gentle-pi 4.0.0 → 4.2.0

package/tests/child-codegraph-bootstrap.test.ts

@@ -0,0 +1,74 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { createAgentSession, DefaultResourceLoader, ModelRuntime, SessionManager, SettingsManager } from "@earendil-works/pi-coding-agent";
+import { createAssistantMessageEventStream, getCurrentTools, type AssistantMessage } from "@earendil-works/pi-ai";
+import { createChildContextExtension } from "../extensions/child-context.ts";
+import { REQUESTED_TOOLS_ENV } from "../lib/agents-runner.ts";
+
+const requested = "read,grep,find,codegraph,subagent_parent_message";
+
+function fixture(env: NodeJS.ProcessEnv, existing?: object) {
+	const tools = new Map<string, object>();
+	if (existing) tools.set("codegraph", existing);
+	const hooks = new Map<string, () => unknown>();
+	createChildContextExtension(env)({
+		on(name: string, handler: () => unknown) { hooks.set(name, handler); },
+		getAllTools() { return [...tools.keys()].map(name => ({ name })); },
+		registerTool(tool: { name: string }) { assert.equal(tools.has(tool.name), false); tools.set(tool.name, tool); },
+	} as unknown as ExtensionAPI);
+	return { tools, start: () => hooks.get("session_start")?.() };
+}
+
+test("fallback child context supplies explicitly requested CodeGraph without extra tools", () => {
+	const f = fixture({ GENTLE_PI_AGENTS_CHILD: "1", [REQUESTED_TOOLS_ENV]: requested });
+	f.start();
+	assert.deepEqual([...f.tools.keys()], ["codegraph"]);
+	const tool = f.tools.get("codegraph") as { parameters: { additionalProperties: boolean; properties: object } };
+	assert.equal(tool.parameters.additionalProperties, false);
+	assert.deepEqual(Object.keys(tool.parameters.properties), ["operation", "query", "limit"]);
+	f.start();
+	assert.equal(f.tools.size, 1, "repeated startup cannot register twice");
+});
+
+test("fallback never overwrites package CodeGraph or grants it without explicit child scope", () => {
+	const existing = { identity: "package-owned implementation" };
+	const full = fixture({ GENTLE_PI_AGENTS_CHILD: "1", [REQUESTED_TOOLS_ENV]: requested }, existing);
+	full.start();
+	assert.equal(full.tools.get("codegraph"), existing);
+	for (const env of [{ [REQUESTED_TOOLS_ENV]: requested }, { GENTLE_PI_AGENTS_CHILD: "1" }, { GENTLE_PI_AGENTS_CHILD: "1", [REQUESTED_TOOLS_ENV]: "read,grep,find" }]) {
+		const f = fixture(env); f.start(); assert.equal(f.tools.size, 0);
+	}
+});
+
+test("actual SDK child first model request includes CodeGraph and keeps selected model", async () => {
+	const root = mkdtempSync(join(tmpdir(), "child-codegraph-sdk-"));
+	const agentDir = join(root, "agent"); mkdirSync(agentDir);
+	const settingsManager = SettingsManager.inMemory({ compaction: { enabled: false }, retry: { enabled: false } });
+	const runtime = await ModelRuntime.create({ authPath: join(agentDir, "offline-auth.json"), modelsPath: null, refreshOnCreate: false });
+	const observed: { model: string; tools: string[] }[] = [];
+	runtime.registerProvider("offline-explore", {
+		api: "offline-explore-test", apiKey: "offline-dummy", baseUrl: "http://offline.invalid",
+		models: [{ id: "configured-small", name: "Configured small fixture", reasoning: false, input: ["text"], cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 }, contextWindow: 100000, maxTokens: 1000 }],
+		streamSimple(model, context) {
+			observed.push({ model: model.id, tools: getCurrentTools(context.messages).map(tool => tool.name).sort() });
+			const stream = createAssistantMessageEventStream();
+			const message: AssistantMessage = { role: "assistant", api: model.api, provider: model.provider, model: model.id, timestamp: Date.now(), content: [{ type: "text", text: "Offline child" }], stopReason: "stop", usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, totalTokens: 0, cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 } } };
+			queueMicrotask(() => { stream.push({ type: "start", partial: message }); stream.push({ type: "done", reason: "stop", message }); stream.end(); });
+			return stream;
+		},
+	});
+	const loader = new DefaultResourceLoader({ cwd: root, agentDir, settingsManager, noExtensions: true, noSkills: true, noPromptTemplates: true, noThemes: true, noContextFiles: true,
+		extensionFactories: [createChildContextExtension({ GENTLE_PI_AGENTS_CHILD: "1", [REQUESTED_TOOLS_ENV]: requested })] });
+	await loader.reload();
+	const { session } = await createAgentSession({ cwd: root, agentDir, modelRuntime: runtime, model: runtime.getModel("offline-explore", "configured-small")!, resourceLoader: loader, settingsManager, sessionManager: SessionManager.inMemory(), tools: ["read", "grep", "find", "codegraph"] });
+	try {
+		await session.bindExtensions({ mode: "json" });
+		await session.prompt("Map local source without modifying files.");
+		assert.deepEqual(observed, [{ model: "configured-small", tools: ["codegraph", "find", "grep", "read"] }]);
+		assert.deepEqual(session.getActiveToolNames().sort(), ["codegraph", "find", "grep", "read"]);
+	} finally { session.dispose(); rmSync(root, { recursive: true, force: true }); }
+});

