@blackbelt-technology/pi-agent-dashboard 0.5.3 → 0.5.4

package/packages/shared/src/__tests__/intent-types.test.ts

@@ -0,0 +1,120 @@
+import { describe, it, expect } from "vitest";
+import type {
+  IntentNode,
+  ActionDescriptor,
+  PluginIntentsMessage,
+  PluginActionMessage,
+} from "../dashboard-plugin/intent-types.js";
+
+describe("intent-types — wire format", () => {
+  it("IntentNode round-trips through JSON.stringify + JSON.parse losslessly", () => {
+    const intent: IntentNode = {
+      primitive: "ui:action-list",
+      props: {
+        actions: [
+          { label: "Run Flow X" },
+          { label: "Run Flow Y" },
+        ],
+      },
+      key: "actions-1",
+      actions: {
+        onClick: {
+          pluginId: "flows",
+          action: "flow.run",
+          payload: { flow: "X" },
+        } satisfies ActionDescriptor,
+      },
+    };
+
+    const roundTrip = JSON.parse(JSON.stringify(intent)) as IntentNode;
+    expect(roundTrip).toEqual(intent);
+    expect(roundTrip.primitive).toBe("ui:action-list");
+    expect((roundTrip.actions?.onClick as ActionDescriptor).pluginId).toBe("flows");
+  });
+
+  it("nested IntentNode inside props survives round-trip", () => {
+    const inner: IntentNode = {
+      primitive: "ui:markdown",
+      props: { content: "## Hello" },
+    };
+
+    const outer: IntentNode = {
+      primitive: "ui:agent-card",
+      props: {
+        name: "Explore",
+        status: "running",
+        body: inner,
+      },
+    };
+
+    const roundTrip = JSON.parse(JSON.stringify(outer)) as IntentNode;
+    expect(roundTrip).toEqual(outer);
+
+    // Nested IntentNode is still structurally an IntentNode after parse
+    const nestedBody = (roundTrip.props as Record<string, unknown>).body as IntentNode;
+    expect(nestedBody.primitive).toBe("ui:markdown");
+    expect((nestedBody.props as Record<string, unknown>).content).toBe("## Hello");
+  });
+
+  it("PluginIntentsMessage envelope is well-typed", () => {
+    const msg: PluginIntentsMessage = {
+      type: "plugin_intents",
+      pluginId: "flows",
+      sessionId: "abc-123",
+      slot: "session-card-action-bar",
+      intent: {
+        primitive: "ui:action-list",
+        props: { actions: [] },
+      },
+    };
+
+    const roundTrip = JSON.parse(JSON.stringify(msg)) as PluginIntentsMessage;
+    expect(roundTrip.type).toBe("plugin_intents");
+    expect(roundTrip.slot).toBe("session-card-action-bar");
+    expect(roundTrip.sessionId).toBe("abc-123");
+  });
+
+  it("PluginIntentsMessage with null intent (clear semantics) round-trips", () => {
+    const msg: PluginIntentsMessage = {
+      type: "plugin_intents",
+      pluginId: "flows",
+      sessionId: "abc-123",
+      slot: "content-view",
+      intent: null,
+    };
+
+    const roundTrip = JSON.parse(JSON.stringify(msg)) as PluginIntentsMessage;
+    expect(roundTrip.intent).toBeNull();
+  });
+
+  it("PluginActionMessage envelope is well-typed", () => {
+    const msg: PluginActionMessage = {
+      type: "plugin_action",
+      pluginId: "flows",
+      sessionId: "abc-123",
+      action: "flow.run",
+      payload: { flow: "X" },
+    };
+
+    const roundTrip = JSON.parse(JSON.stringify(msg)) as PluginActionMessage;
+    expect(roundTrip.type).toBe("plugin_action");
+    expect(roundTrip.action).toBe("flow.run");
+    expect((roundTrip.payload as { flow: string }).flow).toBe("X");
+  });
+
+  it("sessionId may be null for global slots", () => {
+    const msg: PluginIntentsMessage = {
+      type: "plugin_intents",
+      pluginId: "honcho",
+      sessionId: null,
+      slot: "settings-section",
+      intent: {
+        primitive: "ui:status-pill",
+        props: { state: "connected", text: "ready" },
+      },
+    };
+
+    const roundTrip = JSON.parse(JSON.stringify(msg)) as PluginIntentsMessage;
+    expect(roundTrip.sessionId).toBeNull();
+  });
+});

