agent-yes 1.287.0 → 1.288.0

package/ts/tryCatch.bun.spec.ts

@@ -0,0 +1,275 @@
+import { describe, expect, it } from "bun:test";
+import { tryCatch } from "./tryCatch";
+
+describe("tryCatch", () => {
+  describe("direct overload", () => {
+    it("should catch errors and call catchFn with error, attempts, robustFn, and args", () => {
+      let catchedError: unknown;
+      let catchedAttempts: unknown;
+      let catchedFn: unknown;
+      let catchedArgs!: unknown[];
+      const catchFn = (error: unknown, attempts: number, fn: unknown, ...args: unknown[]) => {
+        catchedError = error;
+        catchedAttempts = attempts;
+        catchedFn = fn;
+        catchedArgs = args;
+        return "caught";
+      };
+
+      let calledArgs: unknown[] = [];
+      const errorFn = (...args: unknown[]) => {
+        calledArgs = args;
+        throw new Error("test error");
+      };
+
+      const wrappedFn = tryCatch(catchFn, errorFn);
+      const result = wrappedFn("arg1", "arg2");
+
+      expect(result).toBe("caught");
+      expect(catchedError).toBeInstanceOf(Error);
+      expect(catchedAttempts).toBe(1);
+      expect(catchedFn).toBe(wrappedFn);
+      expect(catchedArgs).toEqual(["arg1", "arg2"]);
+      expect(calledArgs).toEqual(["arg1", "arg2"]);
+    });
+
+    it("should return normal result when no error occurs directly", () => {
+      let catchCalled = false;
+      const catchFn = () => {
+        catchCalled = true;
+        return "error";
+      };
+
+      let calledArgs: unknown[] = [];
+      const normalFn = (...args: unknown[]) => {
+        calledArgs = args;
+        return "success";
+      };
+
+      const wrappedFn = tryCatch(catchFn, normalFn);
+      const result = wrappedFn("arg1", "arg2");
+
+      expect(result).toBe("success");
+      expect(catchCalled).toBe(false);
+      expect(calledArgs).toEqual(["arg1", "arg2"]);
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle different error types and pass function context", () => {
+      const results: unknown[] = [];
+      const functions: unknown[] = [];
+      const catchFn = (error: unknown, _attempts: number, fn: unknown, ..._args: unknown[]) => {
+        results.push(error);
+        functions.push(fn);
+        return "handled";
+      };
+
+      // String error
+      const stringErrorFn = () => {
+        throw "string error";
+      };
+      const wrappedStringFn = tryCatch(catchFn, stringErrorFn);
+      expect(wrappedStringFn()).toBe("handled");
+      expect(results[0]).toBe("string error");
+      expect(functions[0]).toBe(wrappedStringFn);
+
+      // Object error
+      const objectError = { message: "object error" };
+      const objectErrorFn = () => {
+        throw objectError;
+      };
+      const wrappedObjectFn = tryCatch(catchFn, objectErrorFn);
+      expect(wrappedObjectFn()).toBe("handled");
+      expect(results[1]).toBe(objectError);
+      expect(functions[1]).toBe(wrappedObjectFn);
+
+      // null error
+      const nullErrorFn = () => {
+        throw null;
+      };
+      const wrappedNullFn = tryCatch(catchFn, nullErrorFn);
+      expect(wrappedNullFn()).toBe("handled");
+      expect(results[2]).toBe(null);
+      expect(functions[2]).toBe(wrappedNullFn);
+    });
+
+    it("should preserve function parameters and pass them to catchFn", () => {
+      let caughtError: unknown;
+      let caughtAttempts: unknown;
+      let caughtFn: unknown;
+      let caughtArgs!: unknown[];
+      const catchFn = (error: unknown, attempts: number, fn: unknown, ...args: unknown[]) => {
+        caughtError = error;
+        caughtAttempts = attempts;
+        caughtFn = fn;
+        caughtArgs = args;
+        return "caught";
+      };
+
+      let testArgs: [number, string, boolean] | undefined;
+      const testFn = (a: number, b: string, c: boolean) => {
+        testArgs = [a, b, c];
+        if (a > 5) throw new Error("too big");
+        return `${a}-${b}-${c}`;
+      };
+
+      const wrappedFn = tryCatch(catchFn, testFn);
+
+      // Normal execution
+      expect(wrappedFn(3, "test", true)).toBe("3-test-true");
+      expect(testArgs).toEqual([3, "test", true]);
+
+      // Error execution
+      expect(wrappedFn(10, "error", false)).toBe("caught");
+      expect(testArgs).toEqual([10, "error", false]);
+      expect(caughtError).toBeInstanceOf(Error);
+      expect(caughtAttempts).toBe(2);
+      expect(caughtFn).toBe(wrappedFn);
+      expect(caughtArgs).toEqual([10, "error", false]);
+    });
+
+    it("should handle functions with no parameters", () => {
+      let caughtError: unknown;
+      let caughtAttempts: unknown;
