@cursor/july 0.1.20 → 0.1.21

package/src/internal/http-channel.test.ts

@@ -0,0 +1,402 @@
+import { describe, expect, it, vi } from "vitest";
+import { httpChannel } from "../channels.js";
+import type { SessionRecord } from "../types.js";
+import { buildHttpChannelRoutes } from "./http-channel.js";
+import type { SessionEngine } from "./session-engine.js";
+import { HTTP_CHANNEL_ID } from "./session-engine.js";
+
+function sessionRecord(overrides: Partial<SessionRecord> = {}): SessionRecord {
+  const now = new Date().toISOString();
+  return {
+    sessionId: "ses_test",
+    channelId: HTTP_CHANNEL_ID,
+    mode: "chat",
+    continuationKey: "cont_key",
+    auth: null,
+    turnCount: 1,
+    createdAt: now,
+    updatedAt: now,
+    ...overrides,
+  };
+}
+
+describe("buildHttpChannelRoutes", () => {
+  it("does not accept caller workspaceDir on POST /v1/session", async () => {
+    const send = vi.fn(async () => ({
+      id: "ses_test",
+      continuationToken: "cont",
+      isNew: true,
+      waitForCompletion: async () => ({ status: "completed" as const }),
+    }));
+    const engine = { send } as unknown as SessionEngine;
+    const createRoute = buildHttpChannelRoutes({
+      engine,
+      config: httpChannel(),
+      auth: [],
+    }).find(
+      (route) => route.method === "POST" && route.pattern === "/v1/session"
+    );
+    expect(createRoute).toBeDefined();
+
+    const response = await createRoute!.handler(
+      new Request("http://127.0.0.1:3000/v1/session", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          message: "review",
+          workspaceDir: "/tmp/attacker-chosen",
+          workspaceFiles: { "pr/MANIFEST.md": "# evidence" },
+        }),
+      }),
+      { auth: null, params: {}, requestIp: "127.0.0.1" }
+    );
+
+    expect(response.status).toBe(200);
+    expect(send).toHaveBeenCalledWith(HTTP_CHANNEL_ID, "review", {
+      auth: null,
+      workspaceFiles: { "pr/MANIFEST.md": "# evidence" },
+    });
+  });
+
+  it("forwards purpose:eval on POST /v1/session for the eval harness", async () => {
+    const send = vi.fn(async () => ({
+      id: "ses_eval",
+      continuationToken: "cont",
+      isNew: true,
+      waitForCompletion: async () => ({ status: "completed" as const }),
+    }));
+    const engine = { send } as unknown as SessionEngine;
+    const createRoute = buildHttpChannelRoutes({
+      engine,
+      config: httpChannel(),
+      auth: [],
+    }).find(
+      (route) => route.method === "POST" && route.pattern === "/v1/session"
+    );
+    expect(createRoute).toBeDefined();
+
+    const response = await createRoute!.handler(
+      new Request("http://127.0.0.1:3000/v1/session", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ message: "eval case", purpose: "eval" }),
+      }),
+      { auth: null, params: {}, requestIp: "127.0.0.1" }
+    );
+
+    expect(response.status).toBe(200);
+    expect(send).toHaveBeenCalledWith(HTTP_CHANNEL_ID, "eval case", {
+      auth: null,
+      purpose: "eval",
+    });
+  });
+
+  it("forwards per-session cloud options on POST /v1/session", async () => {
+    const send = vi.fn(async () => ({
+      id: "ses_cloud",
+      continuationToken: "cont",
+      isNew: true,
+      waitForCompletion: async () => ({ status: "completed" as const }),
+    }));
+    const engine = { send } as unknown as SessionEngine;
+    const createRoute = buildHttpChannelRoutes({
+      engine,
+      config: httpChannel(),
+      auth: [],
+    }).find(
+      (route) => route.method === "POST" && route.pattern === "/v1/session"
+    );
