@blackbelt-technology/pi-agent-dashboard 0.2.9 → 0.4.0

package/packages/server/src/__tests__/browse-endpoint.test.ts

@@ -1,25 +1,26 @@
 /**
  * Tests for the browse directory endpoint logic.
  */
-import { describe, it, expect } from "vitest";
-import { listDirectories } from "../browse.js";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { listDirectories, createDirectory, validateMkdirName } from "../browse.js";
 import path from "node:path";
 import os from "node:os";
 import fs from "node:fs";
+import fsp from "node:fs/promises";
 
 describe("listDirectories", () => {
   it("should return directory entries for a valid path", async () => {
     // Use the project root — known to have subdirectories
-    const projectRoot = path.resolve(import.meta.dirname, "../../..");
+    const projectRoot = path.resolve(import.meta.dirname, "../../../..");
     const result = await listDirectories(projectRoot);
 
     expect(result.current).toBe(projectRoot);
     expect(result.parent).toBe(path.dirname(projectRoot));
     expect(result.entries.length).toBeGreaterThan(0);
 
-    // Should contain known subdirectories
+    // Should contain known subdirectories at the monorepo root
     const names = result.entries.map((e) => e.name);
-    expect(names).toContain("src");
+    expect(names).toContain("packages");
     expect(names).toContain("node_modules");
   });
 
@@ -29,7 +30,7 @@ describe("listDirectories", () => {
   });
 
   it("should return entries sorted alphabetically", async () => {
-    const projectRoot = path.resolve(import.meta.dirname, "../../..");
+    const projectRoot = path.resolve(import.meta.dirname, "../../../..");
     const result = await listDirectories(projectRoot);
     const names = result.entries.map((e) => e.name);
     const sorted = [...names].sort((a, b) => a.localeCompare(b));
@@ -45,7 +46,7 @@ describe("listDirectories", () => {
   });
 
   it("should detect isGit flag for git repos", async () => {
-    const projectRoot = path.resolve(import.meta.dirname, "../../..");
+    const projectRoot = path.resolve(import.meta.dirname, "../../../..");
     const parentDir = path.dirname(projectRoot);
     const result = await listDirectories(parentDir);
 
@@ -57,7 +58,7 @@ describe("listDirectories", () => {
   });
 
   it("should detect isPi flag for pi projects", async () => {
-    const projectRoot = path.resolve(import.meta.dirname, "../../..");
+    const projectRoot = path.resolve(import.meta.dirname, "../../../..");
     const parentDir = path.dirname(projectRoot);
     const result = await listDirectories(parentDir);
 
@@ -86,7 +87,7 @@ describe("listDirectories", () => {
   });
 
   it("should only return directories, not files", async () => {
-    const projectRoot = path.resolve(import.meta.dirname, "../../..");
+    const projectRoot = path.resolve(import.meta.dirname, "../../../..");
     const result = await listDirectories(projectRoot);
     const names = result.entries.map((e) => e.name);
     // package.json is a file, should not appear
@@ -95,10 +96,245 @@ describe("listDirectories", () => {
   });
 
