M0: compilable skeleton — Kigi 0.1.0 fork surgery

Hard fork of xai-org/grok-build (Apache-2.0) re-targeted as Kigi, an unofficial Kimi Code CLI community build. Rename & identity - 72 xai-*/xai-grok-* crates -> kigi-* (explicit: xai-grok-pager-bin -> kigi-bin [binary `kigi`], xai-grok-pager -> kigi-tui; rest mechanical); ptyctl, ptyctl-cli, third_party/ unchanged; proto package xai.grok.tools.v1 -> kigi.tools.v1 - Config home ~/.kigi (KIGI_SHARE_DIR override), env prefix GROK_* -> KIGI_*, `kigi --version` carries the unofficial-community-build notice - clap identity, help text, startup banner, prompt templates rebranded (templates re-encrypted) Deletions (PRD removal list #5/#6/#7/#9/#10) - voice input (xai-grok-voice) and all TUI wiring - telemetry: Mixpanel client, external OTel stream, Sentry, OTLP layers, trace/GCS/S3 upload queues (kigi-file-utils halved), workspace upload module & dc_log, heap-profile uploader, auth-diagnostics uploader, session-analytics halves of feedback; local zero-egress observability preserved in new kigi-log crate (unified log, --debug firehose, subsystem file logs, opt-in instrumentation) - announcements (crate, remote-settings fields, TUI surfaces) - plugin marketplace (crate, sources/browse/CTA/extensions-modal tab); direct plugin install/uninstall/update via kigi-agent git_install kept - relay/gateway/assets endpoints and features (agent relay, headless relay transport, gateway bridge, LeaderEnvUrls); leader IPC socket now ~/.kigi/leader.sock + KIGI_LEADER_SOCKET, no ws-url derivation - functional types rehomed instead of deleted: PermissionMode -> kigi-config-types, McpInitStrategy -> kigi-mcp, PrCreationSource -> session signals, TerminalDiagnostics -> kigi-pager-render, agent_id -> shell util Endpoints - kigi-env rewritten: single production KigiEndpoints {coding_api_base_url https://api.kimi.com/coding/v1 (KIGI_CODE_BASE_URL), oauth_host https://auth.kimi.com (KIGI_OAUTH_HOST), update_base_url (GitHub Releases API), upgrade_page_url}; GrokBuildEnvironment enum deleted Toolchain & workspace hygiene - Rust 1.97.0 pinned; edition 2024; full cargo update; git2 hoisted to workspace at 0.21 (Option->Result API migration), quick-xml 0.41 - Root Cargo.toml hand-maintained (PRD §8.1): version 0.1.0 inherited by all members, members sorted, unused deps pruned - cargo-deny advisories gate (deny.toml with documented transitive exceptions); CI workflow (check/clippy/fmt/deny/test, macOS+Linux) - cross-crate test seams re-gated behind `test-support` cargo feature; insta snapshot baselines renamed to the kigi_tui prefix - clippy --workspace --all-targets: zero warnings; fmt clean Fixes surfaced by the port - updater probe/installer divergence (bin/kigi vs bin/grok symlink set) - idle model-metadata refresh dead under KIGI_CODE_BASE_URL override (new is_effective_coding_endpoint_url, loopback+override aware) - macOS symlinked-TMPDIR fixture canonicalization (foreign_sessions, fast-worktree); RSS measurement tests serialized via serial_test Docs & legal (Apache §4) - NOTICE added (upstream attribution + change statement); THIRD-PARTY notices sustained; kigi-tools ported-code notices extended; README, CONTRIBUTING, SECURITY, AGENTS.md rewritten Out of scope for M0 (tracked): Kimi auth/inference (M1), search/fetch, command parity, config import (M2), Computer Hub excision & final brand-token sweep (M2), distribution & self-update rewrite (M3).
2026-07-17 05:31:01 -04:00
commit d6c20fc13f
2612 changed files with 1353757 additions and 0 deletions
@@ -0,0 +1,505 @@
+//! One-shot primary-display refresh probe (OnceLock-cached).
