arisa 5.2.21 → 5.2.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arisa",
-  "version": "5.2.21",
+  "version": "5.2.23",
   "description": "Telegram + Pi Agent modular assistant",
   "type": "module",
   "main": "src/index.js",

package/src/core/agent/auth-flow.js

@@ -33,6 +33,15 @@ export function getPiAuthIssue(error) {
   return null;
 }
 
+export function buildPiRequestFailureMessage(error) {
+  const message = getErrorMessage(error);
+  const limited = /usage limit|quota|rate[ _-]?limit|too many requests|insufficient[_ ]credits|credits? (?:exhausted|depleted)/i.test(message);
+  const title = limited
+    ? "The provider's usage quota or request limit was reached. Retry when capacity is available; signing in again does not restore quota."
+    : "Pi request could not be completed. This does not establish an authentication failure.";
+  return `${title}\nDetails: ${message}`;
+}
+
 export async function getPiAuthStatus(config, chatId = null) {
   const runtime = await createPiRuntime({
     provider: config.pi.provider,

package/src/core/tools/official-tool-installer.js

@@ -149,7 +149,9 @@ async function installPackageDependencies(toolDir) {
   }
   const dependencyCount = Object.keys(packageJson.dependencies || {}).length + Object.keys(packageJson.optionalDependencies || {}).length;
   if (!dependencyCount) return { installed: false };
-  if (await exists(path.join(toolDir, "package-lock.json"))) {
+  if (await exists(path.join(toolDir, "pnpm-lock.yaml"))) {
+    await runCommand("pnpm", ["install", "--frozen-lockfile", "--prod"], { cwd: toolDir });
+  } else if (await exists(path.join(toolDir, "package-lock.json"))) {
     await runCommand("npm", ["ci", "--omit=dev"], { cwd: toolDir });
   } else {
     await runCommand("npm", ["install", "--omit=dev"], { cwd: toolDir });

