pi-multimodal-proxy 1.6.0 → 1.10.1

package/extensions/__tests__/internal.test.ts

@@ -8,10 +8,10 @@
  */
 
 import { strict as assert } from "node:assert";
-import { describe, it } from "node:test";
-import { mkdtemp, rm, symlink, writeFile } from "node:fs/promises";
+import { after, describe, it } from "node:test";
+import { lstat, mkdtemp, rm, symlink, writeFile } from "node:fs/promises";
 import os from "node:os";
-import { join, parse } from "node:path";
+import { delimiter, join, parse } from "node:path";
 import {
 	buildConversationContext,
 	buildDescriptionFence,
@@ -24,6 +24,7 @@ import {
 	formatXaiSttTranscript,
 	isTranscriptionRequest,
 	isXaiProvider,
+	consentState,
 	CUSTOM_TYPE_CONFIG,
 	CUSTOM_TYPE_CONSENT,
 	CUSTOM_TYPE_DESCRIPTION,
@@ -45,12 +46,19 @@ import {
 	VIDEO_PATH_PLACEHOLDER,
 	isPathAllowed,
 	isValidNamedRegion,
+	expandLeadingTilde,
+	sanitizeAllowedFolders,
+	pathAccessFromConfig,
+	MAX_ALLOWED_FOLDERS,
 	LRUCache,
+	normalizeAllowedProviders,
 	normalizedToPixels,
 	parseModelString,
+	parseProviderList,
 	pluralImages,
 	readEnvOverrides,
 	readImageFileWithReason,
+	readMediaFileWithReason,
 	readPersistentFile,
 	resolveConfig,
 	resolveCropEntry,
@@ -59,6 +67,7 @@ import {
 	hammingDistance,
 	computePHash,
 	cropImage,
+	shutdownCropWorkers,
 	piAiImageToBuffer,
 	bufferToPiAiImage,
 	shouldStripImages,
@@ -70,7 +79,15 @@ import {
 	writePersistentFile,
 	sanitizeForLog,
 	storeImageMeta,
-	_imageMeta,
+	createImageMetaStore,
+	storeImageData,
+	getImageData,
+	createImageDataStore,
+	parseRecallRef,
+	spinnerFrame,
+	formatProgressStatus,
+	SPINNER_FRAMES,
+	RECALL_HINT,
 } from "../internal.ts";
 
 // SessionEntry minimal shape — typed loose because peer dep types are not loaded in test
@@ -143,6 +160,12 @@ describe("sanitize", () => {
 		assert.equal(result.videoProvider, "xai");
 	});
 
+	it("defaults statusLine to on and preserves off", () => {
+		assert.equal(sanitize({ ...DEFAULT_CONFIG, statusLine: undefined as any }).statusLine, "on");
+		assert.equal(sanitize({ ...DEFAULT_CONFIG, statusLine: "bogus" as any }).statusLine, "on");
+		assert.equal(sanitize({ ...DEFAULT_CONFIG, statusLine: "off" }).statusLine, "off");
+	});
+
 	it("preserves valid values", () => {
 		const cfg: VisionConfig = {
 			mode: "always",
@@ -210,19 +233,57 @@ describe("readEnvOverrides", () => {
 		}
 		assert.equal(readEnvOverrides({ PI_VISION_PROXY_INCLUDE_CONTEXT: "garbage" }).includeContext, undefined);
 	});
+
+	it("parses allowHome truthy/falsy values", () => {
+		for (const v of ["1", "true", "yes", "on", "TRUE", " 1 "]) {
+			assert.equal(readEnvOverrides({ PI_VISION_PROXY_ALLOW_HOME: v }).allowHome, true, `truthy ${v}`);
+		}
+		for (const v of ["0", "false", "no", "off", " off "]) {
+			assert.equal(readEnvOverrides({ PI_VISION_PROXY_ALLOW_HOME: v }).allowHome, false, `falsy ${v}`);
+		}
+		assert.equal(readEnvOverrides({}).allowHome, undefined);
+		assert.equal(readEnvOverrides({ PI_VISION_PROXY_ALLOW_HOME: "garbage" }).allowHome, undefined);
+	});
+
+	it("parses allowedFolders as a delimiter-separated list of absolute paths", () => {
+		const out = readEnvOverrides({ PI_VISION_PROXY_ALLOWED_FOLDERS: ["/a/b", "relative", "/c"].join(delimiter) });
+		assert.deepEqual(out.allowedFolders, ["/a/b", "/c"]);
+		assert.equal(readEnvOverrides({}).allowedFolders, undefined);
+		// Set-but-useless value still overrides (locks) the persisted list with an empty one
+		assert.deepEqual(readEnvOverrides({ PI_VISION_PROXY_ALLOWED_FOLDERS: "relative" }).allowedFolders, []);
+	});
+
+	it("reads PI_VISION_PROXY_STATUS_LINE", () => {
+		assert.equal(readEnvOverrides({ PI_VISION_PROXY_STATUS_LINE: "on" }).statusLine, "on");
+		assert.equal(readEnvOverrides({ PI_VISION_PROXY_STATUS_LINE: "off" }).statusLine, "off");
+		assert.equal(readEnvOverrides({ PI_VISION_PROXY_STATUS_LINE: "bogus" }).statusLine, undefined);
+	});
 });
 
