@astrofoundry/pi-astro 0.29.1 → 0.31.0

package/specialists/install/install.sh

@@ -11,9 +11,9 @@ bin="$root/bin"
 
 [ -d "$src/specialists/lib" ] || { echo "not a pi-astro package: $src" >&2; exit 2; }
 mkdir -p "$bin" "$root/config" "$root/secrets" "$root/work"
-rm -rf "$bin/lib" "$bin/arcane" "$bin/identity" "$bin/network" "$bin/dns" "$bin/edge" "$bin/security" "$bin/backup" "$bin/proxmox" "$bin/inference"
+rm -rf "$bin/lib" "$bin/arcane" "$bin/identity" "$bin/network" "$bin/dns" "$bin/edge" "$bin/security" "$bin/backup" "$bin/proxmox" "$bin/inference" "$bin/media"
 cp -R "$src/specialists/lib" "$bin/lib"
-for s in arcane identity network dns edge security backup proxmox inference; do
+for s in arcane identity network dns edge security backup proxmox inference media; do
   mkdir -p "$bin/$s"
   cp "$src/specialists/$s/run.ts" "$bin/$s/run.ts"
 done

package/specialists/media/run.ts

@@ -0,0 +1,268 @@
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { readConfig } from "../lib/config.ts";
+import { ServiceError, UsageError } from "../lib/errors.ts";
+import { main } from "../lib/main.ts";
+import { printJson, printRaw } from "../lib/output.ts";
+import { workDir } from "../lib/paths.ts";
+import { run } from "../lib/proc.ts";
+import { readSecret } from "../lib/secrets.ts";
+
+const SERVICE = "media";
+
+interface MediaConfig extends Record<string, string | number> {
+    /** Absolute path of trendarr's `dist/cli.js`; run with the node that runs this wrapper. */
+    trendarrCli: string;
+    radarrUrl: string;
+    radarrQualityProfileId: number;
+    radarrRootFolderPath: string;
+    sonarrUrl: string;
+    sonarrQualityProfileId: number;
+    sonarrRootFolderPath: string;
+    /** Sonarr monitor mode for new series: all, future, missing, firstSeason, none. */
+    sonarrMonitor: string;
+    sabnzbdUrl: string;
+    maxEntries: number;
+}
+
+const SHAPE = {
+    trendarrCli: "string",
+    radarrUrl: "string",
+    radarrQualityProfileId: "number",
+    radarrRootFolderPath: "string",
+    sonarrUrl: "string",
+    sonarrQualityProfileId: "number",
+    sonarrRootFolderPath: "string",
+    sonarrMonitor: "string",
+    sabnzbdUrl: "string",
+    maxEntries: "number",
+} as const;
+
+export interface MediaSecrets {
+    tmdbAccessToken: string;
+    omdbApiKey: string;
+    radarrApiKey: string;
+    sonarrApiKey: string;
+    sabnzbdApiKey: string;
+}
+
+/** trendarr's `~/.trendarr/config.json`, field for field (its `src/config.ts` schema). */
+export interface TrendarrConfig {
+    tmdb: { accessToken: string };
+    omdb: { apiKey: string };
+    radarr: { url: string; apiKey: string; qualityProfileId: number; rootFolderPath: string };
+    sonarr: { url: string; apiKey: string; qualityProfileId: number; rootFolderPath: string; monitor: string };
+    sabnzbd: { url: string; apiKey: string };
+    defaults: { maxEntries: number };
+}
+
+export function trendarrConfig(config: MediaConfig, secrets: MediaSecrets): TrendarrConfig {
+    return {
+        tmdb: { accessToken: secrets.tmdbAccessToken },
+        omdb: { apiKey: secrets.omdbApiKey },
+        radarr: { url: config.radarrUrl, apiKey: secrets.radarrApiKey, qualityProfileId: config.radarrQualityProfileId, rootFolderPath: config.radarrRootFolderPath },
+        sonarr: { url: config.sonarrUrl, apiKey: secrets.sonarrApiKey, qualityProfileId: config.sonarrQualityProfileId, rootFolderPath: config.sonarrRootFolderPath, monitor: config.sonarrMonitor },
+        sabnzbd: { url: config.sabnzbdUrl, apiKey: secrets.sabnzbdApiKey },
+        defaults: { maxEntries: config.maxEntries },
+    };
+}
+
