gentle-pi 3.7.0 → 4.0.0

package/tests/history-header-layout.test.ts

@@ -0,0 +1,265 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import promptHistoryExtension from "../extensions/history/index.ts";
+import {
+  planHeaderLayout,
+  SCOPE_RADIO_COMPACT_GLOBAL,
+  SCOPE_RADIO_COMPACT_PROJECT,
+  SCOPE_RADIO_FULL_GLOBAL,
+  SCOPE_RADIO_FULL_PROJECT,
+  scopeRadioText,
+} from "../extensions/history/selector-helpers.ts";
+import { projectHash } from "../extensions/history/store.ts";
+
+// Responsive selector header (restored from Carolina's #1394 work,
+// e2cca1f9b^): the header is fit-driven — inline, stacked (tablet), or
+// compact (mobile) — while the overlay stays exactly 30 rows.
+
+const LEFT =
+  " History Search ".length +
+  " · 1 of 10 ".length +
+  " · loaded 10 of 27 ".length;
+const RADIO = SCOPE_RADIO_FULL_PROJECT.length;
+const GAP = 4;
+
+test("inline while counts plus radio plus minimum gap fit the width", () => {
+  assert.equal(
+    planHeaderLayout(LEFT + GAP + RADIO, LEFT, RADIO, GAP),
+    "inline",
+  );
+  assert.equal(planHeaderLayout(200, LEFT, RADIO, GAP), "inline");
+});
+
+test("stacked (tablet) once the spacer would drop below the minimum gap", () => {
+  assert.equal(
+    planHeaderLayout(LEFT + GAP + RADIO - 1, LEFT, RADIO, GAP),
+    "stacked",
+  );
+  assert.equal(planHeaderLayout(LEFT, LEFT, RADIO, GAP), "stacked");
+});
+
+test("compact (mobile) when even the counts line no longer fits", () => {
+  assert.equal(planHeaderLayout(LEFT - 1, LEFT, RADIO, GAP), "compact");
+  assert.equal(planHeaderLayout(30, LEFT, RADIO, GAP), "compact");
+});
+
+test("radio pins the user-directed labels", () => {
+  assert.equal(SCOPE_RADIO_FULL_PROJECT, "◉ Current project | ○ All projects");
+  assert.equal(SCOPE_RADIO_FULL_GLOBAL, "○ Current project | ◉ All projects");
+  assert.equal(SCOPE_RADIO_COMPACT_PROJECT, "◉ Current project | ○ All");
+  assert.equal(SCOPE_RADIO_COMPACT_GLOBAL, "○ Current | ◉ All projects");
+});
+
+test("scopeRadioText abbreviates only in compact mode", () => {
+  assert.equal(scopeRadioText("project", false), SCOPE_RADIO_FULL_PROJECT);
+  assert.equal(scopeRadioText("global", false), SCOPE_RADIO_FULL_GLOBAL);
+  assert.equal(scopeRadioText("project", true), SCOPE_RADIO_COMPACT_PROJECT);
+  assert.equal(scopeRadioText("global", true), SCOPE_RADIO_COMPACT_GLOBAL);
+});
+
+// ---------------------------------------------------------------------------
+// Rendered selector: the real overlay component driven through the history
+// command with a fake overlay host. Fixtures live under os.tmpdir().
+// ---------------------------------------------------------------------------
+
+const CWD = "/pi-history-fixtures/project-header-layout";
+const ENTER = "\r";
+// 15 prompts, oldest p00 .. newest p14: the header reads
+// " History Search  · 1 of 10  · loaded 10 of 15 ".
