@pi-harness/pi-harness 0.1.13 → 0.1.14

package/packages/client-web/src/vision-toolkit-view.ts

@@ -0,0 +1,280 @@
+export type VisionToolkitOperationView = "catalog" | "info";
+
+export interface VisionToolkitAssetView {
+  readonly path: string;
+  readonly mimeType: "image/png" | "image/jpeg" | "image/gif" | "image/webp";
+  readonly bytes: number;
+  readonly width: number | null;
+  readonly height: number | null;
+  readonly headerTruncated: boolean;
+}
+
+export interface VisionToolkitIssueView {
+  readonly path: string;
+  readonly reason: string;
+}
+
+export interface VisionToolkitReportView {
+  readonly assets: readonly VisionToolkitAssetView[];
+  readonly issues: readonly VisionToolkitIssueView[];
+  readonly inspectedCandidates: number;
+  readonly scannedEntries: number;
+  readonly scannedDirectories: number;
+  readonly truncated: boolean;
+  readonly issuesTruncated: boolean;
+}
+
+export type VisionToolkitStatusView =
+  | { readonly state: "idle" }
+  | { readonly state: "running"; readonly operation: VisionToolkitOperationView; readonly path?: string; readonly at: string }
+  | {
+      readonly state: "completed";
+      readonly operation: VisionToolkitOperationView;
+      readonly path?: string;
+      readonly count: number;
+      readonly truncated: boolean;
+      readonly at: string;
+    }
+  | {
+      readonly state: "failed" | "cancelled";
+      readonly operation: VisionToolkitOperationView;
+      readonly path?: string;
+      readonly error: string;
+      readonly at: string;
+    };
+
+export interface VisionToolkitPanelView {
+  readonly status: VisionToolkitStatusView;
+  readonly report: VisionToolkitReportView | null;
+  readonly supportedTypes: readonly string[];
+  readonly limits: typeof defaultLimits;
+  readonly truncated: boolean;
+}
+
+const supportedTypes = ["png", "jpeg", "jpg", "gif", "webp"] as const;
+const supportedTypeSet = new Set<string>(supportedTypes);
+const supportedMimeTypes = new Set<string>(["image/png", "image/jpeg", "image/gif", "image/webp"]);
+const defaultLimits = {
+  imageBytes: 20_971_520,
+  headerBytes: 262_144,
+  pathCharacters: 4_096,
+  assets: 100,
+  imageCandidates: 256,
+  scannedEntries: 4_096,
+  scannedDirectories: 512,
+  depth: 16,
+  issues: 20,
+  issueCharacters: 500,
+  agentTextBytes: 16_384,
+} as const;
+
+function ownDataRecord(value: unknown): Record<string, unknown> | undefined {
+  try {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) return undefined;
+    const prototype = Object.getPrototypeOf(value) as unknown;
+    if (prototype !== Object.prototype && prototype !== null) return undefined;
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    if (Reflect.ownKeys(descriptors).some((key) => typeof key !== "string")) return undefined;
+    const output = Object.create(null) as Record<string, unknown>;
+    for (const [key, descriptor] of Object.entries(descriptors)) {
+      if (!("value" in descriptor)) return undefined;
+      output[key] = descriptor.value;
+    }
+    return output;
+  } catch {
+    return undefined;
+  }
+}
+
+function ownDataArray(value: unknown, maximum: number): { values: unknown[]; altered: boolean } | undefined {
+  try {
+    if (!Array.isArray(value)) return undefined;
+    const length = Object.getOwnPropertyDescriptor(value, "length");
+    if (length === undefined || !("value" in length) || !Number.isSafeInteger(length.value) || length.value < 0) return undefined;
+    const count = Math.min(length.value as number, maximum);
+    const values: unknown[] = [];
+    for (let index = 0; index < count; index += 1) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+      if (descriptor === undefined || !("value" in descriptor)) return undefined;
+      values.push(descriptor.value);
+    }
