@blackbelt-technology/pi-agent-dashboard 0.2.9 → 0.4.0

package/packages/server/src/__tests__/health-endpoint.test.ts

@@ -2,28 +2,26 @@
  * Tests for GET /api/health endpoint.
  */
 import { describe, it, expect, afterEach } from "vitest";
-import { createServer, type DashboardServer } from "../server.js";
+import { createTestServer, type TestServerHandle } from "../test-support/test-server.js";
+import type { DashboardServer } from "../server.js";
 
-const httpPort = 19090;
-const piPort = 19091;
-let server: DashboardServer;
+let handle: TestServerHandle | undefined;
+let server: DashboardServer | undefined;
 
 describe("GET /api/health", () => {
   afterEach(async () => {
-    if (server) {
-      try { await server.stop(); } catch { /* already stopped */ }
+    if (handle) {
+      try { await handle.stop(); } catch { /* already stopped */ }
+      handle = undefined;
+      server = undefined;
     }
   });
 
   it("should return ok, pid, and uptime", async () => {
-    server = await createServer({
-      port: httpPort, piPort, dev: true,
-      autoShutdown: false, shutdownIdleSeconds: 999, tunnel: false,
-    editor: { idleTimeoutMinutes: 10, maxInstances: 3 },
-    });
-    await server.start();
+    handle = await createTestServer();
+    server = handle.server;
 
-    const res = await fetch(`http://localhost:${httpPort}/api/health`);
+    const res = await fetch(`http://localhost:${handle.httpPort}/api/health`);
     expect(res.status).toBe(200);
 
     const body = await res.json();

package/packages/server/src/__tests__/home-lock-escape-hatch.test.ts

@@ -0,0 +1,60 @@
+/**
+ * Tests for the PI_DASHBOARD_ALLOW_MULTIPLE escape hatch.
+ *
+ * The escape hatch is evaluated in `cli.ts::runForeground`; here we test
+ * the pure predicate `isLockDisabled` plus a behavioral test that confirms
+ * NO metadata is written when the lock is skipped.
+ *
+ * See change: single-dashboard-per-home, task 14.3.
+ */
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { isLockDisabled, acquireOrAttach } from "../home-lock.js";
+
+let tmpHome: string;
+let lockPath: string;
+let metaPath: string;
+
+beforeEach(() => {
+  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "pi-escape-hatch-"));
+  lockPath = path.join(tmpHome, ".pi", "dashboard", "server.lock");
+  metaPath = `${lockPath}.meta.json`;
+});
+
+afterEach(() => {
+  try { fs.rmSync(tmpHome, { recursive: true, force: true }); } catch { /* ignore */ }
+});
+
+describe("escape hatch", () => {
+  it("isLockDisabled true for =1 and =true", () => {
+    expect(isLockDisabled({ PI_DASHBOARD_ALLOW_MULTIPLE: "1" })).toBe(true);
+    expect(isLockDisabled({ PI_DASHBOARD_ALLOW_MULTIPLE: "true" })).toBe(true);
+  });
+
+  it("isLockDisabled false when unset or other values", () => {
+    expect(isLockDisabled({})).toBe(false);
+    expect(isLockDisabled({ PI_DASHBOARD_ALLOW_MULTIPLE: "" })).toBe(false);
+    expect(isLockDisabled({ PI_DASHBOARD_ALLOW_MULTIPLE: "yes" })).toBe(false);
+    expect(isLockDisabled({ PI_DASHBOARD_ALLOW_MULTIPLE: "0" })).toBe(false);
+  });
+
+  it("when caller skips acquireOrAttach (escape hatch on), no metadata sidecar exists", () => {
+    // The CLI-level behavior when PI_DASHBOARD_ALLOW_MULTIPLE is set is to
+    // NOT call acquireOrAttach at all. We simulate that: the fact that we
+    // never called acquireOrAttach means the sidecar was never written.
+    expect(fs.existsSync(metaPath)).toBe(false);
+  });
+
+  it("when lock IS acquired, metadata is written (control)", async () => {
+    const r = await acquireOrAttach({
+      httpPort: 8000, piPort: 9999, version: "t",
+      hooks: { lockPath, metaPath, staleMs: 500 },
+    });
+    expect(r.mode).toBe("acquired");
+    expect(fs.existsSync(metaPath)).toBe(true);
+    if (r.mode === "acquired") await r.release();
+    expect(fs.existsSync(metaPath)).toBe(false);
+  });
+});

