gentle-pi 3.3.0 → 3.5.0

package/tests/gentle-shell.test.ts

@@ -7,6 +7,7 @@ import test from "node:test";
 import { initTheme, type ExtensionAPI, type ExtensionContext, type SlashCommandInfo, type SourceInfo } from "@earendil-works/pi-coding-agent";
 import type { TUI, TuiMouseEvent } from "@earendil-works/pi-tui";
 import installGentleShell, { buildShellBarModel, createActiveProfileReader, changesShortcut, devBinaryCard, extractQueuedText, fetchCodexUsage, fetchNanUsage, loadFileDiff, shellGitRunner, openInExternalEditor, usageShortcut, type GentlePromptEditor } from "../extensions/gentle-shell.ts";
+import { USAGE_SOURCE_EVENT, USAGE_SOURCE_SCHEMA } from "../lib/shell-usage.ts";
 import { CHANGE_STATUS } from "../lib/shell-changes.ts";
 import { sidebarState, type SidebarRail } from "../lib/shell-sidebar.ts";
 import type { ShellBarTheme } from "../lib/shell-bar.ts";
@@ -129,7 +130,7 @@ async function fire(handlers: Map<string, Array<(event: unknown, ctx: ExtensionC
 	for (const handler of handlers.get(event) ?? []) await handler({}, ctx);
 }
 
-function fakeContext(options: { hasUI?: boolean; entries?: unknown[]; oauth?: boolean; pending?: boolean; idle?: boolean; editorFactory?: unknown; token?: string } = {}): { ctx: ExtensionContext; ui: FakeUi; overlayReady: Promise<void> } {
+function fakeContext(options: { hasUI?: boolean; entries?: unknown[]; oauth?: boolean; pending?: boolean; idle?: boolean; editorFactory?: unknown; token?: string; select?: (title: string, options: string[]) => Promise<string | undefined> } = {}): { ctx: ExtensionContext; ui: FakeUi; overlayReady: Promise<void> } {
 	const ui: FakeUi = { footerFactory: undefined, editorFactory: options.editorFactory, widgets: new Map(), widgetSets: 0, workingVisible: undefined, notices: [], overlay: undefined, overlayView: undefined, closeOverlay: undefined };
 	let resolveOverlay: () => void;
 	const overlayReady = new Promise<void>((resolve) => { resolveOverlay = resolve; });
@@ -150,6 +151,9 @@ function fakeContext(options: { hasUI?: boolean; entries?: unknown[]; oauth?: bo
 		getContextUsage: () => ({ tokens: 122_400, contextWindow: 272_000, percent: 45 }),
 		ui: {
 			theme: plainTheme,
+			// Added only when requested: an absent select keeps the no-menu fallback
+			// that every pre-existing test relies on.
+			...(options.select ? { select: options.select } : {}),
 			setFooter(factory: unknown) {
 				ui.footerFactory = factory;
 			},
@@ -475,7 +479,122 @@ test("gentleShell shows working while the agent runs and queued when messages wa
 	editor.dispose();
 });
 