 describe("envFlags", () => {
 	it("reports presence per variable", () => {
-		assert.deepEqual(envFlags({}), { mode: false, model: false, context: false, tool: false, maxImagesPerCall: false, maxBatch: false, cacheSize: false, videoModel: false });
+		assert.deepEqual(envFlags({}), { mode: false, model: false, context: false, tool: false, maxImagesPerCall: false, maxBatch: false, cacheSize: false, videoModel: false, allowedProviders: false, allowHome: false, allowedFolders: false, statusLine: false });
 		assert.deepEqual(
 			envFlags({
 				PI_VISION_PROXY_MODE: "x",
 				PI_VISION_PROXY_MODEL: "y",
 				PI_VISION_PROXY_INCLUDE_CONTEXT: "",
 			}),
-			{ mode: true, model: true, context: true, tool: false, maxImagesPerCall: false, maxBatch: false, cacheSize: false, videoModel: false },
+			{ mode: true, model: true, context: true, tool: false, maxImagesPerCall: false, maxBatch: false, cacheSize: false, videoModel: false, allowedProviders: false, allowHome: false, allowedFolders: false, statusLine: false },
 		);
+		assert.deepEqual(
+			envFlags({ PI_VISION_PROXY_ALLOW_HOME: "1", PI_VISION_PROXY_ALLOWED_FOLDERS: "/a" }),
+			{ mode: false, model: false, context: false, tool: false, maxImagesPerCall: false, maxBatch: false, cacheSize: false, videoModel: false, allowedProviders: false, allowHome: true, allowedFolders: true, statusLine: false },
+		);
+		assert.equal(envFlags({ PI_VISION_PROXY_ALLOWED_PROVIDERS: "" }).allowedProviders, true);
+		// An unrecognized ALLOW_HOME value is not an override and must not lock the command
+		assert.equal(envFlags({ PI_VISION_PROXY_ALLOW_HOME: "garbage" }).allowHome, false);
+		assert.equal(envFlags({ PI_VISION_PROXY_ALLOW_HOME: " off " }).allowHome, true);
+		assert.equal(envFlags({ PI_VISION_PROXY_STATUS_LINE: "off" }).statusLine, true);
+		assert.equal(envFlags({ PI_VISION_PROXY_STATUS_LINE: "on" }).statusLine, true);
+		// An invalid value is not applied by readEnvOverrides, so it must not
+		// report (and thereby lock) the setting as env-overridden either.
+		assert.equal(envFlags({ PI_VISION_PROXY_STATUS_LINE: "bogus" }).statusLine, false);
 	});
 });
 
@@ -285,6 +346,152 @@ describe("pluralImages", () => {
 	});
 });
 
+describe("parseRecallRef", () => {
+	const hash = "a".repeat(32);
+
+	it("accepts a bare 32-hex hash", () => {
+		assert.equal(parseRecallRef(hash), hash);
+	});
+
+	it("accepts a sha256:-prefixed hash", () => {
+		assert.equal(parseRecallRef(`sha256:${hash}`), hash);
+	});
+
+	it("strips a #crop suffix and recalls the base image", () => {
+		assert.equal(parseRecallRef(`${hash}#crop:1840,120,840,360`), hash);
+	});
+
+	it("normalizes uppercase to lowercase", () => {
+		assert.equal(parseRecallRef("A".repeat(32)), hash);
+	});
+
+	it("rejects file paths and non-hash refs", () => {
+		assert.equal(parseRecallRef("/tmp/shot.png"), null);
+		assert.equal(parseRecallRef("./a.png"), null);
+		assert.equal(parseRecallRef("screenshot.png"), null);
+		// Wrong length / non-hex
+		assert.equal(parseRecallRef("a".repeat(31)), null);
+		assert.equal(parseRecallRef("a".repeat(33)), null);
+		assert.equal(parseRecallRef("z".repeat(32)), null);
+	});
+});
+
+describe("session image recall store", () => {
+	it("round-trips retained image bytes by hash", () => {
+		const store = createImageDataStore();
+		storeImageData(store, "hash1", "AAAA", "image/png");
+		const got = getImageData(store, "hash1");
+		assert.deepEqual(got, { data: "AAAA", mimeType: "image/png" });
+		assert.equal(getImageData(store, "missing"), undefined);
+	});
+
+	it("ignores empty hash or data", () => {
+		const store = createImageDataStore();
+		storeImageData(store, "", "AAAA", "image/png");
+		storeImageData(store, "hash", "", "image/png");
+		assert.equal(store.map.size, 0);
+	});
+
+	it("does not duplicate on re-store of the same hash", () => {
+		const store = createImageDataStore();
+		storeImageData(store, "hash1", "AAAA", "image/png");
+		storeImageData(store, "hash1", "AAAA", "image/png");
+		assert.equal(store.map.size, 1);
+	});
+
+	it("keeps stores isolated — one session's bytes do not leak into another (issue #12)", () => {
+		const sessionA = createImageDataStore();
+		const sessionB = createImageDataStore();
+		storeImageData(sessionA, "hash1", "AAAA", "image/png");
+		assert.deepEqual(getImageData(sessionA, "hash1"), { data: "AAAA", mimeType: "image/png" });
+		assert.equal(getImageData(sessionB, "hash1"), undefined);
+	});
+
+	it("evicts least-recently-used entries past the byte budget", () => {
+		const store = createImageDataStore();
+		const prev = process.env.PI_VISION_PROXY_IMAGE_RECALL_BYTES;
+		// Budget of 10 decoded bytes; each 8-char base64 entry decodes to 6 bytes.
+		process.env.PI_VISION_PROXY_IMAGE_RECALL_BYTES = "10";
+		try {
+			storeImageData(store, "h1", "AAAAAAAA", "image/png"); // 6 decoded bytes, total 6
+			storeImageData(store, "h2", "BBBBBBBB", "image/png"); // 6 decoded bytes, total 12 > 10 → evict h1
+			assert.equal(getImageData(store, "h1"), undefined);
+			assert.deepEqual(getImageData(store, "h2"), { data: "BBBBBBBB", mimeType: "image/png" });
+		} finally {
+			if (prev === undefined) delete process.env.PI_VISION_PROXY_IMAGE_RECALL_BYTES;
+			else process.env.PI_VISION_PROXY_IMAGE_RECALL_BYTES = prev;
+		}
+	});
+
+	it("keeps a single oversized image rather than evicting everything", () => {
+		const store = createImageDataStore();
+		const prev = process.env.PI_VISION_PROXY_IMAGE_RECALL_BYTES;
+		process.env.PI_VISION_PROXY_IMAGE_RECALL_BYTES = "4";
+		try {
+			storeImageData(store, "big", "AAAAAAAAAAAA", "image/png"); // 9 decoded bytes > 4 budget
+			assert.deepEqual(getImageData(store, "big"), { data: "AAAAAAAAAAAA", mimeType: "image/png" });
+			assert.equal(store.map.size, 1);
+		} finally {
+			if (prev === undefined) delete process.env.PI_VISION_PROXY_IMAGE_RECALL_BYTES;
+			else process.env.PI_VISION_PROXY_IMAGE_RECALL_BYTES = prev;
+		}
+	});
+
+	it("bumps recency on access so the touched entry survives eviction", () => {
+		const store = createImageDataStore();
+		const prev = process.env.PI_VISION_PROXY_IMAGE_RECALL_BYTES;
+		// Budget of 14 decoded bytes; each 8-char base64 entry decodes to 6 bytes.
+		process.env.PI_VISION_PROXY_IMAGE_RECALL_BYTES = "14";
+		try {
+			storeImageData(store, "h1", "AAAAAAAA", "image/png"); // 6 decoded bytes, total 6
+			storeImageData(store, "h2", "BBBBBBBB", "image/png"); // 6 decoded bytes, total 12
+			getImageData(store, "h1"); // bump h1 to most-recent
+			storeImageData(store, "h3", "CCCCCCCC", "image/png"); // 6 decoded bytes, total 18 > 14 → evict LRU (h2)
+			assert.deepEqual(getImageData(store, "h1"), { data: "AAAAAAAA", mimeType: "image/png" });
+			assert.equal(getImageData(store, "h2"), undefined);
+			assert.deepEqual(getImageData(store, "h3"), { data: "CCCCCCCC", mimeType: "image/png" });
+		} finally {
+			if (prev === undefined) delete process.env.PI_VISION_PROXY_IMAGE_RECALL_BYTES;
+			else process.env.PI_VISION_PROXY_IMAGE_RECALL_BYTES = prev;
+		}
+	});
+});
+
+describe("spinnerFrame", () => {
+	it("returns a frame from the set and wraps around", () => {
+		assert.equal(spinnerFrame(0), SPINNER_FRAMES[0]);
+		assert.equal(spinnerFrame(SPINNER_FRAMES.length), SPINNER_FRAMES[0]);
+		assert.equal(spinnerFrame(SPINNER_FRAMES.length + 1), SPINNER_FRAMES[1]);
+		assert.ok(SPINNER_FRAMES.includes(spinnerFrame(7)));
+	});
+
+	it("handles negative ticks without throwing", () => {
+		assert.ok(SPINNER_FRAMES.includes(spinnerFrame(-1)));
+		assert.ok(SPINNER_FRAMES.includes(spinnerFrame(-13)));
+	});
+});
+
+describe("formatProgressStatus", () => {
+	it("includes frame, label, and elapsed seconds", () => {
+		assert.equal(
+			formatProgressStatus("Analyzing image 2/4…", "⠙", 3),
+			"multimodal-proxy ⠙ Analyzing image 2/4… (3s)",
+		);
+	});
+
+	it("floors and clamps elapsed seconds", () => {
+		assert.match(formatProgressStatus("x", "⠋", 4.9), /\(4s\)$/);
+		assert.match(formatProgressStatus("x", "⠋", -2), /\(0s\)$/);
+	});
+});
+
+describe("RECALL_HINT", () => {
+	it("mentions analyze_image and the image id", () => {
+		assert.match(RECALL_HINT, /analyze_image/);
+		assert.match(RECALL_HINT, /image id/i);
+	});
+});
+
 describe("splitSubcommand", () => {
 	it("splits sub and value with arbitrary whitespace", () => {
 		assert.deepEqual(splitSubcommand("model anthropic/claude"), { sub: "model", value: "anthropic/claude" });
@@ -402,6 +609,182 @@ describe("hasConsent", () => {
 	});
 });
 
