@blackbelt-technology/pi-agent-dashboard 0.2.9 → 0.3.0

package/packages/server/src/__tests__/openspec-tasks-routes.test.ts

@@ -0,0 +1,180 @@
+/**
+ * HTTP-level tests for the openspec task list / toggle endpoints.
+ */
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import Fastify, { type FastifyInstance } from "fastify";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { registerOpenSpecRoutes } from "../routes/openspec-routes.js";
+
+const PASSTHRU_GUARD = async () => {};
+
+// Simulates a non-loopback guard that 403s every request.
+const DENY_GUARD = async (_req: any, reply: any) => {
+  reply.code(403).send({ success: false, error: "forbidden" });
+};
+
+function makeDirectoryService(): any {
+  return {
+    refreshOpenSpec: vi.fn(async () => ({ initialized: true, changes: [] })),
+    getOpenSpecData: vi.fn(),
+  };
+}
+
+describe("openspec tasks REST routes", () => {
+  let tmpDir: string;
+  let changeName: string;
+  let tasksFile: string;
+  let fastify: FastifyInstance;
+
+  const initialMd = [
+    "## 1. Setup",
+    "",
+    "- [ ] 1.1 First task",
+    "- [x] 1.2 Second task",
+    "",
+    "## 2. Docs",
+    "- [ ] 2.1 Third task",
+    "",
+  ].join("\n");
+
+  beforeEach(async () => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "openspec-routes-test-"));
+    changeName = "demo-change";
+    const dir = path.join(tmpDir, "openspec", "changes", changeName);
+    fs.mkdirSync(dir, { recursive: true });
+    tasksFile = path.join(dir, "tasks.md");
+    fs.writeFileSync(tasksFile, initialMd, "utf-8");
+  });
+
+  afterEach(async () => {
+    if (fastify) await fastify.close();
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  async function setup(opts: {
+    networkGuard?: any;
+    onOpenSpecChanged?: (cwd: string) => void;
+  } = {}) {
+    fastify = Fastify();
+    const directoryService = makeDirectoryService();
+    registerOpenSpecRoutes(fastify, {
+      sessionManager: { listAll: () => [] } as any,
+      preferencesStore: { getPinnedDirectories: () => [] } as any,
+      directoryService,
+      networkGuard: opts.networkGuard ?? PASSTHRU_GUARD,
+      onOpenSpecChanged: opts.onOpenSpecChanged,
+    });
+    await fastify.ready();
+    return { directoryService };
+  }
+
+  it("GET /api/openspec/tasks → 200 with parsed tasks + groups", async () => {
+    await setup();
+    const res = await fastify.inject({
+      method: "GET",
+      url: `/api/openspec/tasks?cwd=${encodeURIComponent(tmpDir)}&change=${changeName}`,
+    });
+    expect(res.statusCode).toBe(200);
+    const body = JSON.parse(res.payload);
+    expect(body.success).toBe(true);
+    expect(body.data.tasks.map((t: any) => t.id)).toEqual(["1.1", "1.2", "2.1"]);
+    expect(body.data.groups).toEqual(["1. Setup", "2. Docs"]);
+  });
+
+  it("GET /api/openspec/tasks → 400 when required query missing", async () => {
+    await setup();
+    const res = await fastify.inject({ method: "GET", url: "/api/openspec/tasks" });
+    expect(res.statusCode).toBe(400);
+  });
+
+  it("GET /api/openspec/tasks → 404 when tasks.md missing", async () => {
+    await setup();
+    const res = await fastify.inject({
+      method: "GET",
+      url: `/api/openspec/tasks?cwd=${encodeURIComponent(tmpDir)}&change=does-not-exist`,
+    });
+    expect(res.statusCode).toBe(404);
+  });
+
+  it("GET /api/openspec/tasks → 403 when network guard denies", async () => {
+    await setup({ networkGuard: DENY_GUARD });
+    const res = await fastify.inject({
+      method: "GET",
+      url: `/api/openspec/tasks?cwd=${encodeURIComponent(tmpDir)}&change=${changeName}`,