+test("animations command reports without writing and switches the live pulse", async (t) => {
+	const configHome = scopedDoubleEscCancelConfigHome(t);
+	const delays: number[] = [];
+	let active = 0;
+	t.mock.method(globalThis, "setInterval", (_callback: () => void, delay: number) => {
+		delays.push(delay); active++; return { unref() {} };
+	});
+	t.mock.method(globalThis, "clearInterval", () => { active--; });
+	const { pi, handlers, commands } = fakePi();
+	gentleShell(pi, { GENTLE_PI_CONFIG_HOME: configHome });
+	const { ctx, ui } = fakeContext();
+	const editor = installedPrompt(ctx, ui, handlers);
+	const command = commands.get("gentle:animations");
+	assert.ok(command);
+	await command.handler("", ctx);
+	assert.match(ui.notices.at(-1)!, /animations: quality/);
+	assert.equal(existsSync(join(configHome, "animations.json")), false);
+	for (const handler of handlers.get("agent_start") ?? []) handler({}, ctx);
+	assert.deepEqual(delays, [80]);
+	await command.handler("performance", ctx);
+	assert.deepEqual(delays, [80, 1000]);
+	assert.equal(active, 1);
+	await command.handler("potato", ctx);
+	assert.equal(active, 0);
+	assert.match(stripAnsi(editor.render(60)[0]), /working/);
+	assert.equal(JSON.parse(readFileSync(join(configHome, "animations.json"), "utf8")).policy, "potato");
+	await command.handler("invalid", ctx);
+	assert.equal(JSON.parse(readFileSync(join(configHome, "animations.json"), "utf8")).policy, "potato");
+	await command.handler("quality", ctx);
+	assert.deepEqual(delays, [80, 1000, 80]);
+	for (const handler of handlers.get("agent_settled") ?? []) handler({}, ctx);
+	assert.equal(active, 0);
+	editor.dispose();
+});
+
+test("potato repaints start/settle and shows queued state on the host's next render without intervals", async (t) => {
+	const configHome = scopedDoubleEscCancelConfigHome(t);
+	writeFileSync(join(configHome, "animations.json"), '{"schema":"gentle-pi.animations/v1","policy":"potato"}');
+	const intervals = t.mock.method(globalThis, "setInterval", () => { throw new Error("potato must not animate"); });
+	const renders = t.mock.method(fakeTui, "requestRender", () => {});
+	const { pi, handlers, commands } = fakePi();
+	gentleShell(pi, { GENTLE_PI_CONFIG_HOME: configHome });
+	const { ctx, ui } = fakeContext();
+	const pending = { value: false };
+	(ctx as unknown as { hasPendingMessages(): boolean }).hasPendingMessages = () => pending.value;
+	const editor = installedPrompt(ctx, ui, handlers);
+	let before = renders.mock.callCount();
+	for (const handler of handlers.get("agent_start") ?? []) handler({}, ctx);
+	assert.ok(renders.mock.callCount() > before);
+	assert.match(stripAnsi(editor.render(60)[0]), /✿ working/);
+	before = renders.mock.callCount();
+	pending.value = true;
+	assert.equal(renders.mock.callCount(), before, "changing the queue flag is not a Gentle repaint event");
+	// Pi owns enqueue and its repaint scheduling; this fake context exposes only
+	// hasPendingMessages, not Pi's enqueue path. Simulate the host's render request:
+	// this proves next-render visibility, not real Pi enqueue-to-paint latency.
+	fakeTui.requestRender();
+	assert.equal(renders.mock.callCount(), before + 1);
+	assert.match(stripAnsi(editor.render(60)[0]), /✿ queued/);
+	before = renders.mock.callCount();
+	for (const handler of handlers.get("agent_settled") ?? []) handler({}, ctx);
+	assert.ok(renders.mock.callCount() > before);
+	assert.doesNotMatch(stripAnsi(editor.render(60)[0]), /working|queued/);
+	await commands.get("gentle:animations")!.handler("status", ctx);
+	assert.match(ui.notices.at(-1)!, /animations: potato/);
+	for (const handler of handlers.get("session_shutdown") ?? []) handler({}, ctx);
+	assert.equal(intervals.mock.callCount(), 0);
+});
+
+test("animations status attributes malformed files and reports a failed write", async (t) => {
+	const configHome = scopedDoubleEscCancelConfigHome(t);
+	const path = join(configHome, "animations.json");
+	writeFileSync(path, "broken");
+	const { pi, commands } = fakePi();
+	gentleShell(pi, { GENTLE_PI_CONFIG_HOME: configHome });
+	const { ctx, ui } = fakeContext();
+	await commands.get("gentle:animations")!.handler("", ctx);
+	assert.match(ui.notices.at(-1)!, /animations: quality.*global file.*malformed/);
+	assert.equal(readFileSync(path, "utf8"), "broken");
+	rmSync(path);
+	mkdirSync(path);
+	await commands.get("gentle:animations")!.handler("potato", ctx);
+	assert.match(ui.notices.at(-1)!, /EISDIR|ENOTEMPTY|EPERM/);
+});
+
+test("animations with no argument opens a selectable menu and applies the chosen policy", async (t) => {
+	const configHome = scopedDoubleEscCancelConfigHome(t);
+	const path = join(configHome, "animations.json");
+	const { pi, commands } = fakePi();
+	gentleShell(pi, { GENTLE_PI_CONFIG_HOME: configHome });
+	// No editor/prompt is installed: the handler's `prompt?.setAnimationPolicy`
+	// optional chain must tolerate the interactive menu without one.
+	const chosen = fakeContext({
+		select: async (title, options) => {
+			assert.match(title, /Gentle animations/);
+			assert.deepEqual(options, ["quality", "performance", "potato", "status"]);
+			return "potato";
+		},
+	});
+	await commands.get("gentle:animations")!.handler("", chosen.ctx);
+	assert.equal(JSON.parse(readFileSync(path, "utf8")).policy, "potato");
+	assert.match(chosen.ui.notices.at(-1)!, /animations: potato/);
+
+	// A dismissed menu (undefined selection) reports nothing and writes nothing.
+	const dismissHome = scopedDoubleEscCancelConfigHome(t);
+	const { pi: dismissPi, commands: dismissCommands } = fakePi();
+	gentleShell(dismissPi, { GENTLE_PI_CONFIG_HOME: dismissHome });
+	const dismissed = fakeContext({ select: async () => undefined });
+	await dismissCommands.get("gentle:animations")!.handler("", dismissed.ctx);
+	assert.equal(dismissed.ui.notices.length, 0);
+	assert.equal(existsSync(join(dismissHome, "animations.json")), false);
+});
+
 test("prompt uses the compact banner cadence and releases its unref timer at settlement", (t) => {
+	const configHome = scopedDoubleEscCancelConfigHome(t);
+	writeFileSync(join(configHome, "animations.json"), '{"schema":"gentle-pi.animations/v1","policy":"quality"}');
 	const delays: number[] = [];
 	let active = 0;
 	let unrefs = 0;
@@ -486,7 +605,7 @@ test("prompt uses the compact banner cadence and releases its unref timer at set
 	});
 	t.mock.method(globalThis, "clearInterval", () => { active--; });
 	const { pi, handlers } = fakePi();
-	gentleShell(pi, {});
+	gentleShell(pi, { GENTLE_PI_CONFIG_HOME: configHome });
 	const { ctx, ui } = fakeContext();
 	const editor = installedPrompt(ctx, ui, handlers);
 	assert.equal(active, 0);
@@ -1594,6 +1713,240 @@ test("a provider switch refreshes the new provider inside the same window", asyn
 	assert.equal(calls[1].url, "https://cloud-api.nan.builders/api/usage/quota");
 });
 