+const PROMPT_COUNT = 15;
+const RENDERED_LEFT =
+  " History Search ".length +
+  " · 1 of 10 ".length +
+  " · loaded 10 of 15 ".length;
+const INLINE_WIDTH = RENDERED_LEFT + GAP + RADIO;
+const STACKED_WIDTH = INLINE_WIDTH - 1;
+const COMPACT_WIDTH = RENDERED_LEFT - 1;
+const HINT = "Type to filter (multi-word AND substring, case-insensitive)";
+
+interface Selector {
+  handleInput(data: string): void;
+  handleMouse(event: unknown): unknown;
+  render(width: number): string[];
+}
+
+function makeRoot(): string {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "pi-history-header-"));
+  const dir = path.join(root, "projects", projectHash(CWD));
+  fs.mkdirSync(dir, { recursive: true });
+  const lines = Array.from({ length: PROMPT_COUNT }, (_, i) =>
+    JSON.stringify({
+      v: 1,
+      text: `p${String(i).padStart(2, "0")}`,
+      ts: 1_700_000_000_000 + i,
+    }),
+  );
+  fs.writeFileSync(path.join(dir, "store.jsonl"), `${lines.join("\n")}\n`);
+  return root;
+}
+
+/**
+ * Open the selector through the history command, run `drive` against the
+ * mounted component, press Enter, and return the pasted prompt.
+ */
+async function withSelector(
+  drive: (selector: Selector) => void,
+): Promise<string | null> {
+  const root = makeRoot();
+  const commands: Array<[string, { handler: unknown }]> = [];
+  promptHistoryExtension(
+    {
+      on: () => {},
+      registerShortcut: () => {},
+      registerCommand: (name: string, def: { handler: unknown }) => {
+        commands.push([name, def]);
+      },
+    } as never,
+    {
+      env: { GENTLE_PI_HISTORY_CAPTURE: "1" },
+      gentlePiConfigHome: fs.mkdtempSync(
+        path.join(os.tmpdir(), "pi-history-header-config-"),
+      ),
+      root,
+      cwd: CWD,
+      instanceId: "inst-header",
+      agentDir: path.join(root, "agent"),
+      sessionsRoot: path.join(root, "sessions"),
+    },
+  );
+  const command = commands.find(([name]) => name === "history");
+  assert.ok(command, "the history command must be registered");
+  const handler = command[1].handler as (
+    args: unknown,
+    ctx: unknown,
+  ) => Promise<void>;
+
+  let pasted: string | null = null;
+  const plain = (_color: string, text: string) => text;
+  const ctx = {
+    ui: {
+      notify: (message: string) => {
+        assert.fail(`unexpected notification: ${message}`);
+      },
+      pasteToEditor: (text: string) => {
+        pasted = text;
+      },
+      custom: (
+        factory: (
+          tui: unknown,
+          theme: unknown,
+          keybindings: unknown,
+          done: (result: unknown) => void,
+        ) => Selector,
+      ) =>
+        new Promise((resolve) => {
+          const selector = factory(
+            { requestRender: () => {} },
+            { fg: plain, bg: plain, bold: (text: string) => text },
+            undefined,
+            resolve,
+          );
+          drive(selector);
+          selector.handleInput(ENTER);
+          resolve(null);
+        }),
+    },
+  };
+  await handler([], ctx);
+  await new Promise((resolve) => setTimeout(resolve, 0));
+  return pasted;
+}
+
+async function renderAt(width: number): Promise<string[]> {
+  let lines: string[] = [];
+  await withSelector((selector) => {
+    lines = selector.render(width);
+  });
+  return lines;
+}
+
+function wheelAt(y: number, width: number): Promise<string | null> {
+  return withSelector((selector) => {
+    selector.render(width);
+    selector.handleMouse({
+      type: "wheel",
+      wheelDelta: 1,
+      x: 1,
+      y,
+      screenX: 1,
+      screenY: y,
+      width,
+      height: 30,
+    });
+  });
+}
+
+test("inline: title, counts and a right-flushed radio share one row above the hint", async () => {
