unbound-cli 1.13.0 → 1.15.0

package/test/analytics-columns.test.js

@@ -0,0 +1,68 @@
+const test = require('node:test');
+const assert = require('node:assert');
+
+const { DATASETS, selectTableColumns } = require('../src/commands/analytics');
+const { resolveFormat } = require('../src/lib/analytics-query');
+
+const TERMINAL_COLUMNS = [
+  'Timestamp', 'User', 'Email', 'AI Tool', 'Command Family', 'All Command Families',
+  'Command', 'User Prompt', 'Risk Score', 'Risk Reason', 'Initiator', 'Matched Policies',
+];
+
+test('the table view drops the wide columns that would flood a terminal', () => {
+  const rows = [TERMINAL_COLUMNS.map((_, i) => `v${i}`)];
+  const view = selectTableColumns(DATASETS.terminal, TERMINAL_COLUMNS, rows);
+
+  assert.deepStrictEqual(view.columns, DATASETS.terminal.tableColumns);
+  assert.ok(!view.columns.includes('User Prompt'));
+  assert.ok(!view.columns.includes('Risk Reason'));
+  assert.strictEqual(view.hidden, TERMINAL_COLUMNS.length - view.columns.length);
+});
+
+test('selected cells stay aligned with their headers', () => {
+  const rows = [TERMINAL_COLUMNS.map((name) => `value:${name}`)];
+  const view = selectTableColumns(DATASETS.terminal, TERMINAL_COLUMNS, rows);
+
+  view.columns.forEach((name, i) => {
+    assert.strictEqual(view.rows[0][i], `value:${name}`);
+  });
+});
+
+test('table columns keep the server order, not the order they are listed in', () => {
+  const view = selectTableColumns(DATASETS.terminal, TERMINAL_COLUMNS, []);
+  const serverOrder = TERMINAL_COLUMNS.filter((c) => view.columns.includes(c));
+  assert.deepStrictEqual(view.columns, serverOrder);
+});
+
+test('an unrecognised column set falls back to showing everything', () => {
+  const columns = ['Something', 'Else'];
+  const view = selectTableColumns(DATASETS.terminal, columns, [['a', 'b']]);
+  assert.deepStrictEqual(view.columns, columns);
+  assert.deepStrictEqual(view.rows, [['a', 'b']]);
+});
+
+test('every dataset names only columns the export actually returns', () => {
+  const known = {
+    'terminal-runs': TERMINAL_COLUMNS,
+    'mcp-actions': ['Timestamp', 'User', 'Email', 'AI Tool', 'MCP Server', 'MCP Tool',
+      'Targets', 'User Prompt', 'Risk Score', 'Risk Reason', 'Initiator', 'Matched Policies'],
+    unsanctioned: ['Timestamp', 'User', 'Email', 'AI Tool', 'MCP Server', 'MCP Tool',
+      'Status', 'Sanction Message', 'User Prompt'],
+    'mcp-servers': ['MCP Server', 'Actions', 'Average Risk Score'],
+  };
+
+  for (const dataset of Object.values(DATASETS)) {
+    for (const column of dataset.tableColumns) {
+      assert.ok(
+        known[dataset.key].includes(column),
+        `${dataset.key} lists "${column}", which the export does not return`,
+      );
+    }
+  }
+});
+
+// Commander used to default --format to "table", which made --json look like a
+// contradiction and broke `--json` on every subcommand.
+test('--json works when --format was never passed', () => {
+  assert.strictEqual(resolveFormat({ json: true, format: undefined }), 'json');
+});