+// A generic hook: any extension can register a usage source for its own
+// provider on `pi.events`, and gentle-shell dispatches to it exactly like it
+// dispatches to the built-in Codex/NaN fetchers, without knowing the
+// provider's name ahead of time.
+
+function acmeSource(onFetch: (apiKey: string | undefined) => void, plan = "Acme cloud"): unknown {
+	return {
+		schema: USAGE_SOURCE_SCHEMA,
+		provider: "acme-cloud",
+		fetch: async (apiKey: string | undefined) => {
+			onFetch(apiKey);
+			return {
+				provider: "acme-cloud",
+				plan,
+				limits: [{ name: "acme-cloud", windows: [{ label: "week", usedPercent: 40, windowSeconds: 604_800, resetAt: null }], limitReached: false }],
+				fetchedAt: 0,
+			};
+		},
+	};
+}
+
+test("gentleShell fetches usage through a source registered before session start", async () => {
+	const { pi, handlers } = fakePi();
+	const seen: Array<string | undefined> = [];
+	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { now: () => 1_788_600_000_000 });
+	pi.events.emit(USAGE_SOURCE_EVENT, acmeSource((apiKey) => seen.push(apiKey)));
+	const { ctx, ui } = fakeContext({ token: "acme-token" });
+	(ctx as unknown as { model: { provider: string } }).model.provider = "acme-cloud";
+	await fire(handlers, "session_start", ctx);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.deepEqual(seen, ["acme-token"], "the registered fetch gets the api key modelRegistry resolves for its provider");
+	assert.match(renderFooter(ui), /acme-cloud week ▰▰▰▱▱▱▱▱ 40%/);
+});
+
+test("gentleShell forces one refresh when a usage source registers after session start for the active provider", async () => {
+	const { pi, handlers } = fakePi();
+	let calls = 0;
+	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { now: () => 1_788_600_000_000 });
+	const { ctx, ui } = fakeContext({ token: "acme-token" });
+	(ctx as unknown as { model: { provider: string } }).model.provider = "acme-cloud";
+	await fire(handlers, "session_start", ctx);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.doesNotMatch(renderFooter(ui), /acme-cloud/, "no source registered yet, nothing to show");
+
+	pi.events.emit(USAGE_SOURCE_EVENT, acmeSource(() => { calls += 1; }));
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.equal(calls, 1, "late registration for the active provider triggers one forced refresh, not a wait for the next turn");
+	assert.match(renderFooter(ui), /acme-cloud week ▰▰▰▱▱▱▱▱ 40%/);
+});
+
+test("a usage source registered for a different provider does not force a refresh", async () => {
+	const { pi, handlers } = fakePi();
+	let calls = 0;
+	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { now: () => 1_788_600_000_000 });
+	const { ctx, ui } = fakeContext({ token: "acme-token" });
+	(ctx as unknown as { model: { provider: string } }).model.provider = "openai-codex";
+	await fire(handlers, "session_start", ctx);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+
+	pi.events.emit(USAGE_SOURCE_EVENT, acmeSource(() => { calls += 1; }));
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.equal(calls, 0, "the active provider is codex, so an acme-cloud registration fetches nothing yet");
+	assert.doesNotMatch(renderFooter(ui), /acme-cloud/);
+});
+
+test("gentleShell shows the unsupported note for a provider with no built-in or registered source", async () => {
+	const { pi, handlers, commands } = fakePi();
+	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { now: () => 1_788_600_000_000 });
+	const { ctx, ui } = fakeContext({ token: undefined });
+	(ctx as unknown as { model: { provider: string } }).model.provider = "acme-cloud";
+	await fire(handlers, "session_start", ctx);
+	const opened = commands.get("gentle:usage")!.handler("", ctx);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	const plain = ui.overlayView!.render(90).map(stripAnsi);
+	assert.match(plain[1], /✿ acme-cloud · no subscription usage for this provider/);
+	ui.closeOverlay?.();
+	await opened;
+});
+
+test("gentleShell ignores a malformed usage-source registration payload", async () => {
+	const { pi, handlers } = fakePi();
