@aexhq/cli 0.25.2 → 0.26.1

package/test/no-env-vars.test.ts

@@ -1,59 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { readFileSync, existsSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { dirname, resolve } from "node:path";
-
-const here = dirname(fileURLToPath(import.meta.url));
-const cliRoot = resolve(here, "..");
-const bundlePath = resolve(cliRoot, "dist", "cli.mjs");
-const digestPath = resolve(cliRoot, "dist", "cli.mjs.sha256");
-
-/**
- * Mechanical lockdown of the shipped CLI bundle.
- *
- * The CLI MUST NOT read any `process.env.AEX_*` value at runtime.
- * Earlier drafts proposed test-only overrides like
- * `AEX_RUN_TOKEN_FILE` and `AEX_PROXY_BASE_FILE` — those are a
- * prompt-injection attack surface (a compromised agent could set them
- * to redirect the bearer mint). Tests use module-DI through
- * `internal.ts`; the shipped bundle has no env-driven code paths.
- */
-describe("CLI bundle: no env-var-driven code paths", () => {
-  it("ships a self-contained ESM bundle at dist/cli.mjs", () => {
-    expect(existsSync(bundlePath)).toBe(true);
-    expect(existsSync(digestPath)).toBe(true);
-  });
-
-  it("contains zero process.env.AEX_* references", () => {
-    const text = readFileSync(bundlePath, "utf8");
-    const matches = text.match(/process\.env\.AEX_[A-Z0-9_]+/g) ?? [];
-    expect(matches).toEqual([]);
-  });
-
-  it("never reads the historic test-only override env vars", () => {
-    // These are explicitly named in the plan as forbidden surfaces.
-    const forbidden = [
-      "AEX_RUN_TOKEN_FILE",
-      "AEX_PROXY_BASE_FILE",
-      "AEX_PROXY_INDEX_FILE",
-      "AEX_CLI_BUNDLE_PATH"
-    ];
-    const text = readFileSync(bundlePath, "utf8");
-    for (const name of forbidden) {
-      expect(text.includes(name)).toBe(false);
-    }
-  });
-
-  it("references the fixed in-container paths exactly", () => {
-    // The CLI's discoverability surface is the manifest + run-token
-    // mounted under Anthropic's `/mnt/session/uploads/<mount_path>`
-    // rebase. Asserting their presence in the bundle catches any
-    // refactor that accidentally relativizes them or reverts to the
-    // pre-mount-fix `/aex/...` paths (which the Anthropic
-    // managed runner environment forwarding ignores these — see proxy-bootstrap.ts
-    // for the gory details).
-    const text = readFileSync(bundlePath, "utf8");
-    expect(text.includes("/mnt/session/uploads/aex/index.json")).toBe(true);
-    expect(text.includes("/mnt/session/uploads/aex/run-token")).toBe(true);
-  });
-});

