@selesai/code 0.13.16 → 0.13.19

package/dist/extensions/pi-subagents/test/unit/llm-intent-arbiter.test.ts

@@ -1,5 +1,13 @@
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
+import type { StreamFn } from "@earendil-works/pi-agent-core";
+import {
+	createAssistantMessageEventStream,
+	fauxAssistantMessage,
+	fauxToolCall,
+	type AssistantMessage,
+} from "@earendil-works/pi-ai";
+import { registerFauxProvider } from "@earendil-works/pi-ai/compat";
 import {
 	arbitrateCompletionGuardRescue,
 	createTaskMutationArbiter,
@@ -12,17 +20,45 @@ import {
 const GUARD_ERROR =
 	"Subagent completed without making edits for an implementation task.\nIt appears to have returned planning or scratchpad output instead of applying changes.";
 
-function fakeCtx(overrides: { models?: Array<{ provider?: string; id?: string; api?: string }> } = {}) {
+function fakeCtx(overrides: {
+	models?: Array<{ provider?: string; id?: string; api?: string }>;
+	providerConfig?: { api?: string; streamSimple?: StreamFn };
+} = {}) {
 	const models = overrides.models ?? [{ provider: "test", id: "model-1", api: "test-api" }];
 	return {
 		model: models[0],
 		modelRegistry: {
 			getAvailable: () => models,
-			getRegisteredProviderConfig: () => undefined,
+			getRegisteredProviderConfig: () => overrides.providerConfig,
 		},
 	} as never;
 }
 
+function responseStream(message: AssistantMessage) {
+	const stream = createAssistantMessageEventStream();
+	queueMicrotask(() => stream.push({ type: "done", reason: message.stopReason, message }));
+	return stream;
+}
+
+function decisionResponses(source: string): AssistantMessage[] {
+	return [
+		fauxAssistantMessage(fauxToolCall("task_mutation_decision", {
+			classification: "read_only",
+			confidence: "high",
+			reason: `${source} stream selected`,
+		}), { stopReason: "toolUse" }),
+		fauxAssistantMessage("done", { stopReason: "stop" }),
+	];
+}
+
+function decisionStream(source: string, calls: string[]): StreamFn {
+	const responses = decisionResponses(source);
+	return () => {
+		calls.push(source);
+		return responseStream(responses.shift() ?? fauxAssistantMessage("done", { stopReason: "stop" }));
+	};
+}
+
 function stubArbiter(verdict: "read-only" | "implementation" | "unavailable" | "throw"): TaskMutationArbiter {
 	return async () => {
 		if (verdict === "throw") throw new Error("boom");
@@ -166,6 +202,54 @@ describe("maybeRescueCompletionGuardFailure", () => {
 	});
 });
 
+describe("arbiter stream selection", () => {
+	it("uses a registered provider stream when its API matches the model", async () => {
+		const calls: string[] = [];
+		const arbiter = createTaskMutationArbiter(fakeCtx({
+			models: [{ provider: "registered", id: "model-1", api: "registered-api" }],
+			providerConfig: { api: "registered-api", streamSimple: decisionStream("registered", calls) },
+		}))!;
+
+		assert.equal(await arbiter("task"), "read-only");
+		assert.deepEqual(calls, ["registered", "registered"]);
+	});
+
+	it("lets an explicit stream override a mismatched registered provider", async () => {
+		const calls: string[] = [];
+		const registeredCalls: string[] = [];
+		const arbiter = createTaskMutationArbiter(fakeCtx({
+			models: [{ provider: "registered", id: "model-1", api: "model-api" }],
+			providerConfig: { api: "registered-api", streamSimple: decisionStream("registered", registeredCalls) },
+		}), { streamFn: decisionStream("explicit", calls) })!;
+
+		assert.equal(await arbiter("task"), "read-only");
+		assert.deepEqual(calls, ["explicit", "explicit"]);
+		assert.deepEqual(registeredCalls, []);
+	});
+
+	it("falls back to compat streamSimple for a mismatched registered provider", async () => {
+		const compat = registerFauxProvider({
+			api: "llm-intent-arbiter-compat-test",
+			provider: "compat-provider",
+			models: [{ id: "model-1", reasoning: false }],
+		});
+		try {
+			compat.setResponses(decisionResponses("compat"));
+			const registeredCalls: string[] = [];
+			const arbiter = createTaskMutationArbiter(fakeCtx({
+				models: [{ provider: "registered", id: "model-1", api: compat.api }],
+				providerConfig: { api: "registered-api", streamSimple: decisionStream("registered", registeredCalls) },
+			}))!;
+
+			assert.equal(await arbiter("task"), "read-only");
+			assert.deepEqual(registeredCalls, []);
+			assert.equal(compat.state.callCount, 2);
+		} finally {
+			compat.unregister();
+		}
+	});
+});
+
 describe("createTaskMutationArbiter", () => {
 	it("is disabled by the env opt-out", () => {
 		const previous = process.env.SELESAI_SUBAGENTS_LLM_INTENT_ARBITER;
@@ -182,6 +266,23 @@ describe("createTaskMutationArbiter", () => {
 		assert.equal(createTaskMutationArbiter(fakeCtx({ models: [] })), undefined);
 	});
 