package/test/analytics-export-job.test.js

@@ -0,0 +1,141 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const http = require('http');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const api = require('../src/api');
+const { describeError, safeFilename } = require('../src/lib/downloads');
+
+// `--format csv` no longer streams from our backend: it starts a job, polls it,
+// then pulls the finished file from a presigned S3 URL. That last hop is the
+// part worth pinning down, because it leaves our own origin — a credential sent
+// there goes to a third party, and a short file there reads as a complete CSV.
+
+function startServer(handler) {
+  const server = http.createServer(handler);
+  return new Promise((resolve) => {
+    server.listen(0, '127.0.0.1', () => resolve({ server, port: server.address().port }));
+  });
+}
+
+function freshTmp() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'export-test-'));
+  return { dir, file: path.join(dir, 'out.csv') };
+}
+
+test('fetchToStream sends NO Authorization header (the API key must not reach S3)', async () => {
+  let seen = 'header-never-observed';
+  const { server, port } = await startServer((req, res) => {
+    seen = req.headers.authorization;
+    res.writeHead(200, { 'Content-Type': 'text/csv' });
+    res.end('a,b\n1,2\n');
+  });
+  const { dir, file } = freshTmp();
+  try {
+    await api.fetchToStream(`http://127.0.0.1:${port}/signed`, {
+      transport: http,
+      onHeaders: () => fs.createWriteStream(file),
+    });
+    assert.equal(seen, undefined, 'a presigned URL must be fetched with no credentials attached');
+    assert.equal(fs.readFileSync(file, 'utf8'), 'a,b\n1,2\n');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+    server.close();
+  }
+});
+
+test('fetchToStream refuses a redirect instead of following it to another host', async () => {
+  // A presigned URL points straight at the signing endpoint, so a Location
+  // header is either a misconfigured region or a response steering the client
+  // at a host nobody vetted. Following it would turn an export into an
+  // outbound request to somewhere the operator never chose.
+  let hops = 0;
+  const { server, port } = await startServer((req, res) => {
+    hops += 1;
+    res.writeHead(302, { Location: 'http://169.254.169.254/latest/meta-data/' });
+    res.end();
+  });
+  try {
+    await assert.rejects(
+      () => api.fetchToStream(`http://127.0.0.1:${port}/signed`, {
+        transport: http,
+        onHeaders: () => process.stdout,
+      }),
+      /redirected to somewhere unexpected/,
+    );
+    assert.equal(hops, 1, 'the redirect target must never be requested');
+  } finally {
+    server.close();
+  }
+});
+
+test('fetchToStream maps an expired signature (403) to a message that says what to do', async () => {
+  const { server, port } = await startServer((req, res) => {
+    res.writeHead(403, { 'Content-Type': 'application/xml' });
+    res.end('<Error><Code>AccessDenied</Code></Error>');
+  });
+  try {
+    await assert.rejects(
+      () => api.fetchToStream(`http://127.0.0.1:${port}/expired`, {
+        transport: http,
+        onHeaders: () => process.stdout,
+      }),
+      // S3 answers in XML, which means nothing to a CLI user.
+      /link has expired. Run the export again/,
+    );
+  } finally {
+    server.close();
+  }
+});
+
+test('fetchToStream rejects a non-http(s) URL rather than handing it to a transport', async () => {
+  await assert.rejects(
+    () => api.fetchToStream('file:///etc/passwd', { onHeaders: () => process.stdout }),
+    /Refusing to download from a file: URL/,
+  );
+});
+
+test('safeFilename keeps the basename so the server cannot pick where the file lands', () => {
+  assert.equal(safeFilename('../../.zshrc', 'fallback.csv'), '.zshrc');
+  assert.equal(safeFilename('/etc/passwd', 'fallback.csv'), 'passwd');
+  assert.equal(safeFilename('acme_logs_2026-07-01_to_2026-07-31.csv', 'f.csv'),
+    'acme_logs_2026-07-01_to_2026-07-31.csv');
+  assert.equal(safeFilename('..', 'fallback.csv'), 'fallback.csv');
+  assert.equal(safeFilename('', 'fallback.csv'), 'fallback.csv');
+  assert.equal(safeFilename(null, 'fallback.csv'), 'fallback.csv');
+});
+
+test('an over-limit export (422) reports the real row count and how to narrow it', () => {
+  const err = new api.ApiError(422, {
+    error: 'Too many rows', row_count: 47651, limit: 25000, exceeds_limit: true,
+  });
+  const message = describeError(err, 'Terminal Runs export');
+  assert.match(message, /47,651 rows/);
+  assert.match(message, /25,000-row export limit/);
+  // Says what to do without naming a flag: `download` has --last, `analytics`
+  // has --time-window, and this one message is shown by both.
+  assert.match(message, /Narrow the date range or add filters/);
+});
+
+test('a backend still on the streaming export (405) says so instead of "not found"', () => {
+  const message = describeError(new api.ApiError(405, {}), 'Terminal Runs export');
+  assert.match(message, /too old for this CLI/);
+});
+
+test('describeError works with no dataset, for `download get`', () => {
+  const message = describeError(new api.ApiError(403, {}));
+  assert.match(message, /Admin role required/);
+});
+
+// A 404 means different things on the two paths, and saying the wrong one sends
+// the reader off to check their backend version when the job simply expired.
+test('a 404 by job ID says the export is gone, not that the backend is too old', () => {
+  const byId = describeError(new api.ApiError(404, {}), 'export', { byJobId: true });
+  assert.match(byId, /No export with that ID/);
+  assert.doesNotMatch(byId, /backend/);
+
+  const byKind = describeError(new api.ApiError(404, {}), 'logs-export export');
+  assert.match(byKind, /does not serve/);
+});

