@moxxy/core 0.6.2 → 0.7.0

package/src/session.ts

@@ -1,6 +1,8 @@
 import type {
   AppContext,
   ClientSession,
+  EmittedEvent,
+  LoopGuardSettings,
   MoxxyEvent,
   RunTurnOptions,
   SessionId,
@@ -32,6 +34,9 @@ import { SynthesizerRegistry } from './registries/synthesizers.js';
 import { EmbedderRegistry } from './registries/embedders.js';
 import { IsolatorRegistry } from './registries/isolators.js';
 import { WorkflowExecutorRegistry } from './registries/workflow-executors.js';
+import { EventStoreRegistry } from './registries/event-stores.js';
+import { ServiceRegistryImpl } from './registries/services.js';
+import { jsonlEventStore } from './sessions/jsonl-event-store.js';
 import { RequirementRegistry } from './requirements.js';
 import { PermissionEngine } from './permissions/engine.js';
 import { autoAllowResolver } from './permissions/resolvers.js';
@@ -129,6 +134,9 @@ export class Session implements ClientSession, SessionRuntime {
   readonly embedders: EmbedderRegistry;
   readonly isolators: IsolatorRegistry;
   readonly workflowExecutors: WorkflowExecutorRegistry;
+  readonly eventStores: EventStoreRegistry;
+  /** Inter-plugin service registry — plugins publish/consume services in onInit. */
+  readonly services: ServiceRegistryImpl;
   readonly requirements: RequirementRegistry;
   readonly permissions: PermissionEngine;
   /** Current PermissionResolver. Update via `setPermissionResolver(r)`. */
@@ -155,6 +163,12 @@ export class Session implements ClientSession, SessionRuntime {
    * when the active model advertises `supportsReasoning`. Undefined → off.
    */
   reasoning: { readonly effort?: 'low' | 'medium' | 'high' } | boolean | undefined = undefined;
+  /**
+   * Stuck-loop guard tuning, from `config.context.loopGuard`. Forwarded to each
+   * turn's ModeContext and on to the mode's stuck-loop detector. Undefined →
+   * the detector's defaults.
+   */
+  loopGuard: LoopGuardSettings | undefined = undefined;
   /**
    * Model id resolved by the most recent `runTurn()` (see SessionRuntime).
    * Last-writer-wins for concurrent turns; null until the first turn runs.
@@ -168,8 +182,6 @@ export class Session implements ClientSession, SessionRuntime {
    */
   readyProviders?: Set<string>;
   credentialResolver?: CredentialResolver;
-  mcpAdmin?: McpAdminView;
-  providerAdmin?: ProviderAdminView;
   workflows?: WorkflowsView;
   pluginsAdmin?: PluginsAdminView;
   readonly dispatcher: HookDispatcherImpl;
@@ -191,13 +203,15 @@ export class Session implements ClientSession, SessionRuntime {
     this.compactors = new CompactorRegistry();
     this.cacheStrategies = new CacheStrategyRegistry();
     this.viewRenderers = new ViewRendererRegistry();
-    // Seed the built-in renderer so `present_view` always has one to parse
-    // with; plugins can register/replace and `setActive` an alternative.
-    this.viewRenderers.register(defaultViewRenderer);
+    // Seed the built-in renderer as the protected floor so `present_view`
+    // always has one to parse with; plugins can register/replace and
+    // `setActive` an alternative, but it can never be removed (reverts here).
+    this.viewRenderers.register(defaultViewRenderer, { protected: true });
     this.tunnelProviders = new TunnelProviderRegistry();
-    // Seed the no-op localhost provider so the web surface always resolves a
-    // URL; plugins (the proxy relay) register/setActive a real tunnel.
-    this.tunnelProviders.register(localhostTunnel);
+    // Seed the no-op localhost provider as the protected floor so the web
+    // surface always resolves a URL; plugins (the proxy relay) register/
+    // setActive a real tunnel, reverting here if it's removed.
+    this.tunnelProviders.register(localhostTunnel, { protected: true });
     this.channels = new ChannelRegistryImpl();