+	it("does not stream after explicit auth failure or an auth error", async () => {
+		for (const throws of [false, true]) {
+			let calls = 0;
+			const arbiter = createTaskMutationArbiter({
+				model: { provider: "test", id: "model-1", api: "test-api" },
+				modelRegistry: {
+					async getApiKeyAndHeaders() {
+						if (throws) throw new Error("auth unavailable");
+						return { ok: false, error: "auth unavailable" };
+					},
+				},
+			} as never, { streamFn: () => { calls++; throw new Error("must not stream"); } });
+			assert.equal(await arbiter!("Implement the fix"), "unavailable");
+			assert.equal(calls, 0);
+		}
+	});
+
 	it("returns a working arbiter bound to the host model", async () => {
 		const arbiter = createTaskMutationArbiter(fakeCtx(), {
 			streamFn: async () => {
@@ -223,4 +324,4 @@ describe("createTaskMutationArbiter", () => {
 		await arbiter(`${prefix}B`);
 		assert.equal(streamCalls, 2);
 	});
-});
+});

package/dist/extensions/pi-subagents/test/unit/mission-lifecycle.test.ts

@@ -36,6 +36,8 @@ describe("mission launch lifecycle", () => {
 			labels: ["review"],
 		});
 		assert.throws(() => validateMissionLaunch({}), /title or mission\.summary/);
+		assert.throws(() => validateMissionLaunch(true), /mission must be an object/);
+		assert.throws(() => validateMissionLaunch(false), /mission must be an object/);
 		assert.throws(() => validateMissionLaunch({ title: "Title", summary: "Summary" }), /cannot both be set/);
 		assert.throws(() => validateMissionLaunch({ title: " " }), /non-empty string/);
 		assert.throws(() => validateMissionLaunch({ title: "Title", goal: false }), /must be true/);
@@ -45,6 +47,13 @@ describe("mission launch lifecycle", () => {
 	it("creates missions by default for task launches and honors explicit opt-out", () => {
 		const test = projectFixture();
 		try {
+			assert.throws(() => prepareMissionLaunch({
+				params: { mission: true, task: "Invalid mission" },
+				projectRoot: test.projectRoot,
+				config: test.missionConfig,
+			}), /mission must be an object/);
+			assert.deepEqual(fs.readdirSync(test.projectRoot), [], "invalid mission must not create records");
+			assert.equal(fs.existsSync(test.missionConfig.globalIndexDir), false);
 			const binding = prepareMissionLaunch({
 				params: { task: "Map the auth flow" },
 				projectRoot: test.projectRoot,
@@ -297,4 +306,4 @@ describe("mission launch lifecycle", () => {
 			fs.rmSync(test.root, { recursive: true, force: true });
 		}
 	});
-});
+});

package/dist/extensions/pi-subagents/test/unit/mission-store.test.ts

@@ -298,6 +298,36 @@ describe("mission store", () => {
 		}
 	});
 
