@build-astron-co/nimbus 0.3.0 → 0.4.0

package/src/__tests__/standalone-migration.test.ts

@@ -0,0 +1,199 @@
+/**
+ * Standalone Migration Tests
+ *
+ * Source-level checks verifying that microservice-dependent commands
+ * (RestClient, CoreEngineClient, localhost:300X) have been replaced
+ * with standalone CLI/SQLite/generator implementations.
+ *
+ * These are intentionally static — no runtime startup needed.
+ */
+
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { describe, it, expect } from 'vitest';
+
+const ROOT = join(__dirname, '..', '..');
+
+function src(relativePath: string): string {
+  return readFileSync(join(ROOT, relativePath), 'utf8');
+}
+
+// ---------------------------------------------------------------------------
+// C1 — generate-terraform: standalone
+// ---------------------------------------------------------------------------
+describe('C1 — generate-terraform standalone', () => {
+  it('has no new RestClient call', () => {
+    expect(src('src/commands/generate-terraform.ts')).not.toContain('new RestClient');
+  });
+  it('imports generateTerraformProject from generator', () => {
+    expect(src('src/commands/generate-terraform.ts')).toContain('generateTerraformProject');
+  });
+  it('has no localhost:300 reference', () => {
+    expect(src('src/commands/generate-terraform.ts')).not.toMatch(/localhost:300\d/);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// C2 — generate-k8s: standalone
+// ---------------------------------------------------------------------------
+describe('C2 — generate-k8s standalone', () => {
+  it('has no new RestClient call', () => {
+    expect(src('src/commands/generate-k8s.ts')).not.toContain('new RestClient');
+  });
+  it('uses generateManifestsLocally or kubernetes generator', () => {
+    expect(src('src/commands/generate-k8s.ts')).toMatch(/generateManifestsLocally|generateK8sManifests|K8sGeneratorConfig/);
+  });
+  it('has no localhost:300 reference', () => {
+    expect(src('src/commands/generate-k8s.ts')).not.toMatch(/localhost:300\d/);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// C3 — aws-discover: standalone
+// ---------------------------------------------------------------------------
+describe('C3 — aws-discover standalone', () => {
+  it('has no new RestClient call', () => {
+    expect(src('src/commands/aws-discover.ts')).not.toContain('new RestClient');
+  });
+  it('uses aws configure or execFile for profiles', () => {
+    expect(src('src/commands/aws-discover.ts')).toMatch(/configure|execFile|execFileSync|cliGetAwsProfiles/);
+  });
+  it('has no localhost:300 reference', () => {
+    expect(src('src/commands/aws-discover.ts')).not.toMatch(/localhost:300\d/);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// C4 — aws-terraform: standalone
+// ---------------------------------------------------------------------------
+describe('C4 — aws-terraform standalone', () => {
+  it('has no new RestClient call', () => {
+    expect(src('src/commands/aws-terraform.ts')).not.toContain('new RestClient');
+  });
+  it('imports generateTerraformProject from generator', () => {
+    expect(src('src/commands/aws-terraform.ts')).toContain('generateTerraformProject');
+  });
+  it('has no localhost:300 reference', () => {
+    expect(src('src/commands/aws-terraform.ts')).not.toMatch(/localhost:300\d/);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// C5 — resume: standalone
+// ---------------------------------------------------------------------------
+describe('C5 — resume command standalone', () => {
+  it('has no CoreEngineClient import', () => {
+    expect(src('src/commands/resume.ts')).not.toContain('CoreEngineClient');
+  });
+  it('references chatCommand or getDb for session lookup', () => {
+    expect(src('src/commands/resume.ts')).toMatch(/chatCommand|getDb|SessionManager/);
+  });
+  it('has no localhost:300 reference', () => {
+    expect(src('src/commands/resume.ts')).not.toMatch(/localhost:300\d/);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// C6 — version: DevOps CLI tools (not localhost services)
+// ---------------------------------------------------------------------------
+describe('C6 — version command DevOps tools', () => {
+  it('has no localhost:300 references in fetchComponentVersions', () => {