+function readMediaSecrets(): MediaSecrets {
+    return {
+        tmdbAccessToken: readSecret(SERVICE, "TMDB_ACCESS_TOKEN"),
+        omdbApiKey: readSecret(SERVICE, "OMDB_API_KEY"),
+        radarrApiKey: readSecret(SERVICE, "RADARR_API_KEY"),
+        sonarrApiKey: readSecret(SERVICE, "SONARR_API_KEY"),
+        sabnzbdApiKey: readSecret(SERVICE, "SABNZBD_API_KEY"),
+    };
+}
+
+/** Most IDs one add call takes; a batch runs one Radarr or Sonarr lookup and add per ID. */
+export const MAX_ADD_IDS = 20;
+const MAX_ENTRIES = 50;
+const MAX_QUERY = 200;
+const MINUTE = 60_000;
+const IMDB_ID = /^tt\d{1,12}$/;
+const TYPES = ["movies", "series"];
+
+export type CallKind = "list" | "add" | "queue";
+
+export interface TrendarrCall {
+    argv: string[];
+    kind: CallKind;
+    timeoutMs: number;
+}
+
+const HELP = `media specialist (trendarr: TMDB trending, OMDb ratings, Radarr and Sonarr adds, SABnzbd queue)
+
+  trending [--type movies|series] [--min-rating N] [--max-entries N]
+      TMDB weekly trending with IMDb ratings and in_library; movies under 6.5 are dropped unless --min-rating 0
+  search <query> [--type movies|series] [--max-entries N]
+      title search, ordered by relevance; use imdb_id from here or from trending for adds
+  add-movies <imdbId...>      add to Radarr monitored and start a search (at most ${MAX_ADD_IDS} IDs)
+  add-series <imdbId...>      add to Sonarr monitored and start a search (at most ${MAX_ADD_IDS} IDs)
+  sabnzbd status|pause|resume read or toggle the SABnzbd queue pause state
+
+Output is trendarr's JSON plus "warnings" (trendarr's stderr warnings, such as an unreachable Radarr).
+An add exits 0 even when an ID fails: read each results[].status (added, already_exists, not_found, error).
+trendarr init and its configuration are operator tasks.`;
+
+function option(args: string[], i: number, name: string): string {
+    const value = args[i + 1];
+    if (value === undefined || value.startsWith("--")) throw new UsageError(`${name} needs a value`);
+    return value;
+}
+
+function parseCount(value: string): number {
+    const n = Number(value);
+    if (!Number.isInteger(n) || n < 1 || n > MAX_ENTRIES) throw new UsageError(`--max-entries must be an integer from 1 to ${MAX_ENTRIES}`);
+    return n;
+}
+
+function parseRating(value: string): number {
+    const n = Number(value);
+    if (value.trim() === "" || !Number.isFinite(n) || n < 0 || n > 10) throw new UsageError("--min-rating must be a number from 0 to 10");
+    return n;
+}
+
+/** Flags shared by trending and search; returns the trendarr flags and the remaining positional words. */
+function parseListFlags(args: string[], allowRating: boolean): { flags: string[]; words: string[] } {
+    const flags: string[] = [];
+    const words: string[] = [];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === "--type") {
+            const type = option(args, i, arg);
+            if (!TYPES.includes(type)) throw new UsageError("--type must be movies or series");
+            flags.push("--type", type);
+            i++;
+        } else if (arg === "--max-entries") {
+            flags.push("--max-entries", String(parseCount(option(args, i, arg))));
+            i++;
+        } else if (arg === "--min-rating" && allowRating) {
+            flags.push("--min-rating", String(parseRating(option(args, i, arg))));
+            i++;
+        } else if (arg.startsWith("--")) {
+            throw new UsageError(`unknown option ${arg}`);
+        } else {
+            words.push(arg);
+        }
+    }
+    return { flags, words };
+}
+
+/** IMDb IDs from the arguments; commas and spaces separate them, duplicates collapse. */
