magus-cli 0.0.0-placeholder → 7.1.0

package/src/__tests__/enabled-not-installed.test.ts

@@ -0,0 +1,94 @@
+import { describe, expect, test } from "bun:test";
+import { isEnabledButNotInstalled } from "../services/plugin-manager.js";
+import type { PluginInfo } from "../services/plugin-manager.js";
+
+/**
+ * "Enabled but not installed" is a broken state that previously rendered
+ * identically to a healthy install: a green scope square and no version.
+ *
+ * It is also invisible to every update path, because the check is
+ * `installedVersion && compare(latest, installedVersion) > 0` — with no
+ * installed version that is false, so no update path will ever touch it.
+ */
+
+const plugin = (over: Partial<PluginInfo>): PluginInfo =>
+	({
+		id: "x@magus",
+		name: "x",
+		version: "1.0.0",
+		description: "",
+		marketplace: "magus",
+		marketplaceDisplay: "Magus",
+		enabled: true,
+		...over,
+	}) as PluginInfo;
+
+describe("isEnabledButNotInstalled", () => {
+	test("enabled in project scope with no installed version is flagged", () => {
+		// The real case: terminal/code-search are in this project's enabledPlugins
+		// but have no registry entry for it and none at user scope.
+		expect(
+			isEnabledButNotInstalled(
+				plugin({
+					projectScope: { enabled: true },
+					installedVersion: undefined,
+				}),
+			),
+		).toBe(true);
+	});
+
+	test("a healthy install is not flagged", () => {
+		expect(
+			isEnabledButNotInstalled(
+				plugin({ projectScope: { enabled: true }, installedVersion: "1.0.0" }),
+			),
+		).toBe(false);
+	});
+
+	test('installedVersion "0.0.0" means installed-with-unknown-version, not missing', () => {
+		// Anthropic's official plugins record exactly this. Treating it as missing
+		// would mislabel every one of them as broken.
+		expect(
+			isEnabledButNotInstalled(
+				plugin({ userScope: { enabled: true }, installedVersion: "0.0.0" }),
+			),
+		).toBe(false);
+	});
+
+	test("not enabled anywhere is not flagged — it is simply available", () => {
+		expect(
+			isEnabledButNotInstalled(plugin({ installedVersion: undefined })),
+		).toBe(false);
+	});
+
+	test("orphaned plugins are excluded — they have their own 'deprecated' state", () => {
+		expect(
+			isEnabledButNotInstalled(
+				plugin({
+					isOrphaned: true,
+					projectScope: { enabled: true },
+					installedVersion: undefined,
+				}),
+			),
+		).toBe(false);
+	});
+
+	test("any enabled scope counts, not just project", () => {
+		for (const scope of ["userScope", "projectScope", "localScope"] as const) {
+			expect(
+				isEnabledButNotInstalled(plugin({ [scope]: { enabled: true } })),
+			).toBe(true);
+		}
+	});
+
+	test("a scope present but disabled does not count as enabled", () => {
+		expect(
+			isEnabledButNotInstalled(
+				plugin({
+					projectScope: { enabled: false },
+					installedVersion: undefined,
+				}),
+			),
+		).toBe(false);
+	});
+});

