@cohortapp/agent-sdk 2.17.0 → 2.18.5

package/scripts/ci/check-no-build-artifacts.test.mjs

@@ -1,71 +0,0 @@
-/**
- * Tests for check-no-build-artifacts.mjs — packaging hygiene guard.
- * Pure-function level (parseLsFiles + pattern matching); no git invocation.
- * @module scripts/ci/check-no-build-artifacts.test
- */
-
-import { describe, it } from "node:test";
-import assert from "node:assert/strict";
-import { parseLsFiles, ARTIFACT_PATTERNS } from "./check-no-build-artifacts.mjs";
-
-/** Re-implement the offender classification over parsed rows (mirrors findArtifacts' inner loop). */
-function classify(rows) {
-  const out = [];
-  for (const { mode, path: file } of rows) {
-    if (mode === "120000") { out.push({ file, reason: "symlink" }); continue; }
-    for (const p of ARTIFACT_PATTERNS) if (p.re.test(file)) { out.push({ file, reason: p.label }); break; }
-  }
-  return out;
-}
-
-describe("check-no-build-artifacts: parseLsFiles", () => {
-  it("parses mode + path from `git ls-files -s` rows", () => {
-    const stdout = [
-      "100644 abc123 0\tlib/index.js",
-      "120000 def456 0\tscripts/validate_outbound.py",
-      "100755 aaa111 0\tscripts/send-email.sh",
-    ].join("\n");
-    const rows = parseLsFiles(stdout);
-    assert.equal(rows.length, 3);
-    assert.deepEqual(rows[0], { mode: "100644", path: "lib/index.js" });
-    assert.equal(rows[1].mode, "120000");
-    assert.equal(rows[1].path, "scripts/validate_outbound.py");
-  });
-
-  it("ignores blank lines and malformed rows (no tab)", () => {
-    const rows = parseLsFiles("\n100644 abc 0\tok.js\ngarbage-no-tab\n");
-    assert.equal(rows.length, 1);
-    assert.equal(rows[0].path, "ok.js");
-  });
-
-  it("preserves paths containing spaces (split only on the first tab)", () => {
-    const rows = parseLsFiles("100644 abc 0\tdocs/a file with spaces.md");
-    assert.equal(rows[0].path, "docs/a file with spaces.md");
-  });
-});
-
-describe("check-no-build-artifacts: classification", () => {
-  it("flags tracked symlinks", () => {
-    const off = classify(parseLsFiles("120000 x 0\tscripts/validate_outbound.py"));
-    assert.equal(off.length, 1);
-    assert.equal(off[0].reason, "symlink");
-  });
-
-  it("flags .pyc, .pyo, and __pycache__ paths", () => {
-    const off = classify(parseLsFiles([
-      "100644 a 0\tscripts/__pycache__/x.cpython-313.pyc",
-      "100644 b 0\tscripts/foo.pyo",
-      "100644 c 0\tscripts/__pycache__/bar.py",
-    ].join("\n")));
-    assert.equal(off.length, 3);
-  });
-
-  it("passes clean trees (real source files, executable shell)", () => {
-    const off = classify(parseLsFiles([
-      "100644 a 0\tlib/index.js",
-      "100755 b 0\tscripts/send-email.sh",
-      "100644 c 0\tscripts/validate_outbound.py",
-    ].join("\n")));
-    assert.equal(off.length, 0);
-  });
-});

package/scripts/ci/check-no-residual-identity.test.mjs

@@ -1,202 +0,0 @@
-/**
- * check-no-residual-identity.test.mjs — the de-identification ratchet's own
- * guard-of-the-guard (2.0 §4.5(8)):
- *   (i)   exempt files are skipped by the scan,
- *   (ii)  an out-of-policy exemption entry throws (the list can never grow
- *         into a general escape hatch),
- *   (iii) a seeded marker in a tmp corpus still fails — the exemption did not
- *         blunt the ratchet.
- * Run: node --test scripts/ci/check-no-residual-identity.test.mjs
- */
-
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import {
-  DE_IDENTIFIED_PATHS,
-  EXEMPT_FILES,
-  IDENTITY_PATTERNS,
-  PLACEHOLDER_PENDING,
-  assertExemptPolicy,
-  assertPendingPolicy,
-  findPlaceholderIdentity,
-  findResidualIdentity,
-  isFixturePath,
-  scanIdentity,
-  scanPlaceholders,
-  run,
-} from "./check-no-residual-identity.mjs";
-
-test("ratchet coverage: 2.0 grew the de-identified paths with bin/scripts/scaffold/services", () => {
-  for (const d of ["bin", "scripts", "scaffold", "services", "lib"]) {
-    assert.ok(DE_IDENTIFIED_PATHS.includes(d), `${d} ratcheted`);
-  }
-  assert.ok(
-    IDENTITY_PATTERNS.some((p) => p.label.includes("@adaptic/")),
-    "old package scope pattern present",
-  );
-});
-
-test("(i) exempt files are skipped: a marker inside an exempt path never offends", () => {
-  const cwd = mkdtempSync(join(tmpdir(), "ratchet-"));
-  mkdirSync(join(cwd, "scripts", "ci"), { recursive: true });
-  // The exempt guard file carries identity tokens BY DESIGN.