+describe("consentState", () => {
+	it("distinguishes none from revoked", () => {
+		assert.equal(consentState([], "anthropic"), "none");
+		const revoked: Entry[] = [customEntry(CUSTOM_TYPE_CONSENT, { granted: false, provider: "anthropic" })];
+		assert.equal(consentState(revoked, "anthropic"), "revoked");
+		// Revoke for another provider does not apply
+		assert.equal(consentState(revoked, "openai"), "none");
+	});
+
+	it("reports granted for a matching per-provider grant", () => {
+		const entries: Entry[] = [customEntry(CUSTOM_TYPE_CONSENT, { granted: true, provider: "anthropic" })];
+		assert.equal(consentState(entries, "anthropic"), "granted");
+		assert.equal(consentState(entries, "openai"), "none");
+	});
+});
+
+describe("hasConsent with allowedProviders (pre-consent)", () => {
+	it("grants without any session entry when the provider is listed", () => {
+		assert.equal(hasConsent([], "anthropic", ["anthropic"]), true);
+		assert.equal(hasConsent([], "openai", ["anthropic"]), false);
+		assert.equal(hasConsent([], "anthropic", []), false);
+		assert.equal(hasConsent([], "anthropic", undefined), false);
+	});
+
+	it("never applies as a blanket grant without a specific provider", () => {
+		assert.equal(hasConsent([], undefined, ["anthropic", "openai"]), false);
+	});
+
+	it("an explicit in-session revoke beats the pre-consent list", () => {
+		const entries: Entry[] = [customEntry(CUSTOM_TYPE_CONSENT, { granted: false, provider: "anthropic" })];
+		assert.equal(hasConsent(entries, "anthropic", ["anthropic"]), false);
+		// Revoking one provider leaves other listed providers pre-consented
+		assert.equal(hasConsent(entries, "openai", ["anthropic", "openai"]), true);
+	});
+
+	it("a provider-less in-session revoke blocks all pre-consented providers", () => {
+		const entries: Entry[] = [customEntry(CUSTOM_TYPE_CONSENT, { granted: false })];
+		assert.equal(hasConsent(entries, "anthropic", ["anthropic"]), false);
+		assert.equal(hasConsent(entries, "openai", ["openai"]), false);
+	});
+
+	it("a grant after a revoke restores consent", () => {
+		const entries: Entry[] = [
+			customEntry(CUSTOM_TYPE_CONSENT, { granted: false, provider: "anthropic" }),
+			customEntry(CUSTOM_TYPE_CONSENT, { granted: true, provider: "anthropic" }),
+		];
+		assert.equal(hasConsent(entries, "anthropic", []), true);
+	});
+
+	it("canonicalizes the provider before matching the list", () => {
+		assert.equal(hasConsent([], "x-ai", ["xai"]), true);
+	});
+});
+
+describe("consent provider alias canonicalization (PR #18 review)", () => {
+	it("a revoke stored under an alias still blocks the canonical provider", () => {
+		const entries: Entry[] = [customEntry(CUSTOM_TYPE_CONSENT, { granted: false, provider: "x-ai" })];
+		assert.equal(consentState(entries, "xai"), "revoked");
+		// pre-consent list must NOT override the aliased revoke
+		assert.equal(hasConsent(entries, "xai", ["xai"]), false);
+	});
+
+	it("a revoke stored canonically blocks an alias-form check", () => {
+		const entries: Entry[] = [customEntry(CUSTOM_TYPE_CONSENT, { granted: false, provider: "xai" })];
+		assert.equal(consentState(entries, "x-ai"), "revoked");
+		assert.equal(hasConsent(entries, "x-ai", ["xai"]), false);
+	});
+
+	it("a grant stored under an alias satisfies the canonical check and vice versa", () => {
+		const aliasGrant: Entry[] = [customEntry(CUSTOM_TYPE_CONSENT, { granted: true, provider: "x-ai" })];
+		assert.equal(hasConsent(aliasGrant, "xai"), true);
+		const canonicalGrant: Entry[] = [customEntry(CUSTOM_TYPE_CONSENT, { granted: true, provider: "xai" })];
+		assert.equal(hasConsent(canonicalGrant, "x-ai"), true);
+	});
+
+	it("aliased entries for a different provider still don't match", () => {
+		const entries: Entry[] = [customEntry(CUSTOM_TYPE_CONSENT, { granted: false, provider: "x-ai" })];
+		assert.equal(consentState(entries, "anthropic"), "none");
+	});
+});
+
+describe("normalizeAllowedProviders", () => {
+	it("canonicalizes, dedupes, and drops invalid or non-string entries", () => {
+		assert.deepEqual(normalizeAllowedProviders(["x-ai", "xai", "anthropic", "bad/id", 42]), ["xai", "anthropic"]);
+	});
+
+	it("keeps empty arrays and rejects non-arrays", () => {
+		assert.deepEqual(normalizeAllowedProviders([]), []);
+		assert.equal(normalizeAllowedProviders("anthropic"), undefined);
+		assert.equal(normalizeAllowedProviders(undefined), undefined);
+	});
+});
+
+describe("parseProviderList", () => {
+	it("splits on commas and whitespace, trims, dedupes", () => {
+		assert.deepEqual(parseProviderList("anthropic, openai anthropic"), ["anthropic", "openai"]);
+	});
+
+	it("canonicalizes x-ai to xai", () => {
+		assert.deepEqual(parseProviderList("x-ai,xai"), ["xai"]);
+	});
+
+	it("drops invalid provider ids", () => {
+		assert.deepEqual(parseProviderList("good, bad/slash, also:bad"), ["good"]);
+	});
+
+	it("returns [] for empty or all-invalid input", () => {
+		assert.deepEqual(parseProviderList(""), []);
+		assert.deepEqual(parseProviderList("a/b, c:d"), []);
+	});
+});
+
+describe("allowedProviders config plumbing", () => {
+	it("sanitize normalizes, canonicalizes, and dedupes the list", () => {
+		const cfg = sanitize({ ...DEFAULT_CONFIG, allowedProviders: ["x-ai", "anthropic", "anthropic", "bad/id", 42 as any] });
+		assert.deepEqual(cfg.allowedProviders, ["xai", "anthropic"]);
+	});
+
+	it("sanitize keeps an explicit empty list and drops non-arrays", () => {
+		assert.deepEqual(sanitize({ ...DEFAULT_CONFIG, allowedProviders: [] }).allowedProviders, []);
+		assert.equal("allowedProviders" in sanitize({ ...DEFAULT_CONFIG, allowedProviders: "anthropic" as any }), false);
+		assert.equal("allowedProviders" in sanitize({ ...DEFAULT_CONFIG }), false);
+	});
+
+	it("reads PI_VISION_PROXY_ALLOWED_PROVIDERS", () => {
+		assert.deepEqual(
+			readEnvOverrides({ PI_VISION_PROXY_ALLOWED_PROVIDERS: "anthropic,openai" }).allowedProviders,
+			["anthropic", "openai"],
+		);
+		// defined-but-empty must override a persisted list with "none"
+		assert.deepEqual(readEnvOverrides({ PI_VISION_PROXY_ALLOWED_PROVIDERS: "" }).allowedProviders, []);
+		assert.equal(readEnvOverrides({}).allowedProviders, undefined);
+	});
+
+	it("file config supplies the list; env override wins", () => {
+		const fileConfig = { allowedProviders: ["anthropic"] };
+		assert.deepEqual(resolveConfig([], {}, fileConfig).allowedProviders, ["anthropic"]);
+		// session-entry configs never carry the key, so they don't shadow the file
+		const entries: Entry[] = [customEntry(CUSTOM_TYPE_CONFIG, { mode: "always" })];
+		assert.deepEqual(resolveConfig(entries, {}, fileConfig).allowedProviders, ["anthropic"]);
+		assert.deepEqual(
+			resolveConfig(entries, { PI_VISION_PROXY_ALLOWED_PROVIDERS: "openai" }, fileConfig).allowedProviders,
+			["openai"],
+		);
+		assert.deepEqual(
+			resolveConfig(entries, { PI_VISION_PROXY_ALLOWED_PROVIDERS: "" }, fileConfig).allowedProviders,
+			[],
+		);
+	});
+
+	it("round-trips through the persistent file", async () => {
+		const dir = await mkdtemp(join(os.tmpdir(), "vision-proxy-allowed-"));
+		try {
+			await writePersistentFile({ allowedProviders: ["anthropic", "openai"] }, dir);
+			const read = await readPersistentFile(dir);
+			assert.deepEqual(read.allowedProviders, ["anthropic", "openai"]);
+		} finally {
+			await rm(dir, { recursive: true, force: true });
+		}
+	});
+
+	it("canonicalizes a hand-edited list at the file-read boundary", async () => {
+		const dir = await mkdtemp(join(os.tmpdir(), "vision-proxy-allowed-"));
+		try {
+			await writePersistentFile({ allowedProviders: ["x-ai", "anthropic", "bad/id", 7 as any] }, dir);
+			const read = await readPersistentFile(dir);
+			assert.deepEqual(read.allowedProviders, ["xai", "anthropic"]);
+			// non-array value is dropped entirely
+			await writePersistentFile({ allowedProviders: "anthropic" as any }, dir);
+			assert.equal("allowedProviders" in (await readPersistentFile(dir)), false);
+		} finally {
+			await rm(dir, { recursive: true, force: true });
+		}
+	});
+});
+
 describe("toPiAiImage", () => {
 	it("passes through new shape", () => {
 		const img = { type: "image", data: "AAAA", mimeType: "image/png" } as any;
@@ -591,8 +974,30 @@ describe("isPathAllowed", () => {
 		}
 	});
 