   it("should include full path in each entry", async () => {
-    const projectRoot = path.resolve(import.meta.dirname, "../../..");
+    const projectRoot = path.resolve(import.meta.dirname, "../../../..");
     const result = await listDirectories(projectRoot);
     for (const entry of result.entries) {
       expect(entry.path).toBe(path.join(projectRoot, entry.name));
     }
   });
+
+  it("should return the server's platform", async () => {
+    const projectRoot = path.resolve(import.meta.dirname, "../../../..");
+    const result = await listDirectories(projectRoot);
+    expect(result.platform).toBe(process.platform);
+  });
+
+  it("returns parent=null at the filesystem root", async () => {
+    // Use whichever root is appropriate for the host: "/" on Unix, the
+    // process's drive root on Windows. Previously this test only
+    // exercised Unix; `isFilesystemRoot` covers both branches now.
+    const root = process.platform === "win32"
+      ? path.parse(process.cwd()).root    // e.g., "C:\\" or "B:\\"
+      : "/";
+    const result = await listDirectories(root);
+    expect(result.parent).toBeNull();
+  });
+});
+
+describe("listDirectories with q filter", () => {
+  let tmp: string;
+
+  beforeEach(async () => {
+    tmp = await fsp.mkdtemp(path.join(os.tmpdir(), "browse-q-"));
+  });
+
+  afterEach(async () => {
+    await fsp.rm(tmp, { recursive: true, force: true });
+  });
+
+  async function makeDirs(names: string[]) {
+    for (const n of names) await fsp.mkdir(path.join(tmp, n));
+  }
+
+  it("treats empty q as no filter", async () => {
+    await makeDirs(["alpha", "beta"]);
+    const r1 = await listDirectories(tmp, "");
+    const r2 = await listDirectories(tmp, "   ");
+    const r3 = await listDirectories(tmp);
+    const names1 = r1.entries.map((e) => e.name);
+    const names2 = r2.entries.map((e) => e.name);
+    const names3 = r3.entries.map((e) => e.name);
+    expect(names1).toEqual(["alpha", "beta"]);
+    expect(names2).toEqual(["alpha", "beta"]);
+    expect(names3).toEqual(["alpha", "beta"]);
+  });
+
+  it("returns non-prefix substring matches", async () => {
+    await makeDirs(["pi-dashboard", "my-dashboard-old", "readme-dir"]);
+    const r = await listDirectories(tmp, "dash");
+    const names = r.entries.map((e) => e.name);
+    expect(names).toContain("pi-dashboard");
+    expect(names).toContain("my-dashboard-old");
+    expect(names).not.toContain("readme-dir");
+  });
+
+  it("ranks by tier: exact, prefix, word-boundary, substring", async () => {
+    await makeDirs(["pi", "pi-core", "my-pi-tools", "epiphany"]);
+    const r = await listDirectories(tmp, "pi");
+    const names = r.entries.map((e) => e.name);
+    expect(names).toEqual(["pi", "pi-core", "my-pi-tools", "epiphany"]);
+  });
+
+  it("sorts alphabetically within the same tier", async () => {
+    await makeDirs(["pi-zeta", "pi-alpha", "pi-mu"]);
+    const r = await listDirectories(tmp, "pi");
+    const names = r.entries.map((e) => e.name);
+    // all prefix-tier → alphabetical
+    expect(names).toEqual(["pi-alpha", "pi-mu", "pi-zeta"]);
+  });
+
+  it("is case-insensitive", async () => {
+    await makeDirs(["Pi-Dashboard", "OtherThing"]);
+    const r = await listDirectories(tmp, "dash");
+    const names = r.entries.map((e) => e.name);
+    expect(names).toContain("Pi-Dashboard");
