@cohortapp/agent-sdk 2.11.15 → 2.13.0

package/lib/cli/doctor-checks.test.mjs

@@ -0,0 +1,336 @@
+/**
+ * doctor-checks.test.mjs — the pure front-door/auth/fleet checks behind
+ * `maestro doctor` (lib/cli/doctor-checks.mjs) and the injected runner.
+ *
+ * Run: node --test lib/cli/doctor-checks.test.mjs
+ */
+"use strict";
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { probeClaude } from "../setup/claude-probe.mjs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import {
+  parseDotEnv,
+  authMode,
+  orgIdShape,
+  effectiveSource,
+  sdkGlobalInstall,
+  tailscaleSsh,
+  sessionInstalled,
+  runDoctorChecks,
+} from "./doctor-checks.mjs";
+
+// ── parseDotEnv ──────────────────────────────────────────────────────────────
+
+test("parseDotEnv: KEY=value lines, quotes stripped, comments/blanks ignored, empty values dropped", () => {
+  const env = parseDotEnv('# c\nA=1\nB="two"\nC=\'three\'\nD=\n\nexport E=5\n');
+  assert.deepEqual(env, { A: "1", B: "two", C: "three", E: "5" });
+  assert.deepEqual(parseDotEnv(""), {});
+  assert.deepEqual(parseDotEnv(null), {});
+});
+
+// ── authMode ─────────────────────────────────────────────────────────────────
+
+test("authMode: oauth-token wins, then keychain, then api-key, then none (fail)", () => {
+  const t = authMode({ CLAUDE_CODE_OAUTH_TOKEN: "x", MAESTRO_PREFER_SUBSCRIPTION_AUTH: "1", ANTHROPIC_API_KEY: "k" });
+  assert.equal(t.mode, "oauth-token");
+  assert.equal(t.level, "ok");
+  assert.match(t.msg, /OAuth token/);
+
+  const tokenOnly = authMode({ CLAUDE_CODE_OAUTH_TOKEN: "x" });
+  assert.equal(tokenOnly.mode, "oauth-token");
+  assert.equal(tokenOnly.level, "warn", "token without the prefer flag: spawns may still send ANTHROPIC_API_KEY");
+  assert.match(tokenOnly.msg, /MAESTRO_PREFER_SUBSCRIPTION_AUTH=1/);
+
+  const kc = authMode({ MAESTRO_PREFER_SUBSCRIPTION_AUTH: "1" });
+  assert.equal(kc.mode, "subscription");
+  assert.equal(kc.level, "warn", "keychain login expires headlessly — a seat machine should hold the token");
+  assert.match(kc.msg, /claude setup-token/);
+
+  const key = authMode({ ANTHROPIC_API_KEY: "sk" });
+  assert.equal(key.mode, "api-key");
+  assert.equal(key.level, "ok");
+
+  const none = authMode({});
+  assert.equal(none.mode, "none");
+  assert.equal(none.level, "fail");
+  assert.match(none.msg, /CLAUDE_CODE_OAUTH_TOKEN/);
+  assert.doesNotMatch(none.msg, /ANTHROPIC_API_KEY required/i);
+});
+
+// ── orgIdShape ───────────────────────────────────────────────────────────────
+
+test("orgIdShape: ID match ok; slug set → fail naming the right ID; unknown → shape heuristic", () => {
+  assert.equal(orgIdShape("org_default_adaptic", "org_default_adaptic", "adaptic").level, "ok");
+
+  const slug = orgIdShape("adaptic", "org_default_adaptic", "adaptic");
+  assert.equal(slug.level, "fail");
+  assert.match(slug.msg, /you set the slug/i);
+  assert.match(slug.msg, /org_default_adaptic/);
+
+  const other = orgIdShape("org_default_other", "org_default_adaptic", "adaptic");
+  assert.equal(other.level, "fail");
+  assert.match(other.msg, /does not match/i);
+
+  const unset = orgIdShape("", "org_default_adaptic", "adaptic");
+  assert.equal(unset.level, "warn");
+  assert.match(unset.msg, /not set/i);
+
+  // Server unreachable: fall back to the shape of the value alone.