+    return { values, altered: length.value > maximum };
+  } catch {
+    return undefined;
+  }
+}
+
+function cleanedText(value: unknown, maximum: number): { value: string | undefined; altered: boolean } {
+  if (typeof value !== "string") return { value: undefined, altered: true };
+  const sample = value.slice(0, maximum * 2 + 1);
+  const cleaned = sample
+    .replaceAll(/[\p{Cc}\p{Cf}]+/gu, " ")
+    .trim()
+    .slice(0, maximum);
+  return { value: cleaned === "" ? undefined : cleaned, altered: cleaned !== value };
+}
+
+function integer(value: unknown, maximum: number): number | undefined {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && value <= maximum ? value : undefined;
+}
+
+function canonicalTimestamp(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  try {
+    return new Date(value).toISOString() === value ? value : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function expectedKeys(source: Record<string, unknown>, keys: readonly string[]): boolean {
+  const expected = new Set(keys);
+  return Object.keys(source).every((key) => expected.has(key));
+}
+
+function assetView(value: unknown): { asset: VisionToolkitAssetView | undefined; altered: boolean } {
+  const source = ownDataRecord(value);
+  if (source === undefined) return { asset: undefined, altered: true };
+  const path = cleanedText(source.path, defaultLimits.pathCharacters);
+  const mimeType =
+    typeof source.mimeType === "string" && supportedMimeTypes.has(source.mimeType) ? (source.mimeType as VisionToolkitAssetView["mimeType"]) : undefined;
+  const bytes = integer(source.bytes, defaultLimits.imageBytes);
+  const maximumDimension = mimeType === "image/png" ? 0x7fffffff : mimeType === "image/webp" ? 0x1000000 : 0xffff;
+  const width = source.width === null ? null : integer(source.width, maximumDimension);
+  const height = source.height === null ? null : integer(source.height, maximumDimension);
+  const headerTruncated = typeof source.headerTruncated === "boolean" ? source.headerTruncated : undefined;
+  const dimensionsValid =
+    (typeof width === "number" && width > 0 && typeof height === "number" && height > 0) ||
+    (width === null && height === null && headerTruncated === true && mimeType === "image/jpeg");
+  const altered = path.altered || !expectedKeys(source, ["path", "mimeType", "bytes", "width", "height", "headerTruncated"]);
+  if (path.value === undefined || mimeType === undefined || bytes === undefined || headerTruncated === undefined || !dimensionsValid)
+    return { asset: undefined, altered: true };
+  return { asset: { path: path.value, mimeType, bytes, width: width!, height: height!, headerTruncated }, altered };
+}
+
+function issueView(value: unknown): { issue: VisionToolkitIssueView | undefined; altered: boolean } {
+  const source = ownDataRecord(value);
+  if (source === undefined) return { issue: undefined, altered: true };
+  const path = cleanedText(source.path, defaultLimits.pathCharacters);
+  const reason = cleanedText(source.reason, defaultLimits.issueCharacters);
+  const altered = path.altered || reason.altered || !expectedKeys(source, ["path", "reason"]);
+  if (path.value === undefined || reason.value === undefined) return { issue: undefined, altered: true };
+  return { issue: { path: path.value, reason: reason.value }, altered };
+}
+
+function reportView(value: unknown): { report: VisionToolkitReportView | null; altered: boolean } {
+  if (value === null) return { report: null, altered: false };
+  const source = ownDataRecord(value);
+  if (source === undefined) return { report: null, altered: true };
+  const rawAssets = ownDataArray(source.assets, defaultLimits.assets);
+  const rawIssues = ownDataArray(source.issues, defaultLimits.issues);