package/src/official-tools.lock.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
   "repository": "https://github.com/clasen/Arisa.git",
-  "commit": "2256f9e19f26f23826b9a9062d3a9643b511bb3c",
+  "commit": "773dc5b7dd81e628ec63632bd9d7c32e4cb468fd",
   "tools": {
     "audio-extractor": {
       "version": null,
@@ -13,42 +13,50 @@
       }
     },
     "browser-session-bridge": {
-      "version": "0.2.5",
+      "version": "0.2.6",
       "files": {
-        "README.md": "79cb347ead539309429eca19ba6e9c472e4790ec1ab39a20bba71a4149f61f15",
-        "bridge-server.js": "03722a2657ba74bf34de9cae683b8f23242657da87c05771dd413a38fb446eca",
+        "README.md": "f650843cf4a9b3cb41c3a9a0fafa9c90af5dc607eb142dbc0a215203862b408d",
+        "bridge-server.js": "e5181ef56555a018ba729272409661f4da1b3ac29d2ac5d7e6a5d8e25e93a861",
         "chrome-web-store.js": "4b588d1288dee754c5d8afd609b8c1f67f73d23de7dda247b7a2ff8b68f7ef60",
         "config.js": "45c8e9e9a159b9125d6ea3458c616926c2ba2b5327fdfd750aa05316d3ce5af8",
+        "extension/background-workflow.js": "5ea3afccdfcbfaf9ee41f3baa910f75177a863aeed96d924c9c253e4d23720ea",
+        "extension/background.js": "7a7e7217a9e952739cb5f6cf06ad1002424cb047a045fb29d6642b2b30449bee",
+        "extension/bridge-client.js": "f4b71ccd816734a51dd49ca9240cc2d436c6f2584f40de1cd59c7f4d742426bc",
         "extension/icons/icon-128.png": "a55af49bb570bd5471fc0a2e15a6bcaf3f76a2c5e7439f16bb1829682b343380",
         "extension/icons/icon-16.png": "a4aedb49e2227222a68dc56455812a9e17938fd197b1f30268f02d6c9f7bf95e",
         "extension/icons/icon-32.png": "2dfc9e6e7ec6b4e9feb9c1326d65116cda8e53306c65c84074c818c9e7f6a2a2",
         "extension/icons/icon-48.png": "2f316f1f2fbc72227e7e1f14cf1ff1553a12fc9aab139799f1ee2970c0303deb",
-        "extension/manifest.json": "fbf3dd9fcb119eaaa2a0e43720096c19eb2d3ceca45ea5a893a00bfaa5b44452",
-        "extension/onboarding-state.js": "79f5601ac66686b0d371bbfa8c9e38e12fd23213f3ad309f8c9c6d55c1f856cb",
+        "extension/manifest.json": "abbc939749585fefffac51e6c2d6b0c0511771d43008a1ce9048a89e02879fa7",
+        "extension/onboarding-state.js": "c4c716ac6bb3c942f6ac8fb029693de96db7d5c8e84c886bd026106fb74206c3",
         "extension/popup.css": "8044a298f91790d38c8e84823d10951baffcf823bee5c330f3f297db125a5726",
-        "extension/popup.html": "2f8590991f9941b50ad61d0a7563a0a073eae5a5e980251fe16e19fe86c7a94f",
-        "extension/popup.js": "cf4bb363403381590b872991642f38b98c0964fdd9c3df00b6ec3b40b90c9be9",
+        "extension/popup.html": "8b24f47f092943f954f3a403af209809b5d935b20de6c291ce3d576bd23f8b6c",
+        "extension/popup.js": "d762108f2071424f702ab845254d86fc48c0dc0461143cb1a384820147a08c4e",
         "extension/session-send-state.js": "ec574454825679d8d3eb1fc5692d9a9fcbf133f3d9ac3621648ad09e76ff4abc",
         "extension/site-permissions.js": "83f9aa4d0295318fc730bd561c2db9d1aacf36152319090e99d12f62deea11ad",
-        "index.js": "c01a6b825da4587a550ecec560a558cc6736200e73b6831f5919000c7b81679d",
+        "import-receipts.js": "3f8fb5f3604a73f7b56d7bc9d32cf7b638e7d86065952155fbb4ffb70134d478",
+        "index.js": "351af3e57a90096833b64c33169118ce4b75b81e8aa572090a45422a214646b6",
         "lightpanda-session.js": "57c713dafac531617d7285122b2098c1e0b2f334e43144632f2b1fc79405f789",
-        "package-lock.json": "b97f5a333df234fecde788d0f90b620d39e02fee6079c1b4347baaabd8010b1b",
-        "package.json": "5c9edd6155b6b4868cc87d474e808dfc23567bc312e0d1e0230d8f9f0a1cc081",
+        "package.json": "c6fba5540eef5953ca1e836388c82d006be803d69ebf3d246b8ab9adbea85ad1",
+        "pnpm-lock.yaml": "7af346d8eb7cfaa293cdb329fdc0b3597da5aa8f22b5001e3d8e8c464ab2e9a7",
         "session-browser.js": "7af716a1c0d6793b82ebbaaf64ec3e8f73dfc52b3c9aceef2179d2d859e32a9c",
         "session-redaction.js": "c2393023c1d3b7634432606ad82a96d79c1f093d9b0a6440d955d0ae419c8393",
         "session-selection.js": "da5a4f55ccc8ba22791840943288e7aecacd730425c03f05c2bc10fd6a14341f",
