@boyingliu01/xp-gate 0.31.3 → 0.32.0

package/plugins/dsh/src/compat.test.ts

@@ -0,0 +1,200 @@
+import { describe, it, expect } from "vitest"
+import { readFileSync } from "node:fs"
+import { createRequire } from "node:module"
+import { join, resolve } from "node:path"
+import { fileURLToPath } from "node:url"
+
+const PKG_ROOT = resolve(fileURLToPath(new URL("..", import.meta.url)))
+
+const DSH_PEERS = ["@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-shell", "@deepseek-ai/dsh-tools"] as const
+
+interface PkgShape {
+  peerDependencies?: Record<string, string>
+}
+
+function readPkg(): PkgShape {
+  const path = join(PKG_ROOT, "package.json")
+  try {
+    return JSON.parse(readFileSync(path, "utf8")) as PkgShape
+  } catch (error) {
+    throw new Error(`cannot read ${path}: ${error instanceof Error ? error.message : String(error)}`)
+  }
+}
+
+/**
+ * Minimal semver comparison for MAJOR.MINOR.PATCH[-PRERELEASE].
+ *
+ * Deliberately hand-rolled: the plugin ships zero runtime dependencies, and the
+ * only thing this test needs is ordinal comparison of a handful of versions.
+ * Adding `semver` as a devDependency would let the test pass while telling us
+ * nothing about whether DSH's own resolver agrees — the assertion below pins
+ * the *contract* (which versions we claim), and the scratch-install check in
+ * AC-2 pins the *behaviour* (whether DSH accepts it).
+ */
+interface Parsed {
+  major: number
+  minor: number
+  patch: number
+  pre: string[]
+}
+
+function parse(v: string): Parsed {
+  const [core, pre = ""] = v.split("-", 2)
+  const [major, minor, patch] = core.split(".").map(Number)
+  return { major, minor, patch, pre: pre === "" ? [] : pre.split(".") }
+}
+
+function cmpPre(a: string[], b: string[]): number {
+  // An empty prerelease sorts AFTER any prerelease (1.0.0 > 1.0.0-rc.1).
+  if (a.length === 0 && b.length === 0) return 0
+  if (a.length === 0) return 1
+  if (b.length === 0) return -1
+  for (let i = 0; i < Math.max(a.length, b.length); i += 1) {
+    const x = a[i]
+    const y = b[i]
+    if (x === undefined) return -1
+    if (y === undefined) return 1
+    const nx = Number(x)
+    const ny = Number(y)
+    // Number.isNaN on a non-numeric string means "this identifier is alphanumeric".
+    const xIsAlpha = Number.isNaN(nx)
+    const yIsAlpha = Number.isNaN(ny)
+    if (!xIsAlpha && !yIsAlpha) {
+      if (nx !== ny) return nx < ny ? -1 : 1
+      continue
+    }
+    // semver: numeric identifiers always sort BELOW alphanumeric ones.
+    if (xIsAlpha !== yIsAlpha) return xIsAlpha ? 1 : -1
+    if (x !== y) return x < y ? -1 : 1
+  }
+  return 0
+}
+
+function compare(a: string, b: string): number {
+  const x = parse(a)
+  const y = parse(b)
+  if (x.major !== y.major) return x.major < y.major ? -1 : 1
+  if (x.minor !== y.minor) return x.minor < y.minor ? -1 : 1
+  if (x.patch !== y.patch) return x.patch < y.patch ? -1 : 1
+  return cmpPre(x.pre, y.pre)
+}
+
+/**
+ * Evaluate the range shapes this package may declare.
+ *
+ * `^` matters specifically because it was the original (broken) declaration:
+ * under 0.x, `^0.1.1-rc.2` allows patch bumps only, so it silently excludes
+ * every 0.2.x runtime. Modelling it here keeps that failure expressible as a
+ * red assertion instead of a crash.
+ */
+function satisfiesRange(version: string, range: string): boolean {
+  const trimmed = range.trim()
+
+  const bounded = /^>=(\S+)\s+<(\S+)$/.exec(trimmed)
+  if (bounded !== null) {
+    return compare(version, bounded[1]) >= 0 && compare(version, bounded[2]) < 0
+  }
+
+  const caret = /^\^(\S+)$/.exec(trimmed)
+  if (caret !== null) {
+    const lower = caret[1]
+    const { major, minor } = parse(lower)
+    if (compare(version, lower) < 0) return false
+    // npm caret semantics for 0.x pins the MINOR. Crucially, npm expands
+    //   ^0.1.1-rc.2  =>  >=0.1.1-rc.2 <0.2.0-0
+    // i.e. caret ALREADY carries the `-0` sentinel, so it excludes every 0.2.x