+  if (rawAssets === undefined || rawIssues === undefined) return { report: null, altered: true };
+  const assets: VisionToolkitAssetView[] = [];
+  const issues: VisionToolkitIssueView[] = [];
+  let altered = rawAssets.altered || rawIssues.altered;
+  for (const value of rawAssets.values) {
+    const parsed = assetView(value);
+    altered ||= parsed.altered;
+    if (parsed.asset !== undefined) assets.push(parsed.asset);
+  }
+  for (const value of rawIssues.values) {
+    const parsed = issueView(value);
+    altered ||= parsed.altered;
+    if (parsed.issue !== undefined) issues.push(parsed.issue);
+  }
+  const inspectedCandidates = integer(source.inspectedCandidates, defaultLimits.imageCandidates);
+  const scannedEntries = integer(source.scannedEntries, defaultLimits.scannedEntries);
+  const scannedDirectories = integer(source.scannedDirectories, defaultLimits.scannedDirectories);
+  const truncated = typeof source.truncated === "boolean" ? source.truncated : undefined;
+  const issuesTruncated = typeof source.issuesTruncated === "boolean" ? source.issuesTruncated : undefined;
+  const countersValid =
+    inspectedCandidates !== undefined &&
+    scannedEntries !== undefined &&
+    scannedDirectories !== undefined &&
+    inspectedCandidates <= scannedEntries &&
+    assets.length <= inspectedCandidates &&
+    issues.length <= inspectedCandidates &&
+    (issuesTruncated === true || assets.length + issues.length <= inspectedCandidates);
+  altered ||= !expectedKeys(source, ["assets", "issues", "inspectedCandidates", "scannedEntries", "scannedDirectories", "truncated", "issuesTruncated"]);
+  if (!countersValid || truncated === undefined || issuesTruncated === undefined) return { report: null, altered: true };
+  return {
+    report: { assets, issues, inspectedCandidates, scannedEntries, scannedDirectories, truncated, issuesTruncated },
+    altered,
+  };
+}
+
+function statusView(value: unknown): { status: VisionToolkitStatusView; altered: boolean } {
+  const source = ownDataRecord(value);
+  if (source === undefined) return { status: { state: "idle" }, altered: true };
+  if (source.state === "idle") return { status: { state: "idle" }, altered: !expectedKeys(source, ["state"]) };
+  const operation = source.operation === "catalog" || source.operation === "info" ? source.operation : undefined;
+  const at = canonicalTimestamp(source.at);
+  const parsedPath = source.path === undefined ? { value: undefined, altered: false } : cleanedText(source.path, defaultLimits.pathCharacters);
+  const pathValid = operation === "catalog" ? source.path === undefined : parsedPath.value !== undefined;
+  if (operation === undefined || at === undefined || !pathValid) return { status: { state: "idle" }, altered: true };
+  const path = parsedPath.value;
+  if (source.state === "running") {
+    return {
+      status: { state: "running", operation, ...(path === undefined ? {} : { path }), at },
+      altered: parsedPath.altered || !expectedKeys(source, ["state", "operation", ...(operation === "info" ? ["path"] : []), "at"]),
+    };
+  }
+  if (source.state === "completed") {
+    const count = integer(source.count, defaultLimits.assets);
+    if (count === undefined || typeof source.truncated !== "boolean") return { status: { state: "idle" }, altered: true };
+    return {
+      status: { state: "completed", operation, ...(path === undefined ? {} : { path }), count, truncated: source.truncated, at },
+      altered: parsedPath.altered || !expectedKeys(source, ["state", "operation", ...(operation === "info" ? ["path"] : []), "count", "truncated", "at"]),
+    };
+  }
+  if (source.state === "failed" || source.state === "cancelled") {
+    const error = cleanedText(source.error, defaultLimits.issueCharacters);
+    if (error.value === undefined) return { status: { state: "idle" }, altered: true };