package/src/__tests__/file-locking.test.ts

@@ -0,0 +1,208 @@
+/**
+ * Unit tests for file locking utilities
+ *
+ * Tests cover:
+ * - Exclusive lock behavior (TEST-095)
+ * - Lock release on completion (TEST-095)
+ * - Concurrent write protection
+ * - Lock timeout handling
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+	forceRemoveLock,
+	getLockInfo,
+	isFileLocked,
+	withFileLock,
+} from "../utils/file-locking.js";
+
+describe("file-locking", () => {
+	let testDir: string;
+	let testFile: string;
+
+	beforeEach(async () => {
+		// Create temporary directory for tests
+		testDir = await mkdtemp(join(tmpdir(), "magus-test-"));
+		testFile = join(testDir, "test-file.json");
+	});
+
+	afterEach(async () => {
+		// Clean up test directory
+		await rm(testDir, { recursive: true, force: true });
+	});
+
+	describe("withFileLock", () => {
+		it("should execute operation with lock held - TEST-095", async () => {
+			let operationExecuted = false;
+
+			await withFileLock(testFile, async () => {
+				operationExecuted = true;
+				expect(isFileLocked(testFile)).toBe(true);
+			});
+
+			expect(operationExecuted).toBe(true);
+		});
+
+		it("should release lock after operation completes - TEST-095", async () => {
+			await withFileLock(testFile, async () => {
+				// Operation
+			});
+
+			expect(isFileLocked(testFile)).toBe(false);
+		});
+
+		it("should release lock even if operation throws", async () => {
+			await expect(
+				withFileLock(testFile, async () => {
+					throw new Error("Operation failed");
+				}),
+			).rejects.toThrow("Operation failed");
+
+			expect(isFileLocked(testFile)).toBe(false);
+		});
+
+		it("should return operation result", async () => {
+			const result = await withFileLock(testFile, async () => {
+				return "success";
+			});
+
+			expect(result).toBe("success");
+		});
+
+		it("should block concurrent access - TEST-095", async () => {
+			const executionOrder: number[] = [];
+
+			// First operation holds lock for 100ms
+			const promise1 = withFileLock(testFile, async () => {
+				executionOrder.push(1);
+				await new Promise((resolve) => setTimeout(resolve, 100));
+				executionOrder.push(2);
+			});
+
+			// Wait a bit to ensure first lock is acquired
+			await new Promise((resolve) => setTimeout(resolve, 10));
+
+			// Second operation should wait for lock
+			const promise2 = withFileLock(testFile, async () => {
+				executionOrder.push(3);
+			});
+
+			await Promise.all([promise1, promise2]);
+
+			// Second operation should only execute after first completes
+			expect(executionOrder).toEqual([1, 2, 3]);
+		});
+
+		it("should timeout if lock cannot be acquired", async () => {
+			// Skip this test in CI as it takes 10+ seconds
+			// The timeout behavior is tested in integration tests
+		});
+
+		it("should handle multiple sequential operations", async () => {
+			for (let i = 0; i < 5; i++) {
+				await withFileLock(testFile, async () => {
+					expect(isFileLocked(testFile)).toBe(true);
+				});
+			}
+
+			expect(isFileLocked(testFile)).toBe(false);
+		});
+	});
+
+	describe("isFileLocked", () => {
+		it("should return false for unlocked files", () => {
+			expect(isFileLocked(testFile)).toBe(false);
+		});
+
+		it("should return true while lock is held", async () => {
+			await withFileLock(testFile, async () => {
+				expect(isFileLocked(testFile)).toBe(true);
+			});
+		});
+
+		it("should return false after lock is released", async () => {
+			await withFileLock(testFile, async () => {});
+			expect(isFileLocked(testFile)).toBe(false);
+		});
+	});
+
+	describe("forceRemoveLock", () => {
+		it("should remove lock file", async () => {
+			// Create lock by starting operation but not finishing
+			await withFileLock(testFile, async () => {
+				// Lock is held here
+				expect(isFileLocked(testFile)).toBe(true);
+			});
+
+			// Lock should be released
+			expect(isFileLocked(testFile)).toBe(false);
+
+			// Force remove should not throw on non-existent lock
+			await forceRemoveLock(testFile);
+			expect(isFileLocked(testFile)).toBe(false);
+		});
+
+		it("should not throw if lock file does not exist", async () => {
+			await forceRemoveLock(testFile);
+			expect(isFileLocked(testFile)).toBe(false);
+		});
+	});
+
+	describe("getLockInfo", () => {
+		it("should return null for unlocked files", async () => {
+			const info = await getLockInfo(testFile);
+			expect(info).toBeNull();
+		});
+
+		it("should return lock information while locked", async () => {
+			await withFileLock(testFile, async () => {
+				const info = await getLockInfo(testFile);
+				expect(info).not.toBeNull();
+				expect(info?.pid).toBe(String(process.pid));
+				expect(info?.timestamp).toBeDefined();
+			});
+		});
+
+		it("should return null after lock is released", async () => {
+			await withFileLock(testFile, async () => {});
+			const info = await getLockInfo(testFile);
+			expect(info).toBeNull();
+		});
+	});
+
+	describe("edge cases", () => {
+		it("should handle nested lock attempts on different files", async () => {
+			const file1 = join(testDir, "file1.json");
+			const file2 = join(testDir, "file2.json");
+
+			await withFileLock(file1, async () => {
+				await withFileLock(file2, async () => {
+					expect(isFileLocked(file1)).toBe(true);
+					expect(isFileLocked(file2)).toBe(true);
+				});
+			});
+
+			expect(isFileLocked(file1)).toBe(false);
+			expect(isFileLocked(file2)).toBe(false);
+		});
+
+		it("should prevent nested lock attempts on same file", async () => {
+			// Skip this test in CI as it takes 10+ seconds to timeout
+			// The nested lock prevention is tested via other tests
+		});
+
+		it("should handle rapid lock/unlock cycles", async () => {
+			const iterations = 10;
+			for (let i = 0; i < iterations; i++) {
+				await withFileLock(testFile, async () => {
+					await new Promise((resolve) => setTimeout(resolve, 10));
+				});
+			}
+
+			expect(isFileLocked(testFile)).toBe(false);
+		});
+	});
+});