-	it("denies non-existent files", async () => {
-		assert.equal(await isPathAllowed(join(os.tmpdir(), "does-not-exist-xyz.png")), false);
+	it("allows non-existent files whose parent directory is in the allow-list", async () => {
+		// Non-existent files in tmpdir pass the check so callers can return "unreadable"
+		// instead of the misleading "denied" / "path outside allowed directories" message.
+		assert.equal(await isPathAllowed(join(os.tmpdir(), "does-not-exist-xyz.png")), true);
+	});
+
+	it("denies non-existent files outside the allow-list", async () => {
+		assert.equal(await isPathAllowed("/etc/does-not-exist-vp-xyz.png"), false);
+	});
+
+	it("allows files inside /tmp (system-wide Unix temp dir)", async () => {
+		if (os.platform() === "win32") return;
+		const file = join("/tmp", `vp-test-direct-${Date.now()}.png`);
+		await writeFile(file, TINY_PNG);
+		try {
+			assert.equal(await isPathAllowed(file), true);
+		} finally {
+			try { await rm(file); } catch { /* ignore */ }
+		}
+	});
+
+	it("allows non-existent files inside /tmp", async () => {
+		if (os.platform() === "win32") return;
+		assert.equal(await isPathAllowed("/tmp/does-not-exist-vp-xyz.png"), true);
 	});
 