+    return {
+      status: { state: source.state, operation, ...(path === undefined ? {} : { path }), error: error.value, at },
+      altered: parsedPath.altered || error.altered || !expectedKeys(source, ["state", "operation", ...(operation === "info" ? ["path"] : []), "error", "at"]),
+    };
+  }
+  return { status: { state: "idle" }, altered: true };
+}
+
+function exactSupportedTypes(value: unknown): boolean {
+  const parsed = ownDataArray(value, supportedTypes.length);
+  if (parsed === undefined || parsed.altered || parsed.values.some((item) => typeof item !== "string")) return false;
+  return new Set(parsed.values as string[]).size === supportedTypes.length && parsed.values.every((item) => supportedTypeSet.has(item as string));
+}
+
+function exactLimits(value: unknown): boolean {
+  const source = ownDataRecord(value);
+  if (source === undefined || !expectedKeys(source, Object.keys(defaultLimits))) return false;
+  return Object.entries(defaultLimits).every(([key, expected]) => source[key] === expected);
+}
+
+export function visionToolkitPanelView(data: unknown): VisionToolkitPanelView {
+  const source = ownDataRecord(data);
+  if (source === undefined) {
+    return { status: { state: "idle" }, report: null, supportedTypes: [...supportedTypes], limits: { ...defaultLimits }, truncated: true };
+  }
+  const parsedStatus = statusView(source.status);
+  const parsedReport = reportView(source.report);
+  const completionConsistent =
+    parsedStatus.status.state !== "completed" ||
+    (parsedReport.report !== null &&
+      parsedStatus.status.count === parsedReport.report.assets.length &&
+      parsedStatus.status.truncated === parsedReport.report.truncated &&
+      (parsedStatus.status.operation === "catalog" || (parsedStatus.status.path === parsedReport.report.assets[0]?.path && parsedStatus.status.count === 1)));
+  const truncated =
+    parsedStatus.altered ||
+    parsedReport.altered ||
+    !completionConsistent ||
+    !exactSupportedTypes(source.supportedTypes) ||
+    !exactLimits(source.limits) ||
+    !expectedKeys(source, ["status", "report", "supportedTypes", "limits"]);
+  return {
+    status: parsedStatus.status,
+    report: parsedReport.report,
+    supportedTypes: [...supportedTypes],
+    limits: { ...defaultLimits },
+    truncated,
+  };
+}

package/packages/client-web/src/yaml-validator-view.ts

@@ -0,0 +1,102 @@
+const visibleDiagnostics = 20;
+const defaults = {
+  fileBytes: 512 * 1024,
+  pathCharacters: 4_096,
+  documents: 100,
+  diagnostics: 1_000,
+  panelDiagnostics: 50,
+  toolDiagnostics: 50,
+  diagnosticMessageCharacters: 2_000,
+  statusErrorCharacters: 2_000,
+} as const;
+const rootTypes = new Set(["empty", "map", "seq", "scalar"]);
+const statusStates = new Set(["idle", "running", "completed", "failed", "cancelled"]);
+
+function string(value: unknown, maximum: number): string {
+  return typeof value === "string" ? value.slice(0, maximum) : "";
+}
+
+function integer(value: unknown, minimum: number, maximum: number, fallback: number): number {
+  return typeof value === "number" && Number.isInteger(value) && value >= minimum && value <= maximum ? value : fallback;
+}
+
+function diagnostic(value: unknown) {
+  const record = ownRecord(value);
+  if (record === undefined || typeof record.message !== "string") return undefined;
+  const code = string(record.code, 128);
+  const line = integer(record.line, 1, defaults.fileBytes, 0);
+  const column = integer(record.column, 1, defaults.fileBytes, 0);
+  return {
+    message: record.message.slice(0, defaults.diagnosticMessageCharacters),
+    ...(code === "" ? {} : { code }),
+    ...(line === 0 ? {} : { line }),
+    ...(column === 0 ? {} : { column }),
+  };
+}
+
