect），
+// `declare module 'vitest'` 的接口增强直接生效。但 Vitest 5 的 `Assertion` 接口
+// 使用双类型参数 `Assertion<R, T>`（R = matcher 返回类型，T = received 值类型），
+// 而 @testing-library/jest-dom 官方 types/vitest.d.ts 仍声明单参数 `Assertion<T = any>`，
+// 泛型参数个数不一致导致声明合并报 TS2428。这里以正确的双参数签名重写增强，
 // 使 `toBeInTheDocument` / `toBeDisabled` 等 jest-dom matcher 类型可用。
 // 运行时 matcher 注册在 src/__tests__/setup.ts 的 `import '@testing-library/jest-dom/vitest'`。
 import type { TestingLibraryMatchers } from '@testing-library/jest-dom/matchers'
 
-declare module '@vitest/expect' {
-  interface Assertion<T = any>
-    extends TestingLibraryMatchers<any, T> {}
+declare module 'vitest' {
+  interface Assertion<R extends void | Promise<void> = void, T = unknown>
+    extends TestingLibraryMatchers<R, T> {}
   interface AsymmetricMatchersContaining
     extends TestingLibraryMatchers<any, any> {}
 }

package/vite.shared.ts

@@ -139,8 +139,25 @@ export function createWebViteConfig(opts: WebViteConfigOptions) {
       },
       server: {
         port: 3000,
-        allowedHosts: ['192.168.106.16', '192.168.106.223', 'localhost'],
+        host: true,
+        // host.docker.internal：容器内安全扫描（ZAP/Nuclei，见
+        // scripts/security/）经该地址访问宿主 dev server；Vite 默认拒绝
+        // 非白名单 Host 头（返回 403 "Blocked request"）。仅 dev server 生效。
+        allowedHosts: ['localhost', 'host.docker.internal'],
         cors: { origin: false },
+        // Vite 内部中间件（/src/*、/@fs/*、.map）的响应绕过 TanStack Start
+        // requestMiddleware，故在此层补基础安全头；CSP/HSTS 仍由 middleware
+        // 统一注入（apps/web/src/server/middlewares/security-headers.ts），
+        // 生产构建无 Vite dev server，middleware 即唯一来源。
+        headers: {
+          'X-Content-Type-Options': 'nosniff',
+          'X-Frame-Options': 'DENY',
+          'Cross-Origin-Resource-Policy': 'same-origin',
+          'Cross-Origin-Opener-Policy': 'same-origin',
+          'Permissions-Policy':
+            'camera=(), microphone=(), geolocation=(), payment=(), usb=(), fullscreen=(self)',
+          'Referrer-Policy': 'strict-origin-when-cross-origin',
+        },
       },
       plugins,
       resolve: {

package/public/file.svg

@@ -1 +0,0 @@
-<svg fill="none" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg"><path d="M14.5 13.5V5.41a1 1 0 0 0-.3-.7L9.8.29A1 1 0 0 0 9.08 0H1.5v13.5A2.5 2.5 0 0 0 4 16h8a2.5 2.5 0 0 0 2.5-2.5m-1.5 0v-7H8v-5H3v12a1 1 0 0 0 1 1h8a1 1 0 0 0 1-1M9.5 5V2.12L12.38 5zM5.13 5h-.62v1.25h2.12V5zm-.62 3h7.12v1.25H4.5zm.62 3h-.62v1.25h7.12V11z" clip-rule="evenodd" fill="#666" fill-rule="evenodd"/></svg>