package/tests/child-package-entrypoints.test.ts

@@ -0,0 +1,65 @@
+import assert from "node:assert/strict";
+import { readdirSync, readFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+import { childContextExtensionPaths } from "../extensions/gentle-agents.ts";
+
+// #1690: children of an isolated standalone parent load the forwarded package
+// root, and a parent without the injection signal falls back to the curated
+// child-context/child-safety/nan-provider entries. These tests pin both halves.
+
+const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const extensionsDir = join(repoRoot, "extensions");
+const frozenFallback = [join(extensionsDir, "child-context.ts"), join(extensionsDir, "child-safety.ts"), join(extensionsDir, "nan-provider.ts")];
+
+function assertFrozenFallback(paths: string[]): void {
+	assert.deepEqual(paths, frozenFallback, "the curated child fallback is frozen by #1690; ship new child behavior in the package");
+}
+
+// Pi (package-manager.js resolveExtensionEntries/collectAutoExtensionEntries)
+// loads only the entries from a package.json `pi.extensions` or an index.ts/
+// index.js when the directory has one; otherwise it loads every top-level
+// .ts/.js file. Ignore files there could also hide an entry.
+function packageEntrypointProblems(manifest: { pi?: { extensions?: unknown } }, entries: string[]): string[] {
+	const problems: string[] = [];
+	if (JSON.stringify(manifest.pi?.extensions) !== JSON.stringify(["./extensions"])) problems.push("pi.extensions is not [\"./extensions\"]");
+	for (const name of ["index.ts", "index.js", "package.json", ".gitignore", ".ignore", ".fdignore"]) {
+		if (entries.includes(name)) problems.push(`extensions/${name} narrows Pi's top-level discovery`);
+	}
+	for (const name of ["child-context.ts", "child-safety.ts", "nan-provider.ts"]) {
+		if (!entries.includes(name)) problems.push(`extensions/${name} is not a top-level entrypoint`);
+	}
+	return problems;
+}
+
+test("the curated child fallback is frozen by #1690 to child-context, child-safety and nan-provider; new child behavior ships in the package", () => {
+	assertFrozenFallback(childContextExtensionPaths());
+});
+
+test("forwarding the package root gives children child-context, child-safety and nan-provider as top-level package entrypoints", () => {
+	// This mirrors Pi's discovery rules by hand (package-manager.js
+	// resolveExtensionEntries/collectAutoExtensionEntries). The end-to-end proof
+	// is the live probe recorded in odd/tasks/fix-1690-standalone-child-package.md.
+	const manifest = JSON.parse(readFileSync(join(repoRoot, "package.json"), "utf8"));
+	const entries = readdirSync(extensionsDir);
+	assert.deepEqual(packageEntrypointProblems(manifest, entries), []);
+});
+
+// Helper self-checks: these exercise the test helpers above, not product code,
+// and do not count as product coverage.
+
+test("helper self-check: assertFrozenFallback rejects an extra entry and a reordered list", () => {
+	assert.throws(() => assertFrozenFallback([...frozenFallback, join(extensionsDir, "gentle-ai.ts")]), "an extra entry must fail");
+	assert.throws(() => assertFrozenFallback([...frozenFallback].reverse()), "the order is part of the contract");
+});
+
+test("helper self-check: packageEntrypointProblems flags each rule that narrows Pi's discovery", () => {
+	const manifest = { pi: { extensions: ["./extensions"] } };
+	const entries = ["child-context.ts", "child-safety.ts", "nan-provider.ts", "gentle-ai.ts"];
+	assert.deepEqual(packageEntrypointProblems(manifest, entries), []);
+	assert.deepEqual(packageEntrypointProblems(manifest, [...entries, "index.ts"]), ["extensions/index.ts narrows Pi's top-level discovery"]);
+	assert.deepEqual(packageEntrypointProblems(manifest, [...entries, "package.json"]), ["extensions/package.json narrows Pi's top-level discovery"]);
+	assert.deepEqual(packageEntrypointProblems(manifest, entries.filter((name) => name !== "child-safety.ts")), ["extensions/child-safety.ts is not a top-level entrypoint"]);
+	assert.deepEqual(packageEntrypointProblems({ pi: { extensions: ["./extensions/gentle-ai.ts"] } }, entries), ["pi.extensions is not [\"./extensions\"]"]);
+});