+    expect(names).not.toContain("OtherThing");
+  });
+
+  it("applies the 200-cap AFTER filtering so late-alphabet matches survive", async () => {
+    // Create 210 dummy dirs that don't match 'pi', plus one that does.
+    // The matching one alphabetically sorts near the end.
+    const dummy: string[] = [];
+    for (let i = 0; i < 210; i++) {
+      dummy.push(`z-${String(i).padStart(3, "0")}-other`);
+    }
+    // 'pi-dashboard' is the only match; sorts after all 'z-*'? No — 'p' < 'z',
+    // so use 'pi-dashboard' which alphabetically precedes them anyway. Use
+    // a different setup: create one matching dir named so alphabetically it
+    // falls past position 200 in the unfiltered list.
+    await makeDirs(dummy);
+    // 'zz-pi-match' will alphabetically be past the 200 'z-*' entries if we
+    // keep them, but since we only have 210 total, let's just make the matcher
+    // something that would be cut without filtering. Easier: 'aa-other' ×210
+    // plus a single 'pi-found'.
+    await fsp.rm(tmp, { recursive: true, force: true });
+    await fsp.mkdir(tmp);
+    const many: string[] = [];
+    for (let i = 0; i < 210; i++) many.push(`aa-${String(i).padStart(3, "0")}`);
+    many.push("pi-found");
+    await makeDirs(many);
+
+    // Without filter: 'pi-found' sorts alphabetically past 210 'aa-*' entries,
+    // so it lands at position 210 — cut by the 200 cap.
+    const unfiltered = await listDirectories(tmp);
+    expect(unfiltered.entries.length).toBe(200);
+    expect(unfiltered.entries.map((e) => e.name)).not.toContain("pi-found");
+
+    // With filter: it should survive because filtering happens first.
+    const filtered = await listDirectories(tmp, "pi");
+    expect(filtered.entries.map((e) => e.name)).toContain("pi-found");
+  });
+});
+
+describe("validateMkdirName", () => {
+  it("accepts normal names", () => {
+    expect(validateMkdirName("foo")).toBeNull();
+    expect(validateMkdirName("foo-bar")).toBeNull();
+    expect(validateMkdirName("foo_bar")).toBeNull();
+    expect(validateMkdirName("foo.bar")).toBeNull();
+    expect(validateMkdirName("foo bar")).toBeNull();
+    expect(validateMkdirName("\u00e9l\u00e9phant")).toBeNull();
+  });
+
+  it("rejects empty / whitespace", () => {
+    expect(validateMkdirName("")).toBe("invalid name");
+    expect(validateMkdirName("   ")).toBe("invalid name");
+    expect(validateMkdirName(" foo")).toBe("invalid name");
+    expect(validateMkdirName("foo ")).toBe("invalid name");
+  });
+
+  it("rejects . and ..", () => {
+    expect(validateMkdirName(".")).toBe("invalid name");
+    expect(validateMkdirName("..")).toBe("invalid name");
+  });
+
+  it("rejects path separators", () => {
+    expect(validateMkdirName("foo/bar")).toBe("invalid name");
+    expect(validateMkdirName("foo\\bar")).toBe("invalid name");
+  });
+
+  it("rejects null byte", () => {
+    expect(validateMkdirName("foo\0bar")).toBe("invalid name");
+  });
+});
+
+describe("createDirectory", () => {
+  let tmp: string;
+
+  beforeEach(async () => {
+    tmp = await fsp.mkdtemp(path.join(os.tmpdir(), "mkdir-"));
+  });
+
+  afterEach(async () => {
+    await fsp.rm(tmp, { recursive: true, force: true });
+  });
+
+  it("creates a new directory and returns its absolute path", async () => {
+    const result = await createDirectory(tmp, "new-thing");
