@cohortapp/agent-sdk 2.17.0 → 2.18.5

package/lib/org/verify.test.mjs

@@ -1,194 +0,0 @@
-/**
- * verify.test.mjs — detective layer: pinned-signer snapshot verification +
- * event-chain re-derivation + quarantine (no-throw) semantics.
- * Run: node --test lib/org/verify.test.mjs
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import { createPublicKey } from "node:crypto";
-
-import { verifySnapshot, verifyEvents, quarantine, sshEd25519ToSpkiPem } from "./verify.mjs";
-import { canonicalize, computeRowHash } from "./protocol.mjs";
-import { generateDeviceKey, signWith, verifySignature } from "./keys.mjs";
-
-/** Encode an Ed25519 SPKI PEM into the OpenSSH `ssh-ed25519 <base64>` blob. */
-function spkiToSshEd25519(spkiPem) {
-  const der = createPublicKey(spkiPem).export({ type: "spki", format: "der" });
-  const raw = der.subarray(12); // 12-byte Ed25519 SPKI prefix, then 32 raw bytes
-  const sshStr = (buf) => {
-    const len = Buffer.alloc(4); len.writeUInt32BE(buf.length);
-    return Buffer.concat([len, buf]);
-  };
-  const blob = Buffer.concat([sshStr(Buffer.from("ssh-ed25519")), sshStr(raw)]);
-  return blob.toString("base64");
-}
-
-// --- helpers ---------------------------------------------------------------
-
-/** Sign a snapshot body the SAME way verify expects (canonical body w/o sig). */
-function signSnapshot(privateKeyPem, body) {
-  const material = Buffer.from(canonicalize(body));
-  return { ...body, sig: signWith(privateKeyPem, material) };
-}
-
-/** Build a valid chain of N events from genesis. */
-function buildChain(n) {
-  const events = [];
-  let prev = "";
-  for (let i = 0; i < n; i++) {
-    const row = {
-      seq: i + 1,
-      family: "board",
-      kind: "create",
-      entity_id: `item-${i}`,
-      actor: "agent-a",
-      at: `2026-06-10T00:00:0${i}.000Z`,
-      payload: { i },
-    };
-    const row_hash = computeRowHash(prev, row);
-    events.push({ ...row, prev_hash: prev, row_hash });
-    prev = row_hash;
-  }
-  return events;
-}
-
-// --- verifySnapshot --------------------------------------------------------
-
-test("verifySnapshot: accepts a snapshot signed by a pinned signer", () => {
-  const server = generateDeviceKey();
-  const snap = signSnapshot(server.privateKeyPem, { orgId: "acme", agents: [{ id: "a" }], seq: 7 });
-  const v = verifySnapshot(snap, [server.publicKeyPem]);
-  assert.equal(v.ok, true);
-  assert.equal(v.signer, server.publicKeyPem);
-});
-
-test("verifySnapshot: rejects when signer NOT in pinned list (forgery)", () => {
-  const evil = generateDeviceKey();
-  const pinned = generateDeviceKey();
-  const snap = signSnapshot(evil.privateKeyPem, { orgId: "acme", agents: [] });
-  const v = verifySnapshot(snap, [pinned.publicKeyPem]);
-  assert.equal(v.ok, false);
-  assert.match(v.reason, /pinned signer/);
-});
-
-test("verifySnapshot: rejects a tampered body (sig no longer matches)", () => {
-  const server = generateDeviceKey();
-  const snap = signSnapshot(server.privateKeyPem, { orgId: "acme", agents: [{ id: "a" }] });
-  snap.agents.push({ id: "injected" }); // mutate after signing
-  const v = verifySnapshot(snap, [server.publicKeyPem]);
-  assert.equal(v.ok, false);
-});
-
-test("verifySnapshot: default-deny when no pinned signers", () => {
-  const server = generateDeviceKey();
-  const snap = signSnapshot(server.privateKeyPem, { orgId: "acme" });
-  assert.equal(verifySnapshot(snap, []).ok, false);
-  assert.equal(verifySnapshot(snap, null).ok, false);
-});
-
