@wenathlan/devthink 2.0.13 → 2.0.15

package/tests/apimap.test.ts

@@ -0,0 +1,112 @@
+import { describe, expect, it } from "vitest";
+import {
+  apimapentries,
+  apimapentryof,
+  apimapkinds,
+  apimapresolve,
+  apimapunmapped,
+  apimapbrowserof,
+  apimapbrowsercacheprobe,
+  apifeatureflagintersection,
+  apimapstructerrorof,
+} from "../crossbrowser.js";
+
+describe("apimap catalog", () => {
+  it("records every webextension api the codebase touches with a chromium and firefox mapping", () => {
+    const entries = apimapentries();
+    expect(entries.length).toBeGreaterThan(20);
+    for (const entry of entries) {
+      expect(entry.chromium).not.toBe("");
+      expect(entry.firefox).not.toBe("");
+      expect(entry.api).not.toBe("");
+    }
+  });
+
+  it("resolves the right call through the runtime browser probe", () => {
+    const chromium = apimapresolve({ api: "runtime.geturl", runtime: { chrome: { runtime: { id: "abc" } } } });
+    expect(chromium.ok).toBe(true);
+    expect(chromium.browser).toBe("chromium");
+    expect(chromium.equivalent).toBe("chrome.runtime.getURL");
+    const firefox = apimapresolve({ api: "runtime.geturl", runtime: { browser: { runtime: { id: "abc" } } } });
+    expect(firefox.ok).toBe(true);
+    expect(firefox.browser).toBe("firefox");
+    expect(firefox.equivalent).toBe("browser.runtime.getURL");
+  });
+
+  it("reports unmapped apis at build time and fails the build when a new api lacks a row", () => {
+    const report = apimapunmapped();
+    expect(report.failed).toBe(false);
+    expect(report.missingchromium.length).toBe(0);
+    expect(report.missingfirefox.length).toBe(0);
+    const partial = apimapunmapped([
+      ...apimapentries(),
+      { api: "fictional.api", chromium: "", firefox: "", safari: "", kind: "method" },
+    ]);
+    expect(partial.failed).toBe(true);
+    expect(partial.missingchromium).toContain("fictional.api");
+    expect(partial.missingfirefox).toContain("fictional.api");
+  });
+
+  it("looks up one apimap entry by its reviewed api name", () => {
+    const entry = apimapentryof("runtime.geturl");
+    expect(entry?.api).toBe("runtime.geturl");
+    expect(apimapentryof("nonexistent.api")).toBeUndefined();
+  });
+
+  it("declares the four kind categories", () => {
+    const kinds = apimapkinds();
+    expect(kinds).toEqual(["namespace", "method", "event", "property"]);
+  });
+
+  it("caches the detected browser in memory across calls", () => {
+    const probe = apimapbrowsercacheprobe({ runtime: { chrome: { runtime: { id: "abc" } } } });
+    expect(probe.probe()).toBe("chromium");
+    expect(probe.probe()).toBe("chromium");
+    const refreshed = probe.refresh();
+    expect(refreshed).toBe("chromium");
+  });
+
+  it("surfaces unmapped apis as structured errors with the retry hint none", () => {
+    const resolution = apimapresolve({ api: "runtime.geturl", browser: "safari" });
+    expect(resolution.ok).toBe(true);
+    const struct = apimapstructerrorof({ api: "fictional.api", browser: "safari", reason: "no mapping", now: 1000 });
+    expect(struct.family).toBe("apimap");
+    expect(struct.retry).toBe("none");
+    expect(struct.browser).toBe("safari");
+    expect(struct.api).toBe("fictional.api");
+    expect(struct.at).toBe(1000);
+  });
+
+  it("defaults the feature flag set to the intersection across chromium, firefox and safari", () => {
+    const intersection = apifeatureflagintersection();
+    expect(intersection).toContain("runtime.geturl");
+    expect(intersection).toContain("tabs.query");
+    expect(intersection).toContain("scripting.executeScript");
