@cohortapp/agent-sdk 2.16.0 → 2.18.4

package/lib/cli/doctor-checks.test.mjs

@@ -1,336 +0,0 @@
-/**
- * doctor-checks.test.mjs — the pure front-door/auth/fleet checks behind
- * `maestro doctor` (lib/cli/doctor-checks.mjs) and the injected runner.
- *
- * Run: node --test lib/cli/doctor-checks.test.mjs
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
-import { probeClaude } from "../setup/claude-probe.mjs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import {
-  parseDotEnv,
-  authMode,
-  orgIdShape,
-  effectiveSource,
-  sdkGlobalInstall,
-  tailscaleSsh,
-  sessionInstalled,
-  runDoctorChecks,
-} from "./doctor-checks.mjs";
-
-// ── parseDotEnv ──────────────────────────────────────────────────────────────
-
-test("parseDotEnv: KEY=value lines, quotes stripped, comments/blanks ignored, empty values dropped", () => {
-  const env = parseDotEnv('# c\nA=1\nB="two"\nC=\'three\'\nD=\n\nexport E=5\n');
-  assert.deepEqual(env, { A: "1", B: "two", C: "three", E: "5" });
-  assert.deepEqual(parseDotEnv(""), {});
-  assert.deepEqual(parseDotEnv(null), {});
-});
-
-// ── authMode ─────────────────────────────────────────────────────────────────
-
-test("authMode: oauth-token wins, then keychain, then api-key, then none (fail)", () => {
-  const t = authMode({ CLAUDE_CODE_OAUTH_TOKEN: "x", MAESTRO_PREFER_SUBSCRIPTION_AUTH: "1", ANTHROPIC_API_KEY: "k" });
-  assert.equal(t.mode, "oauth-token");
-  assert.equal(t.level, "ok");
-  assert.match(t.msg, /OAuth token/);
-
-  const tokenOnly = authMode({ CLAUDE_CODE_OAUTH_TOKEN: "x" });
-  assert.equal(tokenOnly.mode, "oauth-token");
-  assert.equal(tokenOnly.level, "warn", "token without the prefer flag: spawns may still send ANTHROPIC_API_KEY");
-  assert.match(tokenOnly.msg, /MAESTRO_PREFER_SUBSCRIPTION_AUTH=1/);
-
-  const kc = authMode({ MAESTRO_PREFER_SUBSCRIPTION_AUTH: "1" });
-  assert.equal(kc.mode, "subscription");
-  assert.equal(kc.level, "warn", "keychain login expires headlessly — a seat machine should hold the token");
-  assert.match(kc.msg, /claude setup-token/);
-
-  const key = authMode({ ANTHROPIC_API_KEY: "sk" });
-  assert.equal(key.mode, "api-key");
-  assert.equal(key.level, "ok");
-
-  const none = authMode({});
-  assert.equal(none.mode, "none");
-  assert.equal(none.level, "fail");
-  assert.match(none.msg, /CLAUDE_CODE_OAUTH_TOKEN/);
-  assert.doesNotMatch(none.msg, /ANTHROPIC_API_KEY required/i);
-});
-
-// ── orgIdShape ───────────────────────────────────────────────────────────────
-
-test("orgIdShape: ID match ok; slug set → fail naming the right ID; unknown → shape heuristic", () => {
-  assert.equal(orgIdShape("org_default_adaptic", "org_default_adaptic", "adaptic").level, "ok");
-
-  const slug = orgIdShape("adaptic", "org_default_adaptic", "adaptic");
-  assert.equal(slug.level, "fail");
-  assert.match(slug.msg, /you set the slug/i);
-  assert.match(slug.msg, /org_default_adaptic/);
-
-  const other = orgIdShape("org_default_other", "org_default_adaptic", "adaptic");
-  assert.equal(other.level, "fail");
-  assert.match(other.msg, /does not match/i);
-
-  const unset = orgIdShape("", "org_default_adaptic", "adaptic");
-  assert.equal(unset.level, "warn");
-  assert.match(unset.msg, /not set/i);
-
-  // Server unreachable: fall back to the shape of the value alone.