+  assert.equal(orgIdShape("org_default_adaptic", "", "").level, "ok");
+  const slugShape = orgIdShape("adaptic", "", "");
+  assert.equal(slugShape.level, "warn");
+  assert.match(slugShape.msg, /looks like a slug/i);
+});
+
+// ── effectiveSource ──────────────────────────────────────────────────────────
+
+test("effectiveSource: org.yaml wins for orgId/token/base; env then .env; shadowed values are named", () => {
+  const rows = effectiveSource({
+    orgYaml: { org: { cohort: { enabled: true, base: "https://os.cohortapp.com", orgId: "org_default_acme", token: "nlk_yaml_secret" } } },
+    dotEnv: { COHORT_ORG_ID: "acme", COHORT_API_KEY: "nlk_dotenv_secret", COHORT_AGENT_ID: "A005" },
+    env: { COHORT_BASE: "https://staging.example" },
+  });
+  const by = Object.fromEntries(rows.map((r) => [r.key, r]));
+  assert.equal(by.orgId.source, "org.yaml");
+  assert.equal(by.orgId.value, "org_default_acme");
+  assert.deepEqual(by.orgId.shadowed, [".env COHORT_ORG_ID=acme"]);
+  assert.equal(by.token.source, "org.yaml");
+  assert.doesNotMatch(JSON.stringify(rows), /secret/, "token values are masked everywhere");
+  assert.deepEqual(by.token.shadowed, [".env COHORT_API_KEY=nlk_…cret"]);
+  assert.equal(by.base.source, "org.yaml");
+  assert.deepEqual(by.base.shadowed, ["env COHORT_BASE=https://staging.example"]);
+  assert.equal(by.agentId.source, ".env");
+  assert.equal(by.agentId.value, "A005");
+
+  // No org.yaml: env beats .env (dotenv never overrides an ambient var).
+  const rows2 = effectiveSource({ orgYaml: null, dotEnv: { COHORT_ORG_ID: "from-dotenv" }, env: { COHORT_ORG_ID: "from-env" } });
+  const o2 = rows2.find((r) => r.key === "orgId");
+  assert.equal(o2.source, "env");
+  assert.equal(o2.value, "from-env");
+  assert.deepEqual(o2.shadowed, [".env COHORT_ORG_ID=from-dotenv"]);
+  const none = rows2.find((r) => r.key === "token");
+  assert.equal(none.source, "none");
+});
+
+// ── sdkGlobalInstall ─────────────────────────────────────────────────────────
+
+test("sdkGlobalInstall: parses npm ls -g JSON and text, compares to npm latest", () => {
+  const json = JSON.stringify({ name: "lib", dependencies: { "@cohortapp/agent-sdk": { version: "2.11.17" } } });
+  const upToDate = sdkGlobalInstall(json, "2.11.17");
+  assert.equal(upToDate.installed, true);
+  assert.equal(upToDate.version, "2.11.17");
+  assert.equal(upToDate.level, "ok");
+
+  const behind = sdkGlobalInstall(json, "2.12.0\n");
+  assert.equal(behind.level, "warn");
+  assert.match(behind.msg, /2\.11\.17.*2\.12\.0/);
+  assert.match(behind.msg, /npm i -g @cohortapp\/agent-sdk@latest/);
+
+  const text = sdkGlobalInstall("/opt/homebrew/lib\n└── @cohortapp/agent-sdk@2.12.0\n", "2.12.0");
+  assert.equal(text.version, "2.12.0");
+  assert.equal(text.level, "ok");
+
+  const ahead = sdkGlobalInstall(json, "2.11.0");
+  assert.equal(ahead.level, "ok", "a local build ahead of npm is fine");
+
+  const missing = sdkGlobalInstall('{"name":"lib"}', "2.12.0");
+  assert.equal(missing.installed, false);
+  // WARN, not fail: every seat in the fleet today installs the SDK locally in
+  // the agent dir (autoupdate.sh `npm install … --save`); the global install
+  // arrives with upgrade() step 4 (WP-M6). A red doctor on a fully functional
+  // seat the hour 2.12.0 lands would read as an outage.