+  });
+
+  it("resolves the sidepanel api to the polyfill fallback on firefox", () => {
+    const firefox = apimapresolve({ api: "sidePanel.open", browser: "firefox" });
+    expect(firefox.ok).toBe(true);
+    expect(firefox.equivalent).toBe("browserpolyfill.sidepanel.open");
+    const safari = apimapresolve({ api: "offscreen.createDocument", browser: "safari" });
+    expect(safari.ok).toBe(true);
+    expect(safari.equivalent).toBe("browserpolyfill.offscreen.inline");
+  });
+
+  it("probes the running browser from the user agent when the runtime seam is absent", () => {
+    expect(
+      apimapbrowserof({
+        probeuseragent: () => "Mozilla/5.0 (X11; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0",
+      }),
+    ).toBe("firefox");
+    expect(
+      apimapbrowserof({ probeuseragent: () => "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_0) Safari/605.1.15" }),
+    ).toBe("safari");
+    expect(
+      apimapbrowserof({
+        probeuseragent: () =>
+          "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
+      }),
+    ).toBe("chromium");
+  });
+});

package/tests/approvalgate.test.ts

@@ -0,0 +1,175 @@
+import { describe, expect, it } from "vitest";
+import {
+  approvalprompt,
+  defaultapprovalwindowms,
+  expireapprovals,
+  listapprovals,
+  redactparams,
+  requireapproval,
+  resolveapproval,
+} from "../gates.js";
+import { consentmetagrade } from "../policy.js";
+import { buildtoolcatalog } from "../tools.js";
+import type { approvalrequest } from "../types.js";
+
+const now = 1_800_000_000_000;
+const catalog = buildtoolcatalog();
+
+describe("approval gate lifecycle", () => {
+  it("raises gates for sensitive tool calls with the full arguments and timeout", () => {
+    const gate = requireapproval({
+      clientid: "client1",
+      tool: "browser.click",
+      reason: "The click runs only as the approved plan step it names.",
+      params: { stepid: "s1", target: "#go" },
+      now,
+      timeout: 5000,
+      id: "gate-1",
+    });
+    expect(gate.id).toBe("gate-1");
+    expect(gate.state).toBe("pending");
+    expect(gate.raisedat).toBe(now);
+    expect(gate.timeoutat).toBe(now + 5000);
+    expect(gate.params).toEqual({ stepid: "s1", target: "#go" });
+    const secretgate = requireapproval({
+      clientid: "client1",
+      tool: "browser.type",
+      reason: "Typing.",
+      params: { stepid: "s2", value: "hunter2" },
+      now,
+      secretfields: ["value"],
+    });
+    expect(secretgate.secretfields).toEqual(["value"]);
+    expect(secretgate.timeoutat).toBeUndefined();
+    expect(defaultapprovalwindowms).toBe(120_000);
+  });
+
+  it("resolves pending gates with the actor and latency while closed gates stay closed", () => {
+    const pending = requireapproval({
+      clientid: "client1",
+      tool: "browser.click",
+      reason: "Click.",
+      params: { stepid: "s1" },
+      now,
+      id: "gate-1",
+    });
+    const approved = resolveapproval({
+      requests: [pending],
+      id: "gate-1",
+      decision: "approved",
+      actor: "user",
+      now: now + 4000,
+    });
+    expect(approved.exec?.decision).toBe("approved");
+    expect(approved.exec?.actor).toBe("user");
+    expect(approved.exec?.latencyms).toBe(4000);
+    expect(approved.requests[0]?.state).toBe("approved");
+    expect(approved.requests[0]?.decidedat).toBe(now + 4000);
+    const again = resolveapproval({
+      requests: approved.requests,
+      id: "gate-1",
+      decision: "refused",
+      actor: "user",
+      now: now + 5000,
+    });
+    expect(again.exec).toBeUndefined();
