cue-ai 0.9.0 → 0.9.2

package/src/lib/companion-detect.ts

@@ -0,0 +1,140 @@
+/**
+ * Content-aware combine-companion detection.
+ *
+ * The profile picker's "Combine X with…" multiselect is fed by static
+ * `recommends:` lists and historical pairings — both blind to what's actually
+ * in the directory. This module scans the cwd for CONTENT signals (image/video
+ * assets, markdown drafts, a registered brand folder) and emits companion
+ * profiles to surface (and auto-check) in that multiselect.
+ *
+ * Sibling to `auto-detect.ts`: same best-effort, 0–1 confidence, max-merge
+ * discipline — but keyed on directory *content* rather than framework configs.
+ * Pure + injectable (`listEntries`) so the rules are unit-testable without a
+ * real filesystem.
+ */
+
+import { readdirSync } from "node:fs";
+import { basename, extname } from "node:path";
+
+export interface CompanionSignal {
+  /** Companion profile to surface in the combine multiselect. */
+  profile: string;
+  /** 0–1. Companions at/above the picker's auto-check threshold start checked. */
+  confidence: number;
+  /** Human-readable trigger, shown as the row hint (e.g. "12 image assets"). */
+  reason: string;
+}
+
+export interface CompanionDetectInput {
+  cwd: string;
+  /** Only profiles installed in this cue install are eligible. */
+  knownProfiles: ReadonlySet<string>;
+  /** Registered postizz brand folder names (basenames under brands/). */
+  brands?: ReadonlySet<string>;
+  /**
+   * Injectable shallow directory listing (entry names only, non-recursive).
+   * Defaults to a best-effort `readdirSync(cwd)`; a missing/unreadable dir
+   * yields an empty list, so detection silently produces no signals.
+   */
+  listEntries?: (cwd: string) => string[];
+}
+
+const IMAGE_EXTS = new Set([".png", ".jpg", ".jpeg", ".webp", ".gif"]);
+const VIDEO_EXTS = new Set([".mp4", ".mov", ".webm"]);
+const CONTENT_DIRS = new Set(["content", "posts", "drafts"]);
+// Markdown that isn't a draft — excluded from the draft count (case-folded stem).
+const NON_DRAFT_MD = new Set([
+  "readme",
+  "agents",
+  "claude",
+  "changelog",
+  "contributing",
+  "license",
+]);
+
+// Tunables. Require ≥3 images before reading a directory as "image work" (one
+// stray screenshot shouldn't trigger it); confidence climbs with the count,
+// capped. Image/video/brand land at/above the picker's 0.7 auto-check line;
+// markdown sits just below, so it surfaces but stays unchecked until toggled.
+const MIN_IMAGES = 3;
+const IMAGE_CONF_BASE = 0.7;
+const IMAGE_CONF_STEP = 0.05;
+const IMAGE_CONF_CAP = 0.9;
+const VIDEO_CONF = 0.7;
+const MIN_MD_DRAFTS = 2;
+const MD_CONF = 0.6;
+const BRAND_CONF = 0.8;
+
+function defaultListEntries(cwd: string): string[] {
+  try {
+    return readdirSync(cwd);
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Scan `cwd` for content signals and return companion profiles to surface in
+ * the combine multiselect — de-duped per profile (max confidence, merged
+ * reasons), filtered to installed profiles, sorted by confidence DESC.
+ */
+export function detectCompanions(input: CompanionDetectInput): CompanionSignal[] {
+  const list = (input.listEntries ?? defaultListEntries)(input.cwd);
+
+  // Aggregate per profile: keep the strongest signal, accumulate its reasons.
+  const acc = new Map<string, { confidence: number; reasons: string[] }>();
+  const add = (profile: string, confidence: number, reason: string): void => {
+    const entry = acc.get(profile) ?? { confidence: 0, reasons: [] };
+    entry.confidence = Math.max(entry.confidence, confidence);
+    if (!entry.reasons.includes(reason)) entry.reasons.push(reason);
+    acc.set(profile, entry);
+  };
+
+  let images = 0;
+  let videos = 0;
+  let mdDrafts = 0;
+  let hasContentDir = false;
+  for (const name of list) {
+    const lower = name.toLowerCase();
+    const ext = extname(lower);
+    if (IMAGE_EXTS.has(ext)) {
+      images++;
+    } else if (VIDEO_EXTS.has(ext)) {
+      videos++;
+    } else if (ext === ".md") {
+      if (!NON_DRAFT_MD.has(lower.slice(0, -3))) mdDrafts++;
+    }
+    // A `content/` (etc.) entry could be a dir or a file; either way it reads
+    // as a drafts workspace for our purposes — a shallow listing can't cheaply
+    // distinguish, and the false-positive cost (one extra unchecked row) is nil.
+    if (CONTENT_DIRS.has(lower)) hasContentDir = true;
+  }
+
+  // ── images → higgsfield (confidence scales with count) ──
+  if (images >= MIN_IMAGES) {
+    const conf = Math.min(IMAGE_CONF_CAP, IMAGE_CONF_BASE + IMAGE_CONF_STEP * (images - MIN_IMAGES));
+    add("higgsfield", conf, `${images} image assets`);
+  }
+  // ── video → higgsfield ──
+  if (videos >= 1) {
+    add("higgsfield", VIDEO_CONF, `${videos} video file${videos === 1 ? "" : "s"}`);
+  }
+  // ── markdown drafts / content dir → blog-writer ──
+  if (mdDrafts >= MIN_MD_DRAFTS || hasContentDir) {
+    add("blog-writer", MD_CONF, "markdown drafts");
+  }
+  // ── registered brand folder → postizz ──
+  const brand = basename(input.cwd);
+  if (input.brands?.has(brand)) {
+    add("postizz", BRAND_CONF, `registered brand: ${brand}`);
+  }
+
+  return [...acc.entries()]
+    .filter(([profile]) => input.knownProfiles.has(profile))
+    .map(([profile, { confidence, reasons }]) => ({
+      profile,
+      confidence,
+      reason: reasons.join(", "),
+    }))
+    .sort((a, b) => b.confidence - a.confidence || a.profile.localeCompare(b.profile));
+}