 	it("allows local Windows drive paths by default", async () => {
@@ -644,6 +1049,94 @@ describe("isPathAllowed", () => {
 			else process.env.PI_VISION_PROXY_ALLOW_DRIVES = prevDrives;
 		}
 	});
+
+	it("allows homedir via the allowHome config option (no env var)", async () => {
+		const home = os.homedir();
+		const prevHome = process.env.PI_VISION_PROXY_ALLOW_HOME;
+		const prevDrives = process.env.PI_VISION_PROXY_ALLOW_DRIVES;
+		try {
+			process.env.PI_VISION_PROXY_ALLOW_DRIVES = "0";
+			delete process.env.PI_VISION_PROXY_ALLOW_HOME;
+			if (!home.toLowerCase().startsWith(process.cwd().toLowerCase())) {
+				assert.equal(await isPathAllowed(home, { allowHome: false }), false);
+			}
+			assert.equal(await isPathAllowed(home, { allowHome: true }), true);
+		} finally {
+			if (prevHome === undefined) delete process.env.PI_VISION_PROXY_ALLOW_HOME;
+			else process.env.PI_VISION_PROXY_ALLOW_HOME = prevHome;
+			if (prevDrives === undefined) delete process.env.PI_VISION_PROXY_ALLOW_DRIVES;
+			else process.env.PI_VISION_PROXY_ALLOW_DRIVES = prevDrives;
+		}
+	});
+
+	it("allows paths under a configured allowed folder", async () => {
+		const home = os.homedir();
+		const prevDrives = process.env.PI_VISION_PROXY_ALLOW_DRIVES;
+		try {
+			process.env.PI_VISION_PROXY_ALLOW_DRIVES = "0";
+			if (!home.toLowerCase().startsWith(process.cwd().toLowerCase())) {
+				assert.equal(await isPathAllowed(home, { allowedFolders: [] }), false);
+				assert.equal(await isPathAllowed(home, { allowedFolders: ["/nonexistent-root-vp-xyz"] }), false);
+			}
+			assert.equal(await isPathAllowed(home, { allowedFolders: [home] }), true);
+			// Non-existent file directly under an allowed folder passes via parent resolution
+			assert.equal(
+				await isPathAllowed(join(home, "does-not-exist-vp-xyz.png"), { allowedFolders: [home] }),
+				true,
+			);
+		} finally {
+			if (prevDrives === undefined) delete process.env.PI_VISION_PROXY_ALLOW_DRIVES;
+			else process.env.PI_VISION_PROXY_ALLOW_DRIVES = prevDrives;
+		}
+	});
+});
+
+describe("expandLeadingTilde", () => {
+	it("expands ~ and ~/sub to the home directory", () => {
+		assert.equal(expandLeadingTilde("~"), os.homedir());
+		assert.equal(expandLeadingTilde("~/pics"), join(os.homedir(), "pics"));
+	});
+
+	it("leaves other paths untouched", () => {
+		assert.equal(expandLeadingTilde("/a/~/b"), "/a/~/b");
+		assert.equal(expandLeadingTilde("~user/x"), "~user/x");
+		assert.equal(expandLeadingTilde("/plain"), "/plain");
+	});
+
+	it("keeps double-separator inputs under home", () => {
+		assert.equal(expandLeadingTilde("~//etc"), join(os.homedir(), "etc"));
+		assert.equal(expandLeadingTilde("~/\\\\pics"), join(os.homedir(), "pics"));
+	});
+});
+
+describe("sanitizeAllowedFolders", () => {
+	it("keeps absolute paths, expands ~, drops relative and non-string entries", () => {
+		const home = os.homedir();
+		const out = sanitizeAllowedFolders(["/a/b", "relative/x", 42, "~/pics", "  /c  ", ""]);
+		assert.deepEqual(out, ["/a/b", join(home, "pics"), "/c"]);
+	});
+
+	it("dedupes case-insensitively and caps at MAX_ALLOWED_FOLDERS", () => {
+		assert.deepEqual(sanitizeAllowedFolders(["/A/B", "/a/b"]), ["/A/B"]);
+		const many = Array.from({ length: MAX_ALLOWED_FOLDERS + 10 }, (_, i) => `/folder-${i}`);
+		assert.equal(sanitizeAllowedFolders(many).length, MAX_ALLOWED_FOLDERS);
+	});
+
+	it("returns empty array for non-arrays", () => {
+		assert.deepEqual(sanitizeAllowedFolders("/a"), []);
+		assert.deepEqual(sanitizeAllowedFolders(undefined), []);
+	});
+
+	it("rejects UNC/network roots", () => {
+		assert.deepEqual(sanitizeAllowedFolders(["\\\\server\\share", "//server/share", "/ok"]), ["/ok"]);
+	});
+});
+
+describe("pathAccessFromConfig", () => {
+	it("extracts allowedFolders and allowHome", () => {
+		const cfg = sanitize({ ...DEFAULT_CONFIG, allowedFolders: ["/media"], allowHome: true });
+		assert.deepEqual(pathAccessFromConfig(cfg), { allowedFolders: ["/media"], allowHome: true });
+	});
 });
 
 describe("readImageFileWithReason", () => {
@@ -669,13 +1162,20 @@ describe("readImageFileWithReason", () => {
 	});
 
 	it("returns reason=denied for path outside allow-list", async () => {
-		// /etc/passwd.png does not exist but extension is image-like.
-		// realpath fails → denied. Either reason is acceptable in that order; assert non-null reason.
 		const r = await readImageFileWithReason("/etc/never-exists-vp.png");
 		assert.equal(r.image, null);
 		assert.equal(r.reason, "denied");
 	});
 
