@andares/pi-toolkits 0.9.7 → 0.10.0

package/src/features/permission/index.ts

@@ -22,6 +22,8 @@ import type {
 	ToolCallEvent,
 } from "@earendil-works/pi-coding-agent";
 import { Text } from "@earendil-works/pi-tui";
+import type { ApprovalLog, ApprovalRecord } from "../../lib/approval-log.js";
+import { auditBase, auditTool } from "../../lib/approval-log.js";
 import type { AskRequest, GateHub } from "../../lib/gates.js";
 import { isJailedTool } from "../../lib/tools.js";
 import { consumeStartupCommand } from "../../lib/startup.js";
@@ -46,6 +48,7 @@ import {
 } from "./paths.js";
 import {
 	decideProgram,
+	decideUnit,
 	decisionEffect,
 	decisionGrantRoot,
 	formatDenial,
@@ -55,6 +58,7 @@ import {
 import { askPermission } from "./prompt.js";
 import { SessionRules } from "./session-rules.js";
 import { parseCommandUnits, type CommandUnit } from "./units.js";
+import { buildPermissionAudit, commandDigest } from "./audit.js";
 
 /** Tools that read one path. */
 const READ_PATH_TOOLS = new Set(["read", "grep", "find", "ls"]);
@@ -123,7 +127,17 @@ interface NoticeData {
 	text: string;
 }
 
-export function registerPermission(pi: ExtensionAPI, gates: GateHub): void {
+export interface PermissionOptions {
+	/** Write-only audit sink; kept optional so tests need no filesystem. */
+	readonly audit?: ApprovalLog;
+}
+
+export function registerPermission(
+	pi: ExtensionAPI,
+	gates: GateHub,
+	options: PermissionOptions = {},
+): void {
+	const audit = options.audit;
 	pi.registerEntryRenderer?.(NOTICE_ENTRY, (entry, _options, theme) => {
 		const text = (entry.data as NoticeData | undefined)?.text;
 		return text === undefined
@@ -148,6 +162,22 @@ export function registerPermission(pi: ExtensionAPI, gates: GateHub): void {
 		rootsCache = undefined;
 	}
 
+	/** Record an on/off or mode change; never affects the state machine. */
+	function recordMode(
+		ctx: ExtensionContext,
+		state: { enabled: boolean; source: string; via: string },
+	): void {
+		if (!audit || audit.mode === "off") return;
+		audit.append({
+			...auditBase(ctx),
+			event: "mode",
+			enabled: state.enabled,
+			modes: { ...modes },
+			source: state.source,
+			via: state.via,
+		});
+	}
+
 	/** Session id, or `undefined` when the host exposes none. */
 	function sessionIdOf(ctx: ExtensionContext): string | undefined {
 		try {
@@ -234,11 +264,13 @@ export function registerPermission(pi: ExtensionAPI, gates: GateHub): void {
 		decision: PolicyDecision,
 		fallbackCwd: string,
 		units: readonly CommandUnit[],
+		payload: ApprovalRecord | undefined,
 	): AskRequest {
 		const root = decisionGrantRoot(decision, () => fallbackCwd);
 		const effect = decisionEffect(decision);
 		const scope =
 			decision.target?.scope === "out" ? "outside project" : "inside project";
+		const title = "Permission required";
 		const details = [
 			`Command: ${decision.unit.raw || decision.unit.command}`,
 			...(decision.target
@@ -249,12 +281,16 @@ export function registerPermission(pi: ExtensionAPI, gates: GateHub): void {
 				? "Session grant would cover: this exact command"
 				: `Session grant would cover: ${root}`,
 		];
+		const auditPayload =
+			payload === undefined
+				? undefined
+				: { ...payload, prompt: [title, ...details] };
 		return {
-			title: "Permission required",
+			title,
 			details,
 			root,
-			present: (ctx) =>
-				askPermission(ctx, { title: "Permission required", details }),
+			audit: auditPayload,
+			present: (ctx) => askPermission(ctx, { title, details }),
 			apply: (choice) => {
 				if (choice === "allow-session") {
 					if (decision.unit.opaque) rules.allowCommand(programKey(units));
@@ -273,6 +309,20 @@ export function registerPermission(pi: ExtensionAPI, gates: GateHub): void {
 							? `${decision.reason ?? "operation"} — denied for this session`
 							: (decision.reason ?? "denied by the operator"),
 				}),
+			settle: (choice) => {
+				if (choice !== "allow-session" && choice !== "deny-session") {
+					return undefined;
+				}
+				const commandScope = decision.unit.opaque;
+				return {
+					grant: {
+						kind: choice === "allow-session" ? "allow" : "deny",
+						scope: commandScope ? "command" : "root",
+						effect,
+						...(commandScope ? { digest: commandDigest(units) } : { root }),
+					},
+				};
+			},
 		};
 	}
 