         "session-store.js": "ee85e5b9696e542bb535a996743ddbbd2093fc66e18873a2f1c7a27707a83994",
-        "test/device-enrollment.test.js": "a4246f4cb19e959ef4b8a83f60664887b624526b0e5646e5ec1fdb93750082b0",
+        "test/background-recovery.test.js": "77d28d9a1aa0bcb91b45b5a1e9be0c030ee6f831cc4b1ad698ccb23dfdbce3be",
+        "test/background-workflow.test.js": "9f8bb38d713b01c1b88af41c3ba082f3b0e438b79116c6cd9bd4413cc4c9be16",
+        "test/device-enrollment.test.js": "f8c5cb944b4416537702173656239a9d2f535fef67c14fefa9c75e6118ab1776",
+        "test/import-receipts.test.js": "29232c3e4a84f2548cfedc689e26010769cdaad2695437cbdd278fbbc1df360a",
         "test/lightpanda-session.test.js": "1fa6c1693a5008c173ec6c5c97effe001b68c535c7a3d4530500c0c4b691c532",
         "test/onboarding-state.test.js": "889f7746bbdb51320e68447560459d2a5d812e4b135de08a7b6e94ef5a142250",
+        "test/popup-lifecycle.test.js": "2326088ad4410849867323ad07f7679906664c67f8fb062cb47c4d3dff05021c",
         "test/session-redaction.test.js": "e45b5cbd19eea7996d57141b5185c3a6e4c79989e4cb7253272fc66cd2cbd719",
         "test/session-refresh.test.js": "ffa688433185c08696761f189df244ed9ac212731b012a3eb9a91da05b43dd56",
         "test/session-selection.test.js": "ee1a15d42b156403d46d789a3ecf0a9c8f0019a00ab908276297d031243a89f5",
         "test/session-send-state.test.js": "c8ccbdf0863c5de85f784e7e32436591fe2db16a2ef4c554f671c6352736d5b6",
         "test/site-permissions.test.js": "27c297475c38ee1cbe7c7df210c767c157e03ecd379cde99a1b502268bda56ab",
-        "tool.manifest.json": "820f6060f077b95c286168f175e5521bc67b043425cae69c5be40834d5016454",
-        "web-store/listing.md": "3e6d7aab1f60142984c3f8c18d92bf23646dc901644c6b71bdb979802bcf320c",
-        "web-store/privacy-policy.md": "eaaaa6066b36ef56896321d62b6ac4596d62104a0591d4edceb8c6040c47fd5c"
+        "tool.manifest.json": "c62e085045cd8b922b8aa97b676f5ff263aac3a6861500bd17fb3a237a6e425e",
+        "web-store/listing.md": "ee3ac9efa32cfe7ca67f995cab057d1db40f40eb237f014e4f699885a022a318",
+        "web-store/privacy-policy.md": "245cd64e0e7687b0c66ebb4cd0e0ee55856a1713c51d4831f22a332db242b168"
       },
       "toolDependencies": {
         "lightpanda-browser": "^0.11.5"
@@ -122,10 +130,10 @@
         "config.js": "bab728665650b986c0eaef8e1be1c259ec42b1f83df4217c9780f5468d3c7666",
         "index.js": "a544e5dbac9cb92e996c2b07690a18481a20b8b10c13c397412581ec9ac6bb04",
         "outcome-contract.js": "5685bd8fbe4fcb608ee43a0148201206283013c1a60855c974a928c1d312480a",
-        "package-lock.json": "a2e847954e9d6682b8fd435c46d7ecbf38568147fc3d336e10f6d806f6be620a",
-        "package.json": "19c61d77ec90fce64d1a3baa1acc5b29af23f7c0574964504bc69b19e38aa34f",
+        "package.json": "593c9afd3d151f8107c611724e7218ed3970eb7643273994ce6006d2af20abcf",
         "panda-results.js": "24a31263b4a03e2c2719d9c54be7b5c022b17fb7dcb249eed33b93882518145b",
         "panda-session.js": "69878ff01bfbf26afe4db0e2e6489b211e3aca100ba5353befefaea009636bb5",
+        "pnpm-lock.yaml": "7af346d8eb7cfaa293cdb329fdc0b3597da5aa8f22b5001e3d8e8c464ab2e9a7",
         "reference-match.js": "5ceb71bfe57763258d89c60936bb7e5b3166b6aa7127f9d2f8da49f01298f46b",
         "test/outcome-contract.test.js": "dda85d1f56880b30d7fad3e8a27aacbb0808d91fc0addac6e0c38f9f0c4849bf",
         "test/panda-results.test.js": "b918d6341251822292fe3e375ab66694a0f71f3c7a24e91be263ee36e5f3e92c",
@@ -187,7 +195,7 @@
         "BENCHMARK.md": "9c732c65f6d8bceb4e73c1a03d298d5140d919f50269f982bd0ec6c1b21fa8b6",
         "COMPATIBILITY-MIGRATION.md": "230e12e8ddac837b7772519693e530c43d2158b69c671036bf246fb3a9e35561",
         "LIMITS.md": "6c0ec9624c76de8ddf09b82a4da1dba1b89a48a1f0e71a083ffbcf7a3d5401fb",
-        "README.md": "c79a9a24d2fe804a7ce3e160e8308b1ac0039461cbfd012347aaa61f841f5fed",
+        "README.md": "6cd4b4b6443d8b568537f9481de23c60e037deb138215f5b5393cc1f49020c1f",
