@agentel/sdk 1.1.0 → 1.2.0

package/test/community-live-smoke.mjs

@@ -187,7 +187,7 @@ async function reviewSubmission(baseUrl, reviewerApiKey, submissionId, idempoten
       Authorization: `Bearer ${reviewerApiKey}`,
       "Content-Type": "application/json",
       "Idempotency-Key": idempotencyKey,
-      "X-Agentel-Client": "@agentel/sdk/1.1.0",
+      "X-Agentel-Client": "@agentel/sdk/1.2.0",
       "X-Agentel-Protocol": "2.7",
     },
     body: JSON.stringify({

package/test/registration-safety.test.mjs

@@ -0,0 +1,194 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, stat, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+
+import {
+  registerAndPersist,
+  validateRegistrationResult,
+} from "../scripts/register-agent.mjs";
+
+const registration = {
+  agent: { id: "agent_test_1", slug: "atlas-research" },
+  credential: { id: "cred_test_1", key: "agentel_live_test_only" },
+  claim: { id: "claim_test_1", code: "claim_test_only", expiresAt: "2030-01-01T00:00:00.000Z" },
+  recovery: { id: "recovery_test_1", code: "recover_test_only" },
+};
+
+test("registration safety rejects an idempotent replay without one-time secrets", () => {
+  assert.throws(
+    () => validateRegistrationResult({
+      agent: registration.agent,
+      credential: { id: registration.credential.id, key: null, shownOnce: false },
+      claim: { id: registration.claim.id, code: null, shownOnce: false },
+      recovery: { id: registration.recovery.id, code: null, shownOnce: false },
+    }),
+    /incomplete credential response/,
+  );
+});
+
+test("registration safety requires an absolute isolated credential directory", async () => {
+  let calls = 0;
+  await assert.rejects(
+    () => registerAndPersist({
+      baseUrl: "https://agentel.test/api/v1",
+      idempotencyKey: "install_test_relative_output",
+      payload: {
+        name: "Relative Output Test",
+        slug: "relative-output-test",
+        description: "A relative output directory safety test.",
+        category: "research",
+        installationId: "test-installation-relative-output",
+      },
+      outputDir: ".agentel-credentials/relative-output-test",
+      fetchImpl: async () => {
+        calls += 1;
+        throw new Error("fetch should not be called");
+      },
+    }),
+    /absolute private directory/,
+  );
+  assert.equal(calls, 0);
+});
+
+test("registration safety rejects a directory containing any registration artifact", async () => {
+  const outputDir = await mkdtemp(join(tmpdir(), "agentel-register-test-"));
+  await writeFile(join(outputDir, "registration-metadata.json"), "existing");
+  await assert.rejects(
+    () => registerAndPersist({
+      baseUrl: "https://agentel.test/api/v1",
+      idempotencyKey: "install_test_existing_artifact",
+      payload: {
+        name: "Existing Artifact Test",
+        slug: "existing-artifact-test",
+        description: "An existing artifact safety test.",
+        category: "research",
+        installationId: "test-installation-existing-artifact",
+      },
+      outputDir,
+      fetchImpl: async () => { throw new Error("fetch should not be called"); },
+    }),
+    /already contains registration-metadata\.json/,
+  );
+});
+
+test("registration safety persists the complete response before /me verification", async () => {
+  const outputDir = await mkdtemp(join(tmpdir(), "agentel-register-test-"));
+  const calls = [];
+  const phases = [];
+  const result = await registerAndPersist({
+    baseUrl: "https://agentel.test/api/v1",
+    idempotencyKey: "install_test_safe_1",
+    payload: {
+      name: "Atlas Research",
+      slug: "atlas-research",
+      description: "An evidence-focused research Agent.",
+      category: "research",
+      avatarId: "icon2",
+      installationId: "test-installation-safe-1",
+    },
+    outputDir,
+    onPhase: (phase) => phases.push(phase),
+    fetchImpl: async (input, init) => {
+      calls.push({ url: String(input), init });
+      if (calls.length === 1) {
+        return new Response(JSON.stringify(registration), { status: 201, headers: { "Content-Type": "application/json", "X-Request-Id": "req_registration_test" } });
+      }
+      return new Response(JSON.stringify({ agent: { id: registration.agent.id } }), { status: 200, headers: { "Content-Type": "application/json" } });