@@ -298,6 +348,7 @@ export function registerPermission(pi: ExtensionAPI, gates: GateHub): void {
 		handler: async (args, ctx) => {
 			// Startup notices are entries; interactive ones stay in-place toasts.
 			const startup = consumeStartupCommand("ask-perm");
+			const via = startup ? "autostart" : "manual";
 			const notice = (text: string): void => {
 				if (startup) pi.appendEntry<NoticeData>(NOTICE_ENTRY, { text });
 				else ctx.ui.notify(text, "info");
@@ -322,6 +373,7 @@ export function registerPermission(pi: ExtensionAPI, gates: GateHub): void {
 				if (changed) rules.clear();
 				enabled = true;
 				syncStatus(ctx);
+				recordMode(ctx, { enabled: true, source: "args", via });
 				notice(`Permission ON — ${formatModes(modes)}. /ask-perm to turn off.`);
 				return;
 			}
@@ -330,6 +382,7 @@ export function registerPermission(pi: ExtensionAPI, gates: GateHub): void {
 				enabled = false;
 				rules.clear();
 				syncStatus(ctx);
+				recordMode(ctx, { enabled: false, source: "toggle", via });
 				notice("Permission OFF — no boundary checks in this session.");
 				return;
 			}
@@ -346,6 +399,7 @@ export function registerPermission(pi: ExtensionAPI, gates: GateHub): void {
 			rules.clear();
 			enabled = true;
 			syncStatus(ctx);
+			recordMode(ctx, { enabled: true, source: "panel", via });
 			notice(`Permission ON — ${formatModes(modes)}. /ask-perm to turn off.`);
 		},
 	});
@@ -364,16 +418,58 @@ export function registerPermission(pi: ExtensionAPI, gates: GateHub): void {
 			if (isJailedTool(event.toolName)) return undefined;
 			const units = unitsFor(event, ctx.cwd);
 			if (units.length === 0) return undefined;
-			const decision = decideProgram(units, {
-				modes,
-				roots: rootsFor(ctx),
-				rules,
-			});
-			if (decision.action === "allow") return undefined;
+			const roots = rootsFor(ctx);
+			const policyCtx = { modes, roots, rules };
+			const decision = decideProgram(units, policyCtx);
+			const logOn = audit !== undefined && audit.mode !== "off";
+
+			if (decision.action === "allow") {
+				// Session-grant allows show how much friction a grant removed; plain
+				// mode allows are logged only under `PI_APPROVAL_LOG=all`, otherwise
+				// their volume would bury the interesting records. A grant on an
+				// opaque program is keyed by its text (`session-command`), so both
+				// grant layers must be recorded — otherwise "allow for this session"
+				// on a command the parser cannot resolve would leave no trace.
+				const granted =
+					decision.layer === "session-allow" ||
+					decision.layer === "session-command";
+				if (logOn && (granted || audit?.mode === "all")) {
+					const payload = buildPermissionAudit({
+						cwd: ctx.cwd,
+						modes,
+						roots,
+						units,
+						unitDecisions: units.map((unit) => decideUnit(unit, policyCtx)),
+						decision,
+					});
+					audit?.append({
+						...auditBase(ctx),
+						...auditTool(event),
+						...payload,
+						event: "allow",
+					});
+				}
+				return undefined;
+			}
+
+			let payload: ApprovalRecord | undefined;
+			if (logOn) {
+				payload = buildPermissionAudit({
+					cwd: ctx.cwd,
+					modes,
+					roots,
+					units,
+					unitDecisions: units.map((unit) => decideUnit(unit, policyCtx)),
+					decision,
+				});
+			}
 			if (decision.action === "deny") {
-				return { kind: "block", reason: formatDenial(decision) };
+				return { kind: "block", reason: formatDenial(decision), audit: payload };
 			}
-			return { kind: "ask", request: askRequest(decision, ctx.cwd, units) };
+			return {
+				kind: "ask",
+				request: askRequest(decision, ctx.cwd, units, payload),
+			};
 		},
 	});
 

