osdy-pi 1.11.2 → 1.11.4

package/extensions/osdy-pi/control-center-account.test.ts

@@ -0,0 +1,241 @@
+import assert from "node:assert/strict";
+import { existsSync } from "node:fs";
+import { registerHooks } from "node:module";
+import test from "node:test";
+import type { ProfileCodexUsageResult } from "./profile-codex-usage.js";
+import { fileURLToPath } from "node:url";
+registerHooks({ resolve(specifier, context, next) {
+	if (specifier.startsWith(".") && specifier.endsWith(".js") && context.parentURL?.endsWith(".ts")) {
+		const url = new URL(`${specifier.slice(0, -3)}.ts`, context.parentURL);
+		if (existsSync(fileURLToPath(url))) return { shortCircuit: true, url: url.href };
+	}
+	return next(specifier, context);
+} });
+const { createControlCenterAccount, bindControlCenterAccount } = await import("./control-center-account.js");
+
+void test("Profile preview is explicit, independently selected and never activates", async () => {
+	const requests: string[] = [];
+	const service = createControlCenterAccount({
+		profiles: () => Promise.resolve(["work", "personal"]), active: () => "work",
+		defaultProfile: () => Promise.resolve(undefined),
+		switch: () => { throw new Error("activation forbidden"); }, setDefault: () => { throw new Error("write forbidden"); },
+		usage: profile => {
+			requests.push(profile);
+			return Promise.resolve({ status: "ready", profile, checkedAt: 1000, quotaSnapshot: { fetchedAt: 1000,
+				planType: undefined, ordinaryUsageAllowed: undefined, credits: undefined,
+				buckets: [
+					{ id: "codex", label: undefined, primary: { usedPercent: 25, windowMinutes: 300, resetsAt: 2000 }, secondary: { usedPercent: 80, windowMinutes: 10080, resetsAt: undefined } },
+					{ id: "extra", label: "Extra bucket", primary: { usedPercent: 10, windowMinutes: undefined, resetsAt: undefined }, secondary: undefined },
+				] } });
+		},
+	});
+	const initial = await service.read();
+	assert.deepEqual(requests, []);
+	assert.equal(initial.rows[0]?.label, "View usage: work");
+	assert.ok(initial.rows.findIndex(row => row.label === "View usage: personal") < initial.rows.findIndex(row => row.label === "Switch to personal"));
+	for (const profile of ["work", "personal"]) {
+		assert.equal((await service.apply({ kind: "account-usage", profile })).failed, false);
+		const row = (await service.read()).rows.find(row => row.label === `View usage: ${profile}`);
+		assert.match(row?.details?.join(" ") ?? "", /75% remaining/);
+		assert.match(row?.details?.join(" ") ?? "", /Weekly: 20% remaining.*Next reset: unknown/);
+		assert.match(row?.details?.join(" ") ?? "", /Extra bucket.*90% remaining.*Next reset: unknown/);
+		assert.ok(row?.details?.includes(`Profile: ${profile}`));
+		assert.ok(row?.details?.includes(`Checked: ${new Date(1000).toLocaleString()} (local time)`));
+		assert.ok(row?.details?.some(line => line.endsWith(`Next reset: ${new Date(2000 * 1000).toLocaleString()}`)));
+	}
+	assert.deepEqual(requests, ["work", "personal"]);
+});
+
+void test("Profile preview preserves timestamp units and marks missing or invalid resets unknown", async () => {
+	const checkedAt = 1_780_000_000_123;
+	for (const resetsAt of [1_780_000_000, 0, undefined, NaN, Infinity, -Infinity, Number.MAX_VALUE]) {
+		const service = createControlCenterAccount({
+			profiles: () => Promise.resolve(["work"]), active: () => "work",
+			defaultProfile: () => Promise.resolve(undefined),
+			switch: () => { throw new Error("activation forbidden"); },
+			setDefault: () => { throw new Error("write forbidden"); },
+			usage: profile => Promise.resolve({ status: "ready", profile, checkedAt,
+				quotaSnapshot: { fetchedAt: checkedAt, planType: undefined, ordinaryUsageAllowed: undefined, credits: undefined,
+					buckets: [{ id: "codex", label: undefined,
+						primary: { usedPercent: 25, windowMinutes: 300, resetsAt },
+						secondary: { usedPercent: 80, windowMinutes: 10080, resetsAt } }] } }),
+		});
+		await service.apply({ kind: "account-usage", profile: "work" });
+		const details = (await service.read()).rows[0]?.details ?? [];
+		assert.ok(details.includes(`Checked: ${new Date(checkedAt).toLocaleString()} (local time)`));
+		const expectedReset = resetsAt === 1_780_000_000 || resetsAt === 0
+			? new Date(resetsAt * 1000).toLocaleString() : "unknown";
+		for (const label of ["Session: 75", "Weekly: 20"]) {
+			assert.ok(details.includes(`codex / ${label}% remaining · Next reset: ${expectedReset}`));
+		}
+	}
+});
+
+void test("Account projects validated metadata, never output or credential fields", async () => {
+	const service = createControlCenterAccount({
+		profiles: () => Promise.resolve(["work", "personal", "../auth.json", { token: "secret" }]),
+		active: () => "work", defaultProfile: () => Promise.resolve({ code: 0, stdout: "personal", stderr: "secret" }),
+		switch: () => Promise.resolve(true), setDefault: () => Promise.resolve(true),
