@gonrocca/nodd 0.2.2 → 0.3.1

package/extensions/nodd-kernel.test.ts

@@ -1,6 +1,7 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import register, { createKernel } from "./nodd-kernel.ts";
@@ -20,6 +21,55 @@ function fakePi() {
   };
 }
 
+test("the config is read from the given home, so the suite never reads the user's", () => {
+  // Without an injectable home, `register()` reads the real `~/.pi/nodd.json`
+  // and the suite's verdict depends on the machine running it: measured on one
+  // commit, a local config with the gates off turned 434 passes into 408.
+  const home = mkdtempSync(join(tmpdir(), "nodd-home-"));
+  mkdirSync(join(home, ".pi"), { recursive: true });
+  writeFileSync(join(home, ".pi", "nodd.json"), JSON.stringify({ gates: { classify: { enabled: false } } }));
+
+  const kernel = register(fakePi() as never, mkdtempSync(join(tmpdir(), "nodd-cwd-")), home);
+  assert.deepEqual(kernel.policy().config, { classify: { enabled: false } }, "the given home is what was read");
+
+  const other = register(fakePi() as never, mkdtempSync(join(tmpdir(), "nodd-cwd-")), mkdtempSync(join(tmpdir(), "nodd-empty-")));
+  assert.deepEqual(other.policy().config, {}, "an empty home means nobody chose, whatever the real one says");
+});
+
+test("reloadPolicy picks up a config written after the session started", () => {
+  // `/nodd-gates off` writes the file; without a re-read the gate keeps blocking
+  // until pi restarts, while disk already says it is off. A user who turns off
+  // the kill switch and watches it keep blocking concludes it does not work.
+  const home = mkdtempSync(join(tmpdir(), "nodd-home-"));
+  mkdirSync(join(home, ".pi"), { recursive: true });
+  const kernel = register(fakePi() as never, mkdtempSync(join(tmpdir(), "nodd-cwd-")), home);
+  assert.deepEqual(kernel.policy().config, {}, "nothing configured yet");
+
+  writeFileSync(join(home, ".pi", "nodd.json"), JSON.stringify({ gates: { track: { enabled: false } } }));
+  kernel.reloadPolicy();
+  assert.deepEqual(kernel.policy().config, { track: { enabled: false } }, "the new config is in effect");
+});
+
+test("/nodd-gates disable takes effect without restarting pi", () => {
+  // The kill switch is user-owned: it must obey at once. Reading the config
+  // only at startup left the gate blocking while disk already said it was off,
+  // and the refusal kept offering /nodd-allow as though nobody had decided —
+  // a user who turns it off and watches it keep blocking concludes it is broken.
+  const home = mkdtempSync(join(tmpdir(), "nodd-home-"));
+  mkdirSync(join(home, ".pi"), { recursive: true });
+  const pi = fakePi();
+  register(pi as never, mkdtempSync(join(tmpdir(), "nodd-cwd-")), home);
+
+  const write = { toolName: "write", toolCallId: "c1", input: { file_path: "a.ts", content: "x" } };
+  assert.equal(pi.emit("tool_call", write)?.block, true, "undeclared writes are blocked while the gate is on");
+
+  // What `/nodd-gates disable classify` writes, mid-session.
+  writeFileSync(join(home, ".pi", "nodd.json"), JSON.stringify({ gates: { classify: { enabled: false } } }));
+
+  const after = pi.emit("tool_call", { ...write, toolCallId: "c2" });
+  assert.equal(after, undefined, "the very next call sees the gate off, with no restart");
+});
+
 test("a read-only session of read/grep/ls produces zero blocks", () => {
   const pi = fakePi();
   register(pi as never);

package/extensions/nodd-kernel.ts

@@ -142,17 +142,23 @@ export type Kernel = {
   /** Run the ordered registry against one call. `null` means let it run. */
   checkCall(request: GateRequest): { block: true; reason: string } | null;
   setPolicy(policy: Policy): void;
+  /** Re-read the configured flags, keeping runtime flags and hatches. */
+  reloadPolicy(): Policy;
   policy(): Policy;
 };
 
 export function createKernel(
   now: () => string = () => new Date().toISOString(),
   cwd: string = process.cwd(),
+  loadPolicy: () => Policy = emptyPolicy,
 ): Kernel {
   const state = emptyState();
   // Mutable because `/nodd-allow` grants a hatch mid-session and a refusal
   // spends it. The policy is session state, not a constant.
   let policy: Policy = emptyPolicy();
+  // Set by `setPolicy`: the caller owns the whole policy from then on, and
+  // `reloadPolicy` stops re-reading the file over their choice.
+  let policyIsPinned = false;
 
   const readDoc = (slug: string): FeatureDoc | null => {
     const path = featureDocPath(cwd, slug);
@@ -349,7 +355,20 @@ export function createKernel(
       return null;
     },
 