+    // prerelease as well as 0.2.0 itself. That is precisely why the old
+    // declaration broke on a 0.2.0-rc.2 runtime, and why the fix must spell out
+    // `<0.3.0-0` rather than `<0.3.0` — the same sentinel idiom npm uses itself.
+    // (Both facts are pinned against the real `semver` package by the oracle test.)
+    const upper = `${major}.${minor + 1}.0-0`
+    return compare(version, upper) < 0
+  }
+
+  throw new Error(`unsupported range shape: ${range}`)
+}
+
+describe("DSH peer compatibility (install gate)", () => {
+  /**
+   * @test REQ-DSH-017
+   * @intent 用真实 semver 校准本文件手写的比较器，避免"测试自己的实现"式假绿。
+   *         semver 是仓库根的开发依赖，仅在测试期作为 oracle 使用，
+   *         不进入插件运行时依赖（插件 ships zero runtime deps）。
+   * @covers AC-DSH-017-04
+   */
+  it("手写比较器与真实 semver 的判定一致（oracle 校准）", async () => {
+    // Resolved through createRequire rather than a static import: `semver` is a
+    // devDependency of the repo root, not of this plugin package, and this
+    // package ships zero runtime deps. Keeping it dynamic means a missing
+    // semver breaks only this oracle test, never the plugin's typecheck.
+    const require_ = createRequire(import.meta.url)
+    const semver = require_("semver") as {
+      satisfies: (v: string, r: string, o?: { includePrerelease?: boolean }) => boolean
+    }
+    const opts = { includePrerelease: true }
+    const versions = ["0.1.0", "0.1.1-rc.2", "0.1.2", "0.2.0-rc.1", "0.2.0-rc.2", "0.2.1", "0.2.9", "0.3.0-rc.1", "0.3.0"]
+    const ranges = ["^0.1.1-rc.2", ">=0.2.0-rc.2 <0.3.0-0", ">=0.2.0-rc.2 <0.3.0"]
+    for (const range of ranges) {
+      for (const version of versions) {
+        expect(
+          satisfiesRange(version, range),
+          `oracle mismatch: ${version} vs ${range} (real semver says ${semver.satisfies(version, range, opts) ? "IN" : "out"})`,
+        ).toBe(semver.satisfies(version, range, opts))
+      }
+    }
+  })
+
+  /**
+   * @test REQ-DSH-017
+   * @intent 验证 peerDependencies 覆盖 DSH 实际运行时版本 0.2.0-rc.2：
+   *         旧的 ^0.1.1-rc.2 在 0.x 语义下只放行 patch，导致 dsh plugin add
+   *         被 evaluatePluginCompatibility 判定不兼容并回滚安装。
+   * @covers AC-DSH-017-01
+   */
+  it("declares peer ranges that admit the DSH 0.2.x runtime", () => {
+    const pkg = readPkg()
+    const peers = pkg.peerDependencies ?? {}
+    for (const name of DSH_PEERS) {
+      const range = peers[name]
+      expect(range, `${name} must declare a peer range`).toBeTypeOf("string")
+      expect(
+        satisfiesRange("0.2.0-rc.2", range as string),
+        `${name} range ${range} must admit the running DSH 0.2.0-rc.2`,
+      ).toBe(true)
+    }
+  })
+
+  /**
+   * @test REQ-DSH-017
+   * @intent 验证上界真正封死 0.3.0 线。DSH 以 includePrerelease 语义比较，
+   *         裸 `<0.3.0` 会把 0.3.0-rc.1 放行（预发布排在正式版之前），
+   *         因此必须使用 `<0.3.0-0` 哨兵。这是边界值回归，不是风格偏好。
+   * @covers AC-DSH-017-02
+   */
+  it("excludes the whole 0.3.0 line, prereleases included", () => {
+    const pkg = readPkg()
+    const peers = pkg.peerDependencies ?? {}
+    for (const name of DSH_PEERS) {
+      const range = peers[name] as string
+      expect(satisfiesRange("0.3.0-rc.1", range), `${name}: 0.3.0-rc.1 must be rejected by ${range}`).toBe(false)
+      expect(satisfiesRange("0.3.0", range), `${name}: 0.3.0 must be rejected by ${range}`).toBe(false)
+    }
+  })
+
+  /**
+   * @test REQ-DSH-017
+   * @intent 验证下界保持为 DSH 0.2.x——0.2.1/0.2.9 这类后续 patch 仍可用，
+   *         而 0.1.x 被排除（下界必须如实反映实测过的运行时）。
+   * @covers AC-DSH-017-03
+   */
+  it("admits later 0.2.x patches and rejects 0.1.x", () => {
+    const pkg = readPkg()
+    const peers = pkg.peerDependencies ?? {}
+    for (const name of DSH_PEERS) {
+      const range = peers[name] as string
+      expect(satisfiesRange("0.2.1", range), `${name}: 0.2.1 must be admitted`).toBe(true)
+      expect(satisfiesRange("0.2.9", range), `${name}: 0.2.9 must be admitted`).toBe(true)
+      expect(satisfiesRange("0.1.1-rc.2", range), `${name}: 0.1.x must be rejected`).toBe(false)
+    }
+  })
+})