+	it("returns reason=unreadable for non-existent file inside /tmp", async () => {
+		if (os.platform() === "win32") return;
+		// Previously returned "denied" (misleading); now returns "unreadable" so the user
+		// knows the file is simply missing, not that /tmp itself is forbidden.
+		const r = await readImageFileWithReason("/tmp/does-not-exist-vp-xyz.png");
+		assert.equal(r.image, null);
+		assert.equal(r.reason, "unreadable");
+	});
+
 	it("returns reason=empty for zero-byte image", async () => {
 		const dir = await mkdtemp(join(os.tmpdir(), "vp-test-"));
 		const file = join(dir, "empty.png");
@@ -724,18 +1224,112 @@ describe("readImageFileWithReason", () => {
 			await rm(dir, { recursive: true, force: true });
 		}
 	});
+
+	it("denies symlink to existing file outside allow-list (TOCTOU post-read check)", async () => {
+		// Simulate the TOCTOU race: the symlink target exists and is readable, so
+		// readFile() succeeds, but the post-read realpath re-verification must catch that
+		// the resolved path is outside the allow-list and return "denied".
+		if (os.platform() === "win32") return;
+		// Find a readable file outside the allow-list to use as a target.
+		// /etc/hostname is present on most Unix systems; use it if it exists.
+		const target = "/etc/hostname";
+		let targetExists = false;
+		try { await lstat(target); targetExists = true; } catch { /* skip if absent */ }
+		if (!targetExists) return;
+
+		const dir = await mkdtemp(join(os.tmpdir(), "vp-test-"));
+		const link = join(dir, "link.png");
+		try {
+			try {
+				await symlink(target, link);
+			} catch {
+				return; // no symlink support → skip
+			}
+			const r = await readImageFileWithReason(link);
+			assert.equal(r.image, null);
+			assert.equal(r.reason, "denied");
+		} finally {
+			await rm(dir, { recursive: true, force: true });
+		}
+	});
+});
+
+describe("readMediaFileWithReason", () => {
+	it("returns reason=not-a-media for unsupported extension", async () => {
+		const r = await readMediaFileWithReason("/tmp/foo.xyzunknown");
+		assert.equal(r.media, null);
+		assert.equal(r.reason, "not-a-media");
+	});
+
+	it("rejects a TypeScript .ts file as not-a-media (extension collision with MPEG-TS)", async () => {
+		const dir = await mkdtemp(join(os.tmpdir(), "vp-test-"));
+		const file = join(dir, "store.ts");
+		// Larger than one MPEG-TS packet (188 bytes) so the sniff check runs.
+		await writeFile(file, "// TypeScript source file, not video\n".repeat(20));
+		try {
+			const r = await readMediaFileWithReason(file);
+			assert.equal(r.media, null);
+			assert.equal(r.reason, "not-a-media");
+		} finally {
+			await rm(dir, { recursive: true, force: true });
+		}
+	});
+
+	it("accepts a real MPEG-TS .ts file with valid sync bytes", async () => {
+		const dir = await mkdtemp(join(os.tmpdir(), "vp-test-"));
+		const file = join(dir, "clip.ts");
+		// Build a buffer of 8 packets, each starting with the 0x47 sync byte.
+		const packet = Buffer.alloc(188);
+		packet[0] = 0x47;
+		const content = Buffer.concat(Array.from({ length: 8 }, () => packet));
+		await writeFile(file, content);
+		try {
+			const r = await readMediaFileWithReason(file);
+			assert.ok(r.media, "media should be returned for valid MPEG-TS");
+			assert.equal(r.media?.mimeType, "video/mp2t");
+			assert.equal(r.media?.type, "image");
+		} finally {
+			await rm(dir, { recursive: true, force: true });
+		}
+	});
+
+	it("returns reason=empty for zero-byte .ts file", async () => {
+		const dir = await mkdtemp(join(os.tmpdir(), "vp-test-"));
+		const file = join(dir, "empty.ts");
+		await writeFile(file, "");
+		try {
+			const r = await readMediaFileWithReason(file);
+			assert.equal(r.media, null);
+			assert.equal(r.reason, "empty");
+		} finally {
+			await rm(dir, { recursive: true, force: true });
+		}
+	});
 });
 
 describe("readPersistentFile / writePersistentFile", () => {
 	it("round-trips config through a file", async () => {
 		const dir = await mkdtemp(join(os.tmpdir(), "vp-test-"));
 		try {
-			const cfg: Partial<VisionConfig> = { mode: "always", provider: "openai", modelId: "gpt-4o" };
+			const cfg: Partial<VisionConfig> = { mode: "always", provider: "openai", modelId: "gpt-4o", statusLine: "off" };
 			await writePersistentFile(cfg, dir);
 			const read = await readPersistentFile(dir);
 			assert.equal(read.mode, "always");
 			assert.equal(read.provider, "openai");
 			assert.equal(read.modelId, "gpt-4o");
+			assert.equal(read.statusLine, "off");
+		} finally {
+			await rm(dir, { recursive: true, force: true });
+		}
+	});
+
+	it("round-trips allowedFolders and allowHome", async () => {
+		const dir = await mkdtemp(join(os.tmpdir(), "vp-test-"));
+		try {
+			await writePersistentFile({ allowedFolders: ["/media/photos"], allowHome: true }, dir);
+			const read = await readPersistentFile(dir);
+			assert.deepEqual(read.allowedFolders, ["/media/photos"]);
+			assert.equal(read.allowHome, true);
 		} finally {
 			await rm(dir, { recursive: true, force: true });
 		}
@@ -1292,6 +1886,29 @@ describe("sanitize (1.4.0 fields)", () => {
 	});
 });
 