+    expect(again.requests[0]?.state).toBe("approved");
+    const refused = resolveapproval({
+      requests: [pending],
+      id: "gate-1",
+      decision: "refused",
+      actor: "user",
+      now: now + 1500,
+    });
+    expect(refused.exec?.decision).toBe("refused");
+    expect(refused.exec?.latencyms).toBe(1500);
+    expect(
+      resolveapproval({ requests: [pending], id: "missing", decision: "approved", actor: "user", now }).exec,
+    ).toBeUndefined();
+  });
+
+  it("expires unanswered gates past their window with the default refusal", () => {
+    const short = requireapproval({
+      clientid: "client1",
+      tool: "browser.click",
+      reason: "Click.",
+      params: {},
+      now,
+      timeout: 1000,
+      id: "gate-1",
+    });
+    const endless = requireapproval({
+      clientid: "client2",
+      tool: "browser.type",
+      reason: "Type.",
+      params: {},
+      now,
+      id: "gate-2",
+    });
+    const swept = expireapprovals([short, endless], now + 1500);
+    expect(swept[0]?.state).toBe("expired");
+    expect(swept[1]?.state).toBe("pending");
+    const resolved = expireapprovals([{ ...short, state: "approved" }], now + 1500);
+    expect(resolved[0]?.state).toBe("approved");
+    expect(listapprovals([endless, short])[0]?.id).toBe("gate-2");
+  });
+});
+
+describe("approval prompts and secret redaction", () => {
+  it("redacts the fields the user marked secret while the rest stays visible", () => {
+    expect(redactparams({ stepid: "s1", value: "hunter2", target: "#go" }, ["value"])).toEqual({
+      stepid: "s1",
+      value: "[redacted]",
+      target: "#go",
+    });
+    expect(redactparams({ stepid: "s1" }, [])).toEqual({ stepid: "s1" });
+    expect(redactparams({ value: "hunter2" }, ["value"]).value).not.toContain("hunter");
+  });
+
+  it("carries the client identity, the called tool and the redacted arguments in every prompt", () => {
+    const gate = requireapproval({
+      clientid: "client1",
+      tool: "browser.type",
+      reason: "The typing runs only as the approved plan step it names.",
+      params: { stepid: "s1", value: "hunter2" },
+      now,
+      secretfields: ["value"],
+    });
+    const prompt = approvalprompt(gate, { fingerprint: "fp-1", displayname: "Laptop agent" });
+    expect(prompt).toContain("Laptop agent");
+    expect(prompt).toContain("fp-1");
+    expect(prompt).toContain("browser.type");
+    expect(prompt).toContain("[redacted]");
+    expect(prompt).not.toContain("hunter2");
+    const bare = approvalprompt(gate);
+    expect(bare).toContain("client1");
+    expect(bare).not.toContain("hunter2");
+  });
+});
+
+describe("sensitive tool gating", () => {
+  it("grades every sensitive tool with the approval gate requirement and passes read tools free", () => {
+    for (const tool of catalog.domains.flatMap((domain) => domain.tools)) {
+      const grade = consentmetagrade(tool);
+      expect(grade.allowed).toBe(true);
+      if (tool.risk !== "read") {
+        expect(tool.consentmeta?.approvalrequired).toBe(true);
+        expect(tool.consentmeta?.originscope).toBe("session");
+        expect(tool.consentmeta?.riskclass).toBe(tool.risk);
+      }
+    }
+    const drift = {
+      ...catalog.domains[0]!.tools[9]!,
+      consentmeta: {
+        review: "review",
+        riskclass: "read" as const,
+        approvalrequired: false,
+        originscope: "session" as const,
+      },
+    };
+    expect(consentmetagrade(drift).allowed).toBe(false);
+    const { consentmeta: dropped, ...missing } = catalog.domains[0]!.tools[9]!;