     this.surfaceRegistry = new SurfaceRegistryImpl();
     this.surfaces = new SurfaceHostImpl(this.surfaceRegistry, { cwd: this.cwd, logger: this.logger }, this.logger);
@@ -211,6 +225,49 @@ export class Session implements ClientSession, SessionRuntime {
     this.embedders = new EmbedderRegistry();
     this.isolators = new IsolatorRegistry();
     this.workflowExecutors = new WorkflowExecutorRegistry();
+    this.services = new ServiceRegistryImpl();
+    // Publish the core registries on the inter-plugin service registry under
+    // well-known names, so a discovery-loaded plugin can resolve one in its
+    // onInit (typed as the SDK's minimal NamedRegistry) instead of being
+    // hand-built with a `() => session.<registry>` closure. The registry
+    // objects are stable; their contents grow as plugins register — consumers
+    // read them lazily at tool-call time, after all registration has run.
+    this.services.register('agents', this.agents);
+    this.services.register('tools', this.tools);
+    this.services.register('providers', this.providers);
+    this.services.register('viewRenderers', this.viewRenderers);
+    this.services.register('synthesizers', this.synthesizers);
+    this.services.register('skills', this.skills);
+    this.services.register('tunnelProviders', this.tunnelProviders);
+    // A stable accessor for the active provider's stored credentials. The
+    // resolver itself is installed late (by activateProvider, after plugins are
+    // built), so close over `this` and read it lazily at call time — lets
+    // provider-admin rebuild a reconfigured provider's instance without a
+    // host-injected `resolveActiveConfig` closure.
+    this.services.register(
+      'resolveCredentials',
+      (name: string): Promise<Record<string, unknown>> | Record<string, unknown> =>
+        this.credentialResolver ? this.credentialResolver(name) : {},
+    );
+    // A live registry-name snapshot (per kind) + a writable event-append fn, for
+    // plugins (self-update) that need them in onInit without a host closure.
+    // appendEvent is the writable counterpart to the read-only `ctx.log`.
+    this.services.register('registrySnapshot', () => ({
+      tools: this.tools.list().map((t) => t.name),
+      agents: this.agents.list().map((a) => a.name),
+      providers: this.providers.list().map((p) => p.name),
+      modes: this.modes.list().map((m) => m.name),
+      compactors: this.compactors.list().map((c) => c.name),
+      channels: this.channels.list().map((c) => c.name),
+    }));
+    this.services.register(
+      'appendEvent',
+      (event: EmittedEvent): Promise<void> => this.log.append(event).then(() => undefined),
+    );
+    this.eventStores = new EventStoreRegistry();
+    // Seed the built-in JSONL store as the protected floor — the storage backend
+    // behind the event log always exists and can be swapped but never removed.
+    this.eventStores.register(jsonlEventStore, { protected: true });
     this.requirements = new RequirementRegistry({
       tools: this.tools,
       providers: this.providers,
@@ -257,12 +314,16 @@ export class Session implements ClientSession, SessionRuntime {
       embedders: this.embedders,
       isolators: this.isolators,
       workflowExecutors: this.workflowExecutors,
+      eventStores: this.eventStores,
       requirements: this.requirements,
       dispatcher: this.dispatcher,
       loader: opts.pluginLoader,
       ...(opts.pluginDiscoveryPaths ? { userPaths: opts.pluginDiscoveryPaths } : {}),
       ...(opts.isPluginDisabled ? { isDisabled: opts.isPluginDisabled } : {}),
     });
+    // Published after construction (the host is built late) so a discovery-loaded
+    // plugin (self-update) can reach reload/unload/listSkipped in its onInit.
+    this.services.register('pluginHost', this.pluginHost);
 