+	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { now: () => 1_788_600_000_000 });
+	pi.events.emit(USAGE_SOURCE_EVENT, { schema: "wrong-schema", provider: "acme-cloud", fetch: async () => undefined });
+	pi.events.emit(USAGE_SOURCE_EVENT, { schema: USAGE_SOURCE_SCHEMA, provider: "acme-cloud", fetch: "not-a-function" });
+	pi.events.emit(USAGE_SOURCE_EVENT, "not-an-object");
+	pi.events.emit(USAGE_SOURCE_EVENT, undefined);
+	const { ctx, ui } = fakeContext({ token: undefined });
+	(ctx as unknown as { model: { provider: string } }).model.provider = "acme-cloud";
+	await fire(handlers, "session_start", ctx);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.doesNotMatch(renderFooter(ui), /acme-cloud/, "no malformed payload registered a usable source");
+});
+
+// A registered source is foreign code running inside a fire-and-forget
+// refresh (`void refreshUsage(...)`, both at session_start and on a late
+// registration): if its fetch rejects and nothing catches it, the rejection
+// is unhandled and, under Node's default policy, takes the whole process
+// down. The doc promises a foreign source is "ignored rather than crashing
+// the shell", so a throw must degrade exactly like a built-in fetcher's.
+test("a registered source's rejecting fetch never crashes the shell or poisons the store", async () => {
+	const { pi, handlers, commands } = fakePi();
+	let calls = 0;
+	const rejectingSource = () => ({
+		schema: USAGE_SOURCE_SCHEMA,
+		provider: "acme-cloud",
+		fetch: async () => {
+			calls += 1;
+			throw new Error("acme is down");
+		},
+	});
+	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { now: () => 1_788_600_000_000 });
+	const { ctx, ui } = fakeContext({ token: "acme-token" });
+	(ctx as unknown as { model: { provider: string } }).model.provider = "acme-cloud";
+
+	const unhandled: unknown[] = [];
+	const onUnhandled = (reason: unknown) => unhandled.push(reason);
+	process.on("unhandledRejection", onUnhandled);
+	try {
+		// Registered before session start: session_start's own fire-and-forget
+		// refresh dispatches straight to the rejecting fetch.
+		pi.events.emit(USAGE_SOURCE_EVENT, rejectingSource());
+		await fire(handlers, "session_start", ctx);
+		await new Promise((resolve) => setTimeout(resolve, 0));
+		assert.equal(calls, 1);
+		assert.doesNotMatch(renderFooter(ui), /acme-cloud/, "a rejecting fetch must never be recorded as a snapshot");
+
+		// A second, late registration for the already-active provider dispatches
+		// through the USAGE_SOURCE_EVENT handler's own fire-and-forget refresh.
+		pi.events.emit(USAGE_SOURCE_EVENT, rejectingSource());
+		await new Promise((resolve) => setTimeout(resolve, 0));
+		assert.equal(calls, 2);
+		assert.doesNotMatch(renderFooter(ui), /acme-cloud/);
+	} finally {
+		process.off("unhandledRejection", onUnhandled);
+	}
+	assert.deepEqual(unhandled, [], "a foreign source's rejection must never surface as an unhandled rejection");
+
+	// The panel still explains itself with the pending note, never a crash,
+	// even through the awaited refresh openUsage runs on open.
+	const opened = commands.get("gentle:usage")!.handler("", ctx);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	const plain = ui.overlayView!.render(90).map(stripAnsi);
+	assert.match(plain[1], /✿ acme-cloud · no usage yet · r to fetch/);
+	ui.closeOverlay?.();
+	await opened;
+});
+
+// A registered source's resolved value is foreign code's own object: it must
+// be validated like any other parsed payload (never trusted to name the
+// provider it actually is, never trusted to be well-formed), and a source
+// that gets replaced mid-flight must never let its late, stale answer land
+// after the replacement already recorded its own.
+
+test("a registered source resolving usage for another provider is rejected without overwriting that provider's snapshot", async () => {
+	const { pi, handlers } = fakePi();
+	const { fetchFn } = fakeFetch(NAN_QUOTA_PAYLOAD);
+	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { fetch: fetchFn, now: () => 1_788_600_000_000 });
+	const { ctx, ui } = fakeContext({ token: "sk-nan-secret" });
+	(ctx as unknown as { model: { provider: string } }).model.provider = "nan";