package/src/lib/companion-fetch.ts

@@ -16,9 +16,10 @@
  */
 
 import { spawnSync, spawn as nodeSpawn } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, cpSync, rmSync, mkdtempSync, statSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, cpSync, rmSync, mkdtempSync, } from "node:fs";
 import { join } from "node:path";
-import { tmpdir, homedir } from "node:os";
+import { tmpdir } from "node:os";
+import { cacheDir } from "./config-paths";
 import { createHash } from "node:crypto";
 
 // ---------------------------------------------------------------------------
@@ -68,10 +69,7 @@ interface ETagEntry {
   ts: number;
 }
 
-const ETAG_CACHE_PATH = join(
-  process.env.XDG_CACHE_HOME ?? join(homedir(), ".cache"),
-  "cue", "companion-etags.json",
-);
+const ETAG_CACHE_PATH = join(cacheDir(), "companion-etags.json");
 
 function loadETagCache(): Record<string, ETagEntry> {
   try {

package/src/lib/conditional-skills.test.ts

@@ -3,7 +3,7 @@ import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
-import { evaluateCondition, filterConditionalSkills, type SkillCondition, type ConditionalSkill } from "./conditional-skills";
+import { evaluateCondition, filterConditionalSkills, type ConditionalSkill } from "./conditional-skills";
 
 let tmp: string;
 

