@alumbwe/anvil 1.0.20 → 1.0.21

package/vendor/@anvil/common/src/constants/__tests__/anvil-onboarding.test.ts

@@ -0,0 +1,246 @@
+import { describe, expect, it } from 'bun:test'
+
+import {
+  classifyOnboardingOtherText,
+  ANVIL_ONBOARDING_QUESTIONS,
+  isOnboardingComplete,
+  ONBOARDING_LEGACY_OPTION_IDS,
+  ONBOARDING_OTHER_TEXT_MAX,
+  OTHER_OPTION_ID,
+  validateOnboardingSubmission,
+  type OnboardingAnswer,
+} from '../anvil-onboarding'
+
+/** A complete, valid submission. */
+function fullAnswers(overrides: OnboardingAnswer[] = []): OnboardingAnswer[] {
+  const base: OnboardingAnswer[] = [
+    { questionId: 'referral_source', optionIds: ['youtube'] },
+    { questionId: 'role', optionIds: ['professional_dev'] },
+    { questionId: 'proficiency', optionIds: ['advanced'] },
+    { questionId: 'intended_use', optionIds: ['work', 'side_projects'] },
+    { questionId: 'subscriptions', optionIds: ['cursor'] },
+  ]
+  return base.map((a) => overrides.find((o) => o.questionId === a.questionId) ?? a)
+}
+
+describe('the question set itself', () => {
+  it('gives every option a unique id within its question', () => {
+    // A duplicate id would silently merge two distinct answers in the analytics.
+    for (const q of ANVIL_ONBOARDING_QUESTIONS) {
+      const ids = q.options.map((o) => o.id)
+      expect(new Set(ids).size).toBe(ids.length)
+    }
+  })
+
+  it('offers Other everywhere except the ordinal scale', () => {
+    // Free text on an ordered scale is unusable for the segmentation the
+    // question exists to support.
+    for (const q of ANVIL_ONBOARDING_QUESTIONS) {
+      const hasOther = q.options.some((o) => o.id === OTHER_OPTION_ID)
+      expect(hasOther).toBe(q.id !== 'proficiency')
+    }
+  })
+
+  it('maps every legacy option onto an option that still exists', () => {
+    // A successor that no longer exists silently drops the answers it was
+    // supposed to rescue — the exact failure the map exists to prevent.
+    for (const [questionId, map] of Object.entries(ONBOARDING_LEGACY_OPTION_IDS)) {
+      const question = ANVIL_ONBOARDING_QUESTIONS.find((q) => q.id === questionId)
+      expect(question).toBeDefined()
+      const live = new Set(question!.options.map((o) => o.id))
+      for (const [retired, successor] of Object.entries(map ?? {})) {
+        expect(live.has(retired)).toBe(false)
+        expect(live.has(successor)).toBe(true)
+      }
+    }
+  })
+
+  it('only marks options exclusive on multi-select questions', () => {
+    // On a single-choice question "exclusive" is meaningless, and reading as
+    // though it does something is worse than not having it.
+    for (const q of ANVIL_ONBOARDING_QUESTIONS) {
+      if (q.multi) continue
+      expect(q.options.some((o) => o.exclusive)).toBe(false)
+    }
+  })
+})
+
+describe('classifyOnboardingOtherText — write-ins folded into real options', () => {
+  it('counts every Instagram spelling as the Instagram / TikTok option', () => {
+    for (const text of ['insta', 'Instagram', 'instagram ads', 'IG', 'tik tok']) {
+      expect(classifyOnboardingOtherText('referral_source', text)).toBe('tiktok')
+    }
+  })
+
+  it('counts AI assistants as the Google / AI search option', () => {
+    for (const text of ['ChatGPT', 'chat gpt', 'AI', 'gemini', 'perplexity']) {
+      expect(classifyOnboardingOtherText('referral_source', text)).toBe('search')
+    }
+  })
+
+  it('prefers the more specific rule when a write-in matches both', () => {
+    expect(classifyOnboardingOtherText('referral_source', 'instagram AI page')).toBe(
+      'tiktok',
+    )
+  })
+
+  it('leaves genuinely other answers alone', () => {
+    // The AI rule is the dangerous one: a substring match would swallow
+    // "email", "said", "chair" and quietly inflate a channel that never
+    // referred anyone.
