procesio-cli 0.1.1__py3-none-any.whl

procesio_cli/tools/procesio/tests/test_process_layout.py

@@ -0,0 +1,117 @@
+"""Tests for the live process-layout actions (duplicate-process, relayout-process).
+
+The client is faked — no network. adapter.layout_flow runs the real offline engine
+(legacy by default) on a tiny flow, so the round-trip through the handler is exercised."""
+from __future__ import annotations
+
+from argparse import Namespace
+
+import pytest
+
+from tools.procesio.errors import UsageError
+from tools.procesio.handlers import process_layout as pl
+
+
+def _flow(fid="f1"):
+    return {"Id": fid, "Title": "Demo", "Actions": [
+        {"Id": "start", "ActionTemplateName": "Start",
+         "CustomData": {"type": "circle", "position": {"x": 0, "y": 0}},
+         "Ports": [{"SourceId": "start", "DestinationId": "a", "Type": 0}]},
+        {"Id": "a", "ActionTemplateName": "Map Data",
+         "CustomData": {"type": "square", "position": {"x": 0, "y": 0}},
+         "Ports": [{"SourceId": "a", "DestinationId": "stop", "Type": 0}]},
+        {"Id": "stop", "ActionTemplateName": "Stop",
+         "CustomData": {"type": "circle", "position": {"x": 0, "y": 0}}, "Ports": []},
+    ]}
+
+
+class FakeClient:
+    """Records POST/PUT calls and serves canned GET responses."""
+    def __init__(self, project_lists, flow):
+        self.workspace_id = "ws-1"
+        self.profile = {}                      # unbound -> production designer host
+        self._lists = list(project_lists)      # successive /api/Projects responses
+        self._flow = flow
+        self.posts = []
+        self.puts = []
+
+    def get(self, path, query=None):
+        if path == "/api/Projects":
+            return {"pageItems": self._lists.pop(0)}
+        if path.startswith("/api/Projects/"):
+            return {"flow": self._flow}
+        raise AssertionError(f"unexpected GET {path}")
+
+    def post(self, path, body=None, query=None):
+        self.posts.append((path, body))
+        if path.endswith("/duplicate"):
+            return {"hasWebhook": False}
+        if path == "/api/Projects/validate":
+            return {"raw_text": ""}
+        raise AssertionError(f"unexpected POST {path}")
+
+    def put(self, path, body=None, query=None):
+        self.puts.append((path, body))
+        return {}
+
+
+def test_duplicate_process_finds_new_copy_id():
+    before = [{"id": "A"}, {"id": "B"}]
+    after = [{"id": "A"}, {"id": "B"}, {"id": "C"}]  # C is the new copy
+    # the two /api/Projects GETs (before, after) + the GET for the copy's title
+    c = FakeClient([before, after], _flow(fid="C"))
+    out = pl.duplicate_process(c, Namespace(id="A", workspace_id="ws-1", profile=None))["result"]
+    assert out["copy_id"] == "C"
+    assert out["source_id"] == "A"
+    assert out["designer_url"].endswith("/designer/C#ws-1")
+    assert out["has_webhook"] is False
+    assert c.posts[0][0] == "/api/Projects/A/duplicate"
+
+
+def test_duplicate_process_ambiguous_when_multiple_new():
+    before = [{"id": "A"}]
+    after = [{"id": "A"}, {"id": "C"}, {"id": "D"}]   # two new → cannot disambiguate
+    c = FakeClient([before, after], _flow())
+    out = pl.duplicate_process(c, Namespace(id="A", workspace_id="ws-1", profile=None))["result"]
+    assert out["copy_id"] is None