+  const lines = await renderAt(INLINE_WIDTH);
+  assert.equal(lines.length, 30, "the overlay stays exactly 30 rows");
+  assert.ok(lines[1]!.startsWith(" History Search  · 1 of 10  · loaded 10 of 15 "));
+  assert.ok(
+    lines[1]!.endsWith(SCOPE_RADIO_FULL_PROJECT),
+    "the radio ends flush at the header's last column",
+  );
+  assert.equal(lines[2]!.trimEnd(), HINT);
+  assert.ok(lines[5]!.startsWith("→ p14"), "the list starts at row 5");
+});
+
+test("stacked (tablet): the radio wraps under the counts and the hint row is reclaimed", async () => {
+  const lines = await renderAt(STACKED_WIDTH);
+  assert.equal(lines.length, 30, "the overlay stays exactly 30 rows");
+  assert.equal(
+    lines[1]!.trimEnd(),
+    " History Search  · 1 of 10  · loaded 10 of 15",
+  );
+  assert.equal(lines[2]!.trimEnd(), ` ${SCOPE_RADIO_FULL_PROJECT}`);
+  assert.ok(
+    !lines.some((line) => line.includes(HINT)),
+    "the hint row gives its row to the radio",
+  );
+  assert.ok(lines[5]!.startsWith("→ p14"), "the list keeps rows 5-14");
+});
+
+test("compact (mobile): counts split across three rows and the list gives up one row", async () => {
+  const lines = await renderAt(COMPACT_WIDTH);
+  assert.equal(lines.length, 30, "the overlay stays exactly 30 rows");
+  assert.equal(lines[1]!.trimEnd(), " History Search  · 1 of 10");
+  assert.equal(lines[2]!.trimEnd(), " loaded 10 of 15");
+  assert.equal(lines[3]!.trimEnd(), ` ${SCOPE_RADIO_FULL_PROJECT}`);
+  assert.ok(lines[6]!.startsWith("→ p14"), "the list starts one row lower");
+  assert.ok(
+    lines[14]!.startsWith("  p06"),
+    "compact paints nine list rows (p14..p06)",
+  );
+  assert.ok(lines[16]!.includes("Preview"), "the preview block keeps its rows");
+});
+
+test("compact abbreviates the radio only when the full radio cannot fit", async () => {
+  const lines = await renderAt(RADIO - 1);
+  assert.equal(lines.length, 30, "the overlay stays exactly 30 rows");
+  assert.equal(lines[3]!.trimEnd(), ` ${SCOPE_RADIO_COMPACT_PROJECT}`);
+});
+
+test("the full radio shows exactly when its row, leading space included, fits", async () => {
+  // Stacked and compact rows print the radio after one leading space, so
+  // the full radio needs RADIO + 1 columns (review advisory A5).
+  const fits = await renderAt(RADIO + 1);
+  assert.equal(fits[3], ` ${SCOPE_RADIO_FULL_PROJECT}`);
+  const tight = await renderAt(RADIO);
+  assert.equal(tight[3]!.trimEnd(), ` ${SCOPE_RADIO_COMPACT_PROJECT}`);
+  assert.ok(
+    tight.slice(1, 4).every((line) => !line.includes("…")),
+    "no header row is truncated at the boundary width",
+  );
+});
+
+test("the list wheel band follows the header mode", async () => {
+  // Inline: row 5 is the first list row — wheel down selects p13.
+  assert.equal(await wheelAt(5, INLINE_WIDTH), "p13");
+  // Compact: row 5 is the search border — a consumed no-op.
+  assert.equal(await wheelAt(5, COMPACT_WIDTH), "p14");
+  assert.equal(await wheelAt(6, COMPACT_WIDTH), "p13");
+});

package/tests/history-hide-prompts.test.ts

@@ -0,0 +1,275 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {
+  hidePrompt,
+  readHiddenPrompts,
+  tombstoneKey,
+} from "../extensions/history/hide-prompts.ts";
+
+// Unit WU4 — tombstone write half + read half (spec C4, design §D6; slice-05
+// D5 recency cap). fs-only coverage. The READ half FAILS CLOSED for history:
+// a file that exists but cannot be trusted (unreadable, corrupt, wrong
+// shape) reads `untrusted` with a recovery warning instead of an empty
+// tombstone set, and the WRITE half refuses without a silent rewrite. The
+// WRITE half persists keys in RECENCY order (oldest first, newest last,
+// never sorted) capped at HIDE_FILE_MAX_ENTRIES (1000, oldest dropped).
