@blackbelt-technology/pi-agent-dashboard 0.5.2 → 0.5.4

package/packages/shared/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blackbelt-technology/pi-dashboard-shared",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "Shared types and utilities for pi-dashboard",
   "type": "module",
   "repository": {

package/packages/shared/src/__tests__/binary-lookup-resolveJiti.test.ts

@@ -33,6 +33,11 @@ describe("MANAGED_PI_PACKAGES + JITI_PACKAGES contract", () => {
 
   it("upstream jiti first, legacy fork fallback", () => {
     expect(JITI_PACKAGES).toEqual(["jiti", "@mariozechner/jiti"]);
+    // Primary lookup MUST be bare "jiti" — that's what `packages/server/
+    // package.json#dependencies.jiti` resolves on a clean npm install.
+    // Regression for v0.5.3 fork-name drift; see change:
+    // enable-standalone-npm-install task 7.3.
+    expect(JITI_PACKAGES[0]).toBe("jiti");
   });
 });
 
@@ -181,6 +186,29 @@ describe("ToolResolver.resolveJiti — anchor walk-up + argv fallback", () => {
     expect(url).not.toBeNull();
   });
 
+  it("resolves jiti shipped as a direct dep of pi-dashboard-server (own-tree, no pi anywhere)", () => {
+    // Simulates the npm-install path post enable-standalone-npm-install:
+    // - no managed pi at ~/.pi-dashboard/
+    // - no system pi on PATH
+    // - no caller-supplied anchor
+    // - jiti lives in pi-dashboard-server's own node_modules, reachable
+    //   via createRequire(argv[1]) walk-up
+    const argv = "/usr/local/lib/node_modules/@blackbelt-technology/pi-dashboard-server/bin/pi-dashboard.mjs";
+    const jitiPkgJson = "/usr/local/lib/node_modules/@blackbelt-technology/pi-dashboard-server/node_modules/jiti/package.json";
+    const url = new ToolResolver().resolveJiti({
+      _managedDir: MANAGED_DIR,
+      // Managed pi pkg.json + legacy variant miss; only the jiti register exists.
+      _pathExists: (p) => p === path.join(path.dirname(jitiPkgJson), "lib", "jiti-register.mjs"),
+      _whichPi: () => null,
+      _realpath: (p) => p,
+      _argv1: argv,
+      resolver: makeResolver({ "jiti/package.json": jitiPkgJson }),
+    });
+    expect(url).not.toBeNull();
+    expect(url!.startsWith("file://")).toBe(true);
+    expect(url!).toMatch(/\/jiti\/lib\/jiti-register\.mjs$/);
+  });
+
   it("returns null when every anchor misses", () => {
     const url = new ToolResolver().resolveJiti({
       _managedDir: MANAGED_DIR,

package/packages/shared/src/__tests__/binary-lookup-spawn-env.test.ts

@@ -0,0 +1,61 @@
+/**
+ * Integration tests: ToolResolver.buildSpawnEnv applies
+ * ensureWindowsSystemPath on Windows and is a no-op on POSIX.
+ *
+ * See change: fix-windows-path-system32-missing.
+ */
+import { describe, it, expect, vi } from "vitest";
+
+// Mock node:fs.existsSync to allow injecting an `exists` impl via opts;
+// binary-lookup itself uses `existsSync` for other resolution code that
+// we don't exercise here.
+vi.mock("node:fs", () => ({ existsSync: () => false, realpathSync: (p: string) => p }));
+
+import { ToolResolver } from "../platform/binary-lookup.js";
+
+describe("ToolResolver.buildSpawnEnv with platform override", () => {
+  it("on win32: adds System32 to PATH even when inherited PATH is empty", () => {
+    const resolver = new ToolResolver({});
+    const env = resolver.buildSpawnEnv(
+      { PATH: "", SYSTEMROOT: "C:\\Windows" },
+      { platform: "win32", exists: () => true },
+    );
+    expect(env.PATH).toContain("C:\\Windows\\System32");
+    expect(env.PATH).toContain("C:\\Windows\\System32\\WindowsPowerShell\\v1.0");
+  });
+
+  it("on win32: does not duplicate System32 when already present", () => {
+    const resolver = new ToolResolver({});
+    const env = resolver.buildSpawnEnv(
+      { PATH: "C:\\Windows\\System32;C:\\other", SYSTEMROOT: "C:\\Windows" },
+      { platform: "win32", exists: () => true },
+    );
+    // Count substring occurrences (case-insensitive). buildSpawnEnv may
+    // splice POSIX `:` delimiters on a darwin host into the prepended
+    // segment, so splitting by `;` is unreliable; substring count is the
+    // right invariant for de-dup.
+    const lower = (env.PATH ?? "").toLowerCase();
+    const re = /c:\\windows\\system32(?![\\\w])/g;
+    const matches = lower.match(re) ?? [];
+    expect(matches.length).toBe(1);
+  });
+
+  it("on linux: does not inject Windows paths", () => {
+    const resolver = new ToolResolver({});
+    const env = resolver.buildSpawnEnv(
+      { PATH: "/usr/bin" },
+      { platform: "linux", exists: () => true },
+    );
+    expect(env.PATH).not.toContain("System32");
+    expect(env.PATH).not.toContain("C:\\Windows");
+  });
+
+  it("on darwin: does not inject Windows paths", () => {
+    const resolver = new ToolResolver({});
+    const env = resolver.buildSpawnEnv(
+      { PATH: "/usr/local/bin:/usr/bin" },
+      { platform: "darwin", exists: () => true },
+    );
+    expect(env.PATH).not.toContain("System32");
+  });
+});