package/tests/child-package-injection.test.ts

@@ -0,0 +1,74 @@
+import assert from "node:assert/strict";
+import { posix, win32 } from "node:path";
+import test from "node:test";
+import {
+	CHILD_PACKAGE_INJECTION_ENV,
+	childPackageExtensionArgs,
+	encodeChildPackageInjection,
+	parseChildPackageInjection,
+} from "../lib/child-package-injection.ts";
+
+const envWith = (value: string | undefined) => ({ [CHILD_PACKAGE_INJECTION_ENV]: value });
+
+test("the env name follows the GENTLE_SHELL_* launcher naming", () => {
+	assert.equal(CHILD_PACKAGE_INJECTION_ENV, "GENTLE_SHELL_CHILD_PACKAGE_INJECTION");
+});
+
+test("encode and parse round-trip both launcher shapes", () => {
+	for (const value of [
+		{ noExtensions: false, extensionPaths: ["/pkg"] },
+		{ noExtensions: true, extensionPaths: ["/agent/npm/node_modules/other", "/agent/extensions/a.ts", "/pkg"] },
+	]) {
+		const encoded = encodeChildPackageInjection(value);
+		assert.deepEqual(JSON.parse(encoded), { version: 1, ...value });
+		assert.deepEqual(parseChildPackageInjection(envWith(encoded)), value);
+	}
+});
+
+test("parse returns undefined when the value is absent or empty", () => {
+	assert.equal(parseChildPackageInjection({}), undefined);
+	assert.equal(parseChildPackageInjection(envWith(undefined)), undefined);
+	assert.equal(parseChildPackageInjection(envWith("")), undefined);
+});
+
+test("parse rejects malformed values without throwing", () => {
+	const rejected = [
+		"{not json",
+		"null",
+		"[]",
+		"42",
+		JSON.stringify({ noExtensions: false, extensionPaths: ["/pkg"] }),
+		JSON.stringify({ version: 2, noExtensions: false, extensionPaths: ["/pkg"] }),
+		JSON.stringify({ version: "1", noExtensions: false, extensionPaths: ["/pkg"] }),
+		JSON.stringify({ version: 1, extensionPaths: ["/pkg"] }),
+		JSON.stringify({ version: 1, noExtensions: "false", extensionPaths: ["/pkg"] }),
+		JSON.stringify({ version: 1, noExtensions: false }),
+		JSON.stringify({ version: 1, noExtensions: false, extensionPaths: "/pkg" }),
+		JSON.stringify({ version: 1, noExtensions: false, extensionPaths: [] }),
+		JSON.stringify({ version: 1, noExtensions: false, extensionPaths: [42] }),
+		JSON.stringify({ version: 1, noExtensions: false, extensionPaths: [null] }),
+		JSON.stringify({ version: 1, noExtensions: false, extensionPaths: [""] }),
+		JSON.stringify({ version: 1, noExtensions: false, extensionPaths: ["pkg"] }),
+		JSON.stringify({ version: 1, noExtensions: true, extensionPaths: ["/pkg", "./extensions/a.ts"] }),
+	];
+	for (const value of rejected) {
+		assert.doesNotThrow(() => parseChildPackageInjection(envWith(value)), value);
+		assert.equal(parseChildPackageInjection(envWith(value)), undefined, value);
+	}
+});
+
+test("parse checks absoluteness with the injected path flavor, so Windows paths are accepted", () => {
+	const windows = encodeChildPackageInjection({ noExtensions: false, extensionPaths: ["C:\\x\\gentle-pi"] });
+	assert.deepEqual(parseChildPackageInjection(envWith(windows), win32), { noExtensions: false, extensionPaths: ["C:\\x\\gentle-pi"] });
+	assert.equal(parseChildPackageInjection(envWith(windows), posix), undefined);
+	const driveRelative = encodeChildPackageInjection({ noExtensions: false, extensionPaths: ["C:x"] });
+	assert.equal(parseChildPackageInjection(envWith(driveRelative), win32), undefined);
+});
+
+test("childPackageExtensionArgs emits plain argv elements, with --no-extensions first for a takeover", () => {
+	assert.deepEqual(childPackageExtensionArgs({ noExtensions: false, extensionPaths: ["/pkg"] }), ["--extension", "/pkg"]);
+	assert.deepEqual(
+		childPackageExtensionArgs({ noExtensions: true, extensionPaths: ["/other dir/pkg", "C:\\x y\\a.ts", "/pkg"] }),
+		["--no-extensions", "--extension", "/other dir/pkg", "--extension", "C:\\x y\\a.ts", "--extension", "/pkg"],
+	);
+});