+    expect(createRoute).toBeDefined();
+
+    const cloud = {
+      repos: [
+        {
+          url: "https://github.com/vercel-labs/deepsec",
+          startingRef: "f75a16803ec5250938bacfe41571d929e8564f45",
+        },
+      ],
+      autoCreatePR: false,
+    };
+    const response = await createRoute!.handler(
+      new Request("http://127.0.0.1:3000/v1/session", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          message: "scan fixture",
+          purpose: "eval",
+          cloud,
+        }),
+      }),
+      { auth: null, params: {}, requestIp: "127.0.0.1" }
+    );
+
+    expect(response.status).toBe(200);
+    expect(send).toHaveBeenCalledWith(HTTP_CHANNEL_ID, "scan fixture", {
+      auth: null,
+      purpose: "eval",
+      cloud,
+    });
+  });
+
+  it("accepts playground follow-ups on non-http chat sessions", async () => {
+    const record = sessionRecord({
+      sessionId: "ses_drive",
+      channelId: "drive",
+      continuationKey: "drive_key",
+      auth: {
+        authenticator: "local-dev",
+        principalId: "loopback",
+        principalType: "runtime",
+      },
+    });
+    const send = vi.fn(async () => ({
+      id: record.sessionId,
+      continuationToken: "drive_key",
+      isNew: false,
+      waitForCompletion: async () => ({ status: "completed" as const }),
+    }));
+    const setContinuationToken = vi.fn(async () => undefined);
+    const engine = {
+      send,
+      setContinuationToken,
+      getOrRestoreSession: vi.fn(async () => record),
+    } as unknown as SessionEngine;
+
+    const followUpRoute = buildHttpChannelRoutes({
+      engine,
+      config: httpChannel(),
+      auth: [],
+      relaxSessionReadAuth: true,
+    }).find(
+      (route) =>
+        route.method === "POST" && route.pattern === "/v1/session/:sessionId"
+    );
+    expect(followUpRoute).toBeDefined();
+
+    const response = await followUpRoute!.handler(
+      new Request("http://127.0.0.1:3000/v1/session/ses_drive", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          message: "look again at CI",
+          continuationToken: "drive:drive_key",
+        }),
+      }),
+      {
+        auth: null,
+        params: { sessionId: "ses_drive" },
+        requestIp: "127.0.0.1",
+      }
+    );
+
+    expect(response.status).toBe(200);
+    const body = (await response.json()) as {
+      ok: boolean;
+      continuationToken: string;
+    };
+    expect(body.ok).toBe(true);
+    expect(body.continuationToken.startsWith("drive:")).toBe(true);
+    expect(send).toHaveBeenCalledWith("drive", "look again at CI", {
+      auth: record.auth,
+      continuationToken: "drive_key",
+    });
+    expect(setContinuationToken).toHaveBeenCalledWith(
+      "ses_drive",
+      expect.any(String)
+    );
+  });
+
+  it("rejects follow-ups on task sessions", async () => {
+    const record = sessionRecord({
+      mode: "task",
+      channelId: "schedule",
+    });
+    const engine = {
+      send: vi.fn(),
+      getOrRestoreSession: vi.fn(async () => record),
+    } as unknown as SessionEngine;
+
+    const followUpRoute = buildHttpChannelRoutes({
+      engine,
+      config: httpChannel(),
+      auth: [],
+      relaxSessionReadAuth: true,
+    }).find(
+      (route) =>
+        route.method === "POST" && route.pattern === "/v1/session/:sessionId"
+    );
+    expect(followUpRoute).toBeDefined();
+
+    const response = await followUpRoute!.handler(
+      new Request("http://127.0.0.1:3000/v1/session/ses_test", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          message: "ping",