package/packages/server/src/__tests__/home-lock-release.test.ts

@@ -0,0 +1,85 @@
+/**
+ * Unit tests for signal-handler installation. See change: single-dashboard-per-home.
+ */
+import { describe, it, expect, vi } from "vitest";
+import { EventEmitter } from "node:events";
+import { installReleaseHandlers } from "../home-lock-release.js";
+
+function fakeProcess() {
+  const ee = new EventEmitter() as unknown as NodeJS.Process;
+  (ee as unknown as { exit: (code: number) => void }).exit = vi.fn();
+  return ee;
+}
+
+describe("installReleaseHandlers", () => {
+  it("registers SIGINT, SIGTERM, SIGHUP, SIGBREAK, and exit handlers", () => {
+    const proc = fakeProcess();
+    const onSpy = vi.spyOn(proc, "on");
+    installReleaseHandlers(async () => {}, { proc });
+    const registered = onSpy.mock.calls.map(c => c[0]);
+    expect(registered).toEqual(expect.arrayContaining(["SIGINT", "SIGTERM", "SIGHUP", "SIGBREAK", "exit"]));
+  });
+
+  it("calls release() on SIGTERM", async () => {
+    const proc = fakeProcess();
+    const release = vi.fn(async () => {});
+    installReleaseHandlers(release, { proc });
+    proc.emit("SIGTERM");
+    // Handler is async — let microtasks flush.
+    await new Promise(r => setImmediate(r));
+    expect(release).toHaveBeenCalledTimes(1);
+  });
+
+  it("calls release() on SIGBREAK (Windows Ctrl+Break)", async () => {
+    // On POSIX Node never emits SIGBREAK, but the handler must still be
+    // wired so Windows Ctrl+Break triggers lock release. Exercising via a
+    // fake process guarantees the registration + dispatch path works.
+    const proc = fakeProcess();
+    const release = vi.fn(async () => {});
+    installReleaseHandlers(release, { proc });
+    proc.emit("SIGBREAK" as NodeJS.Signals);
+    await new Promise(r => setImmediate(r));
+    expect(release).toHaveBeenCalledTimes(1);
+  });
+
+  it("calls release() on SIGHUP", async () => {
+    const proc = fakeProcess();
+    const release = vi.fn(async () => {});
+    installReleaseHandlers(release, { proc });
+    proc.emit("SIGHUP");
+    await new Promise(r => setImmediate(r));
+    expect(release).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not double-release on repeated signals", async () => {
+    const proc = fakeProcess();
+    const release = vi.fn(async () => {});
+    installReleaseHandlers(release, { proc });
+    proc.emit("SIGTERM");
+    proc.emit("SIGTERM");
+    proc.emit("SIGINT");
+    await new Promise(r => setImmediate(r));
+    expect(release).toHaveBeenCalledTimes(1);
+  });
+
+  it("returns a dispose function that removes handlers", () => {
+    const proc = fakeProcess();
+    const release = vi.fn(async () => {});
+    const dispose = installReleaseHandlers(release, { proc });
+    dispose();
+    proc.emit("SIGTERM");
+    // After dispose, the release must not fire.
+    expect(release).not.toHaveBeenCalled();
+  });
+
+  it("swallows release errors but logs them", async () => {
+    const proc = fakeProcess();
+    const logs: string[] = [];
+    const release = vi.fn(async () => { throw new Error("boom"); });
+    installReleaseHandlers(release, { proc, log: (m) => logs.push(m) });
+    proc.emit("SIGTERM");
+    await new Promise(r => setImmediate(r));
+    await new Promise(r => setImmediate(r));
+    expect(logs.join("\n")).toContain("boom");
+  });
+});