-  assert.equal(orgIdShape("org_default_adaptic", "", "").level, "ok");
-  const slugShape = orgIdShape("adaptic", "", "");
-  assert.equal(slugShape.level, "warn");
-  assert.match(slugShape.msg, /looks like a slug/i);
-});
-
-// ── effectiveSource ──────────────────────────────────────────────────────────
-
-test("effectiveSource: org.yaml wins for orgId/token/base; env then .env; shadowed values are named", () => {
-  const rows = effectiveSource({
-    orgYaml: { org: { cohort: { enabled: true, base: "https://os.cohortapp.com", orgId: "org_default_acme", token: "nlk_yaml_secret" } } },
-    dotEnv: { COHORT_ORG_ID: "acme", COHORT_API_KEY: "nlk_dotenv_secret", COHORT_AGENT_ID: "A005" },
-    env: { COHORT_BASE: "https://staging.example" },
-  });
-  const by = Object.fromEntries(rows.map((r) => [r.key, r]));
-  assert.equal(by.orgId.source, "org.yaml");
-  assert.equal(by.orgId.value, "org_default_acme");
-  assert.deepEqual(by.orgId.shadowed, [".env COHORT_ORG_ID=acme"]);
-  assert.equal(by.token.source, "org.yaml");
-  assert.doesNotMatch(JSON.stringify(rows), /secret/, "token values are masked everywhere");
-  assert.deepEqual(by.token.shadowed, [".env COHORT_API_KEY=nlk_…cret"]);
-  assert.equal(by.base.source, "org.yaml");
-  assert.deepEqual(by.base.shadowed, ["env COHORT_BASE=https://staging.example"]);
-  assert.equal(by.agentId.source, ".env");
-  assert.equal(by.agentId.value, "A005");
-
-  // No org.yaml: env beats .env (dotenv never overrides an ambient var).
-  const rows2 = effectiveSource({ orgYaml: null, dotEnv: { COHORT_ORG_ID: "from-dotenv" }, env: { COHORT_ORG_ID: "from-env" } });
-  const o2 = rows2.find((r) => r.key === "orgId");
-  assert.equal(o2.source, "env");
-  assert.equal(o2.value, "from-env");
-  assert.deepEqual(o2.shadowed, [".env COHORT_ORG_ID=from-dotenv"]);
-  const none = rows2.find((r) => r.key === "token");
-  assert.equal(none.source, "none");
-});
-
-// ── sdkGlobalInstall ─────────────────────────────────────────────────────────
-
-test("sdkGlobalInstall: parses npm ls -g JSON and text, compares to npm latest", () => {
-  const json = JSON.stringify({ name: "lib", dependencies: { "@cohortapp/agent-sdk": { version: "2.11.17" } } });
-  const upToDate = sdkGlobalInstall(json, "2.11.17");
-  assert.equal(upToDate.installed, true);
-  assert.equal(upToDate.version, "2.11.17");
-  assert.equal(upToDate.level, "ok");
-
-  const behind = sdkGlobalInstall(json, "2.12.0\n");
-  assert.equal(behind.level, "warn");
-  assert.match(behind.msg, /2\.11\.17.*2\.12\.0/);
-  assert.match(behind.msg, /npm i -g @cohortapp\/agent-sdk@latest/);
-
-  const text = sdkGlobalInstall("/opt/homebrew/lib\n└── @cohortapp/agent-sdk@2.12.0\n", "2.12.0");
-  assert.equal(text.version, "2.12.0");
-  assert.equal(text.level, "ok");
-
-  const ahead = sdkGlobalInstall(json, "2.11.0");
-  assert.equal(ahead.level, "ok", "a local build ahead of npm is fine");
-
-  const missing = sdkGlobalInstall('{"name":"lib"}', "2.12.0");
-  assert.equal(missing.installed, false);
-  // WARN, not fail: every seat in the fleet today installs the SDK locally in
-  // the agent dir (autoupdate.sh `npm install … --save`); the global install
-  // arrives with upgrade() step 4 (WP-M6). A red doctor on a fully functional
-  // seat the hour 2.12.0 lands would read as an outage.