+    expect(src('src/commands/version.ts')).not.toMatch(/localhost:300\d/);
+  });
+  it('includes terraform version check', () => {
+    expect(src('src/commands/version.ts')).toContain('terraform');
+  });
+  it('includes kubectl version check', () => {
+    expect(src('src/commands/version.ts')).toContain('kubectl');
+  });
+  it('includes helm version check', () => {
+    expect(src('src/commands/version.ts')).toContain('helm');
+  });
+  it('shows [+] / [-] icon format', () => {
+    expect(src('src/commands/version.ts')).toMatch(/\[\+\]|\[-\]/);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// C7 — drift: no CoreEngineClient
+// ---------------------------------------------------------------------------
+describe('C7 — drift no CoreEngineClient', () => {
+  it('drift/index.ts has no CoreEngineClient import', () => {
+    const content = src('src/commands/drift/index.ts');
+    // Must not have an import statement (comments are fine)
+    expect(content).not.toMatch(/^import.*CoreEngineClient/m);
+  });
+  it('drift/index.ts uses execFileSync or execFile for terraform', () => {
+    expect(src('src/commands/drift/index.ts')).toMatch(/execFileSync|execFile|spawnExec/);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// C8 — dead client code deleted/stubbed
+// ---------------------------------------------------------------------------
+describe('C8 — dead client code', () => {
+  it('service-discovery.ts is either deleted or a stub without ghost URLs', () => {
+    try {
+      const content = src('src/clients/service-discovery.ts');
+      // If it exists, it must not contain the old ghost localhost service URLs
+      expect(content).not.toContain('localhost:3001');
+      expect(content).not.toContain('localhost:3003');
+      expect(content).not.toContain('localhost:3009');
+    } catch {
+      // File deleted — that's fine
+    }
+  });
+});
+
+// ---------------------------------------------------------------------------
+// H1 — Emoji removed, replaced with ASCII icons
+// ---------------------------------------------------------------------------
+describe('H1 — emoji removed from UI', () => {
+  it('TreePane.tsx has no folder emoji', () => {
+    expect(src('src/ui/TreePane.tsx')).not.toContain('\u{1F4C1}'); // 📁
+  });
+  it('TreePane.tsx uses [/] for directories', () => {
+    expect(src('src/ui/TreePane.tsx')).toContain('[/]');
+  });
+  it('TerminalPane.tsx has no right-pointing triangle', () => {
+    expect(src('src/ui/TerminalPane.tsx')).not.toContain('\u25B6'); // ▶
+  });
+  it('TerminalPane.tsx uses [>] icon', () => {
+    expect(src('src/ui/TerminalPane.tsx')).toContain('[>]');
+  });
+  it('StatusBar.tsx has no Greek capital delta (Δ)', () => {
+    expect(src('src/ui/StatusBar.tsx')).not.toContain('\u0394'); // Δ
+  });
+  it('StatusBar.tsx uses delta: text', () => {
+    expect(src('src/ui/StatusBar.tsx')).toContain('delta:');
+  });
+});
+
+// ---------------------------------------------------------------------------
+// M1 — Secret redaction in spawn-exec
+// ---------------------------------------------------------------------------
+describe('M1 — secret redaction in spawn-exec', () => {
+  it('spawn-exec.ts has SECRET_PATTERNS constant', () => {
+    expect(src('src/tools/spawn-exec.ts')).toContain('SECRET_PATTERNS');
+  });
+  it('spawn-exec.ts has redactSecrets function', () => {
+    expect(src('src/tools/spawn-exec.ts')).toContain('redactSecrets');
+  });
+  it('spawn-exec.ts redacts AKIA keys', () => {
+    expect(src('src/tools/spawn-exec.ts')).toContain('AKIA');
+  });
+  it('spawn-exec.ts redacts Bearer tokens', () => {
+    expect(src('src/tools/spawn-exec.ts')).toContain('Bearer');
+  });
+});
+
+// ---------------------------------------------------------------------------
+// M2 — Doctor shows inline versions
+// ---------------------------------------------------------------------------
+describe('M2 — doctor inline versions', () => {
+  it('doctor.ts references version in available tools output', () => {
+    // The available list should include t.version or similar version string
+    const content = src('src/commands/doctor.ts');
+    expect(content).toMatch(/t\.version|tool\.version|\.version\b/);
+  });
+});