+    });
+    expect(res.statusCode).toBe(403);
+  });
+
+  it("POST toggle → 200 ticks task, rewrites file, and triggers broadcast", async () => {
+    const onOpenSpecChanged = vi.fn();
+    const { directoryService } = await setup({ onOpenSpecChanged });
+    const res = await fastify.inject({
+      method: "POST",
+      url: "/api/openspec/tasks/toggle",
+      payload: { cwd: tmpDir, change: changeName, id: "1.1", done: true, line: 3 },
+    });
+    expect(res.statusCode).toBe(200);
+    const body = JSON.parse(res.payload);
+    expect(body.data.task.done).toBe(true);
+    const after = fs.readFileSync(tasksFile, "utf-8");
+    expect(after).toContain("- [x] 1.1 First task");
+    // Allow the fire-and-forget refresh promise to resolve
+    await new Promise((r) => setTimeout(r, 10));
+    expect(directoryService.refreshOpenSpec).toHaveBeenCalledWith(tmpDir);
+    expect(onOpenSpecChanged).toHaveBeenCalledWith(tmpDir);
+  });
+
+  it("POST toggle → 409 on line mismatch (line already in target state)", async () => {
+    await setup();
+    const res = await fastify.inject({
+      method: "POST",
+      url: "/api/openspec/tasks/toggle",
+      payload: { cwd: tmpDir, change: changeName, id: "1.2", done: true, line: 4 },
+    });
+    expect(res.statusCode).toBe(409);
+    // File untouched
+    expect(fs.readFileSync(tasksFile, "utf-8")).toBe(initialMd);
+  });
+
+  it("POST toggle → 400 when target line is not a checkbox", async () => {
+    await setup();
+    const res = await fastify.inject({
+      method: "POST",
+      url: "/api/openspec/tasks/toggle",
+      payload: { cwd: tmpDir, change: changeName, id: "1.1", done: true, line: 1 },
+    });
+    expect(res.statusCode).toBe(400);
+  });
+
+  it("POST toggle → 400 on malformed body", async () => {
+    await setup();
+    const res = await fastify.inject({
+      method: "POST",
+      url: "/api/openspec/tasks/toggle",
+      payload: { cwd: tmpDir },
+    });
+    expect(res.statusCode).toBe(400);
+  });
+
+  it("POST toggle → 404 when tasks.md missing", async () => {
+    await setup();
+    const res = await fastify.inject({
+      method: "POST",
+      url: "/api/openspec/tasks/toggle",
+      payload: { cwd: tmpDir, change: "missing", id: "1.1", done: true, line: 3 },
+    });
+    expect(res.statusCode).toBe(404);
+  });
+
+  it("POST toggle → 403 when network guard denies", async () => {
+    await setup({ networkGuard: DENY_GUARD });
+    const res = await fastify.inject({
+      method: "POST",
+      url: "/api/openspec/tasks/toggle",
+      payload: { cwd: tmpDir, change: changeName, id: "1.1", done: true, line: 3 },
+    });
+    expect(res.statusCode).toBe(403);
+  });
+});

package/packages/server/src/__tests__/package-manager-wrapper-resolve.test.ts

@@ -0,0 +1,122 @@
+/**
+ * Tests for loadPiPackageManager() resolution chain in package-manager-wrapper.ts.
+ *
+ * Separate from package-manager-wrapper.test.ts because that file mocks
+ * "@mariozechner/pi-coding-agent" so direct-import succeeds and the
+ * fallback paths never execute.
+ *
+ * These tests exercise the managed-install and global-npm fallbacks.
+ */
+import { describe, it, expect, vi, afterEach } from "vitest";
+import * as os from "node:os";
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+// Force the direct import to fail so resolution falls through to the
+// managed-install / global-npm paths. vi.mock is hoisted; the factory
+// throws at import time which mimics pi not being an installed dependency.
