pennyrouter 0.2.4 → 0.2.8

package/src/statusline.js

@@ -1,202 +1,202 @@
-// Claude Code statusline integration.
-//
-// Install drops a standalone node script (no deps) and points Claude Code's
-// `statusLine` setting at it. If the user already had a statusLine command, it is
-// PRESERVED: the original command is stored in the statusline config file and the
-// script runs it first, appending the PennyRouter segment to its output — uninstall
-// restores the original verbatim.
-//
-// The script never blocks on the network: it prints from a per-session cache file and
-// spawns a detached refresh (GET /v1/penny/statusline/<session_id> on the gateway,
-// authed with the pr- key already in Claude Code's settings). The gateway keys that
-// endpoint on the CC session uuid it sees in every request's metadata.user_id — the
-// same uuid Claude Code hands the statusline script on stdin.
-
-import { statePath, atomicWrite, readJsonFile, writeJsonFile } from "./state.js";
-
-export const STATUSLINE_SCRIPT_BASENAME = "claude-statusline.mjs";
-export const STATUSLINE_CONFIG_BASENAME = "claude-statusline.json";
-
-export function statuslineScriptPath() {
-  return statePath(STATUSLINE_SCRIPT_BASENAME);
-}
-
-function statuslineConfigPath() {
-  return statePath(STATUSLINE_CONFIG_BASENAME);
-}
-
-function isOurCommand(command) {
-  return typeof command === "string" && command.includes(STATUSLINE_SCRIPT_BASENAME);
-}
-
-// Mutates `current` (the parsed ~/.claude/settings.json object) to point statusLine at
-// our script; writes the script + config files. The caller persists `current`.
-export async function configureClaudeCodeStatusline(current) {
-  const existing = current.statusLine;
-  const config = (await readJsonFile(statuslineConfigPath(), null)) || {};
-  if (existing && existing.type === "command" && existing.command && !isOurCommand(existing.command)) {
-    // A user-authored statusline: wrap it, and remember it for uninstall. Never
-    // overwrite a previously captured wrap with our own command (re-install case).
-    config.wrap_command = existing.command;
-    if (existing.padding !== undefined) config.wrap_padding = existing.padding;
-  }
-  config.refresh_seconds = config.refresh_seconds ?? 15;
-  await writeJsonFile(statuslineConfigPath(), config);
-  await atomicWrite(statuslineScriptPath(), STATUSLINE_SCRIPT);
-  current.statusLine = {
-    type: "command",
-    command: `node "${statuslineScriptPath()}"`,
-    ...(existing?.padding !== undefined ? { padding: existing.padding } : {}),
-  };
-  return { script_path: statuslineScriptPath(), wrapped: Boolean(config.wrap_command) };
-}
-
-// Mutates `current` to undo configureClaudeCodeStatusline: restore the user's original
-// statusline command if we wrapped one, otherwise remove the setting entirely. A
-// statusLine we didn't write is left untouched.
-export async function restoreClaudeCodeStatusline(current) {
-  if (!current.statusLine || !isOurCommand(current.statusLine.command)) return;
-  const config = (await readJsonFile(statuslineConfigPath(), null)) || {};
-  if (config.wrap_command) {
-    current.statusLine = {
-      type: "command",
-      command: config.wrap_command,
-      ...(config.wrap_padding !== undefined ? { padding: config.wrap_padding } : {}),
-    };
-  } else {
-    delete current.statusLine;
-  }
-}
-
-// The standalone script written to disk. Node >= 18 (global fetch). Keep it dependency-
-// free and fast: read stdin, print from cache, refresh out-of-band.
-const STATUSLINE_SCRIPT = `#!/usr/bin/env node
-// PennyRouter statusline for Claude Code (installed by \`pennyrouter install\`).
-// Prints: [wrapped original statusline (all lines) |] penny segment (penny / penny (sub)
-// / penny (byok) / penny off). The wrapped statusline's first line gets the penny suffix;
-// any further lines (e.g. a context bar) pass through verbatim.
-// Never blocks on the network: reads a per-session cache and refreshes it detached.
