@agentikos/omega-os 0.2.0 → 0.19.5

package/omega/Agentik_Engine/tests/test_v06_features.py

@@ -0,0 +1,370 @@
+"""Tests for the v0.6.0 hardening batch — every new module gets coverage.
+
+We don't hit any real provider APIs in tests (no network). For
+validate.py and updater.py we monkeypatch urlopen; for smoke we run
+against MockProvider; for prune/backup/costs/audit_diff we exercise the
+pure-data paths.
+"""
+from __future__ import annotations
+
+import json
+import os
+import sqlite3
+import sys
+import tempfile
+import time
+import unittest
+from pathlib import Path
+from unittest import mock
+
+import yaml
+
+
+HERE = Path(__file__).resolve().parent
+sys.path.insert(0, str(HERE.parent))
+
+
+# ---------------------------------------------------------------------------
+# validate.py
+# ---------------------------------------------------------------------------
+
+
+class TestValidate(unittest.TestCase):
+    def test_validate_claude_no_key_returns_clean_fail(self):
+        from omega_engine.validate import validate_one
+        with tempfile.TemporaryDirectory() as td:
+            r = validate_one(td, "claude")
+            self.assertFalse(r.ok)
+            self.assertIn("no API key", r.detail)
+
+    def test_validate_unknown_provider(self):
+        from omega_engine.validate import validate_one
+        with tempfile.TemporaryDirectory() as td:
+            r = validate_one(td, "aliens")
+            self.assertFalse(r.ok)
+            self.assertIn("no validator", r.detail)
+
+    def test_validate_all_reads_router(self):
+        from omega_engine.validate import validate_all
+        with tempfile.TemporaryDirectory() as td:
+            home = Path(td)
+            (home / "Agentik_SSOT" / "providers").mkdir(parents=True)
+            (home / "Agentik_SSOT" / "providers" / "router.yaml").write_text(
+                yaml.safe_dump({"providers": [
+                    {"id": "claude", "enabled": True, "secret_ref": "CLAUDE_API_KEY"},
+                    {"id": "glm", "enabled": False, "secret_ref": "GLM_API_KEY"},
+                ]}))
+            results = validate_all(home)
+            # Only enabled providers are validated.
+            self.assertEqual([r.provider for r in results], ["claude"])
+
+    def test_validate_claude_with_mock_http_200(self):
+        from omega_engine.validate import _validate_claude
+        with mock.patch("urllib.request.urlopen") as fake_open:
+            fake_resp = mock.MagicMock()
+            fake_resp.__enter__ = lambda s: s
+            fake_resp.__exit__ = lambda *args: None
+            fake_resp.read = lambda: b'{"ok": true}'
+            fake_open.return_value = fake_resp
+            r = _validate_claude("sk-key")
+            self.assertTrue(r.ok)
+
+
+# ---------------------------------------------------------------------------
+# completions.py
+# ---------------------------------------------------------------------------
+
+
+class TestCompletions(unittest.TestCase):
+    def test_extract_tree_from_parser(self):
+        from omega_engine.cli import _build_parser
+        from omega_engine.completions import extract_tree
+        tree = extract_tree(_build_parser())
+        self.assertEqual(tree.name, "omega")
+        names = {n.name for n in tree.subcommands}
+        # A handful of the commands we know must be there.