package/src/lib/config-paths.test.ts

@@ -0,0 +1,53 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+import { cacheDir, configDir } from "./config-paths";
+
+// configDir/cacheDir read process.env; snapshot + restore so tests don't leak.
+const SAVED = {
+  config: process.env.XDG_CONFIG_HOME,
+  cache: process.env.XDG_CACHE_HOME,
+};
+
+describe("config-paths", () => {
+  beforeEach(() => {
+    delete process.env.XDG_CONFIG_HOME;
+    delete process.env.XDG_CACHE_HOME;
+  });
+  afterEach(() => {
+    if (SAVED.config === undefined) delete process.env.XDG_CONFIG_HOME;
+    else process.env.XDG_CONFIG_HOME = SAVED.config;
+    if (SAVED.cache === undefined) delete process.env.XDG_CACHE_HOME;
+    else process.env.XDG_CACHE_HOME = SAVED.cache;
+  });
+
+  test("configDir falls back to ~/.config/cue when XDG unset", () => {
+    expect(configDir()).toBe(join(homedir(), ".config", "cue"));
+  });
+
+  test("configDir honors a set XDG_CONFIG_HOME", () => {
+    process.env.XDG_CONFIG_HOME = "/custom/xdg";
+    expect(configDir()).toBe(join("/custom/xdg", "cue"));
+  });
+
+  // The bug this module fixes: a set-but-empty XDG must NOT resolve to a
+  // relative "cue" path (the old `XDG ? join(XDG,"cue") : ...` variant did).
+  test("configDir treats an empty XDG_CONFIG_HOME as unset (absolute, not relative)", () => {
+    process.env.XDG_CONFIG_HOME = "";
+    const dir = configDir();
+    expect(dir).toBe(join(homedir(), ".config", "cue"));
+    expect(dir.startsWith("/")).toBe(true);
+  });
+
+  test("cacheDir falls back to ~/.cache/cue and honors XDG_CACHE_HOME", () => {
+    expect(cacheDir()).toBe(join(homedir(), ".cache", "cue"));
+    process.env.XDG_CACHE_HOME = "/c";
+    expect(cacheDir()).toBe(join("/c", "cue"));
+  });
+
+  test("cacheDir treats an empty XDG_CACHE_HOME as unset", () => {
+    process.env.XDG_CACHE_HOME = "";
+    expect(cacheDir()).toBe(join(homedir(), ".cache", "cue"));
+  });
+});

package/src/lib/config-paths.ts

@@ -0,0 +1,33 @@
+/**
+ * Single source of truth for cue's on-disk locations.
+ *
+ * `configDir()` and `cacheDir()` were previously re-implemented ~14 times
+ * across lib/ and commands/, in two subtly different variants:
+ *   - correct:  `xdg && xdg.length > 0 ? xdg : ~/.config`  (empty XDG = unset)
+ *   - buggy:    `xdg ? join(xdg, "cue") : ~/.config/cue`    (empty XDG = set →
+ *               resolves to a *relative* "cue" path)
+ * Centralizing here removes the drift and the empty-string footgun. The repo
+ * root (`CUE_REPO_ROOT`/`SOUL_REPO_ROOT` + ~10 local resolutions) is a related
+ * but distinct concern, intentionally left for a follow-up.
+ */
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+/**
+ * cue's base config dir: `$XDG_CONFIG_HOME/cue`, else `~/.config/cue`.
+ * A missing OR empty `XDG_CONFIG_HOME` falls back to `~/.config` (an
+ * empty-but-set value must NOT resolve to a relative "cue" path).
+ */
+export function configDir(): string {
+  const xdg = process.env.XDG_CONFIG_HOME;
+  return join(xdg && xdg.length > 0 ? xdg : join(homedir(), ".config"), "cue");
+}
+
+/**
+ * cue's cache dir: `$XDG_CACHE_HOME/cue`, else `~/.cache/cue`. Same
+ * empty-string discipline as {@link configDir}.
+ */
+export function cacheDir(): string {
+  const xdg = process.env.XDG_CACHE_HOME;
+  return join(xdg && xdg.length > 0 ? xdg : join(homedir(), ".cache"), "cue");
+}