-import { readFileSync, mkdirSync, writeFileSync, statSync } from "node:fs";
-import { spawn, spawnSync } from "node:child_process";
-import { join, basename } from "node:path";
-import os from "node:os";
-
-const stateDir = join(
-  process.env.XDG_STATE_HOME || join(os.homedir(), ".local", "state"),
-  "pennyrouter",
-);
-const cacheDir = join(stateDir, "statusline-cache");
-
-function readJson(path) {
-  try { return JSON.parse(readFileSync(path, "utf8")); } catch { return null; }
-}
-
-function claudeEnv() {
-  const settings = readJson(join(os.homedir(), ".claude", "settings.json")) || {};
-  const env = settings.env || {};
-  // A normal install writes base + pr- key into settings.json's env block. Fall back to the
-  // process environment so an out-of-band launch that supplies them there instead — e.g. the
-  // interactive probe, which passes creds via --settings <file> + child env rather than the
-  // user's settings.json — still resolves Penny. Real installs never set these as env vars, so
-  // this fallback is inert for them.
-  const base = env.ANTHROPIC_BASE_URL || process.env.ANTHROPIC_BASE_URL || "";
-  const keyCandidates = [
-    env.ANTHROPIC_API_KEY, env.ANTHROPIC_AUTH_TOKEN,
-    process.env.ANTHROPIC_API_KEY, process.env.ANTHROPIC_AUTH_TOKEN,
-  ];
-  const key = keyCandidates.find((v) => typeof v === "string" && v.startsWith("pr-")) || "";
-  return { base, key };
-}
-
-// --refresh <sessionId>: fetch gateway status into the cache file, then exit.
-if (process.argv[2] === "--refresh") {
-  const sessionId = process.argv[3];
-  const { base, key } = claudeEnv();
-  if (!sessionId || !base || !key) process.exit(0);
-  try {
-    const resp = await fetch(base.replace(/\\/$/, "") + "/v1/penny/statusline/" + sessionId, {
-      headers: { "x-api-key": key },
-      signal: AbortSignal.timeout(4000),
-    });
-    if (resp.ok) {
-      const data = await resp.json();
-      mkdirSync(cacheDir, { recursive: true });
-      writeFileSync(join(cacheDir, sessionId + ".json"), JSON.stringify(data));
-    }
-  } catch { /* best-effort: stale cache beats a broken statusline */ }
-  process.exit(0);
-}
-
-const raw = readFileSync(0, "utf8");
-let input = {};
-try { input = JSON.parse(raw); } catch { /* keep {} */ }
-const sessionId = input.session_id || "";
-const config = readJson(join(stateDir, "claude-statusline.json")) || {};
-const refreshMs = (config.refresh_seconds ?? 15) * 1000;
-
-const cachePath = join(cacheDir, sessionId + ".json");
-let cache = sessionId ? readJson(cachePath) : null;
-let cacheAge = Infinity;
-try { cacheAge = Date.now() - statSync(cachePath).mtimeMs; } catch { /* no cache yet */ }
-
-const { base, key } = claudeEnv();
-
-const pennyInstalled = Boolean(base) && Boolean(key);
-if (sessionId && pennyInstalled && cacheAge > refreshMs) {
-  spawn(process.execPath, [process.argv[1], "--refresh", sessionId], {
-    detached: true, stdio: "ignore",
-  }).unref();
-}
-
-// Auth tier suffix: only "sub"/"byok" are shown (penny-tier and unknown render bare).
-function authSuffix(mode) {
-  return mode === "sub" || mode === "byok" ? " (" + mode + ")" : "";
-}
-
-// Teammate badges (@penny ask): 📨 questions waiting on you, 📬 answers that came back.
-// Read from the structured fields rather than the gateway's prebuilt \`label\`, since this
-// line is composed here. Absent on an older gateway, which renders nothing.
-function askBadges(c) {
-  if (!c) return "";
-  let out = "";
-  if (c.asks_open > 0) out += " · 📨 " + c.asks_open;
-  if (c.answers_fresh > 0) out += " · 📬 " + c.answers_fresh;
-  return out;
-}
-
-let penny;
-if (!pennyInstalled) {
-  penny = "🪙 penny off";
-} else if (cache && cache.known && cache.bypass) {
-  penny = "🪙 penny off";
-} else {
-  penny = "🪙 penny" + authSuffix(cache && cache.auth_mode) + askBadges(cache);
-}
-
-let lines;
-if (config.wrap_command) {
-  const run = spawnSync(config.wrap_command, {
-    shell: true, input: raw, encoding: "utf8", timeout: 5000,
-  });
-  lines = (run.stdout || "").replace(/\\n$/, "").split("\\n");
-  if (lines.length === 1 && lines[0] === "") lines = [];
-} else {
-  const model = input.model?.display_name || "";
-  const dir = input.workspace?.current_dir ? basename(input.workspace.current_dir) : "";
-  lines = [[model, dir].filter(Boolean).join(" · ")].filter(Boolean);
-}
-
-if (lines.length === 0) {
-  lines = [penny];
-} else {
-  lines[0] = lines[0].trimEnd() + " | " + penny;
-}
-// Ambient tip: the gateway rotates cache.tip on a slow clock (see tips.statusline_tip).