     // Fan every appended event out to plugin `onEvent` hooks. Without this
     // wiring the hook is dead code — declared on the SDK, dispatched by
@@ -367,6 +428,25 @@ export class Session implements ClientSession, SessionRuntime {
    */
   private envSnapshot: Readonly<NodeJS.ProcessEnv> | null = null;
 
+  /**
+   * The provider-admin capability (configure/refresh stored providers), read by
+   * the runner's provider handlers + the desktop. The @moxxy/plugin-provider-admin
+   * plugin publishes it on the service registry in its onInit, so discovery-loading
+   * it needs no host stash. (RemoteSession sets its own field for thin clients.)
+   */
+  get providerAdmin(): ProviderAdminView | undefined {
+    return this.services.get<ProviderAdminView>('providerAdmin');
+  }
+
+  /**
+   * The MCP-admin capability (enable/detach/list MCP servers), read by the
+   * runner's mcp handlers + the desktop. @moxxy/plugin-mcp publishes it on the
+   * service registry in its onInit. (RemoteSession sets its own field.)
+   */
+  get mcpAdmin(): McpAdminView | undefined {
+    return this.services.get<McpAdminView>('mcpAdmin');
+  }
+
   appContext(): AppContext {
     if (!this.envSnapshot) {
       this.envSnapshot = Object.freeze({ ...process.env });
@@ -376,6 +456,7 @@ export class Session implements ClientSession, SessionRuntime {
       cwd: this.cwd,
       log: this.log.asReader(),
       env: this.envSnapshot,
+      services: this.services,
     };
   }
 

package/src/sessions/jsonl-event-store.ts

@@ -0,0 +1,31 @@
+import type { EventStoreDef, EventStoreScope, EventStoreSession } from '@moxxy/sdk';
+import { SessionPersistence, readEventPage, restoreEvents } from './persistence.js';
+
+/**
+ * The built-in EventStore: per-session JSONL (`~/.moxxy/sessions/<id>.jsonl`) +
+ * a `.json` meta sidecar. A thin adapter over the battle-tested
+ * {@link SessionPersistence} (write) and `restoreEvents`/`readEventPage` (read)
+ * — zero behaviour change, just expressed behind the {@link EventStoreDef}
+ * contract. Core seeds this as the protected floor: a plugin can register an
+ * alternative store, but it never auto-activates (the user opts in by name via
+ * `plugins.eventStore.default`).
+ *
+ * `SessionPersistence` already exposes the full {@link EventStoreSession}
+ * surface (attach/flush/settleWrites/updateHeader/degraded), so `open` returns
+ * one directly.
+ */
+export const jsonlEventStore: EventStoreDef = {
+  name: 'jsonl',
+  open(scope: EventStoreScope): EventStoreSession {
+    return new SessionPersistence({
+      sessionId: scope.sessionId,
+      cwd: scope.cwd,
+      ...(scope.dir ? { dir: scope.dir } : {}),
+      ...(scope.providerName ? { providerName: scope.providerName } : {}),
+      ...(scope.modelId ? { modelId: scope.modelId } : {}),
+      ...(scope.source ? { source: scope.source } : {}),
+    });
+  },
+  restore: (sessionId, dir) => restoreEvents(sessionId, dir),
+  readPage: (sessionId, opts, dir) => readEventPage(sessionId, opts, dir),
+};

package/src/sessions/persistence.ts

@@ -19,59 +19,22 @@
 import { constants as fsConstants, promises as fs } from 'node:fs';
 import * as path from 'node:path';
 import { createMutex, type Mutex, type MoxxyEvent, type SessionId } from '@moxxy/sdk';
+import type { EventLogLike, EventPage, SessionMeta, SessionSource } from '@moxxy/sdk';
 import { moxxyPath, writeFileAtomic } from '@moxxy/sdk/server';
-import type { EventLog } from '../events/log.js';
 import { createLogger, type Logger } from '../logger.js';
 
-/**
- * The channel that originated a session. Persisted into the sidecar by the
- * runner so every surface (desktop/TUI/mobile) derives the session list from a
- * single source instead of each keeping its own copy. `desktop`/`mobile`
- * sessions are kept in the derived workspace list even before they have a first
- * prompt (a brand-new chat the user just opened); empty `cli`/`tui` sidecars are
- * dropped as noise.
- */
-export type SessionSource = 'cli' | 'tui' | 'desktop' | 'mobile';
+// `SessionSource`, `SessionMeta` and `EventPage` are the EventStore contract's
+// data shapes — defined in @moxxy/sdk so `EventStoreDef` can reference them.
+// Re-exported here (and onward from @moxxy/core) so existing importers are
+// unaffected by the move.
+export type { EventLogLike, EventPage, SessionMeta, SessionSource } from '@moxxy/sdk';
 
 /** Schema version of the per-session metadata file (`<id>.json`). Bump when the
  *  shape changes incompatibly; readers tolerate a missing/older version. */
 export const SESSION_META_VERSION = 1;
 