package/packages/shared/src/__tests__/binary-lookup.test.ts

@@ -180,5 +180,21 @@ describe("ToolResolver", () => {
       expect(env.PATH).toContain("/extra/one");
       expect(env.PATH).toContain("/extra/two");
     });
+
+    it("strips ELECTRON_RUN_AS_NODE and other Electron vars from the spawn env", () => {
+      const resolver = new ToolResolver();
+      const env = resolver.buildSpawnEnv({
+        PATH: "/usr/bin",
+        ELECTRON_RUN_AS_NODE: "1",
+        ELECTRON_DEFAULT_ERROR_MODE: "1",
+        ELECTRON_ENABLE_STACK_DUMPING: "1",
+        MY_APP_VAR: "hello",
+      });
+      expect(env.ELECTRON_RUN_AS_NODE).toBeUndefined();
+      expect(env.ELECTRON_DEFAULT_ERROR_MODE).toBeUndefined();
+      expect(env.ELECTRON_ENABLE_STACK_DUMPING).toBeUndefined();
+      // Non-Electron vars preserved
+      expect(env.MY_APP_VAR).toBe("hello");
+    });
   });
 });

package/packages/shared/src/__tests__/bridge-register.test.ts

@@ -181,5 +181,72 @@ describe("shared bridge-register", () => {
       const settings = readSettings();
       expect(settings.packages).toContain("/app/extension");
     });
+
+    it("identity-dedups across install layouts (same package.json#name wins last)", () => {
+      // Three install layouts, all registering the same extension package
+      // name under different absolute paths: dev workspace, .app bundle,
+      // npm-global. After all three register, only the most recent path
+      // should remain.
+      const devPath = path.join(tmpDir, "dev", "ext");
+      const appPath = path.join(tmpDir, "app", "ext");
+      const globalPath = path.join(tmpDir, "global", "ext");
+      for (const p of [devPath, appPath, globalPath]) {
+        fs.mkdirSync(p, { recursive: true });
+        fs.writeFileSync(
+          path.join(p, "package.json"),
+          '{"name":"@blackbelt-technology/pi-dashboard-extension"}',
+        );
+      }
+
+      registerBridgeExtension(devPath);
+      registerBridgeExtension(appPath);
+      registerBridgeExtension(globalPath);
+
+      const settings = readSettings();
+      const packages = settings.packages as string[];
+      expect(packages).toEqual([globalPath]);
+    });
+
+    it("preserves entries with different package names", () => {
+      const otherExt = path.join(tmpDir, "other", "ext");
+      fs.mkdirSync(otherExt, { recursive: true });
+      fs.writeFileSync(
+        path.join(otherExt, "package.json"),
+        '{"name":"some-unrelated-extension"}',
+      );
+
+      const dashExt = path.join(tmpDir, "dash", "ext");
+      fs.mkdirSync(dashExt, { recursive: true });
+      fs.writeFileSync(
+        path.join(dashExt, "package.json"),
+        '{"name":"@blackbelt-technology/pi-dashboard-extension"}',
+      );
+
+      writeSettings({ packages: [otherExt] });
+      registerBridgeExtension(dashExt);
+
+      const settings = readSettings();
+      const packages = settings.packages as string[];
+      expect(packages).toContain(otherExt);
+      expect(packages).toContain(dashExt);
+    });
+
+    it("leaves npm:-scheme entries untouched during identity dedup", () => {
+      const npmEntry = "npm:@blackbelt-technology/pi-dashboard-extension";
+      const localExt = path.join(tmpDir, "local", "ext");
+      fs.mkdirSync(localExt, { recursive: true });
+      fs.writeFileSync(
+        path.join(localExt, "package.json"),
+        '{"name":"@blackbelt-technology/pi-dashboard-extension"}',
+      );
+
+      writeSettings({ packages: [npmEntry] });
+      registerBridgeExtension(localExt);
+
+      const settings = readSettings();
+      const packages = settings.packages as string[];
+      expect(packages).toContain(npmEntry);
+      expect(packages).toContain(localExt);
+    });
   });
 });