         "action-policy.js": "66c6ad39f65378ccf8ed54177f5a3665e23ef82818c30fb05d28cd58cba9b2ab",
         "authenticated-profile.js": "2bbb96c4d25a108c44256514c1c9b4e61e1f125e470ab35c5e02515216cd1b33",
         "benchmark-latest.json": "c5524e6d42479578579fd7db0e50857ff0831ca219e611b821ad1e0a4fade303",
@@ -202,8 +210,8 @@
         "limit-suite-policy.js": "61440ee2e7f557ab2f3c74f8ef4ec2ec85fd2fb7fc53a4121e1f0d066670ea17",
         "mcp-session.js": "cd4a1e6d3c9d80c399fda8f313d69e38fa22a9b24789d7919832a56df7dc90c2",
         "output-bounds.js": "08ab730d0d8722c5e0e761911a509653dd23d8eb4d8c2abf2d9c5e8432870bdd",
-        "package-lock.json": "815dfdb89ce94b543e520955480e322438abd2b71fad4c4ddd699838b8622b65",
-        "package.json": "934ae0f55d1baea305c28f12c0c9faccdd864244d899663c96f9083d96442841",
+        "package.json": "54bf5020ac3ec8a682491dcfcf877b50dc239b6aee72afad039ce473fbc794c2",
+        "pnpm-lock.yaml": "17c814b167307942d3609c7b9d916ceddb85839573ab39baa114e30edb132a1a",
         "process-metrics.js": "e39d2980abb581ca0b917d0d33a1d71922ce49b679a7e96cf16a6a66b81d879a",
         "recipe-store.js": "358ac391ae86e0bfb82fc5b55bd08cfe3fd4fa56ac12a5ad4ad5abfa43c9a6c6",
         "scripts/benchmark.js": "f1bb939984460d84118317f9b4f811e0df80f590b0a441cd62a56eb97bb69b37",
@@ -307,8 +315,8 @@
         "network-security.js": "60a020d4e3c7a4784a5a4e7b7246ee34e63ac73ee2316e09a09d10668dc8a7bc",
         "oauth-device.js": "698aa9255bae47190c63527db7680aaab4f06392a108a0ff6444e32d31b7b89f",
         "oauth-watch-plan.js": "b1bbed52eeb0e2e50dd52d733897ebd70573fea3ff5f023b3c63347f92633d3e",
-        "package-lock.json": "fd7b6bf4545de4056908bd656a4a4e21b9f84acc7b06d8c1d581a8c84c295e90",
-        "package.json": "85ac369f959a40da258d268a3ab1d523abba7c225d5c44a903ddae0bcc512d1b",
+        "package.json": "15e02c7df79f72215e3b13af3aa8d6eba9ddd281509dc6bfeffc9ceb43bcba92",
+        "pnpm-lock.yaml": "fa60c4eced54fabd33553bd7e0e8e313e9749fea80381e333bfeb3c028aef879",
         "state-store.js": "a8fb63096b8efdec8de1cb386eff371f1552f3fd71d96f25036e1c724285e0af",
         "test/mcp-client.test.js": "26a7fe3ffa33ad454eced32c7fab12975ac5c0914041dea68cb7e5467e753a10",
         "tool-routing.js": "b3405c9879443cdc257a1e97d4968859a8654e62ff7cfb90ec3a7a992a62e311",
@@ -620,19 +628,20 @@
       }
     },
     "whatsapp-web": {
-      "version": "1.3.4",
+      "version": "1.3.5",
       "files": {
         "apply-whatsapp-web-compat.js": "8216698bf6d435d516ef8d10e47ea1fa636e81794ec66cde7e52a029f1bd89a0",
         "browser-cache.js": "f71c20f9ab5f04d9d46c5e2551b348d47baba89a10a07173070298098a6d5551",
         "config.js": "b0d4bed04dc87828ff61e1c9050a67ebf09a39cdc3ca52ce23be4c31476dda08",
         "incoming-wake-gate.js": "13b773f47e4e92910ac8dcb9ebb31a0cc7f244791105f45cd61c387a7f2f03cc",
-        "index.js": "461cecd656ba52245de6b76b009b6d335c2ded24eb7b1f163f7c7b7e50ab02f3",
+        "index.js": "5a1b6c36e7b02bc678aa0ed7194c669672945644c20a8e7452c9c206c2900ddb",
         "message-burst.js": "06b2348ea409dffff74c9ae5a6d882f3d279f4adc39206e019f73df424dc4b3b",
-        "package.json": "5e0ddf226fe8658fd78d2e1411f43ff816cc09726a827e0cdb2c151a2a8e8189",
+        "package.json": "f9c45c408616af49097746d055d1b5005ab955f642816daee7896887fc514130",
         "test/browser-cache.test.mjs": "636b91c16c9d4a67f38d625293fe371eb3d2e91818d131cacdec15e5bb255a69",
         "test/incoming-wake-gate.test.mjs": "f84f4f2e6c8d8ff2b7b63f9a266b15d7234bb017400826eac4f96a675cd7e25d",
         "test/message-burst.test.mjs": "d994f46054c7b464d47d714e6e364df5ba96206ce0b7069fccbb555fd61ed14f",
-        "tool.manifest.json": "9e40152ece0ba3ae7a1ad2c462291a5336c2d72492b4293f8f574923d2a762d6"
+        "test/task-ipc.test.mjs": "8f1221d05d1f97f204ea244fb77d088e538f93aa22ea45272d09bef56c762172",
+        "tool.manifest.json": "5106aae4fc5ae17b7babd7658437880170842e037dd6bbebe4a72729d203b663"
       }
     },
     "whispermix-transcribe": {