+	await fire(handlers, "session_start", ctx);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.match(renderFooter(ui), /nan total ▰+▱+/, "the real nan snapshot recorded first");
+
+	(ctx as unknown as { model: { provider: string } }).model.provider = "acme-cloud";
+	pi.events.emit(USAGE_SOURCE_EVENT, {
+		schema: USAGE_SOURCE_SCHEMA,
+		provider: "acme-cloud",
+		fetch: async () => ({ provider: "nan", plan: undefined, limits: [], fetchedAt: 0 }),
+	});
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.doesNotMatch(renderFooter(ui), /acme-cloud/, "a resolution naming another provider must not surface as the active one");
+
+	(ctx as unknown as { model: { provider: string } }).model.provider = "nan";
+	assert.match(renderFooter(ui), /nan total ▰+▱+/, "the real nan snapshot must survive a mismatched acme-cloud resolution untouched");
+});
+
+test("gentleShell leaves the pending note when a registered source resolves a malformed usage", async () => {
+	const { pi, handlers, commands } = fakePi();
+	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { now: () => 1_788_600_000_000 });
+	pi.events.emit(USAGE_SOURCE_EVENT, {
+		schema: USAGE_SOURCE_SCHEMA,
+		provider: "acme-cloud",
+		fetch: async () => ({ provider: "acme-cloud", plan: "Acme", fetchedAt: 0, limits: "nope" }),
+	});
+	const { ctx, ui } = fakeContext({ token: "acme-token" });
+	(ctx as unknown as { model: { provider: string } }).model.provider = "acme-cloud";
+	await fire(handlers, "session_start", ctx);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.doesNotMatch(renderFooter(ui), /acme-cloud/, "a malformed result must never be recorded");
+
+	const opened = commands.get("gentle:usage")!.handler("", ctx);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	const plain = ui.overlayView!.render(90).map(stripAnsi);
+	assert.match(plain[1], /✿ acme-cloud · no usage yet · r to fetch/);
+	ui.closeOverlay?.();
+	await opened;
+});
+
+test("a slow fetch from a replaced source never records after its replacement resolves", async () => {
+	const { pi, handlers } = fakePi();
+	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { now: () => 1_788_600_000_000 });
+	const { ctx, ui } = fakeContext({ token: "acme-token" });
+	(ctx as unknown as { model: { provider: string } }).model.provider = "acme-cloud";
+
+	let resolveSlow!: (value: unknown) => void;
+	const slow = new Promise((resolve) => { resolveSlow = resolve; });
+	pi.events.emit(USAGE_SOURCE_EVENT, {
+		schema: USAGE_SOURCE_SCHEMA,
+		provider: "acme-cloud",
+		fetch: async () => {
+			await slow;
+			return { provider: "acme-cloud", plan: "Stale", fetchedAt: 0, limits: [{ name: "acme-cloud", limitReached: false, windows: [{ label: "week", usedPercent: 10, windowSeconds: 604_800, resetAt: null }] }] };
+		},
+	});
+	await fire(handlers, "session_start", ctx);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.doesNotMatch(renderFooter(ui), /acme-cloud/, "the slow fetch has not resolved yet");
+
+	// Replace the source before the slow fetch resolves; the late registration
+	// forces its own refresh, which resolves immediately.
+	pi.events.emit(USAGE_SOURCE_EVENT, {
+		schema: USAGE_SOURCE_SCHEMA,
+		provider: "acme-cloud",
+		fetch: async () => ({ provider: "acme-cloud", plan: "Fresh", fetchedAt: 0, limits: [{ name: "acme-cloud", limitReached: false, windows: [{ label: "week", usedPercent: 40, windowSeconds: 604_800, resetAt: null }] }] }),
+	});
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.match(renderFooter(ui), /acme-cloud week ▰▰▰▱▱▱▱▱ 40%/, "the replacement's own refresh recorded first");
+
+	// Now let the stale fetch resolve; it must never overwrite the fresh record.
+	resolveSlow(undefined);
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	assert.match(renderFooter(ui), /acme-cloud week ▰▰▰▱▱▱▱▱ 40%/, "the stale refresh must never record after being replaced");
+});
+
 test("gentleShell records SSE rate-limit headers from provider responses", async () => {
 	const { pi, handlers } = fakePi();
 	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { fetch: fakeFetch({}, false).fetchFn, now: () => 0 });

