@cursor/july 0.1.25 → 0.1.27

package/src/internal/http-channel.test.ts

@@ -1,402 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import { httpChannel } from "../channels.js";
-import type { SessionRecord } from "../types.js";
-import { buildHttpChannelRoutes } from "./http-channel.js";
-import type { SessionEngine } from "./session-engine.js";
-import { HTTP_CHANNEL_ID } from "./session-engine.js";
-
-function sessionRecord(overrides: Partial<SessionRecord> = {}): SessionRecord {
-  const now = new Date().toISOString();
-  return {
-    sessionId: "ses_test",
-    channelId: HTTP_CHANNEL_ID,
-    mode: "chat",
-    continuationKey: "cont_key",
-    auth: null,
-    turnCount: 1,
-    createdAt: now,
-    updatedAt: now,
-    ...overrides,
-  };
-}
-
-describe("buildHttpChannelRoutes", () => {
-  it("does not accept caller workspaceDir on POST /v1/session", async () => {
-    const send = vi.fn(async () => ({
-      id: "ses_test",
-      continuationToken: "cont",
-      isNew: true,
-      waitForCompletion: async () => ({ status: "completed" as const }),
-    }));
-    const engine = { send } as unknown as SessionEngine;
-    const createRoute = buildHttpChannelRoutes({
-      engine,
-      config: httpChannel(),
-      auth: [],
-    }).find(
-      (route) => route.method === "POST" && route.pattern === "/v1/session"
-    );
-    expect(createRoute).toBeDefined();
-
-    const response = await createRoute!.handler(
-      new Request("http://127.0.0.1:3000/v1/session", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({
-          message: "review",
-          workspaceDir: "/tmp/attacker-chosen",
-          workspaceFiles: { "pr/MANIFEST.md": "# evidence" },
-        }),
-      }),
-      { auth: null, params: {}, requestIp: "127.0.0.1" }
-    );
-
-    expect(response.status).toBe(200);
-    expect(send).toHaveBeenCalledWith(HTTP_CHANNEL_ID, "review", {
-      auth: null,
-      workspaceFiles: { "pr/MANIFEST.md": "# evidence" },
-    });
-  });
-
-  it("forwards purpose:eval on POST /v1/session for the eval harness", async () => {
-    const send = vi.fn(async () => ({
-      id: "ses_eval",
-      continuationToken: "cont",
-      isNew: true,
-      waitForCompletion: async () => ({ status: "completed" as const }),
-    }));
-    const engine = { send } as unknown as SessionEngine;
-    const createRoute = buildHttpChannelRoutes({
-      engine,
-      config: httpChannel(),
-      auth: [],
-    }).find(
-      (route) => route.method === "POST" && route.pattern === "/v1/session"
-    );
-    expect(createRoute).toBeDefined();
-
-    const response = await createRoute!.handler(
-      new Request("http://127.0.0.1:3000/v1/session", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ message: "eval case", purpose: "eval" }),
-      }),
-      { auth: null, params: {}, requestIp: "127.0.0.1" }
-    );
-
-    expect(response.status).toBe(200);
-    expect(send).toHaveBeenCalledWith(HTTP_CHANNEL_ID, "eval case", {
-      auth: null,
-      purpose: "eval",
-    });
-  });
-
-  it("forwards per-session cloud options on POST /v1/session", async () => {
-    const send = vi.fn(async () => ({
-      id: "ses_cloud",
-      continuationToken: "cont",
-      isNew: true,
-      waitForCompletion: async () => ({ status: "completed" as const }),
-    }));
-    const engine = { send } as unknown as SessionEngine;
-    const createRoute = buildHttpChannelRoutes({
-      engine,
-      config: httpChannel(),
-      auth: [],
-    }).find(
-      (route) => route.method === "POST" && route.pattern === "/v1/session"
-    );
-    expect(createRoute).toBeDefined();
