@mseep/claudian 2.0.25

package/tests/unit/core/providers/modelSelection.test.ts

@@ -0,0 +1,155 @@
+import {
+  decodeProviderModelSelectionId,
+  encodeProviderModelSelectionId,
+  getProviderModelSelectionPrefix,
+  isProviderModelSelectionId,
+  toProviderRuntimeModelId,
+} from '@/core/providers/modelSelection';
+
+describe('model selection namespacing', () => {
+  describe('getProviderModelSelectionPrefix', () => {
+    it('returns the registered prefix for each known provider', () => {
+      expect(getProviderModelSelectionPrefix('claude')).toBe('claude-code/');
+      expect(getProviderModelSelectionPrefix('codex')).toBe('openai-codex/');
+      expect(getProviderModelSelectionPrefix('opencode')).toBe('opencode/');
+      expect(getProviderModelSelectionPrefix('pi')).toBe('pi/');
+    });
+
+    it('returns null for a provider with no registered prefix', () => {
+      expect(getProviderModelSelectionPrefix('unknown-provider')).toBeNull();
+    });
+  });
+
+  describe('encodeProviderModelSelectionId', () => {
+    it('prefixes a bare model id with the provider namespace', () => {
+      expect(encodeProviderModelSelectionId('claude', 'deepseek-v4-pro')).toBe('claude-code/deepseek-v4-pro');
+      expect(encodeProviderModelSelectionId('codex', 'gpt-5-custom')).toBe('openai-codex/gpt-5-custom');
+    });
+
+    it('is idempotent: an already-namespaced id is returned unchanged', () => {
+      const namespaced = 'claude-code/deepseek-v4-pro';
+      expect(encodeProviderModelSelectionId('claude', namespaced)).toBe(namespaced);
+    });
+
+    it('trims surrounding whitespace before prefixing', () => {
+      expect(encodeProviderModelSelectionId('claude', '  deepseek-v4-pro  ')).toBe('claude-code/deepseek-v4-pro');
+    });
+
+    it('returns an empty string for empty or whitespace-only input', () => {
+      expect(encodeProviderModelSelectionId('claude', '')).toBe('');
+      expect(encodeProviderModelSelectionId('claude', '   ')).toBe('');
+    });
+
+    // encode only guards against its OWN prefix, so a value that already carries a
+    // different provider's namespace is treated as opaque and re-prefixed. This is
+    // acceptable because callers only ever encode bare ids they own.
+    it('re-prefixes a value that carries another provider namespace', () => {
+      expect(encodeProviderModelSelectionId('claude', 'openai-codex/gpt-5')).toBe('claude-code/openai-codex/gpt-5');
+    });
+
+    it('leaves the id untouched when the provider has no registered prefix', () => {
+      expect(encodeProviderModelSelectionId('unknown-provider', 'deepseek-v4-pro')).toBe('deepseek-v4-pro');
+    });
+  });
+
+  describe('decodeProviderModelSelectionId', () => {
+    it('decodes a namespaced id into its provider and model id', () => {
+      expect(decodeProviderModelSelectionId('claude-code/deepseek-v4-pro')).toEqual({
+        providerId: 'claude',
+        modelId: 'deepseek-v4-pro',
+      });
+      expect(decodeProviderModelSelectionId('openai-codex/gpt-5')).toEqual({
+        providerId: 'codex',
+        modelId: 'gpt-5',
+      });
+      expect(decodeProviderModelSelectionId('opencode/qwen')).toEqual({
+        providerId: 'opencode',
+        modelId: 'qwen',
+      });
+      expect(decodeProviderModelSelectionId('pi/assistant')).toEqual({
+        providerId: 'pi',
+        modelId: 'assistant',
+      });
+    });
+
+    it('returns null for empty or whitespace-only input', () => {
+      expect(decodeProviderModelSelectionId('')).toBeNull();
+      expect(decodeProviderModelSelectionId('   ')).toBeNull();
+    });
+
+    it('returns null for a non-namespaced model id', () => {
+      expect(decodeProviderModelSelectionId('deepseek-v4-pro')).toBeNull();
+      expect(decodeProviderModelSelectionId('sonnet')).toBeNull();
+    });
+
+    it('returns null when only the prefix is present (no model id)', () => {
+      expect(decodeProviderModelSelectionId('claude-code/')).toBeNull();
+      expect(decodeProviderModelSelectionId('openai-codex/   ')).toBeNull();
+    });
+
+    it('trims surrounding whitespace before decoding', () => {
+      expect(decodeProviderModelSelectionId('  claude-code/deepseek-v4-pro  ')).toEqual({
+        providerId: 'claude',
+        modelId: 'deepseek-v4-pro',
+      });
+    });
+  });
+
+  describe('isProviderModelSelectionId', () => {
+    it('is true for a value carrying the given provider namespace', () => {
+      expect(isProviderModelSelectionId('claude', 'claude-code/deepseek-v4-pro')).toBe(true);
+      expect(isProviderModelSelectionId('codex', 'openai-codex/gpt-5')).toBe(true);
+    });
+
+    // The cross-provider check is the core invariant that lets identically-named
+    // custom models coexist: a claude-namespaced id must NOT be claimed by codex.