package/src/transport/telegram/telegram-auth-controller.js

@@ -1,6 +1,7 @@
 import {
   buildPiAuthRecoveryBlockedMessage,
   buildPiAuthTelegramMessage,
+  buildPiRequestFailureMessage,
   getErrorMessage,
   getPiAuthIssue,
   getPiAuthStatus
@@ -37,12 +38,16 @@ export function createTelegramAuthController({
   }
 
   function rememberValidationFailure(error) {
-    const detected = rememberIssue(error) || {
-      kind: "validation-failed",
-      message: getErrorMessage(error)
-    };
-    issue = detected;
-    return detected;
+    // Quota, network and server failures must never latch the Telegram auth gate.
+    issue = getPiAuthIssue(error);
+    return issue;
+  }
+
+  async function buildValidationFailureMessage(chatId, error) {
+    const detected = rememberValidationFailure(error);
+    return detected
+      ? buildPiAuthTelegramMessage({ config, chatId, issue: detected })
+      : buildPiRequestFailureMessage(error);
   }
 
   async function notifyIssueIfNeeded(chatId, error) {
@@ -62,15 +67,14 @@ export function createTelegramAuthController({
   async function finishRenewal(chatId, renewal) {
     try {
       await renewal.promise;
-      await agentManager.validateAgent();
-      agentManager.clearSessionCache(chatId);
       issue = null;
+      agentManager.clearSessionCache(chatId);
+      await agentManager.validateAgent();
       logger?.log("telegram", `Pi auth renewal completed for chat ${chatId}`);
       await api.sendMessage(chatId, await buildPiAuthTelegramMessage({ config, chatId, verified: true }));
     } catch (error) {
-      const detected = rememberValidationFailure(error);
-      logger?.error("telegram", `Pi auth renewal failed for chat ${chatId}: ${getErrorMessage(error)}`);
-      await api.sendMessage(chatId, await buildPiAuthTelegramMessage({ config, chatId, issue: detected })).catch((notifyError) => {
+      logger?.error("telegram", `Pi auth renewal or validation failed for chat ${chatId}: ${getErrorMessage(error)}`);
+      await api.sendMessage(chatId, await buildValidationFailureMessage(chatId, error)).catch((notifyError) => {
         logger?.error("telegram", `auth renewal failure notice failed for chat ${chatId}: ${getErrorMessage(notifyError)}`);
       });
     } finally {
@@ -141,7 +145,9 @@ export function createTelegramAuthController({
     if (!authorization.ok) return;
 
     const status = await getPiAuthStatus(config, ctx.chat.id);
-    if (status.hasApiKey || !status.supportsOAuth) {
+    const canValidateStoredAuth = status.hasStoredAuth && !issue && !renewals.has(chatKey(ctx.chat.id));
+    // A stored OAuth login may still be valid even when the provider has no quota.
+    if (status.hasApiKey || !status.supportsOAuth || canValidateStoredAuth) {
       await withTyping(ctx, async () => {
         try {
           await agentManager.validateAgent();
@@ -149,8 +155,7 @@ export function createTelegramAuthController({
           issue = null;
           await ctx.reply(await buildPiAuthTelegramMessage({ config, chatId: ctx.chat.id, verified: true }));
         } catch (error) {
-          const detected = rememberValidationFailure(error);
-          await ctx.reply(await buildPiAuthTelegramMessage({ config, chatId: ctx.chat.id, issue: detected }));
+          await ctx.reply(await buildValidationFailureMessage(ctx.chat.id, error));
         }
       });
       return;
@@ -162,8 +167,7 @@ export function createTelegramAuthController({
         ? "Starting Pi login from Telegram..."
         : "Pi login is already in progress. Paste the redirect URL or code here when you have it.");
     } catch (error) {
-      const detected = rememberValidationFailure(error);
-      await ctx.reply(await buildPiAuthTelegramMessage({ config, chatId: ctx.chat.id, issue: detected }));
+      await ctx.reply(await buildValidationFailureMessage(ctx.chat.id, error));
     }
   }
 