-
-    const cloud = {
-      repos: [
-        {
-          url: "https://github.com/vercel-labs/deepsec",
-          startingRef: "f75a16803ec5250938bacfe41571d929e8564f45",
-        },
-      ],
-      autoCreatePR: false,
-    };
-    const response = await createRoute!.handler(
-      new Request("http://127.0.0.1:3000/v1/session", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({
-          message: "scan fixture",
-          purpose: "eval",
-          cloud,
-        }),
-      }),
-      { auth: null, params: {}, requestIp: "127.0.0.1" }
-    );
-
-    expect(response.status).toBe(200);
-    expect(send).toHaveBeenCalledWith(HTTP_CHANNEL_ID, "scan fixture", {
-      auth: null,
-      purpose: "eval",
-      cloud,
-    });
-  });
-
-  it("accepts playground follow-ups on non-http chat sessions", async () => {
-    const record = sessionRecord({
-      sessionId: "ses_drive",
-      channelId: "drive",
-      continuationKey: "drive_key",
-      auth: {
-        authenticator: "local-dev",
-        principalId: "loopback",
-        principalType: "runtime",
-      },
-    });
-    const send = vi.fn(async () => ({
-      id: record.sessionId,
-      continuationToken: "drive_key",
-      isNew: false,
-      waitForCompletion: async () => ({ status: "completed" as const }),
-    }));
-    const setContinuationToken = vi.fn(async () => undefined);
-    const engine = {
-      send,
-      setContinuationToken,
-      getOrRestoreSession: vi.fn(async () => record),
-    } as unknown as SessionEngine;
-
-    const followUpRoute = buildHttpChannelRoutes({
-      engine,
-      config: httpChannel(),
-      auth: [],
-      relaxSessionReadAuth: true,
-    }).find(
-      (route) =>
-        route.method === "POST" && route.pattern === "/v1/session/:sessionId"
-    );
-    expect(followUpRoute).toBeDefined();
-
-    const response = await followUpRoute!.handler(
-      new Request("http://127.0.0.1:3000/v1/session/ses_drive", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({
-          message: "look again at CI",
-          continuationToken: "drive:drive_key",
-        }),
-      }),
-      {
-        auth: null,
-        params: { sessionId: "ses_drive" },
-        requestIp: "127.0.0.1",
-      }
-    );
-
-    expect(response.status).toBe(200);
-    const body = (await response.json()) as {
-      ok: boolean;
-      continuationToken: string;
-    };
-    expect(body.ok).toBe(true);
-    expect(body.continuationToken.startsWith("drive:")).toBe(true);
-    expect(send).toHaveBeenCalledWith("drive", "look again at CI", {
-      auth: record.auth,
-      continuationToken: "drive_key",
-    });
-    expect(setContinuationToken).toHaveBeenCalledWith(
-      "ses_drive",
-      expect.any(String)
-    );
-  });
-
-  it("rejects follow-ups on task sessions", async () => {
-    const record = sessionRecord({
-      mode: "task",
-      channelId: "schedule",
-    });
-    const engine = {
-      send: vi.fn(),
-      getOrRestoreSession: vi.fn(async () => record),
-    } as unknown as SessionEngine;
-
-    const followUpRoute = buildHttpChannelRoutes({
-      engine,
-      config: httpChannel(),
-      auth: [],
-      relaxSessionReadAuth: true,
-    }).find(
-      (route) =>
-        route.method === "POST" && route.pattern === "/v1/session/:sessionId"
-    );
-    expect(followUpRoute).toBeDefined();
-
-    const response = await followUpRoute!.handler(
-      new Request("http://127.0.0.1:3000/v1/session/ses_test", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({
-          message: "ping",
-          continuationToken: "schedule:cont_key",
