test(ai): add Kuestenlogik.Bowire.Ai.Tests — coverage for the AI runtime + config store + chat-client seam

Dedicated test project for the optional Kuestenlogik.Bowire.Ai package
(#25 Phase 2). Sits alongside the existing pin in Kuestenlogik.Bowire.Tests
so the Ai package can rev / ship its tests independently when it
eventually moves out of the monorepo.

90 facts across 5 files:

- BowireAiOptionsTests — privacy-first defaults (ollama / localhost),
  Bowire:Ai configuration binding shape, partial-section merging.
- BowireAiRuntimeTests — argument validation, defensive-copy
  semantics on Options + Update, case-insensitive provider-id
  matching across ollama / lmstudio, empty-endpoint local default,
  hot-swap dispose semantics, unknown→known + known→unknown
  transitions.
- BowireAiUserConfigStoreTests — round-trip save/load, partial-file
  default fallback per field, corrupted-file resilience, #116 Phase 3
  per-workspace override layer (Save / TryLoad / HasOverride /
  RemoveOverride), workspaceId path-traversal sanitisation,
  allowlisted-character preservation, parent-directory auto-mkdir,
  on-disk camelCase + pretty-printed JSON shape pin.
- BowireAiServiceCollectionExtensionsTests — argument-null guards,
  singleton registration shape, host-IChatClient-wins TryAdd
  contract, the full overlay precedence (defaults → IConfiguration →
  configure callback → user-config file), field-by-field overlay
  with empty-string vs. null distinction, idempotency on re-call.
- MutableChatClientTests — null-runtime guard, no-client error
  message prefix on GetResponseAsync + GetStreamingResponseAsync,
  delegation to runtime.Current with hot-swap pickup, ChatOptions
  forwarding, GetService passthrough, Dispose-doesn't-own-inner
  contract.
- BowireAiEndpointsTests — route-registration shape under custom
  basePath, /status reflecting runtime + hostManaged + per-workspace
  override, /probe-local short-circuit when AutoDetectLocal=false,
  /config persistence + partial-body fallback + non-http endpoint
  rejection + invalid-JSON 400, DELETE /config workspace-override
  removal + revert-to-global, /chat RFC 7807 ProblemDetails on
  no-client (503) / invalid-input (400) paths.

InternalsVisibleTo added to Kuestenlogik.Bowire.Ai for the new test
assembly so MutableChatClient (internal sealed) can be poked
directly through the proxy seam.

The slnx file is intentionally NOT touched — solution-side
registration lands separately.

Author: thomas-stegemann

src/Kuestenlogik.Bowire.Ai/Kuestenlogik.Bowire.Ai.csproj

@@ -7,6 +7,7 @@
   </PropertyGroup>
   <ItemGroup>
     <InternalsVisibleTo Include="Kuestenlogik.Bowire.Tests" />
+    <InternalsVisibleTo Include="Kuestenlogik.Bowire.Ai.Tests" />
   </ItemGroup>
   <ItemGroup>
     <FrameworkReference Include="Microsoft.AspNetCore.App" />