-/**
- * The single per-session metadata file: `~/.moxxy/sessions/<id>.json`.
- *
- * ONE file per session, the unit every surface (TUI/desktop/mobile) lists,
- * searches and caches. The conversation itself lives in the append-only
- * `<id>.jsonl`. Fields split by owner:
- *  - the RUNNER owns the content fields (`firstPrompt`, `eventCount`,
- *    `lastActivity`, `provider`, `model`, `startedAt`, `source`) and rewrites
- *    them on a debounce;
- *  - the UI owns `title` (a rename) and `groupId` (which desk it belongs to).
- * Because both write the same file, the runner ADOPTS the UI fields on attach
- * and re-merges them just before each write, so a live session never clobbers a
- * rename or a move.
- */
-export interface SessionMeta {
-  /** Schema version; absent on older files (treated as v0). */
-  readonly version?: number;
-  readonly id: string;
-  readonly cwd: string;
-  readonly startedAt: string;
-  readonly lastActivity: string;
-  readonly eventCount: number;
-  /** First 80 chars of the first user_prompt. The list/search label. */
-  readonly firstPrompt: string | null;
-  readonly provider: string | null;
-  readonly model: string | null;
-  /** Originating channel, when known. Written by the runner via `opts.source`. */
-  readonly source?: SessionSource;
-  /** Explicit workspace/desk membership (UI-owned). `null`/absent → grouped by
-   *  cwd containment (CLI/TUI sessions that don't know about desks). */
-  readonly groupId?: string | null;
-  /** User-set display name, the rename (UI-owned). `null`/absent → the name is
-   *  derived from `firstPrompt`. */
-  readonly title?: string | null;
-}
+// `SessionMeta` is defined in @moxxy/sdk (the EventStore contract's listing
+// shape) and re-exported above. The JSONL impl below reads/writes it.
 
 export interface SessionPersistenceOpts {
   readonly sessionId: SessionId;
@@ -216,7 +179,7 @@ export class SessionPersistence {
    * in the same (now empty) JSONL, matching how the in-memory log
    * reuses the same Session object.
    */
-  attach(log: EventLog): () => void {
+  attach(log: EventLogLike): () => void {
     void this.ensureReady()
       .then(() => this.scheduleIndexWrite())
       .catch(() => undefined);
@@ -679,18 +642,8 @@ export async function restoreEvents(
   return events;
 }
 
-/** One page of persisted events, newest-page-first paging (see
- *  {@link readEventPage}). */
-export interface EventPage {
-  /** The events in this page, in ascending `seq` order. */
-  readonly events: MoxxyEvent[];
-  /**
-   * Cursor to pass as `before` for the NEXT (older) page — the `seq` of the
-   * OLDEST event in this page. `null` once the start of history (the first
-   * persisted event) is included, signalling there is no older page.
-   */
-  readonly prevCursor: number | null;
-}
+// `EventPage` is defined in @moxxy/sdk (the EventStore read contract) and
+// re-exported above; `readEventPage`/`pageEvents` below produce it.
 
 /**
  * Read ONE page of a persisted session's events without re-materializing the

package/src/subagents/run-child.ts

@@ -447,6 +447,7 @@ function buildChildContext(
     turnId: childTurnId,
     cwd: parentAppCtx.cwd,
     env: parentAppCtx.env,
+    services: parentAppCtx.services,
     model,
     ...(spec.systemPrompt !== undefined ? { systemPrompt: spec.systemPrompt } : {}),
     provider: parentSession.providers.getActive(),
@@ -457,6 +458,7 @@ function buildChildContext(
     cacheStrategy: parentSession.cacheStrategies.getActive(),
     ...(parentSession.elisionSettings ? { elision: parentSession.elisionSettings } : {}),
     ...(parentSession.lazyTools ? { lazyTools: true } : {}),
+    ...(parentSession.loopGuard ? { loopGuard: parentSession.loopGuard } : {}),
     permissions: parentSession.resolver,
     // Intentionally no `approval` — fanning approval gates out to N
     // children in parallel would prompt the user N times. Strategies