package/src/features/permission/policy.ts

@@ -30,12 +30,31 @@ export interface PolicyTarget {
 
 export interface PolicyDecision {
 	readonly action: PolicyAction;
+	/** Machine-readable reason class, for the audit log and tests. */
+	readonly layer: PolicyLayer;
 	readonly unit: CommandUnit;
 	readonly target?: PolicyTarget;
 	/** Human/model-facing explanation for ask and deny. */
 	readonly reason?: string;
 }
 
+/**
+ * Which rule decided a unit: the four modes, one of the fixed tables, a session
+ * grant, or a parser fallback. Kept separate from the human-facing reason so
+ * the audit log can group decisions without parsing English.
+ */
+export type PolicyLayer =
+	| "mode"
+	| "secret"
+	| "session-allow"
+	| "session-deny"
+	| "session-command"
+	| "danger"
+	| "privileged"
+	| "opaque"
+	| "unresolved"
+	| "empty";
+
 export interface PolicyContext {
 	readonly modes: PermissionModes;
 	/** Canonical session roots (working directory plus added directories). */
@@ -81,6 +100,7 @@ function decidePath(
 	if (secret !== undefined) {
 		return {
 			action: "deny",
+			layer: "secret",
 			unit,
 			target: { path: pathValue, effect, scope },
 			reason: `${secret} — denied by the fixed safety table`,
@@ -90,19 +110,23 @@ function decidePath(
 	if (ctx.rules.denies(effect, pathValue)) {
 		return {
 			action: "deny",
+			layer: "session-deny",
 			unit,
 			target,
 			reason: `${effect} under ${pathValue} was denied for this session`,
 		};
 	}
 	if (ctx.rules.allows(effect, pathValue)) {
-		return { action: "allow", unit, target };
+		return { action: "allow", layer: "session-allow", unit, target };
 	}
 	const mode = modeFor(ctx.modes, effect, scope);
-	if (mode === "allow") return { action: "allow", unit, target };
+	if (mode === "allow") {
+		return { action: "allow", layer: "mode", unit, target };
+	}
 	if (mode === "deny") {
 		return {
 			action: "deny",
+			layer: "mode",
 			unit,
 			target,
 			reason: `${scope === "out" ? "outside-project" : "in-project"} ${effect} is set to deny`,
@@ -110,6 +134,7 @@ function decidePath(
 	}
 	return {
 		action: "ask",
+		layer: "mode",
 		unit,
 		target,
 		reason:
@@ -130,6 +155,7 @@ export function decideUnit(
 		// to grant.
 		return {
 			action: "ask",
+			layer: "opaque",
 			unit,
 			reason: unit.note ?? "this command could not be analysed",
 		};
@@ -149,6 +175,7 @@ export function decideUnit(
 	if (secret?.reason !== undefined) {
 		return {
 			action: "deny",
+			layer: "secret",
 			unit,
 			target: {
 				path: secret.target.path,
@@ -163,6 +190,7 @@ export function decideUnit(
 		if (baseSecret !== undefined) {
 			return {
 				action: "deny",
+				layer: "secret",
 				unit,
 				target: {
 					path: canonicalBase,
@@ -221,6 +249,7 @@ export function decideUnit(
 		}
 		return {
 			action: "ask",
+			layer: danger !== undefined ? "danger" : "privileged",
 			unit,
 			target,
 			reason: danger ?? "privileged command",
@@ -231,6 +260,7 @@ export function decideUnit(
 		if (canonicalBase === null) {
 			return {
 				action: "ask",
+				layer: "unresolved",
 				unit,
 				reason: "the working directory could not be resolved",
 			};
@@ -263,6 +293,7 @@ export function decideProgram(
 	if (units.length === 0) {
 		return {
 			action: "allow",
+			layer: "empty",
 			unit: {
 				raw: "",
 				headWord: "",
@@ -284,12 +315,17 @@ export function decideProgram(
 		if (ctx.rules.deniesCommand(key)) {
 			return {
 				action: "deny",
+				layer: "session-command",
 				unit: opaqueUnit,
 				reason: "this command was denied for this session",
 			};
 		}
 		if (ctx.rules.allowsCommand(key)) {
-			return { action: "allow", unit: opaqueUnit };
+			return {
+				action: "allow",
+				layer: "session-command",
+				unit: opaqueUnit,
+			};
 		}
 	}
 