+	it("does not reclaim a live replacement owner after observing a reused pid identity", () => {
+		const test = fixture();
+		try {
+			const mission = createMission(test.location, { title: "Replacement owner", objective: "Keep a reused pid lock safe" });
+			const statePath = missionStatePath(test.location, mission.id);
+			const lockPath = `${statePath}.lock`;
+			const ownerPath = path.join(lockPath, "owner.json");
+			const reusedPid = process.pid + 100_000;
+			const replacementOwner = { pid: reusedPid, token: "replacement", createdAt: Date.now(), processKey: "replacement-process" };
+			fs.mkdirSync(lockPath, { recursive: true });
+			fs.writeFileSync(ownerPath, JSON.stringify({ pid: reusedPid, token: "old", createdAt: Date.now(), processKey: "old-process" }), "utf-8");
+
+			let currentIdentity = "old-process";
+			const state = createMissionWorkflowState(test.location, mission.id, {
+				isProcessAlive: (pid) => pid === reusedPid,
+				getProcessStartKey: (pid) => pid === reusedPid ? currentIdentity : "current-process",
+				retryDelaysMs: [],
+			});
+
+			assert.throws(() => state.set("reviewer", "ready"), /Timed out acquiring mission state lock/);
+			fs.writeFileSync(ownerPath, JSON.stringify(replacementOwner), "utf-8");
+			currentIdentity = "replacement-process";
+			assert.throws(() => state.set("reviewer", "ready"), /Timed out acquiring mission state lock/);
+			assert.deepEqual(JSON.parse(fs.readFileSync(ownerPath, "utf-8")), replacementOwner);
+			assert.equal(fs.existsSync(statePath), false);
+		} finally {
+			fs.rmSync(test.root, { recursive: true, force: true });
+		}
+	});
+
 	it("serializes competing abandoned-lock recovery", async () => {
 		const test = fixture();
 		try {
@@ -467,4 +497,4 @@ describe("mission store", () => {
 			fs.rmSync(test.root, { recursive: true, force: true });
 		}
 	});
-});
+});

package/dist/extensions/pi-subagents/test/unit/model-exclusions.test.ts

@@ -1,9 +1,12 @@
 import assert from "node:assert/strict";
 import * as fs from "node:fs";
-import { afterEach, beforeEach, describe, it } from "node:test";
+import * as os from "node:os";
+import * as path from "node:path";
+import { after, afterEach, beforeEach, describe, it } from "node:test";
 import {
 	clearExclusions,
 	DEFAULT_MODEL_EXCLUSION_TTL_MS,
+	findModelExclusion,
 	filterFallbackCandidates,
 	flushPersist,
 	getExcludedCount,
@@ -17,15 +20,44 @@ import {
 	type ModelExclusion,
 } from "../../src/runs/shared/model-exclusions.ts";
 
+const previousAgentDir = process.env.SELESAI_CODING_AGENT_DIR;
+const testAgentDir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-model-exclusions-auth-"));
+
+function captureConsole(method: "error" | "warn", run: () => void): unknown[][] {
+	const original = console[method];
+	const messages: unknown[][] = [];
+	console[method] = (...args: unknown[]) => messages.push(args);
+	try {
+		run();
+	} finally {
+		console[method] = original;
+	}
+	return messages;
+}
+process.env.SELESAI_CODING_AGENT_DIR = testAgentDir;
+const authPath = path.join(testAgentDir, "auth.json");
+
 // The exclusion store is a process-wide singleton persisted under TEMP_ROOT_DIR
 // (isolated per test run by test/support/isolated-temp-root.mjs). Clear it
 // before/after each test so cases don't leak state into each other.
 beforeEach(() => {
 	setDefaultTTL(DEFAULT_MODEL_EXCLUSION_TTL_MS);
 	fs.rmSync(getExclusionsFilePath(), { force: true });
+	fs.rmSync(authPath, { force: true });
+	clearExclusions();
+});
+afterEach(() => {
 	clearExclusions();
+	fs.rmSync(authPath, { force: true });
+});
+after(() => {
+	if (previousAgentDir === undefined) {
+		delete process.env.SELESAI_CODING_AGENT_DIR;
+	} else {
+		process.env.SELESAI_CODING_AGENT_DIR = previousAgentDir;
+	}
+	fs.rmSync(testAgentDir, { recursive: true, force: true });
 });
-afterEach(() => clearExclusions());
 