-        }),
-      }),
-      {
-        auth: null,
-        params: { sessionId: "ses_test" },
-        requestIp: "127.0.0.1",
-      }
-    );
-
-    expect(response.status).toBe(409);
-    const body = (await response.json()) as { error: string };
-    expect(body.error).toBe("session_not_followable");
-  });
-
-  it("stops an in-flight turn via POST /v1/session/:sessionId/stop", async () => {
-    const record = sessionRecord();
-    const interrupt = vi.fn(async () => true);
-    const engine = {
-      interrupt,
-      getOrRestoreSession: vi.fn(async () => record),
-    } as unknown as SessionEngine;
-
-    const stopRoute = buildHttpChannelRoutes({
-      engine,
-      config: httpChannel(),
-      auth: [],
-    }).find(
-      (route) =>
-        route.method === "POST" &&
-        route.pattern === "/v1/session/:sessionId/stop"
-    );
-    expect(stopRoute).toBeDefined();
-
-    const response = await stopRoute!.handler(
-      new Request("http://127.0.0.1:3000/v1/session/ses_test/stop", {
-        method: "POST",
-      }),
-      {
-        auth: null,
-        params: { sessionId: "ses_test" },
-        requestIp: "127.0.0.1",
-      }
-    );
-
-    expect(response.status).toBe(200);
-    const body = (await response.json()) as {
-      ok: boolean;
-      interrupted: boolean;
-    };
-    expect(body).toEqual({ ok: true, interrupted: true });
-    expect(interrupt).toHaveBeenCalledWith("ses_test");
-  });
-
-  it("returns interrupted:false when stop finds no active turn", async () => {
-    const record = sessionRecord();
-    const interrupt = vi.fn(async () => false);
-    const engine = {
-      interrupt,
-      getOrRestoreSession: vi.fn(async () => record),
-    } as unknown as SessionEngine;
-
-    const stopRoute = buildHttpChannelRoutes({
-      engine,
-      config: httpChannel(),
-      auth: [],
-    }).find(
-      (route) =>
-        route.method === "POST" &&
-        route.pattern === "/v1/session/:sessionId/stop"
-    );
-    expect(stopRoute).toBeDefined();
-
-    const response = await stopRoute!.handler(
-      new Request("http://127.0.0.1:3000/v1/session/ses_test/stop", {
-        method: "POST",
-      }),
-      {
-        auth: null,
-        params: { sessionId: "ses_test" },
-        requestIp: "127.0.0.1",
-      }
-    );
-
-    expect(response.status).toBe(200);
-    expect(await response.json()).toEqual({ ok: true, interrupted: false });
-  });
-
-  it("lazy-restores by id before streaming events after redeploy", async () => {
-    const record = sessionRecord({ sessionId: "ses_eval_trace" });
-    const getOrRestoreSession = vi.fn(async () => record);
-    const listEvents = vi.fn(async () => [
-      {
-        index: 0,
-        sessionId: "ses_eval_trace",
-        at: new Date().toISOString(),
-        type: "session.started",
-        data: {},
-      },
-    ]);
-    const engine = {
-      getOrRestoreSession,
-      listEvents,
-    } as unknown as SessionEngine;
-
-    const eventsRoute = buildHttpChannelRoutes({
-      engine,
-      config: httpChannel(),
-      auth: [],
-      relaxSessionReadAuth: true,
-    }).find(
-      (route) =>
-        route.method === "GET" &&
-        route.pattern === "/v1/session/:sessionId/events"
-    );
-    expect(eventsRoute).toBeDefined();
-
-    const response = await eventsRoute!.handler(
-      new Request(
-        "http://127.0.0.1:3000/v1/session/ses_eval_trace/events?format=json"
-      ),
-      {
-        auth: null,
-        params: { sessionId: "ses_eval_trace" },
-        requestIp: "127.0.0.1",
-      }
-    );
-
