@vellumai/assistant 0.7.2 → 0.7.3

package/src/__tests__/cu-unified-flow.test.ts

@@ -9,8 +9,20 @@ import { afterEach, describe, expect, mock, test } from "bun:test";
 
 const sentMessages: unknown[] = [];
 let mockHasClient = true; // Default to true for CU unified flow tests
-let mockCuClients: Array<{ clientId: string; capabilities: string[] }> = [
-  { clientId: "mock-client-1", capabilities: ["host_cu"] },
+// Default principal id used for both ctx.trustContext and clients in the
+// existing single-user tests. Tests that exercise cross-user behaviour
+// override this on individual clients and on the SurfaceConversationContext.
+const DEFAULT_PRINCIPAL = "user-1";
+let mockCuClients: Array<{
+  clientId: string;
+  capabilities: string[];
+  actorPrincipalId?: string;
+}> = [
+  {
+    clientId: "mock-client-1",
+    capabilities: ["host_cu"],
+    actorPrincipalId: DEFAULT_PRINCIPAL,
+  },
 ];
 
 mock.module("../runtime/assistant-event-hub.js", () => ({
@@ -22,6 +34,8 @@ mock.module("../runtime/assistant-event-hub.js", () => ({
       cap === "host_cu" ? mockCuClients : [],
     getClientById: (id: string) =>
       mockCuClients.find((c) => c.clientId === id) ?? null,
+    getActorPrincipalIdForClient: (id: string) =>
+      mockCuClients.find((c) => c.clientId === id)?.actorPrincipalId,
   },
 }));
 
@@ -38,12 +52,25 @@ type SurfaceConversationContext =
 /**
  * Build a minimal SurfaceConversationContext with optional hostCuProxy.
  * Only the fields required by the CU routing path are populated.
+ *
+ * `trustContext` defaults to a guardian context owned by `DEFAULT_PRINCIPAL`.
+ * Pass `null` to omit the field entirely (used to verify same-user
+ * enforcement when the conversation has no source actor principal).
  */
 function buildMockContext(
   hostCuProxy?: InstanceType<typeof HostCuProxy>,
+  trustGuardianPrincipalId: string | null = DEFAULT_PRINCIPAL,
 ): SurfaceConversationContext {
   return {
     conversationId: "test-session",
+    trustContext:
+      trustGuardianPrincipalId != null
+        ? {
+            sourceChannel: "vellum",
+            trustClass: "guardian",
+            guardianPrincipalId: trustGuardianPrincipalId,
+          }
+        : undefined,
     traceEmitter: { emit: () => {} },
     sendToClient: () => {},
     pendingSurfaceActions: new Map(),
@@ -72,7 +99,13 @@ describe("surfaceProxyResolver — CU tool routing", () => {
   function setupProxy(maxSteps?: number): SurfaceConversationContext {
     sentMessages.length = 0;
     mockHasClient = true;
-    mockCuClients = [{ clientId: "mock-client-1", capabilities: ["host_cu"] }];
+    mockCuClients = [
+      {
+        clientId: "mock-client-1",
+        capabilities: ["host_cu"],
+        actorPrincipalId: DEFAULT_PRINCIPAL,
+      },
+    ];
     proxy = new HostCuProxy(maxSteps);
     return buildMockContext(proxy);
   }
@@ -375,11 +408,19 @@ describe("surfaceProxyResolver — CU tool routing", () => {
   // -------------------------------------------------------------------------
 
   describe("multi-client ambiguity guard", () => {
-    test("returns error when multiple CU clients connected and no target_client_id given", async () => {
+    test("returns error when multiple same-user CU clients connected and no target_client_id given", async () => {
       const ctx = setupProxy();
       mockCuClients = [
-        { clientId: "client-a", capabilities: ["host_cu"] },
-        { clientId: "client-b", capabilities: ["host_cu"] },
+        {
+          clientId: "client-a",
+          capabilities: ["host_cu"],
+          actorPrincipalId: DEFAULT_PRINCIPAL,
+        },
+        {
+          clientId: "client-b",
+          capabilities: ["host_cu"],
+          actorPrincipalId: DEFAULT_PRINCIPAL,
+        },
       ];
 