+    assert set(out["copy_candidates"]) == {"C", "D"}
+    assert out["designer_url"] is None
+
+
+def test_relayout_process_dry_run_does_not_save():
+    c = FakeClient([], _flow())
+    out = pl.relayout_process(c, Namespace(id="C", workspace_id="ws-1", profile=None,
+                                           no_validate=False, dry_run=True))["result"]
+    assert out["saved"] is False and out["dry_run"] is True
+    assert out["nodes_moved"] >= 1
+    assert out["engine"] in ("legacy", "elk")
+    assert c.puts == [] and c.posts == []           # nothing persisted
+
+
+def test_relayout_process_validates_then_saves():
+    c = FakeClient([], _flow())
+    out = pl.relayout_process(c, Namespace(id="C", workspace_id="ws-1", profile=None,
+                                           no_validate=False, dry_run=False))["result"]
+    assert out["saved"] is True and out["validated"] is True
+    assert [p[0] for p in c.posts] == ["/api/Projects/validate"]   # validate gate ran
+    assert len(c.puts) == 1 and c.puts[0][0] == "/api/Projects"    # saved via PUT
+    # the PUT body carries the re-laid-out flow (same action ids, new positions)
+    saved_flow = c.puts[0][1]
+    assert {a["Id"] for a in saved_flow["Actions"]} == {"start", "a", "stop"}
+
+
+def test_relayout_process_no_validate_skips_gate():
+    c = FakeClient([], _flow())
+    out = pl.relayout_process(c, Namespace(id="C", workspace_id="ws-1", profile=None,
+                                           no_validate=True, dry_run=False))["result"]
+    assert out["saved"] is True and out["validated"] is None
+    assert c.posts == []                            # validate skipped
+    assert len(c.puts) == 1
+
+
+def test_relayout_process_reports_elk_engine(monkeypatch):
+    monkeypatch.setenv("LAYOUT_ENGINE", "elk")
+    c = FakeClient([], _flow())
+    out = pl.relayout_process(c, Namespace(id="C", workspace_id="ws-1", profile=None,
+                                           no_validate=True, dry_run=True))["result"]
+    assert out["engine"] == "elk"

procesio_cli/tools/procesio/tests/test_process_naming.py

@@ -0,0 +1,188 @@
+"""Tests for rename-actions (bulk-relabel a live process's canvas nodes).
+
+The client is faked — no network. Both DTO casings are exercised: a PascalCase export
+and the camelCase live DTO must rename identically."""
+from __future__ import annotations
+
+from argparse import Namespace
+
+import pytest
+
+from tools.procesio.errors import UsageError
+from tools.procesio.handlers import process_naming as pn
+
+
+def _flow_pascal():
+    return {"Id": "P", "Title": "Demo", "Actions": [
+        {"Id": "aaaa1111", "ActionName": "Node", "ActionTemplateName": "Node",
+         "CustomData": {"name": "Node", "icon": "icon-nodejs"},
+         "Ports": [{"SourceId": "aaaa1111", "DestinationId": "bbbb2222", "Type": 0}]},
+        {"Id": "bbbb2222", "ActionName": "Node", "ActionTemplateName": "Node",
+         "CustomData": {"name": "Node", "icon": "icon-nodejs"}, "Ports": []},
+    ]}
+
+
+def _flow_camel():
+    return {"id": "P", "title": "Demo", "actions": [
+        {"id": "aaaa1111", "actionName": "Node", "actionTemplateName": "Node",
+         "customData": {"name": "Node"}, "ports": []},
+        {"id": "bbbb2222", "actionName": "Call API", "actionTemplateName": "Call API",
+         "customData": {"name": "Call API"}, "ports": []},