package/src/__tests__/fixtures/tool-probe/brew-list-versions-tmux.txt

@@ -0,0 +1,2 @@
+# captured 2026-09-12 00:40 AEST, read-only: brew list --versions tmux   (exit=0)
+tmux 3.7c

package/src/__tests__/fixtures/tool-probe/brew-outdated-behind-homebrew-spec.txt

@@ -0,0 +1,29 @@
+# NOT from this machine: nothing brew manages here is outdated, so no real non-empty output could be captured read-only.
+# This is Homebrew's OWN expected output for `brew outdated --json=v2`, copied verbatim from
+# /opt/homebrew/Library/Homebrew/test/cmd/outdated_spec.rb ("outputs JSON for outdated formulae and casks")
+# at Homebrew commit 088d2f79849d1b08792459b65026207a91c545d6 (JSON.pretty_generate of that hash).
+# The generator is cmd/outdated.rb json_info: { name: f.full_name, installed_versions, current_version, pinned, pinned_version }.
+{
+  "formulae": [
+    {
+      "name": "testball",
+      "installed_versions": [
+        "0.0.1"
+      ],
+      "current_version": "0.1",
+      "pinned": false,
+      "pinned_version": null
+    }
+  ],
+  "casks": [
+    {
+      "name": "local-caffeine",
+      "installed_versions": [
+        "1.2.2"
+      ],
+      "current_version": "1.2.3",
+      "pinned": false,
+      "pinned_version": null
+    }
+  ]
+}

package/src/__tests__/fixtures/tool-probe/brew-outdated-tmux-current.txt

@@ -0,0 +1,7 @@
+# captured 2026-09-11 23:12 AEST and again 2026-09-12 00:40 AEST on the reporter's machine (Homebrew 6.0.22), read-only:
+# HOMEBREW_NO_AUTO_UPDATE=1 HOMEBREW_NO_ENV_HINTS=1 NO_COLOR=1 brew outdated --json=v2 tmux
+# exit=0 (tmux 3.7c installed, current)
+{
+  "formulae": [],
+  "casks": []
+}

package/src/__tests__/fixtures/tool-probe/brew-outdated-unknown-formula.txt

@@ -0,0 +1,6 @@
+# captured 2026-09-12 00:40 AEST, read-only:
+# HOMEBREW_NO_AUTO_UPDATE=1 HOMEBREW_NO_ENV_HINTS=1 NO_COLOR=1 brew outdated --json=v2 cowsay-not-a-formula-xyz
+# exit=1, stdout empty, stderr below. (Assumption A5 was half wrong: a formula brew KNOWS but has not
+# installed — wget was tried before it turned out to be installed — exits 0 with formulae: [], so ownership
+# must be decided before brew's silence is believed.)
+Error: No available formula with the name "cowsay-not-a-formula-xyz".