package/packages/shared/src/__tests__/ci-electron-no-side-effects.test.ts

@@ -0,0 +1,129 @@
+/**
+ * Repo-level invariant: the on-demand Electron CI workflow and its reusable
+ * build workflow MUST NOT publish to npm, create a GitHub Release, push
+ * tags, or otherwise affect the public update channel of installed users.
+ *
+ * The CI dev build's version slug (`<base>-ci.<stamp>.<branch>.<sha7>`) is
+ * a SemVer prerelease ranked strictly below the base stable version, so
+ * `electron-updater` with default `allowPrerelease: false` would not offer
+ * it as an update. Defense-in-depth: this lint enforces that the workflows
+ * themselves contain no publishing or release-creating actions, even by
+ * accident in a future PR.
+ *
+ * If this test fails, remove the offending action from the workflow. If
+ * you genuinely need to publish from CI, do it in publish.yml (which is
+ * gated on a tag push or explicit dispatch with a version input).
+ *
+ * See change: add-ci-electron-on-demand-build (proposal.md Safety section,
+ * design.md Decision 4).
+ */
+import { describe, it } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+import url from "node:url";
+
+const __dirname = path.dirname(url.fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(__dirname, "..", "..", "..", "..");
+const CI_ELECTRON_PATH = path.join(REPO_ROOT, ".github", "workflows", "ci-electron.yml");
+const REUSABLE_PATH = path.join(REPO_ROOT, ".github", "workflows", "_electron-build.yml");
+
+// Patterns whose presence indicates a side-effect we forbid in these
+// workflows. The reusable workflow is the SHARED build definition, so a
+// publishing action there would silently leak into the release flow too —
+// but we want it kept clean for clarity and to keep the no-side-effects
+// invariant easy to reason about.
+const FORBIDDEN_PATTERNS: Array<{ pattern: RegExp; reason: string }> = [
+  {
+    pattern: /softprops\/action-gh-release/,
+    reason: "creates GitHub Releases — must only happen in publish.yml",
+  },
+  {
+    pattern: /actions\/create-release/,
+    reason: "creates GitHub Releases — must only happen in publish.yml",
+  },
+  {
+    pattern: /\bnpm\s+publish\b/,
+    reason: "publishes to npm — must only happen in publish.yml's publish job",
+  },
+  {
+    pattern: /\bgit\s+push\s+origin\s+v\d/,
+    reason: "pushes a version tag — must only happen in publish.yml's prepare job",
+  },
+  {
+    pattern: /\bgit\s+tag\s+["']?v\d/,
+    reason: "creates a version tag — must only happen in publish.yml's prepare job",
+  },
+];
+
+/**
+ * Strip YAML full-line comments before scanning. Comments are legitimately
+ * allowed to discuss what's forbidden ("No `npm publish`") without being
+ * the forbidden thing itself. We strip lines whose first non-whitespace
+ * char is `#`. Inline trailing comments are preserved (rare in this codebase
+ * and risky to strip because of `run: |` shell blocks where `#` is a real
+ * shell comment leader).
+ */
+function stripYamlComments(content: string): string {
+  return content
+    .split("\n")
+    .filter((line) => !/^\s*#/.test(line))
+    .join("\n");
+}
+
+function assertNoForbidden(filePath: string, content: string): void {
+  const stripped = stripYamlComments(content);
+  for (const { pattern, reason } of FORBIDDEN_PATTERNS) {
+    const m = stripped.match(pattern);
+    if (m) {
+      throw new Error(
+        `${path.basename(filePath)} contains forbidden pattern ${pattern} ` +
+          `(${reason}). Matched: ${JSON.stringify(m[0])}. ` +
+          `See change: add-ci-electron-on-demand-build (design.md Decision 4).`,
+      );
+    }
+  }
+}
+
+describe("ci-electron.yml — no side effects on registries or update channels", () => {
+  it("ci-electron.yml contains no forbidden publishing/release actions", () => {
+    const content = fs.readFileSync(CI_ELECTRON_PATH, "utf8");
+    assertNoForbidden(CI_ELECTRON_PATH, content);
+  });
+
+  it("_electron-build.yml (shared) contains no forbidden publishing/release actions", () => {
+    // The reusable workflow is consumed by BOTH publish.yml (release flow)
+    // AND ci-electron.yml (on-demand). Keeping it free of publishing actions
+    // means publishing stays cleanly in publish.yml's own jobs, never
+    // accidentally inherited by the on-demand path.
+    const content = fs.readFileSync(REUSABLE_PATH, "utf8");
+    assertNoForbidden(REUSABLE_PATH, content);
+  });
+
+  it("ci-electron.yml only fires on workflow_dispatch (no push/pr/schedule)", () => {
+    const content = fs.readFileSync(CI_ELECTRON_PATH, "utf8");
+    // Match the top-level `on:` block — must contain `workflow_dispatch:`
+    // and MUST NOT contain `push:`, `pull_request:`, or `schedule:`.
+    const onMatch = content.match(/^on:\s*\n((?:\s+\S.*\n)+?)(?=^\S|\n^[a-z])/m);
+    if (!onMatch) {
+      throw new Error("ci-electron.yml has no top-level `on:` block");
+    }
+    const onBlock = onMatch[1];
+    if (!/workflow_dispatch:/.test(onBlock)) {
+      throw new Error(
+        "ci-electron.yml MUST trigger on workflow_dispatch only. Found `on:` block:\n" +
+          onBlock,
+      );
+    }
+    for (const trigger of ["push:", "pull_request:", "schedule:", "release:"]) {
+      if (new RegExp(`^\\s+${trigger}`, "m").test(onBlock)) {
+        throw new Error(
+          `ci-electron.yml MUST NOT trigger on '${trigger}'. v1 is dispatch-only ` +
+            "to keep the no-side-effects invariant easy to reason about. " +
+            "If a different trigger is genuinely needed, update the spec first. " +
+            "See change: add-ci-electron-on-demand-build.\nFound `on:` block:\n" +
+            onBlock,
+        );
+      }
+    }
+  });
+});