-  assert.equal(missing.level, "warn");
-  assert.match(missing.msg, /npm i -g/);
-  assert.match(missing.msg, /not installed globally/);
-
-  const offline = sdkGlobalInstall(json, "");
-  assert.equal(offline.level, "ok");
-  assert.match(offline.msg, /latest unknown/);
-});
-
-// ── tailscaleSsh ─────────────────────────────────────────────────────────────
-
-test("tailscaleSsh: prefs RunSSH is authoritative, else Self.SSH_HostKeys, else unknown", () => {
-  assert.equal(tailscaleSsh({ Self: { HostName: "h", TailscaleIPs: ["100.1.1.1"] } }, { RunSSH: true }).level, "ok");
-  const off = tailscaleSsh({ Self: { HostName: "h" } }, { RunSSH: false });
-  assert.equal(off.level, "warn");
-  assert.match(off.msg, /configure-macos\.sh --tailscale-ssh/);
-  assert.equal(tailscaleSsh({ Self: { SSH_HostKeys: ["ssh-ed25519 AAAA"] } }).level, "ok");
-  assert.equal(tailscaleSsh({ Self: { SSH_HostKeys: [] } }).level, "warn");
-  assert.equal(tailscaleSsh(JSON.stringify({ Self: { SSH_HostKeys: ["k"] } })).level, "ok");
-  const unknown = tailscaleSsh("");
-  assert.equal(unknown.level, "warn");
-  assert.match(unknown.msg, /not installed|not running/i);
-  assert.equal(tailscaleSsh("not json").level, "warn");
-});
-
-// ── sessionInstalled ─────────────────────────────────────────────────────────
-
-test("sessionInstalled: plist + loaded + fresh heartbeat → ok; each missing rung is named", () => {
-  const now = Date.parse("2026-09-08T12:00:00Z");
-  const fresh = { pid: 1, ts: "2026-09-08T11:59:45Z" };
-  const stale = { pid: 1, ts: "2026-09-08T11:00:00Z" };
-  const ok = sessionInstalled({ first: "ethan", plists: ["ai.maestro.ethan-daemon", "ai.maestro.ethan-session"], loaded: ["ai.maestro.ethan-session"], heartbeat: fresh, now });
-  assert.equal(ok.level, "ok");
-  assert.match(ok.msg, /live/);
-
-  const notInstalled = sessionInstalled({ first: "ethan", plists: ["ai.maestro.ethan-daemon"], loaded: [], heartbeat: null, now });
-  assert.equal(notInstalled.level, "warn");
-  assert.match(notInstalled.msg, /maestro session install/);
-
-  const notLoaded = sessionInstalled({ first: "ethan", plists: ["ai.maestro.ethan-session"], loaded: [], heartbeat: null, now });
-  // Plist present, not loaded, is exactly what `maestro session stop` leaves
-  // behind on purpose (launchctl bootout, plist kept) — a warn that asks, not
-  // a fail that tells the operator to undo their own stop.
-  assert.equal(notLoaded.level, "warn");
-  assert.match(notLoaded.msg, /not loaded/);
-  assert.match(notLoaded.msg, /session stop/);
-  assert.match(notLoaded.msg, /session start/);
-  assert.match(notLoaded.msg, /launchctl/);
-
-  const down = sessionInstalled({ first: "ethan", plists: ["ai.maestro.ethan-session"], loaded: ["ai.maestro.ethan-session"], heartbeat: stale, now });
-  assert.equal(down.level, "fail");
-  assert.match(down.msg, /stale/);
-  assert.match(down.msg, /daemon .*fallback/i);
-
-  const never = sessionInstalled({ first: "ethan", plists: ["ai.maestro.ethan-session"], loaded: ["ai.maestro.ethan-session"], heartbeat: null, now });
-  assert.equal(never.level, "warn");
-  assert.match(never.msg, /no heartbeat yet/);
-});
-
-// ── runDoctorChecks (injected edges) ─────────────────────────────────────────
-
-function agentRoot({ env = "", orgYaml = "", agentJson = { firstName: "Ethan" } } = {}) {
-  const root = mkdtempSync(join(tmpdir(), "doctor-checks-"));
-  mkdirSync(join(root, "config"), { recursive: true });
-  writeFileSync(join(root, "config", "agent.json"), JSON.stringify(agentJson));
-  if (env) writeFileSync(join(root, ".env"), env);
-  if (orgYaml) writeFileSync(join(root, "config", "org.yaml"), orgYaml);
-  return root;
-}
-
-test("runDoctorChecks: the happy seat — token auth, ID matches, session live, SDK current, SSH on", async () => {
-  const root = agentRoot({
-    env: "CLAUDE_CODE_OAUTH_TOKEN=tok\nMAESTRO_PREFER_SUBSCRIPTION_AUTH=1\n",