package/src/__tests__/status.test.ts

@@ -0,0 +1,158 @@
+/**
+ * Tests for the nimbus status command (G18).
+ *
+ * The statusCommand runs concurrent CLI checks. We test the module structure
+ * and basic argument parsing rather than the actual CLI calls to avoid
+ * platform dependencies.
+ */
+
+import { describe, test, expect } from 'vitest';
+import { statusCommand, type StatusOptions } from '../commands/status';
+
+describe('statusCommand (G18)', () => {
+  test('exports statusCommand function', () => {
+    expect(typeof statusCommand).toBe('function');
+  });
+
+  test('StatusOptions accepts json flag', () => {
+    const opts: StatusOptions = { json: true };
+    expect(opts.json).toBe(true);
+  });
+
+  test('StatusOptions json defaults to undefined', () => {
+    const opts: StatusOptions = {};
+    expect(opts.json).toBeUndefined();
+  });
+
+  test('statusCommand resolves without throwing when CLIs are unavailable', async () => {
+    // Mock console.log to suppress output in test
+    const original = console.log;
+    const logs: string[] = [];
+    console.log = (msg: string) => logs.push(msg);
+
+    try {
+      // Should not throw even if kubectl/terraform/aws/gcloud are not installed
+      // (the command catches errors gracefully)
+      await expect(statusCommand({ json: true })).resolves.toBeUndefined();
+    } finally {
+      console.log = original;
+    }
+  });
+
+  test('statusCommand with json option outputs valid JSON', async () => {
+    const original = console.log;
+    let jsonOutput = '';
+    console.log = (msg: string) => { jsonOutput = msg; };
+
+    try {
+      await statusCommand({ json: true });
+      // Should produce valid JSON
+      const parsed = JSON.parse(jsonOutput);
+      expect(parsed).toBeTypeOf('object');
+      // Should have an errors array
+      expect(Array.isArray(parsed.errors)).toBe(true);
+    } finally {
+      console.log = original;
+    }
+  });
+});
+
+describe('statusCommand C2 enhancements', () => {
+  test('JSON output includes model field with default fallback', async () => {
+    const original = console.log;
+    let jsonOutput = '';
+    console.log = (msg: string) => { jsonOutput = msg; };
+
+    try {
+      await statusCommand({ json: true });
+      const parsed = JSON.parse(jsonOutput) as Record<string, unknown>;
+      // model should be set (either from config.json or default 'claude-sonnet-4-6')
+      expect(typeof parsed.model).toBe('string');
+      expect((parsed.model as string).length).toBeGreaterThan(0);
+    } finally {
+      console.log = original;
+    }
+  });
+
+  test('JSON output includes provider field with default fallback', async () => {
+    const original = console.log;
+    let jsonOutput = '';
+    console.log = (msg: string) => { jsonOutput = msg; };
+
+    try {
+      await statusCommand({ json: true });
+      const parsed = JSON.parse(jsonOutput) as Record<string, unknown>;
+      // provider should be set (either from config.json or default 'anthropic')
+      expect(typeof parsed.provider).toBe('string');
+      expect((parsed.provider as string).length).toBeGreaterThan(0);
+    } finally {
+      console.log = original;
+    }
+  });
+
+  test('JSON output includes nimbusMdFound field', async () => {
+    const original = console.log;
+    let jsonOutput = '';
+    console.log = (msg: string) => { jsonOutput = msg; };
+
+    try {
+      await statusCommand({ json: true });
+      const parsed = JSON.parse(jsonOutput) as Record<string, unknown>;
+      // nimbusMdFound should be a boolean (true or undefined/false)
+      expect(
+        parsed.nimbusMdFound === undefined || typeof parsed.nimbusMdFound === 'boolean'
+      ).toBe(true);
+    } finally {
+      console.log = original;
+    }
+  });
+
+  test('JSON output includes sessionCount field', async () => {
+    const original = console.log;
+    let jsonOutput = '';
+    console.log = (msg: string) => { jsonOutput = msg; };
+
+    try {
+      await statusCommand({ json: true });
+      const parsed = JSON.parse(jsonOutput) as Record<string, unknown>;
+      // sessionCount should be a number or 'N/A'
+      expect(
+        typeof parsed.sessionCount === 'number' || parsed.sessionCount === 'N/A'
+      ).toBe(true);
+    } finally {
+      console.log = original;
+    }
+  });
+
+  test('default model is claude-sonnet-4-6 when config.json is absent', async () => {
+    const original = console.log;
+    let jsonOutput = '';
+    console.log = (msg: string) => { jsonOutput = msg; };
+
+    // We can test this by verifying the model is never empty
+    try {
+      await statusCommand({ json: true });
+      const parsed = JSON.parse(jsonOutput) as Record<string, unknown>;
+      // Model should be a non-empty string
+      expect(typeof parsed.model).toBe('string');
+      expect((parsed.model as string).length).toBeGreaterThan(0);
+    } finally {
+      console.log = original;
+    }
+  });
+
+  test('default provider is anthropic when config.json is absent', async () => {
+    const original = console.log;
+    let jsonOutput = '';
+    console.log = (msg: string) => { jsonOutput = msg; };
+
+    try {
+      await statusCommand({ json: true });
+      const parsed = JSON.parse(jsonOutput) as Record<string, unknown>;
+      expect(typeof parsed.provider).toBe('string');
+      expect((parsed.provider as string).length).toBeGreaterThan(0);
+    } finally {
+      console.log = original;
+    }
+  });
+});