+function diagnostics(value: unknown, limit: number) {
+  const source = ownArray(value, limit + 8) ?? [];
+  return source
+    .slice(0, limit + 8)
+    .map(diagnostic)
+    .filter((entry): entry is NonNullable<ReturnType<typeof diagnostic>> => entry !== undefined)
+    .slice(0, limit);
+}
+
+function inventory(value: unknown, totalFallback: number, shown: number, clipped: boolean) {
+  const source = ownRecord(value) ?? {};
+  const total = integer(source.total, shown, 1_000_000, totalFallback);
+  return { total, shown, truncated: source.truncated === true || clipped || total > shown };
+}
+
+export function yamlValidatorPanelView(data: unknown) {
+  const source = ownRecord(data) ?? {};
+  const rawLimits = ownRecord(source.limits) ?? {};
+  const limits = {
+    fileBytes: integer(rawLimits.fileBytes, 1, defaults.fileBytes, defaults.fileBytes),
+    pathCharacters: integer(rawLimits.pathCharacters, 1, defaults.pathCharacters, defaults.pathCharacters),
+    documents: integer(rawLimits.documents, 1, defaults.documents, defaults.documents),
+    diagnostics: integer(rawLimits.diagnostics, 1, defaults.diagnostics, defaults.diagnostics),
+    panelDiagnostics: integer(rawLimits.panelDiagnostics, 1, defaults.panelDiagnostics, defaults.panelDiagnostics),
+    toolDiagnostics: integer(rawLimits.toolDiagnostics, 1, defaults.toolDiagnostics, defaults.toolDiagnostics),
+    diagnosticMessageCharacters: integer(rawLimits.diagnosticMessageCharacters, 1, defaults.diagnosticMessageCharacters, defaults.diagnosticMessageCharacters),
+    statusErrorCharacters: integer(rawLimits.statusErrorCharacters, 1, defaults.statusErrorCharacters, defaults.statusErrorCharacters),
+  };
+  const rawLatest = ownRecord(source.latest);
+  const rawErrors = ownArray(rawLatest?.errors, defaults.diagnostics + 8) ?? [];
+  const errors = diagnostics(rawErrors, visibleDiagnostics);
+  const rawWarnings = ownArray(rawLatest?.warnings, defaults.diagnostics + 8) ?? [];
+  const warnings = diagnostics(rawWarnings, Math.max(0, visibleDiagnostics - errors.length));
+  const errorCount = integer(rawLatest?.errorCount, errors.length, 1_000_000, rawErrors.length);
+  const warningCount = integer(rawLatest?.warningCount, warnings.length, 1_000_000, rawWarnings.length);
+  const rawInventory = ownRecord(source.inventory) ?? {};
+  const rawStatus = ownRecord(source.status) ?? {};
+  const state = typeof rawStatus.state === "string" && statusStates.has(rawStatus.state) ? rawStatus.state : "unknown";
+  const at = string(rawStatus.at, 64);
+  const error = string(rawStatus.error, limits.statusErrorCharacters);
+  return {
+    latest:
+      rawLatest === undefined
+        ? null
+        : {
+            path: string(rawLatest.path, limits.pathCharacters),
+            valid: rawLatest.valid === true,
+            bytes: integer(rawLatest.bytes, 0, limits.fileBytes, 0),
+            documents: integer(rawLatest.documents, 0, limits.documents, 0),
+            rootType: typeof rawLatest.rootType === "string" && rootTypes.has(rawLatest.rootType) ? rawLatest.rootType : "unknown",
+            errorCount,
+            warningCount,
+            diagnosticsTruncated:
+              rawLatest.diagnosticsTruncated === true || errorCount > errors.length || warningCount > warnings.length || rawErrors.length > errors.length,
+            errors,
+            warnings,
+          },
+    status: { state, ...(at === "" ? {} : { at }), ...(error === "" ? {} : { error }) },
+    inventory: {
+      errors: inventory(rawInventory.errors, errorCount, errors.length, rawErrors.length > errors.length),
+      warnings: inventory(rawInventory.warnings, warningCount, warnings.length, rawWarnings.length > warnings.length),
+    },
+    limits,
+  };
+}
+import { ownArray, ownRecord } from "./panel-safe.js";