package/plugins/dsh/src/contract.test.ts

@@ -14,7 +14,12 @@ interface PkgShape {
 }
 
 function readPkg(): PkgShape {
-  return JSON.parse(readFileSync(join(PKG_ROOT, "package.json"), "utf8")) as PkgShape
+  const path = join(PKG_ROOT, "package.json")
+  try {
+    return JSON.parse(readFileSync(path, "utf8")) as PkgShape
+  } catch (error) {
+    throw new Error(`cannot read ${path}: ${error instanceof Error ? error.message : String(error)}`)
+  }
 }
 
 describe("packaging contract", () => {
@@ -60,6 +65,7 @@ describe("packaging contract", () => {
       "delphi.test.ts",
       "delphi-config.test.ts",
       "delphi-run.test.ts",
+      "compat.test.ts",
     ]
     for (const f of files) {
       const content = readFileSync(join(PKG_ROOT, "src", f), "utf8")

package/plugins/dsh/src/credentials.test.ts

@@ -0,0 +1,93 @@
+/**
+ * @test REQ-DSH-014 Delphi credential seam
+ * @intent Verify the plugin can obtain the Delphi API key from DSH's credential store
+ *         when the process environment does not carry it, and that resolution is
+ *         single-layer — a store miss must not silently fall back to process.env.
+ * @covers AC-DSH-014-01 AC-DSH-014-02 AC-DSH-014-03
+ *
+ * Why this exists: the machine that motivated this release has WHALECLOUD_API_KEY in
+ * a user-level environment variable and in ~/.dsh/.credentials.yaml, but NOT in the
+ * environment DSH's own process inherits. Every gate tool worked; delphi-review alone
+ * failed with "missing WHALECLOUD_API_KEY". A plugin that installs, lists its skills,
+ * and then cannot run its headline feature is the definition of incomplete.
+ */
+
+import { describe, it, expect } from "vitest"
+import { credentialRef, isCredentialRefName } from "@deepseek-ai/dsh-credentials"
+import { createCredentialResolver } from "./credentials.js"
+
+describe("createCredentialResolver", () => {
+  it("resolves through the real CredentialRef the DSH service expects", async () => {
+    // Guards against hand-built reference shapes: the service takes a branded ref,
+    // so passing a plain object would type-check nowhere and fail at runtime.
+    const seen: unknown[] = []
+    const credentials = {
+      async resolve(ref: unknown) {
+        seen.push(ref)
+        return { value: "key-from-store" }
+      },
+    }
+    const resolve = createCredentialResolver(credentials, {}, (name) => credentialRef(name))
+    await expect(resolve("WHALECLOUD_API_KEY")).resolves.toBe("key-from-store")
+    expect(seen).toHaveLength(1)
+    expect(isCredentialRefName(seen[0] as string)).toBe(true)
+    expect(seen[0]).toBe(credentialRef("WHALECLOUD_API_KEY"))
+  })
+  it("returns the value stored in the DSH credential store", async () => {
+    const calls: unknown[] = []
+    const credentials = {
+      async resolve(ref: unknown) {
+        calls.push(ref)
+        return { value: "key-from-store" }
+      },
+    }
+    // Default brand is the identity, which is all a plain string-keyed fake needs.
+    const resolve = createCredentialResolver(credentials, {})
+    await expect(resolve("WHALECLOUD_API_KEY")).resolves.toBe("key-from-store")
+    expect(calls).toEqual(["WHALECLOUD_API_KEY"])
+  })
+
+  it("does not fall back to process.env when the store answers undefined", async () => {
+    // The store already layers env -> provider store -> .env. Re-reading env here
+    // would resurrect a key the store deliberately reported as absent, and would
+    // make a GUI session resolve differently from a terminal session.
+    const credentials = { resolve: async () => undefined }
+    const env = { WHALECLOUD_API_KEY: "key-from-env" }
+    const resolve = createCredentialResolver(credentials, env)
+    await expect(resolve("WHALECLOUD_API_KEY")).resolves.toBeUndefined()
+  })
+
+  it("uses process env only when no credential service is available", async () => {
+    const resolve = createCredentialResolver(undefined, { WHALECLOUD_API_KEY: "key-from-env" })
+    await expect(resolve("WHALECLOUD_API_KEY")).resolves.toBe("key-from-env")
+  })
+
+  it("returns undefined when neither source has the value", async () => {
+    const resolve = createCredentialResolver(undefined, {})
+    await expect(resolve("WHALECLOUD_API_KEY")).resolves.toBeUndefined()
+  })
+
+  it("ignores names that are not valid environment-variable identifiers", async () => {
+    const credentials = {
+      resolve: async () => {
+        throw new Error("must not be called for an invalid ref")
+      },
+    }
+    const resolve = createCredentialResolver(credentials, {})
+    await expect(resolve("../etc/passwd")).resolves.toBeUndefined()
+    await expect(resolve("")).resolves.toBeUndefined()
+    await expect(resolve("has-dash")).resolves.toBeUndefined()
+  })
+
+  it("degrades to undefined when the credential store throws", async () => {
+    // A broken store must not take the whole tool down; the caller reports a
+    // named setup error instead.
+    const credentials = {
+      resolve: async () => {
+        throw new Error("store unavailable")
+      },
+    }
+    const resolve = createCredentialResolver(credentials, {})
+    await expect(resolve("WHALECLOUD_API_KEY")).resolves.toBeUndefined()
+  })
+})

