test: regression tests for #5/#6 fixes + adjust existing tests

- Add is-main-module.test.js covering symlink resolution (issue #6.1)
- Add vault.test.js cases for probeKeychainState caching and
  PERPLEXITY_DISABLE_KEYCHAIN=1 escape hatch (issue #6.3)
- Add config-getSavedCookies.test.js for diagnostic logging (issue #5.3)
- Update stdio-daemon-proxy.test.ts to expect empty env (issue #5.1)
- Update auto-config.test.ts to expect empty env for OpenCode (issue #5.1)
- Fix checks/vault.js to import probeKeychainState from vault.js
- Harden tryKeytar() against vitest mock proxies: validate getPassword
  is a function inside the try-catch so proxy-access errors are caught.

Refs issues #5, #6

Author: A.R.

packages/extension/tests/auto-config.test.ts

@@ -191,9 +191,7 @@ describe("2026-05 IDE expansion", () => {
       type: "local",
       command: ["C:/node.exe", "C:/bundle/server.mjs"],
       enabled: true,
-      environment: {
-        PERPLEXITY_HEADLESS_ONLY: "1",
-      },
+      environment: {},
     });
     expect(nextConfig.mcp?.Perplexity.args).toBeUndefined();
     expect(nextConfig.mcp?.Perplexity.env).toBeUndefined();

packages/extension/tests/transports/stdio-daemon-proxy.test.ts

@@ -31,7 +31,7 @@ describe("stdioDaemonProxyBuilder", () => {
     expect(result).toEqual({
       command: "node",
       args: ["/home/user/.perplexity-mcp/launcher.cjs"],
-      env: { PERPLEXITY_HEADLESS_ONLY: "1" },
+      env: {},
     });
     // Critical: proxy variant must NOT force the launcher into no-daemon mode.
     expect("env" in result ? result.env : {}).not.toHaveProperty("PERPLEXITY_NO_DAEMON");
@@ -67,7 +67,6 @@ describe("stdioDaemonProxyBuilder", () => {
     expect(env.PERPLEXITY_CHROME_PATH).toBe(
       "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
     );
-    expect(env.PERPLEXITY_HEADLESS_ONLY).toBe("1");
     expect(env).not.toHaveProperty("PERPLEXITY_NO_DAEMON");
   });
 
@@ -108,7 +107,7 @@ describe("stdioDaemonProxyBuilder", () => {
     expect(result).toEqual({
       command: "node",
       args: ["/home/user/.perplexity-mcp/launcher.cjs"],
-      env: { PERPLEXITY_HEADLESS_ONLY: "1" },
+      env: {},
     });
 
     const env = "env" in result ? result.env ?? {} : {};

packages/mcp-server/src/checks/vault.js

@@ -1,5 +1,6 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
+import { probeKeychainState } from "../vault.js";
 
 const CATEGORY = "vault";
 

packages/mcp-server/src/vault.js

@@ -71,7 +71,7 @@ const scryptAsync = promisify(nodeScrypt);
 // sets the seam, so the floor remains enforced. Cleared by `__resetKeyCache`.
 let _kdfParamsOverride = null;
 let _kdfTestModeActive = false;
-  _keytarModuleCache = null;
+let _keytarModuleCache = null;
 
 /**
  * TEST SEAM — drop scrypt cost during tests by setting (logN, r, p).
@@ -321,9 +321,6 @@ const KEYTAR_ACCOUNT = "vault-master-key";
 let _keyCache = null;
 let _unsealMaterialCache = null;
 
-/** Module-level keytar probe cache. `null` = not checked yet; `false` = unavailable. */
-let _keytarModuleCache = null;
-
 /** Environment escape hatch to suppress all keychain access (issue #6 bug 3). */
 function isKeychainDisabled() {
   return process.env.PERPLEXITY_DISABLE_KEYCHAIN === "1";
@@ -348,6 +345,10 @@ async function tryKeytar() {
   try {
     const mod = await import("keytar");
     const keytar = mod.default ?? mod;
+    if (!keytar || typeof keytar.getPassword !== "function") {
+      _keytarModuleCache = false;
+      return null;
+    }
     _keytarModuleCache = keytar;
     return keytar;
   } catch {
@@ -390,7 +391,7 @@ export async function probeKeychainState() {
     return { available: false, hasKey: false };
   }
   const keytar = await tryKeytar();
-  if (!keytar) {
+  if (!keytar || typeof keytar.getPassword !== "function") {
     return { available: false, hasKey: false };
   }
   try {