+          continuationToken: "schedule:cont_key",
+        }),
+      }),
+      {
+        auth: null,
+        params: { sessionId: "ses_test" },
+        requestIp: "127.0.0.1",
+      }
+    );
+
+    expect(response.status).toBe(409);
+    const body = (await response.json()) as { error: string };
+    expect(body.error).toBe("session_not_followable");
+  });
+
+  it("stops an in-flight turn via POST /v1/session/:sessionId/stop", async () => {
+    const record = sessionRecord();
+    const interrupt = vi.fn(async () => true);
+    const engine = {
+      interrupt,
+      getOrRestoreSession: vi.fn(async () => record),
+    } as unknown as SessionEngine;
+
+    const stopRoute = buildHttpChannelRoutes({
+      engine,
+      config: httpChannel(),
+      auth: [],
+    }).find(
+      (route) =>
+        route.method === "POST" &&
+        route.pattern === "/v1/session/:sessionId/stop"
+    );
+    expect(stopRoute).toBeDefined();
+
+    const response = await stopRoute!.handler(
+      new Request("http://127.0.0.1:3000/v1/session/ses_test/stop", {
+        method: "POST",
+      }),
+      {
+        auth: null,
+        params: { sessionId: "ses_test" },
+        requestIp: "127.0.0.1",
+      }
+    );
+
+    expect(response.status).toBe(200);
+    const body = (await response.json()) as {
+      ok: boolean;
+      interrupted: boolean;
+    };
+    expect(body).toEqual({ ok: true, interrupted: true });
+    expect(interrupt).toHaveBeenCalledWith("ses_test");
+  });
+
+  it("returns interrupted:false when stop finds no active turn", async () => {
+    const record = sessionRecord();
+    const interrupt = vi.fn(async () => false);
+    const engine = {
+      interrupt,
+      getOrRestoreSession: vi.fn(async () => record),
+    } as unknown as SessionEngine;
+
+    const stopRoute = buildHttpChannelRoutes({
+      engine,
+      config: httpChannel(),
+      auth: [],
+    }).find(
+      (route) =>
+        route.method === "POST" &&
+        route.pattern === "/v1/session/:sessionId/stop"
+    );
+    expect(stopRoute).toBeDefined();
+
+    const response = await stopRoute!.handler(
+      new Request("http://127.0.0.1:3000/v1/session/ses_test/stop", {
+        method: "POST",
+      }),
+      {
+        auth: null,
+        params: { sessionId: "ses_test" },
+        requestIp: "127.0.0.1",
+      }
+    );
+
+    expect(response.status).toBe(200);
+    expect(await response.json()).toEqual({ ok: true, interrupted: false });
+  });
+
+  it("lazy-restores by id before streaming events after redeploy", async () => {
+    const record = sessionRecord({ sessionId: "ses_eval_trace" });
+    const getOrRestoreSession = vi.fn(async () => record);
+    const listEvents = vi.fn(async () => [
+      {
+        index: 0,
+        sessionId: "ses_eval_trace",
+        at: new Date().toISOString(),
+        type: "session.started",
+        data: {},
+      },
+    ]);
+    const engine = {
+      getOrRestoreSession,
+      listEvents,
+    } as unknown as SessionEngine;
+
+    const eventsRoute = buildHttpChannelRoutes({
+      engine,
+      config: httpChannel(),
+      auth: [],
+      relaxSessionReadAuth: true,
+    }).find(
+      (route) =>
+        route.method === "GET" &&
+        route.pattern === "/v1/session/:sessionId/events"
+    );
+    expect(eventsRoute).toBeDefined();
+
+    const response = await eventsRoute!.handler(
+      new Request(
+        "http://127.0.0.1:3000/v1/session/ses_eval_trace/events?format=json"
+      ),
+      {
+        auth: null,
+        params: { sessionId: "ses_eval_trace" },
+        requestIp: "127.0.0.1",