+	});
+	const view = await service.read();
+	assert.match(view.summary, /Current: work.*Default: personal/);
+	assert.equal(JSON.stringify(view).includes("secret"), false);
+	assert.equal(JSON.stringify(view).includes("auth.json"), false);
+	assert.equal(view.rows.some(row => row.label === "Switch to personal"), true);
+});
+
+void test("Account revalidates membership and uses real switch/default adapters", async () => {
+	const calls: string[] = [];
+	const service = createControlCenterAccount({ profiles: () => Promise.resolve(["work"]), active: () => undefined,
+		defaultProfile: () => Promise.resolve({ code: 1, stdout: "secret", stderr: "secret" }),
+		switch: name => { calls.push(`switch:${name}`); return Promise.resolve(true); },
+		setDefault: name => { calls.push(`default:${name ?? "clear"}`); return Promise.resolve(true); },
+	});
+	assert.equal((await service.read()).summary.includes("secret"), false);
+	assert.equal((await service.apply({ kind: "account-switch", profile: "missing" })).failed, true);
+	assert.equal((await service.apply({ kind: "account-switch", profile: "work" })).failed, false);
+	assert.equal((await service.apply({ kind: "account-default", profile: "work" })).failed, false);
+	assert.deepEqual(calls, ["switch:work", "default:work"]);
+});
+
+void test("Unavailable default metadata cannot mark a profile named unavailable as default", async () => {
+	const service = createControlCenterAccount({ profiles: () => Promise.resolve(["unavailable"]), active: () => undefined,
+		defaultProfile: () => Promise.resolve({ code: 1, stdout: "", stderr: "" }),
+		switch: () => Promise.resolve(true), setDefault: () => Promise.resolve(true) });
+	assert.equal((await service.read()).rows.some(row => row.current), false);
+});
+
+void test("Bound Account reuses idle switching, quota refresh, and authoritative default commands", async () => {
+	const previous = process.env.OSDY_PI_PROFILE_NAME;
+	process.env.OSDY_PI_PROFILE_NAME = "personal";
+	const events: string[] = [];
+	const commands: string[][] = [];
+	let idle = false;
+	const service = bindControlCenterAccount({ isIdle: () => idle,
+		waitForIdle: () => { events.push("idle"); idle = true; return Promise.resolve(); },
+		ui: { notify: text => events.push(text), select: () => Promise.reject(new Error("old dialog forbidden")), input: () => Promise.reject(new Error("old dialog forbidden")) } },
+		() => { events.push("refresh"); return Promise.resolve(); }, () => { events.push("render"); },
+		{ profiles: () => Promise.resolve(["work", "personal"]), activate: name => { events.push(`activate:${name}`); return Promise.resolve(); },
+			run: args => { commands.push(args); return Promise.resolve({ code: 0, stdout: "work", stderr: "secret" }); } });
+	try {
+		await service.read();
+		assert.equal((await service.apply({ kind: "account-switch", profile: "work" })).failed, false);
+		assert.deepEqual(events.slice(0, 4), ["idle", "activate:work", "render", "refresh"]);
+		assert.equal(process.env.OSDY_PI_PROFILE_NAME, "work");
+		await service.apply({ kind: "account-default", profile: "work" });
+		await service.apply({ kind: "account-default", profile: undefined });
+		assert.deepEqual(commands, [["account", "default"], ["account", "default", "work"], ["account", "default", "--clear"]]);
+		assert.equal(events.join(" ").includes("secret"), false);
+	} finally {
+		if (previous === undefined) delete process.env.OSDY_PI_PROFILE_NAME;
+		else process.env.OSDY_PI_PROFILE_NAME = previous;
+	}
+});
+
+void test("Bound Account validates live external active names without rendering unsafe metadata", async () => {
+	const previous = process.env.OSDY_PI_PROFILE_NAME;
+	const service = bindControlCenterAccount({ isIdle: () => true, waitForIdle: () => Promise.resolve(),
+		ui: { notify: () => {}, select: () => Promise.resolve(undefined), input: () => Promise.resolve(undefined) } },
+		() => Promise.resolve(), () => {},
+		{ profiles: () => Promise.resolve(["work"]), run: () => Promise.resolve({ code: 0, stdout: "No default account.", stderr: "" }) });
+	try {
+		for (const value of [undefined, "", "../auth.json", "auth.json", "DEFAULT", "token-secret\n", "x".repeat(64)]) {
+			if (value === undefined) delete process.env.OSDY_PI_PROFILE_NAME;
+			else process.env.OSDY_PI_PROFILE_NAME = value;
+			const view = await service.read();
+			assert.match(view.summary, /Current: unmanaged/);
+			assert.equal(view.rows.some(row => row.label === "Switch to work"), true);
+			assert.equal(JSON.stringify(view).includes("token-secret"), false);
+			assert.equal(JSON.stringify(view).includes("auth.json"), false);
+		}
+		process.env.OSDY_PI_PROFILE_NAME = "Work";
+		assert.match((await service.read()).summary, /Current: Work/);
+		assert.equal((await service.read()).rows.some(row => row.label === "Switch to work"), false);
+	} finally {
+		if (previous === undefined) delete process.env.OSDY_PI_PROFILE_NAME;