package/src/lib/dashboard-server.test.ts

@@ -0,0 +1,351 @@
+/**
+ * Tests for the dashboard server's profile-detail handler — the data source
+ * that backs cue studio's explorer / search / mcps views. Runs against the
+ * real on-disk `profiles/` + `resources/skills/` tree (no mocks) so the test
+ * also guards the loader → resolver → parser wiring the studio depends on.
+ */
+
+import { describe, expect, test } from "bun:test";
+
+import { handleProfileDetail, handleMcpCatalog, handleMcpAdd, handleMarket, createHandler, semverGt, computeVersionInfo, buildTimeline, handleHooks, handleHookSource } from "./dashboard-server";
+
+function detail(profile: string) {
+  return handleProfileDetail(new URLSearchParams({ profile }));
+}
+
+describe("version banner logic", () => {
+  test("semverGt compares major.minor.patch", () => {
+    expect(semverGt("0.9.1", "0.9.0")).toBe(true);
+    expect(semverGt("1.0.0", "0.9.9")).toBe(true);
+    expect(semverGt("0.9.0", "0.9.0")).toBe(false);
+    expect(semverGt("0.9.0", "0.9.1")).toBe(false);
+    expect(semverGt("0.10.0", "0.9.0")).toBe(true); // numeric, not lexical
+  });
+
+  test("computeVersionInfo flags an update + carries the registry notice", () => {
+    const info = computeVersionInfo("0.9.0", { version: "0.9.1", cue: { notice: { message: "hi", command: "npm i -g cue-ai@latest" } } });
+    expect(info.updateAvailable).toBe(true);
+    expect(info.latest).toBe("0.9.1");
+    expect(info.notice).toEqual({ message: "hi", command: "npm i -g cue-ai@latest" });
+  });
+
+  test("computeVersionInfo is fail-soft when the registry doc is null (offline)", () => {
+    const info = computeVersionInfo("0.9.0", null);
+    expect(info).toEqual({ current: "0.9.0", latest: null, updateAvailable: false, notice: null });
+  });
+
+  test("computeVersionInfo shows a notice even when already up to date", () => {
+    const info = computeVersionInfo("0.9.0", { version: "0.9.0", cue: { notice: { message: "heads up" } } });
+    expect(info.updateAvailable).toBe(false);
+    expect(info.notice).toEqual({ message: "heads up", command: undefined });
+  });
+
+  test("computeVersionInfo drops an empty notice object", () => {
+    const info = computeVersionInfo("0.9.0", { version: "0.9.0", cue: { notice: {} } });
+    expect(info.notice).toBeNull();
+  });
+});
+
+describe("handleProfileDetail", () => {
+  test("returns a real, grouped skill catalogue for gstack", async () => {
+    const res = await detail("gstack");
+    expect(res.ok).toBe(true);
+    if (!res.ok) return;
+    const d = res.data as {
+      profile: string;
+      parts: string[];
+      counts: { skills: number; mcps: number; plugins: number; commands: number };
+      skills: { id: string; ns: string; name: string; body: string; missing: boolean }[];
+      mcps: { id: string }[];
+      commands: { name: string; ref: string; desc: string; argHint: string | null; body: string; sizeK: number; missing: boolean }[];
+    };
+
+    expect(d.profile).toBe("gstack");
+    expect(d.parts).toEqual(["gstack"]);
+    expect(d.skills.length).toBeGreaterThan(0);
+    expect(d.counts.skills).toBe(d.skills.length);
+
+    // Every skill carries a namespace (first path segment) and a non-empty body.
+    for (const s of d.skills) {
+      expect(s.ns.length).toBeGreaterThan(0);
+      expect(s.body.length).toBeGreaterThan(0);
+    }
+
+    // The known meta/analyze skill resolves from disk (not a stub).
+    const analyze = d.skills.find((s) => s.id === "meta/analyze");
+    expect(analyze).toBeDefined();
+    expect(analyze!.missing).toBe(false);
+    expect(analyze!.body).toContain("name: analyze");
+
+    // Commands are slash-prefixed, carry a bare ref, and a body for the preview.