+        for expected in ("doctor", "audit", "skill", "pursue", "cadence",
+                         "smoke", "backup", "validate"):
+            self.assertIn(expected, names)
+
+    def test_render_bash_contains_top_commands(self):
+        from omega_engine.cli import _build_parser
+        from omega_engine.completions import extract_tree, render_bash
+        text = render_bash(extract_tree(_build_parser()))
+        self.assertIn("complete -F _omega_complete omega", text)
+        self.assertIn("doctor", text)
+        self.assertIn("audit", text)
+
+    def test_write_all_creates_files(self):
+        from omega_engine.cli import _build_parser
+        from omega_engine.completions import extract_tree, write_all
+        with tempfile.TemporaryDirectory() as td:
+            paths = write_all(td, extract_tree(_build_parser()))
+            for shell in ("bash", "zsh", "fish"):
+                self.assertTrue(paths[shell].exists())
+
+
+# ---------------------------------------------------------------------------
+# updater.py
+# ---------------------------------------------------------------------------
+
+
+class TestUpdater(unittest.TestCase):
+    def test_parse_semver_handles_prerelease(self):
+        from omega_engine.updater import _parse_semver
+        self.assertEqual(_parse_semver("1.2.3"), (1, 2, 3))
+        self.assertEqual(_parse_semver("1.2.3-beta.1"), (1, 2, 3))
+        self.assertEqual(_parse_semver("v0.4.0"), (0, 4, 0))  # leading v → 0
+        self.assertEqual(_parse_semver("garbage"), (0, 0, 0))
+
+    def test_check_returns_outdated_when_newer(self):
+        from omega_engine.updater import check_for_updates
+        with mock.patch("urllib.request.urlopen") as fake_open:
+            fake_resp = mock.MagicMock()
+            fake_resp.__enter__ = lambda s: s
+            fake_resp.__exit__ = lambda *args: None
+            fake_resp.read = lambda: json.dumps({
+                "dist-tags": {"latest": "1.0.0"},
+            }).encode()
+            fake_open.return_value = fake_resp
+            info = check_for_updates("0.5.0")
+            self.assertTrue(info.is_outdated)
+            self.assertEqual(info.latest, "1.0.0")
+
+    def test_check_returns_uptodate(self):
+        from omega_engine.updater import check_for_updates
+        with mock.patch("urllib.request.urlopen") as fake_open:
+            fake_resp = mock.MagicMock()
+            fake_resp.__enter__ = lambda s: s
+            fake_resp.__exit__ = lambda *args: None
+            fake_resp.read = lambda: json.dumps({
+                "dist-tags": {"latest": "0.5.0"},
+            }).encode()
+            fake_open.return_value = fake_resp
+            info = check_for_updates("0.5.0")
+            self.assertFalse(info.is_outdated)
+
+
+# ---------------------------------------------------------------------------
+# smoke.py
+# ---------------------------------------------------------------------------
+
+
+class TestSmoke(unittest.TestCase):
+    def test_smoke_passes_against_mock(self):
+        from omega_engine.smoke import run_smoke
+        with tempfile.TemporaryDirectory() as td:
+            result = run_smoke(omega_home=td)
+            self.assertTrue(result.passed,
+                            msg=f"smoke failed: {result.detail}")
+            self.assertEqual(result.final_state, "completed")
+            self.assertGreater(result.events_recorded, 0)
+
+
+# ---------------------------------------------------------------------------
+# prune.py
+# ---------------------------------------------------------------------------
+
+
+class TestPrune(unittest.TestCase):
+    def _seed_telegram_history(self, home: Path, *, old_count: int, new_count: int):
+        from omega_engine.telegram_history import _connect, record_inbound
+        # Now-recent messages.
+        for i in range(new_count):
+            record_inbound(home, topic_id=1, text=f"new-{i}")
+        # Artificially old rows.
+        conn = _connect(home)
+        for i in range(old_count):
+            conn.execute(
+                "INSERT INTO messages (topic_id, role, text, message_id, timestamp) "
+                "VALUES (?, ?, ?, ?, ?)",
+                (1, "user", f"old-{i}", None, 0),
+            )
+        conn.commit()
+        conn.close()
+
+    def test_prune_telegram_dry_run_doesnt_delete(self):
+        from omega_engine.prune import prune_telegram
+        with tempfile.TemporaryDirectory() as td:
+            self._seed_telegram_history(Path(td), old_count=3, new_count=2)
+            report = prune_telegram(td, older_than_days=30, dry_run=True)
+            self.assertEqual(report.rows_deleted, 3)
+            self.assertTrue(report.dry_run)
+            # Verify nothing was actually deleted.