package/test/outputs-sync.test.ts

@@ -1,107 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { runOutputsSyncCmd } from "../src/outputs-sync.js";
-import type { CliIO, OutputsSyncFileEntry } from "../src/internal.js";
-
-/** Build a minimal `CliIO` for `outputs sync` test cases. */
-function makeIo(opts: {
-  walk?: (root: string) => Promise<readonly OutputsSyncFileEntry[] | null>;
-  inContainer?: boolean;
-}): {
-  io: CliIO;
-  stdout: string;
-  stderr: string;
-} {
-  const state = { stdout: "", stderr: "" };
-  const io: CliIO = {
-    argv: ["node", "/aex/aex", "outputs", "sync"],
-    readFile: async (path) => {
-      if (path === "/mnt/session/uploads/aex/index.json" && opts.inContainer) return "{}";
-      const err = Object.assign(new Error(`ENOENT: ${path}`), { code: "ENOENT" });
-      throw err;
-    },
-    writeFile: async () => {
-      throw new Error("not used");
-    },
-    fetchImpl: (async () => new Response("{}")) as typeof fetch,
-    cwd: () => "/tmp",
-    stdout: (chunk) => {
-      state.stdout += chunk;
-    },
-    stderr: (chunk) => {
-      state.stderr += chunk;
-    },
-    exit: () => {},
-    ...(opts.walk ? { walkDirectory: opts.walk } : {})
-  };
-  return {
-    io,
-    get stdout() {
-      return state.stdout;
-    },
-    get stderr() {
-      return state.stderr;
-    }
-  };
-}
-
-describe("aex outputs sync (internal)", () => {
-  it("refuses to run on the host (no /aex/index.json)", async () => {
-    const cap = makeIo({ inContainer: false, walk: async () => [] });
-    const exit = await runOutputsSyncCmd(cap.io, ["/workspace/outputs"]);
-    expect(exit.code).not.toBe(0);
-    expect(cap.stderr).toMatch(/in-container/i);
-    expect(cap.stdout).toBe("");
-  });
-
-  it("rejects empty dir list", async () => {
-    const cap = makeIo({ inContainer: true });
-    const exit = await runOutputsSyncCmd(cap.io, []);
-    expect(exit.code).not.toBe(0);
-    expect(cap.stderr).toMatch(/usage/i);
-  });
-
-  it("emits one JSON line per discovered file plus a summary line", async () => {
-    const cap = makeIo({
-      inContainer: true,
-      walk: async (root) => {
-        if (root === "/workspace/outputs") {
-          return [
-            { path: "/workspace/outputs/a.txt", sizeBytes: 12 },
-            { path: "/workspace/outputs/b.bin", sizeBytes: 99 }
-          ];
-        }
-        return [];
-      }
-    });
-    const exit = await runOutputsSyncCmd(cap.io, ["/workspace/outputs", "/workspace/state"]);
-    expect(exit.code).toBe(0);
-    const lines = cap.stdout.trim().split("\n");
-    expect(lines).toHaveLength(3);
-    const parsed = lines.map((line) => JSON.parse(line) as Record<string, unknown>);
-    expect(parsed[0]).toMatchObject({ dir: "/workspace/outputs", path: "/workspace/outputs/a.txt", sizeBytes: 12 });
-    expect(parsed[1]).toMatchObject({ dir: "/workspace/outputs", path: "/workspace/outputs/b.bin", sizeBytes: 99 });
-    expect(parsed[2]).toMatchObject({ summary: { dirs: 2, files: 2, missing: 0 } });
-  });
-
-  it("reports missing dirs via stderr and continues", async () => {
-    const cap = makeIo({
-      inContainer: true,
-      walk: async (root) => (root === "/workspace/state" ? null : [])
-    });
-    const exit = await runOutputsSyncCmd(cap.io, ["/workspace/outputs", "/workspace/state"]);
-    expect(exit.code).toBe(0);
-    expect(cap.stderr).toContain(`"missing_or_unreadable"`);
-    expect(cap.stderr).toContain(`"/workspace/state"`);
-    const summary = cap.stdout.trim().split("\n").pop()!;
-    expect(JSON.parse(summary)).toMatchObject({ summary: { dirs: 2, files: 0, missing: 1 } });
-  });
-
-  it("rejects non-absolute output dirs as a defence against worker mis-instruction", async () => {
-    const cap = makeIo({ inContainer: true, walk: async () => [] });
-    const exit = await runOutputsSyncCmd(cap.io, ["workspace/outputs"]);
-    expect(exit.code).toBe(0);
-    expect(cap.stderr).toContain(`"non_absolute_path"`);
-    const summary = cap.stdout.trim().split("\n").pop()!;
-    expect(JSON.parse(summary)).toMatchObject({ summary: { dirs: 1, files: 0, missing: 1 } });
-  });
-});

package/tsconfig.build.json

@@ -1,9 +0,0 @@
-{
-  "extends": "./tsconfig.json",
-  "compilerOptions": {
-    "outDir": "dist",
-    "rootDir": "src"
-  },
-  "include": ["src"],
-  "exclude": ["test", "dist", "scripts"]
-}

package/tsconfig.json

@@ -1,4 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "include": ["src", "test", "vitest.config.ts"]
-}

package/vitest.config.ts

@@ -1,14 +0,0 @@
-import { defineConfig } from "vitest/config";
-
-export default defineConfig({
-  test: {
-    environment: "node",
-    globals: true,
-    restoreMocks: true,
-    coverage: {
-      provider: "v8",
-      reporter: ["text", "json-summary"],
-      exclude: ["dist/**", "coverage/**", "scripts/**", "**/*.config.*"]
-    }
-  }
-});