-    expect(response.status).toBe(200);
-    expect(getOrRestoreSession).toHaveBeenCalledWith("ses_eval_trace");
-    const body = (await response.json()) as {
-      sessionId: string;
-      events: unknown[];
-    };
-    expect(body.sessionId).toBe("ses_eval_trace");
-    expect(body.events).toHaveLength(1);
-  });
-
-  it("allows cross-principal session reads for --allow-anonymous beyond loopback", async () => {
-    const { requireSessionOwner } = await import("./http-channel.js");
-    const record = sessionRecord({
-      auth: {
-        authenticator: "slack",
-        principalId: "slack:T:C:1.0",
-        principalType: "user",
-      },
-    });
-    const caller = {
-      authenticator: "allow-all",
-      principalId: "anonymous",
-      principalType: "user" as const,
-    };
-    expect(
-      requireSessionOwner(record, caller, {
-        relax: true,
-        beyondLoopback: true,
-        requestIp: "10.0.0.5",
-      })
-    ).toBeUndefined();
-    const denied = requireSessionOwner(record, caller, {
-      relax: true,
-      beyondLoopback: false,
-      requestIp: "10.0.0.5",
-    });
-    expect(denied?.status).toBe(403);
-  });
-});

package/src/internal/init-project.test.ts

@@ -1,270 +0,0 @@
-import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { CLI_COMMAND_NAME } from "./distribution.js";
-import {
-  formatInitSummary,
-  initProject,
-  installScaffoldDependencies,
-} from "./init-project.js";
-
-describe("initProject", () => {
-  let dir: string;
-
-  beforeEach(async () => {
-    dir = await mkdtemp(join(tmpdir(), "agent-serve-init-"));
-  });
-
-  afterEach(async () => {
-    await rm(dir, { recursive: true, force: true });
-  });
-
-  it("scaffolds a fresh directory, including nested tool files", async () => {
-    const target = join(dir, "my-agent");
-    const result = await initProject({ dir: target });
-
-    expect(result.rootDir).toBe(target);
-    expect(result.created.sort()).toEqual([
-      "agent/ab/.gitkeep",
-      "agent/agent.ts",
-      "agent/channels/.gitkeep",
-      "agent/hooks/.gitkeep",
-      "agent/hooks/memory.ts",
-      "agent/instructions.md",
-      "agent/lib/.gitkeep",
-      "agent/mcp-connections/.gitkeep",
-      "agent/sandbox/workspace/.gitkeep",
-      "agent/schedules/.gitkeep",
-      "agent/skills/.gitkeep",
-      "agent/subagents/.gitkeep",
-      "agent/tools/echo.ts",
-      "evals/.gitkeep",
-      "package.json",
-      "tsconfig.json",
-    ]);
-    expect(result.skipped).toEqual([]);
-    expect(result.files.every((entry) => entry.action === "create")).toBe(true);
-
-    const agentTs = await readFile(join(target, "agent/agent.ts"), "utf8");
-    expect(agentTs).toContain('id: "grok-4.5"');
-    expect(agentTs).toContain('{ id: "effort", value: "high" }');
-    expect(agentTs).toContain('{ id: "fast", value: "true" }');
-    const echoTs = await readFile(join(target, "agent/tools/echo.ts"), "utf8");
-    expect(echoTs).toContain("defineTool");
-  });
-
-  it("scaffolds a type-checkable project (tsconfig + typescript dev deps)", async () => {
-    const target = join(dir, "typed");
-    await initProject({ dir: target });
-
-    const pkg = JSON.parse(
-      await readFile(join(target, "package.json"), "utf8")
-    ) as {
-      scripts: Record<string, string>;
-      devDependencies: Record<string, string>;
-    };
-    expect(pkg.scripts.check).toBe("tsc --noEmit");
-    expect(pkg.devDependencies.typescript).toBeDefined();
-    expect(pkg.devDependencies["@types/node"]).toBeDefined();
-
-    // JSONC (tsc allows comments), so assert on content instead of parsing.