       const result = await surfaceProxyResolver(ctx, "computer_use_click", {
@@ -397,8 +438,16 @@ describe("surfaceProxyResolver — CU tool routing", () => {
     test("proceeds when multiple clients connected and target_client_id is given", async () => {
       const ctx = setupProxy();
       mockCuClients = [
-        { clientId: "client-a", capabilities: ["host_cu"] },
-        { clientId: "client-b", capabilities: ["host_cu"] },
+        {
+          clientId: "client-a",
+          capabilities: ["host_cu"],
+          actorPrincipalId: DEFAULT_PRINCIPAL,
+        },
+        {
+          clientId: "client-b",
+          capabilities: ["host_cu"],
+          actorPrincipalId: DEFAULT_PRINCIPAL,
+        },
       ];
 
       const resultPromise = surfaceProxyResolver(ctx, "computer_use_click", {
@@ -508,8 +557,18 @@ describe("surfaceProxyResolver — CU tool routing", () => {
     test("dispatches and records action when targetClientId is valid", async () => {
       const ctx = setupProxy();
       mockCuClients = [
-        { clientId: "cu-client", capabilities: ["host_cu"] },
-        { clientId: "client-b", capabilities: ["host_cu"] }, // would otherwise trip ambiguity guard
+        {
+          clientId: "cu-client",
+          capabilities: ["host_cu"],
+          actorPrincipalId: DEFAULT_PRINCIPAL,
+        },
+        // Second client present to ensure target_client_id resolves
+        // unambiguously and would otherwise trip the ambiguity guard.
+        {
+          clientId: "client-b",
+          capabilities: ["host_cu"],
+          actorPrincipalId: DEFAULT_PRINCIPAL,
+        },
       ];
 
       const resultPromise = surfaceProxyResolver(ctx, "computer_use_click", {
@@ -532,6 +591,113 @@ describe("surfaceProxyResolver — CU tool routing", () => {
     });
   });
 