package/test/analytics-log-table.test.js

@@ -0,0 +1,77 @@
+const test = require('node:test');
+const assert = require('node:assert');
+
+const output = require('../src/output');
+
+function capture(fn) {
+  const lines = [];
+  const original = console.log;
+  console.log = (...args) => lines.push(args.join(' '));
+  try {
+    fn();
+  } finally {
+    console.log = original;
+  }
+  return lines;
+}
+
+const HEADERS = ['Timestamp', 'User', 'Command'];
+const LONG = 'rm -rf /very/long/path/that/keeps/going/and/going/and/going/forever/and/ever';
+
+test('logTable prints a header, a rule and one line per row', () => {
+  const lines = capture(() =>
+    output.logTable(HEADERS, [['2026-08-05', 'ada', 'ls'], ['2026-08-04', 'bob', 'pwd']], { maxWidth: 120 }),
+  );
+  assert.strictEqual(lines.length, 4);
+  assert.ok(lines[0].includes('Timestamp'));
+  assert.match(lines[1], /^[─ ]+$/);
+  assert.ok(lines[2].includes('ada'));
+  assert.ok(lines[3].includes('bob'));
+});
+
+test('logTable says so instead of printing an empty frame', () => {
+  const lines = capture(() => output.logTable(HEADERS, []));
+  assert.strictEqual(lines.length, 1);
+  assert.match(lines[0], /No results found/);
+});
+
+test('logTable never exceeds the terminal width', () => {
+  const maxWidth = 60;
+  const lines = capture(() =>
+    output.logTable(HEADERS, [['2026-08-05T09:55:44Z', 'ada@example.com', LONG]], { maxWidth }),
+  );
+  for (const line of lines) {
+    // biome-ignore lint: strip ANSI colour codes before measuring
+    const plain = line.replace(/\x1b\[[0-9;]*m/g, '');
+    assert.ok(plain.length <= maxWidth, `line of ${plain.length} exceeded ${maxWidth}: ${plain}`);
+  }
+});
+
+test('logTable marks a clipped value with an ellipsis', () => {
+  const lines = capture(() => output.logTable(HEADERS, [['2026-08-05', 'ada', LONG]], { maxWidth: 60 }));
+  assert.ok(lines[2].includes('…'), 'expected the long command to be clipped');
+});
+
+test('logTable prints values in full when wide is set', () => {
+  const lines = capture(() => output.logTable(HEADERS, [['2026-08-05', 'ada', LONG]], { wide: true }));
+  assert.ok(lines[2].includes(LONG), 'wide mode must not clip');
+});
+
+test('logTable collapses newlines so one prompt cannot span many lines', () => {
+  const lines = capture(() =>
+    output.logTable(HEADERS, [['2026-08-05', 'ada', 'line one\nline two\nline three']], { wide: true }),
+  );
+  assert.strictEqual(lines.length, 3);
+  assert.ok(lines[2].includes('line one line two line three'));
+});
+
+test('logTable tolerates a row shorter than the header set', () => {
+  const lines = capture(() => output.logTable(HEADERS, [['2026-08-05']], { maxWidth: 80 }));
+  assert.strictEqual(lines.length, 3);
+  assert.ok(lines[2].includes('2026-08-05'));
+});
+
+test('logTable leaves the original table() untouched', () => {
+  assert.strictEqual(typeof output.table, 'function');
+  assert.notStrictEqual(output.table, output.logTable);
+});

