@blackbelt-technology/pi-agent-dashboard 0.2.9 → 0.4.0

package/packages/server/src/__tests__/provider-test-route.test.ts

@@ -0,0 +1,149 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import Fastify from "fastify";
+import { registerProviderRoutes } from "../routes/provider-routes.js";
+
+// Pass-through network guard — we're testing the endpoint contract, not auth
+const allowGuard = async () => {};
+
+function makeApp() {
+  const app = Fastify();
+  registerProviderRoutes(app, { networkGuard: allowGuard as any });
+  return app;
+}
+
+describe("POST /api/providers/test", () => {
+  let originalFetch: typeof globalThis.fetch;
+  beforeEach(() => {
+    originalFetch = globalThis.fetch;
+  });
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+  });
+
+  function mockFetch(impl: (url: string, init: RequestInit) => Promise<Response>) {
+    globalThis.fetch = vi.fn(impl) as any;
+  }
+
+  it("400 when body is invalid", async () => {
+    const app = makeApp();
+    await app.ready();
+    const res = await app.inject({
+      method: "POST",
+      url: "/api/providers/test",
+      payload: "not-json",
+      headers: { "content-type": "application/json" },
+    });
+    expect(res.statusCode).toBe(400);
+    await app.close();
+  });
+
+  it("400 when baseUrl missing", async () => {
+    const app = makeApp();
+    await app.ready();
+    const res = await app.inject({
+      method: "POST",
+      url: "/api/providers/test",
+      payload: { apiKey: "sk-abc", api: "openai-completions" },
+    });
+    expect(res.statusCode).toBe(400);
+    const body = JSON.parse(res.payload);
+    expect(body.error).toMatch(/baseUrl/);
+    await app.close();
+  });
+
+  it("400 when api missing", async () => {
+    const app = makeApp();
+    await app.ready();
+    const res = await app.inject({
+      method: "POST",
+      url: "/api/providers/test",
+      payload: { baseUrl: "https://x", apiKey: "sk" },
+    });
+    expect(res.statusCode).toBe(400);
+    await app.close();
+  });
+
+  it("happy path: probe returns ok with modelCount", async () => {
+    mockFetch(async () =>
+      new Response(JSON.stringify({ data: [{ id: "m1" }, { id: "m2" }] }), { status: 200 }),
+    );
+    const app = makeApp();
+    await app.ready();
+    const res = await app.inject({
+      method: "POST",
+      url: "/api/providers/test",
+      payload: {
+        baseUrl: "https://api.example.com/v1",
+        apiKey: "sk-abc",
+        api: "openai-completions",
+      },
+    });
+    expect(res.statusCode).toBe(200);
+    const body = JSON.parse(res.payload);
+    expect(body.ok).toBe(true);
+    expect(body.modelCount).toBe(2);
+    expect(body.sample).toEqual(["m1", "m2"]);
+    await app.close();
+  });
+
+  it("401 upstream: returns ok=false with status", async () => {
+    mockFetch(async () => new Response("bad key", { status: 401 }));
+    const app = makeApp();
+    await app.ready();
+    const res = await app.inject({
+      method: "POST",
+      url: "/api/providers/test",
+      payload: {
+        baseUrl: "https://api.example.com/v1",
+        apiKey: "sk-bad",
+        api: "openai-completions",
+      },
+    });
+    // Our endpoint always returns 200 with the structured result
+    expect(res.statusCode).toBe(200);
+    const body = JSON.parse(res.payload);
+    expect(body.ok).toBe(false);
+    expect(body.status).toBe(401);
+    await app.close();
+  });
+
+  it("missing $ENV_VAR: returns ok=false without hitting upstream", async () => {
+    delete process.env.PROBE_ROUTE_MISSING;
+    const fetchSpy = vi.fn(async () => new Response("{}", { status: 200 }));