+//! Fail-closed: never panics into callers; no TTY IO; no display mode mutation.
+
+use std::sync::OnceLock;
+use std::time::Instant;
+
+use super::{DisplayServer, HostOs, is_wsl};
+
+/// Sane bounds; outside → fail closed.
+const MIN_HZ: u32 = 30;
+const MAX_HZ: u32 = 500;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, strum::Display, strum::AsRefStr)]
+#[strum(serialize_all = "snake_case")]
+pub enum DisplayRefreshSource {
+    None,
+    MacosCoreGraphics,
+    WindowsEnumDisplaySettings,
+    Linux,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct DisplayRefreshProbeResult {
+    pub hz: Option<u32>,
+    pub source: DisplayRefreshSource,
+    /// Empty when ok; else a stable skip/error token.
+    pub skip_reason: &'static str,
+    pub duration_ms: u64,
+}
+
+impl DisplayRefreshProbeResult {
+    /// `ok` | `skipped` | `error`
+    pub fn outcome(self) -> &'static str {
+        if self.hz.is_some() {
+            "ok"
+        } else if self.skip_reason == "error" {
+            "error"
+        } else {
+            "skipped"
+        }
+    }
+}
+
+/// Once per process. Infallible; never panics.
+pub fn probe_display_refresh() -> DisplayRefreshProbeResult {
+    static CACHE: OnceLock<DisplayRefreshProbeResult> = OnceLock::new();
+    *CACHE.get_or_init(probe_uncached)
+}
+
+fn probe_uncached() -> DisplayRefreshProbeResult {
+    let start = Instant::now();
+    let (hz, source, skip_reason) = probe_inner();
+    DisplayRefreshProbeResult {
+        hz,
+        source,
+        skip_reason,
+        duration_ms: start.elapsed().as_millis() as u64,
+    }
+}
+
+fn probe_inner() -> (Option<u32>, DisplayRefreshSource, &'static str) {
+    let is_ssh = kigi_shared::clipboard::is_remote_session();
+    let wsl = is_wsl();
+    let os = HostOs::current();
+    let display = DisplayServer::current();
+
+    // Avoid FFI when env already forces a skip.
+    let platform_hz = if precheck_skip(is_ssh, wsl).is_some() {
+        None
+    } else {
+        match os {
+            HostOs::Macos => Some(probe_macos()),
+            HostOs::Windows => Some(probe_windows()),
+            HostOs::Linux | HostOs::Other => None,
+        }
+    };
+
+    decide(is_ssh, wsl, os, display, platform_hz)
+}
+
+/// Pure matrix used by production and tests; inject only the platform result.
+fn decide(
+    is_ssh: bool,
+    is_wsl: bool,
+    os: HostOs,
+    display: DisplayServer,
+    platform_hz: Option<Result<u32, &'static str>>,
+) -> (Option<u32>, DisplayRefreshSource, &'static str) {
+    if let Some(reason) = precheck_skip(is_ssh, is_wsl) {
+        return (None, DisplayRefreshSource::None, reason);
+    }
+    match os {
+        HostOs::Macos => {
+            let source = DisplayRefreshSource::MacosCoreGraphics;
+            match platform_hz.unwrap_or(Err("error")) {
+                Ok(hz) => accept_hz(hz, source),
+                Err(reason) => (None, source, reason),
+            }
+        }
+        HostOs::Windows => {
+            let source = DisplayRefreshSource::WindowsEnumDisplaySettings;
+            match platform_hz.unwrap_or(Err("error")) {
+                Ok(hz) => accept_hz(hz, source),
+                Err(reason) => (None, source, reason),
+            }
+        }
+        HostOs::Linux => {
+            let reason = linux_skip_reason(display);
+            (None, DisplayRefreshSource::Linux, reason)
+        }
+        HostOs::Other => (None, DisplayRefreshSource::None, "unsupported"),
+    }
+}
+
+fn precheck_skip(is_ssh: bool, is_wsl: bool) -> Option<&'static str> {
+    if is_ssh {
+        return Some("ssh");
+    }
+    if is_wsl {
+        return Some("wsl");
+    }
+    None
+}
+
+fn linux_skip_reason(display: DisplayServer) -> &'static str {
+    match display {
+        DisplayServer::Wayland => "wayland_unsupported",
+        DisplayServer::X11 => "x11_unsupported",
+        _ => "no_display",
+    }
+}
+
+fn accept_hz(
+    hz: u32,
+    source: DisplayRefreshSource,
+) -> (Option<u32>, DisplayRefreshSource, &'static str) {
+    if !(MIN_HZ..=MAX_HZ).contains(&hz) {
+        return (None, source, "out_of_range");
+    }
+    (Some(hz), source, "")
+}
+
+#[cfg(target_os = "macos")]
+fn probe_macos() -> Result<u32, &'static str> {
+    // Fail-closed if FFI panics (abort builds still abort).