+    it('is false for a value carrying a different provider namespace', () => {
+      expect(isProviderModelSelectionId('codex', 'claude-code/deepseek-v4-pro')).toBe(false);
+      expect(isProviderModelSelectionId('claude', 'openai-codex/gpt-5')).toBe(false);
+    });
+
+    it('is false for a bare model id and for empty input', () => {
+      expect(isProviderModelSelectionId('claude', 'deepseek-v4-pro')).toBe(false);
+      expect(isProviderModelSelectionId('claude', '')).toBe(false);
+    });
+  });
+
+  describe('toProviderRuntimeModelId', () => {
+    it('strips the namespace when the value belongs to the given provider', () => {
+      expect(toProviderRuntimeModelId('claude', 'claude-code/deepseek-v4-pro')).toBe('deepseek-v4-pro');
+      expect(toProviderRuntimeModelId('codex', 'openai-codex/gpt-5')).toBe('gpt-5');
+    });
+
+    it('leaves a bare model id unchanged', () => {
+      expect(toProviderRuntimeModelId('claude', 'deepseek-v4-pro')).toBe('deepseek-v4-pro');
+    });
+
+    // Never strip another provider's namespace: handing it through verbatim is what
+    // keeps a stray cross-provider id from being misrouted at the runtime seam.
+    it('leaves a value unchanged when it carries another provider namespace', () => {
+      expect(toProviderRuntimeModelId('codex', 'claude-code/deepseek-v4-pro')).toBe('claude-code/deepseek-v4-pro');
+    });
+
+    it('returns an empty string unchanged', () => {
+      expect(toProviderRuntimeModelId('claude', '')).toBe('');
+    });
+  });
+
+  describe('encode/decode round-trip', () => {
+    it.each([
+      ['claude', 'claude-code/', 'deepseek-v4-pro'],
+      ['codex', 'openai-codex/', 'gpt-5-custom'],
+      ['opencode', 'opencode/', 'qwen-max'],
+      ['pi', 'pi/', 'assistant-1'],
+    ] as const)('round-trips a %s model id through encode and toRuntimeModelId', (providerId, prefix, modelId) => {
+      const encoded = encodeProviderModelSelectionId(providerId, modelId);
+      expect(encoded).toBe(`${prefix}${modelId}`);
+      // Stripping the runtime id must recover the original bare model id.
+      expect(toProviderRuntimeModelId(providerId, encoded)).toBe(modelId);
+      // Encoding is idempotent, so re-encoding never double-prefixes.
+      expect(encodeProviderModelSelectionId(providerId, encoded)).toBe(encoded);
+      // Decoding must attribute the id back to the owning provider.
