rufloui 0.3.2 → 0.3.35

package/src/backend/__tests__/server-integration.test.ts

@@ -0,0 +1,444 @@
+// @vitest-environment node
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import fs from 'fs'
+import path from 'path'
+import os from 'os'
+
+// ── Persistence layer tests ─────────────────────────────────────────────
+// These test the save/load cycle for .ruflo/state.json without starting the server.
+// We replicate the core persistence logic from server.ts.
+
+interface PersistedState {
+  tasks: Array<[string, unknown]>
+  workflows: Array<[string, unknown]>
+  sessions: Array<[string, unknown]>
+  agents: Array<[string, { id: string; name: string; type: string }]>
+  terminatedAgents: string[]
+  agentActivity: Array<[string, unknown]>
+  swarmConfig: {
+    id: string; topology: string; strategy: string; maxAgents: number
+    createdAt: string; shutdown: boolean
+  }
+  perfHistory: Array<{ timestamp: string; latency: number; throughput: number }>
+  lastPerfMetrics: unknown
+  benchmarkHasRun: boolean
+  currentSwarmAgentIds: string[]
+}
+
+function createTestPersistDir(): string {
+  const dir = path.join(os.tmpdir(), `ruflo-test-${Date.now()}-${Math.random().toString(36).slice(2)}`)
+  fs.mkdirSync(dir, { recursive: true })
+  return dir
+}
+
+function cleanupDir(dir: string) {
+  try { fs.rmSync(dir, { recursive: true, force: true }) } catch { /* ignore */ }
+}
+
+function saveToDisk(persistDir: string, state: PersistedState) {
+  if (!fs.existsSync(persistDir)) fs.mkdirSync(persistDir, { recursive: true })
+  const target = path.join(persistDir, 'state.json')
+  const tmp = target + '.tmp'
+  fs.writeFileSync(tmp, JSON.stringify(state, null, 2))
+  fs.renameSync(tmp, target)
+}
+
+function loadFromDisk(persistDir: string): PersistedState | null {
+  const filePath = path.join(persistDir, 'state.json')
+  const tmpPath = filePath + '.tmp'
+  // Recovery from interrupted write
+  if (!fs.existsSync(filePath) && fs.existsSync(tmpPath)) {
+    try { fs.renameSync(tmpPath, filePath) } catch { /* ignore */ }
+  }
+  if (!fs.existsSync(filePath)) return null
+  return JSON.parse(fs.readFileSync(filePath, 'utf-8'))
+}
+
+describe('Persistence layer (save/load from .ruflo/state.json)', () => {
+  let testDir: string
+
+  beforeEach(() => { testDir = createTestPersistDir() })
+  afterEach(() => { cleanupDir(testDir) })
+
+  it('saves and loads tasks', () => {
+    const state: PersistedState = {
+      tasks: [['t1', { id: 't1', title: 'Test', status: 'pending' }]],
+      workflows: [], sessions: [], agents: [], terminatedAgents: [],
+      agentActivity: [],
+      swarmConfig: { id: '', topology: 'mesh', strategy: 'round-robin', maxAgents: 8, createdAt: '', shutdown: true },
+      perfHistory: [], lastPerfMetrics: null, benchmarkHasRun: false, currentSwarmAgentIds: [],
+    }
+    saveToDisk(testDir, state)
+    const loaded = loadFromDisk(testDir)
+    expect(loaded).not.toBeNull()
+    expect(loaded!.tasks).toHaveLength(1)
+    expect(loaded!.tasks[0][0]).toBe('t1')
+    expect((loaded!.tasks[0][1] as any).title).toBe('Test')
+  })
+
+  it('saves and loads agents and terminated agents', () => {
+    const state: PersistedState = {
+      tasks: [], workflows: [], sessions: [],
+      agents: [
+        ['2025-01-01T00:00:00', { id: 'a1', name: 'coder-1', type: 'coder' }],
+        ['2025-01-01T01:00:00', { id: 'a2', name: 'tester-1', type: 'tester' }],
+      ],
+      terminatedAgents: ['2025-01-01T00:00:00'],
+      agentActivity: [['a1', { status: 'idle', lastSeen: '2025-01-01' }]],