-    const tsconfig = await readFile(join(target, "tsconfig.json"), "utf8");
-    expect(tsconfig).toContain('"moduleResolution": "bundler"');
-    expect(tsconfig).toContain('"strict": true');
-    expect(tsconfig).toContain('"noEmit": true');
-    expect(tsconfig).toContain('"include": ["agent/**/*", "evals/**/*"]');
-  });
-
-  it("honors name and model overrides", async () => {
-    const target = join(dir, "custom");
-    await initProject({ dir: target, name: "Custom Agent", model: "gpt-5.2" });
-
-    const pkg = JSON.parse(
-      await readFile(join(target, "package.json"), "utf8")
-    ) as { name: string };
-    expect(pkg.name).toBe("Custom Agent");
-    const agentTs = await readFile(join(target, "agent/agent.ts"), "utf8");
-    expect(agentTs).toContain('model: "gpt-5.2"');
-  });
-
-  it("skips existing files and fills in the missing ones", async () => {
-    const target = join(dir, "twice");
-    await initProject({ dir: target });
-    await writeFile(
-      join(target, "agent/instructions.md"),
-      "# custom instructions\n",
-      "utf8"
-    );
-
-    const second = await initProject({ dir: target });
-    expect(second.created).toEqual([]);
-    expect(second.skipped).toContain("agent/instructions.md");
-    expect(second.skipped).toContain("agent/skills/.gitkeep");
-    expect(second.skipped).toContain("evals/.gitkeep");
-    expect(await readFile(join(target, "agent/instructions.md"), "utf8")).toBe(
-      "# custom instructions\n"
-    );
-  });
-
-  it("creates only the missing files when some already exist", async () => {
-    const target = join(dir, "partial");
-    await mkdir(target, { recursive: true });
-    await writeFile(
-      join(target, "package.json"),
-      `${JSON.stringify({ name: "keep-me" }, null, 2)}\n`
-    );
-
-    const result = await initProject({ dir: target });
-    expect(result.skipped).toEqual(["package.json"]);
-    expect(result.created).toContain("agent/agent.ts");
-    expect(result.created).toContain("tsconfig.json");
-    expect(result.created).toContain("agent/lib/.gitkeep");
-    expect(result.created).toContain("evals/.gitkeep");
-    const pkg = JSON.parse(
-      await readFile(join(target, "package.json"), "utf8")
-    ) as { name: string };
-    expect(pkg.name).toBe("keep-me");
-  });
-});
-
-describe("installScaffoldDependencies", () => {
-  it("runs npm install in the project directory", async () => {
-    const calls: Array<{ command: string; args: string[]; cwd: string }> = [];
-    const result = await installScaffoldDependencies("/tmp/agent", {
-      stdio: "pipe",
-      runner: async ({ command, args, cwd }) => {
-        calls.push({ command, args, cwd });
-        return { exitCode: 0, stderr: "" };
-      },
-    });
-    expect(result.ok).toBe(true);
-    expect(calls).toEqual([
-      {
-        command: process.platform === "win32" ? "npm.cmd" : "npm",
-        args: ["install", "--no-fund", "--no-audit"],
-        cwd: "/tmp/agent",
-      },
-    ]);
-  });
-
-  it("surfaces a failed install exit code", async () => {
-    const result = await installScaffoldDependencies("/tmp/agent", {
-      stdio: "pipe",
-      runner: async () => ({ exitCode: 1, stderr: "boom" }),
-    });
-    expect(result).toEqual({ ok: false, exitCode: 1, stderr: "boom" });
-  });
-});
-
-describe("formatInitSummary", () => {
-  const files = [
-    { path: "package.json", action: "create" as const },
-    { path: "agent/agent.ts", action: "create" as const },
-    { path: "agent/instructions.md", action: "exist" as const },
-    { path: "agent/tools/echo.ts", action: "create" as const },
-  ];
-
-  it("lists created files, the project path, login, and dev", () => {
-    const summary = formatInitSummary({
-      rootDir: "/home/user/code/danny",
-      files,
-      cwd: "/home/user/code",
-      signedIn: false,
-    });
-
-    expect(summary).toContain("Initialized agent danny");
-    expect(summary).toContain("Project: /home/user/code/danny");
-    expect(summary).toContain("      create  package.json");
-    expect(summary).toContain("       exist  agent/instructions.md");
-    expect(summary).not.toContain(".gitkeep");
-    expect(summary).toContain("1. cd danny");
-    expect(summary).toContain(`2. ${CLI_COMMAND_NAME} login`);
-    expect(summary).toContain(`3. ${CLI_COMMAND_NAME} dev`);
-    expect(summary).not.toContain(`${CLI_COMMAND_NAME} dev danny`);
-    expect(summary).not.toContain(`${CLI_COMMAND_NAME} serve`);
-    // Scaffold block comes before next steps (init prints them around login).