package/packages/shared/src/__tests__/config.test.ts

@@ -519,3 +519,43 @@ describe("loadConfig spawnRegisterTimeoutMs", () => {
     expect(loadConfig().spawnRegisterTimeoutMs).toBe(30000);
   });
 });
+
+// See change: add-dynamic-pwa-manifest-naming.
+describe("dashboardName", () => {
+  let testDir: string;
+  let configFile: string;
+  let origHome: string;
+
+  beforeEach(() => {
+    testDir = path.join(os.tmpdir(), `test-config-${Date.now()}`);
+    fs.mkdirSync(path.join(testDir, ".pi", "dashboard"), { recursive: true });
+    configFile = path.join(testDir, ".pi", "dashboard", "config.json");
+    origHome = process.env.HOME!;
+    process.env.HOME = testDir;
+  });
+
+  afterEach(() => {
+    process.env.HOME = origHome;
+    if (fs.existsSync(testDir)) fs.rmSync(testDir, { recursive: true });
+  });
+
+  it("is undefined when absent from config", () => {
+    fs.writeFileSync(configFile, JSON.stringify({}));
+    expect(loadConfig().dashboardName).toBeUndefined();
+  });
+
+  it("round-trips a non-empty string", () => {
+    fs.writeFileSync(configFile, JSON.stringify({ dashboardName: "Home NAS" }));
+    expect(loadConfig().dashboardName).toBe("Home NAS");
+  });
+
+  it("is undefined for whitespace-only override", () => {
+    fs.writeFileSync(configFile, JSON.stringify({ dashboardName: "   " }));
+    expect(loadConfig().dashboardName).toBeUndefined();
+  });
+
+  it("is undefined for non-string override", () => {
+    fs.writeFileSync(configFile, JSON.stringify({ dashboardName: 42 }));
+    expect(loadConfig().dashboardName).toBeUndefined();
+  });
+});