package/plugins/dsh/src/credentials.ts

@@ -0,0 +1,71 @@
+/**
+ * Resolve the API key that a Delphi provider config points at, without assuming the
+ * value is in this process's environment.
+ *
+ * The credential service shipped with DSH layers environment, a provider-managed
+ * store, and `.env` files behind one `CredentialRef`. That is exactly the order the
+ * plugin needs: on the machine that prompted this work the key lived in a user-level
+ * environment variable and in `~/.dsh/.credentials.yaml`, while DSH's own process
+ * inherited neither — so `delphi-review` failed with a missing-variable error while
+ * every other gate worked.
+ *
+ * Resolution is deliberately single-layer. When `ctx.credentials` is present and
+ * reports `undefined`, this module does NOT fall back to `process.env`: the service
+ * has already consulted the environment, so a second look would resurrect a value it
+ * deliberately reported as absent and would make a DSH session resolve differently
+ * from a terminal session.
+ */
+
+/** A credential service, narrowed to the one method this module needs. */
+export interface CredentialService {
+  resolve(ref: unknown): Promise<{ value: string } | undefined>
+}
+
+/** Resolve one environment-variable-style reference to its current value. */
+export type ApiKeyResolver = (ref: string) => Promise<string | undefined>
+
+/**
+ * Environment-variable names: a POSIX shell identifier. Anything else cannot name a
+ * credential, so it reads as "not set" rather than reaching the store.
+ */
+const REFERENCE_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/
+
+function isReferenceName(value: string): boolean {
+  return REFERENCE_NAME.test(value)
+}
+
+/**
+ * Build an `ApiKeyResolver` over the available credential service.
+ *
+ * @param credentials - `ctx.credentials`, or undefined when the host does not offer
+ *   one. Absence degrades to reading the process environment directly, which keeps
+ *   the plugin working outside DSH (CLI use, tests).
+ * @param env - environment to read in that fallback. Injected rather than read from
+ *   the global so the module stays testable offline.
+ * @param brand - converts a raw name into the service's nominal `CredentialRef`.
+ *   Injected so this module needs no import of the peer package and tests can pass
+ *   an identity function.
+ */
+export function createCredentialResolver(
+  credentials: CredentialService | undefined,
+  env: NodeJS.ProcessEnv,
+  brand: (value: string) => unknown = (value) => value,
+): ApiKeyResolver {
+  return async (ref: string): Promise<string | undefined> => {
+    if (!isReferenceName(ref)) return undefined
+
+    if (credentials !== undefined) {
+      try {
+        const resolved = await credentials.resolve(brand(ref))
+        return resolved?.value
+      } catch {
+        // A broken provider must not take the tool down; the caller turns the
+        // missing value into a DelphiSetupError that names the variable.
+        return undefined