package/packages/shared/src/__tests__/jiti-packages-parity.test.ts

@@ -0,0 +1,85 @@
+/**
+ * Repo-lint: assert `JITI_PACKAGES` is identical between the two source
+ * sites that resolve jiti at process startup.
+ *
+ *   1. `packages/shared/src/platform/binary-lookup.ts` (canonical, used
+ *      by the server-launcher / electron / doctor / cli runtime path).
+ *   2. `packages/server/bin/pi-dashboard.mjs` (bin wrapper, runs before
+ *      any TS loader is registered so it cannot import the canonical
+ *      module and must inline the constant).
+ *
+ * If these drift, a clean-machine `npm i -g pi-dashboard && pi-dashboard`
+ * boots inconsistently: the bin wrapper might accept a jiti spec the
+ * cli.ts's daemon respawn rejects (or vice-versa). Caught us once with
+ * `@oh-my-pi/jiti` in v0.5.3.
+ *
+ * The lint is a string-parse rather than an import because the bin
+ * wrapper is ESM-not-TS and we want to fail fast even if a future move
+ * to a CJS-only environment breaks dynamic import.
+ *
+ * See change: enable-standalone-npm-install task 7.3.
+ */
+import { describe, it, expect } from "vitest";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import url from "node:url";
+
+const here = path.dirname(url.fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(here, "..", "..", "..", "..");
+
+const BIN_PATH = path.join(REPO_ROOT, "packages/server/bin/pi-dashboard.mjs");
+const SHARED_PATH = path.join(REPO_ROOT, "packages/shared/src/platform/binary-lookup.ts");
+
+/**
+ * Parse a `const JITI_PACKAGES = [ ... ]` (with optional `export` /
+ * `as const`) and return the array of string literals in declared order.
+ * Returns `null` if no such declaration is found.
+ */
+function parseJitiPackagesArray(source: string): string[] | null {
+  // Match either:
+  //   const JITI_PACKAGES = ["a", "b"];
+  //   export const JITI_PACKAGES = ["a", "b"] as const;
+  const decl = source.match(
+    /(?:export\s+)?const\s+JITI_PACKAGES\s*(?::[^=]+)?=\s*\[([^\]]+)\]/,
+  );
+  if (!decl) return null;
+  const inner = decl[1]!;
+  const items: string[] = [];
+  // Pull every quoted string in order. Accepts double or single quotes.
+  for (const m of inner.matchAll(/['"]([^'"]+)['"]/g)) {
+    items.push(m[1]!);
+  }
+  return items;
+}
+
+describe("JITI_PACKAGES parity (binary-lookup.ts ⇔ bin/pi-dashboard.mjs)", () => {
+  it("both sites declare the same array in the same order", () => {
+    const binSrc = readFileSync(BIN_PATH, "utf-8");
+    const sharedSrc = readFileSync(SHARED_PATH, "utf-8");
+
+    const binList = parseJitiPackagesArray(binSrc);
+    const sharedList = parseJitiPackagesArray(sharedSrc);
+
+    expect(binList, `JITI_PACKAGES not found in ${BIN_PATH}`).not.toBeNull();
+    expect(sharedList, `JITI_PACKAGES not found in ${SHARED_PATH}`).not.toBeNull();
+
+    expect(binList).toEqual(sharedList);
+  });
+
+  it("primary lookup is bare \"jiti\" (regression for v0.5.3 fork drift)", () => {
+    const binList = parseJitiPackagesArray(readFileSync(BIN_PATH, "utf-8"));
+    const sharedList = parseJitiPackagesArray(readFileSync(SHARED_PATH, "utf-8"));
+    // Plain "jiti" is what `dependencies.jiti` in packages/server/package.json
+    // installs. It MUST be the first candidate or the bin wrapper will look up
+    // the wrong package on a clean install.
+    expect(binList?.[0]).toBe("jiti");
+    expect(sharedList?.[0]).toBe("jiti");
+  });
+
+  it("does NOT contain @oh-my-pi/jiti (removed by 2026-05-08-migrate-pi-fork-to-earendil)", () => {
+    const binList = parseJitiPackagesArray(readFileSync(BIN_PATH, "utf-8"));
+    const sharedList = parseJitiPackagesArray(readFileSync(SHARED_PATH, "utf-8"));
+    expect(binList).not.toContain("@oh-my-pi/jiti");
+    expect(sharedList).not.toContain("@oh-my-pi/jiti");
+  });
+});

