@codespar/cli 0.18.1 → 0.20.0

package/templates/supplier-payments-agent/packages/agent-runtime/test/transition-line.test.ts

@@ -0,0 +1,29 @@
+/**
+ * #50: the line a person reads after an execution moves carries the rail's own
+ * code and message, verbatim, after the reason — on a failure and on an answer
+ * that left an attempt unknown — and nothing more when there is none.
+ */
+import type { Execution } from "@codespar/agent-core";
+import { describe, expect, it } from "vitest";
+import { transitionLine } from "../src/terminal.js";
+
+function execution(over: Partial<Execution>): Execution {
+  return { state: "settled", outcomes: [], ...over } as Execution;
+}
+
+describe("transitionLine", () => {
+  it("a failure: the reason, then the API's code and message", () => {
+    const failed = execution({ state: "failed", reason: "rail_failed", outcomes: [{ index: 0, attempt_id: "att_0", status: "failed", code: "insufficient_funds", message: "wallet cannot reserve the requested amount" }] });
+    expect(transitionLine(failed)).toBe("  -> failed (rail_failed): insufficient_funds — wallet cannot reserve the requested amount");
+  });
+
+  it("an unknown outcome: the reason, then what the API answered", () => {
+    const open = execution({ state: "executing", reason: "rail_uncertain", uncertain_answers: [{ attempt_id: "att_0", code: "provider_error", message: "no receiving identity" }] });
+    expect(transitionLine(open)).toBe("  -> executing (rail_uncertain): provider_error — no receiving identity");
+  });
+
+  it("nothing to add when nothing failed", () => {
+    expect(transitionLine(execution({ state: "settled" }))).toBe("  -> settled");
+    expect(transitionLine(execution({ state: "denied", reason: "cap_exceeded" as Execution["reason"] }))).toBe("  -> denied (cap_exceeded)");
+  });
+});

package/templates/supplier-payments-agent/packages/agent-runtime/test/verify-cli.test.ts

@@ -9,7 +9,7 @@
  */
 import { spawn, spawnSync } from "node:child_process";
 import { createHash, generateKeyPairSync, sign as signDetached } from "node:crypto";
-import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { createServer, type Server } from "node:http";
 import type { AddressInfo } from "node:net";
 import { tmpdir } from "node:os";
@@ -46,11 +46,11 @@ function fixture(over: Record<string, unknown> = {}) {
   return { dir, receiptPath, keysPath };
 }
 
-function run(args: string[], cwd: string) {
+function run(args: string[], cwd: string, env: Record<string, string> = {}) {
   const result = spawnSync(process.execPath, [BIN, "verify", ...args], {
     cwd,
     // No CodeSpar key, no model key: a verifier holds nothing.
-    env: { ...process.env, CODESPAR_API_KEY: "", ANTHROPIC_API_KEY: "" },
+    env: { ...process.env, CODESPAR_API_KEY: "", ANTHROPIC_API_KEY: "", ...env },
     encoding: "utf8",
     timeout: 60_000,
   });
@@ -64,6 +64,10 @@ describe("codespar-agent verify", () => {
     expect(out.code).toBe(7);
     expect(out.stdout).toContain("SIGNATURE_ONLY");
     expect(out.stdout).toContain(RECEIPT_ID);
+    // The offline check reads neither the deployment nor the project, so two names for them that disagree are none of its business.
+    const disagreeing = run([receiptPath, "--keys", keysPath], dir, { CODESPAR_API_URL: "https://api.codespar.dev", CODESPAR_BASE_URL: "https://api.staging.codespar.dev" });
+    expect(disagreeing.code).toBe(7);
+    expect(disagreeing.stderr).not.toContain("disagree");
     expect(out.stdout).toContain("read_required");
     expect(out.stderr).toContain("carries CodeSpar's signature");
     expect(out.stderr).toContain("--from-api");
@@ -268,12 +272,12 @@ describe("codespar-agent verify --from-api", () => {
   });
 