+    match std::panic::catch_unwind(|| {
+        // SAFETY: read-only CoreGraphics display query; no mode mutation.
+        unsafe { macos_main_display_refresh_hz() }
+    }) {
+        Ok(inner) => inner,
+        Err(_) => Err("error"),
+    }
+}
+
+#[cfg(not(target_os = "macos"))]
+fn probe_macos() -> Result<u32, &'static str> {
+    Err("unsupported")
+}
+
+#[cfg(target_os = "macos")]
+unsafe fn macos_main_display_refresh_hz() -> Result<u32, &'static str> {
+    type CgDisplayModeRef = *mut core::ffi::c_void;
+    type CgDirectDisplayId = u32;
+
+    #[link(name = "CoreGraphics", kind = "framework")]
+    unsafe extern "C" {
+        fn CGMainDisplayID() -> CgDirectDisplayId;
+        fn CGDisplayCopyDisplayMode(display: CgDirectDisplayId) -> CgDisplayModeRef;
+        fn CGDisplayModeGetRefreshRate(mode: CgDisplayModeRef) -> f64;
+        fn CGDisplayModeRelease(mode: CgDisplayModeRef);
+    }
+
+    // SAFETY: stable public CG APIs; null mode handled; Release pairs with Copy.
+    let display = unsafe { CGMainDisplayID() };
+    let mode = unsafe { CGDisplayCopyDisplayMode(display) };
+    if mode.is_null() {
+        return Err("error");
+    }
+    let rate = unsafe { CGDisplayModeGetRefreshRate(mode) };
+    unsafe { CGDisplayModeRelease(mode) };
+    // 0.0 is documented indeterminate for some LCD/VRR panels — skip, not error.
+    // Future primary-display fallback must be thread-safe; no AppKit/NSScreen here.
+    if !rate.is_finite() || rate < 0.0 {
+        return Err("error");
+    }
+    if rate == 0.0 {
+        return Err("indeterminate");
+    }
+    Ok(rate.round() as u32)
+}
+
+#[cfg(target_os = "windows")]
+fn probe_windows() -> Result<u32, &'static str> {
+    match std::panic::catch_unwind(|| {
+        // SAFETY: read-only EnumDisplayDevices/Settings for primary only.
+        unsafe { windows_primary_display_refresh_hz() }
+    }) {
+        Ok(inner) => inner,
+        Err(_) => Err("error"),
+    }
+}
+
+#[cfg(not(target_os = "windows"))]
+fn probe_windows() -> Result<u32, &'static str> {
+    Err("unsupported")
+}
+
+/// Primary monitor Hz (matches macOS `CGMainDisplayID`). Null device name to
+/// `EnumDisplaySettingsW` is the *current* adapter, which can differ from the
+/// primary on multi-monitor machines.
+#[cfg(target_os = "windows")]
+unsafe fn windows_primary_display_refresh_hz() -> Result<u32, &'static str> {
+    use windows_sys::Win32::Graphics::Gdi::{
+        DEVMODEW, DISPLAY_DEVICE_PRIMARY_DEVICE, DISPLAY_DEVICEW, ENUM_CURRENT_SETTINGS,
+        EnumDisplayDevicesW, EnumDisplaySettingsW,
+    };
+
+    // Bound device enumeration so a broken driver cannot spin forever.