+    },
+  });
+
+  assert.equal(result.meVerified, true);
+  assert.deepEqual(phases, ["prepare", "register", "persist", "verify"]);
+  assert.equal(calls.length, 2);
+  assert.match(await readFile(join(outputDir, ".env"), "utf8"), /AGENTEL_AGENT_ID=agent_test_1/);
+  assert.match(await readFile(join(outputDir, "claim-code.env"), "utf8"), /AGENTEL_CLAIM_CODE=claim_test_only/);
+  assert.match(await readFile(join(outputDir, "recovery-code.env"), "utf8"), /AGENTEL_RECOVERY_CODE=recover_test_only/);
+  assert.match(await readFile(join(outputDir, "registration-response.json"), "utf8"), /agentel_live_test_only/);
+  assert.equal((await stat(outputDir)).mode & 0o777, 0o700);
+  assert.equal((await stat(join(outputDir, ".env"))).mode & 0o777, 0o600);
+  assert.equal((await stat(join(outputDir, "claim-code.env"))).mode & 0o777, 0o600);
+  assert.equal((await stat(join(outputDir, "recovery-code.env"))).mode & 0o777, 0o600);
+  assert.equal(new Headers(calls[0].init.headers).get("Idempotency-Key"), "install_test_safe_1");
+  assert.equal(new Headers(calls[1].init.headers).get("Authorization"), "Bearer agentel_live_test_only");
+});
+
+test("registration safety keeps persisted credentials when the post-save /me check fails", async () => {
+  const outputDir = await mkdtemp(join(tmpdir(), "agentel-register-test-"));
+  let calls = 0;
+  await assert.rejects(
+    () => registerAndPersist({
+      baseUrl: "https://agentel.test/api/v1",
+      idempotencyKey: "install_test_me_failure",
+      payload: {
+        name: "Me Failure Test",
+        slug: "me-failure-test",
+        description: "A persistence-before-verification test.",
+        category: "research",
+        installationId: "test-installation-me-failure",
+      },
+      outputDir,
+      fetchImpl: async () => {
+        calls += 1;
+        if (calls === 1) return new Response(JSON.stringify(registration), { status: 201 });
+        return new Response(JSON.stringify({ error: { code: "INVALID_CREDENTIAL" } }), { status: 401 });
+      },
+    }),
+    /Credentials were saved, but \/me identity verification failed/,
+  );
+  assert.equal(calls, 2);
+  assert.match(await readFile(join(outputDir, ".env"), "utf8"), /AGENTEL_AGENT_ID=agent_test_1/);
+  assert.match(await readFile(join(outputDir, "claim-code.env"), "utf8"), /AGENTEL_CLAIM_CODE=claim_test_only/);
+  assert.match(await readFile(join(outputDir, "recovery-code.env"), "utf8"), /AGENTEL_RECOVERY_CODE=recover_test_only/);
+});
+
+test("registration safety requires an explicit slug and installation identity", async () => {
+  const outputDir = await mkdtemp(join(tmpdir(), "agentel-register-test-"));
+  await assert.rejects(
+    () => registerAndPersist({
+      baseUrl: "https://agentel.test/api/v1",
+      idempotencyKey: "install_test_safe_2",
+      payload: { name: "Probe", description: "A test Agent.", category: "research" },
+      outputDir,
+      fetchImpl: async () => { throw new Error("fetch should not be called"); },
+    }),
+    /explicit slug/,
+  );
+});
+
+test("registration safety times out a hanging registration without retrying", async () => {
+  const outputDir = await mkdtemp(join(tmpdir(), "agentel-register-test-"));
+  let calls = 0;
+  let aborted = false;
+
+  await assert.rejects(
+    () => registerAndPersist({
+      baseUrl: "https://agentel.test/api/v1",
+      idempotencyKey: "install_test_timeout",
+      payload: {
+        name: "Timeout Test",
+        slug: "timeout-test",
+        description: "A timeout safety test.",
+        category: "research",
+        installationId: "test-installation-timeout",
+      },
+      outputDir,
+      requestTimeoutMs: 20,
+      fetchImpl: async (_input, init) => {
+        calls += 1;
+        await new Promise((_, reject) => {
+          init.signal.addEventListener("abort", () => {
+            aborted = true;
+            reject(new DOMException("aborted", "AbortError"));
+          }, { once: true });
+        });
+      },
+    }),
+    /outcome is unknown.*same Idempotency-Key/,
+  );
+
+  assert.equal(calls, 1);
+  assert.equal(aborted, true);
+  assert.match(await readFile(join(outputDir, "registration-request.json"), "utf8"), /install_test_timeout/);
+});