+    void dropped;
+    expect(consentmetagrade(missing).allowed).toBe(false);
+  });
+});

package/tests/artifactmanifest.test.ts

@@ -0,0 +1,204 @@
+import { createHash } from "node:crypto";
+import { describe, expect, it } from "vitest";
+import {
+  artifactchannelof,
+  artifactchannels,
+  artifactmanifestcheck,
+  artifactmanifestnameof,
+  artifactmanifestof,
+  artifactmanifesttext,
+  rollbackpinnedset,
+} from "../pack.js";
+
+const checksumof = (text: string) => createHash("sha256").update(text, "utf8").digest("hex");
+const valid = "a".repeat(64);
+
+describe("artifactmanifest", () => {
+  it("records the name, the size and the sha256 checksum of every artifact with its channels", () => {
+    const manifest = artifactmanifestof({
+      version: "1.1.87",
+      artifacts: [{ name: "devthink1.1.87.zip", size: 1024, checksum: valid }],
+    });
+    expect(manifest.name).toBe("devthink artifact manifest");
+    expect(manifest.version).toBe("1.1.87");
+    expect(manifest.banner).toContain("devthink 1.1.87");
+    expect(manifest.banner).toContain("GPL-3.0-only");
+    expect(manifest.artifacts[0]).toEqual({
+      name: "devthink1.1.87.zip",
+      size: 1024,
+      checksum: valid,
+      channels: ["github", "chromium", "nuget", "maven"],
+    });
+  });
+
+  it("sorts the artifacts by name so the document renders deterministically", () => {
+    const manifest = artifactmanifestof({
+      version: "1.1.87",
+      artifacts: [
+        { name: "devthink-site-1.1.87.zip", size: 5, checksum: valid },
+        { name: "devthink-vscode-1.1.87.vsix", size: 6, checksum: valid },
+        { name: "devthink1.1.87.zip", size: 4, checksum: valid },
+      ],
+    });
+    expect(manifest.artifacts.map((entry) => entry.name)).toEqual([
+      "devthink-site-1.1.87.zip",
+      "devthink-vscode-1.1.87.vsix",
+      "devthink1.1.87.zip",
+    ]);
+    /* the text of the same set renders byte identical on every run because no timestamp enters the document */
+    expect(artifactmanifesttext(manifest)).toBe(
+      artifactmanifesttext(
+        artifactmanifestof({
+          version: "1.1.87",
+          artifacts: [
+            { name: "devthink-site-1.1.87.zip", size: 5, checksum: valid },
+            { name: "devthink-vscode-1.1.87.vsix", size: 6, checksum: valid },
+            { name: "devthink1.1.87.zip", size: 4, checksum: valid },
+          ],
+        }),
+      ),
+    );
+  });
+
+  it("refuses an empty artifact set, a duplicate name and a non sha256 checksum", () => {
+    expect(() => artifactmanifestof({ version: "1.1.87", artifacts: [] })).toThrow();
+    expect(() =>
+      artifactmanifestof({
+        version: "1.1.87",
+        artifacts: [
+          { name: "a.zip", size: 1, checksum: valid },
+          { name: "a.zip", size: 1, checksum: valid },
+        ],
+      }),
+    ).toThrow();
+    expect(() =>
+      artifactmanifestof({ version: "1.1.87", artifacts: [{ name: "a.zip", size: 1, checksum: "short" }] }),
+    ).toThrow();
+    expect(() =>
+      artifactmanifestof({ version: "1.1.87", artifacts: [{ name: "", size: 1, checksum: valid }] }),
+    ).toThrow();
+    expect(() =>
+      artifactmanifestof({ version: "not-a-version", artifacts: [{ name: "a.zip", size: 1, checksum: valid }] }),
+    ).toThrow();
+  });
+
+  it("resolves the publishing channels of the release artifact names", () => {
+    expect(artifactchannels()).toEqual([
+      "github",
+      "npmjs",
+      "githubpackages",
+      "nuget",
+      "maven",
+      "container",
+      "vscode",
+      "firefox",
+      "safari",