+export function parseImdbIds(args: string[]): string[] {
+    const ids: string[] = [];
+    for (const piece of args.flatMap((a) => a.split(/[\s,]+/))) {
+        if (piece.length === 0) continue;
+        if (!IMDB_ID.test(piece)) throw new UsageError(`not an IMDb id: ${piece.slice(0, 40)} (expected tt followed by digits)`);
+        if (!ids.includes(piece)) ids.push(piece);
+    }
+    if (ids.length === 0) throw new UsageError("give at least one IMDb id, e.g. tt0111161");
+    if (ids.length > MAX_ADD_IDS) throw new UsageError(`at most ${MAX_ADD_IDS} IDs per call`);
+    return ids;
+}
+
+/** The trendarr argv for one wrapper call, with `--json` always last. */
+export function buildTrendarrCall(args: string[]): TrendarrCall {
+    const [name, ...rest] = args;
+    if (name === "trending") {
+        const { flags, words } = parseListFlags(rest, true);
+        if (words.length > 0) throw new UsageError(`trending takes no words: ${words.join(" ").slice(0, 60)}`);
+        return { argv: ["trending", ...flags, "--json"], kind: "list", timeoutMs: 2 * MINUTE };
+    }
+    if (name === "search") {
+        const { flags, words } = parseListFlags(rest, false);
+        const query = words.join(" ").trim();
+        if (query.length === 0) throw new UsageError("search <query>: give a title");
+        if (query.length > MAX_QUERY) throw new UsageError(`query longer than ${MAX_QUERY} characters`);
+        if (query.startsWith("-")) throw new UsageError("query must not start with '-'");
+        if (/\p{Cc}/u.test(query)) throw new UsageError("query must not contain control characters");
+        return { argv: ["search", query, ...flags, "--json"], kind: "list", timeoutMs: 2 * MINUTE };
+    }
+    if (name === "add-movies" || name === "add-series") {
+        return { argv: [name, ...parseImdbIds(rest), "--json"], kind: "add", timeoutMs: 10 * MINUTE };
+    }
+    if (name === "sabnzbd") {
+        if (rest.length !== 1) throw new UsageError("sabnzbd status|pause|resume");
+        const action = rest[0] === "unpause" ? "resume" : rest[0];
+        if (!["status", "pause", "resume"].includes(action)) throw new UsageError("sabnzbd status|pause|resume");
+        return { argv: ["sabnzbd", action, "--json"], kind: "queue", timeoutMs: MINUTE };
+    }
+    if (name === "init") throw new UsageError("init is not available: the wrapper writes trendarr's configuration for each call from the media note and media.json");
+    throw new UsageError(`unknown command: ${name ?? "(none)"}`);
+}
+
+/** Warning lines trendarr wrote to stderr, without the prefix. */
+export function trendarrWarnings(stderr: string): string[] {
+    return stderr
+        .split("\n")
+        .map((l) => l.trim())
+        .filter((l) => l.startsWith("warning: "))
+        .map((l) => l.slice("warning: ".length));
+}
+
+/** trendarr's error text: every stderr line that is not a warning. */
+export function trendarrError(stderr: string): string {
+    return stderr
+        .split("\n")
+        .map((l) => l.trim())
+        .filter((l) => l.length > 0 && !l.startsWith("warning: "))
+        .join("; ")
+        .slice(0, 500);
+}
+
+function jsonObject(text: string): Record<string, unknown> | null {
+    try {
+        const value: unknown = JSON.parse(text);
+        return typeof value === "object" && value !== null && !Array.isArray(value) ? (value as Record<string, unknown>) : null;
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * The wrapper's answer for one trendarr run. An add reports per ID and exits 1
+ * when any ID failed; its JSON is still the answer, so it passes as success.