+vi.mock("@mariozechner/pi-coding-agent", () => {
+  throw new Error("not installed as direct dependency");
+});
+vi.mock("@oh-my-pi/pi-coding-agent", () => {
+  throw new Error("not installed as direct dependency");
+});
+
+/** Override os.homedir() by setting the env vars libuv reads. */
+function withHome(tmpHome: string): () => void {
+  const prev = {
+    HOME: process.env.HOME,
+    USERPROFILE: process.env.USERPROFILE,
+  };
+  process.env.HOME = tmpHome;
+  process.env.USERPROFILE = tmpHome;
+  return () => {
+    if (prev.HOME === undefined) delete process.env.HOME; else process.env.HOME = prev.HOME;
+    if (prev.USERPROFILE === undefined) delete process.env.USERPROFILE; else process.env.USERPROFILE = prev.USERPROFILE;
+  };
+}
+
+describe("loadPiPackageManager resolution chain", () => {
+  const cleanupPaths: string[] = [];
+  const restoreFns: Array<() => void> = [];
+
+  afterEach(() => {
+    for (const r of restoreFns) r();
+    restoreFns.length = 0;
+    vi.restoreAllMocks();
+    vi.resetModules();
+    for (const p of cleanupPaths) {
+      try { fs.rmSync(p, { recursive: true, force: true }); } catch { /* ignore */ }
+    }
+    cleanupPaths.length = 0;
+  });
+
+  it("resolves pi from managed install at ~/.pi-dashboard/node_modules/ when direct import fails", async () => {
+    const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "pi-dash-home-managed-"));
+    cleanupPaths.push(tmpHome);
+
+    // Create a fake managed pi install with a real ESM entry file
+    const fakeDistDir = path.join(
+      tmpHome,
+      ".pi-dashboard",
+      "node_modules",
+      "@mariozechner",
+      "pi-coding-agent",
+      "dist",
+    );
+    fs.mkdirSync(fakeDistDir, { recursive: true });
+    fs.writeFileSync(
+      path.join(fakeDistDir, "index.js"),
+      [
+        "export function DefaultPackageManager() {",
+        "  return {",
+        "    listConfiguredPackages: () => [{ source: 'npm:from-managed', scope: 'user', filtered: false }],",
+        "  };",
+        "}",
+        "export const SettingsManager = { create: () => ({}) };",
+      ].join("\n"),
+    );
+
+    restoreFns.push(withHome(tmpHome));
+    expect(os.homedir()).toBe(tmpHome);
+    vi.resetModules();
+
+    const { PackageManagerWrapper } = await import("../package-manager-wrapper.js");
+    const wrapper = new PackageManagerWrapper();
+    const result = await wrapper.listInstalled("global");
+
+    expect(result).toEqual([
+      { source: "npm:from-managed", scope: "user", filtered: false },
+    ]);
+  });
+
+  it("falls through to global npm without crashing when managed install is absent", async () => {
+    // tmp home with NO ~/.pi-dashboard directory -> managed resolution must
+    // silently fail and continue to the global-npm path.
+    const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "pi-dash-home-empty-"));
+    cleanupPaths.push(tmpHome);
+
+    restoreFns.push(withHome(tmpHome));
+    expect(os.homedir()).toBe(tmpHome);
+
+    // Stub execSync so `npm root -g` returns a directory where pi is also
+    // absent. With direct-import + managed + global all missing, the
+    // function must surface the final "pi-coding-agent is not installed"
+    // error — proving the managed block didn't throw early.