+      "chromium",
+      "site",
+      "declarations",
+      "provenance",
+    ]);
+    expect(artifactchannelof("wenathlan-extension-1.1.87.tgz", "1.1.87")).toContain("npmjs");
+    expect(artifactchannelof("extension.1.1.87.nupkg", "1.1.87")).toContain("nuget");
+    expect(artifactchannelof("extension-1.1.87.pom", "1.1.87")).toContain("maven");
+    expect(artifactchannelof("extension-container.json", "1.1.87")).toContain("container");
+    expect(artifactchannelof("devthink-vscode-1.1.87.vsix", "1.1.87")).toContain("vscode");
+    expect(artifactchannelof("devthink-firefox-1.1.87.xpi", "1.1.87")).toContain("firefox");
+    expect(artifactchannelof("devthink-safari-1.1.87.zip", "1.1.87")).toContain("safari");
+    expect(artifactchannelof("devthink1.1.87.zip", "1.1.87")).toContain("chromium");
+    expect(artifactchannelof("devthink-site-1.1.87.zip", "1.1.87")).toContain("site");
+    expect(artifactchannelof("devthink-declarations-1.1.87.zip", "1.1.87")).toContain("declarations");
+    expect(artifactchannelof("devthink-sbom-1.1.87.json", "1.1.87")).toContain("provenance");
+    /* an unrecognized name still rides the github asset channel because every release artifact attaches to the release */
+    expect(artifactchannelof("unknown-artifact.bin", "1.1.87")).toEqual(["github"]);
+    /* the dist bundles ride the npm channels */
+    expect(artifactchannelof("dist/index.js", "1.1.87")).toEqual(["npmjs", "githubpackages"]);
+  });
+
+  it("names the manifest asset with the release version", () => {
+    expect(artifactmanifestnameof("1.1.87")).toBe("devthink-artifactmanifest-1.1.87.json");
+    expect(() => artifactmanifestnameof("not-a-version")).toThrow();
+  });
+
+  it("verifies a built or downloaded set matches the manifest exactly", () => {
+    const manifest = artifactmanifestof({
+      version: "1.1.87",
+      artifacts: [
+        { name: "devthink1.1.87.zip", size: 10, checksum: checksumof("one") },
+        { name: "devthink-site-1.1.87.zip", size: 20, checksum: checksumof("two") },
+      ],
+    });
+    const okcheck = artifactmanifestcheck({
+      manifest,
+      files: [
+        { name: "devthink1.1.87.zip", checksum: checksumof("one") },
+        { name: "devthink-site-1.1.87.zip", checksum: checksumof("two") },
+      ],
+    });
+    expect(okcheck.ok).toBe(true);
+    /* a missing artifact, a mismatched checksum and an unexpected extra file each fail the check */
+    const missing = artifactmanifestcheck({
+      manifest,
+      files: [{ name: "devthink-site-1.1.87.zip", checksum: checksumof("two") }],
+    });
+    expect(missing.ok).toBe(false);
+    expect(missing.missing).toEqual(["devthink1.1.87.zip"]);
+    const mismatched = artifactmanifestcheck({
+      manifest,
+      files: [
+        { name: "devthink1.1.87.zip", checksum: checksumof("changed") },
+        { name: "devthink-site-1.1.87.zip", checksum: checksumof("two") },
+      ],
+    });
+    expect(mismatched.ok).toBe(false);
+    expect(mismatched.mismatched).toEqual(["devthink1.1.87.zip"]);
+    const unexpected = artifactmanifestcheck({
+      manifest,
+      files: [
+        { name: "devthink1.1.87.zip", checksum: checksumof("one") },
+        { name: "devthink-site-1.1.87.zip", checksum: checksumof("two") },
+        { name: "stray.bin", checksum: checksumof("stray") },
+      ],
+    });
+    expect(unexpected.ok).toBe(false);
+    expect(unexpected.unexpected).toEqual(["stray.bin"]);
+    /* the checksums file itself stays ignorable beside the manifest */
+    const withsums = artifactmanifestcheck({
+      manifest,
+      files: [