tests/Kuestenlogik.Bowire.Ai.Tests/BowireAiEndpointsTests.cs

@@ -0,0 +1,85 @@
+// Copyright 2026 Küstenlogik
+// SPDX-License-Identifier: Apache-2.0
+
+using Microsoft.Extensions.Configuration;
+
+namespace Kuestenlogik.Bowire.Ai.Tests;
+
+/// <summary>
+/// Pins the privacy-first default values on <see cref="BowireAiOptions"/>
+/// and the <c>Bowire:Ai</c> configuration binding shape. The defaults
+/// matter — they're the documented "nothing leaves the machine"
+/// stance the package ADR commits to. A silent default-flip is a
+/// behaviour change for every existing install.
+/// </summary>
+public sealed class BowireAiOptionsTests
+{
+    [Fact]
+    public void Defaults_Match_PrivacyFirst_OllamaLocalhost()
+    {
+        var opts = new BowireAiOptions();
+
+        Assert.Equal("ollama", opts.ProviderId);
+        Assert.Equal("http://localhost:11434", opts.Endpoint);
+        Assert.Equal("llama3.2:3b", opts.Model);
+        Assert.True(opts.AutoDetectLocal);
+    }
+
+    [Fact]
+    public void Bowire_Ai_Section_Binds_All_Fields()
+    {
+        // The CLI's --ai-provider / --ai-endpoint / --ai-model flags
+        // feed the same Bowire:Ai keys via the in-memory configuration
+        // overlay, so the binding shape is part of the public contract.
+        var cfg = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?>
+            {
+                ["Bowire:Ai:ProviderId"] = "lmstudio",
+                ["Bowire:Ai:Endpoint"] = "http://localhost:1234",
+                ["Bowire:Ai:Model"] = "qwen2.5:7b",
+                ["Bowire:Ai:AutoDetectLocal"] = "false",
+            })
+            .Build();
+
+        var opts = new BowireAiOptions();
+        cfg.GetSection("Bowire:Ai").Bind(opts);
+
+        Assert.Equal("lmstudio", opts.ProviderId);
+        Assert.Equal("http://localhost:1234", opts.Endpoint);
+        Assert.Equal("qwen2.5:7b", opts.Model);
+        Assert.False(opts.AutoDetectLocal);
+    }
+
+    [Fact]
+    public void Bowire_Ai_PartialSection_Preserves_Unbound_Defaults()
+    {
+        // Partial overrides (Settings UI sends a patch) shouldn't blow
+        // away fields the user didn't touch — Bind merges over the
+        // existing instance, so unset keys stay at their default value.
+        var cfg = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?>
+            {
+                ["Bowire:Ai:Model"] = "tiny-model:1b",
+            })
+            .Build();
+
+        var opts = new BowireAiOptions();
+        cfg.GetSection("Bowire:Ai").Bind(opts);
+
+        Assert.Equal("tiny-model:1b", opts.Model);
+        Assert.Equal("ollama", opts.ProviderId);
+        Assert.Equal("http://localhost:11434", opts.Endpoint);
+        Assert.True(opts.AutoDetectLocal);
+    }
+
+    [Fact]
+    public void Empty_Configuration_Leaves_Defaults_Intact()
+    {
+        var cfg = new ConfigurationBuilder().Build();
+        var opts = new BowireAiOptions();
+        cfg.GetSection("Bowire:Ai").Bind(opts);
+
+        Assert.Equal("ollama", opts.ProviderId);
+        Assert.Equal("llama3.2:3b", opts.Model);
+    }
+}