+// The dev suite's deleteCurrent source-parse pins (T27/T28) and the
+// deletionActionsFor planner pins cover the slice-3 selector branch and
+// the slice-5 delete flow; they port with those slices.
+
+function makeStateDir(name: string): string {
+  return fs.mkdtempSync(path.join(os.tmpdir(), `hide-prompts-${name}-`));
+}
+
+function readHideFile(stateDir: string) {
+  return JSON.parse(
+    fs.readFileSync(path.join(stateDir, "hidden.json"), "utf8"),
+  );
+}
+
+/** Assert an untrusted read of the expected reason; returns its message. */
+function assertUntrusted(
+  stateDir: string,
+  reason: "unreadable" | "corrupt" | "malformed",
+): string {
+  const read = readHiddenPrompts(stateDir);
+  assert.equal(read.status, "untrusted");
+  if (read.status !== "untrusted") throw new Error("unreachable");
+  assert.equal(read.reason, reason);
+  // The recovery warning names the file and offers restore-or-delete.
+  assert.ok(read.message.includes("hidden.json"));
+  assert.ok(/restore|delete/.test(read.message));
+  return read.message;
+}
+
+/** Assert a trusted read and return its key set. */
+function trustedKeys(stateDir: string): Set<string> {
+  const read = readHiddenPrompts(stateDir);
+  assert.equal(read.status, "trusted");
+  if (read.status !== "trusted") throw new Error("unreachable");
+  return read.keys;
+}
+
+// T24 — AC-S4-1: hide-key fidelity. Tombstone keys must byte-match the
+// shared tombstoneKey helper for the same text — never a re-implementation:
+// the stored file content is compared against tombstoneKey's own output
+// with strict equality.
+test("T24 (AC-S4-1): hide keys byte-match tombstoneKey across whitespace, case, and >120-char groups", () => {
+  const stateDir = makeStateDir("t24");
+  // Three normalization groups: internal whitespace runs (space + tab),
+  // letter case, and a text longer than the 120-char key prefix.
+  const texts = [
+    "fix\t the   build",
+    "Deploy THE api",
+    `${"pad ".repeat(40)}tail beyond one hundred twenty chars`,
+  ];
+  for (const text of texts) {
+    assert.deepEqual(hidePrompt(stateDir, text), { status: "written" });
+  }
+  const stored = readHideFile(stateDir);
+  assert.ok(Array.isArray(stored), "hidden.json must hold a JSON array");
+  // Byte-match: the file holds EXACTLY the shared helper's output, in
+  // insertion (recency) order — the write half never sorts.
+  assert.deepEqual(stored, texts.map((text) => tombstoneKey(text)));
+  // The read half agrees.
+  const keys = trustedKeys(stateDir);
+  assert.equal(keys.size, stored.length);
+  for (const key of stored) {
+    assert.ok(keys.has(key));
+  }
+});
+
+// T25 — AC-S4-2: hide persistence and tolerance. Two deletes of the same
+// text compact to ONE key; a MISSING hide file (before any deletion) is the
+// safe empty case — trusted with no keys; reads never throw.
+test("T25 (AC-S4-2): duplicate hides compact to one key; a missing file reads trusted-empty; reads never throw", () => {
+  const stateDir = makeStateDir("t25");
+  // Missing file: trusted empty tombstones (before any write exists).
+  assert.equal(trustedKeys(stateDir).size, 0);
+  // Two deletes of the same text — variants differing by case + whitespace
+  // runs normalize onto the same key.
+  assert.deepEqual(hidePrompt(stateDir, "Same   Text"), { status: "written" });
+  assert.deepEqual(hidePrompt(stateDir, "same text"), { status: "written" });
+  const stored = readHideFile(stateDir);
+  assert.deepEqual(stored, [tombstoneKey("same text")]);
+  const keys = trustedKeys(stateDir);
+  assert.equal(keys.size, 1);
+  assert.ok(keys.has(tombstoneKey("same text")));
+});
+
+// D5 — recency order: re-hiding an existing key REFRESHES it to the end
+// (newest); the file array is oldest-first, newest-appended-last — the
+// write half never sorts.