+    for (const text of ['forums', 'my brother', 'email newsletter', 'a fair']) {
+      expect(classifyOnboardingOtherText('referral_source', text)).toBeNull()
+    }
+  })
+
+  it('does nothing on questions with no rules', () => {
+    expect(classifyOnboardingOtherText('role', 'instagram')).toBeNull()
+  })
+})
+
+describe('validateOnboardingSubmission', () => {
+  it('accepts a complete submission', () => {
+    const result = validateOnboardingSubmission({ answers: fullAnswers() })
+    expect(result.ok).toBe(true)
+  })
+
+  it('requires every question', () => {
+    // The form has no skip, so a partial submission is a stale or hand-rolled
+    // client rather than a user choice — and half a response would sit in the
+    // analytics looking like a real one.
+    const result = validateOnboardingSubmission({
+      answers: fullAnswers().slice(0, 2),
+    })
+    expect(result.ok).toBe(false)
+    if (result.ok) throw new Error('unreachable')
+    expect(result.errors.length).toBeGreaterThan(0)
+    expect(result.errors.every((e) => e.questionId !== null)).toBe(true)
+  })
+
+  it('rejects an unknown option id', () => {
+    // Out-of-date client or a forged post. Accepting it would put a value in
+    // the analytics that no question can explain.
+    const result = validateOnboardingSubmission({
+      answers: fullAnswers([{ questionId: 'role', optionIds: ['ceo_of_mars'] }]),
+    })
+    expect(result.ok).toBe(false)
+  })
+
+  it('rejects multiple answers to a single-choice question', () => {
+    const result = validateOnboardingSubmission({
+      answers: fullAnswers([
+        { questionId: 'role', optionIds: ['student', 'founder'] },
+      ]),
+    })
+    expect(result.ok).toBe(false)
+  })
+
+  it('rejects an exclusive option combined with others', () => {
+    // "No subscriptions" and "Cursor" cannot both be true; a stored
+    // contradiction has no honest reading in the tally.
+    const result = validateOnboardingSubmission({
+      answers: fullAnswers([
+        { questionId: 'subscriptions', optionIds: ['none', 'cursor'] },
+      ]),
+    })
+    expect(result.ok).toBe(false)
+  })
+
+  it('accepts the exclusive option on its own', () => {
+    const result = validateOnboardingSubmission({
+      answers: fullAnswers([
+        { questionId: 'subscriptions', optionIds: ['none'] },
+      ]),
+    })
+    expect(result.ok).toBe(true)
+  })
+
+  it('accepts multiple answers where the question allows it', () => {
+    const result = validateOnboardingSubmission({
+      answers: fullAnswers([
+        {
+          questionId: 'intended_use',
+          optionIds: ['work', 'learning', 'automation'],
+        },
+      ]),
+    })
+    expect(result.ok).toBe(true)
+  })
+})
+
+describe('the Other option', () => {
+  it('requires accompanying text', () => {
+    const result = validateOnboardingSubmission({
+      answers: fullAnswers([
+        { questionId: 'role', optionIds: [OTHER_OPTION_ID] },
+      ]),
+    })
+    expect(result.ok).toBe(false)
+  })
+
+  it('keeps the text when Other is chosen', () => {
+    const result = validateOnboardingSubmission({
+      answers: fullAnswers([
+        {
+          questionId: 'role',
+          optionIds: [OTHER_OPTION_ID],
+          otherText: '  technical writer  ',
+        },
+      ]),
+    })
+    expect(result.ok).toBe(true)
+    if (!result.ok) throw new Error('unreachable')
+    const role = result.answers.find((a) => a.questionId === 'role')
+    expect(role?.otherText).toBe('technical writer')
+  })
+
+  it('drops stray text when Other was NOT chosen', () => {
+    // Otherwise text rides along on an answer that has nowhere to display it,
+    // and the admin view shows a note against the wrong option.
+    const result = validateOnboardingSubmission({
+      answers: fullAnswers([
+        { questionId: 'role', optionIds: ['student'], otherText: 'ignore me' },
+      ]),
+    })
+    expect(result.ok).toBe(true)
+    if (!result.ok) throw new Error('unreachable')
+    expect(result.answers.find((a) => a.questionId === 'role')?.otherText).toBeUndefined()
+  })
+
+  it('truncates rather than rejecting a long note', () => {
+    const result = validateOnboardingSubmission({
+      answers: fullAnswers([
+        {
+          questionId: 'role',
+          optionIds: [OTHER_OPTION_ID],
+          otherText: 'x'.repeat(ONBOARDING_OTHER_TEXT_MAX + 500),
+        },
+      ]),
+    })
+    expect(result.ok).toBe(true)
+    if (!result.ok) throw new Error('unreachable')
+    expect(result.answers.find((a) => a.questionId === 'role')?.otherText).toHaveLength(
+      ONBOARDING_OTHER_TEXT_MAX,
+    )
+  })
+})
+
+describe('isOnboardingComplete — the blocking gate reads this', () => {
+  it('is true only when every question has an answer', () => {
+    expect(isOnboardingComplete(fullAnswers())).toBe(true)
+    expect(isOnboardingComplete(fullAnswers().slice(0, 3))).toBe(false)
+  })
+
+  it('treats null, undefined and empty as incomplete', () => {
+    // A user with no record must be gated, not waved through — this is the
+    // difference between the gate working and being decorative.