package/test/analytics-paging-footer.test.js

@@ -0,0 +1,34 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+
+// The footer is how a person, and an agent reading stderr, learns whether it is
+// looking at everything or at one page. Saying "all" on a later page turns a
+// slice into what looks like the whole result set.
+
+function footer({ offset, rows, total, hasMore }) {
+  const nextOffset = offset + rows;
+  if (hasMore ?? nextOffset < total) {
+    return `Showing ${offset + 1}-${offset + rows} of ${total.toLocaleString()}. ` +
+      `Page with --offset ${nextOffset}, or use --format csv to export every row.`;
+  }
+  if (offset > 0) {
+    return `Showing ${offset + 1}-${offset + rows} of ${total.toLocaleString()}. End of results.`;
+  }
+  return `Showing all ${total.toLocaleString()} row(s).`;
+}
+
+test('the last page of a paged read does not claim to be all of them', () => {
+  const line = footer({ offset: 20, rows: 10, total: 564, hasMore: false });
+  assert.match(line, /Showing 21-30 of 564/);
+  assert.doesNotMatch(line, /all/, 'a slice must never read as the whole result set');
+});
+
+test('a single page that holds everything still says all', () => {
+  assert.match(footer({ offset: 0, rows: 7, total: 7, hasMore: false }), /Showing all 7 row/);
+});
+
+test('a page with more behind it points at the next offset', () => {
+  const line = footer({ offset: 0, rows: 20, total: 564, hasMore: true });
+  assert.match(line, /Showing 1-20 of 564/);
+  assert.match(line, /--offset 20/);
+});