   /** The server answers while the command runs, so the process is awaited, never spawned synchronously. */
-  function runAsync(args: string[], cwd: string): Promise<{ code: number | null; stdout: string; stderr: string }> {
+  function runAsync(args: string[], cwd: string, env?: NodeJS.ProcessEnv): Promise<{ code: number | null; stdout: string; stderr: string }> {
     return new Promise((done) => {
       const child = spawn(process.execPath, [BIN, "verify", ...args], {
         cwd,
-        // The placeholder passes the csk_test_ guard and is the one test-key-shaped string the secret scan allows.
-        env: { ...process.env, CODESPAR_API_KEY: "csk_test_your_key_here", CODESPAR_API_URL: baseUrl, ANTHROPIC_API_KEY: "" },
+        // Not the placeholder, which the guard refuses (#50); the underscore keeps it below the secret scan's key shape.
+        env: env ?? { ...process.env, CODESPAR_API_KEY: "csk_test_unit_0000", CODESPAR_API_URL: baseUrl, ANTHROPIC_API_KEY: "" },
       });
       let stdout = "";
       let stderr = "";
@@ -294,6 +298,20 @@ describe("codespar-agent verify --from-api", () => {
     expect(readFileSync(f.paths.copy, "utf8")).not.toContain(PAYEE);
   });
 
+  it("never prints or writes the mandate's signature a tenant's read carries, and shows what the chain sealed about the money", async () => {
+    const f = v4Fixture();
+    const mandateSig = "s".repeat(64);
+    served = { read: { ...f.read, mandate: { ...f.read.mandate, sig: mandateSig } }, keys: f.keys };
+    const human = await runAsync([f.paths.copy, "--from-api"], f.dir);
+    const json = await runAsync([f.paths.copy, "--from-api", "--json"], f.dir);
+    expect([human.code, json.code]).toEqual([0, 0]);
+    expect(human.stdout).toContain("payment      sandbox true, money_moved false");
+    expect(JSON.parse(json.stdout).sealed_payment).toEqual({ sandbox: true, money_moved: false });
+    for (const out of [human, json]) expect(out.stdout + out.stderr).not.toContain(mandateSig);
+    const files = readdirSync(f.dir, { recursive: true, encoding: "utf8" }).map((name) => join(f.dir, name)).filter((path) => statSync(path).isFile());
+    for (const path of files) expect(readFileSync(path, "utf8")).not.toContain(mandateSig);
+  });
+
   it("exits 9 when the run's artifact is not the list the receipt sealed", async () => {
     const f = v4Fixture();
     served = { read: f.read, keys: f.keys };
@@ -320,6 +338,81 @@ describe("codespar-agent verify --from-api", () => {
     expect(JSON.parse(out.stdout)).toMatchObject({ verdict: "signature_only", reason: "read_unavailable" });
   });
 