 describe("model exclusions — record & query", () => {
 	it("excludes a recorded model", () => {
@@ -165,6 +197,50 @@ describe("model exclusions — filtering fallback candidates", () => {
 });
 
 describe("model exclusions — persistence", () => {
+	it("keeps an auth exclusion after reload when auth.json is unchanged", () => {
+		fs.mkdirSync(path.dirname(authPath), { recursive: true });
+		fs.writeFileSync(authPath, JSON.stringify({ openai: { access: "credential-a" } }), "utf-8");
+		const authMtime = new Date(Date.now() - 1_000);
+		fs.utimesSync(authPath, authMtime, authMtime);
+		recordModelFailure({ modelId: "gpt-4", provider: "openai", reason: "invalid oauth token" });
+		reloadFromDisk();
+		assert.equal(isExcluded("gpt-4", "openai"), true);
+	});
+
+	it("invalidates an auth exclusion after auth.json is modified", () => {
+		fs.mkdirSync(path.dirname(authPath), { recursive: true });
+		fs.writeFileSync(authPath, JSON.stringify({ openai: { access: "credential-a" } }), "utf-8");
+		recordModelFailure({ modelId: "gpt-4", provider: "openai", reason: "invalid oauth token" });
+		const { recordedAt } = JSON.parse(fs.readFileSync(getExclusionsFilePath(), "utf-8")).exclusions[0] as ModelExclusion;
+		const newerAuthMtime = new Date(recordedAt + 1_000);
+		fs.utimesSync(authPath, newerAuthMtime, newerAuthMtime);
+		reloadFromDisk();
+		assert.equal(findModelExclusion("openai/gpt-4"), undefined);
+		assert.equal(isExcluded("gpt-4", "openai"), false);
+	});
+
+	it("keeps a non-auth exclusion after auth.json is modified", () => {
+		fs.mkdirSync(path.dirname(authPath), { recursive: true });
+		fs.writeFileSync(authPath, JSON.stringify({ openai: { access: "credential-a" } }), "utf-8");
+		recordModelFailure({ modelId: "gpt-4", provider: "openai", reason: "quota exceeded" });
+		const { recordedAt } = JSON.parse(fs.readFileSync(getExclusionsFilePath(), "utf-8")).exclusions[0] as ModelExclusion;
+		const newerAuthMtime = new Date(recordedAt + 1_000);
+		fs.utimesSync(authPath, newerAuthMtime, newerAuthMtime);
+		reloadFromDisk();
+		assert.equal(isExcluded("gpt-4", "openai"), true);
+	});
+
+	it("does not persist credential contents in the exclusion store", () => {
+		const accessToken = "access-token-secret";
+		const refreshToken = "refresh-token-secret";
+		fs.mkdirSync(path.dirname(authPath), { recursive: true });
+		fs.writeFileSync(authPath, JSON.stringify({ openai: { access: accessToken, refresh: refreshToken } }), "utf-8");
+		recordModelFailure({ modelId: "gpt-4", provider: "openai", reason: "invalid oauth token" });
+		const persisted = fs.readFileSync(getExclusionsFilePath(), "utf-8");
+		assert.equal(persisted.includes(accessToken), false);
+		assert.equal(persisted.includes(refreshToken), false);
+	});
+
 	it("survives a reload from disk", () => {
 		recordModelFailure({ modelId: "gpt-4", provider: "openai", reason: "429" });
 		reloadFromDisk();
@@ -195,64 +271,39 @@ describe("model exclusions — persistence", () => {
 
 	it("reports corrupt persisted exclusions and starts empty", () => {
 		fs.writeFileSync(getExclusionsFilePath(), "not json", "utf-8");
-		const originalError = console.error;
-		const errors: unknown[][] = [];
-		console.error = (...args: unknown[]) => errors.push(args);
-		try {
-			reloadFromDisk();
-		} finally {
-			console.error = originalError;
-		}
+		const errors = captureConsole("error", reloadFromDisk);
 		assert.equal(getExcludedCount(), 0);
 		assert.equal(errors.length, 1);
 		assert.match(String(errors[0]?.[0]), /Failed to load exclusions/);
 	});
 