package/test/analytics-query.test.js

@@ -0,0 +1,142 @@
+const test = require('node:test');
+const assert = require('node:assert');
+
+const {
+  DEFAULT_LIMIT,
+  buildQuery,
+  buildQueryString,
+  parseList,
+  resolveFormat,
+  resolveWindow,
+} = require('../src/lib/analytics-query');
+
+test('parseList splits comma-separated values and drops blanks', () => {
+  assert.deepStrictEqual(parseList('a, b ,,c'), ['a', 'b', 'c']);
+  assert.deepStrictEqual(parseList(''), []);
+  assert.deepStrictEqual(parseList(undefined), []);
+  assert.deepStrictEqual(parseList(['x', ' y ']), ['x', 'y']);
+});
+
+test('resolveFormat defaults to table and honours --json', () => {
+  assert.strictEqual(resolveFormat({}), 'table');
+  assert.strictEqual(resolveFormat({ format: 'csv' }), 'csv');
+  assert.strictEqual(resolveFormat({ json: true }), 'json');
+  assert.strictEqual(resolveFormat({ json: true, format: 'json' }), 'json');
+});
+
+test('resolveFormat rejects an unknown format and a contradictory --json', () => {
+  assert.throws(() => resolveFormat({ format: 'xml' }), /Invalid --format/);
+  assert.throws(() => resolveFormat({ json: true, format: 'csv' }), /Cannot combine --json/);
+});
+
+test('resolveWindow defaults to the thirty-day preset', () => {
+  assert.deepStrictEqual(resolveWindow({}), { time_window: 'THIRTY_DAYS' });
+});
+
+test('resolveWindow normalises case and hyphens in a preset', () => {
+  assert.deepStrictEqual(resolveWindow({ timeWindow: 'seven-days' }), { time_window: 'SEVEN_DAYS' });
+});
+
+test('resolveWindow accepts a valid custom range', () => {
+  assert.deepStrictEqual(
+    resolveWindow({ start: '2026-07-01', end: '2026-07-31' }),
+    { start_date: '2026-07-01', end_date: '2026-07-31' },
+  );
+});
+
+test('resolveWindow rejects half a range, a mixed range, and a bad date', () => {
+  assert.throws(() => resolveWindow({ start: '2026-07-01' }), /must be used together/);
+  assert.throws(() => resolveWindow({ end: '2026-07-01' }), /must be used together/);
+  assert.throws(
+    () => resolveWindow({ start: '2026-07-01', end: '2026-07-31', timeWindow: 'SEVEN_DAYS' }),
+    /Cannot combine --time-window/,
+  );
+  assert.throws(() => resolveWindow({ start: '07/01/2026', end: '07/31/2026' }), /Expected YYYY-MM-DD/);
+});
+
+test('resolveWindow rejects an inverted range and one wider than 90 days', () => {
+  assert.throws(() => resolveWindow({ start: '2026-07-31', end: '2026-07-01' }), /on or before/);
+  assert.throws(() => resolveWindow({ start: '2026-01-01', end: '2026-07-31' }), /maximum is 90/);
+});
+
+test('resolveWindow accepts exactly 90 days but not 91', () => {
+  assert.ok(resolveWindow({ start: '2026-01-01', end: '2026-04-01' }));
+  assert.throws(() => resolveWindow({ start: '2026-01-01', end: '2026-04-02' }), /maximum is 90/);
+});
+
+test('buildQuery asks the server for json when rendering a table', () => {
+  const query = buildQuery({}, { format: 'table' });
+  assert.strictEqual(query.format, 'json');
+  assert.strictEqual(query.limit, DEFAULT_LIMIT);
+});
+
+test('buildQuery omits limit and offset for a csv export', () => {
+  const query = buildQuery({ limit: '50', offset: '10' }, { format: 'csv' });
+  assert.strictEqual(query.format, 'csv');
+  assert.strictEqual(query.limit, undefined);
+  assert.strictEqual(query.offset, undefined);
+});
+
+test('buildQuery omits a zero offset but keeps a real one', () => {
+  assert.strictEqual(buildQuery({ offset: '0' }, { format: 'json' }).offset, undefined);
+  assert.strictEqual(buildQuery({ offset: '40' }, { format: 'json' }).offset, 40);
+});
+
+test('buildQuery maps every filter flag onto its query key', () => {
+  const query = buildQuery(
+    {
+      tool: 'claude-code,cursor',
+      user: '4,9',
+      policy: '11',
+      family: 'git_action,delete_file',
+      server: 'Notion,Slack',
+      risk: 'high,low',
+      initiator: 'agent',
+    },
+    { format: 'csv' },
+  );
+
+  assert.deepStrictEqual(query.tool_types, ['CLAUDE_CODE', 'CURSOR']);
+  assert.deepStrictEqual(query.user_ids, ['4', '9']);
+  assert.deepStrictEqual(query.policy_ids, ['11']);
+  assert.deepStrictEqual(query.command_families, ['git_action', 'delete_file']);
+  assert.deepStrictEqual(query.server, ['Notion', 'Slack']);
+  assert.deepStrictEqual(query.risk_levels, ['High', 'Low']);
+  assert.deepStrictEqual(query.intent_attribution, ['AGENT_INITIATED']);
+});
+
+test('buildQuery leaves absent filters out of the query entirely', () => {
+  const query = buildQuery({}, { format: 'csv' });
+  for (const key of ['tool_types', 'user_ids', 'policy_ids', 'command_families', 'server', 'risk_levels']) {
+    assert.ok(!(key in query), `${key} should be absent`);
+  }
+});
+
+test('buildQuery rejects invalid risk and initiator values', () => {
+  assert.throws(() => buildQuery({ risk: 'Critical' }, { format: 'csv' }), /Invalid --risk/);
+  assert.throws(() => buildQuery({ initiator: 'robot' }, { format: 'csv' }), /Invalid --initiator/);
+});
+
+test('buildQuery rejects limits outside the allowed range', () => {
+  assert.throws(() => buildQuery({ limit: '0' }, { format: 'json' }), /positive integer/);
+  assert.throws(() => buildQuery({ limit: '1.5' }, { format: 'json' }), /positive integer/);
+  assert.throws(() => buildQuery({ limit: '99999' }, { format: 'json' }), /cannot exceed 1000/);
+  assert.throws(() => buildQuery({ offset: '-1' }, { format: 'json' }), /zero or a positive/);
+});
+
+test('buildQueryString repeats a key per value instead of collapsing it', () => {
+  const qs = buildQueryString({ format: 'csv', risk_levels: ['High', 'Low'], server: ['Notion'] });
+  const params = new URLSearchParams(qs);
+  assert.deepStrictEqual(params.getAll('risk_levels'), ['High', 'Low']);
+  assert.deepStrictEqual(params.getAll('server'), ['Notion']);
+});
+
+test('buildQueryString skips empty values', () => {
+  const qs = buildQueryString({ a: 'x', b: undefined, c: null, d: '', e: [] });
+  assert.strictEqual(qs, 'a=x');
+});
+
+test('buildQueryString url-encodes values with spaces and symbols', () => {
+  const qs = buildQueryString({ server: ['Claude in Chrome', 'a&b'] });
+  assert.deepStrictEqual(new URLSearchParams(qs).getAll('server'), ['Claude in Chrome', 'a&b']);
+});