package/packages/shared/src/__tests__/dashboard-paths.test.ts

@@ -0,0 +1,81 @@
+/**
+ * Unit tests for `dashboard-paths.ts` helpers.
+ *
+ * Pins each getter accepts a `{ homedir }` override and falls back to
+ * `os.homedir()` when none is provided. Asserts that the live server
+ * log path and the legacy installer log path resolve to *distinct*
+ * files even though both end in `server.log`.
+ *
+ * See change: harvest-bootstrap-survivor-fixes (cherry-pick 1).
+ */
+import os from "node:os";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import {
+  getDashboardConfigDir,
+  getDashboardServerLogPath,
+  getInstallerLogPath,
+  getManagedDir,
+} from "../dashboard-paths.js";
+
+describe("dashboard-paths getters", () => {
+  describe("getDashboardConfigDir", () => {
+    it("no-arg resolves to ~/.pi/dashboard", () => {
+      expect(getDashboardConfigDir()).toBe(path.join(os.homedir(), ".pi", "dashboard"));
+    });
+    it("honours { homedir } override", () => {
+      expect(getDashboardConfigDir({ homedir: "/fake/home" })).toBe(
+        path.join("/fake/home", ".pi", "dashboard"),
+      );
+    });
+  });
+
+  describe("getDashboardServerLogPath", () => {
+    it("no-arg resolves to ~/.pi/dashboard/server.log", () => {
+      expect(getDashboardServerLogPath()).toBe(
+        path.join(os.homedir(), ".pi", "dashboard", "server.log"),
+      );
+    });
+    it("honours { homedir } override", () => {
+      expect(getDashboardServerLogPath({ homedir: "/fake/home" })).toBe(
+        path.join("/fake/home", ".pi", "dashboard", "server.log"),
+      );
+    });
+  });
+
+  describe("getManagedDir (re-export)", () => {
+    it("no-arg resolves to ~/.pi-dashboard", () => {
+      expect(getManagedDir()).toBe(path.join(os.homedir(), ".pi-dashboard"));
+    });
+    it("honours { homedir } override", () => {
+      expect(getManagedDir({ homedir: "/fake/home" })).toBe(
+        path.join("/fake/home", ".pi-dashboard"),
+      );
+    });
+  });
+
+  describe("getInstallerLogPath", () => {
+    it("no-arg resolves to ~/.pi-dashboard/server.log", () => {
+      expect(getInstallerLogPath()).toBe(
+        path.join(os.homedir(), ".pi-dashboard", "server.log"),
+      );
+    });
+    it("honours { homedir } override", () => {
+      expect(getInstallerLogPath({ homedir: "/fake/home" })).toBe(
+        path.join("/fake/home", ".pi-dashboard", "server.log"),
+      );
+    });
+  });
+
+  describe("live server log vs installer log are distinct", () => {
+    it("the two log paths must never collide for the same homedir", () => {
+      const serverLog = getDashboardServerLogPath({ homedir: "/fake/home" });
+      const installerLog = getInstallerLogPath({ homedir: "/fake/home" });
+      expect(serverLog).not.toBe(installerLog);
+      // Different parent dirs even though both basename to server.log
+      expect(path.basename(serverLog)).toBe("server.log");
+      expect(path.basename(installerLog)).toBe("server.log");
+      expect(path.dirname(serverLog)).not.toBe(path.dirname(installerLog));
+    });
+  });
+});

