relay-ide 0.1.0

package/dist/test/telemetry.test.js

@@ -0,0 +1,295 @@
+import { test, before, afterEach, after } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import express from 'express';
+import { createTelemetryRouter, getAccountTelemetry, getTelemetryForSession, startTelemetry, stopTelemetry, } from '../server/telemetry.js';
+const noopAuth = (_req, _res, next) => next();
+let tmpDir;
+before(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'claude-remote-cli-telemetry-test-'));
+});
+afterEach(() => {
+    stopTelemetry();
+    for (const entry of fs.readdirSync(tmpDir)) {
+        fs.rmSync(path.join(tmpDir, entry), { recursive: true, force: true });
+    }
+});
+after(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+});
+function makeSession(id) {
+    return { id };
+}
+function makeDeps(sessionIds, events, configDir = tmpDir) {
+    return {
+        configDir,
+        getActiveSessions: () => sessionIds.map(makeSession),
+        broadcastEvent: (type, data) => {
+            if (data === undefined)
+                events.push({ type });
+            else
+                events.push({ type, data });
+        },
+    };
+}
+function writeStatusLineFile(sessionId, payload, configDir = tmpDir) {
+    const telemetryDir = path.join(configDir, 'telemetry');
+    fs.mkdirSync(telemetryDir, { recursive: true });
+    const filePath = path.join(telemetryDir, `${sessionId}.json`);
+    fs.writeFileSync(filePath, JSON.stringify(payload, null, 2));
+    return filePath;
+}
+function writePendingTelemetryFile(configDir, payload) {
+    const filePath = path.join(configDir, 'pending-telemetry.json');
+    fs.writeFileSync(filePath, JSON.stringify(payload, null, 2));
+    return filePath;
+}
+function sampleStatusLinePayload() {
+    return {
+        session_id: 'abc-123',
+        model: { id: 'claude-opus-4-6', display_name: 'Claude Opus 4.6' },
+        context_window: {
+            total_input_tokens: 12400,
+            total_output_tokens: 3200,
+            context_window_size: 200000,
+            used_percentage: 7.8,
+            remaining_percentage: 92.2,
+            current_usage: {
+                input_tokens: 500,
+                output_tokens: 100,
+                cache_creation_input_tokens: 1000,
+                cache_read_input_tokens: 5000,
+            },
+        },
+        cost: { total_cost_usd: 0.42 },
+        rate_limits: {
+            five_hour: { used_percentage: 22, resets_at: '2026-03-31T19:30:00Z' },
+            seven_day: { used_percentage: 8, resets_at: '2026-04-03T00:00:00Z' },
+        },
+    };
+}
+test('parses session telemetry from the statusLine file', () => {
+    const events = [];
+    writeStatusLineFile('abc-123', sampleStatusLinePayload());
+    startTelemetry(makeDeps(['abc-123'], events));
+    const session = getTelemetryForSession('abc-123');
+    const account = getAccountTelemetry();
+    assert.deepEqual(session, {
+        sessionId: 'abc-123',
+        model: 'Claude Opus 4.6',
+        totalInputTokens: 12400,
+        totalOutputTokens: 3200,
+        totalCacheRead: 5000,
+        totalCacheWrite: 1000,
+        contextPercent: 7.8,
+        contextWindowSize: 200000,
+        costUsd: 0.42,
+        source: 'statusLine',
+        updatedAt: session?.updatedAt,
+    });
+    assert.deepEqual(account, {
+        fiveHourUsedPercent: 22,
+        fiveHourResetsAt: '2026-03-31T19:30:00Z',
+        sevenDayUsedPercent: 8,
+        sevenDayResetsAt: '2026-04-03T00:00:00Z',
+        updatedAt: account?.updatedAt,
+    });
+    assert.equal(events.filter((event) => event.type === 'session-telemetry').length, 1);
+    assert.equal(events.filter((event) => event.type === 'account-telemetry').length, 1);
+});
+test('missing statusLine file leaves telemetry undefined', () => {
