@cursorpool-dev/cli 0.5.6

package/node_modules/@cursor-pool/service/test/diagnostics.test.ts

@@ -0,0 +1,506 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import {
+  appendAgentCanaryDiagnostic,
+  appendAgentGatewayDiagnostic,
+  appendAgentRequestCheckDiagnostic,
+} from '../src/diagnostics';
+import type { AgentRequestCheck } from '../src/requestCheck';
+
+const allowedGate = {
+  state: 'allowed' as const,
+  productId: 'prod_basic',
+  modeStartedAt: '2026-05-31T00:05:00.000Z',
+};
+const releasedGate = {
+  state: 'blocked' as const,
+  reason: 'mode-released' as const,
+  releaseReason: 'invalid-token' as const,
+  releasedAt: '2026-05-31T00:10:00.000Z',
+};
+
+const canary = (requestId: string) => ({
+  requestId,
+  requestType: 'agent' as const,
+  source: 'cursor-agent-exec' as const,
+  model: 'unknown',
+  receivedAt: `2026-05-30T00:00:0${requestId}.000Z`,
+  runtimeId: 'runtime-1',
+  gate: allowedGate,
+});
+
+const requestCheck = (requestId: string): AgentRequestCheck => ({
+  requestId,
+  requestType: 'agent',
+  source: 'manual-check',
+  model: 'unknown',
+  receivedAt: `2026-05-31T00:00:0${requestId}.000Z`,
+  runtimeId: 'runtime-1',
+  decision: { state: 'blocked', reason: 'logged-out' },
+  route: { state: 'missing' },
+});
+
+const gateway = (requestId: string) => ({
+  requestId,
+  requestType: 'agent' as const,
+  source: 'manual-check' as const,
+  model: 'gpt-test',
+  receivedAt: `2026-05-31T00:20:0${requestId}.000Z`,
+  runtimeId: 'runtime-1',
+  decision: {
+    state: 'accepted' as const,
+    productId: 'prod_basic',
+    modeStartedAt: '2026-05-31T00:05:00.000Z',
+    route: { state: 'ready' as const, expiresAt: '2999-05-31T00:10:00.000Z' },
+  },
+  forward: { state: 'not-configured' as const },
+});
+
+test('appendAgentCanaryDiagnostic writes only sanitized canary JSONL fields', async () => {
+  const tempDir = await mkdtemp(join(tmpdir(), 'cursor-pool-diagnostics-'));
+  const diagnosticsFile = join(tempDir, 'diagnostics.jsonl');
+
+  try {
+    await appendAgentCanaryDiagnostic(
+      {
+        ...canary('1'),
+        prompt: 'do not store',
+        messages: [{ role: 'user', content: 'do not store' }],
+        apiKey: 'secret',
+        authorization: 'Bearer secret',
+        cookie: 'secret',
+        body: { hidden: true },
+        unknown: 'discard-me',
+      },
+      { diagnosticsFile },
+    );
+
+    const content = await readFile(diagnosticsFile, 'utf8');
+    const lines = content.trim().split('\n');
+    assert.equal(lines.length, 1);
+
+    const saved = JSON.parse(lines[0]) as Record<string, unknown>;
+    assert.deepEqual(saved, canary('1'));
+    assert.equal(Object.hasOwn(saved, 'prompt'), false);
+    assert.equal(Object.hasOwn(saved, 'messages'), false);
+    assert.equal(Object.hasOwn(saved, 'apiKey'), false);
+    assert.equal(Object.hasOwn(saved, 'authorization'), false);
+    assert.equal(Object.hasOwn(saved, 'cookie'), false);
+    assert.equal(Object.hasOwn(saved, 'body'), false);
+    assert.equal(Object.hasOwn(saved, 'unknown'), false);
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test('appendAgentCanaryDiagnostic writes released gate diagnostics fields', async () => {
+  const tempDir = await mkdtemp(join(tmpdir(), 'cursor-pool-diagnostics-'));
+  const diagnosticsFile = join(tempDir, 'diagnostics.jsonl');
+
+  try {