package/packages/shared/src/__tests__/legacy-managed-dir.test.ts

@@ -0,0 +1,59 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { detectLegacyManagedDir } from "../legacy-managed-dir.js";
+
+describe("legacy-managed-dir", () => {
+  let tmpHome: string;
+
+  beforeEach(() => {
+    tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "legacy-managed-dir-test-"));
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmpHome, { recursive: true, force: true });
+  });
+
+  it("returns present:false when directory does not exist", () => {
+    const res = detectLegacyManagedDir({ homedir: tmpHome });
+    expect(res).toEqual({ present: false });
+  });
+
+  it("returns present:false when path is a file, not a directory", () => {
+    fs.writeFileSync(path.join(tmpHome, ".pi-dashboard"), "garbage");
+    const res = detectLegacyManagedDir({ homedir: tmpHome });
+    expect(res).toEqual({ present: false });
+  });
+
+  it("returns present:true with zero pkgCount when dir exists but has no node_modules", () => {
+    fs.mkdirSync(path.join(tmpHome, ".pi-dashboard"), { recursive: true });
+    const res = detectLegacyManagedDir({ homedir: tmpHome });
+    expect(res.present).toBe(true);
+    if (res.present) {
+      expect(res.pkgCount).toBe(0);
+      expect(res.path).toContain(".pi-dashboard");
+      expect(res.sizeMb).toBeGreaterThanOrEqual(0);
+    }
+  });
+
+  it("counts direct children under node_modules/ as pkgCount", () => {
+    const nm = path.join(tmpHome, ".pi-dashboard", "node_modules");
+    fs.mkdirSync(path.join(nm, "foo"), { recursive: true });
+    fs.mkdirSync(path.join(nm, "bar"), { recursive: true });
+    fs.mkdirSync(path.join(nm, "@scope"), { recursive: true });
+    const res = detectLegacyManagedDir({ homedir: tmpHome });
+    expect(res.present).toBe(true);
+    if (res.present) expect(res.pkgCount).toBe(3);
+  });
+
+  it("computes a non-zero sizeMb when content exists", () => {
+    const dir = path.join(tmpHome, ".pi-dashboard");
+    fs.mkdirSync(dir, { recursive: true });
+    // Write 2 MB of bytes
+    fs.writeFileSync(path.join(dir, "blob.bin"), Buffer.alloc(2 * 1024 * 1024));
+    const res = detectLegacyManagedDir({ homedir: tmpHome });
+    expect(res.present).toBe(true);
+    if (res.present) expect(res.sizeMb).toBeGreaterThanOrEqual(2);
+  });
+});

package/packages/shared/src/__tests__/no-direct-child-process.test.ts

@@ -24,6 +24,18 @@ const ALLOWLIST: readonly string[] = [
   // See change: consolidate-windows-spawn-and-platform-handlers.
   "packages/shared/src/platform/detached-spawn.ts",
   "packages/shared/src/platform/subprocess-adapter.ts",
+  // Legacy-pi cleanup needs a synchronous npm-root probe at server
+  // startup; predates the platform/exec wrapper. See origin commit
+  // ab711621 (feat(bootstrap): detect + one-click cleanup of legacy
+  // @mariozechner/pi-coding-agent).
+  "packages/server/src/legacy-pi-cleanup.ts",
+  // The startup recovery HTTP server runs precisely when top-level
+  // dependencies are missing (corrupted node_modules) — importing the
+  // platform/exec wrapper there would defeat the recovery flow because
+  // its transitive deps may be the very things that are missing. The
+  // file's own header explicitly mandates: "Keep it dependency-free."
+  // See change: add-startup-recovery-server (commit e606e8b0).
+  "packages/server/src/recovery-server.ts",
 ];
 