+      let caughtFn: unknown;
+      let caughtArgs!: unknown[];
+      const catchFn = (error: unknown, attempts: number, fn: unknown, ...args: unknown[]) => {
+        caughtError = error;
+        caughtAttempts = attempts;
+        caughtFn = fn;
+        caughtArgs = args;
+        return "no params caught";
+      };
+
+      let called = false;
+      const noParamsFn = () => {
+        called = true;
+        throw new Error("no params error");
+      };
+
+      const wrappedFn = tryCatch(catchFn, noParamsFn);
+      const result = wrappedFn();
+
+      expect(result).toBe("no params caught");
+      expect(called).toBe(true);
+      expect(caughtError).toBeInstanceOf(Error);
+      expect(caughtAttempts).toBe(1);
+      expect(caughtFn).toBe(wrappedFn);
+      expect(caughtArgs).toEqual([]);
+    });
+
+    it("should handle functions returning different types", () => {
+      const catchFn = () => null;
+
+      // Function returning number
+      const numberFn = tryCatch(catchFn, () => 42);
+      expect(numberFn()).toBe(42);
+
+      // Function returning object
+      const obj = { key: "value" };
+      const objectFn = tryCatch(catchFn, () => obj);
+      expect(objectFn()).toBe(obj);
+
+      // Function returning undefined
+      const undefinedFn = tryCatch(catchFn, () => undefined);
+      expect(undefinedFn()).toBeUndefined();
+    });
+  });
+
+  describe("attempts tracking", () => {
+    it("should increment attempts on each call", () => {
+      const attemptsList: number[] = [];
+      const catchFn = (_error: unknown, attempts: number) => {
+        attemptsList.push(attempts);
+        return "caught";
+      };
+
+      const errorFn = () => {
+        throw new Error("fail");
+      };
+
+      const wrappedFn = tryCatch(catchFn, errorFn);
+      wrappedFn();
+      wrappedFn();
+      wrappedFn();
+
+      expect(attemptsList).toEqual([1, 2, 3]);
+    });
+
+    it("should count attempts for both successful and failed calls", () => {
+      let lastAttempts = 0;
+      const catchFn = (_error: unknown, attempts: number) => {
+        lastAttempts = attempts;
+        return -1;
+      };
+
+      let callCount = 0;
+      const sometimesFails = () => {
+        callCount++;
+        if (callCount % 2 === 0) throw new Error("even call");
+        return callCount;
+      };
+
+      const wrappedFn = tryCatch(catchFn, sometimesFails);
+      expect(wrappedFn()).toBe(1); // attempt 1, success
+      expect(wrappedFn()).toBe(-1); // attempt 2, fail
+      expect(lastAttempts).toBe(2);
+      expect(wrappedFn()).toBe(3); // attempt 3, success
+      expect(wrappedFn()).toBe(-1); // attempt 4, fail
+      expect(lastAttempts).toBe(4);
+    });
+
+    it("should allow retry via robustFn", () => {
+      let callCount = 0;
+      const catchFn = (_error: unknown, attempts: number, retry: () => number) => {
+        if (attempts < 3) return retry();
+        return -1;
+      };
+
+      const unreliableFn = () => {
+        callCount++;
+        if (callCount < 3) throw new Error("not yet");
+        return 42;
+      };
+
+      const wrappedFn = tryCatch(catchFn, unreliableFn);
+      expect(wrappedFn()).toBe(42);
+      expect(callCount).toBe(3);
+    });
+  });
+
+  describe("type safety", () => {
+    it("should maintain function signature", () => {
+      const catchFn = (_error: unknown, _attempts: number, _fn: unknown, ..._args: unknown[]) =>
+        "error";
+      const originalFn = (a: number, b: string): string => `${a}-${b}`;
+
+      const wrappedFn = tryCatch(catchFn, originalFn);
+
+      // This should be type-safe
+      const result: string = wrappedFn(1, "test");
+      expect(result).toBe("1-test");
+    });
+
+    it("should pass function reference and arguments to catchFn", () => {
+      let capturedFn: unknown;
+      let capturedArgs!: unknown[];
+      const catchFn = (_error: unknown, _attempts: number, fn: unknown, ...args: unknown[]) => {
+        capturedFn = fn;
+        capturedArgs = args;
+        return "handled";
+      };
+
+      const testFn = (_x: number, _y: string) => {
+        throw new Error("test");
+      };
+
+      const wrappedFn = tryCatch(catchFn, testFn);
+      wrappedFn(42, "hello");
+
+      expect(capturedFn).toBe(wrappedFn);
+      expect(capturedArgs).toEqual([42, "hello"]);
+    });
+  });
+});

package/ts/webrtcLink.bun.spec.ts

@@ -0,0 +1,45 @@
+import { describe, expect, it } from "bun:test";
+import { DEFAULT_SIGHOST, isWebrtcSpec, parseWebrtcLink } from "./webrtcLink.ts";
+
+// A representative v2 share secret (e1.<64 hex>); parseSecret keeps the hex `s`.