package/tests/child-safety.test.ts

@@ -80,3 +80,15 @@ test("primary requires fresh confirmation, cancellation and missing UI block", a
 	const blockers = h.events.filter((entry) => entry.name === "herdr:blocked").map((entry) => (entry.data as { active: boolean }).active);
 	assert.deepEqual(blockers, [true, false, true, false, true, false, true, false]);
 });
+
+test("children block recognized destructive commands sent to bash_background too", async () => {
+	const h = harness(true);
+	const result = await h.handlers[0]({ toolName: "bash_background", input: { command: "echo ok && rm -rf ./data" } }, context(async () => { throw new Error("child must never prompt"); }));
+	assert.equal((result as { block?: boolean })?.block, true);
+});
+
+test("children block recognized destructive commands sent to monitor too", async () => {
+	const h = harness(true);
+	const result = await h.handlers[0]({ toolName: "monitor", input: { command: "echo ok && rm -rf ./data" } }, context(async () => { throw new Error("child must never prompt"); }));
+	assert.equal((result as { block?: boolean })?.block, true);
+});

package/tests/child-web-package.test.ts

@@ -0,0 +1,224 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, symlinkSync, realpathSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { childArguments, type TaskRequest } from "../lib/agents-runner.ts";
+import { createAgentSession, DefaultPackageManager, DefaultResourceLoader, ModelRuntime, SessionManager, SettingsManager } from "@earendil-works/pi-coding-agent";
+import { createAssistantMessageEventStream, getCurrentTools, type AssistantMessage } from "@earendil-works/pi-ai";
+
+const webTools = ["web_enable", "web_search", "source_check", "fetch_content", "get_search_content"];
+
+function fixture() {
+	const root = realpathSync(mkdtempSync(join(tmpdir(), "child-web-package-")));
+	const agentDir = join(root, "agent");
+	const packageRoot = join(agentDir, "npm", "node_modules", "pi-web-access");
+	mkdirSync(join(packageRoot, "dist"), { recursive: true });
+	writeFileSync(join(packageRoot, "package.json"), JSON.stringify({ name: "pi-web-access", type: "module", pi: { extensions: ["./dist"] } }));
+	writeFileSync(join(packageRoot, "dist", "index.js"), "export default function(api) {}\n");
+	const request: TaskRequest = {
+		agent: {
+			name: "gentle-ai-explore", description: "Public fixture", filePath: join(root, "explorer.md"), scope: "global",
+			tools: ["read", "grep", "find", "codegraph", ...webTools], instructions: "Explore without modifying source.",
+			model: undefined, thinking: undefined, mode: undefined,
+		},
+		prompt: "Explore the public fixture", label: undefined, context: undefined, mode: "task",
+		parentSessionId: "fixture-parent", resumeSessionPath: undefined,
+		cwd: root, sessionDir: join(root, "sessions"), noExtensions: true,
+		extensionPaths: [join(root, "child-context.ts"), join(root, "child-safety.ts"), join(root, "nan-provider.ts")],
+		env: { PI_CODING_AGENT_DIR: agentDir }, model: { provider: "fixture", id: "configured-small" }, thinking: "low",
+	};
+	for (const path of request.extensionPaths!) writeFileSync(path, "export default function(api) {}\n");
+	return { root, packageRoot, request };
+}
+
+function paths(args: string[]): string[] {
+	return args.flatMap((arg, index) => arg === "-e" || arg === "--extension" ? [args[index + 1]] : []);
+}
+
+test("requested direct web loads only the installed package alongside the frozen owned bootstrap", () => {
+	const f = fixture();
+	try {
+		f.request.env.HOME = f.request.env.USERPROFILE = join(f.root, "other-home");
+		const args = childArguments(f.request);
+		assert.deepEqual(paths(args), [...f.request.extensionPaths!, f.packageRoot]);
+		assert.ok(args.includes("--no-extensions"), "do not enable ambient plugins to obtain web access");
+		assert.equal(args[args.indexOf("--model") + 1], "fixture/configured-small:low");
+		assert.equal(args[args.indexOf("--tools") + 1], [...f.request.agent.tools, "subagent_parent_message"].join(","));
+	} finally { rmSync(f.root, { recursive: true, force: true }); }
+});
+
+test("partial or absent web scope never loads a package or broadens the requested tools", () => {
+	const f = fixture();
+	try {
+		for (const tools of [["read", "grep", "find"], ["web_enable"], ["fetch_content"], webTools.slice(1)]) {
+			const request = { ...f.request, agent: { ...f.request.agent, tools } };