package/tests/inprocess-reviewer.test.ts

@@ -6,6 +6,7 @@ import {
 	INPROCESS_REVIEWER_FAILURE,
 	INPROCESS_REVIEWER_OUTPUT_MAX_BYTES,
 	runInProcessReviewer,
+	openCodeSessionAttributionHeaders,
 	type InProcessReviewerOutcome,
 	type InProcessReviewerRegistry,
 	type InProcessReviewerRequest,
@@ -345,6 +346,97 @@ test("omits reasoning for a non-reasoning model even with a valid label", async
 	assert.ok(!("reasoning" in (calls[0]!.options ?? {})));
 });
 
+// ---------------------------------------------------------------------------
+// OpenCode session attribution headers
+//
+// Pi adds OpenCode attribution headers inside the main agent loop
+// (provider-attribution.js#getSessionHeaders). This completion is an extension
+// side-call that bypasses that loop, so it must add the same headers itself:
+// provider opencode / opencode-go, or a baseUrl whose host is opencode.ai,
+// carrying the live session id — and nothing for any other provider.
+// ---------------------------------------------------------------------------
+
+const OPENCODE_ATTRIBUTION_TESTS: Array<{ readonly name: string; readonly model: Partial<Model<Api>>; readonly selection: string }> = [
+	{ name: "an opencode provider model", model: { provider: "opencode", id: "sonnet-4", baseUrl: "https://opencode.ai" }, selection: "opencode/sonnet-4" },
+	{ name: "an opencode-go provider model", model: { provider: "opencode-go", id: "gpt-5", baseUrl: "https://opencode.ai" }, selection: "opencode-go/gpt-5" },
+	{ name: "a custom provider whose baseUrl host is opencode.ai", model: { provider: "custom", id: "relay-model", baseUrl: "https://opencode.ai/v1" }, selection: "custom/relay-model" },
+];
+
+for (const { name, model, selection } of OPENCODE_ATTRIBUTION_TESTS) {
+	test(`${name} receives both attribution headers carrying the live session id`, async () => {
+		const { complete, calls } = capturingComplete(assistantText("ok"));
+		const outcome = await runInProcessReviewer(baseRequest({ selection, sessionId: "ses-live-1" }), {
+			registry: fakeRegistry([fakeModel(model)]),
+			complete,
+		});
+		expectText(outcome);
+		assert.equal(calls.length, 1);
+		assert.equal(calls[0]!.options?.headers?.["x-opencode-session"], "ses-live-1");
+		assert.equal(calls[0]!.options?.headers?.["x-opencode-client"], "pi");
+	});
+}
+
+for (const { name, model, selection } of OPENCODE_ATTRIBUTION_TESTS) {
+	test(`${name} without a session id adds no attribution header and still completes`, async () => {
+		const { complete, calls } = capturingComplete(assistantText("ok"));
+		const outcome = await runInProcessReviewer(baseRequest({ selection }), {
+			registry: fakeRegistry([fakeModel(model)]),
+			complete,
+		});
+		expectText(outcome);
+		assert.equal(calls.length, 1);
+		assert.ok(!("headers" in (calls[0]!.options ?? {})), "a missing session id must never invent a header");
+	});
+}
+
+test("a non-OpenCode model adds no attribution headers and leaves the options unchanged", async () => {
+	const { complete, calls } = capturingComplete(assistantText("ok"));
+	const outcome = await runInProcessReviewer(baseRequest({ selection: "anthropic/claude-sonnet-4", sessionId: "ses-live-1" }), {
+		registry: fakeRegistry([fakeModel({ provider: "anthropic", id: "claude-sonnet-4", baseUrl: "https://api.anthropic.com" })]),
+		complete,
+	});
+	expectText(outcome);
+	assert.equal(calls.length, 1);
+	assert.ok(!("headers" in (calls[0]!.options ?? {})));
+});
+
+test("registry auth headers win over the attribution defaults and both survive the merge", async () => {
+	const { complete, calls } = capturingComplete(assistantText("ok"));
+	const outcome = await runInProcessReviewer(baseRequest({ selection: "opencode/sonnet-4", sessionId: "ses-live-1" }), {
+		registry: fakeRegistry([fakeModel({ provider: "opencode", id: "sonnet-4" })], async () => ({
+			ok: true,
+			headers: { "x-api-key": "registry-key", "x-opencode-session": "registry-session" },
+		})),
+		complete,
+	});
+	expectText(outcome);
+	const headers = calls[0]!.options?.headers;
+	assert.equal(headers?.["x-api-key"], "registry-key", "registry auth headers must survive");
+	assert.equal(headers?.["x-opencode-session"], "registry-session", "explicit registry headers must not be clobbered by the attribution default");
+	assert.equal(headers?.["x-opencode-client"], "pi");
+});
+
+test("an unparseable baseUrl never throws: attribution follows the provider condition only", async () => {
+	const { complete, calls } = capturingComplete(assistantText("ok"));
+	const outcome = await runInProcessReviewer(baseRequest({ selection: "custom/relay-model", sessionId: "ses-live-1" }), {
+		registry: fakeRegistry([fakeModel({ provider: "custom", id: "relay-model", baseUrl: "not-a-url" })]),
+		complete,
+	});
+	expectText(outcome);
+	assert.ok(!("headers" in (calls[0]!.options ?? {})));
+});
+
+test("openCodeSessionAttributionHeaders mirrors pi's condition exactly", () => {
+	const opencode = fakeModel({ provider: "opencode", baseUrl: "https://example.com" });
+	assert.deepEqual(openCodeSessionAttributionHeaders(opencode, "ses-1"), { "x-opencode-session": "ses-1", "x-opencode-client": "pi" });
+	assert.deepEqual(openCodeSessionAttributionHeaders(fakeModel({ provider: "opencode-go" }), "ses-1"), { "x-opencode-session": "ses-1", "x-opencode-client": "pi" });
+	assert.deepEqual(openCodeSessionAttributionHeaders(fakeModel({ provider: "custom", baseUrl: "https://opencode.ai/v1" }), "ses-1"), { "x-opencode-session": "ses-1", "x-opencode-client": "pi" });
+	assert.equal(openCodeSessionAttributionHeaders(fakeModel({ provider: "custom", baseUrl: "https://api.opencode.ai" }), "ses-1"), undefined, "a subdomain host is not opencode.ai");
+	assert.equal(openCodeSessionAttributionHeaders(fakeModel(), "ses-1"), undefined);
+	assert.equal(openCodeSessionAttributionHeaders(opencode, undefined), undefined, "no session id, no header");
+	assert.equal(openCodeSessionAttributionHeaders(opencode, ""), undefined, "an empty session id is no session id");
+});
+
 // ---------------------------------------------------------------------------
 // Text concatenation ignoring thinking parts
 // ---------------------------------------------------------------------------