-test("verifySnapshot: rejects unsigned / malformed snapshot", () => {
-  const server = generateDeviceKey();
-  assert.equal(verifySnapshot({ orgId: "x" }, [server.publicKeyPem]).ok, false);
-  assert.equal(verifySnapshot(null, [server.publicKeyPem]).ok, false);
-});
-
-test("verifySnapshot: tries multiple pinned signers (key rotation window)", () => {
-  const oldKey = generateDeviceKey();
-  const newKey = generateDeviceKey();
-  const snap = signSnapshot(newKey.privateKeyPem, { orgId: "acme" });
-  const v = verifySnapshot(snap, [oldKey.publicKeyPem, newKey.publicKeyPem]);
-  assert.equal(v.ok, true);
-});
-
-// --- verifyEvents ----------------------------------------------------------
-
-test("verifyEvents: accepts a valid chain from genesis", () => {
-  const events = buildChain(5);
-  assert.deepEqual(verifyEvents(events, ""), { ok: true });
-});
-
-test("verifyEvents: catches a rewritten payload at the right index", () => {
-  const events = buildChain(4);
-  events[2].payload = { i: 999 }; // rewrite without re-hashing
-  const v = verifyEvents(events, "");
-  assert.equal(v.ok, false);
-  assert.equal(v.index, 2);
-  assert.match(v.reason, /row_hash/);
-});
-
-test("verifyEvents: catches a reordered/broken prev link", () => {
-  const events = buildChain(3);
-  events[1].prev_hash = "deadbeef";
-  const v = verifyEvents(events, "");
-  assert.equal(v.ok, false);
-  assert.equal(v.index, 1);
-  assert.match(v.reason, /prev_hash/);
-});
-
-test("verifyEvents: honours a non-genesis startPrev", () => {
-  const all = buildChain(5);
-  const slice = all.slice(2); // events 3..5
-  const startPrev = all[1].row_hash;
-  assert.deepEqual(verifyEvents(slice, startPrev), { ok: true });
-  // wrong startPrev → first link breaks
-  assert.equal(verifyEvents(slice, "wrong").ok, false);
-});
-
-test("verifyEvents: non-array input → quarantine verdict, no throw", () => {
-  const v = verifyEvents(null, "");
-  assert.equal(v.ok, false);
-  assert.match(v.reason, /array/);
-});
-
-// --- quarantine ------------------------------------------------------------
-
-test("quarantine: passes through a verdict", () => {
-  assert.deepEqual(quarantine(() => ({ ok: true })), { ok: true });
-  assert.deepEqual(quarantine(() => ({ ok: false, reason: "x" })), { ok: false, reason: "x" });
-});
-
-test("quarantine: converts a throw into {ok:false}", () => {
-  const v = quarantine(() => { throw new Error("hostile payload"); });
-  assert.equal(v.ok, false);
-  assert.match(v.reason, /hostile payload/);
-});
-
-test("quarantine: rejects a non-verdict return", () => {
-  assert.equal(quarantine(() => 42).ok, false);
-});
-
-// --- sshEd25519ToSpkiPem (the SPEC-format trust-root loader) ----------------
-
-test("sshEd25519ToSpkiPem: round-trips an SSH one-liner back to the exact SPKI PEM", () => {
-  const key = generateDeviceKey();
-  const sshBlob = spkiToSshEd25519(key.publicKeyPem);
-  // bare base64 blob
-  const fromBlob = sshEd25519ToSpkiPem(sshBlob);
-  assert.equal(createPublicKey(fromBlob).export({ type: "spki", format: "pem" }).toString(),
-    createPublicKey(key.publicKeyPem).export({ type: "spki", format: "pem" }).toString(),
-    "the reconstructed SPKI PEM matches the original key");
-  // a full allowed-signers / authorized line
-  const fromLine = sshEd25519ToSpkiPem(`alice@example.com namespaces="org" ssh-ed25519 ${sshBlob} comment`);
-  assert.ok(fromLine, "parses a full allowed-signers line");
-  // a signature made with the private key verifies against the reconstructed PEM.