package/src/__tests__/stream-with-tools.test.ts

@@ -14,7 +14,7 @@
  * All tests use mocks -- no real API calls are made.
  */
 
-import { describe, test, expect, vi, beforeEach } from 'vitest';
+import { describe, test, it, expect, vi, beforeEach } from 'vitest';
 import type { ToolCompletionRequest, StreamChunk } from '../llm/types';
 
 // ---------------------------------------------------------------------------
@@ -728,3 +728,51 @@ describe('OpenAICompatibleProvider.streamWithTools', () => {
     expect(createArg.max_tokens).toBe(1024);
   });
 });
+
+// ---------------------------------------------------------------------------
+// PERF-2c: Unbuffered streaming in LLMRouter fallback branch
+// ---------------------------------------------------------------------------
+
+describe('PERF-2c: LLMRouter unbuffered streaming', () => {
+  it('streamWithTools fallback loop no longer buffers chunks before yielding', async () => {
+    const { readFileSync } = await import('node:fs');
+    const { join } = await import('node:path');
+    const src = readFileSync(join(process.cwd(), 'src/llm/router.ts'), 'utf-8');
+    // Extract only the streamWithTools section (between the streamWithTools guards)
+    const swStart = src.indexOf('Use native streaming-with-tools if providers support it');
+    const swEnd = src.indexOf('If all providers with streamWithTools failed', swStart);
+    const swSection = swStart > 0 && swEnd > swStart ? src.slice(swStart, swEnd) : '';
+    // The streamWithTools fallback section should NOT contain buffering
+    expect(swSection).not.toContain('bufferedChunks');
+    // It should contain yield chunk directly
+    expect(swSection).toContain('yield chunk;');
+  });
+
+  it('router.ts yields each chunk immediately inside the for-await loop', async () => {
+    const { readFileSync } = await import('node:fs');
+    const { join } = await import('node:path');
+    const src = readFileSync(join(process.cwd(), 'src/llm/router.ts'), 'utf-8');
+    // The yield statement should appear inside the for-await (before circuitBreaker.recordSuccess)
+    expect(src).toContain('yield chunk;');
+    // circuitBreaker.recordSuccess comes after the loop ends (done chunk received)
+    expect(src).toContain('circuitBreaker.recordSuccess(p.name);');
+  });
+
+  it('circuitBreaker.recordSuccess is called after stream ends (not before yield)', async () => {
+    const { readFileSync } = await import('node:fs');
+    const { join } = await import('node:path');
+    const src = readFileSync(join(process.cwd(), 'src/llm/router.ts'), 'utf-8');
+    // Find the fallback for-loop block that has yield chunk
+    const yieldIdx = src.indexOf('yield chunk;');
+    const recordSuccessIdx = src.indexOf('circuitBreaker.recordSuccess(p.name);');
+    // recordSuccess should appear AFTER the yield in the source
+    expect(recordSuccessIdx).toBeGreaterThan(yieldIdx);
+  });
+
+  it('stream error path still calls circuitBreaker.recordFailure', async () => {
+    const { readFileSync } = await import('node:fs');
+    const { join } = await import('node:path');
+    const src = readFileSync(join(process.cwd(), 'src/llm/router.ts'), 'utf-8');
+    expect(src).toContain('circuitBreaker.recordFailure(p.name);');
+  });
+});