+  // -------------------------------------------------------------------------
+  // Same-user enforcement (dispatch layer)
+  //
+  // The proxy enforces this internally as well — these tests verify the
+  // dispatch performs the same-user rejection before the proxy is invoked
+  // (so no step is burned and no action history mutated), and uses the
+  // canonical rejection message.
+  // -------------------------------------------------------------------------
+
+  describe("same-user enforcement", () => {
+    test("rejects targeted CU dispatch from a different actor principal", async () => {
+      sentMessages.length = 0;
+      mockHasClient = true;
+      mockCuClients = [
+        {
+          clientId: "cu-client",
+          capabilities: ["host_cu"],
+          actorPrincipalId: "user-other",
+        },
+      ];
+      proxy = new HostCuProxy();
+      const ctx = buildMockContext(proxy, DEFAULT_PRINCIPAL);
+
+      const result = await surfaceProxyResolver(ctx, "computer_use_click", {
+        element_id: 1,
+        reasoning: "click",
+        target_client_id: "cu-client",
+      });
+
+      expect(result.isError).toBe(true);
+      expect(result.content).toContain(
+        "Submitting actor does not match the target client's actor",
+      );
+      // No state mutation, no dispatch.
+      expect(proxy.stepCount).toBe(0);
+      expect(proxy.actionHistory).toHaveLength(0);
+      expect(sentMessages).toHaveLength(0);
+    });
+
+    test("rejects when the conversation has no source actor principal", async () => {
+      sentMessages.length = 0;
+      mockHasClient = true;
+      mockCuClients = [
+        {
+          clientId: "cu-client",
+          capabilities: ["host_cu"],
+          actorPrincipalId: DEFAULT_PRINCIPAL,
+        },
+      ];
+      proxy = new HostCuProxy();
+      const ctx = buildMockContext(proxy, null);
+
+      const result = await surfaceProxyResolver(ctx, "computer_use_click", {
+        element_id: 1,
+        reasoning: "click",
+        target_client_id: "cu-client",
+      });
+
+      expect(result.isError).toBe(true);
+      expect(result.content).toContain(
+        "Submitting actor does not match the target client's actor",
+      );
+      expect(sentMessages).toHaveLength(0);
+    });
+
+    test("auto-resolves to the unique same-user CU client when cross-user clients are present", async () => {
+      // Regression: previously the dispatch counted only same-user clients
+      // for the multi-client guard, so 1 same-user + 1 cross-user passed the
+      // guard with no targetClientId — and the proxy then broadcast to ALL
+      // host_cu subscribers, including the cross-user one.
+      sentMessages.length = 0;
+      mockHasClient = true;
+      mockCuClients = [
+        {
+          clientId: "cu-mine",
+          capabilities: ["host_cu"],
+          actorPrincipalId: DEFAULT_PRINCIPAL,
+        },
+        {
+          clientId: "cu-other",
+          capabilities: ["host_cu"],
+          actorPrincipalId: "user-other",
+        },
+      ];
+      proxy = new HostCuProxy();
+      const ctx = buildMockContext(proxy, DEFAULT_PRINCIPAL);
+
+      const resultPromise = surfaceProxyResolver(ctx, "computer_use_click", {
+        element_id: 1,
+        reasoning: "click",
+        // Intentionally no target_client_id — exercises auto-resolve.
+      });
+
+      // Broadcast happens, but with the same-user clientId set so only
+      // that client receives it.
+      expect(sentMessages).toHaveLength(1);
+      const sent = sentMessages[0] as Record<string, unknown>;
+      expect(sent.targetClientId).toBe("cu-mine");
+
+      // Manually resolve to clean up the pending promise.
+      proxy.processObservation(sent.requestId as string, {
+        executionResult: "ok",
+      });
+      await resultPromise;
+    });
+  });
+
   describe("step limit enforcement through resolver", () => {
     test("rejects action tools when step limit exceeded", async () => {
       const ctx = setupProxy(2); // maxSteps = 2

package/src/__tests__/date-context.test.ts

@@ -1,8 +1,11 @@
 import { describe, expect, test } from "bun:test";
 
+import { UiConfigSchema } from "../config/schemas/platform.js";
 import {
+  canonicalizeTimeZone,
   extractUserTimeZoneFromRecall,
   formatTurnTimestamp,
+  resolveTurnTimezoneContext,
 } from "../daemon/date-context.js";
 