package/packages/client-web/test/agent-teams-view.test.ts

@@ -0,0 +1,198 @@
+import { describe, expect, test } from "vitest";
+import { agentTeamsPanelView } from "../src/agent-teams-view.js";
+
+describe("Agent Teams panel view", () => {
+  test("normalizes a complete bounded collaboration-ledger payload", () => {
+    expect(
+      agentTeamsPanelView({
+        members: [{ id: "builder", name: "Builder", role: "Implementation", status: "working" }],
+        tasks: [{ id: "task-1", title: "Ship", assignee: "builder", status: "in_progress", dependsOn: [] }],
+        messages: [{ id: "message-1", from: "reviewer", to: "builder", body: "Check edge cases", timestamp: "2026-09-06T00:00:00.000Z", read: false }],
+        readyTasks: [],
+        dependencyCycle: null,
+        inventory: {
+          members: { total: 3, shown: 1, truncated: true },
+          tasks: { total: 25, shown: 1, ready: 25, truncated: true },
+          messages: { total: 40, shown: 1, unread: 7, truncated: true },
+        },
+        history: { available: 200, scanned: 4, truncated: false, restored: true },
+        limits: {
+          members: 64,
+          tasks: 256,
+          messages: 1_000,
+          messageCharacters: 4_000,
+          mailboxReadMessages: 25,
+          agentTextBytes: 32_768,
+          stateBytes: 8_388_608,
+          stateScanEntries: 10_000,
+          panelMembers: 12,
+          panelTasks: 20,
+          panelMessages: 5,
+        },
+      }),
+    ).toEqual({
+      members: [{ id: "builder", name: "Builder", role: "Implementation", status: "working" }],
+      tasks: [{ id: "task-1", title: "Ship", assignee: "builder", status: "in_progress", dependsOn: [] }],
+      messages: [{ id: "message-1", from: "reviewer", to: "builder", body: "Check edge cases", timestamp: "2026-09-06T00:00:00.000Z", read: false }],
+      readyTasks: [],
+      dependencyCycle: null,
+      inventory: {
+        members: { total: 3, shown: 1, truncated: true },
+        tasks: { total: 25, shown: 1, ready: 25, truncated: true },
+        messages: { total: 40, shown: 1, unread: 7, truncated: true },
+      },
+      history: { available: 200, scanned: 4, truncated: false, restored: true },
+      limits: {
+        members: 64,
+        tasks: 256,
+        messages: 1_000,
+        messageCharacters: 4_000,
+        mailboxReadMessages: 25,
+        agentTextBytes: 32_768,
+        stateBytes: 8_388_608,
+        stateScanEntries: 10_000,
+        panelMembers: 12,
+        panelTasks: 20,
+        panelMessages: 5,
+      },
+      truncated: false,
+    });
+  });
+
+  test("applies fixed browser limits and drops malformed hostile entries", () => {
+    const members = Array.from({ length: 20 }, (_, index) => ({
+      id: index === 0 ? "bad member" : `member-${index}`,
+      name: "n".repeat(500),
+      role: "r".repeat(500),
+      status: index === 1 ? "working" : "unknown",
+    }));
+    const tasks = Array.from({ length: 30 }, (_, index) => ({
+      id: `task-${index}`,
+      title: "t".repeat(500),
+      assignee: "member-1",
+      status: index === 0 ? "done" : "unknown",
+      dependsOn: Array.from({ length: 300 }, (_, dependency) => `task-${dependency}`),
+    }));
+    const messages = Array.from({ length: 10 }, (_, index) => ({
+      id: `message-${index}`,
+      from: "member-1",
+      to: "member-2",
+      body: "b".repeat(8_000),
+      timestamp: index === 0 ? "invalid" : "2026-09-06T00:00:00.000Z",
+      read: false,
+    }));
+
+    const view = agentTeamsPanelView({
+      members,
+      tasks,
+      messages,
+      readyTasks: Array.from({ length: 100 }, (_, index) => `task-${index}`),
+      dependencyCycle: Array.from({ length: 100 }, (_, index) => `task-${index}`),
+      inventory: {