+    ]}
+
+
+class FakeClient:
+    def __init__(self, flow):
+        self.workspace_id = "ws-1"
+        self.profile = {}                      # unbound -> production designer host
+        self._flow = flow
+        self.posts = []
+        self.puts = []
+
+    def get(self, path, query=None):
+        assert path.startswith("/api/Projects/")
+        return {"flow": self._flow}
+
+    def post(self, path, body=None, query=None):
+        self.posts.append((path, body))
+        return {"raw_text": ""}
+
+    def put(self, path, body=None, query=None):
+        self.puts.append((path, body))
+        return {}
+
+
+def _args(**kw):
+    base = dict(id="P", workspace_id="ws-1", profile=None, map=None, map_file=None,
+                no_validate=False, dry_run=False, force=False)
+    base.update(kw)
+    return Namespace(**base)
+
+
+# -- apply_names (pure) -------------------------------------------------------
+
+def test_sets_both_action_name_and_custom_data_name():
+    flow, changes, unknown, ambiguous = pn.apply_names(
+        _flow_pascal(), {"aaaa1111": "Mapează nume"})
+    assert (unknown, ambiguous) == ([], [])
+    a = flow["Actions"][0]
+    assert a["ActionName"] == "Mapează nume"
+    assert a["CustomData"]["name"] == "Mapează nume"
+    assert changes == [{"id": "aaaa1111", "template": "Node",
+                        "from": "Node", "to": "Mapează nume"}]
+
+
+def test_camel_case_live_dto_renames_the_same_way():
+    flow, changes, _, _ = pn.apply_names(_flow_camel(), {"bbbb2222": "OCR AI"})
+    a = flow["actions"][1]
+    assert a["actionName"] == "OCR AI"
+    assert a["customData"]["name"] == "OCR AI"
+    assert len(changes) == 1
+
+
+def test_does_not_mutate_the_input_flow():
+    original = _flow_pascal()
+    pn.apply_names(original, {"aaaa1111": "Changed"})
+    assert original["Actions"][0]["ActionName"] == "Node"
+    assert original["Actions"][0]["CustomData"]["name"] == "Node"
+
+
+def test_untargeted_actions_are_left_alone():
+    flow, changes, _, _ = pn.apply_names(_flow_pascal(), {"aaaa1111": "Only me"})
+    assert flow["Actions"][1]["ActionName"] == "Node"
+    assert [c["id"] for c in changes] == ["aaaa1111"]
+
+
+def test_ports_and_wiring_survive_a_rename():
+    flow, _, _, _ = pn.apply_names(_flow_pascal(), {"aaaa1111": "X", "bbbb2222": "Y"})
+    assert flow["Actions"][0]["Ports"] == [
+        {"SourceId": "aaaa1111", "DestinationId": "bbbb2222", "Type": 0}]
+
+
+def test_a_name_already_in_place_is_not_reported_as_a_change():
+    _, changes, _, _ = pn.apply_names(_flow_pascal(), {"aaaa1111": "Node"})
+    assert changes == []
+
+
+def test_unique_id_prefix_resolves():
+    _, changes, unknown, ambiguous = pn.apply_names(_flow_pascal(), {"aaaa": "Prefixed"})
+    assert (unknown, ambiguous) == ([], [])
+    assert changes[0]["id"] == "aaaa1111"
+
+
+def test_ambiguous_prefix_is_reported_not_guessed():
+    flow = _flow_pascal()
+    flow["Actions"][1]["Id"] = "aaaa9999"      # now "aaaa" matches two actions
+    new, changes, unknown, ambiguous = pn.apply_names(flow, {"aaaa": "Which one?"})
+    assert ambiguous == ["aaaa"]
+    assert changes == []
+
+
+def test_unknown_id_is_reported():
+    _, changes, unknown, _ = pn.apply_names(_flow_pascal(), {"zzzz": "Nope"})
+    assert unknown == ["zzzz"]
+    assert changes == []
+
+