+      swarmConfig: { id: 's1', topology: 'hierarchical', strategy: 'specialized', maxAgents: 4, createdAt: '2025-01-01', shutdown: false },
+      perfHistory: [], lastPerfMetrics: null, benchmarkHasRun: false, currentSwarmAgentIds: ['a1', 'a2'],
+    }
+    saveToDisk(testDir, state)
+    const loaded = loadFromDisk(testDir)
+    expect(loaded!.agents).toHaveLength(2)
+    expect(loaded!.terminatedAgents).toEqual(['2025-01-01T00:00:00'])
+    expect(loaded!.currentSwarmAgentIds).toEqual(['a1', 'a2'])
+    expect(loaded!.swarmConfig.id).toBe('s1')
+    expect(loaded!.swarmConfig.shutdown).toBe(false)
+  })
+
+  it('saves and loads workflows and sessions', () => {
+    const state: PersistedState = {
+      tasks: [],
+      workflows: [['w1', { id: 'w1', name: 'deploy', status: 'completed', steps: [] }]],
+      sessions: [['s1', { id: 's1', name: 'morning', status: 'saved' }]],
+      agents: [], terminatedAgents: [], agentActivity: [],
+      swarmConfig: { id: '', topology: 'mesh', strategy: '', maxAgents: 8, createdAt: '', shutdown: true },
+      perfHistory: [{ timestamp: '2025-01-01T00:00:00Z', latency: 50, throughput: 100 }],
+      lastPerfMetrics: { some: 'data' },
+      benchmarkHasRun: true, currentSwarmAgentIds: [],
+    }
+    saveToDisk(testDir, state)
+    const loaded = loadFromDisk(testDir)
+    expect(loaded!.workflows).toHaveLength(1)
+    expect(loaded!.sessions).toHaveLength(1)
+    expect(loaded!.perfHistory).toHaveLength(1)
+    expect(loaded!.benchmarkHasRun).toBe(true)
+  })
+
+  it('returns null when no state file exists', () => {
+    const emptyDir = createTestPersistDir()
+    const loaded = loadFromDisk(emptyDir)
+    expect(loaded).toBeNull()
+    cleanupDir(emptyDir)
+  })
+
+  it('recovers from .tmp file when main state.json is missing', () => {
+    const state: PersistedState = {
+      tasks: [['t1', { id: 't1', title: 'Recovered' }]],
+      workflows: [], sessions: [], agents: [], terminatedAgents: [],
+      agentActivity: [],
+      swarmConfig: { id: '', topology: 'mesh', strategy: '', maxAgents: 8, createdAt: '', shutdown: true },
+      perfHistory: [], lastPerfMetrics: null, benchmarkHasRun: false, currentSwarmAgentIds: [],
+    }
+    // Write only the .tmp file (simulating crash during write)
+    const tmpPath = path.join(testDir, 'state.json.tmp')
+    fs.writeFileSync(tmpPath, JSON.stringify(state, null, 2))
+
+    const loaded = loadFromDisk(testDir)
+    expect(loaded).not.toBeNull()
+    expect((loaded!.tasks[0][1] as any).title).toBe('Recovered')
+  })
+
+  it('atomic write creates .tmp then renames', () => {
+    const state: PersistedState = {
+      tasks: [], workflows: [], sessions: [], agents: [], terminatedAgents: [],
+      agentActivity: [],
+      swarmConfig: { id: '', topology: 'mesh', strategy: '', maxAgents: 8, createdAt: '', shutdown: true },
+      perfHistory: [], lastPerfMetrics: null, benchmarkHasRun: false, currentSwarmAgentIds: [],
+    }
+    saveToDisk(testDir, state)
+    // After save, .tmp should NOT exist (renamed to state.json)
+    expect(fs.existsSync(path.join(testDir, 'state.json.tmp'))).toBe(false)
+    expect(fs.existsSync(path.join(testDir, 'state.json'))).toBe(true)
+  })
+
+  it('handles corrupted JSON gracefully', () => {
+    fs.writeFileSync(path.join(testDir, 'state.json'), 'not valid json{{{')
+    expect(() => loadFromDisk(testDir)).toThrow()
+  })
+})
+
+// ── parseCliTable additional edge cases ─────────────────────────────────
+
+function parseCliTable(raw: string): Record<string, string>[] {