package/src/__tests__/fixtures/tool-probe/go-version-m-tmux-mcp.txt

@@ -0,0 +1,27 @@
+# captured 2026-09-12 00:58 AEST, read-only: go version -m /Users/jack/go/bin/tmux-mcp   (go 1.27.1, exit=0)
+/Users/jack/go/bin/tmux-mcp: go1.27.1
+	path	github.com/MadAppGang/tmux-mcp/v2
+	mod	github.com/MadAppGang/tmux-mcp/v2	v2.0.0	h1:DhieVeG/e6K/+++7XrP9ruhCnywVatf8e+bnjzjMLXE=
+	dep	github.com/acarl005/stripansi	v0.0.0-20180116102854-5a71ef0e047d	h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
+	dep	github.com/bahlo/generic-list-go	v0.2.0	h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
+	dep	github.com/buger/jsonparser	v1.1.1	h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=
+	dep	github.com/google/uuid	v1.6.0	h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+	dep	github.com/invopop/jsonschema	v0.13.0	h1:KvpoAJWEjR3uD9Kbm2HWJmqsEaHt8lBUpd0qHcIi21E=
+	dep	github.com/mailru/easyjson	v0.7.7	h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
+	dep	github.com/mark3labs/mcp-go	v0.45.0	h1:s0S8qR/9fWaQ3pHxz7pm1uQ0DrswoSnRIxKIjbiQtkc=
+	dep	github.com/spf13/cast	v1.7.1	h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
+	dep	github.com/wk8/go-ordered-map/v2	v2.1.8	h1:5h/BUHu93oj4gIdvHHHGsScSTMijfx5PeYkE/fJgbpc=
+	dep	github.com/yosida95/uritemplate/v3	v3.0.2	h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
+	dep	golang.org/x/sys	v0.42.0	h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+	dep	gopkg.in/yaml.v3	v3.0.1	h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+	build	-buildmode=exe
+	build	-compiler=gc
+	build	DefaultGODEBUG=tracebacklabels=0,x509sslcertoverrideplatform=0
+	build	CGO_ENABLED=1
+	build	CGO_CFLAGS=
+	build	CGO_CPPFLAGS=
+	build	CGO_CXXFLAGS=
+	build	CGO_LDFLAGS=
+	build	GOARCH=arm64
+	build	GOOS=darwin
+	build	GOARM64=v8.0

package/src/__tests__/fixtures/tool-probe/npm-dist-tags-missing-scoped.txt

@@ -0,0 +1,4 @@
+# captured 2026-09-12 00:50 AEST, read-only GET: curl -sS 'https://registry.npmjs.org/-/package/%40nope-xyz%2Fdoes-not-exist-zz/dist-tags'
+# http 401 — the registry answers 401, not 404, for a scoped name that does not exist (status trailer removed)
+"Unauthorized"
+# http=401

package/src/__tests__/fixtures/tool-probe/npm-dist-tags-openai-codex.txt

@@ -0,0 +1,4 @@
+# captured 2026-09-12 00:50 AEST, read-only GET (verifies A3: a scoped name with / encoded as %2F answers):
+# curl -sS 'https://registry.npmjs.org/-/package/%40openai%2Fcodex/dist-tags'   (http 200; curl's status trailer removed)
+{"beta":"0.1.2505172116","native":"0.1.2505291658","linux-arm64":"0.154.0-linux-arm64","latest":"0.154.0","linux-x64":"0.154.0-linux-x64","win32-arm64":"0.154.0-win32-arm64","darwin-arm64":"0.154.0-darwin-arm64","darwin-x64":"0.154.0-darwin-x64","win32-x64":"0.154.0-win32-x64","alpha-darwin-arm64":"0.155.0-alpha.3.9-darwin-arm64","alpha":"0.155.0-alpha.3.9","alpha-linux-arm64":"0.155.0-alpha.3.9-linux-arm64","alpha-darwin-x64":"0.155.0-alpha.3.9-darwin-x64","alpha-linux-x64":"0.155.0-alpha.3.9-linux-x64","alpha-win32-x64":"0.155.0-alpha.3.9-win32-x64","alpha-win32-arm64":"0.155.0-alpha.3.9-win32-arm64"}
+# http=200

package/src/__tests__/fixtures/tool-probe/pypi-cowsay.txt

@@ -0,0 +1,3 @@
+# captured 2026-09-12 00:50 AEST, read-only GET: curl -sS https://pypi.org/pypi/cowsay/json
+# TRIMMED to info.name + info.version (the full body is ~100 KB of releases); the values are verbatim
+{"info":{"name":"cowsay","version":"6.1"}}