package/packages/server/src/__tests__/home-lock.test.ts

@@ -0,0 +1,308 @@
+/**
+ * Unit tests for the per-HOME advisory lock.
+ * See change: single-dashboard-per-home.
+ */
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {
+  canonicalHomedir,
+  getLockPath,
+  getMetaPath,
+  readMetadata,
+  writeMetadataAtomic,
+  removeMetadata,
+  acquireOrAttach,
+  isLockHolderResponsive,
+  isLockDisabled,
+  InstanceLockMismatchError,
+  type LockMetadata,
+} from "../home-lock.js";
+
+// Fresh tmp dir per test → real FS (proper-lockfile needs real FS semantics).
+let tmpHome: string;
+let lockPath: string;
+let metaPath: string;
+
+beforeEach(() => {
+  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "pi-home-lock-test-"));
+  lockPath = path.join(tmpHome, ".pi", "dashboard", "server.lock");
+  metaPath = `${lockPath}.meta.json`;
+});
+
+afterEach(() => {
+  try {
+    fs.rmSync(tmpHome, { recursive: true, force: true });
+  } catch {
+    /* ignore */
+  }
+});
+
+function baseConfig(overrides: Partial<Parameters<typeof acquireOrAttach>[0]> = {}) {
+  return {
+    httpPort: 8000,
+    piPort: 9999,
+    version: "0.0.0-test",
+    hooks: {
+      lockPath,
+      metaPath,
+      staleMs: 500,
+      probeHealth: async () => ({ running: false }),
+      isProcessAlive: () => false,
+      ...(overrides.hooks ?? {}),
+    },
+    ...overrides,
+  };
+}
+
+describe("canonicalHomedir + paths", () => {
+  it("returns a path containing .pi/dashboard/server.lock", () => {
+    const p = getLockPath();
+    expect(p.endsWith(path.join(".pi", "dashboard", "server.lock"))).toBe(true);
+  });
+
+  it("getMetaPath appends .meta.json", () => {
+    expect(getMetaPath("/x/y/server.lock")).toBe("/x/y/server.lock.meta.json");
+  });
+
+  it("canonicalHomedir survives even when homedir is unreadable (tolerant)", () => {
+    expect(typeof canonicalHomedir()).toBe("string");
+  });
+
+  it("ignores $HOME env override — lock path always derives from os.homedir()", () => {
+    // The design (§4) explicitly states $HOME must NOT influence the lock
+    // path: Git Bash sets $HOME=/c/Users/R while os.homedir()=C:\Users\R,
+    // which would otherwise produce two divergent canonical locks. Here we
+    // prove the invariant by construction: mutate process.env.HOME and
+    // verify getLockPath() doesn't change.
+    const original = process.env.HOME;
+    const before = getLockPath();
+    try {
+      process.env.HOME = "/garbage/not/a/real/path/" + Math.random();
+      const after = getLockPath();
+      expect(after).toBe(before);
+    } finally {
+      if (original === undefined) delete process.env.HOME;
+      else process.env.HOME = original;
+    }
+  });
+
+  it("symlinked homedir canonicalizes to the same lock path on repeated calls", () => {
+    const real = fs.mkdtempSync(path.join(os.tmpdir(), "pi-real-"));
+    const link = path.join(os.tmpdir(), `pi-link-${Date.now()}-${Math.random()}`);
+    fs.symlinkSync(real, link);
+    try {
+      const a = fs.realpathSync(link);
+      const b = fs.realpathSync(link);
+      expect(a).toBe(b);
+      expect(a).toBe(fs.realpathSync(real));
+    } finally {
+      try { fs.unlinkSync(link); } catch { /* ignore */ }
+      fs.rmSync(real, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("writeMetadataAtomic + readMetadata", () => {
+  it("round-trips a metadata object", () => {
+    const meta: LockMetadata = {
+      pid: 1, ppid: 0, httpPort: 8000, piPort: 9999,
+      startedAt: 1, identity: "i", version: "v", url: "http://localhost:8000", hostname: "h",
+    };
+    writeMetadataAtomic(meta, metaPath);
+    expect(readMetadata(metaPath)).toEqual(meta);
+  });
+
+  it("readMetadata returns null when file is missing", () => {
+    expect(readMetadata(metaPath)).toBeNull();
+  });
+
+  it("readMetadata returns null when JSON is corrupt", () => {
+    fs.mkdirSync(path.dirname(metaPath), { recursive: true });
+    fs.writeFileSync(metaPath, "{not json");
+    expect(readMetadata(metaPath)).toBeNull();
+  });
+
+  it("readMetadata returns null for shape-mismatched JSON", () => {
+    fs.mkdirSync(path.dirname(metaPath), { recursive: true });
+    fs.writeFileSync(metaPath, JSON.stringify({ foo: "bar" }));
+    expect(readMetadata(metaPath)).toBeNull();
+  });
+
+  it("removeMetadata is silent on missing file", () => {
+    expect(() => removeMetadata(metaPath)).not.toThrow();
+  });
+});
+
+describe("isLockHolderResponsive", () => {
+  const meta: LockMetadata = {
+    pid: 12345, ppid: 0, httpPort: 8000, piPort: 9999,
+    startedAt: 0, identity: "id-A", version: "v", url: "http://localhost:8000", hostname: "h",
+  };
+
+  it("returns 'dead' when PID is gone", async () => {
+    const result = await isLockHolderResponsive(meta, { isProcessAlive: () => false });
+    expect(result).toBe("dead");
+  });
+
+  it("returns 'dead' when port is not responding", async () => {
+    const result = await isLockHolderResponsive(meta, {
+      isProcessAlive: () => true,
+      probeHealth: async () => ({ running: false }),
+    });
+    expect(result).toBe("dead");
+  });
+
+  it("returns 'alive-match' when identity matches", async () => {
+    const result = await isLockHolderResponsive(meta, {
+      isProcessAlive: () => true,
+      probeHealth: async () => ({ running: true, identity: "id-A", pid: 12345 }),
+    });
+    expect(result).toBe("alive-match");