+    expect(isOnboardingComplete(null)).toBe(false)
+    expect(isOnboardingComplete(undefined)).toBe(false)
+    expect(isOnboardingComplete([])).toBe(false)
+  })
+
+  it('does not count an answer with no options chosen', () => {
+    const hollow = fullAnswers([{ questionId: 'role', optionIds: [] }])
+    expect(isOnboardingComplete(hollow)).toBe(false)
+  })
+})

package/vendor/@anvil/common/src/constants/__tests__/cf-worker-signals.test.ts

@@ -0,0 +1,106 @@
+import { describe, expect, it } from 'bun:test'
+
+import {
+  detectCfWorker,
+  looksLikeProxyClientId,
+  parseAllowedWorkerZones,
+} from '../cf-worker-signals'
+
+const NO_ZONES = new Set<string>()
+
+describe('detectCfWorker', () => {
+  it('detects a Worker subrequest that came through our edge', () => {
+    expect(
+      detectCfWorker({
+        cfWorkerHeader: 'anvil2api.workers.dev',
+        cfRayHeader: 'abc123-SJC',
+        allowedZones: NO_ZONES,
+      }),
+    ).toEqual({ detected: true, zone: 'anvil2api.workers.dev' })
+  })
+
+  it('ignores ordinary traffic', () => {
+    expect(
+      detectCfWorker({
+        cfWorkerHeader: null,
+        cfRayHeader: 'abc123-SJC',
+        allowedZones: NO_ZONES,
+      }),
+    ).toEqual({ detected: false, reason: 'no_header' })
+  })
+
+  it('refuses to act on cf-worker without edge corroboration', () => {
+    // This is the whole difference between this detector and the ones that were
+    // defeated: without `cf-ray` the header is caller-authored text on a request
+    // that never touched Cloudflare, which is exactly as forgeable as a
+    // self-reported fingerprint.
+    expect(
+      detectCfWorker({
+        cfWorkerHeader: 'anything.workers.dev',
+        cfRayHeader: null,
+        allowedZones: NO_ZONES,
+      }),
+    ).toEqual({ detected: false, reason: 'not_edge_verified' })
+  })
+
+  it('never flags our own Workers', () => {
+    // app-preview-proxy is a Cloudflare Worker that talks to our API. Banning
+    // our own infrastructure is the most obvious way this could go wrong.
+    const allowed = parseAllowedWorkerZones('app-preview-proxy, vly-sh-router')
+    expect(
+      detectCfWorker({
+        cfWorkerHeader: 'app-preview-proxy',
+        cfRayHeader: 'abc-SJC',
+        allowedZones: allowed,
+      }),
+    ).toEqual({ detected: false, reason: 'allowlisted' })
+  })
+
+  it('matches the allowlist case-insensitively and ignores padding', () => {
+    const allowed = parseAllowedWorkerZones('  App-Preview-Proxy  ,,  ')
+    expect(
+      detectCfWorker({
+        cfWorkerHeader: '  APP-PREVIEW-PROXY ',
+        cfRayHeader: 'abc-SJC',
+        allowedZones: allowed,
+      }).detected,
+    ).toBe(false)
+  })
+
+  it('treats a whitespace-only header as absent', () => {
+    expect(
+      detectCfWorker({
+        cfWorkerHeader: '   ',
+        cfRayHeader: 'abc-SJC',
+        allowedZones: NO_ZONES,
+      }),
+    ).toEqual({ detected: false, reason: 'no_header' })
+  })
+})
+
+describe('parseAllowedWorkerZones', () => {
+  it('is empty for unset config rather than throwing', () => {
+    expect(parseAllowedWorkerZones(undefined).size).toBe(0)
+    expect(parseAllowedWorkerZones('').size).toBe(0)
+  })
+})
+
+describe('looksLikeProxyClientId', () => {
+  it('matches the published proxy generator', () => {
+    expect(looksLikeProxyClientId('wf-a1b2c3d4')).toBe(true)
+  })
+
+  it('does not match our own clients or near-misses', () => {
+    for (const id of [
+      'enhanced-abc',
+      'wf-TOOLONGVALUE',
+      'wf-a1b2c3',
+      'wf-A1B2C3D4',
+      null,