+      }
+    );
+
+    expect(response.status).toBe(200);
+    expect(getOrRestoreSession).toHaveBeenCalledWith("ses_eval_trace");
+    const body = (await response.json()) as {
+      sessionId: string;
+      events: unknown[];
+    };
+    expect(body.sessionId).toBe("ses_eval_trace");
+    expect(body.events).toHaveLength(1);
+  });
+
+  it("allows cross-principal session reads for --allow-anonymous beyond loopback", async () => {
+    const { requireSessionOwner } = await import("./http-channel.js");
+    const record = sessionRecord({
+      auth: {
+        authenticator: "slack",
+        principalId: "slack:T:C:1.0",
+        principalType: "user",
+      },
+    });
+    const caller = {
+      authenticator: "allow-all",
+      principalId: "anonymous",
+      principalType: "user" as const,
+    };
+    expect(
+      requireSessionOwner(record, caller, {
+        relax: true,
+        beyondLoopback: true,
+        requestIp: "10.0.0.5",
+      })
+    ).toBeUndefined();
+    const denied = requireSessionOwner(record, caller, {
+      relax: true,
+      beyondLoopback: false,
+      requestIp: "10.0.0.5",
+    });
+    expect(denied?.status).toBe(403);
+  });
+});

package/src/internal/init-project.test.ts

@@ -0,0 +1,269 @@
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { CLI_COMMAND_NAME } from "./distribution.js";
+import {
+  formatInitSummary,
+  initProject,
+  installScaffoldDependencies,
+} from "./init-project.js";
+
+describe("initProject", () => {
+  let dir: string;
+
+  beforeEach(async () => {
+    dir = await mkdtemp(join(tmpdir(), "agent-serve-init-"));
+  });
+
+  afterEach(async () => {
+    await rm(dir, { recursive: true, force: true });
+  });
+
+  it("scaffolds a fresh directory, including nested tool files", async () => {
+    const target = join(dir, "my-agent");
+    const result = await initProject({ dir: target });
+
+    expect(result.rootDir).toBe(target);
+    expect(result.created.sort()).toEqual([
+      "agent/ab/.gitkeep",
+      "agent/agent.ts",
+      "agent/channels/.gitkeep",
+      "agent/hooks/.gitkeep",
+      "agent/instructions.md",
+      "agent/lib/.gitkeep",
+      "agent/mcp-connections/.gitkeep",
+      "agent/sandbox/workspace/.gitkeep",
+      "agent/schedules/.gitkeep",
+      "agent/skills/.gitkeep",
+      "agent/subagents/.gitkeep",
+      "agent/tools/echo.ts",
+      "evals/.gitkeep",
+      "package.json",
+      "tsconfig.json",
+    ]);
+    expect(result.skipped).toEqual([]);
+    expect(result.files.every((entry) => entry.action === "create")).toBe(true);
+
+    const agentTs = await readFile(join(target, "agent/agent.ts"), "utf8");
+    expect(agentTs).toContain('id: "grok-4.5"');
+    expect(agentTs).toContain('{ id: "effort", value: "high" }');
+    expect(agentTs).toContain('{ id: "fast", value: "true" }');
+    const echoTs = await readFile(join(target, "agent/tools/echo.ts"), "utf8");
+    expect(echoTs).toContain("defineTool");
+  });
+
+  it("scaffolds a type-checkable project (tsconfig + typescript dev deps)", async () => {
+    const target = join(dir, "typed");
+    await initProject({ dir: target });
+
+    const pkg = JSON.parse(
+      await readFile(join(target, "package.json"), "utf8")
+    ) as {
+      scripts: Record<string, string>;
+      devDependencies: Record<string, string>;
+    };
+    expect(pkg.scripts.check).toBe("tsc --noEmit");
+    expect(pkg.devDependencies.typescript).toBeDefined();
+    expect(pkg.devDependencies["@types/node"]).toBeDefined();
+
+    // JSONC (tsc allows comments), so assert on content instead of parsing.