+		else process.env.OSDY_PI_PROFILE_NAME = previous;
+	}
+});
+
+void test("Account busy guarding rejects overlap without cancelling the first operation", async () => {
+	let finish: (value: boolean) => void = () => {};
+	let switches = 0;
+	const service = createControlCenterAccount({ profiles: () => Promise.resolve(["work"]), active: () => undefined,
+		defaultProfile: () => Promise.resolve(undefined), setDefault: () => Promise.resolve(true),
+		switch: () => { switches++; return new Promise(resolve => { finish = resolve; }); } });
+	const first = service.apply({ kind: "account-switch", profile: "work" });
+	await Promise.resolve(); await Promise.resolve();
+	assert.equal((await service.apply({ kind: "account-switch", profile: "work" })).failed, true);
+	assert.equal(switches, 1); finish(true); assert.equal((await first).failed, false);
+});
+
+void test("Account errors are fixed messages and never leak backend errors", async () => {
+	const service = createControlCenterAccount({ profiles: () => Promise.resolve(["work"]), active: () => "work",
+		defaultProfile: () => Promise.reject(new Error("token-secret")),
+		switch: () => Promise.reject(new Error("token-secret")), setDefault: () => Promise.resolve(false),
+	});
+	assert.equal(JSON.stringify(await service.read()).includes("token-secret"), false);
+	const result = await service.apply({ kind: "account-default", profile: "work" });
+	assert.equal(result.failed, true);
+	assert.equal(result.message.includes("token-secret"), false);
+});
+
+void test("Profile preview cancellation, supersession and stale runtime discard ignored-abort results", async () => {
+	const requests: { signal: AbortSignal; finish: (result: ProfileCodexUsageResult) => void }[] = [];
+	let current = true;
+	const service = createControlCenterAccount({ profiles: () => Promise.resolve(["work", "personal"]), active: () => "work",
+		defaultProfile: () => Promise.resolve(undefined), switch: () => { throw new Error("forbidden"); }, setDefault: () => { throw new Error("forbidden"); },
+		isCurrent: () => current, usage: (_profile, signal) => new Promise(finish => requests.push({ signal, finish })),
+	});
+	const flush = async () => { for (let i = 0; i < 8; i++) await Promise.resolve(); };
+	const first = service.apply({ kind: "account-usage", profile: "work" }); await flush();
+	assert.equal((await service.apply({ kind: "account-default", profile: undefined })).failed, true);
+	const second = service.apply({ kind: "account-usage", profile: "personal" }); await flush();
+	assert.equal(requests[0]?.signal.aborted, true);
+	requests[1]?.finish({ status: "unavailable", profile: "personal", checkedAt: 1000, reason: "remote-usage-unavailable" });
+	await second;
+	requests[0]?.finish({ status: "unavailable", profile: "work", checkedAt: 1000, reason: "stored-credentials-unavailable" }); await first;
+	assert.match(JSON.stringify(await service.read()), /Remote Codex usage unavailable/);
+	assert.doesNotMatch(JSON.stringify(await service.read()), /Stored credentials unavailable \(missing/);
+	const third = service.apply({ kind: "account-usage", profile: "work" }); await flush();
+	service.cancelUsage?.(); assert.equal(requests[2]?.signal.aborted, true);
+	requests[2]?.finish({ status: "unavailable", profile: "work", checkedAt: 1000, reason: "stored-credentials-unavailable" }); await third;
+	assert.doesNotMatch(JSON.stringify(await service.read()), /Checked:/);
+	const fourth = service.apply({ kind: "account-usage", profile: "work" }); await flush(); current = false;
+	requests[3]?.finish({ status: "unavailable", profile: "work", checkedAt: 1000, reason: "stored-credentials-unavailable" }); await fourth;
+	assert.doesNotMatch(JSON.stringify(await service.read()), /Checked:/);
+	assert.equal((await service.apply({ kind: "account-switch", profile: "personal" })).failed, true);
+});
+
+void test("Unavailable, cancelled, absent quota and unexpected errors never fabricate zero or leak raw errors", async () => {
+	for (const outcome of ["stored-credentials-unavailable", "remote-usage-unavailable", "cancelled", "empty", "error"] as const) {
+		const service = createControlCenterAccount({ profiles: () => Promise.resolve(["work"]), active: () => "work",
+			defaultProfile: () => Promise.resolve(undefined), switch: () => Promise.resolve(true), setDefault: () => Promise.resolve(true),
+			usage: profile => {
+				if (outcome === "error") throw new Error("/private/auth.json token-secret");
+				if (outcome === "empty") return Promise.resolve({ status: "ready", profile, checkedAt: 1000,
+					quotaSnapshot: { fetchedAt: 1000, buckets: [], credits: undefined, planType: undefined, ordinaryUsageAllowed: undefined } });
+				if (outcome === "cancelled") return Promise.resolve({ status: "cancelled", profile, checkedAt: 1000, reason: "cancelled" });
+				return Promise.resolve({ status: "unavailable", profile, checkedAt: 1000, reason: outcome });