+    expect(result).toBe(path.join(tmp, "new-thing"));
+    const stat = await fsp.stat(result);
+    expect(stat.isDirectory()).toBe(true);
+  });
+
+  it("throws 'already exists' when target already exists", async () => {
+    await fsp.mkdir(path.join(tmp, "dup"));
+    await expect(createDirectory(tmp, "dup")).rejects.toThrow("already exists");
+  });
+
+  it("throws 'parent not found' when parent does not exist", async () => {
+    await expect(createDirectory("/nonexistent/path/really", "x")).rejects.toThrow("parent not found");
+  });
+
+  it("throws 'parent is not a directory' when parent is a file", async () => {
+    const filePath = path.join(tmp, "somefile");
+    await fsp.writeFile(filePath, "hi");
+    await expect(createDirectory(filePath, "x")).rejects.toThrow("parent is not a directory");
+  });
+
+  it("rejects invalid names without touching disk", async () => {
+    await expect(createDirectory(tmp, "foo/bar")).rejects.toThrow("invalid name");
+    await expect(createDirectory(tmp, "..")).rejects.toThrow("invalid name");
+    await expect(createDirectory(tmp, ".")).rejects.toThrow("invalid name");
+    await expect(createDirectory(tmp, "")).rejects.toThrow("invalid name");
+    await expect(createDirectory(tmp, "foo\0bar")).rejects.toThrow("invalid name");
+    const entries = await fsp.readdir(tmp);
+    expect(entries).toEqual([]);
+  });
+});
+
+// ── S1: rankTier word-boundary edge cases ────────────────────
+// rankTier isn't exported; exercise it indirectly via listDirectories.
+describe("listDirectories word-boundary ranking", () => {
+  let tmp: string;
+
+  beforeEach(async () => {
+    tmp = await fsp.mkdtemp(path.join(os.tmpdir(), "browse-wb-"));
+  });
+
+  afterEach(async () => {
+    await fsp.rm(tmp, { recursive: true, force: true });
+  });
+
+  async function makeDirs(names: string[]) {
+    for (const n of names) await fsp.mkdir(path.join(tmp, n));
+  }
+
+  it("treats hyphen, underscore, dot, space as word boundaries", async () => {
+    // All four should rank at tier 2 for query 'foo' (word boundary before 'foo');
+    // 'embeddedfoo' ranks tier 3 (plain substring).
+    await makeDirs([
+      "pi-foo",    // hyphen boundary
+      "pi_foo",    // underscore boundary
+      "pi.foo",    // dot boundary
+      "pi foo",    // space boundary
+      "embeddedfoo", // no boundary
+    ]);
+    const r = await listDirectories(tmp, "foo");
+    const names = r.entries.map((e) => e.name);
+    // The first four are tier 2 (alphabetical within tier); 'embeddedfoo' is tier 3 last.
+    expect(names[names.length - 1]).toBe("embeddedfoo");
+    // All four boundary-matched names appear before embeddedfoo.
+    const boundaryNames = ["pi foo", "pi-foo", "pi.foo", "pi_foo"];
+    const boundaryPositions = boundaryNames.map((n) => names.indexOf(n));
+    for (const p of boundaryPositions) expect(p).toBeGreaterThanOrEqual(0);
+    for (const p of boundaryPositions) expect(p).toBeLessThan(names.indexOf("embeddedfoo"));
+  });
+
+  it("treats start-of-string as a word boundary (prefix trumps via tier 1)", async () => {
+    await makeDirs(["foo-bar", "xx-foo"]);
+    const r = await listDirectories(tmp, "foo");
+    // 'foo-bar' is prefix (tier 1), 'xx-foo' is word-boundary (tier 2).
+    const names = r.entries.map((e) => e.name);
+    expect(names).toEqual(["foo-bar", "xx-foo"]);
+  });
 });