+      expect(decodeProviderModelSelectionId(encoded)).toEqual({ providerId, modelId });
+    });
+  });
+});

package/tests/unit/core/providers/providerEnvironment.test.ts

@@ -0,0 +1,162 @@
+import '@/providers';
+
+import {
+  classifyEnvironmentVariablesByOwnership,
+  getEnvironmentReviewKeysForScope,
+  getEnvironmentScopeUpdates,
+  getProviderEnvironmentVariables,
+  getRuntimeEnvironmentText,
+  getSharedEnvironmentVariables,
+  inferEnvironmentSnippetScope,
+  resolveEnvironmentSnippetScope,
+  setProviderEnvironmentVariables,
+  setSharedEnvironmentVariables,
+} from '@/core/providers/providerEnvironment';
+
+describe('providerEnvironment', () => {
+  describe('classifyEnvironmentVariablesByOwnership', () => {
+    it('splits shared, Claude, and Codex vars by ownership', () => {
+      const result = classifyEnvironmentVariablesByOwnership([
+        'PATH=/usr/local/bin',
+        'ANTHROPIC_API_KEY=claude-key',
+        'OPENAI_API_KEY=codex-key',
+        'CODEX_SANDBOX=workspace-write',
+        'CUSTOM_FLAG=1',
+      ].join('\n'));
+
+      expect(result.shared).toBe(['PATH=/usr/local/bin', 'CUSTOM_FLAG=1'].join('\n'));
+      expect(result.providers.claude).toBe('ANTHROPIC_API_KEY=claude-key');
+      expect(result.providers.codex).toBe([
+        'OPENAI_API_KEY=codex-key',
+        'CODEX_SANDBOX=workspace-write',
+      ].join('\n'));
+      expect(result.reviewKeys).toEqual(['CUSTOM_FLAG']);
+    });
+
+    it('keeps comments attached to the next owned variable when migrating', () => {
+      const result = classifyEnvironmentVariablesByOwnership([
+        '# shared comment',
+        'PATH=/usr/local/bin',
+        '',
+        '# claude comment',
+        'ANTHROPIC_MODEL=claude-custom',
+      ].join('\n'));
+
+      expect(result.shared).toBe(['# shared comment', 'PATH=/usr/local/bin'].join('\n'));
+      expect(result.providers.claude).toBe(['', '# claude comment', 'ANTHROPIC_MODEL=claude-custom'].join('\n'));
+    });
+  });
+
+  describe('runtime env accessors', () => {
+    it('reads split shared/provider env from settings', () => {
+      const settings: Record<string, unknown> = {
+        sharedEnvironmentVariables: 'PATH=/usr/local/bin',
+        providerConfigs: {
+          claude: { environmentVariables: 'ANTHROPIC_MODEL=custom-model' },
+        },
+      };
+
+      expect(getSharedEnvironmentVariables(settings)).toBe('PATH=/usr/local/bin');
+      expect(getProviderEnvironmentVariables(settings, 'claude')).toBe('ANTHROPIC_MODEL=custom-model');
+      expect(getRuntimeEnvironmentText(settings, 'claude')).toBe([
+        'PATH=/usr/local/bin',
+        'ANTHROPIC_MODEL=custom-model',
+      ].join('\n'));
+    });
+
+    it('falls back to classifying legacy single-bag env settings', () => {
+      const settings: Record<string, unknown> = {
+        environmentVariables: [
+          'PATH=/usr/local/bin',
+          'ANTHROPIC_MODEL=claude-custom',
+          'OPENAI_MODEL=gpt-custom',
+        ].join('\n'),
+      };
+
+      expect(getSharedEnvironmentVariables(settings)).toBe('PATH=/usr/local/bin');
+      expect(getProviderEnvironmentVariables(settings, 'claude')).toBe('ANTHROPIC_MODEL=claude-custom');
+      expect(getProviderEnvironmentVariables(settings, 'codex')).toBe('OPENAI_MODEL=gpt-custom');
+    });
+
+    it('updates split env settings through scoped setters', () => {
+      const settings: Record<string, unknown> = {};
+
+      setSharedEnvironmentVariables(settings, 'PATH=/usr/local/bin');
+      setProviderEnvironmentVariables(settings, 'codex', 'OPENAI_API_KEY=test-key');
+
+      expect(settings.sharedEnvironmentVariables).toBe('PATH=/usr/local/bin');
+      expect(settings.providerConfigs).toEqual({
+        codex: { environmentVariables: 'OPENAI_API_KEY=test-key' },
+      });
+    });
+  });
+
+  describe('getEnvironmentReviewKeysForScope', () => {
+    it('flags unknown keys left in shared env for manual review', () => {
+      const reviewKeys = getEnvironmentReviewKeysForScope([
+        'PATH=/usr/local/bin',
+        'CUSTOM_FLAG=1',