+			},
+		});
+		await service.apply({ kind: "account-usage", profile: "work" });
+		const text = JSON.stringify(await service.read());
+		assert.doesNotMatch(text, /0%|token-secret|private\/auth/);
+		assert.match(text, outcome === "empty" ? /unknown/ : /unavailable|cancelled/);
+	}
+});
+
+void test("Bound preview uses injected service independently of active refresh and queued stale activation", async () => {
+	let current = true; let release = () => {}; const names: string[] = [];
+	const service = bindControlCenterAccount({ isIdle: () => false, waitForIdle: () => new Promise<void>(resolve => { release = resolve; }),
+		ui: { notify: () => {}, select: () => Promise.resolve(undefined), input: () => Promise.resolve(undefined) } },
+		() => { throw new Error("active quota forbidden"); }, () => {},
+		{ profiles: () => Promise.resolve(["work"]), activate: () => { throw new Error("stale activation forbidden"); }, run: () => Promise.resolve({ code: 0, stdout: "", stderr: "" }) },
+		{ isCurrent: () => current, usage: (profile, signal) => { names.push(profile); assert.equal(signal.aborted, false);
+			return Promise.resolve({ status: "unavailable", profile, checkedAt: 1000, reason: "stored-credentials-unavailable" }); } });
+	await service.apply({ kind: "account-usage", profile: "work" }); assert.deepEqual(names, ["work"]);
+	const switching = service.apply({ kind: "account-switch", profile: "work" });
+	for (let i = 0; i < 8; i++) await Promise.resolve();
+	current = false; release(); assert.equal((await switching).failed, true);
+});

package/extensions/osdy-pi/control-center-account.ts

@@ -0,0 +1,141 @@
+import { createAccountManagementDependencies, isProfileName, readActiveProfileName, readStoredProfileCodexCredential, sharedAgentDir, switchAccountInPlace, type AccountContext, type AccountManagementDependencies } from "./account-profiles.js";
+import type { ControlCenterService, ControlCenterRow, ControlCenterAccountAction } from "./control-center.js";
+import { requestProfileCodexUsage, type ProfileCodexUsageResult } from "./profile-codex-usage.js";
+
+export interface ControlCenterAccountService extends ControlCenterService<ControlCenterAccountAction> {
+	cancelUsage?(): void;
+	isCurrent?(): boolean;
+}
+function localTime(value: number | undefined): string {
+	return value !== undefined && Number.isFinite(value) && !Number.isNaN(new Date(value).getTime())
+		? new Date(value).toLocaleString() : "unknown";
+}
+function localResetTime(unixSeconds: number | undefined): string {
+	return localTime(unixSeconds === undefined ? undefined : unixSeconds * 1000);
+}
+function usageDetails(profile: string, result: ProfileCodexUsageResult): string[] {
+	const lines = [`Profile: ${profile}`, `Checked: ${localTime(result.checkedAt)} (local time)`];
+	if (result.status !== "ready") return [...lines, result.status === "cancelled" ? "Query cancelled." :
+		result.reason === "remote-usage-unavailable" ? "Remote Codex usage unavailable (credentials may be rejected)." : "Stored credentials unavailable (missing, expired or unsupported)."];
+	for (const bucket of result.quotaSnapshot.buckets) {
+		if (!bucket.primary && !bucket.secondary) lines.push(`${bucket.label ?? bucket.id}: quota and next reset unknown.`);
+		for (const [label, window] of [["Session", bucket.primary], ["Weekly", bucket.secondary]] as const) {
+			if (window) lines.push(`${bucket.label ?? bucket.id} / ${label}: ${100 - window.usedPercent}% remaining · Next reset: ${localResetTime(window.resetsAt)}`);
+		}
+	}
+	if (lines.length === 2) lines.push("Quota and next reset: unknown (no quota windows returned).");
+	return lines;
+}
+
+export interface ControlCenterAccountBackend {
+	profiles(): Promise<unknown>;
+	active(): string | undefined;
+	defaultProfile(): Promise<unknown>;
+	switch(profile: string): Promise<boolean>;
+	setDefault(profile: string | undefined): Promise<boolean>;
+	usage?(profile: string, signal: AbortSignal): Promise<ProfileCodexUsageResult>;
+	isCurrent?(): boolean;
+}
+function names(value: unknown): string[] {
+	return Array.isArray(value) ? value.filter((name: unknown): name is string => typeof name === "string" && isProfileName(name)) : [];
+}
+function safeName(value: unknown): string | undefined {
+	return typeof value === "string" && isProfileName(value) ? value : undefined;
+}
+type DefaultMetadata = { kind: "profile"; name: string } | { kind: "unset" | "unavailable" };
+function defaultMetadata(value: unknown): DefaultMetadata {
+	if (typeof value !== "object" || value === null || !("code" in value) || value.code !== 0 || !("stdout" in value) || typeof value.stdout !== "string") return { kind: "unavailable" };
+	const output = value.stdout.trim();
+	if (output === "No default account.") return { kind: "unset" };
+	const name = safeName(output);
+	return name ? { kind: "profile", name } : { kind: "unavailable" };