-  const msg = Buffer.from("policy-bundle-bytes");
-  const sigB64 = signWith(key.privateKeyPem, msg);
-  assert.equal(verifySignature(fromBlob, msg, sigB64), true, "signature verifies against the converted PEM");
-  assert.equal(verifySignature(fromLine, msg, sigB64), true);
-});
-
-test("sshEd25519ToSpkiPem: returns null on malformed / non-ed25519 input", () => {
-  assert.equal(sshEd25519ToSpkiPem(""), null);
-  assert.equal(sshEd25519ToSpkiPem(null), null);
-  assert.equal(sshEd25519ToSpkiPem("not-base64-!!!"), null);
-  // a valid base64 but wrong key type (ssh-rsa) blob → null
-  const sshStr = (buf) => { const l = Buffer.alloc(4); l.writeUInt32BE(buf.length); return Buffer.concat([l, buf]); };
-  const rsaBlob = Buffer.concat([sshStr(Buffer.from("ssh-rsa")), sshStr(Buffer.alloc(32))]).toString("base64");
-  assert.equal(sshEd25519ToSpkiPem(rsaBlob), null);
-  // an ed25519 tag with the wrong raw-key length → null
-  const shortBlob = Buffer.concat([sshStr(Buffer.from("ssh-ed25519")), sshStr(Buffer.alloc(16))]).toString("base64");
-  assert.equal(sshEd25519ToSpkiPem(shortBlob), null);
-});

package/lib/org/work-ledger.test.mjs

@@ -1,273 +0,0 @@
-/**
- * lib/org/work-ledger.test.mjs — the daemon's half of the work ledger.
- *
- * What is worth testing here is deliberately NARROW, because the policy is not
- * here: the threshold, the idempotency and the tagging all live server-side in
- * hq's `server/work/ledger.ts`, so re-testing them in this repo would be
- * testing a second implementation that must not exist. What IS this module's
- * job — and what these tests pin — is the mapping: does a real flattened inbox
- * item become the right wire call, does a re-delivery of the SAME item produce
- * the SAME identity, and does every failure path come back as a benign,
- * REASONED refusal rather than an exception on the dispatch path.
- *
- * Run: node --test lib/org/work-ledger.test.mjs
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import {
-  WORK_STAGES,
-  cohortChannelId,
-  cohortMessageId,
-  requesterMemberId,
-  recordWorkStep,
-} from "./work-ledger.mjs";
-
-const CFG = {
-  org: { cohort: { enabled: true, base: "https://os.example.test", token: "tok_test" } },
-};
-
-/** A flattened Cohort inbox item, in the shape lib/channels/inbox-item.mjs writes. */
-function inboxItem(over = {}) {
-  return {
-    id: "cohort-msg_abc123",
-    service: "cohort",
-    channel: "Owner ↔ Isla",
-    channel_id: "ch_dm_1",
-    sender: "The Owner",
-    sender_privilege: "ceo",
-    timestamp: "2026-08-13T05:47:51.000Z",
-    subject: "Direct message",
-    content: "fix these issues you just noted please and push their fixes to git",
-    thread_id: "",
-    is_reply: false,
-    priority_signals: {
-      from_ceo: true,
-      tagged_urgent: false,
-      contains_deadline: false,
-      mentions_agent: true,
-    },
-    raw_ref: "cohort:message:msg_abc123:4821",
-    source: "cohort",
-    ...over,
-  };
-}
-
-/** Capture the params a step would send, without a server. */
-function capture(result = { result: { tracked: true, taskId: "t_1", col: "triage", created: true } }) {
-  const calls = [];
-  const impl = async (params, opts) => {
-    calls.push({ params, opts });
-    return result;
-  };
-  return { calls, impl };
-}
-
-// ---------------------------------------------------------------------------
-// Identity — the thing that makes a re-delivery find the same row
-// ---------------------------------------------------------------------------
-
-test("cohortMessageId reads the entity id off raw_ref", () => {
-  assert.equal(cohortMessageId(inboxItem()), "msg_abc123");
-});
-
-test("cohortMessageId falls back to the inbox id when raw_ref is absent", () => {
-  assert.equal(cohortMessageId(inboxItem({ raw_ref: "" })), "msg_abc123");
-});
-
-test("a re-delivered item yields the SAME identity", () => {
-  // The dead-session case: the item was never marked processed, so the poller
-  // hands back a byte-identical file. Same channel + same message = same key
-  // server-side = the same board row, not a second one.