+    const events = [];
+    startTelemetry(makeDeps(['missing-session'], events));
+    assert.equal(getTelemetryForSession('missing-session'), undefined);
+    assert.equal(getAccountTelemetry(), null);
+    assert.equal(events.length, 0);
+});
+test('inactive sessions are pruned once active telemetry is available', () => {
+    writePendingTelemetryFile(tmpDir, {
+        version: 1,
+        timestamp: new Date().toISOString(),
+        sessions: {
+            stale: {
+                sessionId: 'stale',
+                model: 'Claude Sonnet 4',
+                totalInputTokens: 10,
+                totalOutputTokens: 20,
+                totalCacheRead: 30,
+                totalCacheWrite: 40,
+                contextPercent: 11,
+                contextWindowSize: 999,
+                costUsd: 1.23,
+                source: 'statusLine',
+                updatedAt: '2026-03-31T17:00:00Z',
+            },
+        },
+        account: null,
+    });
+    writeStatusLineFile('fresh', sampleStatusLinePayload());
+    startTelemetry(makeDeps(['fresh'], []));
+    assert.equal(getTelemetryForSession('stale'), undefined);
+    assert.ok(getTelemetryForSession('fresh'));
+});
+test('malformed statusLine JSON is ignored without crashing', () => {
+    const events = [];
+    const telemetryDir = path.join(tmpDir, 'telemetry');
+    fs.mkdirSync(telemetryDir, { recursive: true });
+    fs.writeFileSync(path.join(telemetryDir, 'bad-session.json'), '{"model":');
+    assert.doesNotThrow(() => {
+        startTelemetry(makeDeps(['bad-session'], events));
+    });
+    assert.equal(getTelemetryForSession('bad-session'), undefined);
+    assert.equal(getAccountTelemetry(), null);
+    assert.equal(events.length, 0);
+});
+test('restores pending telemetry from disk on startup', () => {
+    const restored = {
+        version: 1,
+        timestamp: new Date().toISOString(),
+        sessions: {
+            restored: {
+                sessionId: 'restored',
+                model: 'Claude Sonnet 4',
+                totalInputTokens: 10,
+                totalOutputTokens: 20,
+                totalCacheRead: 30,
+                totalCacheWrite: 40,
+                contextPercent: 11,
+                contextWindowSize: 999,
+                costUsd: 1.23,
+                source: 'statusLine',
+                updatedAt: '2026-03-31T18:00:00Z',
+            },
+        },
+        account: {
+            fiveHourUsedPercent: 44,
+            fiveHourResetsAt: '2026-03-31T19:30:00Z',
+            sevenDayUsedPercent: 55,
+            sevenDayResetsAt: '2026-04-03T00:00:00Z',
+            updatedAt: '2026-03-31T18:00:00Z',
+        },
+    };
+    const pendingPath = writePendingTelemetryFile(tmpDir, restored);
+    const events = [];
+    startTelemetry(makeDeps([], events));
+    assert.deepEqual(getTelemetryForSession('restored'), {
+        sessionId: 'restored',
+        model: 'Claude Sonnet 4',
+        totalInputTokens: 10,
+        totalOutputTokens: 20,
+        totalCacheRead: 30,
+        totalCacheWrite: 40,
+        contextPercent: 11,
+        contextWindowSize: 999,
+        costUsd: 1.23,
+        source: 'statusLine',
+        updatedAt: '2026-03-31T18:00:00Z',
+    });
+    assert.deepEqual(getAccountTelemetry(), restored.account);
+    assert.equal(fs.existsSync(pendingPath), false, 'pending telemetry should be cleared after restore');
+    assert.equal(events.length, 0);
+});
+test('GET /telemetry endpoints return session and account telemetry', async () => {
+    const restored = {
+        version: 1,
+        timestamp: new Date().toISOString(),
+        sessions: {
+            endpoint: {
+                sessionId: 'endpoint',
+                model: 'Claude Opus 4.6',
+                totalInputTokens: 100,