+    globalThis.fetch = fetchSpy as any;
+    const app = makeApp();
+    await app.ready();
+    const res = await app.inject({
+      method: "POST",
+      url: "/api/providers/test",
+      payload: {
+        baseUrl: "https://x",
+        apiKey: "$PROBE_ROUTE_MISSING",
+        api: "openai-completions",
+      },
+    });
+    expect(res.statusCode).toBe(200);
+    const body = JSON.parse(res.payload);
+    expect(body.ok).toBe(false);
+    expect(body.error).toMatch(/PROBE_ROUTE_MISSING/);
+    expect(fetchSpy).not.toHaveBeenCalled();
+    await app.close();
+  });
+
+  it("response never echoes the apiKey", async () => {
+    mockFetch(async () => new Response("bad key xyz-secret-abc", { status: 401 }));
+    const app = makeApp();
+    await app.ready();
+    const res = await app.inject({
+      method: "POST",
+      url: "/api/providers/test",
+      payload: {
+        baseUrl: "https://api.example.com/v1",
+        apiKey: "xyz-secret-abc",
+        api: "openai-completions",
+      },
+    });
+    expect(res.payload).not.toContain("xyz-secret-abc");
+    await app.close();
+  });
+});

package/packages/server/src/__tests__/recommended-routes.test.ts

@@ -0,0 +1,389 @@
+/**
+ * Tests for the GET /api/packages/recommended route and its helpers.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import Fastify, { type FastifyInstance } from "fastify";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// Mock pi dependency (pulled transitively by package-manager-wrapper)
+vi.mock("@mariozechner/pi-coding-agent", () => ({
+	DefaultPackageManager: function () {
+		return {};
+	},
+	SettingsManager: { create: () => ({}) },
+}));
+
+// Mock the npm-search-proxy so we can assert enrichment + failure paths.
+vi.mock("../npm-search-proxy.js", () => ({
+	fetchPackageMeta: vi.fn(),
+	fetchGithubPackageJson: vi.fn(),
+}));
+
+import { fetchPackageMeta, fetchGithubPackageJson } from "../npm-search-proxy.js";
+import {
+	registerRecommendedRoutes,
+	invalidateRecommendedCache,
+	parseSourceKey,
+	sourcesMatch,
+} from "../routes/recommended-routes.js";
+
+function makeWrapper(installed: {
+	global?: Array<{ source: string; installedPath?: string }>;
+	local?: Array<{ source: string; installedPath?: string }>;
+}): any {
+	return {
+		listInstalled: vi.fn(async (scope: string) =>
+			scope === "global" ? installed.global ?? [] : installed.local ?? [],
+		),
+	};
+}
+
+describe("parseSourceKey", () => {
+	it("parses npm: sources", () => {
+		expect(parseSourceKey("npm:pi-web-access")).toEqual({
+			kind: "npm",
+			name: "pi-web-access",
+		});
+	});
+
+	it("parses scoped npm: sources", () => {
+		expect(parseSourceKey("npm:@tintinweb/pi-subagents")).toEqual({
+			kind: "npm",
+			name: "@tintinweb/pi-subagents",
+		});
+	});
+
+	it("strips version from npm: sources", () => {
+		expect(parseSourceKey("npm:pi-web-access@1.2.3")).toEqual({
+			kind: "npm",
+			name: "pi-web-access",
+		});
+		expect(parseSourceKey("npm:@scope/pkg@1.0.0")).toEqual({
+			kind: "npm",
+			name: "@scope/pkg",
+		});
+	});
+
+	it("parses git@ SSH URLs", () => {
+		expect(parseSourceKey("git@github.com:BlackBeltTechnology/pi-flows.git")).toEqual({
+			kind: "git",
+			host: "github.com",
+			owner: "BlackBeltTechnology",
+			repo: "pi-flows",
+		});
+	});
+
+	it("parses https git URLs", () => {
+		expect(
+			parseSourceKey("https://github.com/BlackBeltTechnology/pi-flows.git"),
+		).toEqual({
+			kind: "git",
+			host: "github.com",
+			owner: "BlackBeltTechnology",
+			repo: "pi-flows",
+		});
+	});
+
+	it("falls back to raw for unknown forms", () => {