+  const lines = raw.replace(/\r/g, '').split('\n')
+  const dataLines = lines.filter(l => l.trim().startsWith('|') && !l.match(/^[|+\-─\s]+$/))
+  if (dataLines.length < 2) return []
+  const splitRow = (line: string) =>
+    line.split('|').slice(1, -1).map(c => c.trim().replace(/\.{3}$/, ''))
+  const headers = splitRow(dataLines[0]).map(h => h.toLowerCase().replace(/\s+/g, '_'))
+  return dataLines.slice(1).map(line => {
+    const cells = splitRow(line)
+    const obj: Record<string, string> = {}
+    headers.forEach((h, i) => { obj[h] = cells[i] ?? '' })
+    return obj
+  })
+}
+
+describe('parseCliTable — integration with real CLI output patterns', () => {
+  it('parses agent list output format', () => {
+    const cliOutput = [
+      '+-------------------+---------+----------+',
+      '| Name              | Type    | Created  |',
+      '+-------------------+---------+----------+',
+      '| coder-1           | coder   | 10:30:00 |',
+      '| researcher-alpha  | resear  | 10:31:00 |',
+      '+-------------------+---------+----------+',
+    ].join('\n')
+    const result = parseCliTable(cliOutput)
+    expect(result).toHaveLength(2)
+    expect(result[0].name).toBe('coder-1')
+    expect(result[0].type).toBe('coder')
+    expect(result[1].name).toBe('researcher-alpha')
+  })
+
+  it('parses performance metrics output', () => {
+    const cliOutput = [
+      '| Metric     | Current | Limit | Status |',
+      '+------------+---------+-------+--------+',
+      '| Latency    | 45ms    | 100ms | ok     |',
+      '| Throughput | 120/s   | 500/s | ok     |',
+      '| Memory     | 256MB   | 1GB   | ok     |',
+    ].join('\n')
+    const result = parseCliTable(cliOutput)
+    expect(result).toHaveLength(3)
+    expect(result[0].metric).toBe('Latency')
+    expect(result[2].metric).toBe('Memory')
+    expect(result[2].limit).toBe('1GB')
+  })
+
+  it('parses benchmark output with different columns', () => {
+    const cliOutput = [
+      '| Operation | Mean  | P95   | P99   | Status |',
+      '+-----------+-------+-------+-------+--------+',
+      '| read      | 12ms  | 25ms  | 50ms  | pass   |',
+      '| write     | 18ms  | 35ms  | 70ms  | pass   |',
+    ].join('\n')
+    const result = parseCliTable(cliOutput)
+    expect(result).toHaveLength(2)
+    expect(result[0]).toEqual({
+      operation: 'read', mean: '12ms', p95: '25ms', p99: '50ms', status: 'pass',
+    })
+  })
+})
+
+// ── Health check parsing ────────────────────────────────────────────────
+
+describe('Health check parsing logic', () => {
+  const knownChecks = [
+    'Version Freshness', 'Node.js Version', 'npm Version', 'Claude Code CLI',
+    'Git:', 'Git Repository', 'Config File', 'Daemon Status', 'Memory Database',
+    'API Keys', 'MCP Servers', 'Disk Space', 'TypeScript', 'agentic-flow',
+  ]
+
+  function parseHealthChecks(raw: string): Array<{ name: string; status: 'pass' | 'warn' | 'fail'; detail: string }> {
+    const checks: Array<{ name: string; status: 'pass' | 'warn' | 'fail'; detail: string }> = []
+    for (const line of raw.replace(/\r/g, '').split('\n')) {
+      for (const check of knownChecks) {
+        const checkName = check.replace(':', '')
+        if (line.includes(checkName + ':')) {
+          const colonIdx = line.indexOf(checkName + ':')
+          const name = checkName.trim()
+          const detail = line.substring(colonIdx + checkName.length + 1).trim()
+          const isWarn = detail.match(/not (a |running|installed|found)|no (config|api)/i)
+          const isFail = detail.match(/fail|error|critical/i)