+test("re-hiding an existing key refreshes it to the end (recency order, no sort)", () => {
+  const stateDir = makeStateDir("recency");
+  const keysOf = (texts: string[]) => texts.map((text) => tombstoneKey(text));
+  for (const text of ["alpha prompt", "beta prompt", "gamma prompt"]) {
+    assert.deepEqual(hidePrompt(stateDir, text), { status: "written" });
+  }
+  assert.deepEqual(readHideFile(stateDir), keysOf([
+    "alpha prompt",
+    "beta prompt",
+    "gamma prompt",
+  ]));
+  // Re-hide the oldest key: it moves to the END; the others keep order.
+  assert.deepEqual(hidePrompt(stateDir, "alpha prompt"), {
+    status: "written",
+  });
+  assert.deepEqual(readHideFile(stateDir), keysOf([
+    "beta prompt",
+    "gamma prompt",
+    "alpha prompt",
+  ]));
+  assert.equal(trustedKeys(stateDir).size, 3);
+});
+
+// D5 — cap: hidden.json keeps at most 1000 keys in recency order; the
+// 1001st distinct prompt drops the OLDEST key from the front. The file is
+// a rebuildable cache, not a retention guarantee — a dropped prompt may
+// reappear and be deleted again.
+test("the 1001st distinct prompt drops the oldest key — the file keeps exactly 1000", () => {
+  const stateDir = makeStateDir("cap");
+  const oldest = "oldest prompt";
+  assert.deepEqual(hidePrompt(stateDir, oldest), { status: "written" });
+  for (let i = 1; i <= 999; i++) {
+    assert.deepEqual(hidePrompt(stateDir, `prompt number ${i}`), {
+      status: "written",
+    });
+  }
+  // Exactly at the cap: 1000 keys, oldest first, newest last.
+  const atCap = readHideFile(stateDir);
+  assert.equal(atCap.length, 1000);
+  assert.equal(atCap[0], tombstoneKey(oldest));
+  assert.equal(atCap[atCap.length - 1], tombstoneKey("prompt number 999"));
+  // The 1001st distinct prompt: the front (oldest) drops, the newest lands.
+  assert.deepEqual(hidePrompt(stateDir, "prompt number 1000"), {
+    status: "written",
+  });
+  const after = readHideFile(stateDir);
+  assert.equal(after.length, 1000, "the cap holds the file at exactly 1000");
+  assert.equal(
+    after.includes(tombstoneKey(oldest)),
+    false,
+    "the oldest key must be dropped from the front",
+  );
+  assert.equal(
+    after[after.length - 1],
+    tombstoneKey("prompt number 1000"),
+    "the newest key must sit at the end",
+  );
+  // The read half agrees with the capped file.
+  assert.equal(trustedKeys(stateDir).size, 1000);
+});
+
+// T26 — AC-S4-5: corrupt hidden.json FAILS CLOSED for history reads. The
+// READ half reports untrusted (corrupt) so callers block history instead of
+// resurfacing hidden prompts; the WRITE half refuses WITHOUT a silent clean
+// rewrite (the old fail-open behavior cleared the blocked state one hide
+// later). Recovery is manual — restore or delete the file; after deletion
+// the next hide succeeds and reads are trusted again.
+test("T26 (AC-S4-5): corrupt hidden.json reads untrusted; hide refuses without rewriting; deleting the file recovers", () => {
+  const stateDir = makeStateDir("t26");
+  const hidePath = path.join(stateDir, "hidden.json");
+  fs.writeFileSync(hidePath, "{corrupt bytes", "utf8");
+  // READ half: untrusted/corrupt — never an empty trusted set.
+  const message = assertUntrusted(stateDir, "corrupt");
+  // WRITE half: refused, and the corrupt bytes are UNCHANGED — the blocked
+  // state is never silently reset (no-silent-rewrite pin).