-  const first = inboxItem();
-  const again = inboxItem();
-  assert.equal(cohortChannelId(first), cohortChannelId(again));
-  assert.equal(cohortMessageId(first), cohortMessageId(again));
-});
-
-test("requesterMemberId is null for a normal item — the server resolves it", () => {
-  // The flat item carries the sender's NAME, not their id. Guessing a member id
-  // from a display name is how you tag the wrong person.
-  assert.equal(requesterMemberId(inboxItem()), null);
-  assert.equal(requesterMemberId({ sender_member_id: "m_owner" }), "m_owner");
-});
-
-// ---------------------------------------------------------------------------
-// The mapping
-// ---------------------------------------------------------------------------
-
-test("an accepted step sends the ask's identity and the deferred fact", async () => {
-  const { calls, impl } = capture();
-  const res = await recordWorkStep({
-    item: inboxItem(),
-    stage: "accepted",
-    deferred: true,
-    note: "Picked this up.",
-    cfg: CFG,
-    trackImpl: impl,
-    source: { service: "cohort", trace_id: "tr_9" },
-  });
-
-  assert.equal(calls.length, 1);
-  const { params, opts } = calls[0];
-  assert.equal(params.service, "cohort");
-  assert.equal(params.channelId, "ch_dm_1");
-  assert.equal(params.messageId, "msg_abc123");
-  assert.equal(params.stage, "accepted");
-  assert.equal(params.deferred, true);
-  assert.equal(params.directed, true);
-  assert.equal(params.authorKind, "HUMAN");
-  assert.equal(
-    params.body,
-    "fix these issues you just noted please and push their fixes to git",
-  );
-  assert.equal(params.note, "Picked this up.");
-  assert.deepEqual(params.source, { service: "cohort", trace_id: "tr_9" });
-  // Same ask + same stage = the same call, so a retry after a timeout cannot
-  // double-post the tag.
-  assert.equal(opts.idempotencyKey, "board.track:ch_dm_1:msg_abc123:accepted");
-  assert.equal(opts.base, CFG.org.cohort.base);
-  assert.equal(res.tracked, true);
-  assert.equal(res.taskId, "t_1");
-});
-
-test("a `working` step is what puts the row where the live-work surface looks", async () => {
-  // `accepted` lands the row in `triage`, and NO live-work surface reads
-  // `triage` — hq's "On now" banner reads `running` and nothing else. Sending
-  // only the first step is why every daemon row existed and was still
-  // invisible, and why a second, ungated board writer came to exist beside it.
-  const { calls, impl } = capture();
-  await recordWorkStep({
-    item: inboxItem(),
-    stage: "working",
-    deferred: true,
-    cfg: CFG,
-    trackImpl: impl,
-  });
-  assert.equal(calls[0].params.stage, "working");
-  assert.equal(calls[0].opts.idempotencyKey, "board.track:ch_dm_1:msg_abc123:working");
-});
-
-test("the classifier's urgency rides along, already on hq's P-scale", async () => {
-  // hq validates `priority` against z.enum(["P0".."P4"]) and 400s the whole
-  // call on anything else, so the mapping happens before the wire
-  // (scripts/daemon/board-mirror.mjs#boardPriority) and this only forwards it.
-  const { calls, impl } = capture();
-  await recordWorkStep({
-    item: inboxItem(),
-    stage: "accepted",
-    priority: "P0",
-    cfg: CFG,
-    trackImpl: impl,
-  });
-  assert.equal(calls[0].params.priority, "P0");
-
-  const plain = capture();
-  await recordWorkStep({ item: inboxItem(), stage: "accepted", cfg: CFG, trackImpl: plain.impl });
-  assert.ok(!("priority" in plain.calls[0].params), "no priority ⇒ hq's own default answers");
-});
-
-test("directedness comes from the ingest layer's real verdict, never a guess", async () => {
-  const { calls, impl } = capture();
-  await recordWorkStep({
-    item: inboxItem({
-      priority_signals: { mentions_agent: false, from_ceo: false, tagged_urgent: false, contains_deadline: false },
-    }),
-    stage: "accepted",
-    cfg: CFG,
-    trackImpl: impl,
-  });
-  // An overheard channel message is not assigned work — and the SERVER is what
-  // acts on that, so the client's job is only to report it honestly.