+                totalOutputTokens: 200,
+                totalCacheRead: 300,
+                totalCacheWrite: 400,
+                contextPercent: 12.5,
+                contextWindowSize: 123456,
+                costUsd: 4.56,
+                source: 'statusLine',
+                updatedAt: '2026-03-31T18:00:00Z',
+            },
+        },
+        account: {
+            fiveHourUsedPercent: 9,
+            fiveHourResetsAt: '2026-03-31T19:30:00Z',
+            sevenDayUsedPercent: 18,
+            sevenDayResetsAt: '2026-04-03T00:00:00Z',
+            updatedAt: '2026-03-31T18:00:00Z',
+        },
+    };
+    writePendingTelemetryFile(tmpDir, restored);
+    startTelemetry(makeDeps([], []));
+    let server;
+    try {
+        const app = express();
+        app.use(express.json());
+        app.use('/telemetry', noopAuth, createTelemetryRouter());
+        server = await new Promise((resolve) => {
+            const srv = app.listen(0, '127.0.0.1', () => resolve(srv));
+        });
+        const addr = server.address();
+        assert.equal(typeof addr, 'object');
+        assert.ok(addr);
+        const baseUrl = `http://127.0.0.1:${addr.port}`;
+        const sessionsRes = await fetch(`${baseUrl}/telemetry/sessions`);
+        assert.equal(sessionsRes.status, 200);
+        assert.deepEqual(await sessionsRes.json(), {
+            endpoint: {
+                sessionId: 'endpoint',
+                model: 'Claude Opus 4.6',
+                totalInputTokens: 100,
+                totalOutputTokens: 200,
+                totalCacheRead: 300,
+                totalCacheWrite: 400,
+                contextPercent: 12.5,
+                contextWindowSize: 123456,
+                costUsd: 4.56,
+                source: 'statusLine',
+                updatedAt: '2026-03-31T18:00:00Z',
+            },
+        });
+        const accountRes = await fetch(`${baseUrl}/telemetry/account`);
+        assert.equal(accountRes.status, 200);
+        assert.deepEqual(await accountRes.json(), restored.account);
+        const setupStatusRes = await fetch(`${baseUrl}/telemetry/setup-status`);
+        assert.equal(setupStatusRes.status, 200);
+        assert.deepEqual(await setupStatusRes.json(), { installed: true });
+    }
+    finally {
+        await new Promise((resolve) => {
+            if (server)
+                server.close(() => resolve());
+            else
+                resolve();
+        });
+    }
+});
+test('stopTelemetry ignores pending persistence write failures', () => {
+    const blockedPath = path.join(tmpDir, 'not-a-directory');
+    fs.writeFileSync(blockedPath, 'blocked');
+    startTelemetry(makeDeps([], [], blockedPath));
+    assert.doesNotThrow(() => {
+        stopTelemetry();
+    });
+});
+test('collectTelemetry reuses a single active session snapshot per poll', () => {
+    const events = [];
+    let calls = 0;
+    writeStatusLineFile('abc-123', sampleStatusLinePayload());
+    startTelemetry({
+        configDir: tmpDir,
+        getActiveSessions: () => {
+            calls++;
+            return [makeSession('abc-123')];
+        },
+        broadcastEvent: (type, data) => {
+            if (data === undefined)
+                events.push({ type });
+            else
+                events.push({ type, data });
+        },
+    });
+    assert.equal(calls, 1);
+    assert.equal(events.filter((event) => event.type === 'session-telemetry').length, 1);
+});

package/dist/test/terminal-zoom.test.js

@@ -0,0 +1,102 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+// Pure zoom functions inlined here because the frontend source imports from
+// .svelte.ts modules that the Node.js test runner cannot process.
+// These mirror the implementations in frontend/src/lib/terminal-zoom.ts.