+describe("sanitize (1.10.0 file-access fields)", () => {
+	it("defaults allowedFolders and allowHome when missing or invalid", () => {
+		const result = sanitize({
+			mode: "fallback",
+			provider: "anthropic",
+			modelId: "claude-sonnet-5",
+			systemPrompt: "test",
+			includeContext: true,
+		} as VisionConfig);
+		assert.deepEqual(result.allowedFolders, []);
+		assert.equal(result.allowHome, false);
+		const bad = sanitize({ ...DEFAULT_CONFIG, allowedFolders: "nope" as unknown as string[], allowHome: "yes" as unknown as boolean });
+		assert.deepEqual(bad.allowedFolders, []);
+		assert.equal(bad.allowHome, false);
+	});
+
+	it("filters allowedFolders to absolute paths", () => {
+		const result = sanitize({ ...DEFAULT_CONFIG, allowedFolders: ["/media", "relative/x"], allowHome: true });
+		assert.deepEqual(result.allowedFolders, ["/media"]);
+		assert.equal(result.allowHome, true);
+	});
+});
+
 describe("readImageFileWithReason (basename)", () => {
 	it("returns filename (basename)", async () => {
 		const dir = await mkdtemp(join(os.tmpdir(), "vp-test-"));
@@ -1321,6 +1938,10 @@ async function create10x10Png(): Promise<Buffer> {
 }
 
 describe("cropImage (ImageScript)", () => {
+	after(async () => {
+		await shutdownCropWorkers();
+	});
+
 	it("crops a 10×10 PNG to a 5×5 region", async () => {
 		const png = await create10x10Png();
 		const crop = { x: 2, y: 3, width: 5, height: 5 };
@@ -1355,6 +1976,92 @@ describe("cropImage (ImageScript)", () => {
 		assert.equal(result[0], 0xff);
 		assert.equal(result[1], 0xd8);
 	});
+
+	it("succeeds within a generous decode timeout (env override is honoured)", async () => {
+		const prev = process.env.PI_VISION_PROXY_DECODE_TIMEOUT_MS;
+		process.env.PI_VISION_PROXY_DECODE_TIMEOUT_MS = "10000";
+		try {
+			const png = await create10x10Png();
+			const result = await cropImage(png, { x: 0, y: 0, width: 10, height: 10 }, "image/png");
+			assert.ok(result, "crop should succeed with a generous timeout");
+		} finally {
+			if (prev === undefined) delete process.env.PI_VISION_PROXY_DECODE_TIMEOUT_MS;
+			else process.env.PI_VISION_PROXY_DECODE_TIMEOUT_MS = prev;
+		}
+	});
+
+	it("returns null (no throw) for undecodable garbage bytes", async () => {
+		const garbage = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05]);
+		const result = await cropImage(garbage, { x: 0, y: 0, width: 5, height: 5 }, "image/png");
+		assert.equal(result, null);
+	});
+
+	it("falls back to the in-thread path when the worker is disabled", async () => {
+		const prev = process.env.PI_VISION_PROXY_DECODE_WORKER;
+		process.env.PI_VISION_PROXY_DECODE_WORKER = "0";
+		try {
+			const png = await create10x10Png();
+			const result = await cropImage(png, { x: 2, y: 3, width: 5, height: 5 }, "image/png");
+			assert.ok(result, "in-thread fallback should still crop");
+			const dims = extractDimensions(result);
+			assert.ok(dims && dims.width === 5 && dims.height === 5, "fallback crop should have correct dims");
+		} finally {
+			if (prev === undefined) delete process.env.PI_VISION_PROXY_DECODE_WORKER;
+			else process.env.PI_VISION_PROXY_DECODE_WORKER = prev;
+		}
+	});
+
+	it("handles several sequential crops (worker pool reuse)", async () => {
+		const png = await create10x10Png();
+		for (let i = 0; i < 5; i++) {
+			const result = await cropImage(png, { x: 0, y: 0, width: 5, height: 5 }, "image/png");
+			assert.ok(result, `crop ${i} should succeed`);
+			const dims = extractDimensions(result);
+			assert.ok(dims && dims.width === 5 && dims.height === 5, `crop ${i} dims`);
+		}
+	});
+
+	it("works with pooling disabled (spawn-per-call)", async () => {
+		const prev = process.env.PI_VISION_PROXY_DECODE_WORKER_POOL;
+		process.env.PI_VISION_PROXY_DECODE_WORKER_POOL = "0";
+		try {
+			const png = await create10x10Png();
+			const a = await cropImage(png, { x: 0, y: 0, width: 5, height: 5 }, "image/png");
+			const b = await cropImage(png, { x: 1, y: 1, width: 4, height: 4 }, "image/png");
+			assert.ok(a && b, "both crops should succeed without pooling");
+		} finally {
+			if (prev === undefined) delete process.env.PI_VISION_PROXY_DECODE_WORKER_POOL;
+			else process.env.PI_VISION_PROXY_DECODE_WORKER_POOL = prev;
+		}
+	});
+
+	it("hard-terminates the worker on timeout (returns null, does not hang)", async () => {
+		// Force pool=0 so a *fresh* worker is spawned (never a warmed pooled one).
+		// Spinning up a thread + loading ImageScript + instantiating the WASM codec
+		// is reliably far slower than the 1ms timeout regardless of machine speed,
+		// so the main-thread timer fires and terminate()s the worker — proving the
+		// timeout is a hard limit, without depending on wall-clock scheduling luck.
+		const prevWorker = process.env.PI_VISION_PROXY_DECODE_WORKER;
+		const prevPool = process.env.PI_VISION_PROXY_DECODE_WORKER_POOL;
+		const prevTimeout = process.env.PI_VISION_PROXY_DECODE_TIMEOUT_MS;
+		process.env.PI_VISION_PROXY_DECODE_WORKER = "1";
+		process.env.PI_VISION_PROXY_DECODE_WORKER_POOL = "0";
+		process.env.PI_VISION_PROXY_DECODE_TIMEOUT_MS = "1";
+		try {
+			const png = await create10x10Png();
+			const started = Date.now();
+			const result = await cropImage(png, { x: 0, y: 0, width: 10, height: 10 }, "image/png");
+			assert.equal(result, null, "timed-out crop should return null");
+			assert.ok(Date.now() - started < 5000, "should return promptly, not hang");
+		} finally {
+			if (prevWorker === undefined) delete process.env.PI_VISION_PROXY_DECODE_WORKER;
+			else process.env.PI_VISION_PROXY_DECODE_WORKER = prevWorker;
+			if (prevPool === undefined) delete process.env.PI_VISION_PROXY_DECODE_WORKER_POOL;
+			else process.env.PI_VISION_PROXY_DECODE_WORKER_POOL = prevPool;
+			if (prevTimeout === undefined) delete process.env.PI_VISION_PROXY_DECODE_TIMEOUT_MS;
+			else process.env.PI_VISION_PROXY_DECODE_TIMEOUT_MS = prevTimeout;
+		}
+	});
 });
 