+      }
+    }
+
+    const value = env[ref]
+    return typeof value === "string" && value.length > 0 ? value : undefined
+  }
+}

package/plugins/dsh/src/delphi-cancellation.test.ts

@@ -0,0 +1,71 @@
+/**
+ * @test REQ-DSH-007 cooperative cancellation reaches Delphi
+ * @intent Verify an externally aborted signal stops a Delphi review and surfaces as
+ *         TOOL_ABORTED, the same code the three gate tools already raise on cancel.
+ * @covers AC-DSH-007-02
+ *
+ * Why this matters for cost as much as for correctness: a review is up to 5 rounds
+ * across 3 seats under a 900s ceiling. Without signal plumbing, pressing Stop in the
+ * GUI left every one of those requests running to completion — the user paid for a
+ * review they had already abandoned.
+ */
+
+import { describe, it, expect } from "vitest"
+import { TOOL_ABORTED } from "@deepseek-ai/dsh-tools"
+import { runReview } from "./delphi-run.js"
+import type { DelphiOptions } from "./delphi.js"
+
+/** A fetch that never settles until the supplied signal aborts. */
+function hangingFetch(signal: AbortSignal | null | undefined): typeof fetch {
+  return ((_url: string, init?: RequestInit) =>
+    new Promise((_resolve, reject) => {
+      const abort = () => reject(Object.assign(new Error("aborted"), { name: "AbortError" }))
+      const signalToWatch = init?.signal ?? signal
+      if (signalToWatch?.aborted) return abort()
+      signalToWatch?.addEventListener("abort", abort, { once: true })
+      return undefined
+    })) as unknown as typeof fetch
+}
+
+const options: DelphiOptions = {
+  baseUrl: "https://gw.example/v1",
+  apiKey: "test-key",
+  seats: [
+    { role: "architecture", model: "model-a" },
+    { role: "technical", model: "model-b" },
+    { role: "feasibility", model: "model-c" },
+  ] as unknown as DelphiOptions["seats"],
+  thresholdPercent: Number("90"),
+  maxRounds: Number("5"),
+}
+
+describe("runReview cancellation", () => {
+  it("raises TOOL_ABORTED when the caller's signal is already aborted", async () => {
+    const controller = new AbortController()
+    controller.abort()
+    const error = await runReview(
+      { ...options, fetchImpl: hangingFetch(undefined) },
+      "a diff",
+      "",
+      controller.signal,
+    ).catch((e: unknown) => e)
+
+    expect(error).toBeInstanceOf(Error)
+    // The harness maps cancellation to this code; anything else reads as a failure.
+    expect((error as { code?: string }).code).toBe(TOOL_ABORTED)
+  })
+
+  it("stops an in-flight review when the signal aborts mid-round", async () => {
+    const controller = new AbortController()
+    const pending = runReview(
+      { ...options, fetchImpl: hangingFetch(undefined) },
+      "a diff",
+      "",
+      controller.signal,
+    ).catch((e: unknown) => e)
+    // Abort after the request is in flight, not before.
+    controller.abort()
+    const error = await pending
+    expect((error as { code?: string }).code).toBe(TOOL_ABORTED)
+  })
+})