+      ].join('\n'), 'shared');
+
+      expect(reviewKeys).toEqual(['CUSTOM_FLAG']);
+    });
+
+    it('flags shared and foreign-provider keys in provider env sections', () => {
+      const reviewKeys = getEnvironmentReviewKeysForScope([
+        'PATH=/usr/local/bin',
+        'OPENAI_API_KEY=test-key',
+        'CUSTOM_FLAG=1',
+      ].join('\n'), 'provider:claude');
+
+      expect(reviewKeys).toEqual(['PATH', 'OPENAI_API_KEY', 'CUSTOM_FLAG']);
+    });
+  });
+
+  describe('inferEnvironmentSnippetScope', () => {
+    it('returns shared for neutral-only snippets', () => {
+      expect(inferEnvironmentSnippetScope('PATH=/usr/local/bin')).toBe('shared');
+    });
+
+    it('returns provider scope for single-provider snippets', () => {
+      expect(inferEnvironmentSnippetScope('OPENAI_MODEL=gpt-custom')).toBe('provider:codex');
+    });
+
+    it('keeps mixed-ownership legacy snippets unscoped', () => {
+      expect(inferEnvironmentSnippetScope([
+        'PATH=/usr/local/bin',
+        'ANTHROPIC_MODEL=claude-custom',
+      ].join('\n'))).toBeUndefined();
+    });
+  });
+
+  describe('resolveEnvironmentSnippetScope', () => {
+    it('normalizes mixed snippets back to unscoped even if a stale scope was saved', () => {
+      expect(resolveEnvironmentSnippetScope([
+        'PATH=/usr/local/bin',
+        'ANTHROPIC_MODEL=claude-custom',
+      ].join('\n'), 'shared')).toBeUndefined();
+    });
+
+    it('keeps the fallback scope only for empty snippets', () => {
+      expect(resolveEnvironmentSnippetScope('', 'provider:codex')).toBe('provider:codex');
+    });
+  });
+
+  describe('getEnvironmentScopeUpdates', () => {
+    it('reclassifies mixed snippets into separate scope updates', () => {
+      expect(getEnvironmentScopeUpdates([
+        'PATH=/usr/local/bin',
+        'ANTHROPIC_MODEL=claude-custom',
+      ].join('\n'), 'shared')).toEqual([
+        { scope: 'shared', envText: 'PATH=/usr/local/bin' },
+        { scope: 'provider:claude', envText: 'ANTHROPIC_MODEL=claude-custom' },
+      ]);
+    });
+
+    it('uses the fallback scope only when there is no inferable content', () => {
+      expect(getEnvironmentScopeUpdates('', 'provider:claude')).toEqual([
+        { scope: 'provider:claude', envText: '' },
+      ]);
+    });
+  });
+});

package/tests/unit/core/providers/tabLifecycle.test.ts

@@ -0,0 +1,217 @@
+import '@/providers';
+
+/**
+ * Tests for the model-driven multi-provider tab lifecycle.
+ *
+ * Covers transition-heavy cases:
+ * - blank → first send
+ * - blank → history bind
+ * - bound_cold → send
+ * - active → close
+ * - restore/switch staying cold
+ * - Codex-disable fallback
+ * - duplicate-owner prevention
+ * - provider lock after bind
+ */
+import { getProviderForModel } from '@/core/providers/modelRouting';
+import { DEFAULT_CODEX_PRIMARY_MODEL } from '@/providers/codex/types/models';
+
+describe('Tab Lifecycle - Model-Driven Provider Routing', () => {
+  describe('getProviderForModel', () => {
+    it('derives claude from Claude model names', () => {
+      expect(getProviderForModel('haiku')).toBe('claude');
+      expect(getProviderForModel('sonnet')).toBe('claude');
+      expect(getProviderForModel('opus')).toBe('claude');
+      expect(getProviderForModel('claude-sonnet-4-5-20250514')).toBe('claude');
+    });
+
+    it('derives codex from Codex model names', () => {
+      expect(getProviderForModel(DEFAULT_CODEX_PRIMARY_MODEL)).toBe('codex');
+      expect(getProviderForModel('gpt-4o')).toBe('codex');
+      expect(getProviderForModel('o3')).toBe('codex');
+      expect(getProviderForModel('o4-mini')).toBe('codex');
+    });
+
+    it('defaults unknown models to claude', () => {
+      expect(getProviderForModel('custom-model')).toBe('claude');
+      expect(getProviderForModel('')).toBe('claude');
+    });
+
+    it('does not route "obsidian" to codex (no digit after o)', () => {
+      expect(getProviderForModel('obsidian')).toBe('claude');
+    });
+  });
+});
+
+describe('Tab Lifecycle - Blank Tab Behavior', () => {