package/packages/server/src/__tests__/browser-gateway-handler-errors.test.ts

@@ -0,0 +1,129 @@
+/**
+ * Regression tests for browser-gateway exception handling.
+ *
+ * - Handler exceptions MUST be logged with a `[browser-gw] handler error`
+ *   prefix and the message type, so real bugs (e.g. node-pty spawn
+ *   failures) are no longer silently swallowed.
+ * - Malformed JSON frames MUST still be silently dropped (no log noise
+ *   for garbage input).
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { EventEmitter } from "node:events";
+import { createBrowserGateway } from "../browser-gateway.js";
+import { createMemorySessionManager } from "../memory-session-manager.js";
+import { createMemoryEventStore } from "../memory-event-store.js";
+import type { TerminalManager } from "../terminal-manager.js";
+import type { PiGateway } from "../pi-gateway.js";
+import type { SessionOrderManager } from "../session-order-manager.js";
+
+function makeFakeWs() {
+  const ws = new EventEmitter() as EventEmitter & {
+    send: ReturnType<typeof vi.fn>;
+    close: ReturnType<typeof vi.fn>;
+    readyState: number;
+    OPEN: number;
+  };
+  ws.send = vi.fn();
+  ws.close = vi.fn();
+  ws.readyState = 1;
+  ws.OPEN = 1;
+  return ws;
+}
+
+function makeStubPiGateway(): PiGateway {
+  return {
+    start: vi.fn(),
+    stop: vi.fn(),
+    sendToSession: vi.fn(),
+    getConnectedSessionIds: vi.fn(() => []),
+    hasSession: vi.fn(() => false),
+    onEvent: vi.fn(),
+  } as unknown as PiGateway;
+}
+
+function makeStubOrderManager(): SessionOrderManager {
+  return {
+    insert: vi.fn(),
+    remove: vi.fn(),
+    getOrder: vi.fn(() => []),
+    reorder: vi.fn(),
+    getAllOrders: vi.fn(() => ({})),
+  } as unknown as SessionOrderManager;
+}
+
+describe("browser-gateway handler error reporting", () => {
+  let errorSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    errorSpy.mockRestore();
+  });
+
+  it("logs handler exceptions with type and error (does not silently swallow)", async () => {
+    const throwingTerminalManager = {
+      spawn: vi.fn(() => {
+        throw new Error("posix_spawnp failed.");
+      }),
+      attach: vi.fn(),
+      detach: vi.fn(),
+      kill: vi.fn(),
+      get: vi.fn(),
+      list: vi.fn(() => []),
+      updateTitle: vi.fn(),
+    } as unknown as TerminalManager;
+
+    const gateway = createBrowserGateway(
+      createMemorySessionManager(),
+      createMemoryEventStore(() => false),
+      makeStubPiGateway(),
+      undefined,
+      undefined,
+      makeStubOrderManager(),
+      undefined,
+      undefined,
+      throwingTerminalManager,
+    );
+
+    const ws = makeFakeWs();
+    gateway.wss.emit("connection", ws, {});
+
+    ws.emit(
+      "message",
+      Buffer.from(JSON.stringify({ type: "create_terminal", cwd: "/tmp" })),
+    );
+    // Allow any microtasks to settle.
+    await new Promise((r) => setImmediate(r));
+
+    const handlerErrorCall = errorSpy.mock.calls.find(
+      (args: unknown[]) =>
+        typeof args[0] === "string" &&
+        args[0].includes("[browser-gw] handler error") &&
+        args[0].includes("type=create_terminal"),
+    );
+    expect(handlerErrorCall, "expected a [browser-gw] handler error log line").toBeTruthy();
+    expect(throwingTerminalManager.spawn).toHaveBeenCalledOnce();
+  });
+
+  it("silently drops malformed JSON frames (no handler-error log)", async () => {
+    const gateway = createBrowserGateway(
+      createMemorySessionManager(),
+      createMemoryEventStore(() => false),
+      makeStubPiGateway(),
+    );
+
+    const ws = makeFakeWs();
+    gateway.wss.emit("connection", ws, {});
+
+    ws.emit("message", Buffer.from("{not json"));
+    await new Promise((r) => setImmediate(r));
+
+    const handlerErrorCall = errorSpy.mock.calls.find(
+      (args: unknown[]) =>
+        typeof args[0] === "string" && args[0].includes("[browser-gw] handler error"),
+    );
+    expect(handlerErrorCall).toBeUndefined();
+  });
+});

package/packages/server/src/__tests__/cli-parse.test.ts

@@ -31,6 +31,17 @@ describe("parseArgs", () => {
     expect(result.subcommand).toBe("status");
   });
 
+  it("parses upgrade-pi subcommand (unified-bootstrap-install §8)", () => {
+    const result = parseArgs(["upgrade-pi"]);
+    expect(result.subcommand).toBe("upgrade-pi");
+  });
+
+  it("parses upgrade-pi with --port flag", () => {
+    const result = parseArgs(["upgrade-pi", "--port", "9090"]);
+    expect(result.subcommand).toBe("upgrade-pi");
+    expect(result.flags.port).toBe(9090);
+  });
+
   it("parses subcommand with flags", () => {
     const result = parseArgs(["start", "--port", "3000", "--pi-port", "4000"]);
     expect(result.subcommand).toBe("start");