+  assert.equal(missing.level, "warn");
+  assert.match(missing.msg, /npm i -g/);
+  assert.match(missing.msg, /not installed globally/);
+
+  const offline = sdkGlobalInstall(json, "");
+  assert.equal(offline.level, "ok");
+  assert.match(offline.msg, /latest unknown/);
+});
+
+// ── tailscaleSsh ─────────────────────────────────────────────────────────────
+
+test("tailscaleSsh: prefs RunSSH is authoritative, else Self.SSH_HostKeys, else unknown", () => {
+  assert.equal(tailscaleSsh({ Self: { HostName: "h", TailscaleIPs: ["100.1.1.1"] } }, { RunSSH: true }).level, "ok");
+  const off = tailscaleSsh({ Self: { HostName: "h" } }, { RunSSH: false });
+  assert.equal(off.level, "warn");
+  assert.match(off.msg, /configure-macos\.sh --tailscale-ssh/);
+  assert.equal(tailscaleSsh({ Self: { SSH_HostKeys: ["ssh-ed25519 AAAA"] } }).level, "ok");
+  assert.equal(tailscaleSsh({ Self: { SSH_HostKeys: [] } }).level, "warn");
+  assert.equal(tailscaleSsh(JSON.stringify({ Self: { SSH_HostKeys: ["k"] } })).level, "ok");
+  const unknown = tailscaleSsh("");
+  assert.equal(unknown.level, "warn");
+  assert.match(unknown.msg, /not installed|not running/i);
+  assert.equal(tailscaleSsh("not json").level, "warn");
+});
+
+// ── sessionInstalled ─────────────────────────────────────────────────────────
+
+test("sessionInstalled: plist + loaded + fresh heartbeat → ok; each missing rung is named", () => {
+  const now = Date.parse("2026-09-08T12:00:00Z");
+  const fresh = { pid: 1, ts: "2026-09-08T11:59:45Z" };
+  const stale = { pid: 1, ts: "2026-09-08T11:00:00Z" };
+  const ok = sessionInstalled({ first: "ethan", plists: ["ai.maestro.ethan-daemon", "ai.maestro.ethan-session"], loaded: ["ai.maestro.ethan-session"], heartbeat: fresh, now });
+  assert.equal(ok.level, "ok");
+  assert.match(ok.msg, /live/);
+
+  const notInstalled = sessionInstalled({ first: "ethan", plists: ["ai.maestro.ethan-daemon"], loaded: [], heartbeat: null, now });
+  assert.equal(notInstalled.level, "warn");
+  assert.match(notInstalled.msg, /maestro session install/);
+
+  const notLoaded = sessionInstalled({ first: "ethan", plists: ["ai.maestro.ethan-session"], loaded: [], heartbeat: null, now });
+  // Plist present, not loaded, is exactly what `maestro session stop` leaves
+  // behind on purpose (launchctl bootout, plist kept) — a warn that asks, not
+  // a fail that tells the operator to undo their own stop.
+  assert.equal(notLoaded.level, "warn");
+  assert.match(notLoaded.msg, /not loaded/);
+  assert.match(notLoaded.msg, /session stop/);
+  assert.match(notLoaded.msg, /session start/);
+  assert.match(notLoaded.msg, /launchctl/);
+
+  const down = sessionInstalled({ first: "ethan", plists: ["ai.maestro.ethan-session"], loaded: ["ai.maestro.ethan-session"], heartbeat: stale, now });
+  assert.equal(down.level, "fail");
+  assert.match(down.msg, /stale/);
+  assert.match(down.msg, /daemon .*fallback/i);
+
+  const never = sessionInstalled({ first: "ethan", plists: ["ai.maestro.ethan-session"], loaded: ["ai.maestro.ethan-session"], heartbeat: null, now });
+  assert.equal(never.level, "warn");
+  assert.match(never.msg, /no heartbeat yet/);
+});
+
+// ── runDoctorChecks (injected edges) ─────────────────────────────────────────
+
+function agentRoot({ env = "", orgYaml = "", agentJson = { firstName: "Ethan" } } = {}) {
+  const root = mkdtempSync(join(tmpdir(), "doctor-checks-"));
+  mkdirSync(join(root, "config"), { recursive: true });
+  writeFileSync(join(root, "config", "agent.json"), JSON.stringify(agentJson));
+  if (env) writeFileSync(join(root, ".env"), env);
+  if (orgYaml) writeFileSync(join(root, "config", "org.yaml"), orgYaml);
+  return root;
+}
+
+test("runDoctorChecks: the happy seat — token auth, ID matches, session live, SDK current, SSH on", async () => {
+  const root = agentRoot({
+    env: "CLAUDE_CODE_OAUTH_TOKEN=tok\nMAESTRO_PREFER_SUBSCRIPTION_AUTH=1\n",