+    await appendAgentCanaryDiagnostic(
+      {
+        ...canary('1'),
+        gate: releasedGate,
+      },
+      { diagnosticsFile },
+    );
+
+    const content = await readFile(diagnosticsFile, 'utf8');
+    const saved = JSON.parse(content.trim()) as Record<string, unknown>;
+
+    assert.deepEqual(saved.gate, releasedGate);
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test('appendAgentCanaryDiagnostic keeps only the most recent diagnostics entries', async () => {
+  const tempDir = await mkdtemp(join(tmpdir(), 'cursor-pool-diagnostics-'));
+  const diagnosticsFile = join(tempDir, 'diagnostics.jsonl');
+
+  try {
+    await appendAgentCanaryDiagnostic(canary('1'), { diagnosticsFile, maxEntries: 2 });
+    await appendAgentCanaryDiagnostic(canary('2'), { diagnosticsFile, maxEntries: 2 });
+    await appendAgentCanaryDiagnostic(canary('3'), { diagnosticsFile, maxEntries: 2 });
+
+    const content = await readFile(diagnosticsFile, 'utf8');
+    const saved = content
+      .trim()
+      .split('\n')
+      .map((line) => JSON.parse(line) as { requestId: string });
+
+    assert.deepEqual(
+      saved.map((entry) => entry.requestId),
+      ['2', '3'],
+    );
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test('appendAgentCanaryDiagnostic drops invalid historical lines when trimming', async () => {
+  const tempDir = await mkdtemp(join(tmpdir(), 'cursor-pool-diagnostics-'));
+  const diagnosticsFile = join(tempDir, 'diagnostics.jsonl');
+
+  try {
+    await writeFile(diagnosticsFile, 'not-json\n{"requestId":"old"}\n', 'utf8');
+
+    await appendAgentCanaryDiagnostic(canary('1'), { diagnosticsFile, maxEntries: 2 });
+
+    const content = await readFile(diagnosticsFile, 'utf8');
+    const saved = content
+      .trim()
+      .split('\n')
+      .map((line) => JSON.parse(line) as { requestId: string });
+
+    assert.deepEqual(
+      saved.map((entry) => entry.requestId),
+      ['1'],
+    );
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test('appendAgentCanaryDiagnostic sanitizes historical diagnostics before rewrite', async () => {
+  const tempDir = await mkdtemp(join(tmpdir(), 'cursor-pool-diagnostics-'));
+  const diagnosticsFile = join(tempDir, 'diagnostics.jsonl');
+
+  try {
+    await writeFile(
+      diagnosticsFile,
+      `${JSON.stringify({
+        ...canary('1'),
+        prompt: 'do not keep',
+        apiKey: 'secret',
+        gate: {
+          ...allowedGate,
+          extra: 'discard-me',
+        },
+      })}\n`,
+      'utf8',
+    );
+
+    await appendAgentCanaryDiagnostic(canary('2'), { diagnosticsFile, maxEntries: 2 });
+
+    const content = await readFile(diagnosticsFile, 'utf8');
+    const saved = content
+      .trim()
+      .split('\n')
+      .map((line) => JSON.parse(line) as Record<string, unknown>);
+
+    assert.equal(saved.length, 2);
+    assert.deepEqual(saved[0], canary('1'));
+    assert.deepEqual(saved[1], canary('2'));
+    for (const entry of saved) {
+      assert.equal(Object.hasOwn(entry, 'prompt'), false);
+      assert.equal(Object.hasOwn(entry, 'apiKey'), false);
+      assert.equal(Object.hasOwn(entry.gate as Record<string, unknown>, 'extra'), false);
+    }
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test('appendAgentRequestCheckDiagnostic writes only sanitized request-check JSONL fields', async () => {