package/packages/server/src/__tests__/concurrent-launch.test.ts

@@ -0,0 +1,110 @@
+/**
+ * Integration test — concurrent launches.
+ *
+ * Simulates two dashboard startups racing for the same per-HOME lock.
+ * Asserts that exactly one wins (`acquired`) and the other falls back
+ * cleanly (`attach` OR `InstanceLockMismatchError`, depending on liveness
+ * of the winner's probe).
+ *
+ * Uses real tmp dirs (not memfs) because proper-lockfile requires real
+ * filesystem semantics.
+ *
+ * See change: single-dashboard-per-home, task 12.1.
+ */
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { acquireOrAttach, InstanceLockMismatchError } from "../home-lock.js";
+
+let tmpHome: string;
+let lockPath: string;
+let metaPath: string;
+
+beforeEach(() => {
+  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "pi-concurrent-"));
+  lockPath = path.join(tmpHome, ".pi", "dashboard", "server.lock");
+  metaPath = `${lockPath}.meta.json`;
+});
+
+afterEach(() => {
+  try { fs.rmSync(tmpHome, { recursive: true, force: true }); } catch { /* ignore */ }
+});
+
+describe("concurrent launch", () => {
+  it("exactly one of two parallel acquireOrAttach calls wins the lock", async () => {
+    // Both attempts race. Whichever wins first gets `acquired`. The loser
+    // sees ELOCKED; because our probe says the winner is "not alive" (we
+    // intentionally return dead to avoid racing the probe), the loser
+    // steals the stale lock and also acquires. That's not right for
+    // same-HOME same-instant races — we need the loser to SEE the winner.
+    //
+    // To mimic reality: make isProcessAlive true (process IS alive) and
+    // have the probe treat the metadata's identity as authoritative.
+    const hookFactory = () => ({
+      lockPath, metaPath, staleMs: 5_000,
+      isProcessAlive: () => true,
+      probeHealth: async () => {
+        // Read the live metadata file and echo back its identity — this
+        // models a working /api/health from the winner.
+        try {
+          const raw = fs.readFileSync(metaPath, "utf-8");
+          const m = JSON.parse(raw) as { identity?: string; pid?: number };
+          if (m && typeof m.identity === "string") {
+            return { running: true, identity: m.identity, pid: m.pid };
+          }
+        } catch { /* metadata not yet written */ }
+        return { running: true, pid: process.pid };
+      },
+    });
+
+    const cfg = (id: string) => ({
+      httpPort: 8000, piPort: 9999, version: "t",
+      identity: id,
+      hooks: hookFactory(),
+    });
+
+    const [a, b] = await Promise.allSettled([
+      acquireOrAttach(cfg("racer-A")),
+      acquireOrAttach(cfg("racer-B")),
+    ]);
+
+    // Count outcomes.
+    const outcomes = [a, b].map(r => {
+      if (r.status === "rejected") return "error";
+      return r.value.mode;
+    });
+
+    // Exactly one winner, and the loser is either "attach" or "error"
+    // (identity mismatch if the winner's identity appears in metadata
+    // before the loser reads it).
+    const winners = outcomes.filter(o => o === "acquired");
+    expect(winners).toHaveLength(1);
+
+    const losers = outcomes.filter(o => o !== "acquired");
+    expect(losers).toHaveLength(1);
+    expect(["attach", "error"]).toContain(losers[0]);
+
+    // Cleanup: release whichever won.
+    for (const r of [a, b]) {
+      if (r.status === "fulfilled" && r.value.mode === "acquired") {
+        await r.value.release();
+      }
+    }
+  });
+
+  it("the winning identity is persisted to metadata", async () => {
+    const first = await acquireOrAttach({
+      httpPort: 8000, piPort: 9999, version: "t",
+      identity: "winner",
+      hooks: { lockPath, metaPath, staleMs: 5_000 },
+    });
+    expect(first.mode).toBe("acquired");
+
+    const raw = fs.readFileSync(metaPath, "utf-8");
+    const meta = JSON.parse(raw) as { identity: string };
+    expect(meta.identity).toBe("winner");
+
+    if (first.mode === "acquired") await first.release();
+  });
+});