+}
+
+/** Metadata-only projection. Never interpolate backend stdout/stderr/errors. */
+export function createControlCenterAccount(backend: ControlCenterAccountBackend): ControlCenterAccountService {
+	let busy = false;
+	let controller: AbortController | undefined;
+	let preview: { profile: string; details: string[] } | undefined;
+	const current = () => backend.isCurrent?.() ?? true;
+	const cancelUsage = () => { controller?.abort(); controller = undefined; preview = undefined; };
+	return {
+		cancelUsage,
+		isCurrent: current,
+		async read() {
+			let profiles: string[];
+			try { profiles = names(await backend.profiles()); }
+			catch { return { summary: "Account profiles unavailable", note: "Reopen to retry. Login remains Pi-owned (/login).", rows: [] }; }
+			const active = safeName(backend.active());
+			let metadata: DefaultMetadata = { kind: "unavailable" };
+			try { metadata = defaultMetadata(await backend.defaultProfile()); } catch { /* Fixed metadata state only. */ }
+			const defaultProfile = metadata.kind === "profile" ? metadata.name : undefined;
+			const rows: ControlCenterRow[] = [];
+			for (const profile of profiles) {
+				rows.push({ label: `View usage: ${profile}`, current: false, action: { kind: "account-usage", profile },
+					details: preview?.profile === profile && (backend.isCurrent?.() ?? true) ? preview.details : [`Profile: ${profile}`, "Explicit live Codex query using this profile's stored credentials snapshot; no automatic refresh.", "Missing or expired snapshots are unavailable. Local token history is not quota."] });
+				const current = profile.toLowerCase() === active?.toLowerCase();
+				if (!current) rows.push({ label: `Switch to ${profile}`, current: false, action: { kind: "account-switch", profile }, details: ["Switch in place after Pi is idle; next request uses this account."] });
+				rows.push({ label: `Default: ${profile}`, current: profile.toLowerCase() === defaultProfile?.toLowerCase(), action: { kind: "account-default", profile }, details: [`Profile: ${profile}${current ? " (active)" : ""}`, "Default selects the account for future launcher startup."] });
+			}
+			rows.push({ label: "Clear default", current: false, action: { kind: "account-default", profile: undefined } });
+			return { summary: `Current: ${active ?? "unmanaged"} | Default: ${defaultProfile ?? metadata.kind} | Profiles: ${profiles.length}`,
+				note: "View usage queries Codex only; other actions require confirmation. Login remains Pi-owned (/login).", rows };
+		},
+		async apply(action) {
+			if (action.kind === "account-usage") {
+				if (busy || !current() || !backend.usage || !isProfileName(action.profile)) return { failed: true, message: "Profile usage unavailable." };
+				cancelUsage();
+				const request = new AbortController();
+				controller = request;
+				try {
+					if (!names(await backend.profiles()).includes(action.profile) || request.signal.aborted || !current()) return { failed: true, message: "Profile usage unavailable." };
+					const result = await backend.usage(action.profile, request.signal);
+					if (controller !== request || request.signal.aborted || !current()) return { failed: true, message: "Query cancelled." };
+					preview = { profile: action.profile, details: usageDetails(action.profile, result) };
+					return { failed: result.status !== "ready", message: result.status === "ready" ? "Stored-profile Codex usage checked." : "Profile usage unavailable." };
+				} catch {
+					if (controller === request && !request.signal.aborted && current()) preview = { profile: action.profile, details: [`Profile: ${action.profile}`, "Checked: unknown", "Profile usage unavailable."] };
+					return { failed: true, message: "Profile usage unavailable." };
+				} finally { if (controller === request) controller = undefined; }
+			}
+			if (busy || controller || !current() || (action.kind !== "account-switch" && action.kind !== "account-default")) return { failed: true, message: "Account action unavailable." };
+			busy = true;
+			try {
+				const profile = action.profile;
+				if (profile !== undefined && (!isProfileName(profile) || !names(await backend.profiles()).includes(profile))) return { failed: true, message: "Profile no longer available. Reopen Account." };
+				if (!current()) return { failed: true, message: "Account action unavailable." };
+				if (action.kind === "account-switch" && action.profile.toLowerCase() === safeName(backend.active())?.toLowerCase()) return { failed: false, message: "Account already active." };
+				const success = action.kind === "account-switch" ? await backend.switch(action.profile) : await backend.setDefault(profile);
+				if (!success) return { failed: true, message: "Account operation failed; change not confirmed." };
+				const message = action.kind === "account-switch"
+					? "Account switched; next request uses it."