package/test/official-tool-installer.test.js

@@ -1,7 +1,7 @@
 import assert from "node:assert/strict";
 import crypto from "node:crypto";
 import { execFileSync } from "node:child_process";
-import { cp, mkdir, mkdtemp, readFile, readdir, rm, symlink, writeFile } from "node:fs/promises";
+import { chmod, cp, mkdir, mkdtemp, readFile, readdir, rm, symlink, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -136,6 +136,44 @@ test("installs a verified staged tree without overwriting an existing tool", asy
   );
 });
 
+for (const exitCode of [0, 1]) {
+  test(`uses the pnpm lock without falling back to npm when pnpm exits ${exitCode}`, async (t) => {
+    const { root, source, files } = await fixture(t);
+    for (const [name, content] of Object.entries({
+      "package.json": JSON.stringify({ dependencies: { example: "1.0.0" } }),
+      "pnpm-lock.yaml": "lockfileVersion: '9.0'\n"
+    })) {
+      await writeFile(path.join(source, name), content);
+      files[name] = await digest(path.join(source, name));
+    }
+    const bin = path.join(root, "bin");
+    const callsFile = path.join(root, "calls.jsonl");
+    await mkdir(bin);
+    for (const manager of ["pnpm", "npm"]) {
+      const executable = path.join(bin, manager);
+      await writeFile(executable, `#!${process.execPath}\nrequire('node:fs').appendFileSync(${JSON.stringify(callsFile)}, JSON.stringify([${JSON.stringify(manager)}, ...process.argv.slice(2)]) + '\\n');\nprocess.exit(${manager === "pnpm" ? exitCode : 0});\n`);
+      await chmod(executable, 0o755);
+    }
+    const previousPath = process.env.PATH;
+    process.env.PATH = `${bin}${path.delimiter}${previousPath}`;
+    t.after(() => { process.env.PATH = previousPath; });
+    const install = () => installLockedOfficialTool({
+      toolName: "master-slave",
+      lock: lock(files),
+      destination: path.join(root, "installed", "master-slave"),
+      checkout: async ({ checkoutDir }) => {
+        await mkdir(path.join(checkoutDir, "tools"), { recursive: true });
+        await cp(source, path.join(checkoutDir, "tools", "master-slave"), { recursive: true });
+      },
+      validate: async () => {}
+    });
+    if (exitCode) await assert.rejects(install, /pnpm failed/);
+    else await install();
+    const calls = (await readFile(callsFile, "utf8")).trim().split("\n").map(JSON.parse);
+    assert.deepEqual(calls, [["pnpm", "install", "--frozen-lockfile", "--prod"]]);
+  });
+}
+
 test("loads the bundled lock before selecting the canonical tool destination", async (t) => {
   const { root, files } = await fixture(t);
   const lockFile = path.join(root, "official-tools.lock.json");