packages/mcp-server/test/config-getSavedCookies.test.js

@@ -0,0 +1,55 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+describe("getSavedCookies diagnostic logging (issue #5.3)", () => {
+  let TMP;
+  let capturedErrors;
+  let originalConsoleError;
+
+  beforeEach(() => {
+    TMP = mkdtempSync(join(tmpdir(), "pplx-config-"));
+    process.env.PERPLEXITY_CONFIG_DIR = TMP;
+    process.env.PERPLEXITY_PROFILE = "default";
+    delete process.env.PERPLEXITY_SESSION_TOKEN;
+    delete process.env.PERPLEXITY_CSRF_TOKEN;
+    capturedErrors = [];
+    originalConsoleError = console.error;
+    console.error = (...args) => {
+      capturedErrors.push(args.join(" "));
+    };
+  });
+
+  afterEach(() => {
+    rmSync(TMP, { recursive: true, force: true });
+    delete process.env.PERPLEXITY_CONFIG_DIR;
+    delete process.env.PERPLEXITY_PROFILE;
+    delete process.env.PERPLEXITY_VAULT_PASSPHRASE;
+    console.error = originalConsoleError;
+  });
+
+  it("logs 'no vault.enc' when vault is missing", async () => {
+    const { getSavedCookies } = await import("../src/config.js");
+    const cookies = await getSavedCookies();
+    expect(cookies).toEqual([]);
+    expect(capturedErrors.some((c) => /no vault\.enc/.test(c))).toBe(true);
+    expect(capturedErrors.some((c) => /run login first/.test(c))).toBe(true);
+  });
+
+  it("logs 'cookies key absent' when vault exists but has no cookies", async () => {
+    const { createProfile } = await import("../src/profiles.js");
+    const { Vault, __resetKeyCache } = await import("../src/vault.js");
+    createProfile("default");
+    __resetKeyCache();
+    process.env.PERPLEXITY_VAULT_PASSPHRASE = "test-passphrase";
+    const v = new Vault();
+    await v.set("default", "email", "test@example.com");
+
+    vi.resetModules();
+    const { getSavedCookies } = await import("../src/config.js");
+    const cookies = await getSavedCookies();
+    expect(cookies).toEqual([]);
+    expect(capturedErrors.some((c) => c.includes("'cookies' key is absent"))).toBe(true);
+  });
+});

packages/mcp-server/test/is-main-module.test.js

@@ -0,0 +1,55 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { isMainModule } from "../src/is-main-module.js";
+import { writeFileSync, symlinkSync, realpathSync, mkdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const TMP = join(tmpdir(), "perplexity-is-main-module-test");
+
+function cleanTmp() {
+  try { rmSync(TMP, { recursive: true }); } catch { /* ignore */ }
+}
+
+describe("isMainModule", () => {
+  beforeEach(() => {
+    cleanTmp();
+    mkdirSync(TMP, { recursive: true });
+  });
+  afterEach(() => {
+    cleanTmp();
+    delete process.argv[1];
+  });
+
+  it("returns true when argv[1] matches import.meta.url exactly", () => {
+    const realFile = join(TMP, "real.mjs");
+    writeFileSync(realFile, "");
+    process.argv[1] = realFile;
+    const metaUrl = "file://" + realFile.replace(/\\/g, "/");
+    expect(isMainModule(metaUrl)).toBe(true);
+  });
+
+  it("returns false when argv[1] points at a different file", () => {
+    const realFile = join(TMP, "real.mjs");
+    const otherFile = join(TMP, "other.mjs");
+    writeFileSync(realFile, "");
+    writeFileSync(otherFile, "");
+    process.argv[1] = otherFile;
+    const metaUrl = "file://" + realFile.replace(/\\/g, "/");
+    expect(isMainModule(metaUrl)).toBe(false);
+  });
+
+  it("returns true when argv[1] is a symlink to the real file (issue #6)", () => {
+    const realFile = join(TMP, "real.mjs");
+    const linkFile = join(TMP, "link.mjs");
+    writeFileSync(realFile, "");
+    symlinkSync(realFile, linkFile);
+    process.argv[1] = linkFile;
+    const metaUrl = "file://" + realFile.replace(/\\/g, "/");
+    expect(isMainModule(metaUrl)).toBe(true);
+  });
+
+  it("returns false when argv[1] is missing", () => {
+    delete process.argv[1];
+    expect(isMainModule("file:///any/path.mjs")).toBe(false);
+  });
+});

packages/mcp-server/test/vault.test.js

@@ -1340,3 +1340,42 @@ describe("v3 migration", () => {
     }
   });
 });
+
+describe("probeKeychainState — caching + escape hatch (issue #6.3)", () => {
+  beforeEach(() => {
+    __resetKeyCache();
+    delete process.env.PERPLEXITY_DISABLE_KEYCHAIN;
+    vi.doUnmock("keytar");
+  });
+  afterEach(() => {
+    vi.doUnmock("keytar");
+    delete process.env.PERPLEXITY_DISABLE_KEYCHAIN;
+  });
+
+  it("returns false immediately when PERPLEXITY_DISABLE_KEYCHAIN=1", async () => {
+    const { probeKeychainState } = await import("../src/vault.js");
+    process.env.PERPLEXITY_DISABLE_KEYCHAIN = "1";
+    const result = await probeKeychainState();
+    expect(result).toEqual({ available: false, hasKey: false });
+  });
+
+  it("caches keytar load result so repeated probes don't re-import", async () => {
+    let importCount = 0;
+    vi.doMock("keytar", () => {
+      importCount++;
+      return {
+        default: {
+          getPassword: async () => null,
+          setPassword: async () => undefined,
+        },
+      };
+    });
+    const { probeKeychainState } = await import("../src/vault.js");
+    __resetKeyCache(); // clear any prior cache
+    await probeKeychainState();
+    await probeKeychainState();
+    await probeKeychainState();
+    // keytar should only be imported once because the result is cached
+    expect(importCount).toBe(1);
+  });
+});