package/dist/preferences.d.ts

@@ -1,40 +0,0 @@
-/**
- * User-level runtime preferences persisted at ~/.moxxy/preferences.json.
- * Distinct from `~/.moxxy/config.yaml` (user-edited, source of truth for
- * provider/plugin wiring) — this file is mutated by the TUI as the user
- * picks a model / loop strategy via slash commands, so it survives across
- * CLI invocations. A missing file or unreadable contents is a no-op:
- * preferences are best-effort, never load-blocking.
- */
-export interface MoxxyPreferences {
-    /** Active provider name (e.g. "openai", "anthropic"). */
-    readonly providerName?: string;
-    /** Active model id under that provider (e.g. "gpt-5.4-mini"). */
-    readonly model?: string;
-    /** Active loop strategy name (e.g. "default", "research", "goal"). */
-    readonly mode?: string;
-    /**
-     * Providers the user disabled (desktop Settings → Providers toggle).
-     * Seeded into the ProviderRegistry at boot; a listed provider stays
-     * registered but can't be activated until re-enabled.
-     */
-    readonly disabledProviders?: ReadonlyArray<string>;
-}
-export declare function preferencesPath(): string;
-/**
- * Read preferences from disk. Returns an empty object when the file
- * doesn't exist or fails to parse — preferences are an optional layer,
- * never a hard dependency of session bootstrap.
- */
-export declare function loadPreferences(): Promise<MoxxyPreferences>;
-/**
- * Merge-and-write preferences. Reads the current file (if any), merges
- * the patch on top so we don't blow away unrelated fields, and writes
- * the result back atomically. The whole read-merge-write runs inside a
- * module-level mutex so overlapping saves serialize (invariant #5) and
- * never lose an update. Best-effort: a write failure logs to stderr but
- * does not throw — the user's pick still takes effect in this session,
- * just won't persist across invocations.
- */
-export declare function savePreferences(patch: Partial<MoxxyPreferences>): Promise<void>;
-//# sourceMappingURL=preferences.d.ts.map

package/dist/preferences.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"preferences.d.ts","sourceRoot":"","sources":["../src/preferences.ts"],"names":[],"mappings":"AAIA;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACpD;AAED,wBAAgB,eAAe,IAAI,MAAM,CAKxC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAYjE;AAUD;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAcrF"}

package/dist/preferences.js

@@ -1,59 +0,0 @@
-import { promises as fs } from 'node:fs';
-import { createMutex, migrateModeName } from '@moxxy/sdk';
-import { moxxyPath, writeFileAtomic } from '@moxxy/sdk/server';
-export function preferencesPath() {
-    // Route through `moxxyPath` so a `$MOXXY_HOME` override relocates preferences
-    // alongside the rest of the data dir (config.yaml, vault, providers.json, …).
-    // Identical to `~/.moxxy/preferences.json` when MOXXY_HOME is unset.
-    return moxxyPath('preferences.json');
-}
-/**
- * Read preferences from disk. Returns an empty object when the file
- * doesn't exist or fails to parse — preferences are an optional layer,
- * never a hard dependency of session bootstrap.
- */
-export async function loadPreferences() {
-    try {
-        const raw = await fs.readFile(preferencesPath(), 'utf8');
-        const parsed = JSON.parse(raw);
-        if (parsed && typeof parsed === 'object') {
-            const prefs = parsed;
-            return prefs.mode ? { ...prefs, mode: migrateModeName(prefs.mode) } : prefs;
-        }
-        return {};
-    }
-    catch {
-        return {};
-    }
-}
-// Serializes the read-modify-write in `savePreferences` so two concurrent
-// saves (e.g. a /model pick and a provider-disable toggle firing close
-// together) can't both read the same snapshot and have the second write
-// clobber the first's field. This is the single write path for the file —
-// other packages (CLI, runner, channels) route their fire-and-forget saves
-// through it, and any load-modify-save must go through it too.
-const writeMutex = createMutex();
-/**
- * Merge-and-write preferences. Reads the current file (if any), merges
- * the patch on top so we don't blow away unrelated fields, and writes
- * the result back atomically. The whole read-merge-write runs inside a
- * module-level mutex so overlapping saves serialize (invariant #5) and
- * never lose an update. Best-effort: a write failure logs to stderr but
- * does not throw — the user's pick still takes effect in this session,
- * just won't persist across invocations.
- */
-export async function savePreferences(patch) {
-    return writeMutex.run(async () => {
-        const current = await loadPreferences();
-        const next = { ...current, ...patch };
-        const target = preferencesPath();
-        try {
-            await writeFileAtomic(target, JSON.stringify(next, null, 2) + '\n');
-        }
-        catch (err) {
-            process.stderr.write(`moxxy: failed to persist preferences to ${target}: ` +
-                `${err instanceof Error ? err.message : String(err)}\n`);
-        }
-    });
-}
-//# sourceMappingURL=preferences.js.map