 /**

package/packages/shared/src/__tests__/no-electron-execpath-spawn.test.ts

@@ -0,0 +1,149 @@
+/**
+ * Repo-lint: Electron callers of launchDashboardServer must pass an
+ * explicit `nodeBin:` OR set `ELECTRON_RUN_AS_NODE` in the env, so the
+ * spawned process uses a real Node binary instead of the Electron GUI
+ * binary (which silently re-launches the app and exits on the
+ * single-instance lock).
+ *
+ * Also enforces that only `pick-node.ts` may reference `process.execPath`
+ * inside `packages/electron/src/lib/**`.
+ *
+ * See design D4 in openspec/changes/fix-electron-server-launch-node-bin/design.md.
+ */
+import { describe, it, expect } from "vitest";
+import fs from "node:fs/promises";
+import { Dirent } from "node:fs";
+import path from "node:path";
+import url from "node:url";
+
+/**
+ * The only file in packages/electron/src/lib/ that may reference
+ * process.execPath directly (it wraps the value inside PickNodeInput
+ * and passes it through rather than using it as a Node binary itself).
+ */
+const EXECPATH_ALLOWLIST = new Set(["pick-node.ts"]);
+
+/** Walk .ts/.tsx files, excluding node_modules, dist, and __tests__. */
+async function* walk(dir: string): AsyncGenerator<string> {
+  let entries: Dirent[];
+  try {
+    entries = await fs.readdir(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (["node_modules", "dist", "__tests__"].includes(entry.name)) continue;
+      yield* walk(full);
+    } else if (entry.isFile() && /\.(ts|tsx|mts|cts)$/.test(entry.name)) {
+      yield full;
+    }
+  }
+}
+
+describe("no-electron-execpath-spawn", () => {
+  it("launchDashboardServer calls in electron/lib include nodeBin or ELECTRON_RUN_AS_NODE", async () => {
+    const here = path.dirname(url.fileURLToPath(import.meta.url));
+    const repoRoot = path.resolve(here, "..", "..", "..", "..");
+    const electronLibDir = path.join(repoRoot, "packages", "electron", "src", "lib");
+
+    const violations: Array<{ file: string; line: number; text: string }> = [];
+
+    for await (const file of walk(electronLibDir)) {
+      const content = await fs.readFile(file, "utf-8");
+      // Find all launchDashboardServer call sites. We look for the function
+      // name on a line, then scan forward for the matching closing paren to
+      // extract the options object text.
+      const lines = content.split(/\r?\n/);
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i]!;
+        if (!line.includes("launchDashboardServer(")) continue;
+
+        // Collect the call body: from this line to the matching closing paren.
+        let depth = 0;
+        let body = "";
+        for (let j = i; j < lines.length; j++) {
+          const l = lines[j]!;
+          body += l + "\n";
+          for (const ch of l) {
+            if (ch === "(") depth++;
+            else if (ch === ")") depth--;
+          }
+          if (depth === 0 && body.includes("launchDashboardServer(")) break;
+        }
+
+        const hasNodeBin = /\bnodeBin\s*:/.test(body);
+        const hasElectronRunAsNode = /ELECTRON_RUN_AS_NODE/.test(body);
+
+        if (!hasNodeBin && !hasElectronRunAsNode) {
+          violations.push({
+            file: path.relative(repoRoot, file),
+            line: i + 1,
+            text: line.trim(),
+          });
+        }
+      }
+    }
+
+    if (violations.length > 0) {
+      const msg =
+        `launchDashboardServer() called from Electron lib without nodeBin: or ELECTRON_RUN_AS_NODE.\n` +
+        `In Electron, process.execPath is the GUI binary — spawning it without ELECTRON_RUN_AS_NODE=1\n` +
+        `re-launches the app, hits the single-instance lock, and exits silently.\n\n` +
+        `Fix: call pickNodeForServer() and pass nodeBin: pick.nodeBin.\n` +
+        `See design D4: openspec/changes/fix-electron-server-launch-node-bin/design.md\n\n` +
+        `Offenders (${violations.length}):\n` +
+        violations.map((v) => `  ${v.file}:${v.line}  ${v.text}`).join("\n");
+      expect(violations, msg).toHaveLength(0);
+    }
+  });
+
+  it("process.execPath not used directly as a node binary in electron/lib (outside pick-node.ts)", async () => {
+    const here = path.dirname(url.fileURLToPath(import.meta.url));
+    const repoRoot = path.resolve(here, "..", "..", "..", "..");
+    const electronLibDir = path.join(repoRoot, "packages", "electron", "src", "lib");
+
+    // Pattern: process.execPath used as a binary path assignment (not as a
+    // processExecPath: injection key which is the permitted picker-call pattern).
+    //   Flagged:   nodeBin = ... ?? process.execPath
+    //   Flagged:   nodeBin: process.execPath
+    //   Allowed:   processExecPath: process.execPath   (picker input)
+    //   Allowed:   string interpolation / log messages
+    const BINARY_EXECPATH_RE = /(?:nodeBin|cmd|bin)\s*(?:=|:)[^,;\n]*\bprocess\.execPath\b|\?\?\s*process\.execPath/;
+    // Safe patterns that should not be flagged even if they match above
+    const SAFE_RE = /processExecPath\s*:\s*process\.execPath/;
+
+    const violations: Array<{ file: string; line: number; text: string }> = [];
+
+    for await (const file of walk(electronLibDir)) {
+      const basename = path.basename(file);
+      if (EXECPATH_ALLOWLIST.has(basename)) continue;
+
+      const content = await fs.readFile(file, "utf-8");
+      const lines = content.split(/\r?\n/);
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i]!;
+        if (BINARY_EXECPATH_RE.test(line) && !SAFE_RE.test(line)) {
+          violations.push({
+            file: path.relative(repoRoot, file),
+            line: i + 1,
+            text: line.trim(),
+          });
+        }
+      }
+    }
+
+    if (violations.length > 0) {
+      const msg =
+        `process.execPath used directly as a Node binary in packages/electron/src/lib.\n` +
+        `In Electron main, process.execPath is the GUI binary, not a Node interpreter.\n` +
+        `Use pickNodeForServer() from pick-node.ts to select the correct binary.\n\n` +
+        `Allowed file: ${[...EXECPATH_ALLOWLIST].join(", ")}\n` +
+        `Allowed pattern: processExecPath: process.execPath (picker injection)\n\n` +
+        `Offenders (${violations.length}):\n` +
+        violations.map((v) => `  ${v.file}:${v.line}  ${v.text}`).join("\n");
+      expect(violations, msg).toHaveLength(0);
+    }
+  });
+});