package/plugins/dsh/src/delphi-config-apikey-override.test.ts

@@ -0,0 +1,94 @@
+/**
+ * @test REQ-DSH-014 apiKey override on the Delphi config loader
+ * @intent Verify loadDelphiConfig accepts a pre-resolved apiKey and uses it in place of
+ *         resolving ${VAR} from the environment, so the plugin can feed it a value from
+ *         DSH's credential store, and verify the override is scoped to the one name it
+ *         was resolved for.
+ * @covers AC-DSH-014-04 AC-DSH-014-05
+ *
+ * Why: the loader is synchronous and the credential service is asynchronous, so the
+ * value has to be resolved by the caller and handed in. Without this seam the only way
+ * to supply a key is an environment variable — precisely what the DSH process lacks.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from "vitest"
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
+import { loadDelphiConfig, DelphiSetupError } from "./delphi-config.js"
+
+let dir: string
+
+/**
+ * A single-gateway config body: every expert must share one base_url, so the
+ * provider block is built once and only its api_key varies per test.
+ */
+function configFor(apiKeyExpression: string): Record<string, unknown> {
+  const provider = { base_url: "https://gw.example/v1", api_key: apiKeyExpression }
+  const profile = {
+    provider: "gw",
+    providers: { gw: provider },
+    experts: {
+      architecture: { provider: "gw", model: "model-a" },
+      technical: { provider: "gw", model: "model-b" },
+      feasibility: { provider: "gw", model: "model-c" },
+    },
+  }
+  return { active_profile: "test", profiles: { test: profile } }
+}
+
+/** Write a fixture config, surfacing any filesystem failure as a test error. */
+function writeConfig(apiKeyExpression: string): void {
+  try {
+    writeFileSync(join(dir, ".delphi-config.json"), JSON.stringify(configFor(apiKeyExpression)), "utf8")
+  } catch (error) {
+    throw new Error(`cannot write fixture config: ${(error as Error).message}`)
+  }
+}
+
+const GLOBAL = join(tmpdir(), "xp-gate-no-such-global.json")
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), "xp-gate-delphi-override-"))
+})
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true })
+})
+
+describe("loadDelphiConfig apiKey override", () => {
+  it("uses the override when the environment cannot supply the key", () => {
+    writeConfig("${WHALECLOUD_API_KEY}")
+    // The DSH process has no such variable; the override stands in for it.
+    const resolved = loadDelphiConfig(dir, {}, GLOBAL, { WHALECLOUD_API_KEY: "resolved-from-store" })
+    expect(resolved.apiKey).toBe("resolved-from-store")
+  })
+
+  it("still fails loudly, naming the variable, when no override is given", () => {
+    writeConfig("${WHALECLOUD_API_KEY}")
+    expect(() => loadDelphiConfig(dir, {}, GLOBAL)).toThrow(DelphiSetupError)
+    try {
+      loadDelphiConfig(dir, {}, GLOBAL)
+    } catch (error) {
+      expect((error as Error).message).toContain("WHALECLOUD_API_KEY")
+    }
+  })
+
+  it("prefers an override over an environment value", () => {
+    // The caller resolved from the authoritative store; that decision wins.
+    writeConfig("${WHALECLOUD_API_KEY}")
+    const resolved = loadDelphiConfig(dir, { WHALECLOUD_API_KEY: "from-env" }, GLOBAL, {
+      WHALECLOUD_API_KEY: "from-store",
+    })
+    expect(resolved.apiKey).toBe("from-store")
+  })
+
+  it("leaves a literal api_key untouched by the override", () => {
+    // A config that hard-codes a key references no variable, so there is nothing
+    // for a variable-scoped override to replace.
+    writeConfig("literal-key-value")
+    const resolved = loadDelphiConfig(dir, {}, GLOBAL, { WHALECLOUD_API_KEY: "resolved-from-store" })
+    expect(resolved.apiKey).toBe("literal-key-value")
+  })
+})
+