+  const before = fs.readFileSync(hidePath, "utf8");
+  assert.deepEqual(hidePrompt(stateDir, "beta prompt"), {
+    status: "error",
+    message,
+  });
+  assert.equal(fs.readFileSync(hidePath, "utf8"), before);
+  // Manual recovery: delete the file; the next hide succeeds and reads are
+  // trusted with exactly the new key.
+  fs.unlinkSync(hidePath);
+  assert.deepEqual(hidePrompt(stateDir, "beta prompt"), { status: "written" });
+  const keys = trustedKeys(stateDir);
+  assert.equal(keys.size, 1);
+  assert.ok(keys.has(tombstoneKey("beta prompt")));
+});
+
+// Wrong-shaped file: valid JSON that is not an array fails closed too (both
+// halves), while junk items inside a VALID array are ignored and the real
+// keys stay trusted.
+test("malformed hidden.json fails closed for reads and writes; junk items in a valid array are ignored", () => {
+  const malformed = makeStateDir("malformed");
+  const hidePath = path.join(malformed, "hidden.json");
+  for (const shape of ["{}", JSON.stringify({ keys: [] })]) {
+    fs.writeFileSync(hidePath, shape, "utf8");
+    assertUntrusted(malformed, "malformed");
+  }
+  // The write half refuses the malformed file as well.
+  const message = assertUntrusted(malformed, "malformed");
+  assert.deepEqual(hidePrompt(malformed, "kept prompt"), {
+    status: "error",
+    message,
+  });
+
+  // Junk items are ignored, never trusted; real keys survive.
+  const junk = makeStateDir("junk");
+  fs.writeFileSync(
+    path.join(junk, "hidden.json"),
+    JSON.stringify([42, "", "real-key", null]),
+    "utf8",
+  );
+  const keys = trustedKeys(junk);
+  assert.equal(keys.size, 1);
+  assert.ok(keys.has("real-key"));
+});
+
+// Unreadable file: a hidden.json that cannot be read at all fails closed
+// for reads, and the write half refuses too. Skipped as root, where chmod
+// 000 does not block reads; permissions are restored in finally.
+test(
+  "an unreadable hidden.json fails closed for reads and refuses writes",
+  { skip: process.getuid?.() === 0 },
+  () => {
+    const stateDir = makeStateDir("sealed");
+    const hidePath = path.join(stateDir, "hidden.json");
+    fs.writeFileSync(hidePath, '["kept-key"]', "utf8");
+    fs.chmodSync(hidePath, 0o000);
+    try {
+      const message = assertUntrusted(stateDir, "unreadable");
+      assert.deepEqual(hidePrompt(stateDir, "beta prompt"), {
+        status: "error",
+        message,
+      });
+    } finally {
+      fs.chmodSync(hidePath, 0o644); // restore before cleanup
+    }
+  },
+);
+
+// WU4c — write-failure path (AC-S4-2 triangulation): a trusted read whose
+// atomic write fails makes hidePrompt return the toast-suitable error
+// object — never a throw. The state dir is made non-writable while the
+// existing hidden.json stays readable (a state dir whose PATH is blocked
+// by a regular file is now the untrusted-refusal case instead — the READ
+// half fails closed before any write). Skipped as root, where chmod-based
+// write blocking does not apply; permissions are restored in finally.
+test(
+  "hide write failure returns the exact error shape for the delete-flow toast",
+  { skip: process.getuid?.() === 0 },
+  () => {
+    const stateDir = makeStateDir("fail");
+    fs.writeFileSync(
+      path.join(stateDir, "hidden.json"),
+      '["kept-key"]',
+      "utf8",
+    );
+    fs.chmodSync(stateDir, 0o555); // read+execute, no write → EACCES on tmp
+    try {
+      assert.deepEqual(hidePrompt(stateDir, "kept prompt"), {
+        status: "error",
+        message: "Could not write the hide file; the prompt may reappear.",
+      });
+    } finally {
+      fs.chmodSync(stateDir, 0o700); // restore before cleanup
+    }
+  },
+);