+# -- rename_actions (handler) -------------------------------------------------
+
+def test_dry_run_does_not_save():
+    c = FakeClient(_flow_camel())
+    out = pn.rename_actions(c, _args(map='{"aaaa1111": "Extrage nume"}', dry_run=True))["result"]
+    assert out["saved"] is False and out["dry_run"] is True
+    assert out["renamed_count"] == 1
+    assert c.puts == [] and c.posts == []
+
+
+def test_validates_then_saves():
+    c = FakeClient(_flow_camel())
+    out = pn.rename_actions(c, _args(map='{"aaaa1111": "Extrage nume"}'))["result"]
+    assert out["validated"] is True and out["saved"] is True
+    assert c.posts[0][0] == "/api/Projects/validate"
+    assert c.puts[0][0] == "/api/Projects"
+    assert c.puts[0][1]["actions"][0]["actionName"] == "Extrage nume"
+    assert out["designer_url"].endswith("/designer/P#ws-1")
+
+
+def test_no_validate_skips_the_gate():
+    c = FakeClient(_flow_camel())
+    pn.rename_actions(c, _args(map='{"aaaa1111": "X"}', no_validate=True))
+    assert c.posts == [] and len(c.puts) == 1
+
+
+def test_map_file_is_accepted(tmp_path):
+    f = tmp_path / "names.json"
+    f.write_text('{"bbbb2222": "OCR AI — CI"}', encoding="utf-8")
+    c = FakeClient(_flow_camel())
+    out = pn.rename_actions(c, _args(map_file=str(f)))["result"]
+    assert out["renamed"][0]["to"] == "OCR AI — CI"
+
+
+def test_map_and_map_file_are_mutually_exclusive(tmp_path):
+    c = FakeClient(_flow_camel())
+    with pytest.raises(UsageError, match="exactly one"):
+        pn.rename_actions(c, _args(map='{"a": "b"}', map_file=str(tmp_path / "x.json")))
+    with pytest.raises(UsageError, match="exactly one"):
+        pn.rename_actions(c, _args())
+
+
+def test_blank_name_is_rejected():
+    c = FakeClient(_flow_camel())
+    with pytest.raises(UsageError, match="non-empty string"):
+        pn.rename_actions(c, _args(map='{"aaaa1111": "   "}'))
+
+
+def test_unknown_id_aborts_before_saving():
+    c = FakeClient(_flow_camel())
+    with pytest.raises(UsageError, match="no action in process"):
+        pn.rename_actions(c, _args(map='{"nope": "X"}'))
+    assert c.puts == []
+
+
+def test_ambiguous_prefix_aborts_before_saving():
+    flow = _flow_camel()
+    flow["actions"][1]["id"] = "aaaa9999"
+    c = FakeClient(flow)
+    with pytest.raises(UsageError, match="ambiguous id prefix"):
+        pn.rename_actions(c, _args(map='{"aaaa": "X"}'))
+    assert c.puts == []

procesio_cli/tools/procesio/tests/test_process_query_store.py

@@ -0,0 +1,172 @@
+"""Locks the Query Store NODE authoring shapes the builder emits from a `queryStore` spec.
+
+Reverse-engineered from a live PROCESIO export and verified end-to-end in a real workspace
+(SELECT/JOIN/GROUP BY, INSERT/UPDATE/DELETE/REPLACE, list params, error branch). The shape
+facts that make the node RUN rather than merely validate:
+  - b102 Query: `Value` is SQL with `<%N%>`; each `<%N%>` is a CHIP in `Variable[]` typed
+    dataStoreTable ({dataStoreId}) or dataStoreColumn ({dataStoreId, columnId}) - NOT a
+    process variable; `@param` stays literal in the SQL.
+  - b103 Parameters: rows {id, source:{value,variable}, destination:{value:<paramName>}}.
+  - b105/b106 outputs bind like any {var}. One <%N%> id sequence across the whole node.
+  - Designer mirror: b102 -> `ds.<dataStoreId>[.<columnId>]`, b103 -> {id,destination,source}.