 // ---------------------------------------------------------------------------
@@ -85,6 +88,156 @@ describe("extractUserTimeZoneFromRecall", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// UiConfigSchema timezone fields
+// ---------------------------------------------------------------------------
+
+describe("UiConfigSchema timezone fields", () => {
+  test("accepts canonicalizable IANA timezone identifiers", () => {
+    const result = UiConfigSchema.parse({
+      userTimezone: "america/new_york",
+      detectedTimezone: "america/los_angeles",
+    });
+
+    expect(result.userTimezone).toBe("America/New_York");
+    expect(result.detectedTimezone).toBe("America/Los_Angeles");
+    expect(UiConfigSchema.parse({ userTimezone: "UTC" }).userTimezone).toBe(
+      "UTC",
+    );
+  });
+
+  test("accepts empty-string clearing sentinels", () => {
+    const result = UiConfigSchema.parse({
+      userTimezone: "",
+      detectedTimezone: "",
+    });
+
+    expect(result.userTimezone).toBe("");
+    expect(result.detectedTimezone).toBe("");
+  });
+
+  test("rejects invalid non-empty userTimezone and detectedTimezone values", () => {
+    expect(() =>
+      UiConfigSchema.parse({ userTimezone: "not-a-timezone" }),
+    ).toThrow("ui.userTimezone must be a valid IANA timezone identifier");
+    expect(() =>
+      UiConfigSchema.parse({ detectedTimezone: "Mars/Olympus_Mons" }),
+    ).toThrow("ui.detectedTimezone must be a valid IANA timezone identifier");
+    expect(() => UiConfigSchema.parse({ userTimezone: "+05:30" })).toThrow(
+      "ui.userTimezone must be a valid IANA timezone identifier",
+    );
+  });
+
+  test("rejects ambiguous abbreviations and offset strings", () => {
+    for (const value of ["EST", "PST", "UTC+5:30", "GMT-0800", "+05:30"]) {
+      expect(() => UiConfigSchema.parse({ userTimezone: value })).toThrow(
+        "ui.userTimezone must be a valid IANA timezone identifier",
+      );
+      expect(() => UiConfigSchema.parse({ detectedTimezone: value })).toThrow(
+        "ui.detectedTimezone must be a valid IANA timezone identifier",
+      );
+    }
+  });
+});
+
+// ---------------------------------------------------------------------------
+// canonicalizeTimeZone
+// ---------------------------------------------------------------------------
+
+describe("canonicalizeTimeZone", () => {
+  test("returns canonical timezone identifiers and ignores empty values", () => {
+    expect(canonicalizeTimeZone("america/new_york")).toBe("America/New_York");
+    expect(canonicalizeTimeZone("")).toBeNull();
+    expect(canonicalizeTimeZone(null)).toBeNull();
+    expect(canonicalizeTimeZone("not-a-timezone")).toBeNull();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// resolveTurnTimezoneContext
+// ---------------------------------------------------------------------------
+
+describe("resolveTurnTimezoneContext", () => {
+  test("prefers configured user timezone over automatic sources", () => {
+    const context = resolveTurnTimezoneContext({
+      configuredUserTimeZone: "America/New_York",
+      clientTimezone: "America/Chicago",
+      detectedTimezone: "Asia/Tokyo",
+      hostTimeZone: "Europe/London",
+    });
+
+    expect(context.effectiveTimezone).toBe("America/New_York");
+    expect(context.source).toBe("configuredUserTimezone");
+  });
+
+  test("prefers client timezone over detected and host timezones", () => {
+    const context = resolveTurnTimezoneContext({
+      clientTimezone: "America/Chicago",
+      detectedTimezone: "Asia/Tokyo",
+      hostTimeZone: "Europe/London",
+    });
+
+    expect(context.effectiveTimezone).toBe("America/Chicago");
+    expect(context.source).toBe("clientTimezone");
+  });
+
+  test("prefers detected timezone over host timezone", () => {
+    const context = resolveTurnTimezoneContext({
+      detectedTimezone: "Asia/Tokyo",
+      hostTimeZone: "Europe/London",
+    });
+
+    expect(context.effectiveTimezone).toBe("Asia/Tokyo");
+    expect(context.source).toBe("detectedTimezone");
+  });
+
+  test("uses host timezone before UTC fallback", () => {
+    const context = resolveTurnTimezoneContext({
+      hostTimeZone: "Europe/London",
+    });
+
+    expect(context.effectiveTimezone).toBe("Europe/London");
+    expect(context.source).toBe("hostTimezone");
+  });
+
+  test("falls back to UTC when no timezone resolves", () => {
+    const context = resolveTurnTimezoneContext({
+      configuredUserTimeZone: "not-a-timezone",
+      clientTimezone: "also-invalid",
+      detectedTimezone: "",
+      hostTimeZone: "still-invalid",
+    });
+
+    expect(context.effectiveTimezone).toBe("UTC");
+    expect(context.source).toBe("utcFallback");
+  });
+
+  test("ignores empty strings during runtime resolution", () => {
+    const context = resolveTurnTimezoneContext({
+      configuredUserTimeZone: "",
+      clientTimezone: "",
+      detectedTimezone: "",
+      hostTimeZone: "UTC",
+    });
+
+    expect(context.configuredUserTimezone).toBeNull();
+    expect(context.clientTimezone).toBeNull();
+    expect(context.detectedTimezone).toBeNull();
+    expect(context.effectiveTimezone).toBe("UTC");
+    expect(context.source).toBe("hostTimezone");
+  });
+
+  test("does not use recalled profile timezone in normal turn precedence", () => {
+    const context = resolveTurnTimezoneContext({
+      userTimeZone: "Asia/Tokyo",
+      hostTimeZone: "UTC",
+    });
+
+    expect(context.effectiveTimezone).toBe("UTC");
+    expect(context.source).toBe("hostTimezone");
+  });
+});
+
 // ---------------------------------------------------------------------------
 // formatTurnTimestamp
 // ---------------------------------------------------------------------------
@@ -127,11 +280,20 @@ describe("formatTurnTimestamp", () => {
     expect(result).toBe("2026-04-02 (Thursday) 06:52:33 +00:00 (UTC)");
   });
 