+const DEFAULT = 14;
+const MIN = 8;
+const MAX = 28;
+function clampFontSize(size) {
+    if (!Number.isFinite(size))
+        return DEFAULT;
+    return Math.max(MIN, Math.min(MAX, Math.round(size)));
+}
+function zoomPercentage(fontSize) {
+    return Math.round((fontSize / DEFAULT) * 100);
+}
+function scaledTerminalDimensions(windowWidth, windowHeight, fontSize) {
+    const ratio = fontSize / DEFAULT;
+    const charWidth = 8 * ratio;
+    const lineHeight = 17 * ratio;
+    return {
+        cols: Math.max(80, Math.floor((windowWidth - 60) / charWidth)),
+        rows: Math.max(24, Math.floor((windowHeight - 120) / lineHeight)),
+    };
+}
+describe('terminal zoom', () => {
+    describe('clampFontSize', () => {
+        it('returns value within bounds', () => {
+            assert.equal(clampFontSize(14), 14);
+            assert.equal(clampFontSize(20), 20);
+        });
+        it('clamps to minimum', () => {
+            assert.equal(clampFontSize(4), MIN);
+            assert.equal(clampFontSize(0), MIN);
+            assert.equal(clampFontSize(-5), MIN);
+        });
+        it('clamps to maximum', () => {
+            assert.equal(clampFontSize(30), MAX);
+            assert.equal(clampFontSize(100), MAX);
+        });
+        it('rounds fractional values', () => {
+            assert.equal(clampFontSize(14.6), 15);
+            assert.equal(clampFontSize(14.4), 14);
+        });
+        it('handles boundary values exactly', () => {
+            assert.equal(clampFontSize(MIN), MIN);
+            assert.equal(clampFontSize(MAX), MAX);
+        });
+        it('returns default for NaN and non-finite values', () => {
+            assert.equal(clampFontSize(NaN), DEFAULT);
+            assert.equal(clampFontSize(Infinity), DEFAULT);
+            assert.equal(clampFontSize(-Infinity), DEFAULT);
+        });
+    });
+    describe('zoomPercentage', () => {
+        it('returns 100% at default', () => {
+            assert.equal(zoomPercentage(DEFAULT), 100);
+        });
+        it('scales proportionally', () => {
+            assert.equal(zoomPercentage(28), 200);
+            assert.equal(zoomPercentage(7), 50);
+            assert.equal(zoomPercentage(21), 150);
+        });
+        it('handles minimum and maximum', () => {
+            assert.equal(zoomPercentage(MIN), Math.round((MIN / DEFAULT) * 100));
+            assert.equal(zoomPercentage(MAX), Math.round((MAX / DEFAULT) * 100));
+        });
+    });
+    describe('scaledTerminalDimensions', () => {
+        it('matches original hardcoded values at default font size', () => {
+            const dims = scaledTerminalDimensions(1920, 1080, DEFAULT);
+            // Original formula: Math.floor((1920 - 60) / 8) = 232, Math.floor((1080 - 120) / 17) = 56
+            assert.equal(dims.cols, Math.floor((1920 - 60) / 8));
+            assert.equal(dims.rows, Math.floor((1080 - 120) / 17));
+        });
+        it('returns fewer cols/rows at larger font sizes', () => {
+            const normal = scaledTerminalDimensions(1920, 1080, 14);
+            const large = scaledTerminalDimensions(1920, 1080, 28);
+            assert.ok(large.cols < normal.cols, 'larger font should give fewer cols');
+            assert.ok(large.rows < normal.rows, 'larger font should give fewer rows');
+        });
+        it('returns more cols/rows at smaller font sizes', () => {
+            const normal = scaledTerminalDimensions(1920, 1080, 14);
+            const small = scaledTerminalDimensions(1920, 1080, 8);
+            assert.ok(small.cols > normal.cols, 'smaller font should give more cols');
+            assert.ok(small.rows > normal.rows, 'smaller font should give more rows');