+					: "Default account saved.";
+				return { failed: false, message };
+			} catch { return { failed: true, message: "Account operation failed; change not confirmed." }; }
+			finally { busy = false; }
+		},
+	};
+}
+
+export function bindControlCenterAccount(ctx: AccountContext, refreshUsage: () => Promise<void>, requestRender: () => void,
+	backend: AccountManagementDependencies = createAccountManagementDependencies({ refreshUsage, requestRender }),
+	options: { isCurrent?: () => boolean; usage?: ControlCenterAccountBackend["usage"] } = {},
+): ControlCenterAccountService {
+	return createControlCenterAccount({
+		isCurrent: options.isCurrent ?? (() => true),
+		usage: options.usage ?? ((profile, signal) => requestProfileCodexUsage(profile, {
+			readCredentials: async name => readStoredProfileCodexCredential(await sharedAgentDir(process.env), name), signal,
+		})),
+		profiles: () => backend.profiles(), active: readActiveProfileName,
+		defaultProfile: () => backend.run(["account", "default"]),
+		switch: profile => backend.activate ? switchAccountInPlace(ctx, profile, async name => {
+			if (!(options.isCurrent?.() ?? true) || !ctx.isIdle()) throw new Error("Account action unavailable.");
+			await backend.activate!(name);
+		}, refreshUsage, requestRender) : Promise.resolve(false),
+		setDefault: async profile => {
+			if (!ctx.isIdle()) await ctx.waitForIdle();
+			if (!(options.isCurrent?.() ?? true) || !ctx.isIdle()) return false;
+			return (await backend.run(["account", "default", profile ?? "--clear"])).code === 0;
+		},
+	});
+}

package/extensions/osdy-pi/control-center-agents.test.ts

@@ -0,0 +1,107 @@
+import assert from "node:assert/strict";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { registerHooks } from "node:module";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+registerHooks({ resolve(specifier, context, next) {
+	if (specifier.startsWith(".") && specifier.endsWith(".js") && context.parentURL?.endsWith(".ts")) {
+		const url = new URL(`${specifier.slice(0, -3)}.ts`, context.parentURL);
+		if (existsSync(fileURLToPath(url))) return { shortCircuit: true, url: url.href };
+	}
+	return next(specifier, context);
+} });
+const { createControlCenterAgents } = await import("./control-center-agents.js");
+
+function fixture() {
+	const home = mkdtempSync(join(tmpdir(), "osdy-cc08-"));
+	const agentDir = join(home, ".pi", "agent");
+	mkdirSync(agentDir, { recursive: true });
+	const path = join(agentDir, "settings.json");
+	writeFileSync(path, JSON.stringify({ packages: [{ source: "npm:gentle-pi", extensions: ["!unrelated.ts"], themes: [] }, "npm:unrelated"], unrelated: true }));
+	let installs = 0;
+	const options = { home, agentDir, cwd: home, env: {}, isIdle: () => true, install: () => {
+		installs++;
+		const settings = JSON.parse(readFileSync(path, "utf8")) as { packages: unknown[] };
+		settings.packages.push("npm:pi-subagents-j0k3r");
+		writeFileSync(path, JSON.stringify(settings));
+		return Promise.resolve();
+	} };
+	return { options, path, installs: () => installs };
+}
+
+void test("Agents read is inspection-only and describes the confirmed installation and real target", async () => {
+	const f = fixture(); const before = readFileSync(f.path, "utf8");
+	const service = createControlCenterAgents(f.options);
+	assert.equal(f.installs(), 0);
+	const view = await service.read(); await service.read();
+	assert.match(view.summary, /gentle.*Joker.*not installed/i);
+	assert.equal(view.rows.length, 2);
+	const details = view.rows[0]!.details!.join(" ");
+	assert.ok(details.includes(f.path));
+	assert.match(details, /Install npm:pi-subagents-j0k3r if absent/);
+	assert.match(details, /-extensions\/gentle-agents.ts/);
+	assert.match(details, /unrelated.*preserved/i);
+	assert.match(details, /reload.*restart/i);
+	assert.equal(f.installs(), 0); assert.equal(readFileSync(f.path, "utf8"), before);
+});
+
+void test("confirmed Agents selection delegates Joker installation and owned Gentle/Joker filters", async () => {
+	const f = fixture(); const service = createControlCenterAgents(f.options);
+	assert.equal((await service.apply({ kind: "agents-provider", mode: "joker" })).kind, "reload");
+	assert.equal(f.installs(), 1);
+	assert.match(readFileSync(f.path, "utf8"), /-extensions\/gentle-agents.ts/);
+	assert.match((await service.read()).summary, /joker/i);
+	assert.equal((await service.apply({ kind: "agents-provider", mode: "gentle" })).kind, "reload");
+	const saved = JSON.parse(readFileSync(f.path, "utf8")) as { packages: unknown[]; unrelated: boolean; osdyPiJokerExclusionOwned: boolean };
+	assert.deepEqual(saved.packages[0], { source: "npm:gentle-pi", extensions: ["!unrelated.ts"], themes: [] });
+	assert.equal(saved.packages[1], "npm:unrelated");
+	assert.deepEqual(saved.packages[2], { source: "npm:pi-subagents-j0k3r", extensions: ["-./index.ts"] });
+	assert.equal(saved.unrelated, true); assert.equal(saved.osdyPiJokerExclusionOwned, true);
+	assert.equal(f.installs(), 1);