package/packages/server/src/__tests__/config-api.test.ts

@@ -100,5 +100,73 @@ describe("config-api", () => {
       // providers preserved
       expect(written.auth.providers.github.clientId).toBe("x");
     });
+
+    // ── fix-trusted-networks-no-oauth regression tests ─────────────────
+    // These assert that auth.bypassHosts and auth.bypassUrls are persisted
+    // through PUT /api/config. Before the fix, the auth-merge block only
+    // copied secret / providers / allowedUsers, silently dropping bypass*
+    // on every save.
+
+    it("should persist auth.bypassHosts with no pre-existing auth (task 1.5)", () => {
+      fs.writeFileSync(configFile, JSON.stringify({ port: 8000 }));
+      const result = writeConfigPartial({
+        auth: { providers: {}, bypassHosts: ["192.168.1.0/24"] },
+      });
+      expect(result.success).toBe(true);
+      const written = JSON.parse(fs.readFileSync(configFile, "utf-8"));
+      expect(written.auth.bypassHosts).toEqual(["192.168.1.0/24"]);
+    });
+
+    it("should persist auth.bypassHosts alongside existing providers (task 1.6)", () => {
+      fs.writeFileSync(configFile, JSON.stringify({
+        auth: {
+          secret: "s",
+          providers: { github: { clientId: "abc", clientSecret: "xyz" } },
+        },
+      }));
+      const result = writeConfigPartial({
+        auth: { bypassHosts: ["10.0.0.0/8"] },
+      });
+      expect(result.success).toBe(true);
+      const written = JSON.parse(fs.readFileSync(configFile, "utf-8"));
+      expect(written.auth.providers.github.clientId).toBe("abc");
+      expect(written.auth.providers.github.clientSecret).toBe("xyz");
+      expect(written.auth.bypassHosts).toEqual(["10.0.0.0/8"]);
+    });
+
+    it("should clear auth.bypassHosts via empty array (task 1.7)", () => {
+      fs.writeFileSync(configFile, JSON.stringify({
+        auth: { providers: {}, bypassHosts: ["192.168.1.0/24"] },
+      }));
+      const result = writeConfigPartial({
+        auth: { bypassHosts: [] },
+      });
+      expect(result.success).toBe(true);
+      const written = JSON.parse(fs.readFileSync(configFile, "utf-8"));
+      expect(written.auth.bypassHosts).toEqual([]);
+    });
+
+    it("should preserve existing auth.bypassHosts when partial omits the key (task 1.8)", () => {
+      fs.writeFileSync(configFile, JSON.stringify({
+        auth: { providers: {}, bypassHosts: ["192.168.1.0/24"] },
+      }));
+      const result = writeConfigPartial({
+        auth: { allowedUsers: ["alice"] },
+      });
+      expect(result.success).toBe(true);
+      const written = JSON.parse(fs.readFileSync(configFile, "utf-8"));
+      expect(written.auth.bypassHosts).toEqual(["192.168.1.0/24"]);
+      expect(written.auth.allowedUsers).toEqual(["alice"]);
+    });
+
+    it("should persist auth.bypassUrls symmetrically (task 1.9)", () => {
+      fs.writeFileSync(configFile, JSON.stringify({ port: 8000 }));
+      const result = writeConfigPartial({
+        auth: { providers: {}, bypassUrls: ["/webhooks/", "/metrics"] },
+      });
+      expect(result.success).toBe(true);
+      const written = JSON.parse(fs.readFileSync(configFile, "utf-8"));
+      expect(written.auth.bypassUrls).toEqual(["/webhooks/", "/metrics"]);
+    });
   });
 });