-// Rendered as its own soft light-green line: visible without competing with the brighter
-// model/context status above it. Absent field
-// (tips off, old gateway, bypass) renders nothing.
-if (pennyInstalled && cache && cache.tip && !cache.bypass) {
-  lines.push("\\x1b[38;5;114m" + cache.tip + "\\x1b[0m");
-}
-console.log(lines.join("\\n"));
-`;
+// Claude Code statusline integration.
+//
+// Install drops a standalone node script (no deps) and points Claude Code's
+// `statusLine` setting at it. If the user already had a statusLine command, it is
+// PRESERVED: the original command is stored in the statusline config file and the
+// script runs it first, appending the PennyRouter segment to its output — uninstall
+// restores the original verbatim.
+//
+// The script never blocks on the network: it prints from a per-session cache file and
+// spawns a detached refresh (GET /v1/penny/statusline/<session_id> on the gateway,
+// authed with the pr- key already in Claude Code's settings). The gateway keys that
+// endpoint on the CC session uuid it sees in every request's metadata.user_id — the
+// same uuid Claude Code hands the statusline script on stdin.
+
+import { statePath, atomicWrite, readJsonFile, writeJsonFile } from "./state.js";
+
+export const STATUSLINE_SCRIPT_BASENAME = "claude-statusline.mjs";
+export const STATUSLINE_CONFIG_BASENAME = "claude-statusline.json";
+
+export function statuslineScriptPath() {
+  return statePath(STATUSLINE_SCRIPT_BASENAME);
+}
+
+function statuslineConfigPath() {
+  return statePath(STATUSLINE_CONFIG_BASENAME);
+}
+
+function isOurCommand(command) {
+  return typeof command === "string" && command.includes(STATUSLINE_SCRIPT_BASENAME);
+}
+
+// Mutates `current` (the parsed ~/.claude/settings.json object) to point statusLine at
+// our script; writes the script + config files. The caller persists `current`.
+export async function configureClaudeCodeStatusline(current) {
+  const existing = current.statusLine;
+  const config = (await readJsonFile(statuslineConfigPath(), null)) || {};
+  if (existing && existing.type === "command" && existing.command && !isOurCommand(existing.command)) {
+    // A user-authored statusline: wrap it, and remember it for uninstall. Never
+    // overwrite a previously captured wrap with our own command (re-install case).
+    config.wrap_command = existing.command;
+    if (existing.padding !== undefined) config.wrap_padding = existing.padding;
+  }
+  config.refresh_seconds = config.refresh_seconds ?? 15;
+  await writeJsonFile(statuslineConfigPath(), config);
+  await atomicWrite(statuslineScriptPath(), STATUSLINE_SCRIPT);
+  current.statusLine = {
+    type: "command",
+    command: `node "${statuslineScriptPath()}"`,
+    ...(existing?.padding !== undefined ? { padding: existing.padding } : {}),
+  };
+  return { script_path: statuslineScriptPath(), wrapped: Boolean(config.wrap_command) };
+}
+
+// Mutates `current` to undo configureClaudeCodeStatusline: restore the user's original
+// statusline command if we wrapped one, otherwise remove the setting entirely. A
+// statusLine we didn't write is left untouched.
+export async function restoreClaudeCodeStatusline(current) {
+  if (!current.statusLine || !isOurCommand(current.statusLine.command)) return;
+  const config = (await readJsonFile(statuslineConfigPath(), null)) || {};
+  if (config.wrap_command) {
+    current.statusLine = {
+      type: "command",
+      command: config.wrap_command,
+      ...(config.wrap_padding !== undefined ? { padding: config.wrap_padding } : {}),
+    };
+  } else {
+    delete current.statusLine;
+  }
+}
+
+// The standalone script written to disk. Node >= 18 (global fetch). Keep it dependency-
+// free and fast: read stdin, print from cache, refresh out-of-band.