+        });
+        it('enforces minimums on small screens', () => {
+            const dims = scaledTerminalDimensions(100, 100, 28);
+            assert.ok(dims.cols >= 80, 'cols must be at least 80');
+            assert.ok(dims.rows >= 24, 'rows must be at least 24');
+        });
+        it('scales linearly with font size', () => {
+            const at14 = scaledTerminalDimensions(1920, 1080, 14);
+            const at28 = scaledTerminalDimensions(1920, 1080, 28);
+            // At 2x font size, char width doubles, so cols should approximately halve
+            // (not exactly due to the (width - 60) offset and Math.floor)
+            const ratio = at14.cols / at28.cols;
+            assert.ok(ratio > 1.8 && ratio < 2.2, `col ratio should be ~2, got ${ratio}`);
+        });
+    });
+});

package/dist/test/test/analytics.test.js

@@ -0,0 +1,152 @@
+import { test, before, after, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import Database from 'better-sqlite3';
+import { initAnalytics, closeAnalytics, trackEvent, getDbSize, getDbPath } from '../server/analytics.js';
+let tmpDir;
+before(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'claude-remote-cli-analytics-test-'));
+});
+afterEach(() => {
+    closeAnalytics();
+    // Clean up DB files between tests
+    for (const entry of fs.readdirSync(tmpDir)) {
+        fs.unlinkSync(path.join(tmpDir, entry));
+    }
+});
+after(() => {
+    fs.rmSync(tmpDir, { recursive: true });
+});
+test('initAnalytics creates database and schema', () => {
+    initAnalytics(tmpDir);
+    const dbPath = getDbPath(tmpDir);
+    assert.ok(fs.existsSync(dbPath), 'DB file should exist');
+    const db = new Database(dbPath, { readonly: true });
+    const tables = db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all();
+    assert.ok(tables.some(t => t.name === 'events'), 'events table should exist');
+    db.close();
+});
+test('trackEvent inserts a row', () => {
+    initAnalytics(tmpDir);
+    trackEvent({
+        category: 'session',
+        action: 'created',
+        target: 'session-123',
+        properties: { workspace: '/proj', agent: 'claude' },
+        session_id: 'session-123',
+        device: 'desktop',
+    });
+    const db = new Database(getDbPath(tmpDir), { readonly: true });
+    const rows = db.prepare('SELECT * FROM events').all();
+    assert.equal(rows.length, 1);
+    assert.equal(rows[0].category, 'session');
+    assert.equal(rows[0].action, 'created');
+    assert.equal(rows[0].target, 'session-123');
+    assert.equal(rows[0].device, 'desktop');
+    const props = JSON.parse(rows[0].properties);
+    assert.equal(props.workspace, '/proj');
+    assert.equal(props.agent, 'claude');
+    db.close();
+});
+test('trackEvent handles optional fields as null', () => {
+    initAnalytics(tmpDir);
+    trackEvent({ category: 'ui', action: 'click' });
+    const db = new Database(getDbPath(tmpDir), { readonly: true });
+    const rows = db.prepare('SELECT * FROM events').all();
+    assert.equal(rows.length, 1);
+    assert.equal(rows[0].target, null);
+    assert.equal(rows[0].properties, null);
+    assert.equal(rows[0].session_id, null);
+    assert.equal(rows[0].device, null);
+    db.close();
+});
+test('trackEvent is no-op before initAnalytics', () => {
+    // Should not throw
+    trackEvent({ category: 'test', action: 'noop' });
+});
+test('getDbSize returns file size after writes', () => {
+    initAnalytics(tmpDir);
+    const sizeBefore = getDbSize(tmpDir);
+    assert.ok(sizeBefore > 0, 'DB file should have non-zero size after init');
+    for (let i = 0; i < 10; i++) {
+        trackEvent({ category: 'bulk', action: 'test', properties: { i } });