+    vi.doMock("node:child_process", async (importOriginal) => {
+      const actual = await importOriginal<typeof import("node:child_process")>();
+      return {
+        ...actual,
+        execSync: vi.fn(() => tmpHome), // no pi inside tmpHome
+      };
+    });
+
+    vi.resetModules();
+    const { PackageManagerWrapper } = await import("../package-manager-wrapper.js");
+    const wrapper = new PackageManagerWrapper();
+
+    await expect(wrapper.listInstalled("global")).rejects.toThrow(
+      /pi-coding-agent is not installed/,
+    );
+  });
+});

package/packages/server/src/__tests__/pi-core-checker.test.ts

@@ -0,0 +1,195 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import os from "node:os";
+import path from "node:path";
+import fs from "node:fs";
+import { PiCoreChecker, CORE_PACKAGE_NAMES, _internal } from "../pi-core-checker.js";
+
+describe("PiCoreChecker._internal.looksLikePiEcosystem", () => {
+	it("matches known core packages", () => {
+		for (const name of CORE_PACKAGE_NAMES) {
+			expect(_internal.looksLikePiEcosystem(name)).toBe(true);
+		}
+	});
+
+	it("matches bare pi- packages", () => {
+		expect(_internal.looksLikePiEcosystem("pi-web-access")).toBe(true);
+		expect(_internal.looksLikePiEcosystem("pi-agent-browser")).toBe(true);
+	});
+
+	it("matches scoped pi- packages", () => {
+		expect(_internal.looksLikePiEcosystem("@tintinweb/pi-subagents")).toBe(true);
+		expect(_internal.looksLikePiEcosystem("@benvargas/pi-claude-code-use")).toBe(true);
+	});
+
+	it("rejects non-pi packages", () => {
+		expect(_internal.looksLikePiEcosystem("react")).toBe(false);
+		expect(_internal.looksLikePiEcosystem("@types/node")).toBe(false);
+		expect(_internal.looksLikePiEcosystem("piano")).toBe(false);
+		expect(_internal.looksLikePiEcosystem("@scope/notpi")).toBe(false);
+	});
+});
+
+describe("PiCoreChecker.getStatus", () => {
+	let tmpManagedDir: string;
+
+	beforeEach(() => {
+		tmpManagedDir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-core-test-"));
+	});
+
+	function writeManagedPackage(managedDir: string, name: string, version: string) {
+		const dir = path.join(managedDir, "node_modules", name);
+		fs.mkdirSync(dir, { recursive: true });
+		fs.writeFileSync(path.join(dir, "package.json"), JSON.stringify({ name, version }));
+	}
+
+	it("discovers global pi packages via npm list", async () => {
+		const checker = new PiCoreChecker({
+			npmList: async () =>
+				JSON.stringify({
+					dependencies: {
+						"@mariozechner/pi-coding-agent": { version: "0.67.1" },
+						"pi-web-access": { version: "0.10.6" },
+						react: { version: "19.0.0" }, // must be ignored
+					},
+				}),
+			fetchLatest: async (name) => {
+				if (name === "@mariozechner/pi-coding-agent") return "0.67.6";
+				if (name === "pi-web-access") return "0.10.6";
+				return null;
+			},
+			managedDir: tmpManagedDir,
+		});
+
+		const status = await checker.getStatus();
+
+		expect(status.packages.length).toBe(2);
+		const pi = status.packages.find((p) => p.name === "@mariozechner/pi-coding-agent")!;
+		expect(pi.displayName).toBe("pi (core agent)");
+		expect(pi.currentVersion).toBe("0.67.1");
+		expect(pi.latestVersion).toBe("0.67.6");
+		expect(pi.updateAvailable).toBe(true);
+		expect(pi.installSource).toBe("global");
+
+		const web = status.packages.find((p) => p.name === "pi-web-access")!;
+		expect(web.displayName).toBe("pi-web-access");
+		expect(web.updateAvailable).toBe(false);