+"""
+from __future__ import annotations
+
+import itertools
+import re
+
+import pytest
+
+from tools.procesio.dto.process import builder as pb
+from tools.procesio.flowmodel import fevalidation as fv
+
+_STORE = "11111111-1111-1111-1111-111111111111"
+_C_NAME = "22222222-2222-2222-2222-222222222222"
+_C_TIER = "33333333-3333-3333-3333-333333333333"
+_C_CODE = "44444444-4444-4444-4444-444444444444"
+_ORD = "55555555-5555-5555-5555-555555555555"
+_O_CUST = "66666666-6666-6666-6666-666666666666"
+_O_AMT = "77777777-7777-7777-7777-777777777777"
+
+_DSM = {
+    "qs_customers": {"id": _STORE, "columns": {"name": _C_NAME, "tier": _C_TIER, "customercode": _C_CODE}},
+    "qs_orders": {"id": _ORD, "columns": {"customercode": _O_CUST, "amount": _O_AMT}},
+}
+
+
+def _ctx():
+    counter = itertools.count(1)
+    return {"new_id": lambda: f"00000000-0000-0000-0000-{next(counter):012d}",
+            "datastore_meta": _DSM}
+
+
+def _qs_node(dto):
+    return next(a for a in dto["Actions"] if a.get("ActionTemplateName") == "Query Store")
+
+
+def _param(node, tail):
+    return next(p for p in node["Parameters"] if p["TabPropertyId"].endswith(tail))
+
+
+def _cd(node, tail):
+    def walk(settings):
+        for s in settings or []:
+            if str(s.get("id", "")).endswith(tail):
+                return s
+            if isinstance(s.get("value"), list):
+                r = walk(s["value"])
+                if r:
+                    return r
+    for tab in node["CustomData"]["configuration"]:
+        r = walk(tab.get("settings", []))
+        if r:
+            return r
+
+
+_ROWS = {"name": "rows", "type": "json", "isList": True, "direction": "output"}
+_CNT = {"name": "count", "type": "integer", "direction": "output"}
+
+
+def _select_cfg():
+    return {"title": "t",
+            "variables": [{"name": "maxTier", "type": "integer", "direction": "input"}, _ROWS, _CNT],
+            "actions": [{"id": "q", "action": "Query Store", "queryStore": {
+                "sql": "select {{col:QS_Customers.Name}} from {{ds:QS_Customers}} "
+                       "where {{col:QS_Customers.Tier}} <= @maxTier",
+                "params": {"maxTier": {"var": "maxTier"}},
+                "resultRows": "rows", "totalCount": "count"}}]}
+
+
+def test_query_chips_and_placeholders():
+    node = _qs_node(pb.build(_select_cfg(), _ctx()))
+    q = _param(node, "b102")
+    # Each chip becomes a positional placeholder and `@param` stays literal; the statement is
+    # laid out over lines so the node can be read in the designer.
+    assert q["Value"].splitlines() == ["select <%0%>", "from <%1%>", "where <%2%> <= @maxTier"]
+    chips = q["Variable"]
+    assert chips[0] == {"id": 0, "type": "dataStoreColumn", "variableId": None,
+                        "dataStoreId": _STORE, "columnId": _C_NAME, "attribute": None}
+    assert chips[1] == {"id": 1, "type": "dataStoreTable", "variableId": None,
+                        "dataStoreId": _STORE, "attribute": None}
+    assert chips[2]["columnId"] == _C_TIER and chips[2]["type"] == "dataStoreColumn"
+
+
+def test_parameters_map_and_outputs():
+    node = _qs_node(pb.build(_select_cfg(), _ctx()))
+    p = _param(node, "b103")
+    assert p["Variable"] == []                                   # sources live INLINE
+    row = p["Value"][0]
+    assert row["destination"] == {"value": "maxTier", "variable": []}   # @param name, no '@'
+    assert re.match(r"^<%\d+%>$", row["source"]["value"])
+    assert row["source"]["variable"][0]["variableId"]            # bound to the process variable
+    # outputs bind like any {var}: Value=<%N%>, Variable=[{variableId}]
+    for tail in ("b105", "b106"):
+        op = _param(node, tail)
+        assert re.match(r"^<%\d+%>$", op["Value"]) and op["Variable"][0]["variableId"]
+    assert _param(node, "b104")["Value"] == "1800"              # Time Out default
+
+
+def test_one_id_sequence_across_node():
+    node = _qs_node(pb.build(_select_cfg(), _ctx()))
+    ids = []
+    for p in node["Parameters"]:
+        for v in p.get("Variable") or []:
+            ids.append(v["id"])
+        val = p.get("Value")
+        if isinstance(val, list):
+            for row in val:
+                ids += [v["id"] for v in (row.get("source", {}).get("variable") or [])]
+    assert ids == sorted(set(ids)) and ids == list(range(len(ids)))  # contiguous, unique
+
+
+def test_designer_mirror():
+    node = _qs_node(pb.build(_select_cfg(), _ctx()))
+    q = _cd(node, "b102")["value"]                              # code-editor -> ds.<id>[.<col>]
+    # Laid out over lines on the way in, so the node is readable in the designer. The clauses,
+    # the chips and the parameter are unchanged; only the whitespace between them is new.