+    }
+    const sizeAfter = getDbSize(tmpDir);
+    assert.ok(sizeAfter >= sizeBefore, 'Size should grow after writes');
+});
+test('getDbSize returns 0 for non-existent path', () => {
+    assert.equal(getDbSize('/nonexistent/path'), 0);
+});
+test('initAnalytics is idempotent (schema already exists)', () => {
+    initAnalytics(tmpDir);
+    trackEvent({ category: 'test', action: 'first' });
+    closeAnalytics();
+    // Re-init should not throw or lose data
+    initAnalytics(tmpDir);
+    const db = new Database(getDbPath(tmpDir), { readonly: true });
+    const rows = db.prepare('SELECT * FROM events').all();
+    assert.equal(rows.length, 1);
+    db.close();
+});
+// ── Router endpoint tests ──────────────────────────────────────────────
+// These test the Express Router in isolation (same pattern as fs-browse.test.ts)
+import express from 'express';
+import http from 'node:http';
+import { createAnalyticsRouter } from '../server/analytics.js';
+test('POST /analytics/events batch inserts events', async () => {
+    initAnalytics(tmpDir);
+    const app = express();
+    app.use(express.json());
+    app.use('/analytics', createAnalyticsRouter(tmpDir));
+    const server = http.createServer(app);
+    await new Promise(resolve => server.listen(0, resolve));
+    const port = server.address().port;
+    const res = await fetch(`http://localhost:${port}/analytics/events`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ events: [
+                { category: 'ui', action: 'click', target: 'test-btn' },
+                { category: 'session', action: 'created' },
+            ] }),
+    });
+    const data = await res.json();
+    assert.equal(data.ok, true);
+    assert.equal(data.count, 2);
+    const db = new Database(getDbPath(tmpDir), { readonly: true });
+    const rows = db.prepare('SELECT * FROM events').all();
+    assert.equal(rows.length, 2);
+    db.close();
+    server.close();
+});
+test('GET /analytics/size returns bytes', async () => {
+    initAnalytics(tmpDir);
+    const app = express();
+    app.use('/analytics', createAnalyticsRouter(tmpDir));
+    const server = http.createServer(app);
+    await new Promise(resolve => server.listen(0, resolve));
+    const port = server.address().port;
+    const res = await fetch(`http://localhost:${port}/analytics/size`);
+    const data = await res.json();
+    assert.ok(data.bytes > 0);
+    server.close();
+});
+test('DELETE /analytics/events clears all events', async () => {
+    initAnalytics(tmpDir);
+    trackEvent({ category: 'test', action: 'to-delete' });
+    const app = express();
+    app.use(express.json());
+    app.use('/analytics', createAnalyticsRouter(tmpDir));
+    const server = http.createServer(app);
+    await new Promise(resolve => server.listen(0, resolve));
+    const port = server.address().port;
+    const res = await fetch(`http://localhost:${port}/analytics/events`, { method: 'DELETE' });
+    const data = await res.json();
+    assert.equal(data.ok, true);
+    const db = new Database(getDbPath(tmpDir), { readonly: true });
+    const rows = db.prepare('SELECT * FROM events').all();
+    assert.equal(rows.length, 0);
+    db.close();
+    server.close();
+});

package/dist/test/test/auth.test.js

@@ -0,0 +1,95 @@
+import { test } from 'node:test';
+import assert from 'node:assert';
+import { hashPin, verifyPin, isLegacyHash, isRateLimited, recordFailedAttempt, generateCookieToken, _resetForTesting, } from '../server/auth.js';
+test('hashPin returns scrypt hash with expected format', async () => {
+    _resetForTesting();
+    const hash = await hashPin('1234');
+    assert.ok(hash.startsWith('scrypt:'), `Expected hash to start with scrypt:, got: ${hash}`);