+    reloadPolicy() {
+      // Re-read rather than cache: `/nodd-gates off` writes the file, and a
+      // policy only read at startup leaves the gate blocking while disk already
+      // says it is off — a kill switch the user watches fail.
+      //
+      // An explicit `setPolicy` wins: it is the caller stating the whole policy,
+      // and re-reading over it would silently undo what they just set.
+      if (policyIsPinned) return policy;
+      policy = { ...loadPolicy(), flags: policy.flags, hatches: policy.hatches };
+      return policy;
+    },
+
     setPolicy(next) {
+      policyIsPinned = true;
       policy = next;
     },
 
@@ -518,23 +537,32 @@ function promotionSignals(committed: Committed, request: GateRequest) {
   };
 }
 
-/** Gate flags as configured. An unreadable config means nobody chose. */
-function readPolicy(): Policy {
+/**
+ * Gate flags as configured. An unreadable config means nobody chose.
+ *
+ * `home` is a parameter, not `homedir()` inside: the tests call `register()`
+ * directly, and reading the real `~/.pi/nodd.json` made the suite's verdict
+ * depend on the machine running it.
+ */
+function readPolicy(home?: string): Policy {
   try {
-    const { config } = parseConfig(readFileSync(noddConfigPath(), "utf8"));
+    const { config } = parseConfig(readFileSync(noddConfigPath(home), "utf8"));
     return { ...emptyPolicy(), config: config.gates };
   } catch {
     return emptyPolicy();
   }
 }
 
-export default function register(pi?: PiApi, cwd: string = process.cwd()): Kernel {
-  const kernel = createKernel(undefined, cwd);
-  if (!pi || typeof pi.on !== "function") return kernel;
+export default function register(pi?: PiApi, cwd: string = process.cwd(), home?: string): Kernel {
+  const kernel = createKernel(undefined, cwd, () => readPolicy(home));
+  if (!pi || typeof pi.on !== "function") {
+    kernel.reloadPolicy();
+    return kernel;
+  }
 
   // Flags the user set persist into the session's policy. `/nodd-allow` adds
   // one-shot hatches on top of this at runtime.
-  kernel.setPolicy(readPolicy());
+  kernel.reloadPolicy();
 
   pi.registerTool?.({
     name: "nodd_declare",
@@ -552,6 +580,10 @@ export default function register(pi?: PiApi, cwd: string = process.cwd()): Kerne
   pi.on("tool_call", ((event: ToolCallEvent) => {
     let decision: { block: true; reason: string } | null = null;
     try {
+      // Re-read the flags before deciding. `/nodd-gates disable` writes the
+      // config from another extension, and a policy read only at startup would
+      // keep blocking while disk already said the gate was off.
+      kernel.reloadPolicy();
       decision = kernel.checkCall({ toolName: event?.toolName ?? "", input: normalizeInput(event?.input) });
     } catch {
       // A gate that throws must not break the session. Failing open here is

package/extensions/nodd-models.test.ts

@@ -1,5 +1,8 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { readFileSync } from "node:fs";
 import { MECHANISM_PLACEHOLDER } from "../src/models/slots.ts";
 import register, { runModelsCommand, type ConfigIo } from "./nodd-models.ts";
@@ -164,6 +167,73 @@ test("quitting the picker produces zero writes; saving writes once", async () =>
   assert.equal(saveIo.writes[0].unrelated, true, "the picker's save preserves unrelated keys");
 });
 