+		expect(parseSourceKey("/local/path")).toEqual({
+			kind: "raw",
+			source: "/local/path",
+		});
+	});
+});
+
+describe("sourcesMatch", () => {
+	it("matches npm sources with and without version", () => {
+		expect(sourcesMatch("npm:pi-web-access", "npm:pi-web-access@1.0.0")).toBe(true);
+	});
+
+	it("matches git SSH and HTTPS forms of the same repo", () => {
+		expect(
+			sourcesMatch(
+				"git@github.com:BlackBeltTechnology/pi-flows.git",
+				"https://github.com/BlackBeltTechnology/pi-flows.git",
+			),
+		).toBe(true);
+	});
+
+	it("is case-insensitive on the git host/owner/repo", () => {
+		expect(
+			sourcesMatch(
+				"git@github.com:BlackBeltTechnology/pi-flows.git",
+				"git@github.com:blackbelttechnology/pi-flows.git",
+			),
+		).toBe(true);
+	});
+
+	it("distinguishes different repos", () => {
+		expect(
+			sourcesMatch(
+				"git@github.com:BlackBeltTechnology/pi-flows.git",
+				"git@github.com:BlackBeltTechnology/pi-anthropic-messages.git",
+			),
+		).toBe(false);
+	});
+
+	it("matches a git URL against a local path whose basename equals the repo name", () => {
+		expect(
+			sourcesMatch(
+				"git@github.com:BlackBeltTechnology/pi-flows.git",
+				"../pi-flows",
+			),
+		).toBe(true);
+		expect(
+			sourcesMatch(
+				"../pi-anthropic-messages",
+				"git@github.com:BlackBeltTechnology/pi-anthropic-messages.git",
+			),
+		).toBe(true);
+		expect(
+			sourcesMatch(
+				"git@github.com:BlackBeltTechnology/pi-flows.git",
+				"/home/user/src/pi-flows/",
+			),
+		).toBe(true);
+	});
+
+	it("does not cross-match a git URL against an unrelated local path", () => {
+		expect(
+			sourcesMatch(
+				"git@github.com:BlackBeltTechnology/pi-flows.git",
+				"../pi-web-access",
+			),
+		).toBe(false);
+	});
+});
+
+describe("GET /api/packages/recommended", () => {
+	let fastify: FastifyInstance;
+	let tmpHome: string;
+	let origCwd: string;
+
+	beforeEach(() => {
+		invalidateRecommendedCache();
+		vi.mocked(fetchPackageMeta).mockReset();
+		vi.mocked(fetchGithubPackageJson).mockReset();
+
+		tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "pi-rec-"));
+		process.env.HOME = tmpHome;
+
+		// chdir to a clean subdirectory so the route's CWD-based local
+		// settings read doesn't pick up the host repo's .pi/settings.json.
+		origCwd = process.cwd();
+		const scratchCwd = path.join(tmpHome, "scratch");
+		fs.mkdirSync(scratchCwd, { recursive: true });
+		process.chdir(scratchCwd);
+	});
+
+	afterEach(async () => {
+		if (fastify) await fastify.close();
+		process.chdir(origCwd);
+		if (fs.existsSync(tmpHome)) fs.rmSync(tmpHome, { recursive: true, force: true });
+	});
+
+	async function setupRoute(installed: {
+		global?: Array<{ source: string; installedPath?: string }>;
+		local?: Array<{ source: string; installedPath?: string }>;
+	} = {}): Promise<FastifyInstance> {
+		fastify = Fastify();
+		const wrapper = makeWrapper(installed);
+		registerRecommendedRoutes(fastify, { packageManagerWrapper: wrapper });
+		await fastify.ready();
+		return fastify;
+	}
+
+	it("returns the 5 manifest entries with default (offline) descriptions", async () => {
+		vi.mocked(fetchPackageMeta).mockResolvedValue(null);
+		vi.mocked(fetchGithubPackageJson).mockResolvedValue(null);
+		await setupRoute();
+
+		const res = await fastify.inject({
+			method: "GET",
+			url: "/api/packages/recommended",
+		});
+		expect(res.statusCode).toBe(200);
+		const body = JSON.parse(res.payload);
+		expect(body.success).toBe(true);
+		const entries = body.data.recommended;
+		expect(entries).toHaveLength(5);
+		// Every entry falls back to fallbackDescription and has no version.