+          checks.push({
+            name,
+            status: isFail ? 'fail' : isWarn ? 'warn' : 'pass',
+            detail,
+          })
+          break
+        }
+      }
+    }
+    return checks
+  }
+
+  it('parses passing checks', () => {
+    const raw = [
+      '✓ Version Freshness: v3.1.0 (latest)',
+      '✓ Node.js Version: v20.11.0',
+      '✓ npm Version: 10.2.4',
+    ].join('\n')
+    const checks = parseHealthChecks(raw)
+    expect(checks).toHaveLength(3)
+    expect(checks[0]).toEqual({ name: 'Version Freshness', status: 'pass', detail: 'v3.1.0 (latest)' })
+    expect(checks[1]).toEqual({ name: 'Node.js Version', status: 'pass', detail: 'v20.11.0' })
+  })
+
+  it('parses warning checks (not installed, not found)', () => {
+    const raw = [
+      '⚠ Daemon Status: not running',
+      '⚠ API Keys: no API key configured',
+    ].join('\n')
+    const checks = parseHealthChecks(raw)
+    expect(checks).toHaveLength(2)
+    expect(checks[0].status).toBe('warn')
+    expect(checks[1].status).toBe('warn')
+  })
+
+  it('parses fail checks', () => {
+    const raw = '✗ Memory Database: critical error in HNSW index'
+    const checks = parseHealthChecks(raw)
+    expect(checks).toHaveLength(1)
+    expect(checks[0].status).toBe('fail')
+  })
+
+  it('handles Windows-mangled output (no Unicode)', () => {
+    // On Windows, UTF-8 symbols may get mangled, so we rely on check names
+    const raw = [
+      '? Version Freshness: v3.1.0',
+      '? Daemon Status: not running',
+    ].join('\n')
+    const checks = parseHealthChecks(raw)
+    expect(checks).toHaveLength(2)
+    expect(checks[0].name).toBe('Version Freshness')
+    expect(checks[1].status).toBe('warn')
+  })
+
+  it('returns empty for unrecognized output', () => {
+    const raw = 'Some random output\nwithout check names'
+    const checks = parseHealthChecks(raw)
+    expect(checks).toHaveLength(0)
+  })
+})
+
+// ── Time matching logic ─────────────────────────────────────────────────
+
+describe('Time matching (UTC to local conversion)', () => {
+  it('converts UTC ISO string to local time string', () => {
+    const utcDate = new Date('2025-01-15T14:30:00Z')
+    // The registry stores local time for matching with `agent list` output
+    const localStr = utcDate.toLocaleTimeString('en-US', { hour12: false })
+    // localStr should be a valid time like "09:30:00" or "14:30:00" depending on timezone
+    expect(localStr).toMatch(/^\d{2}:\d{2}:\d{2}$/)
+  })
+
+  it('handles date at midnight UTC', () => {
+    const utcDate = new Date('2025-06-01T00:00:00Z')
+    const localStr = utcDate.toLocaleTimeString('en-US', { hour12: false })
+    expect(localStr).toMatch(/^\d{2}:\d{2}:\d{2}$/)
+  })
+
+  it('handles date at end of day UTC', () => {
+    const utcDate = new Date('2025-06-01T23:59:59Z')
+    const localStr = utcDate.toLocaleTimeString('en-US', { hour12: false })
+    expect(localStr).toMatch(/^\d{2}:\d{2}:\d{2}$/)
+  })
+})
+
+// ── Env var cleanup ─────────────────────────────────────────────────────
+
+describe('Env var cleanup for child processes', () => {
+  it('identifies CLAUDE-prefixed env vars', () => {
+    const testEnv: Record<string, string> = {
+      CLAUDE_SESSION_ID: 'abc123',
+      CLAUDE_API_KEY: 'sk-test',
+      CLAUDE_CONFIG_DIR: '/home/user/.claude',
+      PATH: '/usr/bin',
+      HOME: '/home/user',
+      NODE_ENV: 'development',
+    }
+
+    // Replicate the env cleanup logic from server.ts
+    const cleanEnv = { ...testEnv }
+    for (const key of Object.keys(cleanEnv)) {