+        members: { total: Number.POSITIVE_INFINITY, shown: -1 },
+        tasks: { total: 1, shown: 999, ready: 999 },
+        messages: { total: 1, shown: 999, unread: 999 },
+      },
+      history: { available: Number.NaN, scanned: 99_999, restored: "yes" },
+      limits: { members: 999, tasks: 999, messages: 999_999, panelMembers: 999, panelTasks: 999, panelMessages: 999 },
+    });
+
+    expect(view.members).toHaveLength(11);
+    expect(view.members[0]).toEqual({ id: "member-1", name: "n".repeat(200), role: "r".repeat(200), status: "working" });
+    expect(view.tasks).toHaveLength(20);
+    expect(view.tasks[0]).toMatchObject({ title: "t".repeat(200), status: "done" });
+    expect(view.tasks[0]?.dependsOn).toHaveLength(20);
+    expect(view.messages).toHaveLength(4);
+    expect(view.messages[0]?.body).toBe("b".repeat(4_000));
+    expect(view.readyTasks).toHaveLength(20);
+    expect(view.dependencyCycle).toHaveLength(20);
+    expect(view.inventory).toEqual({
+      members: { total: 11, shown: 11, truncated: true },
+      tasks: { total: 20, shown: 20, ready: 20, truncated: true },
+      messages: { total: 4, shown: 4, unread: 4, truncated: true },
+    });
+    expect(view.history).toEqual({ available: 0, scanned: 0, truncated: false, restored: false });
+    expect(view.limits).toMatchObject({ members: 64, tasks: 256, messages: 1_000, panelMembers: 12, panelTasks: 20, panelMessages: 5 });
+    expect(view.truncated).toBe(true);
+  });
+
+  test("preserves a valid deep recovery scan beyond the recent-history window", () => {
+    const view = agentTeamsPanelView({
+      history: { available: 10_002, scanned: 10_002, truncated: false, restored: true },
+    });
+
+    expect(view.history).toEqual({ available: 10_002, scanned: 10_002, truncated: false, restored: true });
+  });
+
+  test("tracks browser-side truncation independently for each inventory", () => {
+    const view = agentTeamsPanelView({
+      members: [{ id: "builder", name: "Builder", role: "Implementation", status: "idle" }],
+      tasks: [{ id: "task-1", title: "Ship", assignee: "builder", status: "todo", dependsOn: [] }],
+      messages: [{ id: "message-1", from: "builder", to: "builder", body: "Broken timestamp", timestamp: "invalid", read: false }],
+      readyTasks: ["task-1"],
+      dependencyCycle: null,
+      inventory: {
+        members: { total: 1, shown: 1, truncated: false },
+        tasks: { total: 1, shown: 1, ready: 1, truncated: false },
+        messages: { total: 1, shown: 1, unread: 1, truncated: false },
+      },
+    });
+
+    expect(view.inventory).toEqual({
+      members: { total: 1, shown: 1, truncated: false },
+      tasks: { total: 1, shown: 1, ready: 1, truncated: false },
+      messages: { total: 1, shown: 0, unread: 1, truncated: true },
+    });
+    expect(view.truncated).toBe(true);
+  });
+
+  test("reports malformed collection and task-metadata containers as truncated", () => {
+    const view = agentTeamsPanelView({
+      members: {},
+      tasks: "invalid",
+      messages: 42,
+      readyTasks: {},
+      dependencyCycle: "invalid",
+    });
+
+    expect(view.members).toEqual([]);
+    expect(view.tasks).toEqual([]);
+    expect(view.messages).toEqual([]);
+    expect(view.readyTasks).toEqual([]);
+    expect(view.dependencyCycle).toBeNull();
+    expect(view.inventory).toEqual({
+      members: { total: 0, shown: 0, truncated: true },
+      tasks: { total: 0, shown: 0, ready: 0, truncated: true },
+      messages: { total: 0, shown: 0, unread: 0, truncated: true },
+    });
+    expect(view.truncated).toBe(true);
+  });
+
+  test("tracks dependency truncation against the original task after malformed tasks are dropped", () => {
+    const view = agentTeamsPanelView({