package/dist/preferences.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"preferences.js","sourceRoot":"","sources":["../src/preferences.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAyB/D,MAAM,UAAU,eAAe;IAC7B,8EAA8E;IAC9E,8EAA8E;IAC9E,qEAAqE;IACrE,OAAO,SAAS,CAAC,kBAAkB,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,MAA0B,CAAC;YACzC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9E,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,uEAAuE;AACvE,wEAAwE;AACxE,0EAA0E;AAC1E,2EAA2E;AAC3E,+DAA+D;AAC/D,MAAM,UAAU,GAAG,WAAW,EAAE,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAgC;IACpE,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;QAC/B,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;QACxC,MAAM,IAAI,GAAqB,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2CAA2C,MAAM,IAAI;gBACnD,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/src/preferences.test.ts

@@ -1,156 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { promises as fs } from 'node:fs';
-import * as os from 'node:os';
-import * as path from 'node:path';
-import { loadPreferences, preferencesPath, savePreferences } from './preferences.js';
-
-// preferencesPath() resolves ~/.moxxy/preferences.json via os.homedir(), which
-// derives from HOME (POSIX) / USERPROFILE (Windows). Point both at a tmpdir per
-// test so the suite never touches the developer's real preferences file.
-let tmpHome: string;
-let savedHome: string | undefined;
-let savedUserProfile: string | undefined;
-let savedMoxxyHome: string | undefined;
-
-beforeEach(async () => {
-  tmpHome = await fs.mkdtemp(path.join(os.tmpdir(), 'mox-prefs-'));
-  savedHome = process.env.HOME;
-  savedUserProfile = process.env.USERPROFILE;
-  savedMoxxyHome = process.env.MOXXY_HOME;
-  process.env.HOME = tmpHome;
-  process.env.USERPROFILE = tmpHome;
-  // The default-home tests below assert the `~/.moxxy` fallback, so MOXXY_HOME
-  // must be unset for them (it would otherwise win).
-  delete process.env.MOXXY_HOME;
-  await fs.mkdir(path.join(tmpHome, '.moxxy'), { recursive: true });
-});
-
-afterEach(async () => {
-  if (savedHome === undefined) delete process.env.HOME;
-  else process.env.HOME = savedHome;
-  if (savedUserProfile === undefined) delete process.env.USERPROFILE;
-  else process.env.USERPROFILE = savedUserProfile;
-  if (savedMoxxyHome === undefined) delete process.env.MOXXY_HOME;
-  else process.env.MOXXY_HOME = savedMoxxyHome;
-  await fs.rm(tmpHome, { recursive: true, force: true });
-});
-
-const readRaw = async (): Promise<unknown> =>
-  JSON.parse(await fs.readFile(preferencesPath(), 'utf8'));
-
-describe('preferences store', () => {
-  it('resolves the path under the (overridden) home dir', () => {
-    expect(preferencesPath()).toBe(path.join(tmpHome, '.moxxy', 'preferences.json'));
-  });
-
-  it('honors $MOXXY_HOME so preferences follow the relocated data dir', async () => {
-    const altHome = await fs.mkdtemp(path.join(os.tmpdir(), 'mox-prefs-alt-'));
-    const prevMoxxyHome = process.env.MOXXY_HOME;
-    process.env.MOXXY_HOME = altHome;
-    try {
-      // Path now lives directly under MOXXY_HOME, NOT under ~/.moxxy.
-      expect(preferencesPath()).toBe(path.join(altHome, 'preferences.json'));
-      await savePreferences({ model: 'relocated' });
-      // Written to the relocated dir, not the homedir fallback.
-      const raw = await fs.readFile(path.join(altHome, 'preferences.json'), 'utf8');
-      expect(JSON.parse(raw).model).toBe('relocated');
-      // The homedir fallback location must remain empty.
-      await expect(
-        fs.readFile(path.join(tmpHome, '.moxxy', 'preferences.json'), 'utf8'),
-      ).rejects.toMatchObject({ code: 'ENOENT' });
-    } finally {
-      if (prevMoxxyHome === undefined) delete process.env.MOXXY_HOME;
-      else process.env.MOXXY_HOME = prevMoxxyHome;
-      await fs.rm(altHome, { recursive: true, force: true });