+const STATUSLINE_SCRIPT = `#!/usr/bin/env node
+// PennyRouter statusline for Claude Code (installed by \`pennyrouter install\`).
+// Prints: [wrapped original statusline (all lines) |] penny segment (penny / penny (sub)
+// / penny (byok) / penny off). The wrapped statusline's first line gets the penny suffix;
+// any further lines (e.g. a context bar) pass through verbatim.
+// Never blocks on the network: reads a per-session cache and refreshes it detached.
+import { readFileSync, mkdirSync, writeFileSync, statSync } from "node:fs";
+import { spawn, spawnSync } from "node:child_process";
+import { join, basename } from "node:path";
+import os from "node:os";
+
+const stateDir = join(
+  process.env.XDG_STATE_HOME || join(os.homedir(), ".local", "state"),
+  "pennyrouter",
+);
+const cacheDir = join(stateDir, "statusline-cache");
+
+function readJson(path) {
+  try { return JSON.parse(readFileSync(path, "utf8")); } catch { return null; }
+}
+
+function claudeEnv() {
+  const settings = readJson(join(os.homedir(), ".claude", "settings.json")) || {};
+  const env = settings.env || {};
+  // A normal install writes base + pr- key into settings.json's env block. Fall back to the
+  // process environment so an out-of-band launch that supplies them there instead — e.g. the
+  // interactive probe, which passes creds via --settings <file> + child env rather than the
+  // user's settings.json — still resolves Penny. Real installs never set these as env vars, so
+  // this fallback is inert for them.
+  const base = env.ANTHROPIC_BASE_URL || process.env.ANTHROPIC_BASE_URL || "";
+  const keyCandidates = [
+    env.ANTHROPIC_API_KEY, env.ANTHROPIC_AUTH_TOKEN,
+    process.env.ANTHROPIC_API_KEY, process.env.ANTHROPIC_AUTH_TOKEN,
+  ];
+  const key = keyCandidates.find((v) => typeof v === "string" && v.startsWith("pr-")) || "";
+  return { base, key };
+}
+
+// --refresh <sessionId>: fetch gateway status into the cache file, then exit.
+if (process.argv[2] === "--refresh") {
+  const sessionId = process.argv[3];
+  const { base, key } = claudeEnv();
+  if (!sessionId || !base || !key) process.exit(0);
+  try {
+    const resp = await fetch(base.replace(/\\/$/, "") + "/v1/penny/statusline/" + sessionId, {
+      headers: { "x-api-key": key },
+      signal: AbortSignal.timeout(4000),
+    });
+    if (resp.ok) {
+      const data = await resp.json();
+      mkdirSync(cacheDir, { recursive: true });
+      writeFileSync(join(cacheDir, sessionId + ".json"), JSON.stringify(data));
+    }
+  } catch { /* best-effort: stale cache beats a broken statusline */ }
+  process.exit(0);
+}
+
+const raw = readFileSync(0, "utf8");
+let input = {};
+try { input = JSON.parse(raw); } catch { /* keep {} */ }
+const sessionId = input.session_id || "";
+const config = readJson(join(stateDir, "claude-statusline.json")) || {};
+const refreshMs = (config.refresh_seconds ?? 15) * 1000;
+
+const cachePath = join(cacheDir, sessionId + ".json");
+let cache = sessionId ? readJson(cachePath) : null;
+let cacheAge = Infinity;
+try { cacheAge = Date.now() - statSync(cachePath).mtimeMs; } catch { /* no cache yet */ }
+
+const { base, key } = claudeEnv();
+
+const pennyInstalled = Boolean(base) && Boolean(key);
+if (sessionId && pennyInstalled && cacheAge > refreshMs) {
+  spawn(process.execPath, [process.argv[1], "--refresh", sessionId], {
+    detached: true, stdio: "ignore",
+  }).unref();
+}
+
+// Auth tier suffix: only "sub"/"byok" are shown (penny-tier and unknown render bare).
+function authSuffix(mode) {
+  return mode === "sub" || mode === "byok" ? " (" + mode + ")" : "";
+}
+
+// Teammate badges (@penny ask): 📨 questions waiting on you, 📬 answers that came back.
+// Read from the structured fields rather than the gateway's prebuilt \`label\`, since this
+// line is composed here. Absent on an older gateway, which renders nothing.