-    orgYaml: "org:\n  cohort:\n    enabled: true\n    base: https://os.cohortapp.com\n    orgId: org_default_acme\n    token: nlk_x\n",
-  });
-  try {
-    mkdirSync(join(root, "state", "session"), { recursive: true });
-    writeFileSync(join(root, "state", "session", "heartbeat.json"), JSON.stringify({ pid: 1, ts: "2026-09-08T11:59:50Z" }));
-    const calls = [];
-    const rows = await runDoctorChecks({
-      cwd: root,
-      env: { PATH: "/usr/bin" },
-      now: Date.parse("2026-09-08T12:00:00Z"),
-      probeClaude: () => ({ ok: true, mode: "subscription", auth: "ok", verified: false, name: "Claude auth (subscription — OAuth token)", detail: "CLI reports a login for the token; the token itself is only proven by a real spawn" }),
-      exec: (cmd, args) => {
-        calls.push([cmd, ...args].join(" "));
-        if (cmd === "npm" && args[0] === "ls") return JSON.stringify({ dependencies: { "@cohortapp/agent-sdk": { version: "2.12.0" } } });
-        if (cmd === "npm" && args[0] === "view") return "2.12.0\n";
-        if (/tailscale/i.test(cmd) && args[0] === "status") return JSON.stringify({ Self: { HostName: "h" } });
-        if (/tailscale/i.test(cmd) && args[0] === "debug") return JSON.stringify({ RunSSH: true });
-        if (cmd === "launchctl") return "-\t0\tai.maestro.ethan-session\n";
-        if (cmd === "which") return `/opt/homebrew/bin/${args[0]}\n`;
-        return "";
-      },
-      listPlists: () => ["ai.maestro.ethan-daemon.plist", "ai.maestro.ethan-session.plist"],
-      fetchImpl: async () => ({ ok: true, status: 200, headers: { get: () => undefined }, json: async () => ({ ok: true, result: { orgs: [{ id: "org_default_acme", slug: "acme", isActive: true }] } }) }),
-    });
-    const text = rows.map((r) => `${r.level}: ${r.msg}`).join("\n");
-    assert.ok(rows.every((r) => r.level !== "fail"), text);
-    assert.match(text, /OAuth token/);
-    // The probe cannot validate a token: the row says what the CLI REPORTS, never "verified".
-    assert.match(text, /ok: Claude auth \(subscription — OAuth token\): CLI reports a login/);
-    assert.doesNotMatch(text, /: verified/);
-    assert.match(text, /COHORT_ORG_ID.*org_default_acme/);
-    assert.match(text, /orgId .*org\.yaml/);
-    assert.match(text, /agent-sdk 2\.12\.0/);
-    assert.match(text, /Tailscale SSH/);
-    assert.match(text, /session.*live/i);
-    assert.ok(calls.some((c) => c.startsWith("npm ls -g @cohortapp/agent-sdk")), calls.join("\n"));
-    assert.ok(!text.includes("nlk_x"), "the token never appears in doctor output");
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("runDoctorChecks: the slug trap — org.list is asked WITHOUT the org pin, and the answer names the ID", async () => {
-  const root = agentRoot({
-    env: "ANTHROPIC_API_KEY=sk\nCOHORT_ORG_ID=acme\nCOHORT_API_KEY=nlk_y\nCOHORT_BASE=https://os.cohortapp.com\n",
-  });
-  try {
-    const seen = [];
-    const rows = await runDoctorChecks({
-      cwd: root,
-      env: { PATH: "/usr/bin" },
-      now: Date.now(),
-      probeClaude: () => ({ ok: true, mode: "api-key", auth: "ok", name: "Claude API reachable (api-key)" }),
-      exec: () => { throw Object.assign(new Error("ENOENT"), { code: "ENOENT" }); },
-      listPlists: () => [],
-      fetchImpl: async (url, init) => {
-        seen.push({ url: String(url), headers: init.headers });
-        return { ok: true, status: 200, headers: { get: () => undefined }, json: async () => ({ ok: true, result: { orgs: [{ id: "org_default_acme", slug: "acme", isActive: true }] } }) };
-      },
-    });
-    assert.equal(seen.length, 1);
-    assert.match(seen[0].url, /org\.list$/);
-    assert.equal(seen[0].headers["x-org-id"], undefined, "a slug pin would 401 the very probe that diagnoses it");
-    const text = rows.map((r) => `${r.level}: ${r.msg}`).join("\n");
-    assert.match(text, /fail: .*you set the slug/i);
-    assert.match(text, /org_default_acme/);
-    // Effective sources: no org.yaml → .env rows.