+});
+
+void test("isolated Agents owner guard blocks rows, installs and writes even for a personal target", async () => {
+	for (const override of [true, false]) {
+		const f = fixture(); const before = readFileSync(f.path, "utf8");
+		const service = createControlCenterAgents({ ...f.options,
+			...(override ? { env: { PI_CODING_AGENT_DIR: f.options.agentDir } } : { agentDir: join(f.options.home, "isolated") }) });
+		const view = await service.read();
+		assert.deepEqual(view.rows, []); assert.match(view.note, /normal personal Pi.*isolated|override/i);
+		const result = await service.apply({ kind: "agents-provider", mode: "joker" });
+		assert.equal(result.kind, "rejected"); assert.equal(f.installs(), 0);
+		assert.equal(readFileSync(f.path, "utf8"), before);
+	}
+});
+
+void test("Agents service guards idle, reentrancy and stale owner responses without reload", async () => {
+	const f = fixture(); let idle = false; let current = true; let writes = 0; let finish = () => {};
+	const service = createControlCenterAgents({ ...f.options, isIdle: () => idle, isCurrent: () => current,
+		setup: () => { writes++; return new Promise(resolve => { finish = () => resolve({ installed: false, changed: true, gentleCount: 1 }); }); } });
+	const action = { kind: "agents-provider", mode: "joker" } as const;
+	assert.equal((await service.apply(action)).kind, "rejected"); assert.equal(writes, 0);
+	idle = true; const pending = service.apply(action);
+	assert.equal((await service.apply(action)).kind, "rejected"); assert.equal(writes, 1);
+	current = false; finish(); assert.equal((await pending).kind, "rejected");
+	assert.equal((await service.apply(action)).kind, "rejected"); assert.equal(writes, 1);
+});
+
+void test("Agents omits ineligible Gentle and ignores status from an old session", async () => {
+	const f = fixture(); writeFileSync(f.path, JSON.stringify({ packages: ["npm:pi-subagents-j0k3r"] }));
+	const service = createControlCenterAgents(f.options);
+	assert.deepEqual((await service.read()).rows.map(row => row.label), ["Joker agents"]);
+	const stale = createControlCenterAgents({ ...f.options, isCurrent: () => false });
+	assert.deepEqual((await stale.read()).rows, []);
+	const result = await service.apply({ kind: "agents-provider", mode: "gentle" });
+	assert.equal(result.kind, "rejected"); assert.match(result.message, /eligible personal Gentle/);
+	assert.equal(f.installs(), 0);
+});
+
+void test("Agents owner errors retain honest failure and never request reload", async () => {
+	const f = fixture();
+	const service = createControlCenterAgents({ ...f.options, setup: () => Promise.reject(new Error("synthetic failure")) });
+	const result = await service.apply({ kind: "agents-provider", mode: "joker" });
+	assert.equal(result.kind, "rejected"); assert.match(result.message, /synthetic failure.*Reload not requested/);
+	assert.equal(f.installs(), 0);
+});

package/extensions/osdy-pi/control-center-agents.ts

@@ -0,0 +1,60 @@
+import { join } from "node:path";
+import { inspectJokerAgents, setupJokerAgents, switchAgentMode } from "./agent-coexistence-setup.js";
+import type { ControlCenterDetail, ProviderApplyResult } from "./control-center.js";
+
+export type ControlCenterAgentsAction = { kind: "agents-provider"; mode: "joker" | "gentle" };
+export interface ControlCenterAgentsService {
+	read(): Promise<ControlCenterDetail>;
+	apply(action: ControlCenterAgentsAction): Promise<ProviderApplyResult>;
+}
+
+/** The coexistence owner validates normal personal Pi and owns every install/filter write. */
+export function createControlCenterAgents(options: Parameters<typeof setupJokerAgents>[0] & {
+	isIdle: () => boolean;
+	isCurrent?: () => boolean;
+	inspect?: typeof inspectJokerAgents;
+	setup?: typeof setupJokerAgents;
+	switchMode?: typeof switchAgentMode;
+}): ControlCenterAgentsService {
+	let busy = false;
+	const current = () => options.isCurrent?.() !== false;
+	const target = join(options.agentDir, "settings.json");
+	return {
+		async read() {
+			try {
+				const status = await (options.inspect ?? inspectJokerAgents)(options);
+				if (!current()) return { summary: "Agents status unavailable", note: "Session changed; reopen the panel.", rows: [] };
+				return {
+					summary: `Agent mode: ${status.mode} | Joker: ${status.jokerInstalled ? "installed" : "not installed"} | Gentle entries: ${status.gentleCount}`,
+					note: "Configured provider, not proof of loaded tools. Opening this category never installs or switches agents.",
+					rows: (["joker", "gentle"] as const).filter(mode => mode === "joker" || status.gentleCount > 0).map(mode => ({
+						label: mode === "joker" ? "Joker agents" : "Gentle agents", current: status.mode === mode,
+						action: { kind: "agents-provider", mode },
+						details: [`Target: ${target}`, mode === "joker"
+							? "Select Joker: Install npm:pi-subagents-j0k3r if absent; enable ./index.ts and exclude only -extensions/gentle-agents.ts from eligible Gentle entries."