+function askBadges(c) {
+  if (!c) return "";
+  let out = "";
+  if (c.asks_open > 0) out += " · 📨 " + c.asks_open;
+  if (c.answers_fresh > 0) out += " · 📬 " + c.answers_fresh;
+  return out;
+}
+
+let penny;
+if (!pennyInstalled) {
+  penny = "🪙 penny off";
+} else if (cache && cache.known && cache.bypass) {
+  penny = "🪙 penny off";
+} else {
+  penny = "🪙 penny" + authSuffix(cache && cache.auth_mode) + askBadges(cache);
+}
+
+let lines;
+if (config.wrap_command) {
+  const run = spawnSync(config.wrap_command, {
+    shell: true, input: raw, encoding: "utf8", timeout: 5000,
+  });
+  lines = (run.stdout || "").replace(/\\n$/, "").split("\\n");
+  if (lines.length === 1 && lines[0] === "") lines = [];
+} else {
+  const model = input.model?.display_name || "";
+  const dir = input.workspace?.current_dir ? basename(input.workspace.current_dir) : "";
+  lines = [[model, dir].filter(Boolean).join(" · ")].filter(Boolean);
+}
+
+if (lines.length === 0) {
+  lines = [penny];
+} else {
+  lines[0] = lines[0].trimEnd() + " | " + penny;
+}
+// Ambient tip: the gateway rotates cache.tip on a slow clock (see tips.statusline_tip).
+// Rendered as its own soft light-green line: visible without competing with the brighter
+// model/context status above it. Absent field
+// (tips off, old gateway, bypass) renders nothing.
+if (pennyInstalled && cache && cache.tip && !cache.bypass) {
+  lines.push("\\x1b[38;5;114m" + cache.tip + "\\x1b[0m");
+}
+console.log(lines.join("\\n"));
+`;

package/src/statusline.test.js

@@ -1,72 +1,72 @@
-// Guards against the class of bug found 2026-07-18: an unescaped backtick inside a
-// comment on line 99 of statusline.js terminated the STATUSLINE_SCRIPT template
-// literal early, so every `pennyrouter install` since shipped a syntactically broken
-// generated script — installs succeeded silently, the crash only surfaced later, at
-// Claude Code's next statusline render, in a completely different process.
-//
-// `npm run check` (node --check on every source file) happened to catch this ONE
-// instance because the break also broke the OUTER file's parse — but that's
-// incidental: a subtler bug (backticks that still balance, or valid-looking JS that's
-// semantically wrong) would pass --check on the outer file yet still crash at
-// runtime, because --check never looks at the STRING CONTENT of a template literal.
-// This test extracts the ACTUAL constant (not a source-text regex) and validates the
-// real generated script: syntax-checks it, then executes it end-to-end with a fake
-// stdin payload the way Claude Code actually invokes it, so a broken script fails
-// `npm run check` locally instead of a user's install.
-//
-// No test framework in this package yet — plain assert + a process exit code, run via
-// `node src/statusline.test.js` (wired into `npm run check`).
-import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-
-import { configureClaudeCodeStatusline, statuslineScriptPath } from "./statusline.js";
-
-async function main() {
-  const tmpState = fs.mkdtempSync(path.join(os.tmpdir(), "pr-statusline-test-"));
-  const prevXdg = process.env.XDG_STATE_HOME;
-  process.env.XDG_STATE_HOME = tmpState;
-  try {
-    const current = {};
-    await configureClaudeCodeStatusline(current);
-    const scriptPath = statuslineScriptPath();
-    assert.ok(fs.existsSync(scriptPath), "script file was written");
-
-    // 1. Syntax: node --check on the ACTUAL written file (not a regex-extracted copy).
-    execFileSync(process.execPath, ["--check", scriptPath], { stdio: "pipe" });
-
-    // 2. Behavior: run it the way Claude Code does — JSON on stdin, plain stdout.
-    // The generated script may discover a real Claude config from the invoking user's
-    // home, but must render a valid Penny segment either way. XDG_STATE_HOME is isolated
-    // above, so no cached session state or wrapped command can influence this check.