+    expect(d.commands.length).toBeGreaterThan(0);
+    expect(d.counts.commands).toBe(d.commands.length);
+    for (const c of d.commands) {
+      expect(c.name).toBe("/" + c.ref);
+      expect(c.body.length).toBeGreaterThan(0);
+    }
+
+    // A known command (/verify) resolves its real markdown from
+    // resources/commands (not a stub), with its frontmatter description.
+    const verify = d.commands.find((c) => c.ref === "verify");
+    expect(verify).toBeDefined();
+    expect(verify!.missing).toBe(false);
+    expect(verify!.desc.length).toBeGreaterThan(0);
+    expect(verify!.body).toContain("description:");
+  });
+
+  test("resolves composite selectors and dedupes the union", async () => {
+    const res = await detail("gstack+core");
+    expect(res.ok).toBe(true);
+    if (!res.ok) return;
+    const d = res.data as { parts: string[]; skills: { id: string }[] };
+    expect(d.parts).toEqual(["gstack", "core"]);
+    const ids = d.skills.map((s) => s.id);
+    expect(new Set(ids).size).toBe(ids.length); // no duplicate skill ids
+  });
+
+  test("errors cleanly for an unknown profile", async () => {
+    const res = await detail("definitely-not-a-real-profile-xyz");
+    expect(res.ok).toBe(false);
+  });
+
+  test("surfaces per-profile CLI dependencies from skill frontmatter", async () => {
+    const res = await detail("gstack+core");
+    expect(res.ok).toBe(true);
+    if (!res.ok) return;
+    const d = res.data as {
+      counts: { clis: number };
+      clis: { name: string; install: string; known: boolean; usedBy: string[] }[];
+    };
+    expect(Array.isArray(d.clis)).toBe(true);
+    expect(d.counts.clis).toBe(d.clis.length);
+    // Every CLI is attributed to at least one skill and ranked by usage.
+    for (const c of d.clis) {
+      expect(c.name.length).toBeGreaterThan(0);
+      expect(c.usedBy.length).toBeGreaterThan(0);
+    }
+    for (let i = 1; i < d.clis.length; i++) {
+      expect(d.clis[i - 1]!.usedBy.length).toBeGreaterThanOrEqual(d.clis[i]!.usedBy.length);
+    }
+  });
+
+  test("surfaces the agency profile's declared subagents, grouped by division", async () => {
+    const res = await detail("agency");
+    expect(res.ok).toBe(true);
+    if (!res.ok) return;
+    const d = res.data as {
+      counts: { subagents: number };
+      subagents: { id: string; division: string; name: string }[];
+    };
+
+    // The roster is large and varied — not just a couple inherited bits.
+    expect(d.counts.subagents).toBe(d.subagents.length);
+    expect(d.subagents.length).toBeGreaterThan(40);
+
+    // A known ref splits into division + slug for grouped display.
+    const ui = d.subagents.find((s) => s.id === "design/design-ui-designer");
+    expect(ui).toBeDefined();
+    expect(ui!.division).toBe("design");
+    expect(ui!.name).toBe("design-ui-designer");
+
+    // Multiple divisions are represented (design, finance, sales, …).
+    expect(new Set(d.subagents.map((s) => s.division)).size).toBeGreaterThan(5);
+  });
+
+  test("parses the profile's declared playbooks into workflow cards", async () => {
+    const res = await detail("gstack");
+    expect(res.ok).toBe(true);
+    if (!res.ok) return;
+    const d = res.data as {
+      playbooks: { id: string; name: string; title: string; emoji: string; trigger: string; est: string; desc: string; steps: { name: string; detail: string }[] }[];
+    };
+
+    expect(Array.isArray(d.playbooks)).toBe(true);
+    expect(d.playbooks.length).toBeGreaterThan(0);
+
+    // ship-feature is declared (inherited from core) and parses with real steps.
+    const ship = d.playbooks.find((p) => p.id === "ship-feature");
+    expect(ship).toBeDefined();
+    expect(ship!.title).toBe("Ship a Feature");