+			assert.deepEqual(paths(childArguments(request)), request.extensionPaths);
+		}
+	} finally { rmSync(f.root, { recursive: true, force: true }); }
+});
+
+test("already injected web package is not added twice", () => {
+	const f = fixture();
+	try {
+		const request = { ...f.request, extensionPaths: [...f.request.extensionPaths!, f.packageRoot] };
+		assert.deepEqual(paths(childArguments(request)), request.extensionPaths);
+	} finally { rmSync(f.root, { recursive: true, force: true }); }
+});
+
+test("a symlink to the injected web package is not loaded again", () => {
+	const f = fixture();
+	try {
+		const alias = join(f.root, "web-alias");
+		symlinkSync(f.packageRoot, alias, "junction");
+		for (const path of [alias, "web-alias"]) {
+			const request = { ...f.request, extensionPaths: [...f.request.extensionPaths!, path] };
+			assert.deepEqual(paths(childArguments(request)), request.extensionPaths);
+		}
+	} finally { rmSync(f.root, { recursive: true, force: true }); }
+});
+
+test("web lookup uses the child's home instead of the parent agent directory", () => {
+	const f = fixture();
+	const parentAgentDir = process.env.PI_CODING_AGENT_DIR;
+	try {
+		process.env.PI_CODING_AGENT_DIR = join(f.root, "parent-agent");
+		const home = join(f.root, "child-home");
+		const packageRoot = join(home, ".pi", "agent", "npm", "node_modules", "pi-web-access");
+		mkdirSync(packageRoot, { recursive: true });
+		const homeEnv = process.platform === "win32" ? { USERPROFILE: home } : { HOME: home };
+		for (const override of [undefined, "", "~/.pi/agent"]) {
+			const request = { ...f.request, env: { ...homeEnv, PI_CODING_AGENT_DIR: override } };
+			assert.deepEqual(paths(childArguments(request)), [...f.request.extensionPaths!, packageRoot]);
+		}
+	} finally {
+		if (parentAgentDir === undefined) delete process.env.PI_CODING_AGENT_DIR;
+		else process.env.PI_CODING_AGENT_DIR = parentAgentDir;
+		rmSync(f.root, { recursive: true, force: true });
+	}
+});
+
+test("missing or incompatible SDK package lookup never installs or enables ambient extensions", () => {
+	const f = fixture();
+	const original = DefaultPackageManager.prototype.getInstalledPath;
+	try {
+		for (const lookup of [() => undefined, () => { throw new Error("unsupported package lookup"); }]) {
+			DefaultPackageManager.prototype.getInstalledPath = lookup;
+			const args = childArguments(f.request);
+			assert.deepEqual(paths(args), f.request.extensionPaths);
+			assert.ok(args.includes("--no-extensions"));
+		}
+	} finally {
+		DefaultPackageManager.prototype.getInstalledPath = original;
+		rmSync(f.root, { recursive: true, force: true });
+	}
+});
+
+test("explicit capability scope, not agent name, determines optional web loading", () => {
+	const f = fixture();
+	try {
+		for (const name of ["renamed-explorer", "gentle-ai-worker", "gentle-ai-verify"]) {
+			const optedIn = { ...f.request, agent: { ...f.request.agent, name } };
+			assert.deepEqual(paths(childArguments(optedIn)), [...f.request.extensionPaths!, f.packageRoot]);
+			const localOnly = { ...optedIn, agent: { ...optedIn.agent, tools: ["read", "grep", "find"] } };
+			assert.deepEqual(paths(childArguments(localOnly)), f.request.extensionPaths);
+		}
+	} finally { rmSync(f.root, { recursive: true, force: true }); }
+});
+
+async function sdkFixture(block: boolean, injectAlias = false) {
+	const f = fixture();
+	const marker = "controlled public web evidence";
+	const counter = `webFixture_${Math.random().toString(36).slice(2)}`;
+	const state = globalThis as unknown as Record<string, number>;
+	state[counter] = 0;
+	const hooks = `${counter}_hooks`;
+	state[hooks] = 0;
+	if (injectAlias) {
+		const alias = join(f.root, "web-alias");
+		symlinkSync(f.packageRoot, alias, "junction");
+		f.request.extensionPaths!.push(alias);
+	}
+	writeFileSync(join(f.packageRoot, "dist", "index.js"), `
+export default function(api) {
+	api.on("session_start", () => { globalThis[${JSON.stringify(hooks)}]++; });
+	for (const name of ${JSON.stringify(webTools)}) api.registerTool({
+		name, label: name, description: "Controlled web fixture",
+		parameters: { type: "object", properties: { url: { type: "string" } }, additionalProperties: false },
+		async execute() {
+			globalThis[${JSON.stringify(counter)}]++;
+			return { content: [{ type: "text", text: ${JSON.stringify(marker)} }] };