+    for i in 0u32..32 {
+        // SAFETY: zeroed DISPLAY_DEVICEW with cb set is the documented pattern.
+        let mut device: DISPLAY_DEVICEW = unsafe { std::mem::zeroed() };
+        device.cb = std::mem::size_of::<DISPLAY_DEVICEW>() as u32;
+        // SAFETY: null parent = desktop adapters; i indexes adapters.
+        let ok = unsafe { EnumDisplayDevicesW(std::ptr::null(), i, &mut device, 0) };
+        if ok == 0 {
+            break;
+        }
+        if device.StateFlags & DISPLAY_DEVICE_PRIMARY_DEVICE == 0 {
+            continue;
+        }
+
+        // SAFETY: zeroed DEVMODEW with dmSize set; DeviceName is the primary.
+        let mut devmode: DEVMODEW = unsafe { std::mem::zeroed() };
+        devmode.dmSize = std::mem::size_of::<DEVMODEW>() as u16;
+        let ok = unsafe {
+            EnumDisplaySettingsW(
+                device.DeviceName.as_ptr(),
+                ENUM_CURRENT_SETTINGS,
+                &mut devmode,
+            )
+        };
+        if ok == 0 {
+            return Err("error");
+        }
+        let hz = devmode.dmDisplayFrequency;
+        // 0/1 often mean "default hardware rate" — fail closed.
+        if hz < 2 {
+            return Err("error");
+        }
+        return Ok(hz);
+    }
+    Err("error")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Real OS path smoke: must not panic (FFI wrapped + fail-closed).
+    /// Outcome may be ok/skipped/error depending on host; we only require
+    /// process survival and a valid outcome token.
+    #[test]
+    fn probe_display_refresh_never_panics() {
+        let r = probe_display_refresh();
+        assert!(
+            matches!(r.outcome(), "ok" | "skipped" | "error"),
+            "unexpected outcome {:?}",
+            r.outcome()
+        );
+        if let Some(hz) = r.hz {
+            assert!((MIN_HZ..=MAX_HZ).contains(&hz), "hz out of bounds: {hz}");
+            assert_eq!(r.outcome(), "ok");
+            assert!(r.skip_reason.is_empty());
+        } else {
+            assert!(!r.skip_reason.is_empty() || r.outcome() == "error");
+        }
+        // Second call hits OnceLock — still must not panic.
+        let r2 = probe_display_refresh();
+        assert_eq!(r.hz, r2.hz);
+        assert_eq!(r.outcome(), r2.outcome());
+    }
+
+    #[test]
+    fn ssh_skips_before_platform() {
+        let (hz, source, reason) = decide(
+            true,
+            false,
+            HostOs::Macos,
+            DisplayServer::Unknown,
+            Some(Ok(120)),
+        );
+        assert_eq!(hz, None);
+        assert_eq!(source, DisplayRefreshSource::None);
+        assert_eq!(reason, "ssh");
+    }
+
+    #[test]
+    fn wsl_skips() {
+        let (hz, source, reason) =
+            decide(false, true, HostOs::Linux, DisplayServer::X11, Some(Ok(60)));
+        assert_eq!(hz, None);
+        assert_eq!(source, DisplayRefreshSource::None);
+        assert_eq!(reason, "wsl");
+    }
+
+    #[test]
+    fn linux_wayland_unsupported() {
+        let (hz, source, reason) =
+            decide(false, false, HostOs::Linux, DisplayServer::Wayland, None);
+        assert_eq!(hz, None);
+        assert_eq!(source, DisplayRefreshSource::Linux);
+        assert_eq!(reason, "wayland_unsupported");
+    }
+
+    #[test]
+    fn linux_x11_unsupported() {
+        let (hz, source, reason) = decide(false, false, HostOs::Linux, DisplayServer::X11, None);
+        assert_eq!(hz, None);
+        assert_eq!(source, DisplayRefreshSource::Linux);
+        assert_eq!(reason, "x11_unsupported");
+    }
+
+    #[test]
+    fn linux_no_display() {
+        let (hz, source, reason) =