+test("the handler opens the picker on the saved profiles, not on an empty menu", async () => {
+  // The host built the picker from `models` and `groups` only, so the profiles
+  // on disk never reached it: a user with six saved profiles opened
+  // /nodd-models and the menu offered to create the first one.
+  const commands = new Map<string, any>();
+  register({ registerCommand: (name: string, options: unknown) => commands.set(name, options) } as never);
+
+  const config = {
+    models: { implement: "cliproxy/personal/claude-opus-5" },
+    thinking: { implement: "high" },
+    profiles: {
+      rapido: { models: { implement: "cliproxy/ds/deepseek-flash" }, thinking: { implement: "low" } },
+      lento: { models: { implement: "cliproxy/personal/claude-opus-5" }, thinking: { implement: "high" } },
+    },
+    activeProfile: "rapido",
+  };
+
+  const home = mkdtempSync(join(tmpdir(), "nodd-models-"));
+  mkdirSync(join(home, ".pi"), { recursive: true });
+  writeFileSync(join(home, ".pi", "nodd.json"), JSON.stringify(config));
+  const previousHome = process.env.HOME;
+  process.env.HOME = home;
+
+  let rendered: string[] = [];
+  try {
+    await commands.get("nodd-models").handler("", {
+      ui: {
+        notify() {},
+        // Stand in for pi's custom-UI host: build the component, render it, and
+        // quit without saving.
+        async custom(build: any) {
+          let result: unknown;
+          const component = build({ requestRender() {} }, {}, {}, (r: unknown) => { result = r; });
+          rendered = component.render(80);
+          component.handleInput?.("q");
+          return result ?? { type: "quit" };
+        },
+      },
+      modelRegistry: { getAll: () => [{ provider: "cliproxy", id: "personal/claude-opus-5" }] },
+    } as never);
+  } finally {
+    if (previousHome === undefined) delete process.env.HOME;
+    else process.env.HOME = previousHome;
+  }
+
+  const screen = rendered.join("\n");
+  assert.match(screen, /rapido/, "a saved profile is on the opening screen");
+  assert.match(screen, /lento/, "and so is the other one");
+  assert.doesNotMatch(screen, /modelos sin perfil/, "with profiles saved, the menu is not the no-profile one");
+});
+
+test("the picker input carries the profiles and the active one", () => {
+  const input = register.pickerInput(
+    {
+      models: { implement: "cliproxy/personal/claude-opus-5" },
+      thinking: { implement: "high" },
+      profiles: { rapido: { models: { implement: "cliproxy/ds/deepseek-flash" } } },
+      activeProfile: "rapido",
+    },
+    new Map([["cliproxy", ["personal/claude-opus-5"]]]),
+  );
+
+  assert.deepEqual(Object.keys(input.profiles), ["rapido"], "saved profiles reach the picker");
+  assert.equal(input.activeProfile, "rapido", "and so does the active one");
+  assert.deepEqual(input.thinking, { implement: "high" }, "and the levels, so editing does not wipe them");
+});
+
 test("the command is registered with pi under its own name", () => {
   const commands = new Map<string, unknown>();
   register({ registerCommand: (name: string, options: unknown) => commands.set(name, options) } as never);

package/extensions/nodd-models.ts

@@ -334,8 +334,12 @@ function register(pi?: PiApi): void {
         // deterministic text path, which is the whole command in a headless run.
         if (args.trim() === "" && typeof ctx?.ui?.custom === "function") {
           const groups = groupsFrom(ctx.modelRegistry);
+          // Everything the picker needs, including the saved profiles and the
+          // active one. Passing only the models opened the picker as though
+          // nothing had ever been saved.
+          const input = pickerInput(io.readConfig(), groups);
           const result = await ctx.ui.custom<EnterResult>((tui, _theme, _keys, done) =>
-            createComponent({ models: currentModels(io.readConfig()), groups }, done, () => tui.requestRender()),
+            createComponent(input, done, () => tui.requestRender()),
           );
           runPicker(result, io);
           notify?.(result.type === "save" ? "nodd · modelos guardados" : "nodd · sin cambios", "info");
@@ -352,5 +356,6 @@ function register(pi?: PiApi): void {
 
 register.runPicker = runPicker;
 register.createComponent = createComponent;
+register.pickerInput = pickerInput;
 
 export default register;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gonrocca/nodd",
-  "version": "0.2.2",
+  "version": "0.3.1",
   "description": "Non-negotiable Organic Driven Development — the ODD protocol as runtime mechanism for pi: blocking gates, observed evidence, and promotion to /forge.",
   "type": "module",
   "keywords": [