package/plugins/dsh/src/delphi-config-credential-refs.test.ts

@@ -0,0 +1,75 @@
+/**
+ * @test REQ-DSH-014 credential reference discovery
+ * @intent Verify the plugin can learn WHICH environment-variable names the Delphi
+ *         config references, without resolving them, so it knows what to ask DSH's
+ *         credential service for.
+ * @covers AC-DSH-014-06
+ *
+ * Why: loadDelphiConfig is synchronous and the credential service is asynchronous, so
+ * the tool must resolve first and load second. That needs a cheap way to read the
+ * referenced names out of the config before any value exists — otherwise the loader
+ * throws before the caller ever learns what to resolve.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from "vitest"
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
+import { listCredentialReferences } from "./delphi-config.js"
+
+let dir: string
+const GLOBAL = join(tmpdir(), "xp-gate-no-such-global.json")
+
+/** A single-gateway config body; only the api_key expression varies per test. */
+function configFor(apiKeyExpression: string): Record<string, unknown> {
+  const provider = { base_url: "https://gw.example/v1", api_key: apiKeyExpression }
+  const profile = {
+    provider: "gw",
+    providers: { gw: provider },
+    experts: {
+      architecture: { provider: "gw", model: "model-a" },
+      technical: { provider: "gw", model: "model-b" },
+      feasibility: { provider: "gw", model: "model-c" },
+    },
+  }
+  return { active_profile: "test", profiles: { test: profile } }
+}
+
+/** Write a fixture config, surfacing any filesystem failure as a test error. */
+function writeConfig(apiKeyExpression: string): void {
+  try {
+    writeFileSync(join(dir, ".delphi-config.json"), JSON.stringify(configFor(apiKeyExpression)), "utf8")
+  } catch (error) {
+    throw new Error(`cannot write fixture config: ${(error as Error).message}`)
+  }
+}
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), "xp-gate-creds-refs-"))
+})
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true })
+})
+
+describe("listCredentialReferences", () => {
+  it("names the variable a ${VAR} api_key points at", () => {
+    writeConfig("${WHALECLOUD_API_KEY}")
+    expect(listCredentialReferences(dir, GLOBAL)).toEqual(["WHALECLOUD_API_KEY"])
+  })
+
+  it("returns nothing for a literal api_key", () => {
+    writeConfig("literal-key-value")
+    expect(listCredentialReferences(dir, GLOBAL)).toEqual([])
+  })
+
+  it("returns the variable name even when it is unset — never throws", () => {
+    // This is the whole point: the caller needs the name in order to resolve it.
+    writeConfig("${SOME_UNSET_KEY}")
+    expect(listCredentialReferences(dir, GLOBAL)).toEqual(["SOME_UNSET_KEY"])
+  })
+
+  it("returns an empty list when no config exists at all", () => {
+    expect(listCredentialReferences(dir, GLOBAL)).toEqual([])
+  })
+})