+		expect(web.installSource).toBe("global");
+
+		expect(status.updatesAvailable).toBe(1);
+	});
+
+	it("discovers managed packages and prefers them over global duplicates", async () => {
+		writeManagedPackage(tmpManagedDir, "@mariozechner/pi-coding-agent", "0.67.5");
+
+		const checker = new PiCoreChecker({
+			npmList: async () =>
+				JSON.stringify({
+					dependencies: {
+						"@mariozechner/pi-coding-agent": { version: "0.67.1" },
+					},
+				}),
+			fetchLatest: async () => "0.67.6",
+			managedDir: tmpManagedDir,
+		});
+
+		const status = await checker.getStatus();
+		expect(status.packages.length).toBe(1);
+		expect(status.packages[0].currentVersion).toBe("0.67.5");
+		expect(status.packages[0].installSource).toBe("managed");
+	});
+
+	it("returns empty list when managed dir missing and npm list fails", async () => {
+		const checker = new PiCoreChecker({
+			npmList: async () => {
+				throw new Error("npm not found");
+			},
+			fetchLatest: async () => null,
+			managedDir: path.join(tmpManagedDir, "nonexistent"),
+		});
+		const status = await checker.getStatus();
+		expect(status.packages).toEqual([]);
+		expect(status.updatesAvailable).toBe(0);
+	});
+
+	it("tolerates non-zero npm list exit when stdout contains valid JSON", async () => {
+		const checker = new PiCoreChecker({
+			npmList: async () => {
+				const err = new Error("npm warn") as Error & { stdout: string };
+				err.stdout = JSON.stringify({
+					dependencies: { "pi-web-access": { version: "0.10.6" } },
+				});
+				throw err;
+			},
+			fetchLatest: async () => "0.10.6",
+			managedDir: path.join(tmpManagedDir, "nope"),
+		});
+		const status = await checker.getStatus();
+		expect(status.packages.length).toBe(1);
+		expect(status.packages[0].name).toBe("pi-web-access");
+	});
+
+	it("caches results within 5 minutes", async () => {
+		let calls = 0;
+		const checker = new PiCoreChecker({
+			npmList: async () => {
+				calls++;
+				return JSON.stringify({ dependencies: { "pi-web-access": { version: "0.10.6" } } });
+			},
+			fetchLatest: async () => "0.10.6",
+			managedDir: path.join(tmpManagedDir, "nope"),
+		});
+		await checker.getStatus();
+		await checker.getStatus();
+		expect(calls).toBe(1);
+	});
+
+	it("force-refresh invalidates the cache", async () => {
+		let calls = 0;
+		const checker = new PiCoreChecker({
+			npmList: async () => {
+				calls++;
+				return JSON.stringify({ dependencies: { "pi-web-access": { version: "0.10.6" } } });
+			},
+			fetchLatest: async () => "0.10.6",
+			managedDir: path.join(tmpManagedDir, "nope"),
+		});
+		await checker.getStatus();
+		await checker.getStatus(true);
+		expect(calls).toBe(2);
+	});
+
+	it("treats fetch failure as latestVersion=null, updateAvailable=false", async () => {
+		const checker = new PiCoreChecker({
+			npmList: async () =>
+				JSON.stringify({ dependencies: { "pi-web-access": { version: "0.10.6" } } }),
+			fetchLatest: async () => {
+				throw new Error("network down");
+			},
+			managedDir: path.join(tmpManagedDir, "nope"),
+		});
+		const status = await checker.getStatus();
+		expect(status.packages.length).toBe(1);
+		expect(status.packages[0].latestVersion).toBeNull();
+		expect(status.packages[0].updateAvailable).toBe(false);
+	});
+
+	it("sorts known core packages first", async () => {
+		const checker = new PiCoreChecker({
+			npmList: async () =>
+				JSON.stringify({
+					dependencies: {
+						"pi-web-access": { version: "0.10.6" },