+  it('blank tabs start in blank lifecycle state with draft model', () => {
+    // Simulated tab state (not importing Tab module to keep this unit-level)
+    const tab = {
+      lifecycleState: 'blank' as const,
+      draftModel: 'haiku',
+      conversationId: null,
+      service: null,
+      serviceInitialized: false,
+    };
+
+    expect(tab.lifecycleState).toBe('blank');
+    expect(tab.draftModel).toBe('haiku');
+    expect(tab.conversationId).toBeNull();
+    expect(tab.service).toBeNull();
+    expect(tab.serviceInitialized).toBe(false);
+  });
+
+  it('blank tabs derive provider from draft model selection', () => {
+    expect(getProviderForModel(DEFAULT_CODEX_PRIMARY_MODEL)).toBe('codex');
+    expect(getProviderForModel('sonnet')).toBe('claude');
+  });
+
+  it('blank tab with Codex draft model should fall back when Codex is disabled', () => {
+    const draftModel = DEFAULT_CODEX_PRIMARY_MODEL;
+    const draftProvider = getProviderForModel(draftModel);
+
+    // Verify the draft is Codex
+    expect(draftProvider).toBe('codex');
+
+    // When Codex disabled, fallback model should route to Claude
+    const fallbackModel = 'haiku';
+    const fallbackProvider = getProviderForModel(fallbackModel);
+    expect(fallbackProvider).toBe('claude');
+  });
+});
+
+describe('Tab Lifecycle - Provider Lock After Bind', () => {
+  it('cross-provider model change should be rejected on bound sessions', () => {
+    const boundProvider = 'claude';
+    const requestedModel = DEFAULT_CODEX_PRIMARY_MODEL;
+    const requestedProvider = getProviderForModel(requestedModel);
+
+    // Provider mismatch should be detected
+    expect(requestedProvider).not.toBe(boundProvider);
+  });
+
+  it('same-provider model change should be allowed on bound sessions', () => {
+    const boundProvider = 'claude';
+    const requestedModel = 'sonnet';
+    const requestedProvider = getProviderForModel(requestedModel);
+
+    expect(requestedProvider).toBe(boundProvider);
+  });
+
+  it('bound-cold sessions should accept same-provider model changes locally', () => {
+    const tab = {
+      lifecycleState: 'bound_cold' as const,
+      providerId: 'claude' as const,
+      serviceInitialized: false,
+      service: null,
+    };
+
+    // Changing model within same provider should not require runtime
+    const newModel = 'opus';
+    expect(getProviderForModel(newModel)).toBe(tab.providerId);
+    expect(tab.serviceInitialized).toBe(false); // Should stay cold
+  });
+});
+
+describe('Tab Lifecycle - History Bind', () => {
+  it('history selection should bind tab to persisted provider without starting runtime', () => {
+    // Simulated conversation from history
+    const conversation = {
+      id: 'conv-1',
+      providerId: 'codex' as const,
+      messages: [{ id: 'msg-1', role: 'user' as const, content: 'test' }],
+    };
+
+    // After bind, tab should be bound_cold with conversation's provider
+    const tab = {
+      lifecycleState: 'bound_cold' as const,
+      providerId: conversation.providerId,
+      conversationId: conversation.id,
+      draftModel: null,
+      service: null,
+      serviceInitialized: false,
+    };
+
+    expect(tab.lifecycleState).toBe('bound_cold');
+    expect(tab.providerId).toBe('codex');
+    expect(tab.conversationId).toBe('conv-1');
+    expect(tab.draftModel).toBeNull();
+    expect(tab.service).toBeNull();
+    expect(tab.serviceInitialized).toBe(false);
+  });
+});
+
+describe('Tab Lifecycle - Close Semantics', () => {
+  it('closing a blank tab should have no runtime to clean up', () => {
+    const tab = {
+      lifecycleState: 'blank' as const,
+      service: null,
+      serviceInitialized: false,
+    };
+
+    expect(tab.service).toBeNull();
+    // No runtime teardown needed
+  });
+
+  it('closing a bound_cold tab should not start a runtime', () => {
+    const tab = {
+      lifecycleState: 'bound_cold' as const,
+      service: null,
+      serviceInitialized: false,
+    };
+
+    expect(tab.service).toBeNull();
+    // Should not create service during close