+      undefined,
+      '',
+    ]) {
+      expect(looksLikeProxyClientId(id as string)).toBe(false)
+    }
+  })
+})

package/vendor/@anvil/common/src/constants/agents.ts

@@ -0,0 +1,99 @@
+import type { AgentTemplateTypes } from '../types/session-state'
+
+// Define agent personas with their shared characteristics
+export const AGENT_PERSONAS = {
+  // Base agents - all use Buffy persona
+  base: {
+    displayName: 'Buffy the Base Agent',
+    purpose: 'Base agent that orchestrates the full response.',
+  } as const,
+
+  // Ask mode
+  ask: {
+    displayName: 'Ask Mode Agent',
+    purpose: 'Base ask-mode agent that orchestrates the full response.',
+  } as const,
+
+  // Specialized agents
+  thinker: {
+    displayName: 'Theo the Theorizer',
+    purpose:
+      'Does deep thinking given the current messages and a specific prompt to focus on. Use this to help you solve a specific problem.',
+  } as const,
+  'file-explorer': {
+    displayName: 'Dora The File Explorer',
+    purpose: 'Expert at exploring a codebase and finding relevant files.',
+  } as const,
+  'file-picker': {
+    displayName: 'Fletcher the File Fetcher',
+    purpose: 'Expert at finding relevant files in a codebase.',
+  } as const,
+  researcher: {
+    displayName: 'Reid Searcher the Researcher',
+    purpose: 'Expert at researching topics using web search and documentation.',
+  } as const,
+  planner: {
+    displayName: 'Peter Plan',
+    purpose: 'Agent that formulates a comprehensive plan to a prompt.',
+    hidden: true,
+  } as const,
+  reviewer: {
+    displayName: 'Nit Pick Nick the Reviewer',
+    purpose:
+      'Reviews file changes and responds with critical feedback. Use this after making any significant change to the codebase; otherwise, no need to use this agent for minor changes since it takes a second.',
+  } as const,
+  'agent-builder': {
+    displayName: 'Bob the Agent Builder',
+    purpose: 'Creates new agent templates for the anvil multi-agent system',
+    hidden: false,
+  } as const,
+} as const satisfies Partial<
+  Record<
+    (typeof AgentTemplateTypes)[keyof typeof AgentTemplateTypes],
+    { displayName: string; purpose: string; hidden?: boolean }
+  >
+>
+
+// Agent IDs list from AGENT_PERSONAS keys
+export const AGENT_IDS = Object.keys(
+  AGENT_PERSONAS,
+) as (keyof typeof AGENT_PERSONAS)[]
+
+// Agent ID prefix constant
+export const AGENT_ID_PREFIX = 'AnvilAI/'
+
+// Agent names for client-side reference
+export const AGENT_NAMES = Object.fromEntries(
+  Object.entries(AGENT_PERSONAS).map(([agentType, persona]) => [
+    agentType,
+    persona.displayName,
+  ]),
+) as Record<keyof typeof AGENT_PERSONAS, string>
+
+export type AgentName =
+  (typeof AGENT_PERSONAS)[keyof typeof AGENT_PERSONAS]['displayName']
+
+// Get unique agent names for UI display
+export const UNIQUE_AGENT_NAMES = Array.from(
+  new Set(
+    Object.values(AGENT_PERSONAS)
+      .filter((persona) => !('hidden' in persona) || !persona.hidden)
+      .map((persona) => persona.displayName),
+  ),
+)
+
+// Map from display name back to agent types (for parsing user input)
+export const AGENT_NAME_TO_TYPES = Object.entries(AGENT_NAMES).reduce(
+  (acc, [type, name]) => {
+    if (!acc[name]) acc[name] = []
+    acc[name].push(type)
+    return acc
+  },
+  {} as Record<string, string[]>,
+)
+
+export const MAX_AGENT_STEPS_DEFAULT = 200
+
+// Programmatic tool calls can persist additional rows without consuming the
+// LLM-call budget, so keep the transport limit separate and safely bounded.
+export const MAX_AGENT_STEP_ROWS = 1_000