+      members: [{ id: "builder", name: "Builder", role: "Implementation", status: "idle" }],
+      tasks: [
+        { id: "bad task", title: "Drop", assignee: "builder", status: "todo", dependsOn: [] },
+        {
+          id: "task-1",
+          title: "Keep",
+          assignee: "builder",
+          status: "todo",
+          dependsOn: Array.from({ length: 21 }, (_, index) => `dependency-${index}`),
+        },
+      ],
+      messages: [],
+      readyTasks: [],
+      dependencyCycle: null,
+      inventory: {
+        members: { total: 1, shown: 1, truncated: false },
+        tasks: { total: 2, shown: 2, ready: 0, truncated: false },
+        messages: { total: 0, shown: 0, unread: 0, truncated: false },
+      },
+    });
+
+    expect(view.tasks).toHaveLength(1);
+    expect(view.tasks[0]?.dependsOn).toHaveLength(20);
+    expect(view.inventory.tasks).toEqual({ total: 2, shown: 1, ready: 0, truncated: true });
+  });
+});

package/packages/client-web/test/at-file-panel.test.ts

@@ -0,0 +1,76 @@
+import { createElement } from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { describe, expect, test } from "vitest";
+import { PluginPanelCard } from "../src/react-room.js";
+
+function renderPanel(data: unknown): string {
+  return renderToStaticMarkup(
+    createElement(PluginPanelCard, {
+      panel: {
+        id: "at-file-panel",
+        pluginId: "@pi-harness/core/plugins/at-file",
+        title: "@file Context",
+        data,
+      },
+    }),
+  );
+}
+
+describe("at-file panel", () => {
+  test("renders a valid bounded attachment report", () => {
+    const html = renderPanel({ lastFile: { path: "docs/notes.md", bytes: 5 }, maxBytes: 256 * 1024 });
+
+    expect(html).toContain("docs/notes.md");
+    expect(html).toContain("5 bytes");
+    expect(html).toContain("262144 bytes");
+    expect(html).not.toContain("面板数据不完整");
+  });
+
+  test("wraps a long attachment path instead of truncating it", () => {
+    const path = `nested/${"a".repeat(500)}.md`;
+    const html = renderPanel({ lastFile: { path, bytes: 5 }, maxBytes: 256 * 1024 });
+
+    expect(html).toContain(path);
+    expect(html).toMatch(/<p class="[^"]*break-all[^"]*">nested\//u);
+    expect(html).not.toMatch(/<p class="[^"]*truncate[^"]*">nested\//u);
+  });
+
+  test("fails closed without invoking accessors or revoked proxies", () => {
+    let getterCalls = 0;
+    const rootAccessor = Object.defineProperty({}, "lastFile", {
+      enumerable: true,
+      get() {
+        getterCalls += 1;
+        return { path: "poison", bytes: 1 };
+      },
+    });
+    const nestedAccessor = Object.defineProperty({}, "path", {
+      enumerable: true,
+      get() {
+        getterCalls += 1;
+        return "poison";
+      },
+    });
+    const revocable = Proxy.revocable({}, {});
+    revocable.revoke();
+
+    for (const data of [rootAccessor, { lastFile: nestedAccessor, maxBytes: 256 * 1024 }, revocable.proxy]) {
+      expect(() => renderPanel(data)).not.toThrow();
+      expect(renderPanel(data)).toContain("面板数据不完整");
+    }
+    expect(getterCalls).toBe(0);
+  });
+
+  test("sanitizes bounded path text and rejects contradictory fields", () => {
+    const sanitized = renderPanel({ lastFile: { path: "docs/\u202Enotes.md", bytes: 5 }, maxBytes: 256 * 1024 });
+    const invalidBytes = renderPanel({ lastFile: { path: "docs/notes.md", bytes: 256 * 1024 + 1 }, maxBytes: 256 * 1024 });
+    const unknown = renderPanel({ lastFile: null, maxBytes: 256 * 1024, unexpected: true });
+
+    expect(sanitized).toContain("docs/ notes.md");
+    expect(sanitized).not.toContain("\u202E");
+    expect(sanitized).toContain("面板数据不完整");
+    expect(invalidBytes).not.toContain("262145 bytes");
+    expect(invalidBytes).toContain("面板数据不完整");
+    expect(unknown).toContain("面板数据不完整");
+  });
+});