+    assert q.splitlines() == [f"select ds.{_STORE}.{_C_NAME}",
+                              f"from ds.{_STORE}",
+                              f"where ds.{_STORE}.{_C_TIER} <= @maxTier"]
+    prow = _cd(node, "b103")["value"][0]                        # map-parameters designer row
+    assert prow["destination"] == "maxTier" and prow["source"]                       # var id
+    assert _cd(node, "b105")["value"] and _cd(node, "b106")["value"]                  # output var ids
+
+
+def test_join_two_data_stores():
+    cfg = {"title": "t", "variables": [_ROWS, _CNT],
+           "actions": [{"id": "q", "action": "Query Store", "queryStore": {
+               "sql": "SELECT c.{{col:QS_Customers.Name}} AS Customer, SUM(o.{{col:QS_Orders.Amount}}) AS Rev "
+                      "FROM {{ds:QS_Customers}} AS c JOIN {{ds:QS_Orders}} AS o "
+                      "ON o.{{col:QS_Orders.CustomerCode}} = c.{{col:QS_Customers.CustomerCode}} "
+                      "GROUP BY c.{{col:QS_Customers.Name}}",
+               "resultRows": "rows", "totalCount": "count"}}]}
+    node = _qs_node(pb.build(cfg, _ctx()))
+    chips = _param(node, "b102")["Variable"]
+    stores = {c["dataStoreId"] for c in chips}
+    assert stores == {_STORE, _ORD}                            # both data stores chipped
+    assert {c["columnId"] for c in chips if c["type"] == "dataStoreColumn"} == {
+        _C_NAME, _O_AMT, _O_CUST, _C_CODE}
+
+
+def test_guid_passthrough_without_meta():
+    cfg = {"title": "t", "variables": [_ROWS],
+           "actions": [{"id": "q", "action": "Query Store", "queryStore": {
+               "sql": f"select {{{{col:{_STORE}.{_C_NAME}}}}} from {{{{ds:{_STORE}}}}}",
+               "resultRows": "rows"}}]}
+    ctx = {"new_id": lambda: "00000000-0000-0000-0000-000000000001"}   # no datastore_meta
+    node = _qs_node(pb.build(cfg, ctx))
+    chips = _param(node, "b102")["Variable"]
+    assert chips[0]["columnId"] == _C_NAME and chips[1]["dataStoreId"] == _STORE
+
+
+def test_unknown_store_name_raises():
+    cfg = {"title": "t", "variables": [_ROWS],
+           "actions": [{"id": "q", "action": "Query Store", "queryStore": {
+               "sql": "select {{col:Nope.Name}} from {{ds:Nope}}", "resultRows": "rows"}}]}
+    with pytest.raises(Exception) as e:
+        pb.build(cfg, _ctx())
+    assert "unknown Data Store" in str(e.value)
+
+
+def test_fe_validation_clean():
+    assert fv.validate_flow(pb.build(_select_cfg(), _ctx())) == []

procesio_cli/tools/procesio/tests/test_processinfo_variable.py

@@ -0,0 +1,56 @@
+"""A config can declare the platform's ProcessInfo variable, and bind its fields.
+
+ProcessInfo is an ordinary flow variable of a fixed model (type 40, SystemDataModel) that the
+designer adds the first time something references it - it is NOT ambient and NOT automatic. A
+process rebuilt from a config therefore loses it silently unless the config can ask for it,
+which is what `direction: "processinfo"` is for. Its `workspaceId` is the honest source for the
+workspace a run belongs to: always right, never configured, and correct after an import.