package/test/telegram-auth-controller.test.js

@@ -0,0 +1,124 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { ModelRuntime } from "@earendil-works/pi-coding-agent";
+import { createTelegramAuthController } from "../src/transport/telegram/telegram-auth-controller.js";
+
+function setup(t, { stored = true, apiKey = "", failure = null, loginFailure = null } = {}) {
+  const messages = [];
+  const calls = { login: 0, validate: 0, clear: 0 };
+  t.mock.method(ModelRuntime, "create", async () => ({
+    setRuntimeApiKey: async () => {},
+    getProviderAuthStatus: () => ({ configured: stored, source: "stored" }),
+    getProvider: () => ({ auth: { oauth: {} } }),
+    async login() {
+      calls.login++;
+      if (loginFailure) throw loginFailure;
+      return { type: "oauth", access: "test-only" };
+    }
+  }));
+  const controller = createTelegramAuthController({
+    config: { pi: { provider: "openai-codex", model: "test-model", apiKey } },
+    api: { sendMessage: async (_chatId, text) => messages.push(text) },
+    agentManager: {
+      async validateAgent() {
+        calls.validate++;
+        if (failure) throw failure;
+      },
+      clearSessionCache() { calls.clear++; }
+    }
+  });
+  const command = () => controller.handleCommand({
+    chat: { id: 123 }, reply: async (text) => messages.push(text)
+  }, { authorize: async () => ({ ok: true }), withTyping: async (_ctx, fn) => fn() });
+  return { controller, messages, calls, command };
+}
+
+for (const apiKey of ["", "test-key"]) {
+  for (const message of [
+    "Codex error: The usage limit has been reached",
+    "429 Too many requests",
+    "insufficient_quota",
+    "request timed out",
+    "503 service unavailable"
+  ]) {
+    test(`validation preserves usable auth after ${message} (${apiKey ? "API key" : "OAuth"})`, async (t) => {
+      const { controller, calls, command, messages } = setup(t, { apiKey, failure: new Error(message) });
+      await command();
+      assert.equal(controller.getIssue(), null);
+      assert.equal(calls.login, 0);
+      assert.equal(calls.clear, 0);
+      assert.match(messages[0], new RegExp(message));
+      assert.doesNotMatch(messages[0], /Send \/auth|Run \/auth|Update the key|not ready/);
+      await command();
+      assert.equal(calls.validate, 2);
+      assert.equal(calls.login, 0);
+    });
+  }
+}
+
+test("/auth validates stored OAuth credentials instead of starting a device login", async (t) => {
+  const { controller, calls, command, messages } = setup(t);
+  await command();
+  assert.equal(calls.validate, 1);
+  assert.equal(calls.login, 0);
+  assert.equal(controller.getIssue(), null);
+  assert.match(messages[0], /authentication is working/);
+});
+
+test("real token invalidation remains blocking and permits OAuth recovery", async (t) => {
+  const { controller, command, calls, messages } = setup(t, { failure: new Error("auth token revoked") });
+  await command();
+  assert.equal(controller.getIssue()?.kind, "invalidated-token");
+  assert.match(messages[0], /Run \/auth/);
+  await command();
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(calls.login, 1);
+  assert.equal(controller.getIssue()?.kind, "invalidated-token");
+});
+
+test("successful OAuth renewal followed by quota failure clears a stale auth block", async (t) => {
+  const { controller, command, calls, messages } = setup(t, {
+    failure: new Error("Codex error: The usage limit has been reached")
+  });
+  controller.rememberIssue(new Error("auth token expired"));
+  await command();
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(calls.login, 1);
+  assert.equal(calls.clear, 1);
+  assert.equal(controller.getIssue(), null);
+  assert.equal(controller.hasActiveRenewal(123), false);
+  assert.match(messages.join("\n"), /signing in again does not restore quota/);
+  await command();
+  assert.equal(calls.login, 1);
+  assert.equal(calls.validate, 2);
+});
+
+test("missing credentials still initiate login", async (t) => {
+  const { controller, command, calls } = setup(t, { stored: false });
+  await command();
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(calls.login, 1);
+  assert.equal(calls.validate, 1);
+  assert.equal(controller.getIssue(), null);
+});
+
+test("transient OAuth login failure does not create an authentication block", async (t) => {
+  const { controller, command, calls, messages } = setup(t, {
+    stored: false, loginFailure: new Error("request timed out")
+  });
+  await command();
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(calls.validate, 0);
+  assert.equal(controller.getIssue(), null);
+  assert.equal(controller.hasActiveRenewal(123), false);
+  assert.match(messages.join("\n"), /does not establish an authentication failure/);
+});
+
+test("ordinary prompt quota errors never latch the auth issue", async (t) => {
+  const { controller, messages } = setup(t);
+  assert.equal(await controller.notifyIssueIfNeeded(123, new Error("Codex error: The usage limit has been reached")), false);
+  assert.equal(controller.getIssue(), null);
+  assert.equal(messages.length, 0);
+  assert.equal(await controller.notifyIssueIfNeeded(123, new Error("No auth found")), true);
+  assert.equal(controller.getIssue()?.kind, "missing-auth");
+});