+    orgYaml: "org:\n  cohort:\n    enabled: true\n    base: https://os.cohortapp.com\n    orgId: org_default_acme\n    token: nlk_x\n",
+  });
+  try {
+    mkdirSync(join(root, "state", "session"), { recursive: true });
+    writeFileSync(join(root, "state", "session", "heartbeat.json"), JSON.stringify({ pid: 1, ts: "2026-09-08T11:59:50Z" }));
+    const calls = [];
+    const rows = await runDoctorChecks({
+      cwd: root,
+      env: { PATH: "/usr/bin" },
+      now: Date.parse("2026-09-08T12:00:00Z"),
+      probeClaude: () => ({ ok: true, mode: "subscription", auth: "ok", verified: false, name: "Claude auth (subscription — OAuth token)", detail: "CLI reports a login for the token; the token itself is only proven by a real spawn" }),
+      exec: (cmd, args) => {
+        calls.push([cmd, ...args].join(" "));
+        if (cmd === "npm" && args[0] === "ls") return JSON.stringify({ dependencies: { "@cohortapp/agent-sdk": { version: "2.12.0" } } });
+        if (cmd === "npm" && args[0] === "view") return "2.12.0\n";
+        if (/tailscale/i.test(cmd) && args[0] === "status") return JSON.stringify({ Self: { HostName: "h" } });
+        if (/tailscale/i.test(cmd) && args[0] === "debug") return JSON.stringify({ RunSSH: true });
+        if (cmd === "launchctl") return "-\t0\tai.maestro.ethan-session\n";
+        if (cmd === "which") return `/opt/homebrew/bin/${args[0]}\n`;
+        return "";
+      },
+      listPlists: () => ["ai.maestro.ethan-daemon.plist", "ai.maestro.ethan-session.plist"],
+      fetchImpl: async () => ({ ok: true, status: 200, headers: { get: () => undefined }, json: async () => ({ ok: true, result: { orgs: [{ id: "org_default_acme", slug: "acme", isActive: true }] } }) }),
+    });
+    const text = rows.map((r) => `${r.level}: ${r.msg}`).join("\n");
+    assert.ok(rows.every((r) => r.level !== "fail"), text);
+    assert.match(text, /OAuth token/);
+    // The probe cannot validate a token: the row says what the CLI REPORTS, never "verified".
+    assert.match(text, /ok: Claude auth \(subscription — OAuth token\): CLI reports a login/);
+    assert.doesNotMatch(text, /: verified/);
+    assert.match(text, /COHORT_ORG_ID.*org_default_acme/);
+    assert.match(text, /orgId .*org\.yaml/);
+    assert.match(text, /agent-sdk 2\.12\.0/);
+    assert.match(text, /Tailscale SSH/);
+    assert.match(text, /session.*live/i);
+    assert.ok(calls.some((c) => c.startsWith("npm ls -g @cohortapp/agent-sdk")), calls.join("\n"));
+    assert.ok(!text.includes("nlk_x"), "the token never appears in doctor output");
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+test("runDoctorChecks: the slug trap — org.list is asked WITHOUT the org pin, and the answer names the ID", async () => {
+  const root = agentRoot({
+    env: "ANTHROPIC_API_KEY=sk\nCOHORT_ORG_ID=acme\nCOHORT_API_KEY=nlk_y\nCOHORT_BASE=https://os.cohortapp.com\n",
+  });
+  try {
+    const seen = [];
+    const rows = await runDoctorChecks({
+      cwd: root,
+      env: { PATH: "/usr/bin" },
+      now: Date.now(),
+      probeClaude: () => ({ ok: true, mode: "api-key", auth: "ok", name: "Claude API reachable (api-key)" }),
+      exec: () => { throw Object.assign(new Error("ENOENT"), { code: "ENOENT" }); },
+      listPlists: () => [],
+      fetchImpl: async (url, init) => {
+        seen.push({ url: String(url), headers: init.headers });
+        return { ok: true, status: 200, headers: { get: () => undefined }, json: async () => ({ ok: true, result: { orgs: [{ id: "org_default_acme", slug: "acme", isActive: true }] } }) };
+      },
+    });
+    assert.equal(seen.length, 1);
+    assert.match(seen[0].url, /org\.list$/);
+    assert.equal(seen[0].headers["x-org-id"], undefined, "a slug pin would 401 the very probe that diagnoses it");
+    const text = rows.map((r) => `${r.level}: ${r.msg}`).join("\n");
+    assert.match(text, /fail: .*you set the slug/i);
+    assert.match(text, /org_default_acme/);
+    // Effective sources: no org.yaml → .env rows.