+      if (key.startsWith('CLAUDE')) delete cleanEnv[key]
+    }
+
+    expect(cleanEnv).not.toHaveProperty('CLAUDE_SESSION_ID')
+    expect(cleanEnv).not.toHaveProperty('CLAUDE_API_KEY')
+    expect(cleanEnv).not.toHaveProperty('CLAUDE_CONFIG_DIR')
+    expect(cleanEnv).toHaveProperty('PATH')
+    expect(cleanEnv).toHaveProperty('HOME')
+    expect(cleanEnv).toHaveProperty('NODE_ENV')
+  })
+
+  it('handles env with no CLAUDE vars', () => {
+    const testEnv: Record<string, string> = { PATH: '/usr/bin', HOME: '/home' }
+    const cleanEnv = { ...testEnv }
+    for (const key of Object.keys(cleanEnv)) {
+      if (key.startsWith('CLAUDE')) delete cleanEnv[key]
+    }
+    expect(Object.keys(cleanEnv)).toEqual(['PATH', 'HOME'])
+  })
+
+  it('handles env with only CLAUDE vars', () => {
+    const testEnv: Record<string, string> = { CLAUDE_A: '1', CLAUDE_B: '2' }
+    const cleanEnv = { ...testEnv }
+    for (const key of Object.keys(cleanEnv)) {
+      if (key.startsWith('CLAUDE')) delete cleanEnv[key]
+    }
+    expect(Object.keys(cleanEnv)).toHaveLength(0)
+  })
+})
+
+// ── WebSocket broadcast logic ───────────────────────────────────────────
+
+describe('WebSocket broadcast logic', () => {
+  const PERSIST_EVENTS = new Set([
+    'task:added', 'task:updated', 'task:list',
+    'workflow:added', 'workflow:updated',
+    'session:added', 'session:updated', 'session:list', 'session:active',
+    'swarm:status', 'swarm-monitor:purged',
+    'agent:activity', 'agent:added', 'agent:removed', 'agents:cleared',
+    'performance:metrics',
+  ])
+
+  it('identifies persist-worthy event types', () => {
+    expect(PERSIST_EVENTS.has('task:added')).toBe(true)
+    expect(PERSIST_EVENTS.has('task:updated')).toBe(true)
+    expect(PERSIST_EVENTS.has('swarm:status')).toBe(true)
+    expect(PERSIST_EVENTS.has('agent:activity')).toBe(true)
+  })
+
+  it('does not persist transient events', () => {
+    expect(PERSIST_EVENTS.has('task:output')).toBe(false)
+    expect(PERSIST_EVENTS.has('agent:output')).toBe(false)
+    expect(PERSIST_EVENTS.has('log')).toBe(false)
+    expect(PERSIST_EVENTS.has('viz:update')).toBe(false)
+  })
+
+  it('broadcast message format is valid JSON with type, payload, timestamp', () => {
+    const type = 'task:added'
+    const payload = { id: 't1', title: 'Test' }
+    const msg = JSON.stringify({ type, payload, timestamp: new Date().toISOString() })
+    const parsed = JSON.parse(msg)
+    expect(parsed.type).toBe('task:added')
+    expect(parsed.payload.id).toBe('t1')
+    expect(parsed.timestamp).toBeTruthy()
+  })
+})
+
+// ── sanitizeShellArg comprehensive tests ────────────────────────────────
+
+function sanitizeShellArg(arg: string): string {
+  return arg.replace(/[;&|`$(){}[\]!#~<>\\]/g, '')
+}
+
+describe('sanitizeShellArg — injection prevention', () => {
+  it('blocks command chaining with semicolons', () => {
+    expect(sanitizeShellArg('coder; rm -rf /')).toBe('coder rm -rf /')
+  })
+
+  it('blocks pipe injection', () => {
+    expect(sanitizeShellArg('coder | cat /etc/passwd')).toBe('coder  cat /etc/passwd')
+  })
+
+  it('blocks command substitution', () => {
+    expect(sanitizeShellArg('$(cat /etc/shadow)')).toBe('cat /etc/shadow')
+    expect(sanitizeShellArg('`id`')).toBe('id')
+  })
+
+  it('preserves normal agent names', () => {
+    expect(sanitizeShellArg('my-coder-agent')).toBe('my-coder-agent')
+    expect(sanitizeShellArg('researcher_v2')).toBe('researcher_v2')
+    expect(sanitizeShellArg('agent.test')).toBe('agent.test')
+  })
+