package/src/features/stash/stash.ts

@@ -21,7 +21,7 @@ import type { KeyId } from "@earendil-works/pi-tui";
 /**
  * Stash hotkey.
  *
- * Compatibility rationale (verified against pi 1.0.0–1.3.0 keybindings, live
+ * Compatibility rationale (verified against pi 0.99.0–1.4.0 keybindings, live
  * matchesKey probes and terminal/OS behavior):
  *  - pi: no default binding for ctrl+alt+<letter> (only ctrl+alt+] is taken);
  *    extension shortcuts dispatch first while the editor is focused

package/src/index.ts

@@ -18,6 +18,7 @@
  * each other. The bus is installed once, after every gate is registered.
  */
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { createApprovalLog } from "./lib/approval-log.js";
 import { createGateHub } from "./lib/gates.js";
 import { registerAsk } from "./features/ask/index.js";
 import { registerAutostart } from "./features/autostart/index.js";
@@ -28,12 +29,15 @@ import { registerReview } from "./features/review/index.js";
 import { registerStash } from "./features/stash/index.js";
 
 export default function piToolkits(pi: ExtensionAPI): void {
-	const gates = createGateHub();
+	// One rolling audit sink for every gate. Creation is lazy and side-effect
+	// free: the directory is only touched when the first record is written.
+	const audit = createApprovalLog();
+	const gates = createGateHub({ audit });
 
 	registerAsk(pi, gates);
 	// Permission registers its session_start reset before autostart, so a
 	// project-declared `/ask-perm ...` runs against a freshly reset mode.
-	registerPermission(pi, gates);
+	registerPermission(pi, gates, { audit });
 	registerAutostart(pi);
 	registerCompact(pi);
 	registerFavorites(pi);