-  writeFileSync(join(cwd, "scripts", "ci", "check-no-residual-identity.mjs"), "// patterns: Sophie Mehran Adaptic\n");
-  writeFileSync(join(cwd, "scripts", "ci", "check-no-confidential.mjs"), "// scope note naming Sophie\n");
-  const offenders = findResidualIdentity({ cwd });
-  assert.deepEqual(offenders, [], "both exempt files skipped");
-  rmSync(cwd, { recursive: true, force: true });
-});
-
-test("(ii) an out-of-policy exemption entry throws at policy assert", () => {
-  assert.doesNotThrow(() => assertExemptPolicy(EXEMPT_FILES), "the real list is in policy");
-  assert.throws(
-    () => assertExemptPolicy(["lib/org/client.mjs"]),
-    /out of policy/,
-    "a non-guard path can never self-exempt",
-  );
-  assert.throws(() => assertExemptPolicy(["scripts/ci/run-tests.mjs"]), /out of policy/, "even scripts/ci files must be check-no-* guards");
-  for (const f of EXEMPT_FILES) {
-    assert.match(f, /^scripts\/ci\/check-no-/, `${f} matches the policy prefix`);
-  }
-});
-
-test("(iii) a seeded marker in a NON-exempt file still fails the ratchet", async () => {
-  const cwd = mkdtempSync(join(tmpdir(), "ratchet-"));
-  mkdirSync(join(cwd, "scripts", "daemon"), { recursive: true });
-  mkdirSync(join(cwd, "services", "x"), { recursive: true });
-  writeFileSync(join(cwd, "scripts", "daemon", "sneaky.mjs"), 'const who = "Sophie";\n');
-  writeFileSync(join(cwd, "services", "x", "pkg.json"), '{"name": "@adaptic/oops"}\n');
-  const offenders = findResidualIdentity({ cwd });
-  assert.equal(offenders.length, 2, "both seeded markers caught");
-  const labels = offenders.flatMap((o) => o.hits.map((h) => h.label)).join("|");
-  assert.match(labels, /Sophie/);
-  assert.match(labels, /@adaptic\//);
-  const code = await run(cwd);
-  assert.equal(code, 1, "run() exits non-zero on offenders");
-  rmSync(cwd, { recursive: true, force: true });
-});
-
-test("scanIdentity flags every 2.0 pattern incl. the package scope; placeholders stay clean", () => {
-  assert.ok(scanIdentity("npm i @adaptic/maestro").some((h) => /@adaptic\//.test(h.match)));
-  // scanIdentity is the ORIGINAL-INSTANCE scan only. The fictional placeholder
-  // class is a SEPARATE pass (scanPlaceholders) over its own path set — see the
-  // placeholder tests at the bottom of this file.
-  assert.equal(scanIdentity("Northwind's Alex and Jordan shipped it").length, 0, "different scan");
-  assert.equal(scanIdentity("").length, 0);
-});
-
-test("the LIVE repo is clean under the expanded ratchet (the commit that lands it is green)", async () => {
-  const code = await run();
-  assert.equal(code, 0, "expanded ratchet must be green in-tree");
-});
-
-// ─────────────────────────────────────────────────────────────────────────────
-// The FICTIONAL PLACEHOLDER class — the exemption that used to say
-// "Northwind / Alex / Jordan are intentional examples and are NOT flagged".
-// That blanket exemption is what let an invented employer sit inside the huddle
-// system prompt, the PSTN relay fallback, the classifier identity line and the
-// outbound validator. These tests pin the narrowed shape.