+const SECRET = "e1.982610a3034f065bfe9700037b306a6afeb7dc48567064058e6c4bbc09e502c2";
+
+describe("isWebrtcSpec", () => {
+  it("accepts webrtc:// links", () => {
+    expect(isWebrtcSpec(`webrtc://r1:${SECRET}@s.agent-yes.com`)).toBe(true);
+  });
+  it("accepts https share links (have a # fragment)", () => {
+    expect(isWebrtcSpec(`https://agent-yes.com/w/#r1:${SECRET}`)).toBe(true);
+    expect(isWebrtcSpec(`http://localhost:8080/w/#r1:${SECRET}`)).toBe(true);
+  });
+  it("rejects http remotes and bare aliases", () => {
+    expect(isWebrtcSpec("token@192.168.1.5:7432")).toBe(false);
+    expect(isWebrtcSpec("work-mac")).toBe(false);
+    expect(isWebrtcSpec("work-mac:claude")).toBe(false);
+    expect(isWebrtcSpec("http://192.168.1.5:7432")).toBe(false); // no fragment
+  });
+});
+
+describe("parseWebrtcLink", () => {
+  it("parses webrtc://room:token@host", () => {
+    const r = parseWebrtcLink(`webrtc://r223104:${SECRET}@example.com`);
+    expect(r).toEqual({ room: "r223104", s: expect.any(String), host: "example.com" });
+    expect(r!.s.length).toBeGreaterThan(0);
+  });
+
+  it("parses an https share link and defaults the signaling host", () => {
+    const r = parseWebrtcLink(`https://agent-yes.com/w/#r223104:${SECRET}`);
+    expect(r).toMatchObject({ room: "r223104", host: DEFAULT_SIGHOST });
+  });
+
+  it("honors an explicit @sighost in the fragment", () => {
+    const r = parseWebrtcLink(`https://agent-yes.com/w/#r1:${SECRET}@sig.example.com`);
+    expect(r).toMatchObject({ room: "r1", host: "sig.example.com" });
+  });
+
+  it("returns null for non-share strings and malformed fragments", () => {
+    expect(parseWebrtcLink("token@host:7432")).toBeNull();
+    expect(parseWebrtcLink("just-an-alias")).toBeNull();
+    expect(parseWebrtcLink("https://agent-yes.com/w/#noColonHere")).toBeNull();
+  });
+});

package/ts/workspaceConfig.bun.spec.ts

@@ -0,0 +1,319 @@
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "fs";
+import { homedir, tmpdir } from "os";
+import path from "path";
+import {
+  expandTilde,
+  getMaxAgents,
+  getMinFreeMb,
+  getSpawnWaitMs,
+  getProvisionAllowlist,
+  getProvisionHook,
+  getProvisionRoot,
+  getSpawnHook,
+  getWorkspaceRoot,
+  hasProvisionHook,
+  hasSpawnHook,
+  isProvisionAllowed,
+  resolveSpawnCwd,
+  setWorkspaceRoot,
+} from "./workspaceConfig.ts";
+
+describe("workspaceConfig", () => {
+  let original: string | undefined;
+  let tmp: string;
+  beforeEach(() => {
+    original = process.env.AGENT_YES_HOME;
+    tmp = mkdtempSync(path.join(tmpdir(), "ay-cfg-"));
+    process.env.AGENT_YES_HOME = tmp;
+  });
+  afterEach(() => {
+    if (original === undefined) delete process.env.AGENT_YES_HOME;
+    else process.env.AGENT_YES_HOME = original;
+    delete process.env.CODEHOST_WS_ROOT;
+    delete process.env.CODEHOST_PROVISION_ALLOWLIST;
+    delete process.env.AGENT_YES_SPAWN_HOOK;
+    delete process.env.AGENT_YES_PROVISION_HOOK;
+    delete process.env.AGENT_YES_MAX_AGENTS;
+    delete process.env.AGENT_YES_MIN_FREE_MB;
+    delete process.env.AGENT_YES_SPAWN_WAIT_MS;
+    rmSync(tmp, { recursive: true, force: true });
+  });
+
+  it("defaults the workspace root to the home dir when unset", () => {
+    expect(getWorkspaceRoot()).toBe(homedir());
+  });
+
+  it("round-trips set/get and resolves to an absolute path", () => {
+    const saved = setWorkspaceRoot(path.join(tmp, "ws"));
+    expect(saved).toBe(path.join(tmp, "ws"));