package/packages/shared/src/__tests__/ensure-windows-path.test.ts

@@ -0,0 +1,112 @@
+/**
+ * Unit tests for ensureWindowsSystemPath.
+ *
+ * See change: fix-windows-path-system32-missing.
+ */
+import { describe, it, expect } from "vitest";
+import { ensureWindowsSystemPath } from "../platform/ensure-windows-path.js";
+
+const WIN_ENV_BASE = {
+  SYSTEMROOT: "C:\\Windows",
+  LOCALAPPDATA: "C:\\Users\\u\\AppData\\Local",
+};
+
+const EXPECTED_CANDIDATES = [
+  "C:\\Windows\\System32",
+  "C:\\Windows",
+  "C:\\Windows\\System32\\Wbem",
+  "C:\\Windows\\System32\\WindowsPowerShell\\v1.0",
+  "C:\\Windows\\System32\\OpenSSH",
+  "C:\\Users\\u\\AppData\\Local\\Microsoft\\WindowsApps",
+];
+
+const allExist = () => true;
+const noneExist = () => false;
+
+describe("ensureWindowsSystemPath", () => {
+  describe("non-Windows hosts", () => {
+    it("returns env unchanged on darwin", () => {
+      const env = { PATH: "/usr/bin:/bin" };
+      const out = ensureWindowsSystemPath(env, { platform: "darwin", exists: allExist });
+      expect(out).toBe(env);
+    });
+
+    it("returns env unchanged on linux", () => {
+      const env = { PATH: "/usr/bin:/bin" };
+      const out = ensureWindowsSystemPath(env, { platform: "linux", exists: allExist });
+      expect(out).toBe(env);
+    });
+  });
+
+  describe("Windows host", () => {
+    it("prepends all 6 candidates when PATH empty and all exist", () => {
+      const env = { ...WIN_ENV_BASE, PATH: "" };
+      const out = ensureWindowsSystemPath(env, { platform: "win32", exists: allExist });
+      const parts = (out.PATH ?? "").split(";").filter(Boolean);
+      expect(parts).toEqual(EXPECTED_CANDIDATES);
+    });
+
+    it("does not duplicate System32 when already in PATH", () => {
+      const env = {
+        ...WIN_ENV_BASE,
+        PATH: "C:\\foo;C:\\Windows\\System32;C:\\bar",
+      };
+      const out = ensureWindowsSystemPath(env, { platform: "win32", exists: allExist });
+      const occurrences = (out.PATH ?? "")
+        .toLowerCase()
+        .split(";")
+        .filter((p) => p === "c:\\windows\\system32").length;
+      expect(occurrences).toBe(1);
+      // Original PATH ordering preserved at the tail.
+      expect(out.PATH).toContain("C:\\foo;C:\\Windows\\System32;C:\\bar");
+      // Other 5 prepended.
+      expect(out.PATH).toContain("C:\\Windows\\System32\\Wbem");
+    });
+
+    it("skips Wbem when it does not exist on disk", () => {
+      const exists = (p: string) => !p.endsWith("Wbem");
+      const env = { ...WIN_ENV_BASE, PATH: "" };
+      const out = ensureWindowsSystemPath(env, { platform: "win32", exists });
+      expect(out.PATH).not.toContain("Wbem");
+      expect(out.PATH).toContain("C:\\Windows\\System32");
+      expect(out.PATH).toContain("WindowsPowerShell");
+    });
+
+    it("returns env unchanged when no candidates exist on disk", () => {
+      const env = { ...WIN_ENV_BASE, PATH: "C:\\already\\here" };
+      const out = ensureWindowsSystemPath(env, { platform: "win32", exists: noneExist });
+      expect(out).toBe(env);
+    });
+
+    it("is idempotent: second call adds nothing", () => {
+      const env = { ...WIN_ENV_BASE, PATH: "" };
+      const once = ensureWindowsSystemPath(env, { platform: "win32", exists: allExist });
+      const twice = ensureWindowsSystemPath(once, { platform: "win32", exists: allExist });
+      expect(twice.PATH).toBe(once.PATH);
+    });
+
+    it("treats lowercase System32 in PATH as already-present", () => {
+      const env = {
+        ...WIN_ENV_BASE,
+        PATH: "c:\\windows\\system32;c:\\elsewhere",
+      };
+      const out = ensureWindowsSystemPath(env, { platform: "win32", exists: allExist });
+      const lower = (out.PATH ?? "").toLowerCase();
+      const occurrences = lower.split(";").filter((p) => p === "c:\\windows\\system32").length;
+      expect(occurrences).toBe(1);
+    });
+
+    it("defaults SYSTEMROOT to C:\\Windows when env lacks it", () => {
+      const env = { PATH: "", LOCALAPPDATA: "C:\\Users\\u\\AppData\\Local" };
+      const out = ensureWindowsSystemPath(env, { platform: "win32", exists: allExist });
+      expect(out.PATH).toContain("C:\\Windows\\System32");
+    });
+
+    it("skips WindowsApps when LOCALAPPDATA missing", () => {
+      const env = { SYSTEMROOT: "C:\\Windows", PATH: "" };
+      const out = ensureWindowsSystemPath(env, { platform: "win32", exists: allExist });
+      expect(out.PATH).not.toContain("WindowsApps");
+      expect(out.PATH).toContain("C:\\Windows\\System32");
+    });
+  });
+});