-  test("handles user timezone override", () => {
+  test("handles configured user timezone override", () => {
     const result = formatTurnTimestamp({
       nowMs: THU_APR_02_0652,
       hostTimeZone: "UTC",
-      userTimeZone: "Asia/Tokyo",
+      configuredUserTimeZone: "Asia/Tokyo",
+    });
+    expect(result).toBe("2026-04-02 (Thursday) 15:52:33 +09:00 (Asia/Tokyo)");
+  });
+
+  test("uses client timezone when no configured override exists", () => {
+    const result = formatTurnTimestamp({
+      nowMs: THU_APR_02_0652,
+      hostTimeZone: "UTC",
+      clientTimezone: "Asia/Tokyo",
     });
     expect(result).toBe("2026-04-02 (Thursday) 15:52:33 +09:00 (Asia/Tokyo)");
   });

package/src/__tests__/disk-pressure-guard.test.ts

@@ -0,0 +1,262 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+
+import type { DiskPressureTransitionResult } from "../daemon/disk-pressure-guard.js";
+import type { DiskUsageInfo } from "../util/disk-usage.js";
+
+let diskSample: DiskUsageInfo | null = null;
+let diskSampleError: unknown = null;
+let diskSampleCalls = 0;
+
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({}),
+}));
+
+mock.module("../util/disk-usage.js", () => ({
+  getDiskUsageInfo: () => {
+    diskSampleCalls += 1;
+    if (diskSampleError) throw diskSampleError;
+    return diskSample;
+  },
+}));
+
+mock.module("../runtime/assistant-event.js", () => ({
+  buildAssistantEvent: (message: unknown, conversationId?: string) => ({
+    id: "event-test",
+    type: "message",
+    timestamp: new Date().toISOString(),
+    conversationId,
+    message,
+  }),
+}));
+
+mock.module("../runtime/assistant-event-hub.js", () => ({
+  AssistantEventHub: class {},
+  broadcastMessage: () => {},
+  capabilityForMessageType: () => undefined,
+  assistantEventHub: {
+    publish: async () => {},
+  },
+}));
+
+const { _setOverridesForTesting } =
+  await import("../config/assistant-feature-flags.js");
+const {
+  DISK_PRESSURE_OVERRIDE_CONFIRMATION,
+  DISK_PRESSURE_THRESHOLD_PERCENT,
+  __getDiskPressureGuardTimerForTests,
+  __resetDiskPressureGuardForTests,
+  acknowledgeDiskPressureLock,
+  evaluateDiskPressureNow,
+  getDiskPressureStatus,
+  overrideDiskPressureLock,
+  startDiskPressureGuard,
+  stopDiskPressureGuard,
+} = await import("../daemon/disk-pressure-guard.js");
+
+function setFeatureFlag(enabled: boolean): void {
+  _setOverridesForTesting({ "safe-storage-limits": enabled });
+}
+
+function setDiskUsage(usedMb: number, totalMb = 100): void {
+  diskSample = {
+    path: "/workspace",
+    totalMb,
+    usedMb,
+    freeMb: Math.max(0, totalMb - usedMb),
+  };
+  diskSampleError = null;
+}
+
+function expectRejected(
+  result: DiskPressureTransitionResult,
+  reason: Exclude<DiskPressureTransitionResult, { ok: true }>["reason"],
+): asserts result is Exclude<DiskPressureTransitionResult, { ok: true }> {
+  expect(result.ok).toBe(false);
+  if (result.ok) {
+    throw new Error("Expected disk pressure transition to be rejected");
+  }
+  expect(result.reason).toBe(reason);