+  /*
+   * #66: the copy sits in its agent, and that agent's `.env` names the
+   * deployment as well as the key. A shell that exported neither must still
+   * read from the deployment the `.env` names, under `readDotEnv`'s rule: the
+   * environment wins, the file fills only what is unset.
+   */
+  function inAgent(dir: string, dotEnv: Record<string, string>): void {
+    writeFileSync(join(dir, "agent.yaml"), 'name: "verify-fixture-agent"\n');
+    writeFileSync(join(dir, ".env"), Object.entries(dotEnv).map(([k, v]) => `${k}=${v}\n`).join(""));
+  }
+
+  function bareEnv(over: Record<string, string> = {}): NodeJS.ProcessEnv {
+    const env: NodeJS.ProcessEnv = { ...process.env, ANTHROPIC_API_KEY: "", ...over };
+    for (const name of ["CODESPAR_API_KEY", "CODESPAR_API_URL", "CODESPAR_PROJECT_ID", "CODESPAR_BASE_URL", "CODESPAR_PROJECT"]) if (!(name in over)) delete env[name];
+    return env;
+  }
+
+  it("reads the receipt from the deployment the agent's .env names when the shell exported nothing", async () => {
+    const f = v4Fixture();
+    inAgent(f.dir, { CODESPAR_API_KEY: "csk_test_unit_0000", CODESPAR_API_URL: baseUrl });
+    served = { read: f.read, keys: f.keys };
+    asked.length = 0;
+    const out = await runAsync([f.paths.copy, "--from-api", "--json"], f.dir, bareEnv());
+    expect(out.code).toBe(0);
+    expect(JSON.parse(out.stdout)).toMatchObject({ verdict: "verified", keys_from: `${baseUrl}/.well-known/codespar-receipt-keys.json` });
+    expect(asked).toEqual([`GET /.well-known/codespar-receipt-keys.json anon`, `GET /v1/consumers/receipts/${RECEIPT_ID} auth`]);
+    expect(out.stdout + out.stderr).not.toContain("csk_test_unit_0000");
+  });
+
+  it("keeps an exported CODESPAR_API_URL over the one in the agent's .env, which still fills the unset key", async () => {
+    const f = v4Fixture();
+    inAgent(f.dir, { CODESPAR_API_KEY: "csk_test_unit_0000", CODESPAR_API_URL: "http://127.0.0.1:9" });
+    served = { read: f.read, keys: f.keys };
+    asked.length = 0;
+    const out = await runAsync([f.paths.copy, "--from-api", "--json"], f.dir, bareEnv({ CODESPAR_API_URL: baseUrl }));
+    expect(out.code).toBe(0);
+    expect(asked).toEqual([`GET /.well-known/codespar-receipt-keys.json anon`, `GET /v1/consumers/receipts/${RECEIPT_ID} auth`]);
+  });
+
+  const BOTH_ASKED = () => [`GET /.well-known/codespar-receipt-keys.json anon`, `GET /v1/consumers/receipts/${RECEIPT_ID} auth`];
+
+  it("reads from the deployment the .env names under the CLI's name, CODESPAR_BASE_URL", async () => {
+    const f = v4Fixture();
+    inAgent(f.dir, { CODESPAR_API_KEY: "csk_test_unit_0000", CODESPAR_BASE_URL: baseUrl });
+    served = { read: f.read, keys: f.keys };
+    asked.length = 0;
+    const out = await runAsync([f.paths.copy, "--from-api", "--json"], f.dir, bareEnv());
+    expect(out.code).toBe(0);
+    expect(asked).toEqual(BOTH_ASKED());
+  });
+
+  it("keeps the shell's deployment over the .env's when each uses the other name, either way round", async () => {
+    for (const [shellName, fileName] of [["CODESPAR_BASE_URL", "CODESPAR_API_URL"], ["CODESPAR_API_URL", "CODESPAR_BASE_URL"]] as const) {
+      const f = v4Fixture();
+      inAgent(f.dir, { CODESPAR_API_KEY: "csk_test_unit_0000", [fileName]: "http://127.0.0.1:9" });
+      served = { read: f.read, keys: f.keys };
+      asked.length = 0;
+      const out = await runAsync([f.paths.copy, "--from-api", "--json"], f.dir, bareEnv({ [shellName]: baseUrl }));
+      expect(out.stderr).not.toContain("disagree");
+      expect(out.code).toBe(0);
+      expect(asked).toEqual(BOTH_ASKED());
+    }
+  });
+
+  it("refuses two names that disagree as a usage error (2), before any request, and never as a failed verification (1)", async () => {
+    const f = v4Fixture();
+    inAgent(f.dir, { CODESPAR_API_KEY: "csk_test_unit_0000", CODESPAR_API_URL: baseUrl, CODESPAR_BASE_URL: "http://127.0.0.1:9" });
+    asked.length = 0;
+    const out = await runAsync([f.paths.copy, "--from-api"], f.dir, bareEnv());
+    expect(out.code).toBe(2);
+    expect(out.stderr).toContain(`CODESPAR_API_URL=${baseUrl}`);
+    expect(out.stderr).toContain("CODESPAR_BASE_URL=http://127.0.0.1:9");
+    expect(asked).toEqual([]);
+  });
+
   it("refuses a key set from another deployment than the read", async () => {
     const f = v4Fixture();
     const out = await runAsync([f.paths.copy, "--from-api", "--url", "https://api.codespar.dev/.well-known/codespar-receipt-keys.json"], f.dir);

package/templates/supplier-payments-agent/packages/agent-runtime/test/whatsapp-rules.test.ts

@@ -71,6 +71,14 @@ describe("the collection rules, tried through the channel", () => {
     expect(backend.delivered).toHaveLength(0);
   });
 