+        { name: "devthink1.1.87.zip", checksum: checksumof("one") },
+        { name: "devthink-site-1.1.87.zip", checksum: checksumof("two") },
+        { name: "SHA256SUMS.txt", checksum: checksumof("sums") },
+      ],
+    });
+    expect(withsums.ok).toBe(true);
+  });
+
+  it("freezes the rollback pin of the previous release artifact set", () => {
+    const previous = artifactmanifestof({
+      version: "1.1.86",
+      artifacts: [{ name: "devthink1.1.86.zip", size: 10, checksum: checksumof("previous") }],
+    });
+    const pin = rollbackpinnedset({ previousversion: "1.1.86", manifest: previous });
+    expect(pin.tag).toBe("v1.1.86");
+    expect(pin.version).toBe("1.1.86");
+    expect(pin.artifacts).toEqual([
+      {
+        name: "devthink1.1.86.zip",
+        checksum: checksumof("previous"),
+        channels: ["github", "chromium", "nuget", "maven"],
+      },
+    ]);
+    expect(pin.procedure).toEqual([
+      "checkout the immutable tag v1.1.86",
+      "download the release assets of that tag",
+      "verify every asset against the pinned checksums of this pin",
+      "republish the pinned asset set on the channels the rollback covers",
+    ]);
+    /* the pin carries no download url, only the immutable tag and the digests */
+    expect(JSON.stringify(pin)).not.toMatch(/https?:\/\//);
+    /* a manifest of another version never freezes a pin */
+    expect(() => rollbackpinnedset({ previousversion: "1.1.85", manifest: previous })).toThrow();
+    expect(() => rollbackpinnedset({ previousversion: "not-a-version", manifest: previous })).toThrow();
+  });
+});

package/tests/attentionfeed.test.ts

@@ -0,0 +1,163 @@
+import { describe, expect, it } from "vitest";
+import {
+  attentioncountof,
+  attentiondeeplinkof,
+  attentionentryof,
+  attentionnotifications,
+  collectattention,
+  dedupeattention,
+  dismissattention,
+  pruneattention,
+  rankattention,
+  attentionseverityof,
+} from "../views.js";
+
+const now = 1_800_000_000_000;
+
+describe("attentionfeed collection and ranking", () => {
+  it("collects gate waits, phishguard blocks, deferrals and failures with their deep links", () => {
+    const entries = collectattention({
+      gatewaits: [
+        {
+          runid: "run1",
+          stepid: "step1",
+          gateid: "gate1",
+          kind: "confirmpay",
+          origin: "https://example.com",
+          waitedms: 5000,
+        },
+      ],
+      phishblocks: [
+        {
+          runid: "run1",
+          origin: "https://lookalike.test",
+          matchedorigin: "https://example.com",
+          reason: "distance 0.9 over the threshold",
+        },
+      ],
+      deferrals: [{ runid: "run2", origin: "https://example.com", reason: "the bucket reset waits" }],
+      failures: [
+        { runid: "run3", stepid: "step9", origin: "https://example.com", message: "the selector matched nothing" },
+      ],
+      now,
+    });
+    expect(entries.map((entry) => entry.cause)).toEqual(["gatewait", "phishguard", "deferral", "failure"]);
+    expect(entries[0]?.deeplink).toBe("devthink://gate/gate1?run=run1");
+    expect(entries[1]?.deeplink).toBe("devthink://phishguard?run=run1");
+    expect(entries[2]?.deeplink).toBe("devthink://deferred?run=run2");
+    expect(entries[3]?.deeplink).toBe("devthink://error?run=run3");
+    expect(() =>
+      attentionentryof({ cause: "gatewait", runid: " ", origin: "https://example.com", summary: "waits", at: now }),
+    ).toThrow(/run ref/);
+    expect(() =>
+      attentionentryof({ cause: "gatewait", runid: "run1", origin: "https://example.com", summary: " ", at: now }),