+            from omega_engine.telegram_history import recent_messages
+            still = recent_messages(td, topic_id=1, limit=100)
+            self.assertEqual(len(still), 5)
+
+    def test_prune_telegram_yes_actually_deletes(self):
+        from omega_engine.prune import prune_telegram
+        from omega_engine.telegram_history import recent_messages
+        with tempfile.TemporaryDirectory() as td:
+            self._seed_telegram_history(Path(td), old_count=3, new_count=2)
+            report = prune_telegram(td, older_than_days=30, dry_run=False)
+            self.assertEqual(report.rows_deleted, 3)
+            still = recent_messages(td, topic_id=1, limit=100)
+            self.assertEqual(len(still), 2)
+
+    def test_prune_all_returns_one_per_target(self):
+        from omega_engine.prune import prune_all
+        with tempfile.TemporaryDirectory() as td:
+            reports = prune_all(td, older_than_days=30, dry_run=True)
+            targets = [r.target for r in reports]
+            self.assertEqual(targets, ["events", "audits", "telegram", "sessions"])
+
+
+# ---------------------------------------------------------------------------
+# backup.py
+# ---------------------------------------------------------------------------
+
+
+class TestBackup(unittest.TestCase):
+    def _seed_tree(self, home: Path) -> None:
+        # Minimal backupable structure
+        (home / "Agentik_Runtime" / "eventlog").mkdir(parents=True)
+        (home / "Agentik_Runtime" / "eventlog" / "omega.db").write_text("fake-db")
+        (home / "Agentik_Extra" / "etc" / "secrets").mkdir(parents=True)
+        (home / "Agentik_Extra" / "etc" / "secrets" / "x.age").write_text("encrypted")
+        (home / "Agentik_SSOT").mkdir(parents=True)
+        (home / "Agentik_SSOT" / "VERSION").write_text("0.5.0")
+        (home / "Agentik_Coding").mkdir(parents=True)
+        (home / "Agentik_Coding" / "projects.json").write_text("[]")
+
+    def test_backup_creates_tarball(self):
+        from omega_engine.backup import backup
+        with tempfile.TemporaryDirectory() as td:
+            home = Path(td) / "Omega"
+            home.mkdir()
+            self._seed_tree(home)
+            result = backup(home, out_dir=Path(td))
+            self.assertTrue(result.bundle.exists())
+            self.assertGreater(result.bytes, 0)
+            self.assertFalse(result.encrypted)
+
+    def test_backup_then_restore_roundtrip(self):
+        from omega_engine.backup import backup, restore
+        with tempfile.TemporaryDirectory() as td:
+            home = Path(td) / "Omega"
+            home.mkdir()
+            self._seed_tree(home)
+            result = backup(home, out_dir=Path(td))
+
+            # Restore into a clean tree.
+            target = Path(td) / "restored"
+            target.mkdir()
+            r = restore(result.bundle, target=target)
+            self.assertGreater(r.files, 0)
+            self.assertTrue((target / "Agentik_SSOT" / "VERSION").exists())
+            self.assertEqual(
+                (target / "Agentik_SSOT" / "VERSION").read_text(), "0.5.0",
+            )
+
+    def test_verify_passes_on_clean_bundle(self):
+        from omega_engine.backup import backup, verify
+        with tempfile.TemporaryDirectory() as td:
+            home = Path(td) / "Omega"
+            home.mkdir()
+            self._seed_tree(home)
+            result = backup(home, out_dir=Path(td))
+            v = verify(result.bundle)
+            self.assertTrue(v["ok"])
+
+
+# ---------------------------------------------------------------------------
+# costs.py
+# ---------------------------------------------------------------------------
+
+
+class TestCosts(unittest.TestCase):
+    def test_estimate_cost_claude(self):
+        from omega_engine.costs import estimate_cost
+        # 1M in + 1M out on claude-sonnet → 3 + 15 = 18 USD
+        cost = estimate_cost(
+            "claude", input_tokens=1_000_000, output_tokens=1_000_000,
+            model="claude-sonnet-4-6",
+        )
+        self.assertAlmostEqual(cost, 18.0, places=2)
+
+    def test_estimate_cost_unknown_provider_zero(self):
+        from omega_engine.costs import estimate_cost
+        self.assertEqual(
+            estimate_cost("not-real", input_tokens=1000, output_tokens=1000),
+            0.0,
+        )
+
+    def test_rate_card_summary_includes_known_providers(self):
+        from omega_engine.costs import rate_card_summary
+        s = rate_card_summary()
+        for p in ("claude", "openai", "glm", "deepseek"):
+            self.assertIn(p, s["providers"])
+
+
+# ---------------------------------------------------------------------------
+# audit_diff.py