+    const tsconfig = await readFile(join(target, "tsconfig.json"), "utf8");
+    expect(tsconfig).toContain('"moduleResolution": "bundler"');
+    expect(tsconfig).toContain('"strict": true');
+    expect(tsconfig).toContain('"noEmit": true');
+    expect(tsconfig).toContain('"include": ["agent/**/*", "evals/**/*"]');
+  });
+
+  it("honors name and model overrides", async () => {
+    const target = join(dir, "custom");
+    await initProject({ dir: target, name: "Custom Agent", model: "gpt-5.2" });
+
+    const pkg = JSON.parse(
+      await readFile(join(target, "package.json"), "utf8")
+    ) as { name: string };
+    expect(pkg.name).toBe("Custom Agent");
+    const agentTs = await readFile(join(target, "agent/agent.ts"), "utf8");
+    expect(agentTs).toContain('model: "gpt-5.2"');
+  });
+
+  it("skips existing files and fills in the missing ones", async () => {
+    const target = join(dir, "twice");
+    await initProject({ dir: target });
+    await writeFile(
+      join(target, "agent/instructions.md"),
+      "# custom instructions\n",
+      "utf8"
+    );
+
+    const second = await initProject({ dir: target });
+    expect(second.created).toEqual([]);
+    expect(second.skipped).toContain("agent/instructions.md");
+    expect(second.skipped).toContain("agent/skills/.gitkeep");
+    expect(second.skipped).toContain("evals/.gitkeep");
+    expect(await readFile(join(target, "agent/instructions.md"), "utf8")).toBe(
+      "# custom instructions\n"
+    );
+  });
+
+  it("creates only the missing files when some already exist", async () => {
+    const target = join(dir, "partial");
+    await mkdir(target, { recursive: true });
+    await writeFile(
+      join(target, "package.json"),
+      `${JSON.stringify({ name: "keep-me" }, null, 2)}\n`
+    );
+
+    const result = await initProject({ dir: target });
+    expect(result.skipped).toEqual(["package.json"]);
+    expect(result.created).toContain("agent/agent.ts");
+    expect(result.created).toContain("tsconfig.json");
+    expect(result.created).toContain("agent/lib/.gitkeep");
+    expect(result.created).toContain("evals/.gitkeep");
+    const pkg = JSON.parse(
+      await readFile(join(target, "package.json"), "utf8")
+    ) as { name: string };
+    expect(pkg.name).toBe("keep-me");
+  });
+});
+
+describe("installScaffoldDependencies", () => {
+  it("runs npm install in the project directory", async () => {
+    const calls: Array<{ command: string; args: string[]; cwd: string }> = [];
+    const result = await installScaffoldDependencies("/tmp/agent", {
+      stdio: "pipe",
+      runner: async ({ command, args, cwd }) => {
+        calls.push({ command, args, cwd });
+        return { exitCode: 0, stderr: "" };
+      },
+    });
+    expect(result.ok).toBe(true);
+    expect(calls).toEqual([
+      {
+        command: process.platform === "win32" ? "npm.cmd" : "npm",
+        args: ["install", "--no-fund", "--no-audit"],
+        cwd: "/tmp/agent",
+      },
+    ]);
+  });
+
+  it("surfaces a failed install exit code", async () => {
+    const result = await installScaffoldDependencies("/tmp/agent", {
+      stdio: "pipe",
+      runner: async () => ({ exitCode: 1, stderr: "boom" }),
+    });
+    expect(result).toEqual({ ok: false, exitCode: 1, stderr: "boom" });
+  });
+});
+
+describe("formatInitSummary", () => {
+  const files = [
+    { path: "package.json", action: "create" as const },
+    { path: "agent/agent.ts", action: "create" as const },
+    { path: "agent/instructions.md", action: "exist" as const },
+    { path: "agent/tools/echo.ts", action: "create" as const },
+  ];
+
+  it("lists created files, the project path, login, and dev", () => {
+    const summary = formatInitSummary({
+      rootDir: "/home/user/code/danny",
+      files,
+      cwd: "/home/user/code",
+      signedIn: false,
+    });
+
+    expect(summary).toContain("Initialized agent danny");
+    expect(summary).toContain("Project: /home/user/code/danny");
+    expect(summary).toContain("      create  package.json");
+    expect(summary).toContain("       exist  agent/instructions.md");
+    expect(summary).not.toContain(".gitkeep");
+    expect(summary).toContain("1. cd danny");
+    expect(summary).toContain(`2. ${CLI_COMMAND_NAME} login`);
+    expect(summary).toContain(`3. ${CLI_COMMAND_NAME} dev`);
+    expect(summary).not.toContain(`${CLI_COMMAND_NAME} dev danny`);
+    expect(summary).not.toContain(`${CLI_COMMAND_NAME} serve`);
+    // Scaffold block comes before next steps (init prints them around login).