package/src/__tests__/fixtures/tool-probe/uv-receipt-browser-use.toml

@@ -0,0 +1,10 @@
+# captured 2026-09-12 00:42 AEST, read-only: cat ~/.local/share/uv/tools/browser-use/uv-receipt.toml (uv 0.11.15)
+[tool]
+requirements = [{ name = "browser-use" }]
+entrypoints = [
+    { name = "browser", install-path = "/Users/jack/.local/bin/browser", from = "browser-use" },
+    { name = "browser-use", install-path = "/Users/jack/.local/bin/browser-use", from = "browser-use" },
+    { name = "browser-use-tui", install-path = "/Users/jack/.local/bin/browser-use-tui", from = "browser-use" },
+    { name = "browseruse", install-path = "/Users/jack/.local/bin/browseruse", from = "browser-use" },
+    { name = "bu", install-path = "/Users/jack/.local/bin/bu", from = "browser-use" },
+]

package/src/__tests__/fixtures/tool-probe/uv-receipt-cowsay-git.toml

@@ -0,0 +1,8 @@
+# captured 2026-09-12 00:55 AEST: UV_TOOL_DIR=$SESSION/validation/captures/uv-scratch/tools UV_TOOL_BIN_DIR=$SESSION/validation/captures/uv-scratch/bin UV_CACHE_DIR=$SESSION/validation/captures/uv-scratch/cache UV_PYTHON_INSTALL_DIR=$SESSION/validation/captures/uv-scratch/python NO_COLOR=1 uv tool install --force git+https://github.com/VaasuDevanS/cowsay-python@v6.1
+# then: cat $SESSION/validation/captures/uv-scratch/tools/cowsay/uv-receipt.toml
+# $SESSION = claudish worktree update-fix2 ai-docs/sessions/dev-feature-magus-unify-20260911-2240 (the user's real uv tools were never touched)
+[tool]
+requirements = [{ name = "cowsay", git = "https://github.com/VaasuDevanS/cowsay-python?rev=v6.1" }]
+entrypoints = [
+    { name = "cowsay", install-path = "/Users/jack/mag/claudish/.claude/worktrees/update-fix2/ai-docs/sessions/dev-feature-magus-unify-20260911-2240/validation/captures/uv-scratch/bin/cowsay", from = "cowsay" },
+]

package/src/__tests__/fixtures/tool-probe/uv-receipt-cowsay-pinned.toml

@@ -0,0 +1,8 @@
+# captured 2026-09-12 00:54 AEST: UV_TOOL_DIR=$SESSION/validation/captures/uv-scratch/tools UV_TOOL_BIN_DIR=$SESSION/validation/captures/uv-scratch/bin UV_CACHE_DIR=$SESSION/validation/captures/uv-scratch/cache UV_PYTHON_INSTALL_DIR=$SESSION/validation/captures/uv-scratch/python NO_COLOR=1 uv tool install 'cowsay==6.0'
+# then: cat $SESSION/validation/captures/uv-scratch/tools/cowsay/uv-receipt.toml
+# $SESSION = claudish worktree update-fix2 ai-docs/sessions/dev-feature-magus-unify-20260911-2240 (the user's real uv tools were never touched)
+[tool]
+requirements = [{ name = "cowsay", specifier = "==6.0" }]
+entrypoints = [
+    { name = "cowsay", install-path = "/Users/jack/mag/claudish/.claude/worktrees/update-fix2/ai-docs/sessions/dev-feature-magus-unify-20260911-2240/validation/captures/uv-scratch/bin/cowsay", from = "cowsay" },
+]

package/src/__tests__/fixtures/tool-probe/uv-receipt-graphifyy.toml

@@ -0,0 +1,7 @@
+# captured 2026-09-12 00:42 AEST, read-only: cat ~/.local/share/uv/tools/graphifyy/uv-receipt.toml (uv 0.11.15)
+[tool]
+requirements = [{ name = "graphifyy", extras = ["mcp"] }]
+entrypoints = [
+    { name = "graphify", install-path = "/Users/jack/.local/bin/graphify", from = "graphifyy" },
+    { name = "graphify-mcp", install-path = "/Users/jack/.local/bin/graphify-mcp", from = "graphifyy" },
+]

package/src/__tests__/fixtures/tool-probe/uv-receipt-mcp.toml

@@ -0,0 +1,6 @@
+# captured 2026-09-12 00:42 AEST, read-only: cat ~/.local/share/uv/tools/mcp/uv-receipt.toml (uv 0.11.15)
+[tool]
+requirements = [{ name = "mcp" }]
+entrypoints = [
+    { name = "mcp", install-path = "/Users/jack/.local/bin/mcp", from = "mcp" },
+]