+    assert.match(text, /orgId .*\.env/);
+    // Edges that are absent degrade to warn, never throw.
+    assert.match(text, /warn: .*not installed globally|warn: .*npm ls/i);
+    assert.match(text, /warn: .*Tailscale/);
+    assert.match(text, /warn: .*maestro session install/);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+test("runDoctorChecks: not enrolled → the org-id check is skipped with a note, never a network call", async () => {
+  const root = agentRoot({ env: "CLAUDE_CODE_OAUTH_TOKEN=t\nMAESTRO_PREFER_SUBSCRIPTION_AUTH=1\n" });
+  try {
+    let fetched = 0;
+    const rows = await runDoctorChecks({
+      cwd: root, env: {}, now: Date.now(),
+      probeClaude: () => ({ ok: true, auth: "unknown", mode: "subscription", name: "Claude auth", detail: "could not verify" }),
+      exec: () => "", listPlists: () => [],
+      fetchImpl: async () => { fetched += 1; return { ok: false, status: 500, headers: { get: () => undefined }, json: async () => ({}) }; },
+    });
+    assert.equal(fetched, 0);
+    const text = rows.map((r) => `${r.level}: ${r.msg}`).join("\n");
+    assert.match(text, /not enrolled/i);
+    assert.match(text, /could not verify/);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+test("runDoctorChecks: a VERIFIED probe (api-key 200) says verified; a token that lives only in the ambient env yields two consistent rows", async () => {
+  const root = agentRoot({ env: "ANTHROPIC_API_KEY=sk\n" });
+  try {
+    const rows = await runDoctorChecks({
+      cwd: root, env: {}, now: Date.now(),
+      probeClaude: () => ({ ok: true, mode: "api-key", auth: "ok", verified: true, name: "Claude API reachable (api-key)" }),
+      exec: () => "", listPlists: () => [], fetchImpl: async () => ({ ok: false, status: 500, headers: { get: () => undefined }, json: async () => ({}) }),
+    });
+    const text = rows.map((r) => `${r.level}: ${r.msg}`).join("\n");
+    assert.match(text, /ok: Claude API reachable \(api-key\): verified/);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+  // No .env at all; the token arrives through launchd's environment (the headless runbook path).
+  const bare = agentRoot({});
+  try {
+    const seen = [];
+    const rows = await runDoctorChecks({
+      cwd: bare, env: { CLAUDE_CODE_OAUTH_TOKEN: "tok-from-launchd", MAESTRO_PREFER_SUBSCRIPTION_AUTH: "1" }, now: Date.now(),
+      probeClaude: (agentRoot, opts) => { seen.push(opts); return probeClaude(agentRoot, { ...opts, exec: () => '{"loggedIn":true,"authMethod":"oauth_token"}', claudeBin: "/fake/claude" }); },
+      exec: () => "", listPlists: () => [], fetchImpl: async () => ({ ok: false, status: 500, headers: { get: () => undefined }, json: async () => ({}) }),
+    });
+    const text = rows.map((r) => `${r.level}: ${r.msg}`).join("\n");
+    assert.match(text, /ok: Claude auth: subscription OAuth token/);
+    assert.match(text, /ok: Claude auth \(subscription — OAuth token\): CLI reports a login/);
+    assert.doesNotMatch(text, /fail:/, "the mode row and the probe row read the same env and cannot contradict each other");
+    assert.equal(seen[0].env.CLAUDE_CODE_OAUTH_TOKEN, "tok-from-launchd", "doctor hands the probe the same ambient env it judged the mode from");
+  } finally { rmSync(bare, { recursive: true, force: true }); }
+});