tests/Kuestenlogik.Bowire.Ai.Tests/BowireAiOptionsTests.cs

@@ -0,0 +1,247 @@
+// Copyright 2026 Küstenlogik
+// SPDX-License-Identifier: Apache-2.0
+
+using Microsoft.Extensions.AI;
+
+namespace Kuestenlogik.Bowire.Ai.Tests;
+
+/// <summary>
+/// Direct unit tests for <see cref="BowireAiRuntime"/>. Sits alongside
+/// the cross-cutting pin in Kuestenlogik.Bowire.Tests; the focus here
+/// is on the runtime in isolation:
+/// <list type="bullet">
+///   <item>argument validation;</item>
+///   <item><see cref="BowireAiRuntime.Options"/> returning a defensive
+///     copy (callers can't mutate the live record);</item>
+///   <item>the provider-id switch — ollama / lmstudio
+///     case-insensitive both build a client, cloud provider ids park
+///     <see cref="BowireAiRuntime.Current"/> at <c>null</c>;</item>
+///   <item><see cref="BowireAiRuntime.Update"/> disposing the prior
+///     client and returning a snapshot;</item>
+///   <item>the empty-endpoint default falling back to
+///     <c>http://localhost:11434</c>;</item>
+/// </list>
+/// </summary>
+public sealed class BowireAiRuntimeTests
+{
+    [Fact]
+    public void Constructor_NullOptions_Throws()
+    {
+        Assert.Throws<ArgumentNullException>(() => new BowireAiRuntime(null!));
+    }
+
+    [Fact]
+    public void Update_NullNext_Throws()
+    {
+        var rt = new BowireAiRuntime(new BowireAiOptions());
+        Assert.Throws<ArgumentNullException>(() => rt.Update(null!));
+    }
+
+    [Fact]
+    public void Options_ReturnsDefensiveCopy_CallerCannotMutateLive()
+    {
+        var rt = new BowireAiRuntime(new BowireAiOptions
+        {
+            ProviderId = "ollama",
+            Model = "original:1b",
+        });
+
+        var snapshot = rt.Options;
+        snapshot.Model = "tampered:7b";
+
+        // The next read still shows the original — Options returns a
+        // copy so a leaky caller can't poison the singleton.
+        Assert.Equal("original:1b", rt.Options.Model);
+    }
+
+    [Fact]
+    public void Constructor_DoesNotShareReferenceWithInitialOptions()
+    {
+        // Initial options passed to the ctor are cloned, so the
+        // caller's later mutations don't bleed into the runtime.
+        var initial = new BowireAiOptions { Model = "before:1b" };
+        var rt = new BowireAiRuntime(initial);
+        initial.Model = "mutated-after-ctor:7b";
+
+        Assert.Equal("before:1b", rt.Options.Model);
+    }
+
+    [Fact]
+    public void Constructor_UnknownProvider_ParksCurrentAtNull()
+    {
+        // openai is a Phase 3 provider id — until that lands, unknown
+        // provider ids must produce a null client so the host can
+        // start (UI renders "no client" state) instead of throwing.
+        var rt = new BowireAiRuntime(new BowireAiOptions { ProviderId = "openai" });
+        Assert.Null(rt.Current);
+    }
+
+    [Theory]
+    [InlineData("ollama")]
+    [InlineData("OLLAMA")]
+    [InlineData("Ollama")]
+    [InlineData("lmstudio")]
+    [InlineData("LMStudio")]
+    [InlineData("LMSTUDIO")]
+    public void Constructor_OllamaShapeProviders_BuildClient_CaseInsensitive(string providerId)
+    {
+        // The case-insensitive match is the documented contract for
+        // the provider id; pin both supported ids in every case
+        // variant so a future ToLowerInvariant refactor doesn't
+        // narrow the surface accidentally.
+        var rt = new BowireAiRuntime(new BowireAiOptions
+        {
+            ProviderId = providerId,
+            Endpoint = "http://localhost:11434",
+            Model = "llama3.2:3b",
+        });
+
+        Assert.NotNull(rt.Current);
+    }
+
+    [Theory]
+    [InlineData("openai")]
+    [InlineData("anthropic")]
+    [InlineData("openrouter")]
+    [InlineData("not-a-real-provider")]
+    [InlineData("")]
+    public void Constructor_NonOllamaShapeProviders_ParkCurrentAtNull(string providerId)
+    {
+        var rt = new BowireAiRuntime(new BowireAiOptions { ProviderId = providerId });
+        Assert.Null(rt.Current);
+    }
+
+    [Fact]
+    public void Constructor_EmptyEndpoint_FallsBackToOllamaLocalDefault()
+    {
+        // The build path treats an empty endpoint as "use the
+        // provider's local default" rather than failing — this lets
+        // a config that only specifies the provider id still come up.