package/public/globe.svg

@@ -1 +0,0 @@
-<svg fill="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><g clip-path="url(#a)"><path fill-rule="evenodd" clip-rule="evenodd" d="M10.27 14.1a6.5 6.5 0 0 0 3.67-3.45q-1.24.21-2.7.34-.31 1.83-.97 3.1M8 16A8 8 0 1 0 8 0a8 8 0 0 0 0 16m.48-1.52a7 7 0 0 1-.96 0H7.5a4 4 0 0 1-.84-1.32q-.38-.89-.63-2.08a40 40 0 0 0 3.92 0q-.25 1.2-.63 2.08a4 4 0 0 1-.84 1.31zm2.94-4.76q1.66-.15 2.95-.43a7 7 0 0 0 0-2.58q-1.3-.27-2.95-.43a18 18 0 0 1 0 3.44m-1.27-3.54a17 17 0 0 1 0 3.64 39 39 0 0 1-4.3 0 17 17 0 0 1 0-3.64 39 39 0 0 1 4.3 0m1.1-1.17q1.45.13 2.69.34a6.5 6.5 0 0 0-3.67-3.44q.65 1.26.98 3.1M8.48 1.5l.01.02q.41.37.84 1.31.38.89.63 2.08a40 40 0 0 0-3.92 0q.25-1.2.63-2.08a4 4 0 0 1 .85-1.32 7 7 0 0 1 .96 0m-2.75.4a6.5 6.5 0 0 0-3.67 3.44 29 29 0 0 1 2.7-.34q.31-1.83.97-3.1M4.58 6.28q-1.66.16-2.95.43a7 7 0 0 0 0 2.58q1.3.27 2.95.43a18 18 0 0 1 0-3.44m.17 4.71q-1.45-.12-2.69-.34a6.5 6.5 0 0 0 3.67 3.44q-.65-1.27-.98-3.1" fill="#666"/></g><defs><clipPath id="a"><path fill="#fff" d="M0 0h16v16H0z"/></clipPath></defs></svg>

package/public/window.svg

@@ -1 +0,0 @@
-<svg fill="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><path fill-rule="evenodd" clip-rule="evenodd" d="M1.5 2.5h13v10a1 1 0 0 1-1 1h-11a1 1 0 0 1-1-1zM0 1h16v11.5a2.5 2.5 0 0 1-2.5 2.5h-11A2.5 2.5 0 0 1 0 12.5zm3.75 4.5a.75.75 0 1 0 0-1.5.75.75 0 0 0 0 1.5M7 4.75a.75.75 0 1 1-1.5 0 .75.75 0 0 1 1.5 0m1.75.75a.75.75 0 1 0 0-1.5.75.75 0 0 0 0 1.5" fill="#666"/></svg>

package/src/lib/__tests__/cli-detector.test.ts

@@ -1,80 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-// AllBlue - 理想之海
-// Copyright (C) 2026 AllBlue Contributors
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-import { describe, it, expect, vi, beforeEach } from 'vitest'
-
-describe('getApiAgent', () => {
-  beforeEach(() => {
-    vi.resetModules()
-    delete process.env.OPENAI_API_KEY
-    delete process.env.AI_MODEL
-  })
-
-  it('returns undefined when no API key set', async () => {
-    const { getApiAgent } = await import('@/shared/ai-cli/cli-detector')
-    expect(getApiAgent()).toBeUndefined()
-  })
-
-  it('returns undefined when API key is placeholder', async () => {
-    process.env.OPENAI_API_KEY = 'sk-your-api-key-here'
-    const { getApiAgent } = await import('@/shared/ai-cli/cli-detector')
-    expect(getApiAgent()).toBeUndefined()
-  })
-
-  it('returns agent info when API key is valid', async () => {
-    process.env.OPENAI_API_KEY = 'sk-real-key'
-    const { getApiAgent } = await import('@/shared/ai-cli/cli-detector')
-    const agent = getApiAgent()
-    expect(agent).toBeDefined()
-    expect(agent?.id).toBe('openai-api')
-    expect(agent?.available).toBe(true)
-  })
-
-  it('uses AI_MODEL env in display name', async () => {
-    process.env.OPENAI_API_KEY = 'sk-real-key'
-    process.env.AI_MODEL = 'gpt-4'
-    const { getApiAgent } = await import('@/shared/ai-cli/cli-detector')
-    expect(getApiAgent()?.name).toContain('gpt-4')
-  })
-})
-
-describe('detectAgents', () => {
-  beforeEach(() => {
-    vi.resetModules()
-  })
-
-  it('returns 16 known agents with executable check', async () => {
-    const { detectAgents } = await import('@/shared/ai-cli/cli-detector')
-    const agents = await detectAgents()
-    expect(agents).toHaveLength(16)
-    agents.forEach(a => {
-      expect(a.id).toBeDefined()
-      expect(a.binary).toBeDefined()
-    })
-  })
-
-  it('handles all agents failing gracefully', async () => {
-    vi.doMock('child_process', () => ({
-      execSync: vi.fn(() => { throw new Error('not found') }),
-    }))
-
-    const { detectAgents } = await import('@/shared/ai-cli/cli-detector')
-    const agents = await detectAgents()
-    expect(agents).toHaveLength(16)
-    agents.forEach(a => expect(a.available).toBe(false))
-  })
-})