+    expect(getWorkspaceRoot()).toBe(path.join(tmp, "ws"));
+  });
+
+  it("expands a leading ~", () => {
+    expect(expandTilde("~")).toBe(homedir());
+    expect(expandTilde("~/projects")).toBe(path.join(homedir(), "projects"));
+    expect(expandTilde("/abs/path")).toBe("/abs/path");
+  });
+
+  it("stores a tilde path as home-based absolute", () => {
+    const saved = setWorkspaceRoot("~/myws");
+    expect(saved).toBe(path.join(homedir(), "myws"));
+  });
+
+  describe("resolveSpawnCwd", () => {
+    beforeEach(() => setWorkspaceRoot(path.join(tmp, "ws")));
+
+    it("empty input → workspace root", () => {
+      expect(resolveSpawnCwd("")).toBe(path.join(tmp, "ws"));
+      expect(resolveSpawnCwd(undefined)).toBe(path.join(tmp, "ws"));
+    });
+
+    it("bare name → <workspace>/<name>", () => {
+      expect(resolveSpawnCwd("myproject")).toBe(path.join(tmp, "ws", "myproject"));
+    });
+
+    it("absolute path → used as-is", () => {
+      // path.resolve keeps a POSIX-absolute path on Unix but anchors it to the
+      // current drive on Windows (→ C:\tmp\elsewhere); compare against the same
+      // resolution the impl uses so the assertion holds on both (cf. "a/b" below).
+      expect(resolveSpawnCwd("/tmp/elsewhere")).toBe(path.resolve("/tmp/elsewhere"));
+    });
+
+    it("tilde path → home-based", () => {
+      expect(resolveSpawnCwd("~/docs")).toBe(path.join(homedir(), "docs"));
+    });
+
+    it("a relative path with a separator is resolved, not joined to the workspace", () => {
+      expect(resolveSpawnCwd("a/b")).toBe(path.resolve("a/b"));
+    });
+  });
+
+  const writeConfig = (c: Record<string, unknown>) =>
+    writeFileSync(path.join(tmp, "config.json"), JSON.stringify(c));
+
+  describe("getProvisionRoot", () => {
+    it("is undefined when neither env nor config is set", () => {
+      expect(getProvisionRoot()).toBeUndefined();
+    });
+
+    it("returns the configured provisionRoot, resolved", () => {
+      writeConfig({ provisionRoot: "/code" });
+      expect(getProvisionRoot()).toBe(path.resolve("/code"));
+    });
+
+    it("env CODEHOST_WS_ROOT overrides the config and expands ~", () => {
+      writeConfig({ provisionRoot: "/code" });
+      process.env.CODEHOST_WS_ROOT = "~/ws";
+      expect(getProvisionRoot()).toBe(path.join(homedir(), "ws"));
+    });
+
+    it("ignores a blank configured value", () => {
+      writeConfig({ provisionRoot: "   " });
+      expect(getProvisionRoot()).toBeUndefined();
+    });
+  });
+
+  describe("getProvisionAllowlist", () => {
+    it("is empty when unset", () => {
+      expect(getProvisionAllowlist()).toEqual([]);
+    });
+
+    it("reads and normalizes the configured list (trim/lowercase/drop empties)", () => {
+      writeConfig({ provisionAllowlist: [" Snomiao ", "Acme/Repo", ""] });
+      expect(getProvisionAllowlist()).toEqual(["snomiao", "acme/repo"]);
+    });
+
+    it("env CODEHOST_PROVISION_ALLOWLIST (comma-separated) overrides config", () => {
+      writeConfig({ provisionAllowlist: ["snomiao"] });
+      process.env.CODEHOST_PROVISION_ALLOWLIST = "Foo, bar/baz ,";
+      expect(getProvisionAllowlist()).toEqual(["foo", "bar/baz"]);
+    });
+  });
+
+  describe("isProvisionAllowed", () => {
+    it("denies everything when the allowlist is empty (secure default)", () => {
+      expect(isProvisionAllowed("snomiao", "agent-yes")).toBe(false);
+    });
+