-  assert.equal(calls[0].params.directed, false);
-});
-
-test("a session death is reported as `failed`, not swallowed", async () => {
-  const { calls, impl } = capture({ result: { tracked: true, taskId: "t_1", col: "blocked", moved: true } });
-  const res = await recordWorkStep({
-    item: inboxItem(),
-    stage: "failed",
-    deferred: true,
-    note: "The session handling this ended without completing (exit 143).",
-    cfg: CFG,
-    trackImpl: impl,
-  });
-  assert.equal(calls[0].params.stage, "failed");
-  assert.equal(res.col, "blocked");
-});
-
-test("attachments and extra tags are forwarded, and bounded", async () => {
-  const { calls, impl } = capture();
-  await recordWorkStep({
-    item: inboxItem(),
-    stage: "review",
-    cfg: CFG,
-    trackImpl: impl,
-    notify: Array.from({ length: 20 }, (_, i) => `m_${i}`),
-    attachments: Array.from({ length: 20 }, (_, i) => ({ name: `f${i}.txt`, dataUrl: "data:text/plain;base64,eA==" })),
-  });
-  assert.equal(calls[0].params.notify.length, 8);
-  assert.equal(calls[0].params.attachments.length, 6);
-});
-
-// ---------------------------------------------------------------------------
-// Fail-open, never silent
-// ---------------------------------------------------------------------------
-
-test("a non-Cohort item is refused with a reason, not an exception", async () => {
-  const { calls, impl } = capture();
-  const res = await recordWorkStep({ item: inboxItem({ service: "slack" }), stage: "accepted", cfg: CFG, trackImpl: impl });
-  assert.equal(res.tracked, false);
-  assert.equal(res.reason, "not-a-cohort-channel");
-  assert.equal(calls.length, 0, "no wire call for a board we cannot write to");
-});
-
-test("an item with no resolvable channel is refused", async () => {
-  const res = await recordWorkStep({ item: inboxItem({ channel_id: "" }), stage: "accepted", cfg: CFG, trackImpl: async () => ({}) });
-  assert.equal(res.tracked, false);
-  assert.equal(res.reason, "not-a-cohort-channel");
-});
-
-test("a bad stage is refused rather than sent", async () => {
-  const { calls, impl } = capture();
-  const res = await recordWorkStep({ item: inboxItem(), stage: "finished", cfg: CFG, trackImpl: impl });
-  assert.equal(res.reason, "bad-stage");
-  assert.equal(calls.length, 0);
-});
-
-test("org integration off ⇒ a clean skip", async () => {
-  const res = await recordWorkStep({ item: inboxItem(), stage: "accepted", cfg: {}, trackImpl: async () => ({}) });
-  assert.equal(res.tracked, false);
-  assert.equal(res.reason, "org-disabled");
-});
-
-test("a server error frame comes back as a REASON, never a throw", async () => {
-  const res = await recordWorkStep({
-    item: inboxItem(),
-    stage: "accepted",
-    cfg: CFG,
-    trackImpl: async () => ({ error: { code: "FORBIDDEN_SCOPE", message: "board.write not granted" } }),
-  });
-  assert.equal(res.tracked, false);
-  assert.match(res.reason, /FORBIDDEN_SCOPE/);
-  assert.match(res.reason, /board\.write not granted/);
-});
-
-test("a thrown transport error is contained — the dispatch path never sees it", async () => {
-  const res = await recordWorkStep({
-    item: inboxItem(),
-    stage: "accepted",
-    cfg: CFG,
-    trackImpl: async () => {
-      throw new Error("ECONNREFUSED");
-    },
-  });
-  assert.equal(res.tracked, false);
-  assert.match(res.reason, /ECONNREFUSED/);
-});
-
-test("WORK_STAGES matches the server's ladder", () => {
-  assert.deepEqual(WORK_STAGES, ["accepted", "working", "blocked", "review", "done", "failed"]);
-});