+}
+
+beforeEach(() => {
+  __resetDiskPressureGuardForTests();
+  setFeatureFlag(true);
+  setDiskUsage(10);
+  diskSampleCalls = 0;
+});
+
+afterEach(() => {
+  __resetDiskPressureGuardForTests();
+  _setOverridesForTesting({});
+  diskSample = null;
+  diskSampleError = null;
+  diskSampleCalls = 0;
+});
+
+describe("disk pressure guard", () => {
+  test("returns a stable disabled status without sampling when the flag is disabled", () => {
+    setDiskUsage(99);
+    setFeatureFlag(false);
+
+    const status = evaluateDiskPressureNow();
+
+    expect(status.enabled).toBe(false);
+    expect(status.state).toBe("disabled");
+    expect(status.locked).toBe(false);
+    expect(status.effectivelyLocked).toBe(false);
+    expect(status.usagePercent).toBeNull();
+    expect(diskSampleCalls).toBe(0);
+    expect(getDiskPressureStatus()).toEqual(status);
+  });
+
+  test("locks when sampled usage reaches the threshold", () => {
+    setDiskUsage(DISK_PRESSURE_THRESHOLD_PERCENT);
+
+    const status = evaluateDiskPressureNow();
+
+    expect(status.enabled).toBe(true);
+    expect(status.state).toBe("critical");
+    expect(status.locked).toBe(true);
+    expect(status.acknowledged).toBe(false);
+    expect(status.overrideActive).toBe(false);
+    expect(status.effectivelyLocked).toBe(true);
+    expect(status.lockId).toBeTruthy();
+    expect(status.usagePercent).toBe(DISK_PRESSURE_THRESHOLD_PERCENT);
+    expect(status.thresholdPercent).toBe(DISK_PRESSURE_THRESHOLD_PERCENT);
+    expect(status.path).toBe("/workspace");
+    expect(status.lastCheckedAt).toBeTruthy();
+    expect(status.blockedCapabilities.length).toBeGreaterThan(0);
+  });
+
+  test("acknowledges an active lock without overriding it", () => {
+    setDiskUsage(99);
+    evaluateDiskPressureNow();
+
+    const result = acknowledgeDiskPressureLock();
+
+    expect(result.ok).toBe(true);
+    expect(result.status.acknowledged).toBe(true);
+    expect(result.status.overrideActive).toBe(false);
+    expect(result.status.effectivelyLocked).toBe(true);
+  });
+
+  test("unlocks and clears acknowledgement and override when usage falls below threshold", () => {
+    setDiskUsage(99);
+    evaluateDiskPressureNow();
+    acknowledgeDiskPressureLock();
+    overrideDiskPressureLock(DISK_PRESSURE_OVERRIDE_CONFIRMATION);
+
+    setDiskUsage(20);
+    const status = evaluateDiskPressureNow();
+
+    expect(status.state).toBe("ok");
+    expect(status.locked).toBe(false);
+    expect(status.acknowledged).toBe(false);
+    expect(status.overrideActive).toBe(false);
+    expect(status.effectivelyLocked).toBe(false);
+    expect(status.lockId).toBeNull();
+    expect(status.blockedCapabilities).toEqual([]);
+  });
+
+  test("overrides an active lock only with the exact confirmation after trimming whitespace", () => {
+    setDiskUsage(99);
+    evaluateDiskPressureNow();
+
+    const invalid = overrideDiskPressureLock("I accept the risks");
+    expectRejected(invalid, "invalid_confirmation");
+    expect(invalid.status.effectivelyLocked).toBe(true);