+  it('preserves spaces and dashes', () => {
+    expect(sanitizeShellArg('my agent name')).toBe('my agent name')
+    expect(sanitizeShellArg('code-review-2025')).toBe('code-review-2025')
+  })
+})

package/src/backend/__tests__/server-utils.test.ts

@@ -0,0 +1,200 @@
+// @vitest-environment node
+import { describe, it, expect } from 'vitest'
+
+// ── Utility functions copied from server.ts (can't import — it starts a server) ──
+
+function parseCliTable(raw: string): Record<string, string>[] {
+  const lines = raw.replace(/\r/g, '').split('\n')
+  const dataLines = lines.filter(l => l.trim().startsWith('|') && !l.match(/^[|+\-─\s]+$/))
+  if (dataLines.length < 2) return []
+  const splitRow = (line: string) =>
+    line.split('|').slice(1, -1).map(c => c.trim().replace(/\.{3}$/, ''))
+  const headers = splitRow(dataLines[0]).map(h => h.toLowerCase().replace(/\s+/g, '_'))
+  return dataLines.slice(1).map(line => {
+    const cells = splitRow(line)
+    const obj: Record<string, string> = {}
+    headers.forEach((h, i) => { obj[h] = cells[i] ?? '' })
+    return obj
+  })
+}
+
+function parseCliOutput(raw: string): unknown {
+  const lines = raw.split('\n').filter(l => l.trim() && !l.match(/^[+─┌┐└┘├┤┬┴┼═╔╗╚╝╠╣╦╩╬\-]+$/))
+  const data: Record<string, string> = {}
+  for (const line of lines) {
+    const match = line.match(/^\|\s*(.+?)\s*\|\s*(.+?)\s*\|$/)
+    if (match && !match[1].match(/^-+$/)) {
+      data[match[1].trim()] = match[2].trim()
+    }
+  }
+  return Object.keys(data).length > 0 ? data : { raw }
+}
+
+function sanitizeShellArg(arg: string): string {
+  return arg.replace(/[;&|`$(){}[\]!#~<>\\]/g, '')
+}
+
+// ── parseCliTable ───────────────────────────────────────────────────────
+
+describe('parseCliTable', () => {
+  it('returns empty array for empty string', () => {
+    expect(parseCliTable('')).toEqual([])
+  })
+
+  it('returns empty array for header-only table', () => {
+    const table = '| Name | Status |\n+------+--------+'
+    expect(parseCliTable(table)).toEqual([])
+  })
+
+  it('parses a 2-column table', () => {
+    const table = [
+      '| Name   | Status  |',
+      '+--------+---------+',
+      '| agent1 | running |',
+      '| agent2 | idle    |',
+    ].join('\n')
+    const result = parseCliTable(table)
+    expect(result).toEqual([
+      { name: 'agent1', status: 'running' },
+      { name: 'agent2', status: 'idle' },
+    ])
+  })
+
+  it('parses a multi-column table', () => {
+    const table = [
+      '| Metric     | Current | Limit | Status |',
+      '+------------+---------+-------+--------+',
+      '| Latency    | 45ms    | 100ms | ok     |',
+      '| Throughput | 120/s   | 500/s | ok     |',
+    ].join('\n')
+    const result = parseCliTable(table)
+    expect(result).toHaveLength(2)
+    expect(result[0]).toEqual({ metric: 'Latency', current: '45ms', limit: '100ms', status: 'ok' })
+    expect(result[1]).toEqual({ metric: 'Throughput', current: '120/s', limit: '500/s', status: 'ok' })
+  })
+
+  it('strips trailing ellipsis from cell values', () => {
+    const table = [
+      '| Name          | Description    |',
+      '+---------------+----------------+',
+      '| long-agent... | does stuff...  |',
+    ].join('\n')
+    const result = parseCliTable(table)
+    expect(result[0].name).toBe('long-agent')
+    expect(result[0].description).toBe('does stuff')
+  })
+
+  it('filters separator lines', () => {
+    const table = [
+      '+--------+---------+',
+      '| Name   | Status  |',
+      '+--------+---------+',
+      '| agent1 | running |',