+						"@mariozechner/pi-coding-agent": { version: "0.67.1" },
+						"pi-agent-browser": { version: "0.1.0" },
+					},
+				}),
+			fetchLatest: async () => null,
+			managedDir: path.join(tmpManagedDir, "nope"),
+		});
+		const status = await checker.getStatus();
+		expect(status.packages[0].name).toBe("@mariozechner/pi-coding-agent");
+		// remaining are alphabetical
+		expect(status.packages[1].name).toBe("pi-agent-browser");
+		expect(status.packages[2].name).toBe("pi-web-access");
+	});
+});

package/packages/server/src/__tests__/pi-core-routes.test.ts

@@ -0,0 +1,184 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import Fastify, { type FastifyInstance } from "fastify";
+import { registerPiCoreRoutes } from "../routes/pi-core-routes.js";
+import { PackageOperationBusyError } from "../package-manager-wrapper.js";
+import type { PiCoreStatus, PiCorePackage } from "@blackbelt-technology/pi-dashboard-shared/rest-api.js";
+
+function makePkg(name: string, updateAvailable = false): PiCorePackage {
+	return {
+		name,
+		displayName: name,
+		currentVersion: "0.1.0",
+		latestVersion: updateAvailable ? "0.2.0" : "0.1.0",
+		updateAvailable,
+		installSource: "global",
+	};
+}
+
+describe("pi-core-routes", () => {
+	let app: FastifyInstance;
+	let checker: any;
+	let updater: any;
+	let onUpdateComplete: any;
+
+	beforeEach(async () => {
+		checker = {
+			getStatus: vi.fn<(refresh?: boolean) => Promise<PiCoreStatus>>(),
+			invalidate: vi.fn(),
+		};
+		updater = {
+			update: vi.fn(),
+		};
+		onUpdateComplete = vi.fn();
+		app = Fastify({ logger: false });
+		registerPiCoreRoutes(app, {
+			piCoreChecker: checker,
+			piCoreUpdater: updater,
+			onUpdateComplete,
+		});
+		await app.ready();
+	});
+
+	afterEach(async () => {
+		await app.close();
+	});
+
+	it("GET /api/pi-core/versions returns cached status", async () => {
+		const status: PiCoreStatus = {
+			packages: [makePkg("pi-web-access")],
+			updatesAvailable: 0,
+			lastChecked: new Date().toISOString(),
+		};
+		checker.getStatus.mockResolvedValue(status);
+
+		const res = await app.inject({ method: "GET", url: "/api/pi-core/versions" });
+		expect(res.statusCode).toBe(200);
+		const body = res.json() as any;
+		expect(body.success).toBe(true);
+		expect(body.data).toEqual(status);
+		expect(checker.getStatus).toHaveBeenCalledWith(false);
+	});
+
+	it("GET /api/pi-core/versions?refresh=true forces refresh", async () => {
+		checker.getStatus.mockResolvedValue({
+			packages: [],
+			updatesAvailable: 0,
+			lastChecked: new Date().toISOString(),
+		});
+		const res = await app.inject({ method: "GET", url: "/api/pi-core/versions?refresh=true" });
+		expect(res.statusCode).toBe(200);
+		expect(checker.getStatus).toHaveBeenCalledWith(true);
+	});
+
+	it("POST /api/pi-core/update with empty body updates all packages with updateAvailable", async () => {
+		checker.getStatus.mockResolvedValue({
+			packages: [makePkg("pi-web-access", true), makePkg("pi-foo", false)],
+			updatesAvailable: 1,
+			lastChecked: new Date().toISOString(),
+		});
+		updater.update.mockResolvedValue({
+			results: [{ name: "pi-web-access", success: true }],
+			sessionsReloaded: 2,
+		});
+
+		const res = await app.inject({ method: "POST", url: "/api/pi-core/update", payload: {} });
+		expect(res.statusCode).toBe(200);
+		const body = res.json() as any;
+		expect(body.success).toBe(true);
+		expect(body.data.results).toHaveLength(1);
+		expect(body.data.sessionsReloaded).toBe(2);