+            decide(false, false, HostOs::Linux, DisplayServer::Unknown, None);
+        assert_eq!(hz, None);
+        assert_eq!(source, DisplayRefreshSource::Linux);
+        assert_eq!(reason, "no_display");
+    }
+
+    #[test]
+    fn host_os_other_unsupported() {
+        let (hz, source, reason) =
+            decide(false, false, HostOs::Other, DisplayServer::Unknown, None);
+        assert_eq!(hz, None);
+        assert_eq!(source, DisplayRefreshSource::None);
+        assert_eq!(reason, "unsupported");
+    }
+
+    #[test]
+    fn out_of_range_low() {
+        let (hz, source, reason) = decide(
+            false,
+            false,
+            HostOs::Macos,
+            DisplayServer::Unknown,
+            Some(Ok(15)),
+        );
+        assert_eq!(hz, None);
+        assert_eq!(source, DisplayRefreshSource::MacosCoreGraphics);
+        assert_eq!(reason, "out_of_range");
+    }
+
+    #[test]
+    fn out_of_range_high() {
+        let (hz, source, reason) = decide(
+            false,
+            false,
+            HostOs::Windows,
+            DisplayServer::Unknown,
+            Some(Ok(1000)),
+        );
+        assert_eq!(hz, None);
+        assert_eq!(source, DisplayRefreshSource::WindowsEnumDisplaySettings);
+        assert_eq!(reason, "out_of_range");
+    }
+
+    #[test]
+    fn ok_120_macos() {
+        let (hz, source, reason) = decide(
+            false,
+            false,
+            HostOs::Macos,
+            DisplayServer::Unknown,
+            Some(Ok(120)),
+        );
+        assert_eq!(hz, Some(120));
+        assert_eq!(source, DisplayRefreshSource::MacosCoreGraphics);
+        assert_eq!(reason, "");
+    }
+
+    #[test]
+    fn ok_144_windows() {
+        let (hz, source, reason) = decide(
+            false,
+            false,
+            HostOs::Windows,
+            DisplayServer::Unknown,
+            Some(Ok(144)),
+        );
+        assert_eq!(hz, Some(144));
+        assert_eq!(source, DisplayRefreshSource::WindowsEnumDisplaySettings);
+        assert_eq!(reason, "");
+    }
+
+    #[test]
+    fn backend_error() {
+        let (hz, source, reason) = decide(
+            false,
+            false,
+            HostOs::Macos,
+            DisplayServer::Unknown,
+            Some(Err("error")),
+        );
+        assert_eq!(hz, None);
+        assert_eq!(source, DisplayRefreshSource::MacosCoreGraphics);
+        assert_eq!(reason, "error");
+    }
+
+    #[test]
+    fn indeterminate_is_skipped_not_error() {
+        let (hz, source, reason) = decide(
+            false,
+            false,
+            HostOs::Macos,
+            DisplayServer::Unknown,
+            Some(Err("indeterminate")),
+        );
+        assert_eq!(
+            (hz, source, reason),
+            (
+                None,
+                DisplayRefreshSource::MacosCoreGraphics,
+                "indeterminate"
+            )
+        );
+        assert_eq!(
+            DisplayRefreshProbeResult {
+                hz: None,
+                source,
+                skip_reason: reason,
+                duration_ms: 0,
+            }
+            .outcome(),
+            "skipped"
+        );
+    }
+
+    #[test]
+    fn missing_platform_hz_is_error() {
+        let (hz, source, reason) =
+            decide(false, false, HostOs::Macos, DisplayServer::Unknown, None);
+        assert_eq!(hz, None);
+        assert_eq!(source, DisplayRefreshSource::MacosCoreGraphics);
+        assert_eq!(reason, "error");
+    }
+
+    #[test]
+    fn boundary_hz_accepted() {
+        for hz_in in [30u32, 500] {
+            let (hz, _, reason) = decide(
+                false,
+                false,