-    assert.match(text, /orgId .*\.env/);
-    // Edges that are absent degrade to warn, never throw.
-    assert.match(text, /warn: .*not installed globally|warn: .*npm ls/i);
-    assert.match(text, /warn: .*Tailscale/);
-    assert.match(text, /warn: .*maestro session install/);
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("runDoctorChecks: not enrolled → the org-id check is skipped with a note, never a network call", async () => {
-  const root = agentRoot({ env: "CLAUDE_CODE_OAUTH_TOKEN=t\nMAESTRO_PREFER_SUBSCRIPTION_AUTH=1\n" });
-  try {
-    let fetched = 0;
-    const rows = await runDoctorChecks({
-      cwd: root, env: {}, now: Date.now(),
-      probeClaude: () => ({ ok: true, auth: "unknown", mode: "subscription", name: "Claude auth", detail: "could not verify" }),
-      exec: () => "", listPlists: () => [],
-      fetchImpl: async () => { fetched += 1; return { ok: false, status: 500, headers: { get: () => undefined }, json: async () => ({}) }; },
-    });
-    assert.equal(fetched, 0);
-    const text = rows.map((r) => `${r.level}: ${r.msg}`).join("\n");
-    assert.match(text, /not enrolled/i);
-    assert.match(text, /could not verify/);
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("runDoctorChecks: a VERIFIED probe (api-key 200) says verified; a token that lives only in the ambient env yields two consistent rows", async () => {
-  const root = agentRoot({ env: "ANTHROPIC_API_KEY=sk\n" });
-  try {
-    const rows = await runDoctorChecks({
-      cwd: root, env: {}, now: Date.now(),
-      probeClaude: () => ({ ok: true, mode: "api-key", auth: "ok", verified: true, name: "Claude API reachable (api-key)" }),
-      exec: () => "", listPlists: () => [], fetchImpl: async () => ({ ok: false, status: 500, headers: { get: () => undefined }, json: async () => ({}) }),
-    });
-    const text = rows.map((r) => `${r.level}: ${r.msg}`).join("\n");
-    assert.match(text, /ok: Claude API reachable \(api-key\): verified/);
-  } finally { rmSync(root, { recursive: true, force: true }); }
-  // No .env at all; the token arrives through launchd's environment (the headless runbook path).
-  const bare = agentRoot({});
-  try {
-    const seen = [];
-    const rows = await runDoctorChecks({
-      cwd: bare, env: { CLAUDE_CODE_OAUTH_TOKEN: "tok-from-launchd", MAESTRO_PREFER_SUBSCRIPTION_AUTH: "1" }, now: Date.now(),
-      probeClaude: (agentRoot, opts) => { seen.push(opts); return probeClaude(agentRoot, { ...opts, exec: () => '{"loggedIn":true,"authMethod":"oauth_token"}', claudeBin: "/fake/claude" }); },
-      exec: () => "", listPlists: () => [], fetchImpl: async () => ({ ok: false, status: 500, headers: { get: () => undefined }, json: async () => ({}) }),
-    });
-    const text = rows.map((r) => `${r.level}: ${r.msg}`).join("\n");
-    assert.match(text, /ok: Claude auth: subscription OAuth token/);
-    assert.match(text, /ok: Claude auth \(subscription — OAuth token\): CLI reports a login/);
-    assert.doesNotMatch(text, /fail:/, "the mode row and the probe row read the same env and cannot contradict each other");
-    assert.equal(seen[0].env.CLAUDE_CODE_OAUTH_TOKEN, "tok-from-launchd", "doctor hands the probe the same ambient env it judged the mode from");
-  } finally { rmSync(bare, { recursive: true, force: true }); }
-});