+		for (const e of entries) {
+			expect(typeof e.description).toBe("string");
+			expect(e.description.length).toBeGreaterThan(10);
+			expect(e.version).toBeUndefined();
+			expect(e.installed.scope).toBeNull();
+			expect(e.activeInPi).toBe(false);
+			expect(e.updateAvailable).toBe(false);
+		}
+	});
+
+	it("uses npm metadata when registry is reachable", async () => {
+		vi.mocked(fetchPackageMeta).mockImplementation(async (name: string) => {
+			if (name === "pi-web-access") {
+				return { description: "LIVE npm desc", version: "9.9.9" };
+			}
+			return null;
+		});
+		vi.mocked(fetchGithubPackageJson).mockResolvedValue(null);
+		await setupRoute();
+
+		const res = await fastify.inject({ method: "GET", url: "/api/packages/recommended" });
+		const body = JSON.parse(res.payload);
+		const pwa = body.data.recommended.find((e: any) => e.id === "pi-web-access");
+		expect(pwa.description).toBe("LIVE npm desc");
+		expect(pwa.version).toBe("9.9.9");
+	});
+
+	it("uses GitHub metadata for git-sourced entries", async () => {
+		vi.mocked(fetchPackageMeta).mockResolvedValue(null);
+		vi.mocked(fetchGithubPackageJson).mockImplementation(async (owner, repo) => {
+			if (owner === "BlackBeltTechnology" && repo === "pi-flows") {
+				return { description: "LIVE github desc", version: "0.1.0" };
+			}
+			return null;
+		});
+		await setupRoute();
+
+		const res = await fastify.inject({ method: "GET", url: "/api/packages/recommended" });
+		const body = JSON.parse(res.payload);
+		const flows = body.data.recommended.find((e: any) => e.id === "pi-flows");
+		expect(flows.description).toBe("LIVE github desc");
+		expect(flows.version).toBe("0.1.0");
+	});
+
+	it("reports installed + activeInPi correctly when settings.json lists the source", async () => {
+		vi.mocked(fetchPackageMeta).mockResolvedValue(null);
+		vi.mocked(fetchGithubPackageJson).mockResolvedValue(null);
+
+		// Write settings.json with pi-web-access as an active package
+		const settingsDir = path.join(tmpHome, ".pi", "agent");
+		fs.mkdirSync(settingsDir, { recursive: true });
+		fs.writeFileSync(
+			path.join(settingsDir, "settings.json"),
+			JSON.stringify({ packages: ["npm:pi-web-access"] }),
+		);
+
+		await setupRoute({
+			global: [{ source: "npm:pi-web-access", installedPath: "/fake" }],
+		});
+
+		const res = await fastify.inject({ method: "GET", url: "/api/packages/recommended" });
+		const body = JSON.parse(res.payload);
+		const pwa = body.data.recommended.find((e: any) => e.id === "pi-web-access");
+		expect(pwa.installed.scope).toBe("global");
+		expect(pwa.activeInPi).toBe(true);
+
+		// Entries not in settings.json remain inactive
+		const browser = body.data.recommended.find((e: any) => e.id === "pi-agent-browser");
+		expect(browser.installed.scope).toBeNull();
+		expect(browser.activeInPi).toBe(false);
+	});
+
+	it("matches git SSH source against git HTTPS active source", async () => {
+		vi.mocked(fetchPackageMeta).mockResolvedValue(null);
+		vi.mocked(fetchGithubPackageJson).mockResolvedValue(null);
+
+		const settingsDir = path.join(tmpHome, ".pi", "agent");
+		fs.mkdirSync(settingsDir, { recursive: true });
+		// User wrote HTTPS in settings; manifest has SSH. They should match.