-    }
-  });
-
-  it('returns an empty object when the file is missing', async () => {
-    expect(await loadPreferences()).toEqual({});
-  });
-
-  it('returns an empty object when the file is corrupt', async () => {
-    await fs.writeFile(preferencesPath(), '{ not json', 'utf8');
-    expect(await loadPreferences()).toEqual({});
-  });
-
-  it('round-trips a patch through disk', async () => {
-    await savePreferences({ model: 'gpt-5.4-mini', providerName: 'openai' });
-    const loaded = await loadPreferences();
-    expect(loaded.model).toBe('gpt-5.4-mini');
-    expect(loaded.providerName).toBe('openai');
-  });
-
-  it('merges a second patch without clobbering unrelated fields', async () => {
-    await savePreferences({ providerName: 'openai' });
-    await savePreferences({ model: 'gpt-5.4-mini' });
-    const loaded = await loadPreferences();
-    expect(loaded.providerName).toBe('openai');
-    expect(loaded.model).toBe('gpt-5.4-mini');
-  });
-
-  it('migrates legacy mode names on load', async () => {
-    // "tool-use" is the legacy id that migrateModeName maps to "default".
-    await fs.writeFile(
-      preferencesPath(),
-      JSON.stringify({ mode: 'tool-use' }) + '\n',
-      'utf8',
-    );
-    const loaded = await loadPreferences();
-    expect(loaded.mode).toBe('default');
-  });
-
-  it('writes a trailing newline atomically (no partial file)', async () => {
-    await savePreferences({ model: 'm1' });
-    const raw = await fs.readFile(preferencesPath(), 'utf8');
-    expect(raw.endsWith('\n')).toBe(true);
-    expect(JSON.parse(raw)).toEqual({ model: 'm1' });
-  });
-
-  it('serializes overlapping saves so no update is lost (invariant #5)', async () => {
-    // Two patches firing concurrently each read-merge-write the same file.
-    // Without the mutex the later writer clobbers the earlier writer's field.
-    await Promise.all([
-      savePreferences({ model: 'a' }),
-      savePreferences({ mode: 'goal' }),
-    ]);
-    const loaded = await loadPreferences();
-    expect(loaded.model).toBe('a');
-    expect(loaded.mode).toBe('goal');
-  });
-
-  it('swallows a write failure: logs to stderr but never throws (best-effort contract)', async () => {
-    // savePreferences is documented best-effort — a persist failure must NOT
-    // bubble out and break the slash-command / shutdown that triggered it. Force
-    // an unwritable target by pointing MOXXY_HOME *under a regular file*, so the
-    // atomic writer's `mkdir(dirname)` fails with ENOTDIR.
-    const blocker = path.join(tmpHome, 'not-a-dir');
-    await fs.writeFile(blocker, 'x', 'utf8');
-    const prevMoxxyHome = process.env.MOXXY_HOME;
-    process.env.MOXXY_HOME = path.join(blocker, 'nested'); // dirname is a file → mkdir fails
-    const stderr = vi.spyOn(process.stderr, 'write').mockReturnValue(true);
-    try {
-      // Must resolve, not reject — the pick still took effect in-session.
-      await expect(savePreferences({ model: 'm' })).resolves.toBeUndefined();
-      // The failure is surfaced (not silently swallowed) on stderr.
-      expect(stderr).toHaveBeenCalled();
-    } finally {
-      stderr.mockRestore();
-      if (prevMoxxyHome === undefined) delete process.env.MOXXY_HOME;
-      else process.env.MOXXY_HOME = prevMoxxyHome;
-    }
-  });
-
-  it('keeps ALL distinct keys present under many overlapping writers', async () => {
-    const patches: Array<Partial<Record<`k${number}`, string>>> = [];
-    for (let i = 0; i < 25; i++) patches.push({ [`k${i}`]: `v${i}` });
-    // Fire all saves at once; each merges a distinct key.
-    await Promise.all(
-      patches.map((p) => savePreferences(p as Record<string, string>)),
-    );
-    const loaded = (await readRaw()) as Record<string, string>;
-    for (let i = 0; i < 25; i++) {
-      expect(loaded[`k${i}`]).toBe(`v${i}`);
-    }
-  });
-});