+  });
+
+  it("returns 'alive-mismatch' when identity differs", async () => {
+    const result = await isLockHolderResponsive(meta, {
+      isProcessAlive: () => true,
+      probeHealth: async () => ({ running: true, identity: "id-B", pid: 99999 }),
+    });
+    expect(result).toBe("alive-mismatch");
+  });
+
+  it("falls back to PID match when identity missing", async () => {
+    const matchByPid = await isLockHolderResponsive(meta, {
+      isProcessAlive: () => true,
+      probeHealth: async () => ({ running: true, pid: 12345 }),
+    });
+    expect(matchByPid).toBe("alive-match");
+
+    const misMatchByPid = await isLockHolderResponsive(meta, {
+      isProcessAlive: () => true,
+      probeHealth: async () => ({ running: true, pid: 99999 }),
+    });
+    expect(misMatchByPid).toBe("alive-mismatch");
+  });
+});
+
+describe("acquireOrAttach", () => {
+  it("acquires a fresh lock and writes metadata", async () => {
+    const result = await acquireOrAttach(baseConfig());
+    expect(result.mode).toBe("acquired");
+    const meta = readMetadata(metaPath);
+    expect(meta).not.toBeNull();
+    expect(meta?.pid).toBe(process.pid);
+    expect(meta?.httpPort).toBe(8000);
+    if (result.mode === "acquired") await result.release();
+  });
+
+  it("release() removes the metadata sidecar", async () => {
+    const result = await acquireOrAttach(baseConfig());
+    expect(result.mode).toBe("acquired");
+    if (result.mode === "acquired") {
+      await result.release();
+      expect(readMetadata(metaPath)).toBeNull();
+    }
+  });
+
+  it("release() is idempotent", async () => {
+    const result = await acquireOrAttach(baseConfig());
+    if (result.mode === "acquired") {
+      await result.release();
+      await expect(result.release()).resolves.toBeUndefined();
+    }
+  });
+
+  it("attaches when a live dashboard already holds the lock", async () => {
+    // Acquire as "another process" first.
+    const first = await acquireOrAttach(baseConfig({
+      identity: "first-instance",
+    }));
+    expect(first.mode).toBe("acquired");
+
+    // Now mount a probe that says the first is alive + matches.
+    const second = await acquireOrAttach(baseConfig({
+      hooks: {
+        lockPath, metaPath, staleMs: 500,
+        isProcessAlive: () => true,
+        probeHealth: async () => ({ running: true, identity: "first-instance", pid: process.pid }),
+      },
+    }));
+    expect(second.mode).toBe("attach");
+    if (second.mode === "attach") {
+      expect(second.meta.identity).toBe("first-instance");
+    }
+    if (first.mode === "acquired") await first.release();
+  });
+
+  it("throws InstanceLockMismatchError on identity mismatch", async () => {
+    const first = await acquireOrAttach(baseConfig({ identity: "mine" }));
+    expect(first.mode).toBe("acquired");
+
+    await expect(
+      acquireOrAttach(baseConfig({
+        hooks: {
+          lockPath, metaPath, staleMs: 500,
+          isProcessAlive: () => true,
+          probeHealth: async () => ({ running: true, identity: "someone-else", pid: 99999 }),
+        },
+      })),
+    ).rejects.toBeInstanceOf(InstanceLockMismatchError);
+
+    if (first.mode === "acquired") await first.release();
+  });
+
+  it("steals a stale lock (process dead)", async () => {
+    const first = await acquireOrAttach(baseConfig({ identity: "stale-holder" }));
+    expect(first.mode).toBe("acquired");
+    // Don't release — simulate a crash. Then attempt to reacquire with
+    // isProcessAlive=false → steal path.
+
+    // proper-lockfile's `stale` option needs the staleMs to have elapsed.
+    // We pass a 1ms stale threshold in baseConfig via the hooks override.
+    await new Promise(r => setTimeout(r, 50));
+    const second = await acquireOrAttach(baseConfig({
+      hooks: {
+        lockPath, metaPath, staleMs: 1,
+        isProcessAlive: () => false,
+        probeHealth: async () => ({ running: false }),
+      },
+    }));
+    expect(second.mode).toBe("acquired");
+    if (second.mode === "acquired") await second.release();
+  });
+
+  it("steals lock when metadata is corrupt", async () => {
+    const first = await acquireOrAttach(baseConfig());
+    expect(first.mode).toBe("acquired");
+    // Corrupt metadata but leave proper-lockfile in place.
+    fs.writeFileSync(metaPath, "{not json");
+    await new Promise(r => setTimeout(r, 50));
+
+    const second = await acquireOrAttach(baseConfig({
+      hooks: {
+        lockPath, metaPath, staleMs: 1,
+        isProcessAlive: () => false,
+        probeHealth: async () => ({ running: false }),
+      },
+    }));
+    expect(second.mode).toBe("acquired");
+    if (second.mode === "acquired") await second.release();
+  });
+});
+
+describe("isLockDisabled", () => {
+  it("returns true for PI_DASHBOARD_ALLOW_MULTIPLE=1", () => {
+    expect(isLockDisabled({ PI_DASHBOARD_ALLOW_MULTIPLE: "1" })).toBe(true);
+  });
+  it("returns true for PI_DASHBOARD_ALLOW_MULTIPLE=true", () => {
+    expect(isLockDisabled({ PI_DASHBOARD_ALLOW_MULTIPLE: "true" })).toBe(true);
+  });
+  it("returns false when unset", () => {
+    expect(isLockDisabled({})).toBe(false);
+  });
+  it("returns false for other values", () => {
+    expect(isLockDisabled({ PI_DASHBOARD_ALLOW_MULTIPLE: "0" })).toBe(false);
+    expect(isLockDisabled({ PI_DASHBOARD_ALLOW_MULTIPLE: "yes" })).toBe(false);
+  });
+});