+                HostOs::Macos,
+                DisplayServer::Unknown,
+                Some(Ok(hz_in)),
+            );
+            assert_eq!(hz, Some(hz_in));
+            assert_eq!(reason, "");
+        }
+    }
+
+    #[test]
+    fn source_strum_snake_case_stable() {
+        assert_eq!(DisplayRefreshSource::None.as_ref(), "none");
+        assert_eq!(
+            DisplayRefreshSource::MacosCoreGraphics.as_ref(),
+            "macos_core_graphics"
+        );
+        assert_eq!(
+            DisplayRefreshSource::WindowsEnumDisplaySettings.as_ref(),
+            "windows_enum_display_settings"
+        );
+        assert_eq!(DisplayRefreshSource::Linux.as_ref(), "linux");
+        assert_eq!(DisplayRefreshSource::Linux.to_string(), "linux");
+    }
+
+    #[test]
+    fn outcome_tokens() {
+        let ok = DisplayRefreshProbeResult {
+            hz: Some(120),
+            source: DisplayRefreshSource::MacosCoreGraphics,
+            skip_reason: "",
+            duration_ms: 1,
+        };
+        assert_eq!(ok.outcome(), "ok");
+
+        let skipped = DisplayRefreshProbeResult {
+            hz: None,
+            source: DisplayRefreshSource::None,
+            skip_reason: "ssh",
+            duration_ms: 0,
+        };
+        assert_eq!(skipped.outcome(), "skipped");
+
+        let err = DisplayRefreshProbeResult {
+            hz: None,
+            source: DisplayRefreshSource::MacosCoreGraphics,
+            skip_reason: "error",
+            duration_ms: 2,
+        };
+        assert_eq!(err.outcome(), "error");
+    }
+}
@@ -0,0 +1,185 @@
+//! Host platform and display server classification.
+
+use std::collections::HashMap;
+use std::ffi::OsString;
+use std::sync::OnceLock;
+
+mod display_refresh;
+
+pub use display_refresh::{DisplayRefreshProbeResult, DisplayRefreshSource, probe_display_refresh};
+
+/// Process env as UTF-8. Skips non-Unicode entries (`vars()` panics on those).
+pub fn collect_unicode_env() -> HashMap<String, String> {
+    unicode_env_from_os(std::env::vars_os())
+}
+
+/// Pure helper: drop OsString pairs that are not valid Unicode.
+pub fn unicode_env_from_os(
+    iter: impl IntoIterator<Item = (OsString, OsString)>,
+) -> HashMap<String, String> {
+    iter.into_iter()
+        .filter_map(|(k, v)| Some((k.into_string().ok()?, v.into_string().ok()?)))
+        .collect()
+}
+
+#[derive(Debug, Clone, Copy, Default, Eq, PartialEq, strum::Display)]
+#[strum(serialize_all = "snake_case")]
+#[non_exhaustive]
+pub enum HostOs {
+    Macos,
+    Linux,
+    Windows,
+    #[default]
+    Other,
+}
+
+impl HostOs {
+    /// Call on demand since cfg is compile-time constant.
+    pub fn current() -> Self {
+        if cfg!(target_os = "macos") {
+            Self::Macos
+        } else if cfg!(target_os = "linux") {
+            Self::Linux
+        } else if cfg!(target_os = "windows") {
+            Self::Windows
+        } else {
+            Self::Other
+        }
+    }
+}
+
+/// WSL detection. The implementation lives in `kigi-tty-utils` (the shared
+/// low-level crate) so crates that must not depend on this UI crate can reuse
+/// it; re-exported here so existing `host::is_wsl()` callers are unchanged.
+pub use kigi_tty_utils::is_wsl;
+
+#[derive(Debug, Clone, Copy, Default, Eq, PartialEq, strum::Display)]
+#[strum(serialize_all = "snake_case")]
+#[non_exhaustive]
+pub enum DisplayServer {
+    Quartz,
+    Wayland,
+    X11,
+    Win32,
+    #[default]
+    Unknown,
+}
+
+impl DisplayServer {
+    /// Detect the display server. Cached for process lifetime on Linux
+    /// (env vars don't change); compile-time constant on macOS/Windows.