+"""
+import tools.procesio.dto.process.builder as pb
+
+SYSTEM_MODEL = "10c6ac59-3929-49e6-99dc-121212121221"
+WORKSPACE_ATTR = "75044bb4-7c70-40f2-8756-21c03de655c8"
+
+
+def _cfg(actions=None):
+    return {"title": "t",
+            "variables": [{"name": "ProcessInfo", "direction": "processinfo"},
+                          {"name": "out", "type": "string", "direction": "output"}],
+            "actions": actions or []}
+
+
+def _build(monkeypatch=None):
+    return pb.build(_cfg(), {"var_ids": {"processinfo": "11111111-1111-1111-1111-111111111111",
+                                         "out": "22222222-2222-2222-2222-222222222222"}})
+
+
+def test_processinfo_is_emitted_as_a_type_40_system_variable():
+    dto = pb.build(_cfg(), {"var_ids": {"processinfo": "11111111-1111-1111-1111-111111111111",
+                                        "out": "22222222-2222-2222-2222-222222222222"}})
+    variables = dto.get("Variables") or dto.get("variables")
+    pi = next(v for v in variables if (v.get("Name") or v.get("name")) == "ProcessInfo")
+    assert (pi.get("Type") or pi.get("type")) == 40
+    assert (pi.get("DataType") or pi.get("dataType")) == SYSTEM_MODEL
+    assert not (pi.get("IsList") or pi.get("isList"))
+
+
+def test_direction_is_published_in_the_schema():
+    import json
+    import pathlib
+    schema = json.loads((pathlib.Path(pb.__file__).parent / "config.schema.json")
+                        .read_text(encoding="utf-8"))
+    found = json.dumps(schema)
+    assert "processinfo" in found, "the config schema must offer the processinfo direction"
+
+
+def test_the_model_is_registered_so_a_path_binding_can_resolve():
+    """`{var: ProcessInfo, path: [workspaceId]}` needs the variable's model in ctx to resolve."""
+    ctx = {}
+    cfg = _cfg()
+    # prepare_ctx fills var_models from `model`; a processinfo variable must get the fixed one
+    # without the config naming it.
+    var_models = {}
+    for v in cfg["variables"]:
+        if str(v.get("direction", "")).lower() == "processinfo":
+            var_models[v["name"].lower()] = pb.SYSTEM_DATA_MODEL_ID
+    assert var_models["processinfo"] == SYSTEM_MODEL

procesio_cli/tools/procesio/tests/test_profiles.py

@@ -0,0 +1,127 @@
+"""Multi-credential profile store: CRUD, default resolution, secret hygiene."""
+from __future__ import annotations
+
+import argparse
+import json
+
+import pytest
+
+from tools.procesio import profiles
+from tools.procesio.errors import AuthError, UsageError
+
+
+def test_save_and_get_roundtrip(store):
+    profiles.save_profile("p", {"type": "apikey", "key": "K", "value": "V"})
+    blob = profiles.get_profile("p")
+    assert blob["key"] == "K" and blob["value"] == "V"
+    assert "p" in profiles.profile_names()
+
+
+def test_first_profile_becomes_default(store):
+    profiles.save_profile("first", {"type": "apikey", "key": "K", "value": "V"})
+    assert profiles.get_default() == "first"
+    profiles.save_profile("second", {"type": "apikey", "key": "K", "value": "V"})
+    assert profiles.get_default() == "first"  # adding more doesn't change default
+
+
+def test_index_has_no_secret_values(store):
+    profiles.save_profile("p", {"type": "apikey", "key": "K", "value": "TOPSECRET",
+                                "workspace": "w"})
+    raw_index = store.get("procesio", "credentials")
+    assert "TOPSECRET" not in raw_index
+    assert json.loads(raw_index)[0]["name"] == "p"
+
+
+def test_public_view_redacts_secrets(store):
+    profiles.save_profile("p", {"type": "userpass", "username": "u@example.com",
+                                "password": "PW"})
+    view = profiles.public_view(profiles.get_profile("p"), "p")
+    assert view["username"] == "u@example.com"