-// ─────────────────────────────────────────────────────────────────────────────
-
-test("placeholder scan FLAGS a fictional employer in a live prompt path", () => {
-  const cwd = mkdtempSync(join(tmpdir(), "ratchet-ph-"));
-  mkdirSync(join(cwd, "scripts", "huddle"), { recursive: true });
-  writeFileSync(
-    join(cwd, "scripts", "huddle", "huddle-server.mjs"),
-    'const p = `ABOUT: Northwind is a global asset manager`;\n',
-  );
-  const { regressions } = findPlaceholderIdentity({ cwd, pending: [] });
-  assert.equal(regressions.length, 1, "a prompt-path literal is a regression");
-  assert.match(regressions[0].hits[0].label, /Northwind/);
-  rmSync(cwd, { recursive: true, force: true });
-});
-
-test("placeholder scan EXEMPTS tests, fixtures, docs, scaffold and *.example", () => {
-  const cwd = mkdtempSync(join(tmpdir(), "ratchet-ph2-"));
-  mkdirSync(join(cwd, "scripts", "daemon"), { recursive: true });
-  mkdirSync(join(cwd, "lib", "fixtures"), { recursive: true });
-  mkdirSync(join(cwd, "scaffold", "config"), { recursive: true });
-  const body = 'const who = "Alex Chen at Northwind";\n';
-  writeFileSync(join(cwd, "scripts", "daemon", "thing.test.mjs"), body);
-  writeFileSync(join(cwd, "scripts", "test-information-barriers.py"), body);
-  writeFileSync(join(cwd, "lib", "fixtures", "roster.json"), body);
-  writeFileSync(join(cwd, "scaffold", "config", "known-agents.json"), body);
-  writeFileSync(join(cwd, "lib", "voice.yaml.example"), body);
-  const { regressions } = findPlaceholderIdentity({ cwd, pending: [] });
-  assert.deepEqual(regressions, [], "fixtures/tests/scaffold/examples are legitimate placeholders");
-  rmSync(cwd, { recursive: true, force: true });
-});
-
-test("isFixturePath classifies by convention, not by a hand-maintained list", () => {
-  for (const p of [
-    "lib/model-router.test.mjs",
-    "scripts/test-voice-parser.mjs",
-    "scripts/foo_test.py",
-    "docs/guides/voice.md",
-    "scaffold/config/known-agents.json",
-    "lib/channels/__tests__/x.mjs",
-    "config/voice.yaml.example",
-  ]) assert.equal(isFixturePath(p), true, p);
-
-  for (const p of [
-    "scripts/huddle/huddle-server.mjs",
-    "scripts/daemon/classifier.mjs",
-    "policies/information-barriers.yaml",
-    "lib/identity/persona.mjs",
-  ]) assert.equal(isFixturePath(p), false, p);
-});
-
-test("PLACEHOLDER_PENDING is a shrinking ratchet: a baselined file that went clean FAILS", () => {
-  const cwd = mkdtempSync(join(tmpdir(), "ratchet-ph3-"));
-  mkdirSync(join(cwd, "scripts"), { recursive: true });
-  writeFileSync(join(cwd, "scripts", "clean.mjs"), "export const x = 1;\n");
-  const pending = [{ file: "scripts/clean.mjs", reason: "stale baseline entry, ten chars plus" }];
-  const res = findPlaceholderIdentity({ cwd, pending });
-  assert.deepEqual(res.regressions, []);
-  assert.deepEqual(res.pendingClean, ["scripts/clean.mjs"], "clean baseline entry must be deleted");
-  rmSync(cwd, { recursive: true, force: true });
-});
-
-test("PLACEHOLDER_PENDING suppresses only its own listed files, and reports them", () => {
-  const cwd = mkdtempSync(join(tmpdir(), "ratchet-ph4-"));
-  mkdirSync(join(cwd, "scripts"), { recursive: true });
-  writeFileSync(join(cwd, "scripts", "known.mjs"), 'const a = "Northwind";\n');
-  writeFileSync(join(cwd, "scripts", "new.mjs"), 'const b = "PartnerCo";\n');
-  const pending = [{ file: "scripts/known.mjs", reason: "not yet grounded in config/company.json" }];
-  const res = findPlaceholderIdentity({ cwd, pending });
-  assert.deepEqual(res.regressions.map((r) => r.file), ["scripts/new.mjs"], "only the NEW file fails");
-  assert.deepEqual(res.pendingDirty.map((e) => e.file), ["scripts/known.mjs"], "the baseline is reported, not hidden");
-  rmSync(cwd, { recursive: true, force: true });
-});
-
-test("assertPendingPolicy rejects an undocumented baseline entry", () => {
-  assert.throws(() => assertPendingPolicy([{ file: "scripts/x.mjs", reason: "meh" }]), /needs a real/);
-  assert.throws(() => assertPendingPolicy([{ reason: "a perfectly long reason" }]), /no `file`/);
-  assertPendingPolicy(PLACEHOLDER_PENDING); // the shipped baseline is in policy
-});
-
-test("the files this lane grounded are NOT on the baseline and are clean in-tree", () => {
-  const grounded = [
-    "scripts/huddle/huddle-server.mjs",
-    "scripts/daemon/classifier.mjs",
-    "scripts/daemon/prompt-builder.mjs",
-    "scripts/cloud-relay/voice/server.mjs",
-    "scripts/media-generation/generate-assets.mjs",
-    "scripts/media-generation/gemini-image-client.mjs",
-    "scripts/spawn-session.sh",
-    "scripts/pre-draft-context.py",
-    "scripts/disclosure_boundaries.py",
-    "policies/information-barriers.yaml",
-  ];
-  const baselined = new Set(PLACEHOLDER_PENDING.map((e) => e.file));
-  for (const f of grounded) {
-    assert.equal(baselined.has(f), false, `${f} must not be baselined — it is grounded`);
-    assert.equal(scanPlaceholders(readFileSync(new URL(`../../${f}`, import.meta.url), "utf8")).length, 0, f);
-  }
-});