package/tests/install-tui-mode-guard.test.ts

@@ -0,0 +1,99 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+
+// isPiManagedInstall gates the POSTINSTALL entry point only (scripts/install-gentle-ai.mjs):
+// it decides whether the running gentle-pi package sits under a directory
+// pattern Pi's own package manager creates (npm-backed or git-backed), so an
+// `npm install -g gentle-pi`, a plain development git checkout, or an npx
+// cache directory never writes to the user's global Pi settings. It is
+// deliberately unrelated to installTuiModeSetting's own ownership check
+// (which compares the package location against one specific resolved agent
+// home) and to installIsolatedTuiModeSetting (gentle-shell's own bootstrap of
+// a directory it just created), covered in the other two test files.
+
+const helperUrl = new URL("../scripts/install-tui-mode-setting.mjs", import.meta.url);
+const { isPiManagedInstall } = await import(helperUrl.href);
+
+test("isPiManagedInstall recognizes the user-scope npm-managed layout", () => {
+	assert.equal(isPiManagedInstall(join("/home/alan", ".pi", "agent", "npm", "node_modules", "gentle-pi")), true);
+});
+
+test("isPiManagedInstall recognizes the project-scope npm-managed layout", () => {
+	assert.equal(isPiManagedInstall(join("/repo", ".pi", "npm", "node_modules", "gentle-pi")), true);
+});
+
+test("isPiManagedInstall recognizes Pi's git-managed layout", () => {
+	assert.equal(isPiManagedInstall(join("/home/alan", ".pi", "agent", "git", "github.com", "Gentleman-Programming", "gentle-pi")), true);
+});
+
+test("isPiManagedInstall rejects a global npm -g install", () => {
+	assert.equal(isPiManagedInstall("/usr/local/lib/node_modules/gentle-pi"), false);
+});
+
+test("isPiManagedInstall rejects a plain development git checkout", () => {
+	assert.equal(isPiManagedInstall("/Users/alan/work/gentle-pi"), false);
+});
+
+test("isPiManagedInstall rejects an npx cache directory", () => {
+	assert.equal(isPiManagedInstall(join("/home/alan", ".npm", "_npx", "abc123", "node_modules", "gentle-pi")), false);
+});
+
+test("isPiManagedInstall rejects a pnpm content-addressable store", () => {
+	assert.equal(isPiManagedInstall(join("/home/alan", ".pnpm", "gentle-pi@1.0.0", "node_modules", "gentle-pi")), false);
+});
+
+test("isPiManagedInstall resolves a relative path before checking", () => {
+	const cwd = process.cwd();
+	try {
+		process.chdir(join("/tmp"));
+		assert.equal(isPiManagedInstall(join(".", "npm", "node_modules", "gentle-pi")), true);
+	} finally {
+		process.chdir(cwd);
+	}
+});
+
+// --- postinstall entry integration --------------------------------------------
+
+function fixture(t: test.TestContext, packageSegments: readonly string[]) {
+	const root = mkdtempSync(join(tmpdir(), "gentle-pi-guard-"));
+	t.after(() => rmSync(root, { recursive: true, force: true }));
+	const home = join(root, "agent");
+	const packageRoot = join(home, ...packageSegments);
+	const scripts = join(packageRoot, "scripts");
+	mkdirSync(scripts, { recursive: true });
+	copyFileSync(helperUrl, join(scripts, "install-tui-mode-setting.mjs"));
+	copyFileSync(new URL("../scripts/install-gentle-ai.mjs", import.meta.url), join(scripts, "install-gentle-ai.mjs"));
+	writeFileSync(
+		join(scripts, "gentle-ai-installer.mjs"),
+		'export const INSTALLER_VERSION = "test"; export async function installGentleAi() { return { installed: true, binaryPath: "fixture" }; }',
+	);
+	const settings = join(home, "settings.json");
+	const env = { ...process.env, GENTLE_PI_AGENT_HOME: home, GENTLE_PI_SKIP_GENTLE_AI_INSTALL: "0" };
+	return { root, home, packageRoot, scripts, settings, env };
+}
+
+test("postinstall skips the global settings write outside a pi-managed install", (t) => {
+	const f = fixture(t, ["node_modules", "gentle-pi"]);
+	const result = spawnSync(process.execPath, [join(f.scripts, "install-gentle-ai.mjs")], { encoding: "utf8", env: f.env });
+	assert.equal(result.status, 0, result.stderr);
+	assert.match(`${result.stdout}${result.stderr}`, /skip/i);
+	assert.equal(existsSync(f.settings), false);
+});
+
+test("postinstall still writes fullscreen for a pi-managed npm install", (t) => {
+	const f = fixture(t, ["npm", "node_modules", "gentle-pi"]);
+	const result = spawnSync(process.execPath, [join(f.scripts, "install-gentle-ai.mjs")], { encoding: "utf8", env: f.env });
+	assert.equal(result.status, 0, result.stderr);
+	assert.equal(JSON.parse(readFileSync(f.settings, "utf8")).tuiMode, "fullscreen");
+});
+
+test("postinstall still writes fullscreen for a pi-managed git install", (t) => {
+	const f = fixture(t, ["git", "github.com", "Gentleman-Programming", "gentle-pi"]);
+	const result = spawnSync(process.execPath, [join(f.scripts, "install-gentle-ai.mjs")], { encoding: "utf8", env: f.env });
+	assert.equal(result.status, 0, result.stderr);
+	assert.equal(JSON.parse(readFileSync(f.settings, "utf8")).tuiMode, "fullscreen");
+});