package/packages/shared/src/__tests__/no-flow-command-route-claims.test.ts

@@ -0,0 +1,71 @@
+/**
+ * Repo-lint: dashboard plugins MUST NOT claim `command-route` for any
+ * `/flows*` command. Flow operations in the dashboard are button-driven
+ * (`SessionFlowActions`, `FlowDashboard` Abort, `FlowLaunchDialog`); the
+ * pi-flows extension itself still registers the slash commands for TUI.
+ *
+ * See change: fix-pi-flows-end-to-end (Group 8, task 8.5).
+ */
+import { describe, it, expect } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const PACKAGES_DIR = path.resolve(__dirname, "..", "..", "..", "..");
+
+interface PluginClaim {
+  slot?: string;
+  command?: string;
+  component?: string;
+}
+
+interface ManifestSlice {
+  id?: string;
+  claims?: PluginClaim[];
+}
+
+function readPluginManifests(): Array<{ pkg: string; manifest: ManifestSlice }> {
+  const out: Array<{ pkg: string; manifest: ManifestSlice }> = [];
+  for (const entry of fs.readdirSync(PACKAGES_DIR, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const pkgJsonPath = path.join(PACKAGES_DIR, entry.name, "package.json");
+    if (!fs.existsSync(pkgJsonPath)) continue;
+    let raw: string;
+    try {
+      raw = fs.readFileSync(pkgJsonPath, "utf-8");
+    } catch {
+      continue;
+    }
+    let parsed: { "pi-dashboard-plugin"?: ManifestSlice };
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      continue;
+    }
+    const m = parsed["pi-dashboard-plugin"];
+    if (m) out.push({ pkg: entry.name, manifest: m });
+  }
+  return out;
+}
+
+describe("repo-lint: no dashboard plugin claims command-route for /flows*", () => {
+  it("every monorepo plugin manifest is free of /flows* command-route claims", () => {
+    const offenders: string[] = [];
+    for (const { pkg, manifest } of readPluginManifests()) {
+      for (const claim of manifest.claims ?? []) {
+        if (claim.slot !== "command-route") continue;
+        if (!claim.command || !claim.command.startsWith("/flows")) continue;
+        offenders.push(`${pkg}: command "${claim.command}" → component "${claim.component ?? "?"}"`);
+      }
+    }
+    if (offenders.length > 0) {
+      throw new Error(
+        `Found dashboard plugin command-route claims for /flows*:\n${offenders.map((o) => "  " + o).join("\n")}\n\n` +
+          "Dashboard flow operations are button-driven (SessionFlowActions / FlowDashboard / FlowLaunchDialog). " +
+          "pi-flows itself still registers /flows* commands for TUI use; the dashboard plugin manifest must not.",
+      );
+    }
+    expect(offenders).toEqual([]);
+  });
+});