+# ---------------------------------------------------------------------------
+
+
+class TestAuditDiff(unittest.TestCase):
+    def test_diff_classifies_fixed_new_persist_regressed(self):
+        from omega_engine.audit_diff import diff_runs
+        from omega_engine.audits.history import (
+            AuditRun, make_run_id, now, record_run,
+        )
+        with tempfile.TemporaryDirectory() as td:
+            base = now()
+            f_fixed = {"phase": "p", "location": "a.py:1",
+                       "message": "bug A", "severity": "high"}
+            f_persist = {"phase": "p", "location": "b.py:1",
+                         "message": "bug B", "severity": "medium"}
+            f_regressed1 = {"phase": "p", "location": "c.py:1",
+                            "message": "bug C", "severity": "low"}
+            f_regressed2 = {"phase": "p", "location": "c.py:1",
+                            "message": "bug C", "severity": "high"}
+            f_new = {"phase": "p", "location": "d.py:1",
+                     "message": "bug D", "severity": "medium"}
+
+            record_run(td, AuditRun(
+                run_id="ar-1", audit_id="codeaudit", scope=".",
+                timestamp=base, score=70, verified=False, finding_count=3,
+                verdict={"findings": [f_fixed, f_persist, f_regressed1]},
+            ))
+            record_run(td, AuditRun(
+                run_id="ar-2", audit_id="codeaudit", scope=".",
+                timestamp=base + 1, score=80, verified=False, finding_count=3,
+                verdict={"findings": [f_persist, f_regressed2, f_new]},
+            ))
+            d = diff_runs(td, "ar-1", "ar-2")
+            self.assertEqual(d.delta, 10)
+            self.assertEqual(len(d.fixed), 1)
+            self.assertEqual(d.fixed[0]["location"], "a.py:1")
+            self.assertEqual(len(d.new), 1)
+            self.assertEqual(d.new[0]["location"], "d.py:1")
+            self.assertEqual(len(d.persist), 2)        # b.py + c.py both in both runs
+            self.assertEqual(len(d.regressed), 1)
+            self.assertEqual(d.regressed[0]["location"], "c.py:1")
+
+    def test_diff_unknown_run_raises(self):
+        from omega_engine.audit_diff import diff_runs
+        with tempfile.TemporaryDirectory() as td:
+            with self.assertRaises(KeyError):
+                diff_runs(td, "missing-1", "missing-2")
+
+
+# ---------------------------------------------------------------------------
+# ssh-key-rotate template ships
+# ---------------------------------------------------------------------------
+
+
+class TestSshRotateTemplate(unittest.TestCase):
+    def test_template_present_and_parseable(self):
+        REPO = Path(__file__).resolve().parents[3]
+        tmpl = REPO / "bootstrap" / "templates" / "autonomous" / "ssh-key-rotate.yaml"
+        self.assertTrue(tmpl.exists())
+        data = yaml.safe_load(tmpl.read_text())
+        self.assertEqual(data["id"], "ssh-key-rotate")
+        self.assertFalse(data["enabled"])  # opt-in by design
+        self.assertEqual(data["trigger"]["type"], "cron")
+
+
+if __name__ == "__main__":
+    unittest.main(verbosity=2)

package/omega/Agentik_Engine/tests/test_vault.py

@@ -0,0 +1,173 @@
+"""Tests for the encrypted secrets vault.
+
+Two backends to exercise:
+
+  * **plain** — always runs (the fallback when `age` is not installed).
+  * **age**   — runs only when `age` and `age-keygen` are both on PATH.
+                We skip the age-specific cases otherwise so CI on minimal
+                hosts doesn't go red.
+
+Also exercises the path-traversal refusal and the round-trip invariant
+(write then read returns the same value).
+"""
+from __future__ import annotations
+
+import os
+import shutil
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+
+HERE = Path(__file__).resolve().parent
+sys.path.insert(0, str(HERE.parent))
+
+from omega_engine.vault import (  # noqa: E402
+    _safe_ref,
+    vault_init,
+    vault_read,
+    vault_status,
+    vault_write,
+)
+
+
+AGE_AVAILABLE = bool(shutil.which("age")) and bool(shutil.which("age-keygen"))
+
+
+class TestSafeRef(unittest.TestCase):
+    def test_rejects_empty(self):
+        with self.assertRaises(ValueError):
+            _safe_ref("")
+
+    def test_rejects_path_traversal(self):
+        for bad in ("../escape", "a/b", "x\\y", ".hidden"):
+            with self.assertRaises(ValueError):
+                _safe_ref(bad)
+
+    def test_accepts_flat_names(self):
+        for good in ("CLAUDE_OAUTH", "max-primary_TOKEN", "abc123"):
+            self.assertEqual(_safe_ref(good), good)
+
+
+class TestPlainBackend(unittest.TestCase):
+    """The fallback backend, always available."""