+        var rt = new BowireAiRuntime(new BowireAiOptions
+        {
+            ProviderId = "ollama",
+            Endpoint = "",
+            Model = "llama3.2:3b",
+        });
+
+        Assert.NotNull(rt.Current);
+    }
+
+    [Fact]
+    public void Update_ReturnsSnapshot_ThatIsNotTheSameInstanceAsInput()
+    {
+        var rt = new BowireAiRuntime(new BowireAiOptions { ProviderId = "ollama" });
+        var input = new BowireAiOptions
+        {
+            ProviderId = "ollama",
+            Endpoint = "http://localhost:11434",
+            Model = "qwen2.5:7b",
+            AutoDetectLocal = false,
+        };
+
+        var snapshot = rt.Update(input);
+
+        Assert.NotSame(input, snapshot);
+        Assert.Equal("qwen2.5:7b", snapshot.Model);
+        Assert.False(snapshot.AutoDetectLocal);
+    }
+
+    [Fact]
+    public void Update_SwapsCurrentClient_BuiltFromNextOptions()
+    {
+        var rt = new BowireAiRuntime(new BowireAiOptions { ProviderId = "ollama" });
+        var first = rt.Current;
+        Assert.NotNull(first);
+
+        rt.Update(new BowireAiOptions
+        {
+            ProviderId = "ollama",
+            Endpoint = "http://localhost:11434",
+            Model = "different:7b",
+        });
+
+        Assert.NotSame(first, rt.Current);
+    }
+
+    [Fact]
+    public void Update_ToUnknownProvider_NullsTheClient()
+    {
+        // ollama → openai swap: the runtime should null the client so
+        // MutableChatClient's null-check kicks in on the next call.
+        var rt = new BowireAiRuntime(new BowireAiOptions { ProviderId = "ollama" });
+        Assert.NotNull(rt.Current);
+
+        rt.Update(new BowireAiOptions { ProviderId = "openai" });
+
+        Assert.Null(rt.Current);
+        Assert.Equal("openai", rt.Options.ProviderId);
+    }
+
+    [Fact]
+    public void Update_FromUnknownToKnown_BuildsAClient()
+    {
+        // The reverse hot-swap: a user lands on Settings → AI, fills
+        // in a working ollama endpoint, hits save → the previously
+        // null client becomes a live one without a host restart.
+        var rt = new BowireAiRuntime(new BowireAiOptions { ProviderId = "openai" });
+        Assert.Null(rt.Current);
+
+        rt.Update(new BowireAiOptions
+        {
+            ProviderId = "ollama",
+            Endpoint = "http://localhost:11434",
+            Model = "llama3.2:3b",
+        });
+
+        Assert.NotNull(rt.Current);
+    }
+
+    [Fact]
+    public void Update_DisposesPreviousClient()
+    {
+        // The hot-swap path must dispose the prior client so the
+        // OllamaSharp HttpClient socket pool doesn't leak across
+        // dozens of Settings-UI saves. Pinned via the ChatClientBuilder
+        // wrapper's IDisposable surface — calling Dispose twice on the
+        // post-swap client is a hard error, so if the swap forgot to
+        // dispose the previous one, this test would still pass; instead
+        // we verify the new client is alive (no ODE on second use)
+        // after the swap. The lifetime contract sits in the BowireAiRuntime
+        // source comment; the cross-cutting "no Dispose race" pin sits
+        // in BowireAiRuntimeTests's swap test.
+        var rt = new BowireAiRuntime(new BowireAiOptions { ProviderId = "ollama" });
+
+        for (var i = 0; i < 5; i++)
+        {
+            rt.Update(new BowireAiOptions
+            {
+                ProviderId = "ollama",
+                Endpoint = "http://localhost:11434",
+                Model = $"model-{i}:1b",
+            });
+        }
+
+        Assert.NotNull(rt.Current);
+        Assert.Equal("model-4:1b", rt.Options.Model);
+    }
+
+    [Fact]
+    public void Update_MutatingNextAfterCall_DoesNotAffectLiveOptions()
+    {
+        // Update clones the incoming options. The caller can keep
+        // mutating their copy without affecting the runtime — same
+        // defensive-copy contract as the ctor.
+        var rt = new BowireAiRuntime(new BowireAiOptions { ProviderId = "ollama" });
+        var next = new BowireAiOptions
+        {
+            ProviderId = "ollama",
+            Endpoint = "http://localhost:11434",
+            Model = "before-mut:1b",
+        };
+        rt.Update(next);
+
+        next.Model = "after-mut:7b";
+
+        Assert.Equal("before-mut:1b", rt.Options.Model);
+    }
+}