package/src/__tests__/fixtures/tool-probe/uv-receipt-serena-agent.toml

@@ -0,0 +1,9 @@
+# captured 2026-09-12 00:42 AEST, read-only: cat ~/.local/share/uv/tools/serena-agent/uv-receipt.toml (uv 0.11.15)
+[tool]
+requirements = [{ name = "serena-agent" }]
+python = "3.13"
+entrypoints = [
+    { name = "serena", install-path = "/Users/jack/.local/bin/serena", from = "serena-agent" },
+    { name = "serena-agent", install-path = "/Users/jack/.local/bin/serena-agent", from = "serena-agent" },
+    { name = "serena-hooks", install-path = "/Users/jack/.local/bin/serena-hooks", from = "serena-agent" },
+]

package/src/__tests__/fixtures/tool-probe/uv-tool-list-outdated-pinned.txt

@@ -0,0 +1,5 @@
+# captured 2026-09-12 00:54 AEST: UV_TOOL_DIR=$SESSION/validation/captures/uv-scratch/tools UV_TOOL_BIN_DIR=$SESSION/validation/captures/uv-scratch/bin UV_CACHE_DIR=$SESSION/validation/captures/uv-scratch/cache UV_PYTHON_INSTALL_DIR=$SESSION/validation/captures/uv-scratch/python NO_COLOR=1 uv tool list --outdated   (exit=0)
+# cowsay was installed as 'cowsay==6.0' (receipt specifier ==6.0); uv still lists it as outdated.
+# $SESSION = claudish worktree update-fix2 ai-docs/sessions/dev-feature-magus-unify-20260911-2240 (the user's real uv tools were never touched)
+cowsay v6.0 [latest: 6.1]
+- cowsay

package/src/__tests__/fixtures/tool-probe/uv-tool-list-outdated.txt

@@ -0,0 +1,11 @@
+# captured 2026-09-12 00:42 AEST on the reporter's machine, read-only: uv tool list --outdated   (uv 0.11.15, exit=0)
+# Same text as the 2026-09-11 23:12 baseline. browser-use and mcp are absent: current.
+claude-swap v0.24.1 [latest: 0.26.0]
+- claude-swap
+- cswap
+graphifyy v0.9.50 [latest: 0.9.58]
+- graphify
+- graphify-mcp
+mistral-vibe v2.5.0 [latest: 2.25.3]
+- vibe
+- vibe-acp

package/src/__tests__/fixtures/tool-probe/uv-tool-list.txt

@@ -0,0 +1,22 @@
+# captured 2026-09-12 00:42 AEST on the reporter's machine, read-only: uv tool list   (uv 0.11.15, exit=0)
+browser-use v0.13.10
+- browser
+- browser-use
+- browser-use-tui
+- browseruse
+- bu
+claude-swap v0.24.1
+- claude-swap
+- cswap
+graphifyy v0.9.50
+- graphify
+- graphify-mcp
+mcp v2.2.0
+- mcp
+mistral-vibe v2.5.0
+- vibe
+- vibe-acp
+serena-agent v1.7.0
+- serena
+- serena-agent
+- serena-hooks

package/src/__tests__/footer-hints.test.ts

@@ -0,0 +1,40 @@
+/**
+ * `joinKeys` decides how a key group reads in the footer chip.
+ *
+ * Found on screen, not in review: the Models tab advertised apply as `Entera`, and the
+ * layout's own scroll hint had been rendering as `^U/^DPgUp/Dn` on EVERY screen in the app.
+ * Both are two key names concatenated with nothing between them, which reads as one key that
+ * does not exist.
+ */
+import { describe, expect, test } from "bun:test";
+import { joinKeys } from "../ui/components/layout/FooterHints.js";
+
+describe("joinKeys", () => {
+	test("single-character keys butt together, the way an arrow pair is written", () => {
+		expect(joinKeys(["↑", "↓"])).toBe("↑↓");
+		expect(joinKeys(["j", "k"])).toBe("jk");
+	});
+
+	test("one key is itself", () => {
+		expect(joinKeys(["U"])).toBe("U");
+		expect(joinKeys(["Enter"])).toBe("Enter");
+	});
+
+	test("named keys get a gap — the regression this exists for", () => {
+		expect(joinKeys(["Enter", "a"])).toBe("Enter a");
+		expect(joinKeys(["^U/^D", "PgUp/Dn"])).toBe("^U/^D PgUp/Dn");
+	});
+
+	test("a space, not a slash: several key names already contain one", () => {
+		expect(joinKeys(["^U/^D", "PgUp/Dn"])).not.toContain("//");
+	});
+
+	test("a multi-byte single character still counts as one", () => {
+		// "↑".length is 1 but an emoji's is 2 — count code points, not UTF-16 units.
+		expect(joinKeys(["⌘", "⇧"])).toBe("⌘⇧");
+	});
+
+	test("an empty group is empty rather than a stray separator", () => {
+		expect(joinKeys([])).toBe("");
+	});
+});