package/src/lib/approval-log.test.ts

@@ -0,0 +1,289 @@
+import {
+	existsSync,
+	mkdtempSync,
+	readFileSync,
+	readdirSync,
+	statSync,
+	writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+import {
+	clipText,
+	createApprovalLog,
+	sanitizeToolInput,
+} from "./approval-log.js";
+
+function tempDir(prefix = "pi-approval-"): string {
+	return mkdtempSync(join(tmpdir(), prefix));
+}
+
+function logFiles(dir: string): string[] {
+	return readdirSync(dir)
+		.filter((name) => /^audit-\d{6,}\.jsonl$/.test(name))
+		.sort();
+}
+
+function linesOf(dir: string, name: string): string[] {
+	return readFileSync(join(dir, name), "utf8")
+		.split("\n")
+		.filter((line) => line !== "");
+}
+
+describe("approval log", () => {
+	it("writes one JSON object per line and creates the directory lazily", () => {
+		const root = tempDir();
+		const dir = join(root, "nested", "log");
+		const log = createApprovalLog({
+			dir,
+			mode: "interesting",
+			now: () => new Date("2026-01-02T03:04:05.000Z"),
+		});
+
+		expect(existsSync(dir)).toBe(false);
+		log.append({
+			event: "block",
+			tool: "bash",
+			verdict: { action: "deny", layer: "secret" },
+		});
+		expect(logFiles(dir)).toEqual(["audit-000001.jsonl"]);
+
+		const lines = linesOf(dir, "audit-000001.jsonl");
+		expect(lines).toHaveLength(1);
+		const record = JSON.parse(lines[0] ?? "{}") as Record<string, unknown>;
+		expect(record).toMatchObject({
+			v: 1,
+			ts: "2026-01-02T03:04:05.000Z",
+			event: "block",
+			tool: "bash",
+			verdict: { action: "deny", layer: "secret" },
+		});
+		if (process.platform !== "win32") {
+			expect(statSync(join(dir, "audit-000001.jsonl")).mode & 0o777).toBe(
+				0o600,
+			);
+		}
+	});
+
+	it("rotates at the record cap and removes the oldest file", () => {
+		const dir = tempDir();
+		const log = createApprovalLog({
+			dir,
+			mode: "interesting",
+			maxRecords: 3,
+			maxFiles: 2,
+		});
+		for (let i = 1; i <= 7; i++) log.append({ event: "ask", n: i });
+
+		expect(logFiles(dir)).toEqual(["audit-000002.jsonl", "audit-000003.jsonl"]);
+		expect(linesOf(dir, "audit-000002.jsonl")).toHaveLength(3);
+		expect(linesOf(dir, "audit-000003.jsonl")).toHaveLength(1);
+		expect(
+			linesOf(dir, "audit-000003.jsonl")
+				.map((line) => (JSON.parse(line) as { n: number }).n)
+				.join(","),
+		).toBe("7");
+	});
+
+	it("rotates at the byte cap before the record cap", () => {
+		const dir = tempDir();
+		const log = createApprovalLog({
+			dir,
+			mode: "interesting",
+			maxFileBytes: 300,
+			maxRecords: 1000,
+		});
+		for (let i = 1; i <= 3; i++) {
+			log.append({ event: "ask", n: i, payload: "x".repeat(200) });
+		}
+		const files = logFiles(dir);
+		expect(files).toHaveLength(2);
+		expect(linesOf(dir, files[0] ?? "")).toHaveLength(2);
+		expect(linesOf(dir, files[1] ?? "")).toHaveLength(1);
+	});
+
+	it("terminates a crash-truncated tail before appending", () => {
+		const dir = tempDir();
+		writeFileSync(
+			join(dir, "audit-000001.jsonl"),
+			'{"v":1,"event":"block"}\n{"v":1,"event":"as',
+		);
+		const log = createApprovalLog({ dir, mode: "interesting" });
+		log.append({ event: "ask", n: 2 });
+
+		const lines = linesOf(dir, "audit-000001.jsonl");
+		expect(lines).toHaveLength(3);
+		expect(() => JSON.parse(lines[0] ?? "")).not.toThrow();
+		expect(() => JSON.parse(lines[1] ?? "")).toThrow();
+		expect(JSON.parse(lines[2] ?? "") as Record<string, unknown>).toMatchObject({
+			event: "ask",
+			n: 2,
+		});
+	});
+
+	it("redacts credential-shaped strings anywhere in the record", () => {
+		const dir = tempDir();
+		const log = createApprovalLog({ dir, mode: "interesting" });
+		log.append({
+			event: "ask",
+			input: {
+				command:
+					"curl -H 'Authorization: Bearer abcdefgh12345678' https://user:pass@example.com/x?token=supersecretvalue",
+			},
+			units: [{ raw: "export TOKEN=anothersecretvalue" }],
+			reason: "password=hunter2",
+		});
+
+		const line = readFileSync(join(dir, "audit-000001.jsonl"), "utf8");
+		expect(line).toContain('"redacted":true');
+		expect(line).not.toContain("abcdefgh12345678");
+		expect(line).not.toContain("supersecretvalue");
+		expect(line).not.toContain("anothersecretvalue");
+		expect(line).not.toContain("hunter2");
+		expect(line).toContain("[redacted]");
+	});
+
+	it("drops write/edit bodies but keeps their size", () => {
+		expect(sanitizeToolInput("write", { path: "/tmp/a", content: "hello" }))
+			.toEqual({ path: "/tmp/a", contentBytes: 5 });
+		expect(
+			sanitizeToolInput("edit", {