-    const payload = JSON.stringify({
-      session_id: "test-session",
-      model: { display_name: "Test Model" },
-      workspace: { current_dir: "/tmp" },
-    });
-    const out = execFileSync(process.execPath, [scriptPath], {
-      input: payload, encoding: "utf8", timeout: 5000,
-    });
-    assert.ok(out.includes("🪙 penny"), `expected Penny status segment in output, got: ${out}`);
-    assert.ok(out.includes("Test Model"), `expected model name passed through, got: ${out}`);
-
-    // 3. Malformed stdin must not crash the script (best-effort JSON.parse fallback).
-    const outBadInput = execFileSync(process.execPath, [scriptPath], {
-      input: "not json", encoding: "utf8", timeout: 5000,
-    });
-    assert.ok(outBadInput.length > 0, "script still prints something on bad stdin");
-  } finally {
-    if (prevXdg === undefined) delete process.env.XDG_STATE_HOME;
-    else process.env.XDG_STATE_HOME = prevXdg;
-    fs.rmSync(tmpState, { recursive: true, force: true });
-  }
-
-  console.log("statusline.test.js: all checks passed");
-}
-
-main().catch((err) => {
-  console.error(err);
-  process.exit(1);
-});
+// Guards against the class of bug found 2026-07-18: an unescaped backtick inside a
+// comment on line 99 of statusline.js terminated the STATUSLINE_SCRIPT template
+// literal early, so every `pennyrouter install` since shipped a syntactically broken
+// generated script — installs succeeded silently, the crash only surfaced later, at
+// Claude Code's next statusline render, in a completely different process.
+//
+// `npm run check` (node --check on every source file) happened to catch this ONE
+// instance because the break also broke the OUTER file's parse — but that's
+// incidental: a subtler bug (backticks that still balance, or valid-looking JS that's
+// semantically wrong) would pass --check on the outer file yet still crash at
+// runtime, because --check never looks at the STRING CONTENT of a template literal.
+// This test extracts the ACTUAL constant (not a source-text regex) and validates the
+// real generated script: syntax-checks it, then executes it end-to-end with a fake
+// stdin payload the way Claude Code actually invokes it, so a broken script fails
+// `npm run check` locally instead of a user's install.
+//
+// No test framework in this package yet — plain assert + a process exit code, run via
+// `node src/statusline.test.js` (wired into `npm run check`).
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { configureClaudeCodeStatusline, statuslineScriptPath } from "./statusline.js";
+
+async function main() {
+  const tmpState = fs.mkdtempSync(path.join(os.tmpdir(), "pr-statusline-test-"));
+  const prevXdg = process.env.XDG_STATE_HOME;
+  process.env.XDG_STATE_HOME = tmpState;
+  try {
+    const current = {};
+    await configureClaudeCodeStatusline(current);
+    const scriptPath = statuslineScriptPath();
+    assert.ok(fs.existsSync(scriptPath), "script file was written");
+
+    // 1. Syntax: node --check on the ACTUAL written file (not a regex-extracted copy).
+    execFileSync(process.execPath, ["--check", scriptPath], { stdio: "pipe" });
+
+    // 2. Behavior: run it the way Claude Code does — JSON on stdin, plain stdout.
+    // The generated script may discover a real Claude config from the invoking user's
+    // home, but must render a valid Penny segment either way. XDG_STATE_HOME is isolated
+    // above, so no cached session state or wrapped command can influence this check.
+    const payload = JSON.stringify({
+      session_id: "test-session",
+      model: { display_name: "Test Model" },
+      workspace: { current_dir: "/tmp" },
+    });
+    const out = execFileSync(process.execPath, [scriptPath], {
+      input: payload, encoding: "utf8", timeout: 5000,
+    });
+    assert.ok(out.includes("🪙 penny"), `expected Penny status segment in output, got: ${out}`);
+    assert.ok(out.includes("Test Model"), `expected model name passed through, got: ${out}`);
+
+    // 3. Malformed stdin must not crash the script (best-effort JSON.parse fallback).
+    const outBadInput = execFileSync(process.execPath, [scriptPath], {
+      input: "not json", encoding: "utf8", timeout: 5000,
+    });
+    assert.ok(outBadInput.length > 0, "script still prints something on bad stdin");
+  } finally {
+    if (prevXdg === undefined) delete process.env.XDG_STATE_HOME;
+    else process.env.XDG_STATE_HOME = prevXdg;
+    fs.rmSync(tmpState, { recursive: true, force: true });
+  }
+
+  console.log("statusline.test.js: all checks passed");
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});