package/src/__tests__/format-command.test.ts

@@ -0,0 +1,78 @@
+/**
+ * `formatCommand` renders a Command for a human, and must not lie.
+ *
+ * Two properties, and they pull in opposite directions:
+ *
+ *  1. **Display neutrality.** Every token magus actually builds is
+ *     shell-safe, so the rendered line must be byte-identical to the string
+ *     these builders produced before commands became argv. That is what lets
+ *     item 3 land without touching `install`/`doctor` output.
+ *     `doctor-bins.test.ts` is the end-to-end gate on that; these are the unit.
+ *  2. **A dangerous token must LOOK dangerous.** If a package name ever did
+ *     contain shell syntax, printing it bare would show the reader a command
+ *     that does something other than what runs. Quoting it makes the
+ *     one-token-ness visible.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { type Command, formatCommand } from "../utils/command-utils.js";
+
+const c = (cmd: string, ...args: string[]): Command => ({ cmd, args });
+
+describe("formatCommand — display neutrality", () => {
+	test("every token this codebase really builds renders unquoted", () => {
+		// Sampled from the actual builders: npm scopes, version pins in both
+		// syntaxes, go module paths, long flags. If quoting ever fires for one of
+		// these, some install/doctor output changed.
+		expect(formatCommand(c("bun", "install", "-g", "claudish@1.2.0"))).toBe(
+			"bun install -g claudish@1.2.0",
+		);
+		expect(
+			formatCommand(c("npm", "install", "-g", "@anthropic-ai/claude-code")),
+		).toBe("npm install -g @anthropic-ai/claude-code");
+		expect(formatCommand(c("uv", "tool", "install", "aider==0.1"))).toBe(
+			"uv tool install aider==0.1",
+		);
+		expect(formatCommand(c("go", "install", "github.com/x/t@latest"))).toBe(
+			"go install github.com/x/t@latest",
+		);
+		expect(
+			formatCommand(
+				c("python3", "-m", "pip", "install", "--user", "--upgrade", "aider"),
+			),
+		).toBe("python3 -m pip install --user --upgrade aider");
+		expect(formatCommand(c("brew", "install", "tmux"))).toBe(
+			"brew install tmux",
+		);
+	});
+
+	test("a command with no arguments renders as just the executable", () => {
+		expect(formatCommand(c("brew"))).toBe("brew");
+	});
+});
+
+describe("formatCommand — a dangerous token is made visible", () => {
+	test("shell metacharacters are single-quoted", () => {
+		expect(formatCommand(c("bun", "install", "-g", "a b; rm -rf /"))).toBe(
+			"bun install -g 'a b; rm -rf /'",
+		);
+		expect(formatCommand(c("bun", "install", "-g", "$(id)"))).toBe(
+			"bun install -g '$(id)'",
+		);
+		expect(formatCommand(c("bun", "install", "-g", "a|b"))).toBe(
+			"bun install -g 'a|b'",
+		);
+	});
+
+	test("an embedded single quote closes, escapes and reopens", () => {
+		// `'\''` is the only POSIX-portable way: a single-quoted string has no
+		// escape character at all, so the quote must be left and re-entered.
+		expect(formatCommand(c("x", "it's"))).toBe(`x 'it'\\''s'`);
+	});
+
+	test("an empty argument is quoted so it does not vanish", () => {
+		// Unquoted it would render as nothing, and the reader would be shown a
+		// command with fewer arguments than the one that runs.
+		expect(formatCommand(c("x", "", "y"))).toBe("x '' y");
+	});
+});