package/src/__tests__/system-prompt.test.ts

@@ -9,7 +9,7 @@ import { describe, test, expect, beforeEach, afterEach } from 'vitest';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
-import { buildSystemPrompt, loadNimbusMd } from '../agent/system-prompt';
+import { buildSystemPrompt, loadNimbusMd, extractForbiddenRules } from '../agent/system-prompt';
 import type { ToolDefinition } from '../tools/schemas/types';
 import { z } from 'zod';
 
@@ -51,7 +51,9 @@ describe('buildSystemPrompt', () => {
   test('includes base identity', () => {
     const prompt = buildSystemPrompt({ mode: 'build', tools: [] });
     expect(prompt).toContain('You are Nimbus');
-    expect(prompt).toContain('AI-powered DevOps');
+    // C2: new DevOps-operator-first framing
+    expect(prompt).toContain('autonomous DevOps operator');
+    expect(prompt).toContain('RUN commands and query live state');
   });
 
   test('includes mode-specific instructions for "plan"', () => {
@@ -167,3 +169,80 @@ describe('loadNimbusMd', () => {
     expect(result).toBe('root-level');
   });
 });
+
+// ===========================================================================
+// G14: extractForbiddenRules
+// ===========================================================================
+
+describe('extractForbiddenRules (G14)', () => {
+  test('extracts bullet items from ## Forbidden section', () => {
+    const content = `
+## Safety Rules
+
+- Do not break prod
+
+## Forbidden
+
+- Never destroy the production database
+- Never delete the S3 bucket
+- Never run rm -rf /
+
+## Custom Instructions
+
+Some other stuff
+`;
+    const rules = extractForbiddenRules(content);
+    expect(rules).toHaveLength(3);
+    expect(rules[0]).toBe('Never destroy the production database');
+    expect(rules[1]).toBe('Never delete the S3 bucket');
+    expect(rules[2]).toBe('Never run rm -rf /');
+  });
+
+  test('returns empty array when no Forbidden section', () => {
+    const content = '## Safety Rules\n\n- Be careful\n';
+    expect(extractForbiddenRules(content)).toEqual([]);
+  });
+
+  test('ignores HTML comment lines', () => {
+    const content = `
+## Forbidden
+
+<!-- Example: - Never destroy the database -->
+- Never touch prod
+`;
+    const rules = extractForbiddenRules(content);
+    expect(rules).toHaveLength(1);
+    expect(rules[0]).toBe('Never touch prod');
+  });
+
+  test('G14: prompt includes HARD CONSTRAINTS block when Forbidden section has entries', () => {
+    const nimbusContent = `
+## Forbidden
+
+- Never destroy the production database
+- Never run terraform destroy in prod
+`;
+    const prompt = buildSystemPrompt({
+      mode: 'build',
+      tools: [],
+      nimbusInstructions: nimbusContent,
+    });
+    expect(prompt).toContain('HARD CONSTRAINTS');
+    expect(prompt).toContain('Never destroy the production database');
+    expect(prompt).toContain('STRICTLY FORBIDDEN');
+  });
+
+  test('G14: prompt does not include HARD CONSTRAINTS when Forbidden section is empty/comments', () => {
+    const nimbusContent = `
+## Forbidden
+
+<!-- List operations Nimbus must never perform in this project -->
+`;
+    const prompt = buildSystemPrompt({
+      mode: 'build',
+      tools: [],
+      nimbusInstructions: nimbusContent,
+    });
+    expect(prompt).not.toContain('HARD CONSTRAINTS');
+  });
+});