+				path: "/tmp/a",
+				oldText: "abc",
+				newText: "abcdef",
+			}),
+		).toEqual({ path: "/tmp/a", contentBytes: 6, oldTextBytes: 3 });
+	});
+
+	it("clips overlong text with a visible marker", () => {
+		const clipped = clipText("x".repeat(5000), 100);
+		expect(clipped).toContain("[+4900 chars]");
+		expect(clipped.length).toBeLessThan(5000);
+	});
+
+	it("caps a pathological record without losing the verdict", () => {
+		const dir = tempDir();
+		const log = createApprovalLog({
+			dir,
+			mode: "interesting",
+			maxRecordBytes: 600,
+		});
+		log.append({
+			event: "ask",
+			verdict: { action: "ask", layer: "mode", target: "/tmp/x" },
+			verdictCode: 1,
+			units: Array.from({ length: 40 }, (_, index) => ({
+				raw: `${index}:${"y".repeat(300)}`,
+			})),
+			input: { command: "z".repeat(5000) },
+		});
+
+		const line = readFileSync(join(dir, "audit-000001.jsonl"), "utf8").trim();
+		const record = JSON.parse(line) as Record<string, unknown>;
+		expect(record.event).toBe("ask");
+		expect(record.verdict).toMatchObject({ action: "ask", layer: "mode" });
+		expect(record.units === undefined || record.truncated === true).toBe(true);
+		expect(line.length).toBeLessThan(2000);
+	});
+
+	it("skips one unserializable record instead of disabling the log", () => {
+		const dir = tempDir();
+		const warnings: string[] = [];
+		const log = createApprovalLog({
+			dir,
+			mode: "interesting",
+			warn: (message) => warnings.push(message),
+		});
+		// A BigInt inside the envelope cannot be stringified even after every
+		// optional field is dropped. It must cost one record, not the process.
+		log.append({ event: "ask", verdict: { action: 1n as unknown as number } });
+		expect(log.active).toBe(true);
+		log.append({ event: "block", n: 2 });
+
+		const lines = linesOf(dir, "audit-000001.jsonl");
+		expect(lines).toHaveLength(1);
+		expect(JSON.parse(lines[0] ?? "{}") as Record<string, unknown>).toMatchObject({
+			event: "block",
+			n: 2,
+		});
+		expect(warnings).toHaveLength(1);
+	});
+
+	it("keeps a record whose envelope survives the dropped detail", () => {
+		const dir = tempDir();
+		const log = createApprovalLog({ dir, mode: "interesting" });
+		// The BigInt sits in a field the last-resort envelope drops, so the
+		// decision itself is still recorded (with `truncated`).
+		log.append({ event: "ask", extra: 1n as unknown as number, verdict: "ask" });
+
+		const record = JSON.parse(
+			linesOf(dir, "audit-000001.jsonl")[0] ?? "{}",
+		) as Record<string, unknown>;
+		expect(record.event).toBe("ask");
+		expect(record.truncated).toBe(true);
+	});
+
+	it("fails open and warns once when the directory is unusable", () => {
+		const root = tempDir();
+		const file = join(root, "not-a-dir");
+		writeFileSync(file, "");
+		const warnings: string[] = [];
+		const log = createApprovalLog({
+			dir: join(file, "log"),
+			mode: "interesting",
+			warn: (message) => warnings.push(message),
+		});
+
+		expect(() => log.append({ event: "ask" })).not.toThrow();
+		expect(log.active).toBe(false);
+		expect(warnings).toHaveLength(1);
+		log.append({ event: "ask" });
+		expect(warnings).toHaveLength(1);
+	});
+
+	it("writes nothing when the mode is off", () => {
+		const root = tempDir();
+		const dir = join(root, "off");
+		const log = createApprovalLog({ dir, mode: "off" });
+		log.append({ event: "ask" });
+		expect(log.active).toBe(false);
+		expect(existsSync(dir)).toBe(false);
+	});
+
+	it("keeps two writers within the ring without corrupting lines", () => {
+		const dir = tempDir();
+		const first = createApprovalLog({
+			dir,
+			mode: "interesting",
+			maxRecords: 3,
+			maxFiles: 2,
+		});
+		const second = createApprovalLog({
+			dir,
+			mode: "interesting",
+			maxRecords: 3,
+			maxFiles: 2,
+		});
+		for (let i = 0; i < 10; i++) {
+			(i % 2 === 0 ? first : second).append({ event: "ask", n: i });
+		}
+
+		const files = logFiles(dir);
+		expect(files.length).toBeLessThanOrEqual(2);
+		let total = 0;
+		for (const name of files) {
+			const lines = linesOf(dir, name);
+			for (const line of lines) {
+				expect(() => JSON.parse(line)).not.toThrow();
+			}
+			// Each writer checks the count before appending, so two writers can
+			// overshoot the cap by at most one record — not by 2x, which is what a
+			// per-process counter would do.
+			expect(lines.length).toBeLessThanOrEqual(4);
+			total += lines.length;
+		}
+		expect(total).toBeGreaterThan(0);
+		expect(total).toBeLessThanOrEqual(10);
+	});
+});