+    expect(summary.indexOf("Project:")).toBeLessThan(
+      summary.indexOf("Next steps:")
+    );
+  });
+
+  it("omits .gitkeep placeholders from the printed file list", () => {
+    const summary = formatInitSummary({
+      rootDir: "/home/user/code/danny",
+      files: [
+        { path: "package.json", action: "create" },
+        { path: "agent/skills/.gitkeep", action: "create" },
+        { path: "evals/.gitkeep", action: "exist" },
+      ],
+      cwd: "/home/user/code",
+      signedIn: true,
+    });
+
+    expect(summary).toContain("      create  package.json");
+    expect(summary).not.toContain("skills");
+    expect(summary).not.toContain(".gitkeep");
+  });
+
+  it("skips the login step when a credential already resolves", () => {
+    const summary = formatInitSummary({
+      rootDir: "/home/user/code/danny",
+      files,
+      cwd: "/home/user/code",
+      signedIn: true,
+    });
+
+    expect(summary).not.toContain(`${CLI_COMMAND_NAME} login`);
+    expect(summary).toContain("1. cd danny");
+    expect(summary).toContain(`2. ${CLI_COMMAND_NAME} dev`);
+  });
+
+  it("omits cd when init ran inside the target directory", () => {
+    const summary = formatInitSummary({
+      rootDir: "/home/user/code/danny",
+      files,
+      cwd: "/home/user/code/danny",
+      signedIn: false,
+    });
+
+    expect(summary).not.toContain("cd ");
+    expect(summary).toContain(`1. ${CLI_COMMAND_NAME} login`);
+    expect(summary).toMatch(
+      new RegExp(`2\\. ${CLI_COMMAND_NAME} dev\\s+# start the local playground`)
+    );
+  });
+
+  it("uses an absolute cd path for targets outside the cwd", () => {
+    const summary = formatInitSummary({
+      rootDir: "/srv/agents/danny",
+      files,
+      cwd: "/home/user/code",
+      signedIn: true,
+    });
+
+    expect(summary).toContain("cd /srv/agents/danny");
+    expect(summary).toContain(`${CLI_COMMAND_NAME} dev`);
+    expect(summary).not.toContain(`${CLI_COMMAND_NAME} dev /`);
+  });
+
+  it("dims secondary scaffold and next-step note text when color is on", () => {
+    const summary = formatInitSummary({
+      rootDir: "/home/user/code/danny",
+      files,
+      cwd: "/home/user/code",
+      signedIn: true,
+      color: true,
+    });
+
+    expect(summary).toContain("\u001b[2m      create  package.json\u001b[0m");
+    expect(summary).toContain(
+      "\u001b[2mProject: /home/user/code/danny\u001b[0m"
+    );
+    expect(summary).toContain("\u001b[2m# start the local playground\u001b[0m");
+    // Primary headings stay undimmed.
+    expect(summary).toContain("Initialized agent danny");
+    expect(summary).not.toContain("\u001b[2mInitialized agent danny\u001b[0m");
+    expect(summary).toContain("Next steps:");
+    expect(summary).not.toContain("\u001b[2mNext steps:\u001b[0m");
+  });
+});