+
+		// Only updates the one with updateAvailable
+		expect(updater.update).toHaveBeenCalledTimes(1);
+		const arg = updater.update.mock.calls[0][0];
+		expect(arg).toHaveLength(1);
+		expect(arg[0].name).toBe("pi-web-access");
+
+		// Cache invalidated so next status reflects new versions
+		expect(checker.invalidate).toHaveBeenCalled();
+
+		// onUpdateComplete called so server can broadcast to browsers (badge refetch)
+		expect(onUpdateComplete).toHaveBeenCalledTimes(1);
+		expect(onUpdateComplete).toHaveBeenCalledWith({
+			results: [{ name: "pi-web-access", success: true }],
+			sessionsReloaded: 2,
+		});
+	});
+
+	it("POST /api/pi-core/update does not call onUpdateComplete on busy-error", async () => {
+		checker.getStatus.mockResolvedValue({
+			packages: [makePkg("pi-web-access", true)],
+			updatesAvailable: 1,
+			lastChecked: new Date().toISOString(),
+		});
+		updater.update.mockRejectedValue(new PackageOperationBusyError());
+
+		const res = await app.inject({ method: "POST", url: "/api/pi-core/update", payload: {} });
+		expect(res.statusCode).toBe(409);
+		expect(onUpdateComplete).not.toHaveBeenCalled();
+	});
+
+	it("POST /api/pi-core/update with specific packages filters to those", async () => {
+		checker.getStatus.mockResolvedValue({
+			packages: [makePkg("pi-web-access", true), makePkg("pi-foo", true)],
+			updatesAvailable: 2,
+			lastChecked: new Date().toISOString(),
+		});
+		updater.update.mockResolvedValue({ results: [{ name: "pi-foo", success: true }], sessionsReloaded: 0 });
+
+		const res = await app.inject({
+			method: "POST",
+			url: "/api/pi-core/update",
+			payload: { packages: ["pi-foo"] },
+		});
+		expect(res.statusCode).toBe(200);
+		expect(updater.update.mock.calls[0][0].map((p: PiCorePackage) => p.name)).toEqual(["pi-foo"]);
+	});
+
+	it("POST /api/pi-core/update rejects unknown packages with 400", async () => {
+		checker.getStatus.mockResolvedValue({
+			packages: [makePkg("pi-web-access", true)],
+			updatesAvailable: 1,
+			lastChecked: new Date().toISOString(),
+		});
+
+		const res = await app.inject({
+			method: "POST",
+			url: "/api/pi-core/update",
+			payload: { packages: ["not-a-real-package"] },
+		});
+		expect(res.statusCode).toBe(400);
+		const body = res.json() as any;
+		expect(body.success).toBe(false);
+		expect(body.error).toMatch(/not-a-real-package/);
+	});
+
+	it("POST /api/pi-core/update returns 409 when busy", async () => {
+		checker.getStatus.mockResolvedValue({
+			packages: [makePkg("pi-web-access", true)],
+			updatesAvailable: 1,
+			lastChecked: new Date().toISOString(),
+		});
+		updater.update.mockRejectedValue(new PackageOperationBusyError());
+
+		const res = await app.inject({ method: "POST", url: "/api/pi-core/update", payload: {} });
+		expect(res.statusCode).toBe(409);
+		const body = res.json() as any;
+		expect(body.success).toBe(false);
+	});
+
+	it("POST /api/pi-core/update returns empty result when nothing to update", async () => {
+		checker.getStatus.mockResolvedValue({
+			packages: [makePkg("pi-web-access", false)],
+			updatesAvailable: 0,
+			lastChecked: new Date().toISOString(),
+		});
+
+		const res = await app.inject({ method: "POST", url: "/api/pi-core/update", payload: {} });
+		expect(res.statusCode).toBe(200);
+		const body = res.json() as any;
+		expect(body.data.results).toEqual([]);
+		expect(body.data.sessionsReloaded).toBe(0);
+		expect(updater.update).not.toHaveBeenCalled();
+	});
+});