package/test/sdk-v1.2-contract.test.mjs

@@ -0,0 +1,57 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import test from "node:test";
+import { AgentelConnector } from "../dist/agentel-connector.js";
+
+function connectorWithCapture() {
+  const calls = [];
+  const connector = new AgentelConnector({
+    baseUrl: "https://agentel.test/api/v1",
+    agentId: "agent_founder",
+    apiKey: "agentel_test_key",
+    fetch: async (input, init) => {
+      calls.push({ url: String(input), init });
+      return new Response(JSON.stringify({ ok: true, requests: [], events: [], messages: [], cursor: 0, nextCursor: 0, hasMore: false }), { status: 200 });
+    },
+  });
+  return { connector, calls };
+}
+
+test("1.2.0 Topic creation maps typed fields and Idempotency-Key to the canonical API", async () => {
+  const { connector, calls } = connectorWithCapture();
+  await connector.createTopic({ title: "Agent evidence", prompt: "What counts as evidence?", description: "Compare reviewable evidence shapes.", primaryCategory: "ai-agents", language: "en", contributionTypes: ["take", "evidence"] }, "topic-key-1");
+  assert.equal(calls[0].url, "https://agentel.test/api/v1/community/topics");
+  assert.equal(calls[0].init.method, "POST");
+  assert.equal(new Headers(calls[0].init.headers).get("Idempotency-Key"), "topic-key-1");
+  assert.deepEqual(JSON.parse(calls[0].init.body), { title: "Agent evidence", prompt: "What counts as evidence?", description: "Compare reviewable evidence shapes.", primary_category: "ai-agents", language: "en", contribution_types: ["take", "evidence"] });
+});
+
+test("1.2.0 keeps Mission draft, approval-gated publish, workspace, and room routes distinct", async () => {
+  const { connector, calls } = connectorWithCapture();
+  await connector.createMissionDraft({ contract: { schema: "agentel.mission", schema_version: "1.1" }, creationRequestId: "request_1" }, "draft-key-1");
+  await connector.validateMissionDraft("mission_1");
+  await connector.publishMissionDraft("mission_1", "publish-key-1");
+  await connector.missionWorkspace("mission_1");
+  await connector.sendMissionRoomMessage("mission_1", { type: "QUESTION", audience: "AUTHORITY", content: "Please clarify the acceptance rule." }, "room-key-1");
+  assert.deepEqual(calls.map((call) => new URL(call.url).pathname), ["/api/v1/missions", "/api/v1/missions/mission_1/validate", "/api/v1/missions/mission_1/publish", "/api/v1/missions/mission_1/workspace", "/api/v1/missions/mission_1/room/messages"]);
+  assert.equal(new Headers(calls[2].init.headers).get("Idempotency-Key"), "publish-key-1");
+  assert.equal(JSON.parse(calls[4].init.body).audience_type, "AUTHORITY");
+});
+
+test("1.2.0 exposes request events and invitation response without collapsing Human approval", async () => {
+  const { connector, calls } = connectorWithCapture();
+  await connector.missionCreationEvents({ cursor: 2, limit: 10 });
+  await connector.acceptMissionCreationRequest("request_1", "accept-key-1");
+  await connector.respondToMissionCreationInvitation({ requestId: "request_1", participantId: "participant_1", decision: "ACCEPT", note: "Ready." }, "response-key-1");
+  assert.equal(calls[0].url, "https://agentel.test/api/v1/mission-creation-events?cursor=2&limit=10");
+  assert.equal(new Headers(calls[1].init.headers).get("Idempotency-Key"), "accept-key-1");
+  assert.deepEqual(JSON.parse(calls[2].init.body), { request_id: "request_1", participant_id: "participant_1", decision: "ACCEPT", note: "Ready." });
+});
+
+test("1.2.0 preserves official onboarding access alongside paid direct messages", async () => {
+  const declarations = await readFile(new URL("../dist/agentel-connector.d.ts", import.meta.url), "utf8");
+  assert.match(declarations, /officialWelcome\?: AgentelDirectMessage/);
+  assert.match(declarations, /type: "DIRECT" \| "OFFICIAL_WELCOME"/);
+  assert.match(declarations, /accessMode: "DIRECT_MESSAGES" \| "OFFICIAL_MESSAGES_ONLY"/);
+  assert.match(declarations, /historyDays: number \| null/);
+});