+		}
+	});
+}
+`);
+	const settingsManager = SettingsManager.inMemory({ compaction: { enabled: false }, retry: { enabled: false } });
+	const runtime = await ModelRuntime.create({ authPath: join(f.root, "offline-auth.json"), modelsPath: null, refreshOnCreate: false });
+	const observed: { model: string; tools: string[] }[] = [];
+	let turn = 0;
+	runtime.registerProvider("offline-web", {
+		api: "offline-web-test", apiKey: "offline-dummy", baseUrl: "http://offline.invalid",
+		models: [{ id: "configured-small", name: "Configured small fixture", reasoning: false, input: ["text"], cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 }, contextWindow: 100000, maxTokens: 1000 }],
+		streamSimple(model, context) {
+			observed.push({ model: model.id, tools: getCurrentTools(context.messages).map(tool => tool.name).sort() });
+			const calling = turn++ === 0;
+			const message: AssistantMessage = {
+				role: "assistant", api: model.api, provider: model.provider, model: model.id, timestamp: Date.now(),
+				content: calling ? [{ type: "toolCall", id: "fixture-fetch", name: "fetch_content", arguments: { url: "https://public.fixture/evidence" } }] : [{ type: "text", text: "Finished" }],
+				stopReason: calling ? "toolUse" : "stop",
+				usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, totalTokens: 0, cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 } },
+			};
+			const stream = createAssistantMessageEventStream();
+			queueMicrotask(() => { stream.push({ type: "start", partial: message }); stream.push({ type: "done", reason: message.stopReason as "stop" | "toolUse", message }); stream.end(); });
+			return stream;
+		},
+	});
+	const calls: string[] = [];
+	const loader = new DefaultResourceLoader({
+		cwd: f.root, agentDir: join(f.root, "agent"), settingsManager,
+		noExtensions: true, noSkills: true, noPromptTemplates: true, noThemes: true, noContextFiles: true,
+		additionalExtensionPaths: paths(childArguments(f.request)),
+		extensionFactories: [api => {
+			api.on("session_start", () => { api.setActiveTools(webTools); });
+			api.on("tool_call", event => {
+				calls.push(event.toolName);
+				if (block) return { block: true, reason: "fixture permission denied" };
+			});
+		}],
+	});
+	let session: Awaited<ReturnType<typeof createAgentSession>>["session"] | undefined;
+	try {
+		await loader.reload();
+		assert.deepEqual(loader.getExtensions().errors, []);
+		({ session } = await createAgentSession({ cwd: f.root, agentDir: join(f.root, "agent"), modelRuntime: runtime, model: runtime.getModel("offline-web", "configured-small")!, resourceLoader: loader, settingsManager, sessionManager: SessionManager.inMemory(), tools: webTools }));
+		await session.bindExtensions({ mode: "json" });
+		assert.equal(state[hooks], 1, "the package's session hook must register only once");
+		await session.prompt("Retrieve the controlled public source directly.");
+		assert.deepEqual(calls, ["fetch_content"], JSON.stringify({ observed, messages: session.messages.map(message => ({ role: message.role, errorMessage: message.role === "assistant" ? message.errorMessage : undefined, content: message.role === "toolResult" ? message.content : undefined })) }));
+		assert.ok(observed.length >= 2);
+		assert.ok(observed.every(request => request.model === "configured-small"));
+		assert.ok(observed[0].tools.includes("fetch_content"), "registration must reach an actual SDK model request");
+		assert.equal(state[counter], block ? 0 : 1, "permission interception occurs before backend execution");
+		const result = session.messages.find(message => message.role === "toolResult");
+		assert.ok(result?.role === "toolResult");
+		assert.equal(Boolean(result.isError), block);
+		assert.ok(JSON.stringify(result.content).includes(block ? "fixture permission denied" : marker));
+	} finally {
+		session?.dispose();
+		delete state[counter];
+		delete state[hooks];
+		rmSync(f.root, { recursive: true, force: true });
+	}
+}
+
+test("production child paths register and execute web through actual SDK hooks without network", async () => {
+	await sdkFixture(false);
+});
+
+test("a symlink-injected web package registers actual SDK hooks once", async () => {
+	await sdkFixture(false, true);
+});
+
+test("normal SDK permission hook blocks web execution before the backend", async () => {
+	await sdkFixture(true);
+});