package/tests/install-tui-mode-setting.test.ts

@@ -7,7 +7,7 @@ import { join } from "node:path";
 import { test } from "node:test";
 
 const helperUrl = new URL("../scripts/install-tui-mode-setting.mjs", import.meta.url);
-const { installTuiModeSetting } = await import(helperUrl.href);
+const { installTuiModeSetting, installIsolatedTuiModeSetting } = await import(helperUrl.href);
 
 function fixture(t: { after(fn: () => void): void }, packagePath: readonly string[] = ["npm", "node_modules", "gentle-pi"]) {
 	const root = mkdtempSync(join(tmpdir(), "gentle-tui-test-"));
@@ -269,6 +269,44 @@ for (const fault of ["write", "rename", "concurrent-change"]) {
 	});
 }
 
+// --- installIsolatedTuiModeSetting -------------------------------------------
+// gentle-shell's own isolated-home bootstrap (T2): unlike installTuiModeSetting,
+// there is no "physically installed under this home's npm/node_modules"
+// ownership check to satisfy, because gentle-shell just created `dir` itself
+// moments ago; a plain agent-home-shaped temp directory is enough.
+
+test("installIsolatedTuiModeSetting writes fullscreen into a freshly created directory", async (t) => {
+	const root = mkdtempSync(join(tmpdir(), "gentle-shell-isolated-"));
+	t.after(() => rmSync(root, { recursive: true, force: true }));
+	const dir = join(root, "gentle-shell", "agent");
+	mkdirSync(dir, { recursive: true });
+	assert.deepEqual(await installIsolatedTuiModeSetting(dir), { changed: true, recognized: true });
+	assert.deepEqual(JSON.parse(readFileSync(join(dir, "settings.json"), "utf8")), { tuiMode: "fullscreen" });
+});
+
+test("installIsolatedTuiModeSetting preserves other settings fields already present", async (t) => {
+	const root = mkdtempSync(join(tmpdir(), "gentle-shell-isolated-"));
+	t.after(() => rmSync(root, { recursive: true, force: true }));
+	writeFileSync(join(root, "settings.json"), JSON.stringify({ tuiMode: "regular", theme: "rose" }));
+	assert.deepEqual(await installIsolatedTuiModeSetting(root), { changed: true, recognized: true });
+	assert.deepEqual(JSON.parse(readFileSync(join(root, "settings.json"), "utf8")), { tuiMode: "fullscreen", theme: "rose" });
+});
+
+test("installIsolatedTuiModeSetting is a no-op when already fullscreen", async (t) => {
+	const root = mkdtempSync(join(tmpdir(), "gentle-shell-isolated-"));
+	t.after(() => rmSync(root, { recursive: true, force: true }));
+	writeFileSync(join(root, "settings.json"), JSON.stringify({ tuiMode: "fullscreen" }));
+	const before = lstatSync(join(root, "settings.json"));
+	assert.deepEqual(await installIsolatedTuiModeSetting(root), { changed: false, recognized: true });
+	assert.equal(lstatSync(join(root, "settings.json")).ino, before.ino);
+});
+
+test("installIsolatedTuiModeSetting rejects a missing directory", async (t) => {
+	const root = mkdtempSync(join(tmpdir(), "gentle-shell-isolated-"));
+	t.after(() => rmSync(root, { recursive: true, force: true }));
+	await assert.rejects(installIsolatedTuiModeSetting(join(root, "absent")));
+});
+
 type PostinstallRoute = "skip" | "success" | "failure";
 
 function writePostinstallFixture(f: ReturnType<typeof fixture>, route: PostinstallRoute) {