-    expect(summary.indexOf("Project:")).toBeLessThan(
-      summary.indexOf("Next steps:")
-    );
-  });
-
-  it("omits .gitkeep placeholders from the printed file list", () => {
-    const summary = formatInitSummary({
-      rootDir: "/home/user/code/danny",
-      files: [
-        { path: "package.json", action: "create" },
-        { path: "agent/skills/.gitkeep", action: "create" },
-        { path: "evals/.gitkeep", action: "exist" },
-      ],
-      cwd: "/home/user/code",
-      signedIn: true,
-    });
-
-    expect(summary).toContain("      create  package.json");
-    expect(summary).not.toContain("skills");
-    expect(summary).not.toContain(".gitkeep");
-  });
-
-  it("skips the login step when a credential already resolves", () => {
-    const summary = formatInitSummary({
-      rootDir: "/home/user/code/danny",
-      files,
-      cwd: "/home/user/code",
-      signedIn: true,
-    });
-
-    expect(summary).not.toContain(`${CLI_COMMAND_NAME} login`);
-    expect(summary).toContain("1. cd danny");
-    expect(summary).toContain(`2. ${CLI_COMMAND_NAME} dev`);
-  });
-
-  it("omits cd when init ran inside the target directory", () => {
-    const summary = formatInitSummary({
-      rootDir: "/home/user/code/danny",
-      files,
-      cwd: "/home/user/code/danny",
-      signedIn: false,
-    });
-
-    expect(summary).not.toContain("cd ");
-    expect(summary).toContain(`1. ${CLI_COMMAND_NAME} login`);
-    expect(summary).toMatch(
-      new RegExp(`2\\. ${CLI_COMMAND_NAME} dev\\s+# start the local playground`)
-    );
-  });
-
-  it("uses an absolute cd path for targets outside the cwd", () => {
-    const summary = formatInitSummary({
-      rootDir: "/srv/agents/danny",
-      files,
-      cwd: "/home/user/code",
-      signedIn: true,
-    });
-
-    expect(summary).toContain("cd /srv/agents/danny");
-    expect(summary).toContain(`${CLI_COMMAND_NAME} dev`);
-    expect(summary).not.toContain(`${CLI_COMMAND_NAME} dev /`);
-  });
-
-  it("dims secondary scaffold and next-step note text when color is on", () => {
-    const summary = formatInitSummary({
-      rootDir: "/home/user/code/danny",
-      files,
-      cwd: "/home/user/code",
-      signedIn: true,
-      color: true,
-    });
-
-    expect(summary).toContain("\u001b[2m      create  package.json\u001b[0m");
-    expect(summary).toContain(
-      "\u001b[2mProject: /home/user/code/danny\u001b[0m"
-    );
-    expect(summary).toContain("\u001b[2m# start the local playground\u001b[0m");
-    // Primary headings stay undimmed.
-    expect(summary).toContain("Initialized agent danny");
-    expect(summary).not.toContain("\u001b[2mInitialized agent danny\u001b[0m");
-    expect(summary).toContain("Next steps:");
-    expect(summary).not.toContain("\u001b[2mNext steps:\u001b[0m");
-  });
-});