+  it("refuses outside the hours in either locale, for the same rule, and only the detail is translated (#64)", () => {
+    const at = (locale: "pt-BR" | "en" | undefined) =>
+      checkOutbound(CONTACT, { kind: "text", text: "Oi, Joana!" }, { conversation: { contact: CONTACT }, hours: HOURS, now: () => OUTSIDE, ...(locale ? { locale } : {}) });
+    expect(at(undefined)).toEqual({ rule: "collection_hours", detail: "fora do horário de cobrança (08:00-20:00 America/Sao_Paulo); agora são 22:30" });
+    expect(at("pt-BR")).toEqual(at(undefined));
+    expect(at("en")).toEqual({ rule: "collection_hours", detail: "outside collection hours (08:00-20:00 America/Sao_Paulo); it is 22:30 now" });
+  });
+
   it("refuses a message to any contact but the one the conversation is bound to", () => {
     const refusal = checkOutbound("+5511900000000", { kind: "text", text: "sobre a sua divida" }, {
       conversation: { contact: CONTACT, subject: "acordo-1042" },

package/templates/supplier-payments-agent/packages/agent-runtime/test/whatsapp-session.test.ts

@@ -165,3 +165,80 @@ describe("the local registry refuses what Meta would refuse", () => {
     expect(templateArity("Oi {{ 1 }}.")).toBe(1);
   });
 });
+
+describe("a conversation speaks one locale, and its templates and taps are that locale's copies (#64)", () => {
+  const VENCIDA_PT: WhatsAppTemplate = {
+    name: "acordo_cobranca_vencida",
+    language: "pt_BR",
+    description: "expired",
+    body: "A cobrança do {{1}} venceu.",
+    buttons: [{ id: "emitir_nova", title: "Emitir nova", intent: "quero uma nova cobrança" }],
+  };
+  const VENCIDA_EN: WhatsAppTemplate = {
+    name: "acordo_cobranca_vencida",
+    language: "en_US",
+    description: "expired",
+    body: "The charge for {{1}} expired.",
+    buttons: [{ id: "emitir_nova", title: "Issue a new one", intent: "I want a new charge" }],
+  };
+
+  class Tapper extends Recorder {
+    private tapped = false;
+    override async next(): Promise<InboundMessage | undefined> {
+      if (this.tapped) return undefined;
+      this.tapped = true;
+      return { id: "wamid.tap", from: CONTACT, text: "Emitir nova", timestamp: Math.floor(FRIDAY.getTime() / 1000), reply: { type: "button", id: "emitir_nova", title: "Emitir nova" } };
+    }
+  }
+
+  function localized(locale: "pt-BR" | "en", backend: Recorder = new Recorder()) {
+    const c = new WhatsAppChannel({
+      backend,
+      conversation: { contact: CONTACT, subject: "acordo-1042" },
+      now: () => FRIDAY,
+      templates: [VENCIDA_PT, VENCIDA_EN],
+      session: { lastInboundAt: Math.floor(TUESDAY.getTime() / 1000) },
+      locale,
+    });
+    return { channel: c, backend };
+  }
+
+  it("an English conversation declares, and sends, the en_US copy with its own buttons", async () => {
+    const { channel: c, backend } = localized("en");
+    expect(c.language).toBe("en_US");
+    const declared = c.declaredTemplate("acordo_cobranca_vencida")!;
+    expect(declared.language).toBe("en_US");
+    const sent = await c.send({ kind: "template", template: declared.name, language: declared.language, variables: ["acordo-1042"] });
+    expect(sent.refused).toBeUndefined();
+    expect(backend.delivered).toEqual([{ kind: "template", template: "acordo_cobranca_vencida", language: "en_US", variables: ["acordo-1042"], buttons: [{ id: "emitir_nova", title: "Issue a new one" }] }]);
+  });
+
+  it("the default locale is pt-BR and picks the pt_BR copy", () => {
+    const c = new WhatsAppChannel({ backend: new Recorder(), conversation: { contact: CONTACT }, now: () => FRIDAY, templates: [VENCIDA_PT, VENCIDA_EN] });
+    expect(c.language).toBe("pt_BR");
+    expect(c.declaredTemplate("acordo_cobranca_vencida")?.body).toBe("A cobrança do {{1}} venceu.");
+  });
+
+  it("a tap is read as the intent its locale's copy declares: the same button id, the model handed that conversation's language", async () => {
+    const en = localized("en", new Tapper());
+    const pt = localized("pt-BR", new Tapper());
+    expect((await en.channel.next())?.text).toBe("I want a new charge");
+    expect((await pt.channel.next())?.text).toBe("quero uma nova cobrança");
+  });
+
+  it("refuses a language nobody registered, naming the ones that were", async () => {
+    const { channel: c, backend } = localized("en");
+    const sent = await c.send({ kind: "template", template: "acordo_cobranca_vencida", language: "es_MX", variables: ["acordo-1042"] });
+    expect(sent.refused?.rule).toBe("template_language_unknown");
+    expect(sent.refused?.detail).toContain("pt_BR, en_US");
+    expect(backend.delivered).toHaveLength(0);
+  });
+
+  it("an English conversation's refusal reaches the operator in English, and the rule it names is the same", async () => {
+    const said: string[] = [];
+    const c = new WhatsAppChannel({ backend: new Recorder(), conversation: { contact: CONTACT }, now: () => FRIDAY, templates: [VENCIDA_EN], session: { lastInboundAt: Math.floor(TUESDAY.getTime() / 1000) }, locale: "en", say: (l) => void said.push(l) });
+    const sent = await c.say("free text after the window");
+    expect(sent.refused?.rule).toBe("session_window_closed");
+    expect(said).toEqual([`  [whatsapp] refused (session_window_closed): ${sent.refused!.detail}`]);
+  });
+});