+		fs.writeFileSync(
+			path.join(settingsDir, "settings.json"),
+			JSON.stringify({
+				packages: ["https://github.com/BlackBeltTechnology/pi-flows.git"],
+			}),
+		);
+
+		await setupRoute();
+		const res = await fastify.inject({ method: "GET", url: "/api/packages/recommended" });
+		const body = JSON.parse(res.payload);
+		const flows = body.data.recommended.find((e: any) => e.id === "pi-flows");
+		expect(flows.activeInPi).toBe(true);
+	});
+
+	it("matches git manifest source against a local-path active source (basename heuristic)", async () => {
+		vi.mocked(fetchPackageMeta).mockResolvedValue(null);
+		vi.mocked(fetchGithubPackageJson).mockResolvedValue(null);
+
+		// User has pi-flows checked out locally and registered via `pi install -l`
+		// which records the local path in .pi/settings.json. The manifest has the
+		// git SSH URL. The two should still match via basename.
+		const projectDir = path.join(tmpHome, "workspace");
+		fs.mkdirSync(path.join(projectDir, ".pi"), { recursive: true });
+		fs.writeFileSync(
+			path.join(projectDir, ".pi", "settings.json"),
+			JSON.stringify({ packages: ["../pi-flows", "../pi-anthropic-messages"] }),
+		);
+
+		const origCwd = process.cwd();
+		process.chdir(projectDir);
+		try {
+			await setupRoute();
+			const res = await fastify.inject({ method: "GET", url: "/api/packages/recommended" });
+			const body = JSON.parse(res.payload);
+			const flows = body.data.recommended.find((e: any) => e.id === "pi-flows");
+			const msg = body.data.recommended.find(
+				(e: any) => e.id === "pi-anthropic-messages",
+			);
+			expect(flows.activeInPi).toBe(true);
+			expect(msg.activeInPi).toBe(true);
+		} finally {
+			process.chdir(origCwd);
+		}
+	});
+
+	it("considers project-local .pi/settings.json for activeInPi", async () => {
+		vi.mocked(fetchPackageMeta).mockResolvedValue(null);
+		vi.mocked(fetchGithubPackageJson).mockResolvedValue(null);
+
+		const projectDir = path.join(tmpHome, "workspace");
+		fs.mkdirSync(path.join(projectDir, ".pi"), { recursive: true });
+		fs.writeFileSync(
+			path.join(projectDir, ".pi", "settings.json"),
+			JSON.stringify({ packages: ["npm:pi-web-access"] }),
+		);
+
+		const origCwd = process.cwd();
+		process.chdir(projectDir);
+		try {
+			await setupRoute();
+			const res = await fastify.inject({ method: "GET", url: "/api/packages/recommended" });
+			const body = JSON.parse(res.payload);
+			const pwa = body.data.recommended.find((e: any) => e.id === "pi-web-access");
+			expect(pwa.activeInPi).toBe(true);
+		} finally {
+			process.chdir(origCwd);
+		}
+	});
+
+	it("serves cached data on the second call within 60s", async () => {
+		vi.mocked(fetchPackageMeta).mockResolvedValue({
+			description: "cached",
+			version: "1.0.0",
+		});
+		vi.mocked(fetchGithubPackageJson).mockResolvedValue(null);
+		await setupRoute();
+
+		await fastify.inject({ method: "GET", url: "/api/packages/recommended" });
+		const callsAfterFirst = vi.mocked(fetchPackageMeta).mock.calls.length;
+		await fastify.inject({ method: "GET", url: "/api/packages/recommended" });
+		expect(vi.mocked(fetchPackageMeta).mock.calls.length).toBe(callsAfterFirst);
+	});
+
+	it("refetches after invalidateRecommendedCache()", async () => {
+		vi.mocked(fetchPackageMeta).mockResolvedValue({
+			description: "refresh",
+			version: "1.0.0",
+		});
+		vi.mocked(fetchGithubPackageJson).mockResolvedValue(null);
+		await setupRoute();
+
+		await fastify.inject({ method: "GET", url: "/api/packages/recommended" });
+		const before = vi.mocked(fetchPackageMeta).mock.calls.length;
+		invalidateRecommendedCache();
+		await fastify.inject({ method: "GET", url: "/api/packages/recommended" });
+		expect(vi.mocked(fetchPackageMeta).mock.calls.length).toBeGreaterThan(before);
+	});
+});

package/packages/server/src/__tests__/restart-helper.test.ts

@@ -0,0 +1,83 @@
+/**
+ * Tests for the cross-platform restart orchestrator.