+ */
+export function interpretRun(call: TrendarrCall, result: { stdout: string; stderr: string; code: number }): Record<string, unknown> {
+    const parsed = jsonObject(result.stdout);
+    const warnings = trendarrWarnings(result.stderr);
+    if (call.kind === "add" && parsed && Array.isArray(parsed.results)) return { ...parsed, warnings };
+    if (result.code !== 0) throw new ServiceError(trendarrError(result.stderr) || `trendarr exited ${result.code}`);
+    if (!parsed) throw new ServiceError("trendarr printed no JSON");
+    return { ...parsed, warnings };
+}
+
+/** Runs trendarr with a private HOME that holds only this call's configuration, removed afterwards. */
+async function runTrendarr(config: MediaConfig, call: TrendarrCall): Promise<{ stdout: string; stderr: string; code: number }> {
+    if (!config.trendarrCli.startsWith("/")) throw new ServiceError("trendarrCli must be an absolute path to trendarr's dist/cli.js");
+    const secrets = readMediaSecrets();
+    const base = workDir(SERVICE);
+    mkdirSync(base, { recursive: true, mode: 0o700 });
+    const home = mkdtempSync(join(base, "home-"));
+    try {
+        chmodSync(home, 0o700);
+        mkdirSync(join(home, ".trendarr"), { mode: 0o700 });
+        writeFileSync(join(home, ".trendarr", "config.json"), `${JSON.stringify(trendarrConfig(config, secrets))}\n`, { mode: 0o600 });
+        return await run(process.execPath, [config.trendarrCli, ...call.argv], { env: { HOME: home }, timeoutMs: call.timeoutMs });
+    } finally {
+        rmSync(home, { recursive: true, force: true });
+    }
+}
+
+export async function command(args: string[]): Promise<number> {
+    if (args.length === 0 || args[0] === "--help" || args[0] === "help") {
+        printRaw(HELP);
+        return 0;
+    }
+    const call = buildTrendarrCall(args);
+    const config = readConfig<MediaConfig>(SERVICE, SHAPE);
+    printJson(interpretRun(call, await runTrendarr(config, call)));
+    return 0;
+}
+
+if (process.argv[1] && import.meta.url === new URL(`file://${process.argv[1]}`).href) {
+    await main(SERVICE, command);
+}

package/specialists/wrappers.test.ts

@@ -1,4 +1,4 @@
-import { mkdtempSync, rmSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
@@ -8,7 +8,8 @@ import { parseParams, parseRecordFilters, technitiumRequest, command as dnsComma
 import { buildVpsRemote, command as edgeCommand, isTransientSshFailure } from "./edge/run.ts";
 import { API_PREFIXES, buildDmzRemote, validateApiPath, command as identityCommand } from "./identity/run.ts";
 import { buildInferenceRemote, compactReleases, command as inferenceCommand } from "./inference/run.ts";
-import { UsageError } from "./lib/errors.ts";
+import { MAX_ADD_IDS, buildTrendarrCall, interpretRun, parseImdbIds, trendarrConfig, trendarrError, trendarrWarnings, command as mediaCommand } from "./media/run.ts";
+import { ServiceError, UsageError } from "./lib/errors.ts";
 import { safeRepoPath, safeWritePath } from "./lib/repo.ts";
 import { POLICY_REQUIRED, buildPulsarRemote, parseQuery, policyWrite, unifiPath, command as networkCommand } from "./network/run.ts";
 import { buildHostRemote, needsConfirm, parseSetPairs, parseVmid, validateApiPath as validatePvePath, command as proxmoxCommand } from "./proxmox/run.ts";
@@ -464,3 +465,122 @@ describe("wrapper config errors", () => {
         await expect(inferenceCommand(["nexus-status"])).rejects.toThrow(/inference\.json/);
     });
 });
+
+describe("media wrapper", () => {
+    it("builds trendarr argv with --json and validated options", () => {
+        expect(buildTrendarrCall(["trending"])).toEqual({ argv: ["trending", "--json"], kind: "list", timeoutMs: 120_000 });
+        expect(buildTrendarrCall(["trending", "--type", "movies", "--min-rating", "0", "--max-entries", "5"]).argv).toEqual(["trending", "--type", "movies", "--min-rating", "0", "--max-entries", "5", "--json"]);
+        expect(buildTrendarrCall(["search", "breaking", "bad", "--type", "series"]).argv).toEqual(["search", "breaking bad", "--type", "series", "--json"]);