+    expect(ship!.trigger).toBe("playbook");
+    expect(ship!.est.startsWith("~")).toBe(true);
+    expect(ship!.desc.length).toBeGreaterThan(0);
+    expect(ship!.steps.length).toBeGreaterThan(0);
+
+    // Steps strip the leading "N." numbering and never carry markdown noise.
+    for (const s of ship!.steps) {
+      expect(s.name.length).toBeGreaterThan(0);
+      expect(/^\d+\.\s/.test(s.name)).toBe(false);
+    }
+  });
+});
+
+describe("GET /api/v1/plugin-icon", () => {
+  const handler = createHandler();
+  const get = (qs: string) =>
+    handler(new Request(`http://127.0.0.1/api/v1/plugin-icon${qs}`));
+
+  test("reuses a same-named profile's logo (resend)", async () => {
+    const res = await get("?plugin=resend@claude-plugins-official");
+    expect(res.status).toBe(200);
+    expect(res.headers.get("Content-Type")).toBe("image/png");
+    expect((await res.arrayBuffer()).byteLength).toBeGreaterThan(0);
+  });
+
+  test("rejects a path-traversal plugin name", async () => {
+    const res = await get("?plugin=" + encodeURIComponent("../secret"));
+    expect(res.status).toBe(400);
+  });
+
+  test("400 when the plugin param is missing", async () => {
+    const res = await get("");
+    expect(res.status).toBe(400);
+  });
+
+  test("404 for a plugin with neither a profile nor a generated logo", async () => {
+    const res = await get("?plugin=definitely-not-a-real-plugin-xyz");
+    expect(res.status).toBe(404);
+  });
+});
+
+describe("handleMcpCatalog", () => {
+  test("returns the catalog as an array of addable entries", async () => {
+    const res = await handleMcpCatalog();
+    expect(res.ok).toBe(true);
+    if (!res.ok) return;
+    const entries = res.data as { id: string; transport: string }[];
+    expect(Array.isArray(entries)).toBe(true);
+    expect(entries.length).toBeGreaterThan(10);
+    expect(entries.some((e) => e.id === "coolify")).toBe(true);
+  });
+});
+
+describe("handleMarket", () => {
+  const VALID_TYPES = new Set(["profile", "workflow", "skill", "cli", "mcp", "plugin"]);
+
+  test("returns a normalized, counted marketplace feed", async () => {
+    const res = await handleMarket();
+    expect(res.ok).toBe(true);
+    if (!res.ok) return;
+    const d = res.data as {
+      items: Array<Record<string, unknown>>;
+      counts: Record<string, number>;
+    };
+
+    expect(Array.isArray(d.items)).toBe(true);
+    expect(d.items.length).toBeGreaterThan(0);
+
+    // Every item carries the full contract: correct field types + a valid type.
+    for (const it of d.items) {
+      expect(typeof it.id).toBe("string");
+      expect((it.id as string).length).toBeGreaterThan(0);
+      expect(VALID_TYPES.has(it.type as string)).toBe(true);
+      expect(typeof it.name).toBe("string");
+      expect(typeof it.author).toBe("string");
+      expect(typeof it.handle).toBe("string");
+      expect(typeof it.stars).toBe("number");
+      expect(typeof it.installs).toBe("string");
+      expect(typeof it.when).toBe("string");
+      expect(typeof it.featured).toBe("boolean");
+      expect(typeof it.desc).toBe("string");
+      expect(Array.isArray(it.tags)).toBe(true);
+      expect(["registry", "local"]).toContain(it.source as string);
+      expect(typeof it.add).toBe("string");
+      expect(VALID_TYPES.has(it.addKind as string)).toBe(true);
+    }
+
+    // counts.all === items.length, and per-type counts sum to it.
+    expect(d.counts.all).toBe(d.items.length);
+    const perType = d.counts.profile + d.counts.workflow + d.counts.skill + d.counts.cli + d.counts.mcp + d.counts.plugin;
+    expect(perType).toBe(d.counts.all);
+
+    // The local library is always present — profiles + workflows come from disk.
+    expect(d.counts.profile).toBeGreaterThan(0);