+ * See change: fix-windows-server-parity.
+ */
+import { describe, it, expect } from "vitest";
+import { buildOrchestratorScript } from "../restart-helper.js";
+
+describe("buildOrchestratorScript", () => {
+  const baseParams = {
+    cliPath: "/tmp/cli.ts",
+    loader: "file:///tmp/jiti-register.mjs",
+    port: 8000,
+    extraArgs: [] as string[],
+    execPath: "/usr/bin/node",
+  };
+
+  it("produces a self-contained Node script (no shell/lsof/curl)", () => {
+    const script = buildOrchestratorScript(baseParams);
+    expect(script).not.toMatch(/\blsof\b/);
+    expect(script).not.toMatch(/\bcurl\b/);
+    expect(script).not.toMatch(/\bsh\s+-c\b/);
+    // Uses Node built-ins
+    expect(script).toMatch(/require\("node:net"\)/);
+    expect(script).toMatch(/require\("node:http"\)/);
+    expect(script).toMatch(/require\("node:child_process"\)/);
+  });
+
+  it("embeds the port as a number literal", () => {
+    const script = buildOrchestratorScript({ ...baseParams, port: 12345 });
+    expect(script).toMatch(/const PORT = 12345/);
+  });
+
+  it("embeds the loader as a --import arg when provided", () => {
+    const script = buildOrchestratorScript(baseParams);
+    // ARGS should be a JSON array containing --import and the loader
+    expect(script).toMatch(/const ARGS = \[.*"--import".*"file:\/\/\/tmp\/jiti-register\.mjs"/);
+    expect(script).toMatch(/"\/tmp\/cli\.ts"/);
+    expect(script).toMatch(/"start"/);
+  });
+
+  it("omits --import when loader is empty", () => {
+    const script = buildOrchestratorScript({ ...baseParams, loader: "" });
+    expect(script).not.toMatch(/"--import"/);
+    expect(script).toMatch(/"\/tmp\/cli\.ts"/);
+    expect(script).toMatch(/"start"/);
+  });
+
+  it("appends extra args (e.g. --dev) after 'start'", () => {
+    const script = buildOrchestratorScript({ ...baseParams, extraArgs: ["--dev"] });
+    // ARGS array should have "start" immediately followed by "--dev"
+    expect(script).toMatch(/"start","--dev"/);
+  });
+
+  it("safely embeds Windows paths with backslashes and drive letters", () => {
+    const winParams = {
+      ...baseParams,
+      cliPath: "B:\\Dev\\BB\\pi-agent-dashboard\\packages\\server\\src\\cli.ts",
+      loader: "file:///B:/Dev/Nodejs/global/node_modules/@mariozechner/jiti/lib/jiti-register.mjs",
+      execPath: "C:\\Program Files\\nodejs\\node.exe",
+    };
+    const script = buildOrchestratorScript(winParams);
+    // Must be embedded via JSON.stringify (backslashes escaped, quotes preserved)
+    expect(script).toContain(JSON.stringify(winParams.execPath));
+    expect(script).toContain(JSON.stringify(winParams.cliPath));
+    expect(script).toContain(JSON.stringify(winParams.loader));
+    // Should not contain raw unescaped backslashes that would break the JS
+    // (we embed via JSON.stringify which escapes them to \\)
+    expect(script).toMatch(/B:\\\\Dev\\\\BB/);
+  });
+
+  it("references ~/.pi/dashboard/restart.log for failure logging", () => {
+    const script = buildOrchestratorScript(baseParams);
+    expect(script).toMatch(/restart\.log/);
+    expect(script).toMatch(/fs\.appendFileSync/);
+  });
+
+  it("health-check target is /api/health on the configured port", () => {
+    const script = buildOrchestratorScript({ ...baseParams, port: 8765 });
+    expect(script).toMatch(/\/api\/health/);
+    expect(script).toMatch(/const PORT = 8765/);
+    expect(script).toMatch(/port: PORT/);
+  });
+});