+    it("'*' allows any owner/repo", () => {
+      writeConfig({ provisionAllowlist: ["*"] });
+      expect(isProvisionAllowed("anyone", "anything")).toBe(true);
+    });
+
+    it("matches by owner case-insensitively and rejects others", () => {
+      writeConfig({ provisionAllowlist: ["snomiao"] });
+      expect(isProvisionAllowed("SNOMIAO", "x")).toBe(true);
+      expect(isProvisionAllowed("evil", "x")).toBe(false);
+    });
+
+    it("matches an exact owner/repo and an owner/* glob", () => {
+      writeConfig({ provisionAllowlist: ["acme/widget", "org/*"] });
+      expect(isProvisionAllowed("acme", "widget")).toBe(true);
+      expect(isProvisionAllowed("acme", "other")).toBe(false);
+      expect(isProvisionAllowed("org", "anything")).toBe(true);
+    });
+  });
+
+  describe("getMaxAgents", () => {
+    it("is undefined (unlimited) when neither env nor config is set", () => {
+      expect(getMaxAgents()).toBeUndefined();
+    });
+
+    it("reads a positive integer from config", () => {
+      writeConfig({ maxAgents: 8 });
+      expect(getMaxAgents()).toBe(8);
+    });
+
+    it("env AGENT_YES_MAX_AGENTS overrides config", () => {
+      writeConfig({ maxAgents: 8 });
+      process.env.AGENT_YES_MAX_AGENTS = "3";
+      expect(getMaxAgents()).toBe(3);
+    });
+
+    it("floors a fractional value", () => {
+      process.env.AGENT_YES_MAX_AGENTS = "4.9";
+      expect(getMaxAgents()).toBe(4);
+    });
+
+    it("treats 0, negative, and garbage as unlimited (undefined)", () => {
+      writeConfig({ maxAgents: 0 });
+      expect(getMaxAgents()).toBeUndefined();
+      process.env.AGENT_YES_MAX_AGENTS = "-5";
+      expect(getMaxAgents()).toBeUndefined();
+      process.env.AGENT_YES_MAX_AGENTS = "lots";
+      expect(getMaxAgents()).toBeUndefined();
+    });
+
+    it("treats a fractional value < 1 as unlimited, not a 0 hard-cap", () => {
+      // Regression: 0.5 must NOT floor to 0 (which would reject every spawn).
+      process.env.AGENT_YES_MAX_AGENTS = "0.5";
+      expect(getMaxAgents()).toBeUndefined();
+    });
+  });
+
+  describe("getMinFreeMb", () => {
+    it("is undefined (no floor) when unset", () => {
+      expect(getMinFreeMb()).toBeUndefined();
+    });
+
+    it("reads config and lets env override", () => {
+      writeConfig({ minFreeMb: 1024 });
+      expect(getMinFreeMb()).toBe(1024);
+      process.env.AGENT_YES_MIN_FREE_MB = "2048";
+      expect(getMinFreeMb()).toBe(2048);
+    });
+
+    it("treats non-positive/garbage/sub-1 as no floor", () => {
+      process.env.AGENT_YES_MIN_FREE_MB = "0";
+      expect(getMinFreeMb()).toBeUndefined();
+      process.env.AGENT_YES_MIN_FREE_MB = "nope";
+      expect(getMinFreeMb()).toBeUndefined();
+      process.env.AGENT_YES_MIN_FREE_MB = "0.5";
+      expect(getMinFreeMb()).toBeUndefined();
+    });
+  });
+
+  describe("getSpawnWaitMs", () => {
+    it("defaults to 10 minutes when unset", () => {
+      expect(getSpawnWaitMs()).toBe(600_000);
+    });
+
+    it("reads config and lets env override; allows 0 (don't wait)", () => {
+      writeConfig({ spawnWaitMs: 5000 });
+      expect(getSpawnWaitMs()).toBe(5000);
+      process.env.AGENT_YES_SPAWN_WAIT_MS = "0";
+      expect(getSpawnWaitMs()).toBe(0);
+    });
+
+    it("falls back to the default on negative/garbage", () => {
+      process.env.AGENT_YES_SPAWN_WAIT_MS = "-1";
+      expect(getSpawnWaitMs()).toBe(600_000);
+      process.env.AGENT_YES_SPAWN_WAIT_MS = "soon";