-	it("rejects persisted exclusions with invalid timestamps", () => {
-		for (const [field, value] of [
-			["expiresAt", null],
-			["expiresAt", 0],
-			["expiresAt", 9_000_000_000_000_000],
-			["recordedAt", null],
-			["recordedAt", -1],
-			["recordedAt", 9_000_000_000_000_000],
+	it("drops malformed persisted exclusions", () => {
+		for (const [patch, expected] of [
+			[{ expiresAt: null }, /invalid expiresAt/],
+			[{ expiresAt: 0 }, /invalid expiresAt/],
+			[{ expiresAt: 9_000_000_000_000_000 }, /invalid expiresAt/],
+			[{ recordedAt: null }, /invalid recordedAt/],
+			[{ recordedAt: -1 }, /invalid recordedAt/],
+			[{ recordedAt: 9_000_000_000_000_000 }, /invalid recordedAt/],
+			[{ reason: null }, /invalid reason/],
+			[{ reason: 503 }, /invalid reason/],
+			[{ reason: { bad: true } }, /invalid reason/],
+			[{ reason: ["503"] }, /invalid reason/],
+			[{ modelId: 42 }, /invalid modelId/],
+			[{ modelId: "" }, /invalid modelId/],
+			[{ provider: 42 }, /invalid provider/],
+			[{ modelId: undefined, provider: "" }, /invalid provider/],
+			[{ modelId: undefined, provider: undefined }, /must include modelId or provider/],
 		] as const) {
 			const now = Date.now();
-			const entry = { modelId: "gpt-4", provider: "openai", reason: "503", recordedAt: now, expiresAt: now + 60_000, [field]: value };
+			const entry = { modelId: "gpt-4", provider: "openai", reason: "503", recordedAt: now, expiresAt: now + 60_000, ...patch };
 			fs.writeFileSync(getExclusionsFilePath(), JSON.stringify({ version: 1, exclusions: [entry] }), "utf-8");
-			const originalError = console.error;
-			const errors: unknown[][] = [];
-			console.error = (...args: unknown[]) => errors.push(args);
-			try {
-				reloadFromDisk();
-			} finally {
-				console.error = originalError;
-			}
+			const warnings = captureConsole("warn", reloadFromDisk);
 			assert.equal(getExcludedCount(), 0);
-			assert.equal(errors.length, 1);
-			assert.match(String(errors[0]?.[1]), new RegExp(`invalid ${field}`));
-		}
-	});
-
-	it("rejects persisted exclusions with non-string reasons", () => {
-		for (const reason of [null, 503, { bad: true }, ["503"]]) {
-			const now = Date.now();
-			fs.writeFileSync(getExclusionsFilePath(), JSON.stringify({
-				version: 1,
-				exclusions: [{ modelId: "gpt-4", provider: "openai", reason, recordedAt: now, expiresAt: now + 60_000 }],
-			}), "utf-8");
-			const originalError = console.error;
-			const errors: unknown[][] = [];
-			console.error = (...args: unknown[]) => errors.push(args);
-			try {
-				reloadFromDisk();
-			} finally {
-				console.error = originalError;
-			}
+			assert.equal(warnings.length, 1);
+			assert.match(String(warnings[0]?.[0]), expected);
+			assert.equal(captureConsole("warn", reloadFromDisk).length, 0);
 			assert.equal(getExcludedCount(), 0);
-			assert.equal(errors.length, 1);
-			assert.match(String(errors[0]?.[1]), /invalid reason/);
-			assert.deepEqual(filterFallbackCandidates(["openai/gpt-4", "anthropic/claude-3"]), ["openai/gpt-4", "anthropic/claude-3"]);
 		}
 	});
-});
+});