+        expect(buildTrendarrCall(["add-movies", "tt1160419", "tt0468569,tt1160419"])).toMatchObject({ argv: ["add-movies", "tt1160419", "tt0468569", "--json"], kind: "add" });
+        expect(buildTrendarrCall(["add-series", "tt0903747"]).argv).toEqual(["add-series", "tt0903747", "--json"]);
+        expect(buildTrendarrCall(["sabnzbd", "unpause"])).toMatchObject({ argv: ["sabnzbd", "resume", "--json"], kind: "queue" });
+        expect(buildTrendarrCall(["sabnzbd", "status"]).argv).toEqual(["sabnzbd", "status", "--json"]);
+    });
+
+    it("refuses anything trendarr would not accept or should not run", () => {
+        expect(() => buildTrendarrCall(["init"])).toThrow(/init is not available/);
+        expect(() => buildTrendarrCall(["trending", "--type", "films"])).toThrow(/movies or series/);
+        expect(() => buildTrendarrCall(["trending", "--min-rating", "11"])).toThrow(/0 to 10/);
+        expect(() => buildTrendarrCall(["trending", "--min-rating", ""])).toThrow(/0 to 10/);
+        expect(() => buildTrendarrCall(["trending", "--max-entries", "0"])).toThrow(/1 to 50/);
+        expect(() => buildTrendarrCall(["trending", "--max-entries"])).toThrow(/needs a value/);
+        expect(() => buildTrendarrCall(["trending", "dune"])).toThrow(/no words/);
+        expect(() => buildTrendarrCall(["trending", "--discord"])).toThrow(/unknown option/);
+        expect(() => buildTrendarrCall(["search", "--min-rating", "5", "dune"])).toThrow(/unknown option/);
+        expect(() => buildTrendarrCall(["search"])).toThrow(/give a title/);
+        expect(() => buildTrendarrCall(["search", "-rf"])).toThrow(/must not start/);
+        expect(() => buildTrendarrCall(["search", "a\u0007b"])).toThrow(/control characters/);
+        expect(() => buildTrendarrCall(["search", "x".repeat(201)])).toThrow(/longer than/);
+        expect(() => buildTrendarrCall(["sabnzbd", "delete"])).toThrow(/status\|pause\|resume/);
+        expect(() => buildTrendarrCall(["sabnzbd"])).toThrow(/status\|pause\|resume/);
+        expect(() => buildTrendarrCall(["delete-movie", "tt1"])).toThrow(/unknown command/);
+        expect(() => parseImdbIds(["tt12x"])).toThrow(UsageError);
+        expect(() => parseImdbIds([" , "])).toThrow(/at least one/);
+        expect(() => parseImdbIds(Array.from({ length: MAX_ADD_IDS + 1 }, (_, i) => `tt${i + 1}`))).toThrow(/at most/);
+    });
+
+    it("writes trendarr's configuration in its own schema", () => {
+        const config = { trendarrCli: "/x/cli.js", radarrUrl: "http://r:7878", radarrQualityProfileId: 7, radarrRootFolderPath: "/media/movies", sonarrUrl: "http://s:8989", sonarrQualityProfileId: 7, sonarrRootFolderPath: "/media/tv", sonarrMonitor: "all", sabnzbdUrl: "http://z:8084", maxEntries: 10 };
+        expect(trendarrConfig(config, { tmdbAccessToken: "t", omdbApiKey: "o", radarrApiKey: "r", sonarrApiKey: "s", sabnzbdApiKey: "z" })).toEqual({
+            tmdb: { accessToken: "t" },
+            omdb: { apiKey: "o" },
+            radarr: { url: "http://r:7878", apiKey: "r", qualityProfileId: 7, rootFolderPath: "/media/movies" },
+            sonarr: { url: "http://s:8989", apiKey: "s", qualityProfileId: 7, rootFolderPath: "/media/tv", monitor: "all" },
+            sabnzbd: { url: "http://z:8084", apiKey: "z" },
+            defaults: { maxEntries: 10 },
+        });
+    });
+
+    it("keeps add results on a partial failure and turns other failures into errors", () => {
+        const add = buildTrendarrCall(["add-movies", "tt1"]);
+        const list = buildTrendarrCall(["trending"]);
+        const partial = JSON.stringify({ results: [{ imdb_id: "tt1", title: null, status: "not_found", detail: null }], sabnzbd_paused: false });
+        expect(interpretRun(add, { stdout: partial, stderr: "warning: SABnzbd slow\n", code: 1 })).toMatchObject({ results: [{ status: "not_found" }], warnings: ["SABnzbd slow"] });
+        expect(interpretRun(list, { stdout: '{"movies":[],"series":[]}', stderr: "warning: Radarr unreachable — in_library unknown\n", code: 0 })).toEqual({ movies: [], series: [], warnings: ["Radarr unreachable — in_library unknown"] });