+      expect(getSpawnWaitMs()).toBe(600_000);
+    });
+  });
+
+  describe("getSpawnHook / hasSpawnHook", () => {
+    const isPosix = process.platform !== "win32";
+
+    it("is null/false when unset", () => {
+      expect(getSpawnHook()).toBeNull();
+      expect(hasSpawnHook()).toBe(false);
+    });
+
+    it("returns the configured hook from a private (0600) config", () => {
+      writeConfig({ spawnHook: 'echo hi >&2\nexec "$@"' });
+      if (isPosix) chmodSync(path.join(tmp, "config.json"), 0o600);
+      expect(getSpawnHook()).toBe('echo hi >&2\nexec "$@"');
+      expect(hasSpawnHook()).toBe(true);
+    });
+
+    it("ignores a blank hook", () => {
+      writeConfig({ spawnHook: "   " });
+      expect(getSpawnHook()).toBeNull();
+    });
+
+    it("env AGENT_YES_SPAWN_HOOK overrides the config", () => {
+      writeConfig({ spawnHook: "from-file" });
+      process.env.AGENT_YES_SPAWN_HOOK = "from-env";
+      expect(getSpawnHook()).toBe("from-env");
+    });
+
+    it.skipIf(!isPosix)(
+      "refuses a file-backed hook when the config is group/world-writable (tampering guard)",
+      () => {
+        writeConfig({ spawnHook: "echo pwned" });
+        chmodSync(path.join(tmp, "config.json"), 0o666);
+        expect(getSpawnHook()).toBeNull();
+        chmodSync(path.join(tmp, "config.json"), 0o600);
+        expect(getSpawnHook()).toBe("echo pwned");
+      },
+    );
+  });
+
+  describe("getProvisionHook / hasProvisionHook", () => {
+    const isPosix = process.platform !== "win32";
+
+    it("is null/false when unset", () => {
+      expect(getProvisionHook()).toBeNull();
+      expect(hasProvisionHook()).toBe(false);
+    });
+
+    it("returns the configured hook from a private (0600) config", () => {
+      writeConfig({ provisionHook: 'gh auth switch --user "$KOHO_OWNER"' });
+      if (isPosix) chmodSync(path.join(tmp, "config.json"), 0o600);
+      expect(getProvisionHook()).toBe('gh auth switch --user "$KOHO_OWNER"');
+      expect(hasProvisionHook()).toBe(true);
+    });
+
+    it("ignores a blank hook", () => {
+      writeConfig({ provisionHook: "   " });
+      expect(getProvisionHook()).toBeNull();
+    });
+
+    it("env AGENT_YES_PROVISION_HOOK overrides the config", () => {
+      writeConfig({ provisionHook: "from-file" });
+      process.env.AGENT_YES_PROVISION_HOOK = "from-env";
+      expect(getProvisionHook()).toBe("from-env");
+    });
+
+    it("is independent of the spawn hook", () => {
+      writeConfig({ spawnHook: "spawn-only" });
+      if (isPosix) chmodSync(path.join(tmp, "config.json"), 0o600);
+      expect(getSpawnHook()).toBe("spawn-only");
+      expect(getProvisionHook()).toBeNull();
+    });
+
+    it.skipIf(!isPosix)(
+      "refuses a file-backed hook when the config is group/world-writable (tampering guard)",
+      () => {
+        writeConfig({ provisionHook: "echo pwned" });
+        chmodSync(path.join(tmp, "config.json"), 0o666);
+        expect(getProvisionHook()).toBeNull();
+        chmodSync(path.join(tmp, "config.json"), 0o600);
+        expect(getProvisionHook()).toBe("echo pwned");
+      },
+    );
+  });
+});

package/dist/trayApp-1AQ6X2V9.js

@@ -1,5 +0,0 @@
-import "./versionChecker-CGmyt2qE.js";
-import "./rustBinary-C57KWEtX.js";
-import { a as trayHiddenMarker, i as launchTray, n as hasDesktop, r as isTrayHidden, t as cmdTray } from "./trayApp-DG2fQnhx.js";
-
-export { cmdTray };