+
+    def test_init_with_no_age_picks_plain(self):
+        with tempfile.TemporaryDirectory() as td:
+            with mock.patch("omega_engine.vault._age_available", return_value=False):
+                info = vault_init(td)
+            self.assertEqual(info["backend"], "plain")
+            self.assertFalse(info["age_installed"])
+            sec = Path(td) / "Agentik_Extra" / "etc" / "secrets"
+            self.assertTrue(sec.is_dir())
+            # secrets dir is mode 700
+            mode = sec.stat().st_mode & 0o777
+            self.assertEqual(mode, 0o700)
+
+    def test_round_trip_plain(self):
+        with tempfile.TemporaryDirectory() as td:
+            with mock.patch("omega_engine.vault._age_available", return_value=False):
+                path = vault_write(td, "MY_TOKEN", "s3cret-value")
+                # mode 600
+                mode = path.stat().st_mode & 0o777
+                self.assertEqual(mode, 0o600)
+                # file is named without .age suffix in plain mode
+                self.assertTrue(path.name.endswith("MY_TOKEN"))
+                self.assertFalse(path.name.endswith(".age"))
+
+                got = vault_read(td, "MY_TOKEN")
+                self.assertEqual(got, "s3cret-value")
+
+    def test_read_returns_none_when_missing(self):
+        with tempfile.TemporaryDirectory() as td:
+            with mock.patch("omega_engine.vault._age_available", return_value=False):
+                self.assertIsNone(vault_read(td, "ABSENT"))
+
+    def test_overwrite_rotates_in_place(self):
+        with tempfile.TemporaryDirectory() as td:
+            with mock.patch("omega_engine.vault._age_available", return_value=False):
+                vault_write(td, "TOK", "v1")
+                vault_write(td, "TOK", "v2")
+                self.assertEqual(vault_read(td, "TOK"), "v2")
+
+    def test_status_counts_plain(self):
+        with tempfile.TemporaryDirectory() as td:
+            with mock.patch("omega_engine.vault._age_available", return_value=False):
+                vault_write(td, "A", "1")
+                vault_write(td, "B", "2")
+                status = vault_status(td)
+            self.assertEqual(status["backend"], "plain")
+            self.assertEqual(status["plaintext_count"], 2)
+            self.assertEqual(status["encrypted_count"], 0)
+
+
+@unittest.skipUnless(AGE_AVAILABLE, "age + age-keygen not installed on this host")
+class TestAgeBackend(unittest.TestCase):
+    """Exercised only when age is installed (CI may or may not have it)."""
+
+    def test_init_generates_keypair(self):
+        with tempfile.TemporaryDirectory() as td:
+            info = vault_init(td)
+            self.assertEqual(info["backend"], "age")
+            key = Path(info["key_path"])
+            pub = Path(info["pub_path"])
+            self.assertTrue(key.exists())
+            self.assertTrue(pub.exists())
+            self.assertEqual(key.stat().st_mode & 0o777, 0o600)
+            # public key file starts with "age1"
+            self.assertTrue(pub.read_text().strip().startswith("age1"))
+
+    def test_init_is_idempotent(self):
+        with tempfile.TemporaryDirectory() as td:
+            a = vault_init(td)
+            b = vault_init(td)
+            self.assertEqual(a["key_path"], b["key_path"])
+            self.assertEqual(a["pub_path"], b["pub_path"])
+
+    def test_round_trip_age(self):
+        with tempfile.TemporaryDirectory() as td:
+            path = vault_write(td, "OAUTH_X", "abc-DEF-123")
+            self.assertTrue(path.name.endswith(".age"))
+            mode = path.stat().st_mode & 0o777
+            self.assertEqual(mode, 0o600)
+            got = vault_read(td, "OAUTH_X")
+            self.assertEqual(got, "abc-DEF-123")
+
+    def test_status_counts_encrypted(self):
+        with tempfile.TemporaryDirectory() as td:
+            vault_write(td, "A", "1")
+            vault_write(td, "B", "2")
+            status = vault_status(td)
+            self.assertEqual(status["backend"], "age")
+            self.assertEqual(status["encrypted_count"], 2)
+            self.assertEqual(status["plaintext_count"], 0)
+
+    def test_write_cleans_up_old_plaintext(self):
+        with tempfile.TemporaryDirectory() as td:
+            # Pre-seed a plaintext file as if from a legacy install.
+            with mock.patch("omega_engine.vault._age_available", return_value=False):
+                vault_write(td, "LEGACY", "old")
+            # Now write through the age backend.
+            vault_write(td, "LEGACY", "new")
+            sec = Path(td) / "Agentik_Extra" / "etc" / "secrets"
+            self.assertTrue((sec / "LEGACY.age").exists())
+            self.assertFalse((sec / "LEGACY").exists(),
+                             "old plaintext should have been cleaned up")
+            self.assertEqual(vault_read(td, "LEGACY"), "new")
+
+
+class TestAccountUsesVault(unittest.TestCase):
+    """`account.write_token` / `read_token` must round-trip through the vault."""
+
+    def test_account_token_round_trip(self):
+        from omega_engine.account import read_token, write_token
+
+        with tempfile.TemporaryDirectory() as td:
+            write_token(td, "MAX_PRIMARY", "claude-token-xyz")
+            self.assertEqual(read_token(td, "MAX_PRIMARY"), "claude-token-xyz")
+
+
+if __name__ == "__main__":
+    unittest.main(verbosity=2)