 describe("piAiImageToBuffer / bufferToPiAiImage", () => {
@@ -1958,8 +2665,9 @@ describe("Security: image decode bomb protection", () => {
 		const img = new Image(100, 100);
 		const encoded = Buffer.from(await img.encode(1));
 		const hash = "test-decode-bomb-normal";
-		storeImageMeta(hash, encoded);
-		const meta = _imageMeta.get(hash);
+		const store = createImageMetaStore();
+		storeImageMeta(store, hash, encoded);
+		const meta = store.get(hash);
 		// Normal image should be accepted
 		assert.ok(meta, "normal image should be stored");
 	});
@@ -2050,10 +2758,100 @@ describe("Review fixes: storeImageMeta filename backfill", () => {
 		const img = new Image(50, 60);
 		const encoded = Buffer.from(await img.encode(1));
 		const hash = "test-backfill-filename";
-		storeImageMeta(hash, encoded); // first call, no filename
-		storeImageMeta(hash, encoded, "photo.png"); // second call, with filename
-		const meta = _imageMeta.get(hash);
+		const store = createImageMetaStore();
+		storeImageMeta(store, hash, encoded); // first call, no filename
+		storeImageMeta(store, hash, encoded, "photo.png"); // second call, with filename
+		const meta = store.get(hash);
 		assert.ok(meta, "meta should exist");
 		assert.equal(meta!.filename, "photo.png", "filename should be backfilled");
 	});
+
+	it("keeps stores isolated — one session's metadata does not leak into another (issue #12)", async () => {
+		const { Image } = await import("imagescript");
+		const encoded = Buffer.from(await new Image(40, 30).encode(1));
+		const sessionA = createImageMetaStore();
+		const sessionB = createImageMetaStore();
+		storeImageMeta(sessionA, "shared-hash", encoded, "a.png");
+		assert.ok(sessionA.get("shared-hash"), "session A should have the metadata");
+		assert.equal(sessionB.get("shared-hash"), undefined, "session B must not inherit it");
+	});
+});
+
+// ── Default model fallback (1.8.0) ──────────────────────────────────────────
+
+import { applyDefaultModelFallback, DEFAULT_MODEL_FALLBACKS } from "../internal.ts";
+
+describe("applyDefaultModelFallback", () => {
+	const registryWith = (...models: string[]) => (p: string, m: string) => models.includes(`${p}/${m}`);
+	const builtin = { ...DEFAULT_CONFIG };
+
+	it("keeps the built-in default when the registry knows it", () => {
+		const out = applyDefaultModelFallback(builtin, registryWith(`${builtin.provider}/${builtin.modelId}`));
+		assert.equal(out.modelId, DEFAULT_CONFIG.modelId);
+	});
+
+	it("falls back to the first available fallback on older catalogs", () => {
+		const fb = DEFAULT_MODEL_FALLBACKS[0]!;
+		const out = applyDefaultModelFallback(builtin, registryWith(`${fb.provider}/${fb.modelId}`));
+		assert.equal(out.provider, fb.provider);
+		assert.equal(out.modelId, fb.modelId);
+	});
+
+	it("returns the config unchanged when no fallback is available either", () => {
+		const out = applyDefaultModelFallback(builtin, () => false);
+		assert.equal(out.modelId, DEFAULT_CONFIG.modelId);
+	});
+
+	it("never rewrites a user-configured model, even when it is missing", () => {
+		const custom = { ...DEFAULT_CONFIG, provider: "openai", modelId: "gpt-5.5" };
+		const out = applyDefaultModelFallback(custom, () => false);
+		assert.equal(out.provider, "openai");
+		assert.equal(out.modelId, "gpt-5.5");
+	});
+
+	it("never rewrites an explicit user choice that equals the built-in default (userConfigured)", () => {
+		const out = applyDefaultModelFallback(builtin, () => false, true);
+		assert.equal(out.provider, DEFAULT_CONFIG.provider);
+		assert.equal(out.modelId, DEFAULT_CONFIG.modelId);
+	});
+
+	it("never rewrites a model persisted with modelExplicit, even the default pair", () => {
+		const explicit = { ...DEFAULT_CONFIG, modelExplicit: true };
+		const out = applyDefaultModelFallback(explicit, () => false);
+		assert.equal(out.modelId, DEFAULT_CONFIG.modelId);
+	});
+
+	it("upgrades an implicit legacy baked-in default to the current default when available", () => {
+		const legacy = { ...DEFAULT_CONFIG, provider: "anthropic", modelId: "claude-sonnet-4-5" };
+		const out = applyDefaultModelFallback(
+			legacy,
+			registryWith(`${DEFAULT_CONFIG.provider}/${DEFAULT_CONFIG.modelId}`, "anthropic/claude-sonnet-4-5"),
+		);
+		assert.equal(out.modelId, DEFAULT_CONFIG.modelId);
+	});
+
+	it("keeps a legacy default as-is when the current default is not in the registry", () => {
+		const legacy = { ...DEFAULT_CONFIG, provider: "anthropic", modelId: "claude-sonnet-4-5" };
+		const out = applyDefaultModelFallback(legacy, registryWith("anthropic/claude-sonnet-4-5"));
+		assert.equal(out.modelId, "claude-sonnet-4-5");
+	});
+
+	it("does not upgrade a legacy-default model marked modelExplicit", () => {
+		const legacy = {
+			...DEFAULT_CONFIG,
+			provider: "anthropic",
+			modelId: "claude-sonnet-4-5",
+			modelExplicit: true,
+		};
+		const out = applyDefaultModelFallback(legacy, () => true);
+		assert.equal(out.modelId, "claude-sonnet-4-5");
+	});
+
+	it("does not mutate the other config fields when substituting", () => {
+		const fb = DEFAULT_MODEL_FALLBACKS[0]!;
+		const cfg = { ...DEFAULT_CONFIG, mode: "always" as const, cacheSize: 7 };
+		const out = applyDefaultModelFallback(cfg, registryWith(`${fb.provider}/${fb.modelId}`));
+		assert.equal(out.mode, "always");
+		assert.equal(out.cacheSize, 7);
+	});
 });