+    expect(d.counts.workflow).toBeGreaterThan(0);
+  });
+});
+
+describe("handleMcpAdd validation", () => {
+  test("rejects a missing id", async () => {
+    const res = await handleMcpAdd({ profile: "core" });
+    expect(res.ok).toBe(false);
+    if (!res.ok) expect(res.error).toBe("missing-id");
+  });
+
+  test("rejects a missing profile", async () => {
+    const res = await handleMcpAdd({ id: "coolify" });
+    expect(res.ok).toBe(false);
+    if (!res.ok) expect(res.error).toBe("missing-profile");
+  });
+
+  test("surfaces unknown-mcp from the lib as an error envelope", async () => {
+    const res = await handleMcpAdd({ id: "not-a-real-mcp-xyz", profile: "core" });
+    expect(res.ok).toBe(false);
+    if (!res.ok) expect(res.error).toMatch(/unknown-mcp/);
+  });
+});
+
+describe("buildTimeline", () => {
+  test("returns gap-filled daily buckets spanning the window", () => {
+    const t = buildTimeline(7);
+    expect(t.windowDays).toBe(7);
+    expect(t.daily).toHaveLength(7);
+    expect(t.daily.every((d) => typeof d.sessions === "number" && /^\d{4}-\d{2}-\d{2}$/.test(d.date))).toBe(true);
+    expect(Array.isArray(t.profiles)).toBe(true);
+  });
+});
+
+describe("GET /api/v1/hook-source", () => {
+  test("rejects a missing path", async () => {
+    const r = await handleHookSource(new URLSearchParams());
+    expect(r.ok).toBe(false);
+    if (!r.ok) expect(r.error).toBe("missing-path");
+  });
+
+  test("rejects an arbitrary path — only enumerated hook scripts are readable", async () => {
+    const r = await handleHookSource(new URLSearchParams({ path: "/etc/passwd" }));
+    expect(r.ok).toBe(false);
+    if (!r.ok) expect(r.error).toBe("not-a-hook-script");
+  });
+
+  test("rejects a path traversal that escapes the hooks dir", async () => {
+    const r = await handleHookSource(new URLSearchParams({ path: "/x/hooks/../../../../etc/passwd" }));
+    expect(r.ok).toBe(false);
+    if (!r.ok) expect(r.error).toBe("not-a-hook-script");
+  });
+
+  test("serves a real enumerated hook script's source", async () => {
+    const hk = await handleHooks(new URLSearchParams());
+    if (!hk.ok) return; // telemetry/profile unresolved in this env — security cases still cover it
+    const events = (hk.data as { events: { hooks: { scriptPath: string | null }[] }[] }).events;
+    const withScript = events.flatMap((e) => e.hooks).find((h) => h.scriptPath);
+    if (!withScript?.scriptPath) return; // no resolvable hook scripts here
+    const r = await handleHookSource(new URLSearchParams({ path: withScript.scriptPath }));
+    expect(r.ok).toBe(true);
+    if (r.ok) {
+      const d = r.data as { filename: string; content: string; language: string };
+      expect(d.filename.length).toBeGreaterThan(0);
+      expect(typeof d.content).toBe("string");
+      expect(d.language.length).toBeGreaterThan(0);
+    }
+  });
+});
+
+describe("GET /api/v1/telemetry/stream (SSE)", () => {
+  test("responds as an event-stream and pushes an initial frame", async () => {
+    const handler = createHandler();
+    const res = await handler(new Request("http://localhost/api/v1/telemetry/stream?since=7"));
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-type")).toContain("text/event-stream");
+    expect(res.body).not.toBeNull();
+    // Read just the first frame, then cancel so the stream's interval timers
+    // stop and the test process can exit.
+    const reader = res.body!.getReader();
+    const { value, done } = await reader.read();
+    expect(done).toBe(false);
+    const text = new TextDecoder().decode(value);
+    // A real timeline frame when telemetry is on, or the disabled error frame.
+    expect(text).toMatch(/event: (timeline|error)/);
+    await reader.cancel();
+  });
+});