package/templates/supplier-payments-agent/packages/agent-runtime/test/whatsapp-status-replies.test.ts

@@ -88,7 +88,7 @@ describe("1. a status webhook is read, and a failed outcome is an outcome not to
     const status = ch.log().find((l) => l.direction === "status")!;
     expect(status).toMatchObject({ kind: "status", message_id: sent.id, state: "failed", about: { execution_id: "exe_1", state: "settled" }, errors: [{ code: 131026, details: "not on whatsapp" }] });
     expect(failed).toEqual([status]);
-    expect(said.join("\n")).toContain("a pessoa NAO foi avisada");
+    expect(said.join("\n")).toContain("a pessoa NÃO foi avisada");
   });
 
   it("a read is recorded and nothing more: not consent, not an acknowledgement, not a reply", async () => {
@@ -121,6 +121,32 @@ describe("1. a status webhook is read, and a failed outcome is an outcome not to
     expect(failed.map((l) => l.about)).toEqual([{ execution_id: "exe_2", state: "settled" }]);
   });
 
+  it("a delivered that lands AFTER the failed does not un-fail the message, and a late sent does not rewind a read (#63)", async () => {
+    // The emulator's own order when a failure is posted while the send is still dispatching its sent/delivered webhooks.
+    class Interleaved extends Scripted {
+      override async deliver(to: string, body: OutboundBody): Promise<SentMessage> {
+        const sent = await super.deliver(to, body);
+        this.report({ message_id: sent.id, status: "sent", timestamp: 1, errors: [] });
+        this.report({ message_id: sent.id, status: "failed", timestamp: 2, errors: [{ code: 131026 }] });
+        this.report({ message_id: sent.id, status: "delivered", timestamp: 2, errors: [] });
+        return sent;
+      }
+    }
+    const backend = new Interleaved();
+    const failed: ChannelLogLine[] = [];
+    const ch = new WhatsAppChannel({ backend, conversation: { contact: CONTACT }, now: () => NOW, templates: TEMPLATES, onDeliveryFailed: (l) => failed.push(l) });
+    await ch.open();
+    const sent = await ch.send({ kind: "template", template: "acordo_quitado", language: "pt_BR", variables: ["acordo-1042"], about: { execution_id: "exe_3", state: "settled" } });
+    expect(ch.deliveryOf(sent.id)).toBe("failed");
+    expect(failed.map((l) => l.about)).toEqual([{ execution_id: "exe_3", state: "settled" }]);
+    // Every status is still in the conversation's log, in the order it arrived.
+    expect(ch.log().filter((l) => l.direction === "status").map((l) => l.state)).toEqual(["sent", "failed", "delivered"]);
+
+    backend.report({ message_id: "wamid.other", status: "read", timestamp: 3, errors: [] });
+    backend.report({ message_id: "wamid.other", status: "sent", timestamp: 1, errors: [] });
+    expect(ch.deliveryOf("wamid.other")).toBe("read");
+  });
+
   it("a status about a message an EARLIER run sent is tied back to the outcome that run recorded", async () => {
     const prior: ChannelLogLine = { at: NOW.toISOString(), direction: "out", contact: "+55*****4321", kind: "template", message_id: "wamid.old", state: "sent", about: { execution_id: "exe_old", state: "settled" } };
     const backend = new Scripted();