+  });
+
+  it('closing a bound_active tab should clean up the runtime', () => {
+    const mockCleanup = jest.fn();
+    const tab = {
+      lifecycleState: 'bound_active' as const,
+      service: { cleanup: mockCleanup },
+      serviceInitialized: true,
+    };
+
+    // Simulate close behavior
+    tab.service.cleanup();
+    expect(mockCleanup).toHaveBeenCalled();
+  });
+});
+
+describe('Tab Lifecycle - Codex Disable Fallback', () => {
+  it('existing Codex sessions should remain valid when Codex is disabled', () => {
+    const codexSession = {
+      id: 'conv-codex-1',
+      providerId: 'codex' as const,
+      messages: [{ id: 'msg-1', role: 'user' as const, content: 'hello' }],
+    };
+
+    // Disabling Codex should not invalidate this session
+    const codexEnabled = false;
+
+    // Session should still be loadable
+    expect(codexSession.providerId).toBe('codex');
+    expect(codexEnabled).toBe(false);
+    // The session provider is preserved regardless of codexEnabled setting
+  });
+
+  it('blank tab with Codex draft falls back to Claude default when Codex disabled', () => {
+    const tab = {
+      lifecycleState: 'blank' as const,
+      draftModel: DEFAULT_CODEX_PRIMARY_MODEL,
+      providerId: 'codex' as const,
+    };
+
+    const codexEnabled = false;
+    const draftProvider = getProviderForModel(tab.draftModel);
+
+    if (!codexEnabled && draftProvider === 'codex') {
+      // Should fall back
+      tab.draftModel = 'haiku';
+      tab.providerId = getProviderForModel('haiku') as any;
+    }
+
+    expect(tab.draftModel).toBe('haiku');
+    expect(tab.providerId).toBe('claude');
+  });
+});

package/tests/unit/core/security/ApprovalManager.test.ts

@@ -0,0 +1,152 @@
+
+import {
+  getActionDescription,
+  getActionPattern,
+  matchesRulePattern,
+} from '../../../../src/core/security/ApprovalManager';
+
+describe('getActionPattern', () => {
+  it('extracts command from Bash tool input', () => {
+    expect(getActionPattern('Bash', { command: 'git status' })).toBe('git status');
+  });
+
+  it('trims whitespace from Bash commands', () => {
+    expect(getActionPattern('Bash', { command: '  git status  ' })).toBe('git status');
+  });
+
+  it('returns empty string for non-string Bash command', () => {
+    expect(getActionPattern('Bash', { command: 123 })).toBe('');
+  });
+
+  it('extracts file_path for Read/Write/Edit tools', () => {
+    expect(getActionPattern('Read', { file_path: '/test/file.md' })).toBe('/test/file.md');
+    expect(getActionPattern('Write', { file_path: '/test/output.md' })).toBe('/test/output.md');
+    expect(getActionPattern('Edit', { file_path: '/test/edit.md' })).toBe('/test/edit.md');
+  });
+
+  it('returns null when file_path is missing', () => {
+    expect(getActionPattern('Read', {})).toBeNull();
+  });
+
+  it('extracts notebook_path for NotebookEdit tool', () => {
+    expect(getActionPattern('NotebookEdit', { notebook_path: '/test/notebook.ipynb' })).toBe('/test/notebook.ipynb');
+  });
+
+  it('falls back to file_path for NotebookEdit when notebook_path is missing', () => {
+    expect(getActionPattern('NotebookEdit', { file_path: '/test/notebook.ipynb' })).toBe('/test/notebook.ipynb');
+  });
+
+  it('returns null for NotebookEdit when both paths are missing', () => {
+    expect(getActionPattern('NotebookEdit', {})).toBeNull();
+  });
+
+  it('returns null when file_path is empty string', () => {
+    expect(getActionPattern('Read', { file_path: '' })).toBeNull();
+  });
+
+  it('extracts pattern for Glob/Grep tools', () => {
+    expect(getActionPattern('Glob', { pattern: '**/*.md' })).toBe('**/*.md');
+    expect(getActionPattern('Grep', { pattern: 'TODO' })).toBe('TODO');
+  });
+
+  it('returns JSON for unknown tools', () => {
+    expect(getActionPattern('UnknownTool', { foo: 'bar' })).toBe('{"foo":"bar"}');
+  });
+});
+
+describe('getActionDescription', () => {
+  it('describes Bash tool actions', () => {
+    expect(getActionDescription('Bash', { command: 'git status' })).toBe('Run command: git status');