+    ).toThrow(/summary/);
+  });
+
+  it("ranks the causes by severity first and time second", () => {
+    const entries = [
+      attentionentryof({
+        cause: "failure",
+        runid: "r",
+        origin: "https://example.com",
+        summary: "failed late",
+        at: now + 5000,
+      }),
+      attentionentryof({
+        cause: "deferral",
+        runid: "r",
+        origin: "https://example.com",
+        summary: "deferred",
+        at: now + 1000,
+      }),
+      attentionentryof({
+        cause: "gatewait",
+        runid: "r",
+        origin: "https://example.com",
+        summary: "waits",
+        gateref: "g1",
+        at: now,
+      }),
+      attentionentryof({
+        cause: "phishguard",
+        runid: "r",
+        origin: "https://example.com",
+        summary: "blocked",
+        at: now + 2000,
+      }),
+    ];
+    const ranked = rankattention(entries);
+    expect(ranked.map((entry) => entry.cause)).toEqual(["phishguard", "gatewait", "deferral", "failure"]);
+    expect(attentionseverityof("gatewait")).toBe("critical");
+    expect(attentionseverityof("phishguard")).toBe("critical");
+    expect(attentionseverityof("deferral")).toBe("warning");
+    expect(attentionseverityof("failure")).toBe("info");
+  });
+
+  it("deduplicates repeated causes per run while the first occurrence keeps its time", () => {
+    const first = attentionentryof({
+      cause: "gatewait",
+      runid: "r",
+      origin: "https://example.com",
+      summary: "waits",
+      gateref: "g1",
+      at: now,
+    });
+    const second = attentionentryof({
+      cause: "gatewait",
+      runid: "r",
+      origin: "https://example.com",
+      summary: "still waits",
+      gateref: "g1",
+      at: now + 9000,
+    });
+    const othergate = attentionentryof({
+      cause: "gatewait",
+      runid: "r",
+      origin: "https://example.com",
+      summary: "waits",
+      gateref: "g2",
+      at: now + 1000,
+    });
+    const deduped = dedupeattention([second, first, othergate]);
+    expect(deduped).toHaveLength(2);
+    expect(deduped[0]?.at).toBe(now);
+    expect(attentioncountof([first, second])).toBe(1);
+  });
+
+  it("dismisses entries and prunes past the retention window", () => {
+    const entry = attentionentryof({
+      cause: "failure",
+      runid: "r",
+      origin: "https://example.com",
+      summary: "failed",
+      at: now,
+    });
+    expect(dismissattention([entry], entry.id)).toHaveLength(0);
+    const pruned = pruneattention([entry], 1000, now + 2000);
+    expect(pruned.kept).toHaveLength(0);
+    expect(pruned.pruned).toEqual([entry.id]);
+    expect(pruneattention([entry], undefined, now + 2000).kept).toHaveLength(1);
+    expect(pruneattention([entry], 1000, now + 500).kept).toHaveLength(1);
+  });
+
+  it("renders the entries as content free system notifications with their deep links", () => {
+    const entries = [
+      attentionentryof({
+        cause: "gatewait",
+        runid: "r",
+        origin: "https://example.com",
+        summary: "waits",
+        gateref: "g1",
+        at: now,
+      }),
+    ];
+    const notifications = attentionnotifications(entries, now);
+    expect(notifications).toHaveLength(1);
+    expect(notifications[0]?.kind).toBe("attention");
+    expect(notifications[0]?.title).toBe("A gate waits for you");
+    expect(notifications[0]?.content).toBe(false);
+    expect(notifications[0]?.deeplink).toBe("devthink://gate/g1?run=r");
+    expect(attentiondeeplinkof("deferral", "r")).toBe("devthink://deferred?run=r");
+  });
+});