+
+    const valid = overrideDiskPressureLock(
+      `  ${DISK_PRESSURE_OVERRIDE_CONFIRMATION}  `,
+    );
+
+    expect(valid.ok).toBe(true);
+    expect(valid.status.locked).toBe(true);
+    expect(valid.status.overrideActive).toBe(true);
+    expect(valid.status.effectivelyLocked).toBe(false);
+  });
+
+  test("rejects acknowledgement when no lock is active", () => {
+    setDiskUsage(10);
+    evaluateDiskPressureNow();
+
+    const result = acknowledgeDiskPressureLock();
+
+    expectRejected(result, "not_locked");
+    expect(result.status.locked).toBe(false);
+  });
+
+  test("rejects override when no lock is active", () => {
+    setDiskUsage(10);
+    evaluateDiskPressureNow();
+
+    const result = overrideDiskPressureLock(
+      DISK_PRESSURE_OVERRIDE_CONFIRMATION,
+    );
+
+    expectRejected(result, "not_locked");
+    expect(result.status.locked).toBe(false);
+  });
+
+  test("rejects repeated override while preserving the existing override", () => {
+    setDiskUsage(99);
+    evaluateDiskPressureNow();
+    const first = overrideDiskPressureLock(DISK_PRESSURE_OVERRIDE_CONFIRMATION);
+    expect(first.ok).toBe(true);
+
+    const second = overrideDiskPressureLock(
+      DISK_PRESSURE_OVERRIDE_CONFIRMATION,
+    );
+
+    expectRejected(second, "already_overridden");
+    expect(second.status.overrideActive).toBe(true);
+    expect(second.status.effectivelyLocked).toBe(false);
+  });
+
+  test("sample failures degrade open and do not preserve a prior lock", () => {
+    setDiskUsage(99);
+    evaluateDiskPressureNow();
+    expect(getDiskPressureStatus().locked).toBe(true);
+
+    diskSampleError = new Error("sample failed");
+    const status = evaluateDiskPressureNow();
+
+    expect(status.enabled).toBe(true);
+    expect(status.state).toBe("unknown");
+    expect(status.locked).toBe(false);
+    expect(status.effectivelyLocked).toBe(false);
+    expect(status.error).toBe("sample failed");
+    expect(status.lastCheckedAt).toBeTruthy();
+  });
+
+  test("timer start and stop are idempotent", () => {
+    expect(__getDiskPressureGuardTimerForTests()).toBeNull();
+
+    startDiskPressureGuard();
+    const firstTimer = __getDiskPressureGuardTimerForTests();
+    expect(firstTimer).toBeTruthy();
+
+    startDiskPressureGuard();
+    expect(__getDiskPressureGuardTimerForTests()).toBe(firstTimer);
+
+    stopDiskPressureGuard();
+    expect(__getDiskPressureGuardTimerForTests()).toBeNull();
+
+    stopDiskPressureGuard();
+    expect(__getDiskPressureGuardTimerForTests()).toBeNull();
+  });
+
+  test("disabling the flag clears an active timer and lock", () => {
+    setDiskUsage(99);
+    evaluateDiskPressureNow();
+    startDiskPressureGuard();
+    expect(__getDiskPressureGuardTimerForTests()).toBeTruthy();
+
+    setFeatureFlag(false);
+    const status = evaluateDiskPressureNow();
+
+    expect(status.enabled).toBe(false);
+    expect(status.locked).toBe(false);
+    expect(__getDiskPressureGuardTimerForTests()).toBeNull();
+  });
+});