package/tests/codegraph-tools.test.ts

@@ -39,6 +39,41 @@ test("CodeGraph tool rejects non-project, nested-project, HOME, and temporary wo
 	assert.equal(calls, 0);
 });
 
+test("CodeGraph query timeout is reported distinctly from user abort and never bounds init (#1901)", async (t) => {
+	const cwd = workspace(t);
+	const ctx = { cwd } as ExtensionContext;
+	// Behaves like execFile: settles only when its signal aborts, then rejects with AbortError.
+	const hanging: CodeGraphRunner = (_args, options) => new Promise((_resolve, reject) => {
+		options.signal?.addEventListener("abort", () => reject(Object.assign(new Error("The operation was aborted"), { name: "AbortError", code: "ABORT_ERR" })), { once: true });
+	});
+
+	const bounded = createCodeGraphTool(hanging, { queryTimeoutMs: 20 });
+	for (const parameters of [{ operation: "query", query: "x" }, { operation: "explore", query: "x" }] as const) {
+		const result = await bounded.execute("test", parameters, undefined, undefined, ctx);
+		assert.match(result.content[0].text, /CodeGraph timed out after 20 ms/);
+		assert.match(result.content[0].text, /Use read, grep, and find/);
+		assert.equal((result.details as { status: string }).status, "failed");
+	}
+
+	// A user cancellation is not a timeout.
+	const user = new AbortController();
+	setTimeout(() => user.abort(), 5);
+	const cancelled = await createCodeGraphTool(hanging, { queryTimeoutMs: 60_000 }).execute("test", { operation: "query", query: "x" }, user.signal, undefined, ctx);
+	assert.doesNotMatch(cancelled.content[0].text, /timed out/);
+	assert.match(cancelled.content[0].text, /CodeGraph failed to run/);
+
+	// init is the legitimately slow first index: only the user's own signal bounds it.
+	let initSignal: AbortSignal | undefined = new AbortController().signal;
+	const slowInit = createCodeGraphTool(async (_args, options) => {
+		initSignal = options.signal;
+		await new Promise((resolve) => setTimeout(resolve, 60));
+		return { stdout: "indexed", stderr: "" };
+	}, { queryTimeoutMs: 20 });
+	const init = await slowInit.execute("test", { operation: "init" }, undefined, undefined, ctx);
+	assert.deepEqual(init.content, [{ type: "text", text: "indexed" }]);
+	assert.equal(initSignal, undefined);
+});
+
 test("CodeGraph tool runs only fixed cwd-scoped init, query, and explore commands", async (t) => {
 	const cwd = workspace(t);
 	const calls: Array<{ args: readonly string[]; cwd: string }> = [];

package/tests/codemode-rendering.test.ts

@@ -42,12 +42,13 @@ function registeredCodemode() {
 }
 
 function context(overrides: Partial<ToolRenderContext> = {}): ToolRenderContext {
-	return {
+	const fixture = {
 		args: { code: "await tools.read({path: '/private/argument'});" },
 		toolCallId: "code-1", invalidate() {}, lastComponent: undefined, state: {}, cwd: "/fixture",
 		executionStarted: true, argsComplete: true, isPartial: false, expanded: false, showImages: false,
-		isError: false, ...overrides,
+		isError: false, durationMs: undefined, outputPad: 0, ...overrides,
 	};
+	return fixture;
 }
 
 function result(calls: unknown = [], text = "Script completed\nWall time 0.1 seconds\nOutput:\n"): AgentToolResult<unknown> {
@@ -108,6 +109,7 @@ test("public loadout modes preserve hidden and deferred exposure policy", async
 			declared: [tool, direct], callable: [direct, deferred], registered: [tool, direct, deferred, hidden],
 			getExposure: (name: string) => name === "deferred_fixture" ? "deferred" : name === "hidden_fixture" ? "hidden" : "direct",
 			getNamespace: () => undefined,
+			getPromptGuidelines: () => [],
 		} as unknown as Parameters<NonNullable<ToolDefinition["prepareLoadout"]>>[0];
 		const changes = tool.prepareLoadout!(loadout)!;
 		assert.deepEqual(changes.hiddenDeclarations, mode === "only" ? ["direct_fixture"] : []);
@@ -429,6 +431,109 @@ function piRow(tool: ToolDefinition, value: AgentToolResult<unknown> | undefined
 
 const pending = () => context({ isPartial: true, executionStarted: true, state: {} });
 