+  });
+
+  it('describes file tool actions', () => {
+    expect(getActionDescription('Read', { file_path: '/f.md' })).toBe('Read file: /f.md');
+    expect(getActionDescription('Write', { file_path: '/f.md' })).toBe('Write to file: /f.md');
+    expect(getActionDescription('Edit', { file_path: '/f.md' })).toBe('Edit file: /f.md');
+  });
+
+  it('describes search tool actions', () => {
+    expect(getActionDescription('Glob', { pattern: '*.md' })).toBe('Search files matching: *.md');
+    expect(getActionDescription('Grep', { pattern: 'TODO' })).toBe('Search content matching: TODO');
+  });
+
+  it('describes unknown tools with JSON', () => {
+    expect(getActionDescription('Custom', { a: 1 })).toBe('Custom: {"a":1}');
+  });
+});
+
+describe('matchesRulePattern', () => {
+  it('matches when no rule pattern is provided', () => {
+    expect(matchesRulePattern('Bash', 'git status', undefined)).toBe(true);
+  });
+
+  it('matches wildcard rule', () => {
+    expect(matchesRulePattern('Bash', 'anything', '*')).toBe(true);
+  });
+
+  it('matches exact rule', () => {
+    expect(matchesRulePattern('Bash', 'git status', 'git status')).toBe(true);
+  });
+
+  it('rejects non-matching Bash rule without wildcard', () => {
+    expect(matchesRulePattern('Bash', 'git status', 'git commit')).toBe(false);
+  });
+
+  it('matches Bash wildcard prefix', () => {
+    expect(matchesRulePattern('Bash', 'git status', 'git *')).toBe(true);
+    expect(matchesRulePattern('Bash', 'git commit', 'git *')).toBe(true);
+    expect(matchesRulePattern('Bash', 'npm install', 'git *')).toBe(false);
+  });
+
+  it('matches Bash CC-format colon wildcard', () => {
+    expect(matchesRulePattern('Bash', 'npm install', 'npm:*')).toBe(true);
+    expect(matchesRulePattern('Bash', 'npm run build', 'npm run:*')).toBe(true);
+    expect(matchesRulePattern('Bash', 'yarn install', 'npm:*')).toBe(false);
+  });
+
+  it('does not allow Bash prefix collisions without a separator', () => {
+    expect(matchesRulePattern('Bash', 'github status', 'git:*')).toBe(false);
+    expect(matchesRulePattern('Bash', 'npmish install', 'npm:*')).toBe(false);
+    expect(matchesRulePattern('Bash', 'npm runner build', 'npm run:*')).toBe(false);
+  });
+
+  it('matches file path prefix for Read tool', () => {
+    expect(matchesRulePattern('Read', '/test/vault/notes/file.md', '/test/vault/')).toBe(true);
+    expect(matchesRulePattern('Read', '/other/path/file.md', '/test/vault/')).toBe(false);
+  });
+
+  it('respects path segment boundaries', () => {
+    expect(matchesRulePattern('Read', '/test/vault/notes/file.md', '/test/vault/notes')).toBe(true);
+    expect(matchesRulePattern('Read', '/test/vault/notes2/file.md', '/test/vault/notes')).toBe(false);
+  });
+
+  it('matches exact file path (same length, no trailing slash)', () => {
+    expect(matchesRulePattern('Read', '/test/vault/file.md', '/test/vault/file.md')).toBe(true);
+  });
+
+  it('matches file path with backslash normalization for same-length paths', () => {
+    expect(matchesRulePattern('Write', '/test/vault\\file.md', '/test/vault/file.md')).toBe(true);
+  });
+
+  it('allows simple prefix matching for non-file, non-bash tools', () => {
+    expect(matchesRulePattern('Glob', '**/*.md', '**/*')).toBe(true);
+    expect(matchesRulePattern('Grep', 'TODO in file', 'TODO')).toBe(true);
+  });
+
+  it('returns false for non-file, non-bash tools when prefix does not match', () => {
+    expect(matchesRulePattern('Glob', 'src/**', 'tests/**')).toBe(false);
+  });
+
+  it('matches exact Bash prefix without trailing space/wildcard via CC format', () => {
+    expect(matchesRulePattern('Bash', 'npm', 'npm:*')).toBe(true);
+  });
+
+  it('does not match when action pattern is null', () => {
+    expect(matchesRulePattern('Read', null, '/test/vault/')).toBe(false);
+    expect(matchesRulePattern('Read', null, '*')).toBe(false);
+  });
+
+  it('still matches when no rule pattern and action is null', () => {
+    expect(matchesRulePattern('Read', null, undefined)).toBe(true);
+  });
+});