+							: "Select Gentle: enable extensions/gentle-agents.ts; exclude Joker ./index.ts with the owner's -./index.ts filter. No installation.",
+							"Only owner-managed agent filters change; unrelated resources and installed packages are preserved.",
+							"Successful save closes this panel before resource reload; restart Pi if reload fails."],
+					})),
+				};
+			} catch (error) {
+				return { summary: "Agents status unavailable", note: error instanceof Error ? error.message : "Inspection failed; reopen to retry.", rows: [] };
+			}
+		},
+		async apply(action) {
+			if (busy || !current() || !options.isIdle())
+				return { kind: "rejected", message: "Agents selection requires the current idle session; nothing changed." };
+			busy = true;
+			try {
+				if (action.mode === "joker") await (options.setup ?? setupJokerAgents)(options);
+				else await (options.switchMode ?? switchAgentMode)({ ...options, mode: "off" });
+				if (!current()) return { kind: "rejected", message: "Session changed after the owner operation; reload not requested. Reopen status in the current session." };
+				return { kind: "reload", message: "Agents selection saved. Reloading resources; restart Pi if reload fails." };
+			} catch (error) {
+				return { kind: "rejected", message: `Agents selection failed: ${error instanceof Error ? error.message : "unknown error"}. Reload not requested.` };
+			} finally {
+				busy = false;
+			}
+		},
+	};
+}

package/extensions/osdy-pi/control-center-git.test.ts

@@ -0,0 +1,48 @@
+import assert from "node:assert/strict";
+import { existsSync } from "node:fs";
+import { registerHooks } from "node:module";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+registerHooks({ resolve(specifier, context, nextResolve) {
+	if (specifier.startsWith(".") && specifier.endsWith(".js") && context.parentURL?.endsWith(".ts")) {
+		const url = new URL(`${specifier.slice(0, -3)}.ts`, context.parentURL);
+		if (existsSync(fileURLToPath(url))) return { shortCircuit: true, url: url.href };
+	}
+	return nextResolve(specifier, context);
+} });
+const { createControlCenterGit } = await import("./control-center-git.js");
+void test("Git reads branch/status only and delegates persisted enabled changes to its shared owner", async () => {
+	let enabled = true;
+	const calls: string[][] = [];
+	const applied: boolean[] = [];
+	const service = createControlCenterGit({
+		snapshot: () => ({ enabled, placement: "aboveEditor" }),
+		exec: (args) => {
+			calls.push(args);
+			if (args.includes("branch")) return Promise.resolve("feature\n");
+			if (args.includes("status")) return Promise.resolve(" M file.ts\n?? new.ts\n");
+			throw new Error("Unexpected Git inspection command");
+		},
+		applyEnabled: (value) => { enabled = value; applied.push(value); return Promise.resolve(true); },
+	});
+	const view = await service.read();
+	assert.match(view.summary, /Branch: feature.*2 changed/);
+	assert.match(view.note, /aboveEditor.*session.*read-only/i);
+	assert.deepEqual(calls, [
+		["--no-optional-locks", "branch", "--show-current"],
+		["--no-optional-locks", "status", "--short", "--untracked-files=normal"],
+	]);
+	assert.deepEqual(applied, []);
+	assert.equal((await service.apply({ kind: "git-enabled", value: false })).failed, false);
+	assert.deepEqual(applied, [false]);
+	assert.equal((await service.read()).rows[1]?.current, true);
+});
+void test("Git unavailable and failed persistence are honest, without new workflows", async () => {
+	const service = createControlCenterGit({ snapshot: () => ({ enabled: false, placement: "belowEditor" }),
+		exec: () => Promise.reject(new Error("not a repository")), applyEnabled: () => Promise.resolve(false) });
+	assert.match((await service.read()).summary, /unavailable/);
+	assert.match((await service.apply({ kind: "git-enabled", value: true })).message, /Applied live.*could not be saved/);
+	const detached = createControlCenterGit({ snapshot: () => ({ enabled: true, placement: "aboveEditor" }),
+		exec: () => Promise.resolve(""), applyEnabled: () => Promise.resolve(true) });
+	assert.match((await detached.read()).summary, /detached.*clean/);
+});

package/extensions/osdy-pi/control-center-git.ts

@@ -0,0 +1,40 @@
+import type { ControlCenterService } from "./control-center.js";
+import type { WorkingTreePlacement } from "./types.js";
+
+interface GitDependencies {
+	snapshot(): { enabled: boolean; placement: WorkingTreePlacement };
+	exec(args: string[]): Promise<string>;
+	applyEnabled(value: boolean): Promise<boolean>;
+}
+
+/** Read-only Git inspection; the runtime retains ownership of widget persistence. */
+export function createControlCenterGit(dependencies: GitDependencies): ControlCenterService {
+	return {
+		async read() {
+			let summary: string;
+			try {
+				const [branch, status] = await Promise.all([
+					dependencies.exec(["--no-optional-locks", "branch", "--show-current"]),
+					dependencies.exec(["--no-optional-locks", "status", "--short", "--untracked-files=normal"]),
+				]);
+				const changed = status.split("\n").filter((line) => line.trim()).length;
+				summary = `Branch: ${branch.trim() || "detached HEAD"} | ${changed ? `${changed} changed entries` : "working tree clean"}`;
+			} catch {
+				summary = "Git branch/worktree unavailable (not a repository or inspection failed).";
+			}
+			const state = dependencies.snapshot();
+			return {
+				summary,
+				note: `Position: ${state.placement} (session detail, read-only). Inspection never writes Git.`,
+				rows: [true, false].map((value) => ({ label: `Working-tree widget: ${value ? "enabled" : "disabled"}`,
+					current: state.enabled === value, action: { kind: "git-enabled" as const, value } })),
+			};
+		},
+		async apply(action) {
+			if (action.kind !== "git-enabled") return { failed: true, message: "Not a Git preference action" };
+			const saved = await dependencies.applyEnabled(action.value);
+			return { failed: !saved, message: saved ? "Saved globally: working-tree widget"
+				: "Applied live: working-tree widget, but could not be saved. Retry to persist." };
+		},
+	};
+}