+    assert "password" not in view
+    assert view["has_password"] is True
+
+
+def test_resolve_explicit_default_and_single(store):
+    with pytest.raises(UsageError):
+        profiles.resolve(None)  # nothing stored, ambiguous
+    profiles.save_profile("only", {"type": "apikey", "key": "K", "value": "V"})
+    name, _ = profiles.resolve(None)
+    assert name == "only"
+    profiles.save_profile("other", {"type": "apikey", "key": "K", "value": "V"})
+    profiles.set_default("other")
+    assert profiles.resolve(None)[0] == "other"
+    assert profiles.resolve("only")[0] == "only"
+
+
+def test_remove_fixes_default(store):
+    profiles.save_profile("a", {"type": "apikey", "key": "K", "value": "V"})
+    profiles.save_profile("b", {"type": "apikey", "key": "K", "value": "V"})
+    profiles.set_default("a")
+    profiles.remove_profile("a")
+    assert "a" not in profiles.profile_names()
+    assert profiles.get_default() == "b"  # default moved to a survivor
+
+
+def test_get_missing_profile_raises(store):
+    with pytest.raises(AuthError):
+        profiles.get_profile("nope")
+
+
+def test_token_cache_roundtrip(store):
+    profiles.set_token_cache("p", {"access_token": "T", "expires_at": 123})
+    assert profiles.get_token_cache("p")["access_token"] == "T"
+    profiles.clear_token_cache("p")
+    assert profiles.get_token_cache("p") is None
+
+
+# -- add-credential secret hygiene ------------------------------------------
+
+def test_apikey_secrets_are_prompted_when_flags_are_omitted(monkeypatch):
+    """A key passed as --key/--value lands in shell history and every process
+    listing, which defeats storing it in the credential manager at all. Omitting
+    the flag on a TTY must prompt instead of erroring."""
+    from tools.procesio.handlers import profile_admin
+
+    monkeypatch.setattr(profile_admin.sys.stdin, "isatty", lambda: True)
+    asked = []
+
+    def fake_getpass(prompt):
+        asked.append(prompt)
+        return {
+            "PROCESIO API key name: ": "KN",
+            "PROCESIO API key value (shown once): ": "KV",
+        }[prompt]
+
+    monkeypatch.setattr(profile_admin.getpass, "getpass", fake_getpass)
+    saved = {}
+    monkeypatch.setattr(profile_admin.profiles, "save_profile",
+                        lambda n, b: saved.update({"name": n, "blob": b}))
+    monkeypatch.setattr(profile_admin.profiles, "get_default", lambda: None)
+
+    args = argparse.Namespace(
+        name="p", type="apikey", key=None, value=None, workspace_id=None,
+        workspace=None, username=None, password=None, realm=None, client_id=None,
+        web_base=None, auth_base=None, make_default=False)
+    out = profile_admin.add_credential(args)
+
+    assert asked == [
+        "PROCESIO API key name: ",
+        "PROCESIO API key value (shown once): ",
+    ]
+    assert saved["blob"]["key"] == "KN" and saved["blob"]["value"] == "KV"
+    # The returned view must never carry the secret back out.
+    assert "KV" not in json.dumps(out)
+
+
+def test_omitted_secret_without_a_tty_is_a_usage_error(monkeypatch):
+    """CI / tool-to-tool callers still pass the flag; failing loudly beats hanging
+    on a getpass prompt nobody can answer."""
+    from tools.procesio.handlers import profile_admin
+
+    monkeypatch.setattr(profile_admin.sys.stdin, "isatty", lambda: False)
+    args = argparse.Namespace(
+        name="p", type="apikey", key=None, value=None, workspace_id=None,
+        workspace=None, username=None, password=None, realm=None, client_id=None,
+        web_base=None, auth_base=None, make_default=False)
+    with pytest.raises(UsageError, match="--key"):
+        profile_admin.add_credential(args)