package/packages/server/src/__tests__/is-pi-process.test.ts

@@ -0,0 +1,36 @@
+/**
+ * Tests for isPiCommandLine (pure predicate used by isPiProcess).
+ * See change: fix-windows-server-parity.
+ */
+import { describe, it, expect } from "vitest";
+import { isPiCommandLine } from "../browser-handlers/session-action-handler.js";
+
+describe("isPiCommandLine", () => {
+  it("matches a typical pi cli invocation", () => {
+    expect(isPiCommandLine("/usr/bin/node /usr/local/lib/node_modules/@mariozechner/pi-coding-agent/dist/cli.js")).toBe(true);
+  });
+
+  it("matches when only 'pi' appears as a word", () => {
+    expect(isPiCommandLine("pi --mode rpc")).toBe(true);
+    expect(isPiCommandLine("/opt/pi/bin/pi")).toBe(true);
+  });
+
+  it("matches when only 'node' appears as a word", () => {
+    expect(isPiCommandLine("node server.js")).toBe(true);
+    expect(isPiCommandLine("/usr/bin/node --import tsx /app.ts")).toBe(true);
+  });
+
+  it("does not match unrelated commands", () => {
+    expect(isPiCommandLine("/bin/bash -c sleep 10")).toBe(false);
+    expect(isPiCommandLine("python3 script.py")).toBe(false);
+    expect(isPiCommandLine("")).toBe(false);
+  });
+
+  it("does not match substrings of other words", () => {
+    // \b word-boundary: 'api', 'epic', 'snode' must NOT match 'pi'/'node'
+    expect(isPiCommandLine("api-server --port 8000")).toBe(false);
+    expect(isPiCommandLine("epic-game.exe")).toBe(false);
+    // 'snode' is actually a whole word containing "node" at the end; \bnode\b requires word boundary
+    expect(isPiCommandLine("running snode-worker")).toBe(false);
+  });
+});