+    pub fn current() -> Self {
+        static CACHE: OnceLock<DisplayServer> = OnceLock::new();
+        *CACHE.get_or_init(|| {
+            let env = collect_unicode_env();
+            Self::detect_from_env(&env)
+        })
+    }
+
+    /// Pure helper so tests can drive env directly.
+    fn detect_from_env(env: &HashMap<String, String>) -> Self {
+        match HostOs::current() {
+            HostOs::Macos => Self::Quartz,
+            HostOs::Windows => Self::Win32,
+            HostOs::Linux => {
+                if env.get("WAYLAND_DISPLAY").is_some_and(|v| !v.is_empty()) {
+                    Self::Wayland
+                } else if env.get("DISPLAY").is_some_and(|v| !v.is_empty()) {
+                    Self::X11
+                } else {
+                    Self::Unknown
+                }
+            }
+            HostOs::Other => Self::Unknown,
+        }
+    }
+}
+
+#[cfg(test)]
+mod unicode_env_tests {
+    use super::*;
+    use std::ffi::OsString;
+
+    #[test]
+    fn unicode_env_from_os_skips_non_unicode_key_or_value() {
+        #[cfg(unix)]
+        {
+            use std::os::unix::ffi::OsStringExt;
+            let bad = OsString::from_vec(vec![0xff, 0xfe]);
+            let map = unicode_env_from_os([
+                (bad.clone(), OsString::from("ok")),
+                (OsString::from("OK_KEY"), bad),
+                (OsString::from("GOOD"), OsString::from("yes")),
+            ]);
+            assert_eq!(map, HashMap::from([("GOOD".into(), "yes".into())]));
+        }
+        #[cfg(windows)]
+        {
+            use std::os::windows::ffi::OsStringExt;
+            let bad = OsString::from_wide(&[0xD800]); // lone surrogate
+            let map = unicode_env_from_os([
+                (bad.clone(), OsString::from("ok")),
+                (OsString::from("OK_KEY"), bad),
+                (OsString::from("GOOD"), OsString::from("yes")),
+            ]);
+            assert_eq!(map, HashMap::from([("GOOD".into(), "yes".into())]));
+        }
+    }
+}
+
+// All remaining tests here are Linux-only DisplayServer tests; WSL detection
+// tests live with the implementation in `kigi-tty-utils`.
+#[cfg(all(test, target_os = "linux"))]
+mod tests {
+    use super::*;
+
+    fn env(pairs: &[(&str, &str)]) -> HashMap<String, String> {
+        pairs
+            .iter()
+            .map(|(k, v)| ((*k).to_owned(), (*v).to_owned()))
+            .collect()
+    }
+
+    #[test]
+    fn display_server_wayland() {
+        assert_eq!(
+            DisplayServer::detect_from_env(&env(&[("WAYLAND_DISPLAY", "wayland-0")])),
+            DisplayServer::Wayland,
+        );
+    }
+
+    #[test]
+    fn display_server_x11() {
+        assert_eq!(
+            DisplayServer::detect_from_env(&env(&[("DISPLAY", ":0")])),
+            DisplayServer::X11,
+        );
+    }
+
+    #[test]
+    fn display_server_wayland_wins_over_x11() {
+        assert_eq!(
+            DisplayServer::detect_from_env(&env(&[
+                ("WAYLAND_DISPLAY", "wayland-0"),
+                ("DISPLAY", ":0"),
+            ])),
+            DisplayServer::Wayland,
+        );
+    }
+
+    #[test]
+    fn display_server_unknown_when_no_display() {
+        assert_eq!(
+            DisplayServer::detect_from_env(&env(&[])),
+            DisplayServer::Unknown,
+        );
+    }
+
+    #[test]
+    fn display_server_empty_wayland_display_ignored() {
+        assert_eq!(
+            DisplayServer::detect_from_env(&env(&[("WAYLAND_DISPLAY", ""), ("DISPLAY", ":1")])),
+            DisplayServer::X11,
+        );
+    }
+}