+    const parts = hash.split(':');
+    assert.strictEqual(parts.length, 3, 'Hash should have 3 colon-separated parts');
+});
+test('verifyPin returns true for correct PIN', async () => {
+    _resetForTesting();
+    const hash = await hashPin('1234');
+    const result = await verifyPin('1234', hash);
+    assert.strictEqual(result, true);
+});
+test('verifyPin returns false for wrong PIN', async () => {
+    _resetForTesting();
+    const hash = await hashPin('1234');
+    const result = await verifyPin('9999', hash);
+    assert.strictEqual(result, false);
+});
+test('rate limiter blocks after 5 failures', () => {
+    _resetForTesting();
+    const ip = '127.0.0.1';
+    for (let i = 0; i < 5; i++) {
+        recordFailedAttempt(ip);
+    }
+    assert.strictEqual(isRateLimited(ip), true);
+});
+test('rate limiter allows under threshold', () => {
+    _resetForTesting();
+    const ip = '127.0.0.1';
+    for (let i = 0; i < 4; i++) {
+        recordFailedAttempt(ip);
+    }
+    assert.strictEqual(isRateLimited(ip), false);
+});
+test('verifyPin returns false for legacy bcrypt hash (requires PIN reset)', async () => {
+    _resetForTesting();
+    const legacyHash = '$2b$10$abcdefghijklmnopqrstuuABCDEFGHIJKLMNOPQRSTUVWXYZ012';
+    const result = await verifyPin('1234', legacyHash);
+    assert.strictEqual(result, false);
+});
+test('verifyPin returns false for malformed scrypt hash (missing parts)', async () => {
+    _resetForTesting();
+    const result = await verifyPin('1234', 'scrypt:saltonly');
+    assert.strictEqual(result, false);
+});
+test('verifyPin returns false for scrypt hash with empty salt', async () => {
+    _resetForTesting();
+    const result = await verifyPin('1234', 'scrypt::deadbeef');
+    assert.strictEqual(result, false);
+});
+test('verifyPin returns false for scrypt hash with wrong key length', async () => {
+    _resetForTesting();
+    // Valid hex but wrong length (should be 64 bytes = 128 hex chars)
+    const result = await verifyPin('1234', 'scrypt:abcd1234:deadbeef');
+    assert.strictEqual(result, false);
+});
+test('verifyPin returns false for completely empty hash', async () => {
+    _resetForTesting();
+    const result = await verifyPin('1234', '');
+    assert.strictEqual(result, false);
+});
+test('verifyPin returns false for garbage input', async () => {
+    _resetForTesting();
+    const result = await verifyPin('1234', 'not-a-valid-hash-at-all');
+    assert.strictEqual(result, false);
+});
+test('hashPin produces unique salts', async () => {
+    _resetForTesting();
+    const hash1 = await hashPin('1234');
+    const hash2 = await hashPin('1234');
+    assert.notStrictEqual(hash1, hash2, 'Two hashes of the same PIN should have different salts');
+    // But both should verify correctly
+    assert.strictEqual(await verifyPin('1234', hash1), true);
+    assert.strictEqual(await verifyPin('1234', hash2), true);
+});
+test('isLegacyHash returns true for bcrypt hashes', () => {
+    assert.strictEqual(isLegacyHash('$2b$10$abcdefghijklmnopqrstuuABCDEFGHIJKLMNOPQRSTUVWXYZ012'), true);
+    assert.strictEqual(isLegacyHash('$2a$10$someotherbcrypthashvalue'), true);
+});
+test('isLegacyHash returns false for scrypt hashes', async () => {
+    const hash = await hashPin('1234');
+    assert.strictEqual(isLegacyHash(hash), false);
+});
+test('isLegacyHash returns false for empty string', () => {
+    assert.strictEqual(isLegacyHash(''), false);
+});
+test('generateCookieToken returns non-empty string', () => {
+    _resetForTesting();
+    const token = generateCookieToken();
+    assert.ok(typeof token === 'string' && token.length > 0);
+});