+      '+--------+---------+',
+    ].join('\n')
+    const result = parseCliTable(table)
+    expect(result).toHaveLength(1)
+    expect(result[0].name).toBe('agent1')
+  })
+
+  it('lowercases headers and replaces spaces with underscores', () => {
+    const table = [
+      '| Agent Name | Run Count | Last Activity |',
+      '| bot-1      | 5         | 2025-01-01    |',
+    ].join('\n')
+    const result = parseCliTable(table)
+    expect(result[0]).toHaveProperty('agent_name', 'bot-1')
+    expect(result[0]).toHaveProperty('run_count', '5')
+    expect(result[0]).toHaveProperty('last_activity', '2025-01-01')
+  })
+
+  it('handles Windows \\r\\n line endings', () => {
+    const table = '| Name | Val |\r\n| a    | b   |\r\n'
+    const result = parseCliTable(table)
+    expect(result).toHaveLength(1)
+    expect(result[0]).toEqual({ name: 'a', val: 'b' })
+  })
+
+  it('handles missing cells gracefully', () => {
+    const table = [
+      '| A | B | C |',
+      '| 1 | 2 |',
+    ].join('\n')
+    const result = parseCliTable(table)
+    expect(result[0].a).toBe('1')
+    expect(result[0].b).toBe('2')
+    expect(result[0].c).toBe('')
+  })
+})
+
+// ── parseCliOutput ──────────────────────────────────────────────────────
+
+describe('parseCliOutput', () => {
+  it('parses key-value table', () => {
+    const raw = [
+      '+----------+--------+',
+      '| Status   | active |',
+      '| Uptime   | 5m     |',
+      '+----------+--------+',
+    ].join('\n')
+    const result = parseCliOutput(raw) as Record<string, string>
+    expect(result.Status).toBe('active')
+    expect(result.Uptime).toBe('5m')
+  })
+
+  it('returns { raw } for non-table input', () => {
+    const raw = 'Some plain text output'
+    expect(parseCliOutput(raw)).toEqual({ raw: 'Some plain text output' })
+  })
+
+  it('filters separator and border lines', () => {
+    const raw = [
+      '╔══════════╗',
+      '| Key | Val |',
+      '╚══════════╝',
+    ].join('\n')
+    const result = parseCliOutput(raw) as Record<string, string>
+    expect(result.Key).toBe('Val')
+  })
+
+  it('returns { raw } for empty string', () => {
+    expect(parseCliOutput('')).toEqual({ raw: '' })
+  })
+})
+
+// ── sanitizeShellArg ────────────────────────────────────────────────────
+
+describe('sanitizeShellArg', () => {
+  it('returns clean strings unchanged', () => {
+    expect(sanitizeShellArg('hello-world')).toBe('hello-world')
+    expect(sanitizeShellArg('agent_name')).toBe('agent_name')
+    expect(sanitizeShellArg('test123')).toBe('test123')
+  })
+
+  it('removes semicolons and pipes', () => {
+    expect(sanitizeShellArg('cmd;rm -rf /')).toBe('cmdrm -rf /')
+    expect(sanitizeShellArg('a|b')).toBe('ab')
+  })
+
+  it('removes backticks and dollar signs', () => {
+    expect(sanitizeShellArg('`whoami`')).toBe('whoami')
+    expect(sanitizeShellArg('$HOME')).toBe('HOME')
+  })
+
+  it('removes parentheses and braces', () => {
+    expect(sanitizeShellArg('$(cmd)')).toBe('cmd')
+    expect(sanitizeShellArg('{a,b}')).toBe('a,b')
+  })
+
+  it('removes brackets, hash, tilde, angle brackets, backslash', () => {
+    expect(sanitizeShellArg('[test]')).toBe('test')
+    expect(sanitizeShellArg('#comment')).toBe('comment')
+    expect(sanitizeShellArg('~user')).toBe('user')
+    expect(sanitizeShellArg('<in>')).toBe('in')
+    expect(sanitizeShellArg('path\\to')).toBe('pathto')
+  })
+
+  it('removes mixed dangerous characters', () => {
+    expect(sanitizeShellArg('a;b|c`d$e(f)g{h}i[j]k!l#m~n<o>p\\q')).toBe('abcdefghijklmnopq')
+  })
+})