package/test/chat-json-stdout.test.js

@@ -9,26 +9,32 @@ const { Command } = require('commander');
 // jq parses the whole stream, so it emitted the right answer AND exited 5 — a
 // failure that looks like a success until something checks $?.
 
-function freshChat({ post }) {
+function freshChat({ postStream }) {
   for (const m of ['../src/commands/chat', '../src/api', '../src/auth', '../src/output', '../src/chartRender']) {
     delete require.cache[require.resolve(m)];
   }
   const api = require('../src/api');
-  api.post = post;
+  api.postStream = postStream;
   const auth = require('../src/auth');
   auth.ensureLoggedIn = async () => {};
   return require('../src/commands/chat');
 }
 
-const REPLY = {
-  success: true,
-  conversation_id: 'c-1',
-  log_id: 'l-1',
-  blocks: [{ type: 'text', text: 'Here you go.' }],
-};
+const CID = '11111111-2222-4333-8444-555555555555';
+const BLOCKS = [{ type: 'text', text: 'Here you go.' }];
+const DONE = { conversation_id: CID, log_id: 'l-1' };
+
+// Replay a turn the way the server sends it: a frame per block, then `done`.
+function streamer(blocks = BLOCKS, done = DONE) {
+  return async (_path, { onEvent }) => {
+    for (const block of blocks) onEvent('block', block);
+    onEvent('done', done);
+    return null;
+  };
+}
 
 async function runChat(args) {
-  const chat = freshChat({ post: async () => REPLY });
+  const chat = freshChat({ postStream: streamer() });
   const out = [];
   const err = [];
   const realOut = process.stdout.write.bind(process.stdout);
@@ -58,7 +64,7 @@ test('chat: --json with -o keeps stdout parseable as JSON', async () => {
   // The whole stream, not just a prefix — this is what jq consumes.
   const parsed = JSON.parse(stdout);
   assert.equal(parsed.blocks.length, 1);
-  assert.equal(parsed.conversation_id, 'c-1');
+  assert.equal(parsed.conversation_id, CID);
 
   // The confirmation still happens, just not where a parser will trip on it.
   assert.match(stderr, /Wrote /);
@@ -80,6 +86,89 @@ test('chat: --json puts the transcript on stdout and everything else on stderr',
 