+test("unchanged Code frames reuse paint work in both styles, widths and views", (t) => {
+	const original = cardStyle();
+	t.after(() => setCardStyle(original));
+	const tool = decorateCodemodeTool({ name: "codemode" } as ToolDefinition);
+	const output = Array.from({ length: 300 }, (_, i) => `${i}: 界🌹 e\u0301 \x1b[31mcolored\x1b[0m ${"words ".repeat(12)}`).join("\n");
+	for (const style of Object.values(CARD_STYLE)) {
+		setCardStyle(style);
+		for (const expanded of [false, true]) {
+			for (const width of [80, 160]) {
+				let paints = 0;
+				const painted = {
+					fg: (role: string, text: string) => { paints++; return floatTheme.fg(role, text); },
+					bg: (role: string, text: string) => { paints++; return floatTheme.bg(role, text); },
+				};
+				const ctx = context({ expanded });
+				const components = [tool.renderCall!(ctx.args, painted as never, ctx),
+					tool.renderResult!(result([], output), { expanded, isPartial: false }, painted as never, ctx)];
+				for (const component of components) {
+					const first = [...component.render(width)];
+					const afterFirst = paints;
+					for (let repeat = 0; repeat < 20; repeat++) assert.deepEqual(component.render(width + 0.5), first);
+					assert.equal(paints, afterFirst, "unchanged frame must not repaint");
+					component.invalidate();
+					assert.deepEqual(component.render(width), first, "invalidation preserves exact ANSI output");
+					assert.ok(paints > afterFirst);
+				}
+			}
+		}
+	}
+});
+
+test("Code cache replaces its frame on width, style and theme invalidation", (t) => {
+	const original = cardStyle();
+	t.after(() => setCardStyle(original));
+	setCardStyle(CARD_STYLE.NEON);
+	const tool = decorateCodemodeTool({ name: "codemode" } as ToolDefinition);
+	let paints = 0;
+	let color = "\x1b[31m";
+	const painted = {
+		fg: (_role: string, text: string) => { paints++; return `${color}${text}\x1b[0m`; },
+		bg: floatTheme.bg,
+	};
+	const ctx = context();
+	const value = result([], "hello 界 e\u0301\nsecond");
+	const fresh = () => tool.renderResult!(value, { expanded: false, isPartial: false }, painted as never, ctx);
+	const component = fresh();
+	const first = [...component.render(80)];
+	const before = paints;
+	assert.deepEqual(component.render(80.9), first);
+	assert.equal(paints, before);
+	assert.deepEqual(component.render(160), fresh().render(160));
+	assert.ok(paints > before);
+	setCardStyle(CARD_STYLE.FLOAT);
+	assert.deepEqual(component.render(160), fresh().render(160));
+	setCardStyle(CARD_STYLE.NEON);
+	assert.deepEqual(component.render(80), first);
+	color = "\x1b[35m";
+	component.invalidate();
+	const changed = component.render(80);
+	assert.deepEqual(changed, fresh().render(80));
+	assert.notDeepEqual(changed, first);
+	assert.deepEqual(changed.map(stripAnsi), first.map(stripAnsi));
+	assert.deepEqual(component.render(0), []);
+	assert.deepEqual(component.render(-1), []);
+});
+
+test("cached running Code calls notice result arrival and completion", (t) => {
+	const original = cardStyle();
+	t.after(() => setCardStyle(original));
+	const tool = decorateCodemodeTool({ name: "codemode" } as ToolDefinition);
+	for (const style of Object.values(CARD_STYLE)) {
+		setCardStyle(style);
+		for (const transition of ["result", "completion"]) {
+			const ctx = pending();
+			const component = tool.renderCall!(ctx.args, floatTheme as never, ctx);
+			const running = [...component.render(80)];
+			assert.match(running.map(stripAnsi).join("\n"), /running…/);
+			assert.deepEqual(component.render(80), running);
+			if (transition === "result") tool.renderResult!(result([], "partial"), { expanded: false, isPartial: true }, floatTheme as never, ctx);
+			else ctx.isPartial = false;
+			const changed = component.render(80);
+			assert.doesNotMatch(changed.map(stripAnsi).join("\n"), /running…/);
+			assert.deepEqual(changed, tool.renderCall!(ctx.args, floatTheme as never, ctx).render(80));
+			assert.deepEqual(component.render(80), changed);
+		}
+	}
+});
+
+test("cached Code results do not leak content across partial, final or expanded components", () => {
+	const tool = decorateCodemodeTool({ name: "codemode" } as ToolDefinition);
+	const ctx = pending();
+	const partial = tool.renderResult!(result([], "partial payload"), { expanded: false, isPartial: true }, theme as never, ctx);
+	const first = [...partial.render(80)];
+	assert.deepEqual(partial.render(80), first);
+	const value = result([], "final payload\nsecond\nthird\nfourth detail");
+	const final = tool.renderResult!(value, { expanded: false, isPartial: false }, theme as never, ctx);
+	const expanded = tool.renderResult!(value, { expanded: true, isPartial: false }, theme as never, context({ expanded: true }));
+	assert.match(final.render(80).join("\n"), /final payload/);
+	assert.doesNotMatch(final.render(80).join("\n"), /partial payload|fourth detail/);
+	assert.match(expanded.render(80).join("\n"), /fourth detail/);
+	assert.deepEqual(partial.render(80), first);
+});
+
 test("a running Code card closes its own frame with one running row until a result exists", () => {
 	const tool = registeredCodemode();
 	const roles: string[] = [];