package/packages/server/src/__tests__/node-guard.test.ts

@@ -0,0 +1,85 @@
+import { describe, expect, it } from "vitest";
+import { buildNodeUpgradeMessage, isAffectedNode } from "../node-guard.js";
+
+describe("isAffectedNode", () => {
+  it("returns true for v22.0.0 (lower bound of 22.x affected)", () => {
+    expect(isAffectedNode("v22.0.0")).toBe(true);
+  });
+
+  it("returns true for v22.17.999 (upper bound of 22.x affected)", () => {
+    expect(isAffectedNode("v22.17.999")).toBe(true);
+  });
+
+  it("returns false for v22.18.0 (first 22.x fixed)", () => {
+    expect(isAffectedNode("v22.18.0")).toBe(false);
+  });
+
+  it("returns false for v22.22.2 (current LTS)", () => {
+    expect(isAffectedNode("v22.22.2")).toBe(false);
+  });
+
+  it("returns true for v24.1.0 (lower bound of 24.x affected)", () => {
+    expect(isAffectedNode("v24.1.0")).toBe(true);
+  });
+
+  it("returns true for v24.2.999 (upper bound of 24.x affected)", () => {
+    expect(isAffectedNode("v24.2.999")).toBe(true);
+  });
+
+  it("returns false for v24.3.0 (first 24.x fixed)", () => {
+    expect(isAffectedNode("v24.3.0")).toBe(false);
+  });
+
+  it("returns false for v24.0.0 (below affected range)", () => {
+    expect(isAffectedNode("v24.0.0")).toBe(false);
+  });
+
+  it("returns false for v25.0.0 (entire 25.x unaffected)", () => {
+    expect(isAffectedNode("v25.0.0")).toBe(false);
+  });
+
+  it("returns false for v20.x (pre-bug range)", () => {
+    expect(isAffectedNode("v20.15.0")).toBe(false);
+  });
+
+  it("returns false for v23.x (odd releases all unaffected)", () => {
+    expect(isAffectedNode("v23.5.0")).toBe(false);
+  });
+
+  it("accepts versions without the v prefix", () => {
+    expect(isAffectedNode("22.17.0")).toBe(true);
+    expect(isAffectedNode("22.18.0")).toBe(false);
+  });
+
+  it("returns false for malformed input rather than throwing", () => {
+    expect(isAffectedNode("")).toBe(false);
+    expect(isAffectedNode("not-a-version")).toBe(false);
+    expect(isAffectedNode("v22")).toBe(false);
+    expect(isAffectedNode("22.17")).toBe(false);
+  });
+});
+
+describe("buildNodeUpgradeMessage", () => {
+  it("interpolates the running version into the message", () => {
+    const msg = buildNodeUpgradeMessage("v22.17.1");
+    expect(msg).toContain("v22.17.1");
+  });
+
+  it("includes the upstream Node issue link", () => {
+    const msg = buildNodeUpgradeMessage("v22.17.1");
+    expect(msg).toContain("https://github.com/nodejs/node/issues/58515");
+  });
+
+  it("names the minimum acceptable versions", () => {
+    const msg = buildNodeUpgradeMessage("v22.17.1");
+    expect(msg).toMatch(/22\.18/);
+    expect(msg).toMatch(/24\.3/);
+  });
+
+  it("suggests nvm, brew, and Windows installer paths", () => {
+    const msg = buildNodeUpgradeMessage("v22.17.1");
+    expect(msg).toMatch(/nvm/);
+    expect(msg).toMatch(/brew/);
+    expect(msg).toMatch(/nodejs\.org/);
+  });
+});