   // stdout is what a reader pipes to jq, so it has to parse whole.
   assert.equal(JSON.parse(stdout).blocks.length, 1);
-  assert.ok(!stdout.includes('continue with'), 'the hint must not reach stdout');
-  assert.match(stderr, /continue with: -c c-1/);
+  assert.ok(!stdout.includes('continue:'), 'the hint must not reach stdout');
+  // Captured here, so not a terminal — the hint is for a person, and a script
+  // takes the id off conversation_id instead.
+  assert.ok(!stderr.includes('continue:'), 'the hint is TTY-only');
+});
+
+test('chat: --json prints the continue hint when stderr is a terminal', async () => {
+  const realIsTTY = Object.getOwnPropertyDescriptor(process.stderr, 'isTTY');
+  Object.defineProperty(process.stderr, 'isTTY', { value: true, configurable: true });
+  try {
+    const { stdout, stderr } = await runChat(['-m', 'anything', '--json']);
+    assert.equal(JSON.parse(stdout).blocks.length, 1);
+    assert.ok(stderr.includes(`continue: unbound chat -m "..." -c ${CID}`));
+  } finally {
+    if (realIsTTY) Object.defineProperty(process.stderr, 'isTTY', realIsTTY);
+    else delete process.stderr.isTTY;
+  }
+});
+
+test('chat: --json carries the next command, not just the id', async () => {
+  const { stdout } = await runChat(['-m', 'anything', '--json']);
+  const payload = JSON.parse(stdout);
+
+  assert.equal(payload.continue_command, `unbound chat -m "..." -c ${CID}`);
+  assert.equal(payload.conversation_id, CID);
+});
+
+test('chat: a turn with no blocks has nothing to continue', async () => {
+  const chat = freshChat({ postStream: streamer([], { conversation_id: CID }) });
+  const payload = chat._internals.toJsonPayload({ success: true, conversation_id: CID, blocks: [] });
+
+  assert.equal(payload.continue_command, null);
+});
+
+test('chat: a conversation_id that is not a uuid yields no command to run', async () => {
+  const chat = freshChat({ postStream: streamer() });
+  const hostile = chat._internals.toJsonPayload({
+    success: true,
+    conversation_id: 'c-1; rm -rf ~',
+    blocks: [{ type: 'text', text: 'hi' }],
+  });
+
+  // The field exists to be executed, so it is null rather than a command
+  // carrying whatever the response happened to contain.
+  assert.equal(hostile.continue_command, null);
+  assert.equal(hostile.conversation_id, 'c-1; rm -rf ~');
+
+  const real = chat._internals.toJsonPayload({
+    success: true,
+    conversation_id: '1555aaca-769c-4b8c-84c5-049397392195',
+    blocks: [{ type: 'text', text: 'hi' }],
+  });
+  assert.equal(real.continue_command,
+    'unbound chat -m "..." -c 1555aaca-769c-4b8c-84c5-049397392195');
+});
+
+test('chat: the continue hint comes after the transcript, not before it', async () => {
+  // A real turn is hundreds of kilobytes. Printed first, the hint scrolls out of
+  // reach before the command ends, which is the same as not printing it.
+  const realIsTTY = Object.getOwnPropertyDescriptor(process.stderr, 'isTTY');
+  Object.defineProperty(process.stderr, 'isTTY', { value: true, configurable: true });
+
+  const chat = freshChat({ postStream: streamer() });
+  const order = [];
+  const realOut = process.stdout.write.bind(process.stdout);
+  const realErr = process.stderr.write.bind(process.stderr);
+  process.stdout.write = (chunk) => { order.push(['stdout', String(chunk)]); return true; };
+  process.stderr.write = (chunk) => { order.push(['stderr', String(chunk)]); return true; };
+  try {
+    const program = new Command();
+    program.exitOverride();
+    chat.register(program);
+    await program.parseAsync(['node', 'unbound', 'chat', '-m', 'anything', '--json']);
+  } finally {
+    process.stdout.write = realOut;
+    process.stderr.write = realErr;
+    if (realIsTTY) Object.defineProperty(process.stderr, 'isTTY', realIsTTY);
+    else delete process.stderr.isTTY;
+  }
+
+  const transcript = order.findIndex(([s, text]) => s === 'stdout' && text.includes('"blocks"'));
+  const hint = order.findIndex(([, text]) => text.includes('continue:'));
+  assert.ok(transcript !== -1, 'the transcript was written');
+  assert.ok(hint !== -1, 'the hint was written');
+  assert.ok(hint > transcript, `hint at ${hint} must come after the transcript at ${transcript}`);
 });