+        expect(() => interpretRun(list, { stdout: "", stderr: "API key rejected (401) by https://api.themoviedb.org/3/trending\n", code: 1 })).toThrow(/API key rejected/);
+        expect(() => interpretRun(add, { stdout: "", stderr: "Config missing/invalid — run 'trendarr init'.\n", code: 1 })).toThrow(ServiceError);
+        expect(() => interpretRun(list, { stdout: "not json", stderr: "", code: 0 })).toThrow(/no JSON/);
+        expect(trendarrWarnings("warning: a\nboom\nwarning: b")).toEqual(["a", "b"]);
+        expect(trendarrError("warning: a\nboom\n\nbang")).toBe("boom; bang");
+    });
+
+    it("prints help without touching config", async () => {
+        const write = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
+        expect(await mediaCommand(["--help"])).toBe(0);
+        expect(String(write.mock.calls[0][0])).toContain("add-movies <imdbId...>");
+        write.mockRestore();
+    });
+
+    describe("run", () => {
+        let home: string;
+        const originalHome = process.env.HOME;
+
+        beforeEach(() => {
+            home = mkdtempSync(join(tmpdir(), "spec-media-"));
+            process.env.HOME = home;
+            const secrets = join(home, ".specialists", "secrets", "media");
+            mkdirSync(secrets, { recursive: true });
+            for (const field of ["TMDB_ACCESS_TOKEN", "OMDB_API_KEY", "RADARR_API_KEY", "SONARR_API_KEY", "SABNZBD_API_KEY"]) writeFileSync(join(secrets, field), `${field.toLowerCase()}\n`, { mode: 0o600 });
+            const fake = join(home, "fake-trendarr.mjs");
+            writeFileSync(
+                fake,
+                [
+                    'import { readFileSync, statSync } from "node:fs";',
+                    'const path = `${process.env.HOME}/.trendarr/config.json`;',
+                    "const config = JSON.parse(readFileSync(path, 'utf8'));",
+                    'process.stderr.write("warning: fake warning\\n");',
+                    "process.stdout.write(JSON.stringify({ argv: process.argv.slice(2), home: process.env.HOME, mode: statSync(path).mode & 0o777, sonarrKey: config.sonarr.apiKey }));",
+                ].join("\n"),
+            );
+            mkdirSync(join(home, ".specialists", "config"), { recursive: true });
+            writeFileSync(
+                join(home, ".specialists", "config", "media.json"),
+                JSON.stringify({ trendarrCli: fake, radarrUrl: "http://r", radarrQualityProfileId: 7, radarrRootFolderPath: "/m", sonarrUrl: "http://s", sonarrQualityProfileId: 7, sonarrRootFolderPath: "/t", sonarrMonitor: "all", sabnzbdUrl: "http://z", maxEntries: 10 }),
+            );
+        });
+
+        afterEach(() => {
+            process.env.HOME = originalHome;
+            rmSync(home, { recursive: true, force: true });
+        });
+
+        it("runs trendarr with a private HOME and removes it afterwards", async () => {
+            const write = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
+            expect(await mediaCommand(["sabnzbd", "status"])).toBe(0);
+            const printed = JSON.parse(String(write.mock.calls[0][0])) as { argv: string[]; home: string; mode: number; sonarrKey: string; warnings: string[] };
+            write.mockRestore();
+            expect(printed.argv).toEqual(["sabnzbd", "status", "--json"]);
+            expect(printed.home.startsWith(join(home, ".specialists", "work", "media", "home-"))).toBe(true);
+            expect(printed.mode).toBe(0o600);
+            expect(printed.sonarrKey).toBe("sonarr_api_key");
+            expect(printed.warnings).toEqual(["fake warning"]);
+            expect(existsSync(printed.home)).toBe(false);
+            expect(readdirSync(join(home, ".specialists", "work", "media"))).toEqual([]);
+        });
+
+        it("fails clearly when a secret is missing", async () => {
+            rmSync(join(home, ".specialists", "secrets", "media", "OMDB_API_KEY"));
+            await expect(mediaCommand(["trending"])).rejects.toThrow(/OMDB_API_KEY for media is missing/);
+        });
+    });
+});