+  const tempDir = await mkdtemp(join(tmpdir(), 'cursor-pool-diagnostics-'));
+  const diagnosticsFile = join(tempDir, 'diagnostics.jsonl');
+
+  try {
+    await appendAgentRequestCheckDiagnostic(
+      {
+        ...requestCheck('1'),
+        prompt: 'do not store',
+        messages: [{ role: 'user', content: 'do not store' }],
+        headers: { authorization: 'Bearer secret' },
+        apiKey: 'secret',
+        cookie: 'secret',
+        body: { hidden: true },
+        unknown: 'discard-me',
+      } as AgentRequestCheck,
+      { diagnosticsFile },
+    );
+
+    const content = await readFile(diagnosticsFile, 'utf8');
+    const saved = JSON.parse(content.trim()) as Record<string, unknown>;
+
+    assert.deepEqual(saved, {
+      kind: 'agent-request-check',
+      ...requestCheck('1'),
+    });
+    assert.equal(Object.hasOwn(saved, 'prompt'), false);
+    assert.equal(Object.hasOwn(saved, 'messages'), false);
+    assert.equal(Object.hasOwn(saved, 'headers'), false);
+    assert.equal(Object.hasOwn(saved, 'apiKey'), false);
+    assert.equal(Object.hasOwn(saved, 'cookie'), false);
+    assert.equal(Object.hasOwn(saved, 'body'), false);
+    assert.equal(Object.hasOwn(saved, 'unknown'), false);
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test('appendAgentRequestCheckDiagnostic keeps canary and request-check diagnostics together', async () => {
+  const tempDir = await mkdtemp(join(tmpdir(), 'cursor-pool-diagnostics-'));
+  const diagnosticsFile = join(tempDir, 'diagnostics.jsonl');
+
+  try {
+    await appendAgentCanaryDiagnostic(canary('1'), { diagnosticsFile, maxEntries: 3 });
+    await appendAgentRequestCheckDiagnostic(requestCheck('2'), { diagnosticsFile, maxEntries: 3 });
+
+    const content = await readFile(diagnosticsFile, 'utf8');
+    const saved = content
+      .trim()
+      .split('\n')
+      .map((line) => JSON.parse(line) as Record<string, unknown>);
+
+    assert.equal(saved.length, 2);
+    assert.equal(Object.hasOwn(saved[0], 'kind'), false);
+    assert.equal(saved[1].kind, 'agent-request-check');
+    assert.deepEqual(saved[1], {
+      kind: 'agent-request-check',
+      ...requestCheck('2'),
+    });
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test('appendAgentRequestCheckDiagnostic writes safe route state without token', async () => {
+  const tempDir = await mkdtemp(join(tmpdir(), 'cursor-pool-diagnostics-'));
+  const diagnosticsFile = join(tempDir, 'diagnostics.jsonl');
+
+  try {
+    await appendAgentRequestCheckDiagnostic({
+      requestId: 'req-route',
+      requestType: 'agent',
+      source: 'manual-check',
+      model: 'gpt-test',
+      receivedAt: '2026-05-31T00:10:00.000Z',
+      runtimeId: 'runtime-1',
+      decision: {
+        state: 'allowed',
+        productId: 'prod_basic',
+        modeStartedAt: '2026-05-31T00:05:00.000Z',
+      },
+      route: {
+        state: 'ready',
+        expiresAt: '2026-05-31T00:20:00.000Z',
+      },
+    }, { diagnosticsFile });
+
+    const saved = JSON.parse((await readFile(diagnosticsFile, 'utf8')).trim()) as Record<string, unknown>;
+    assert.deepEqual(saved.route, {
+      state: 'ready',
+      expiresAt: '2026-05-31T00:20:00.000Z',
+    });
+    assert.doesNotMatch(JSON.stringify(saved), /rt_|secret|token/i);
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test('appendAgentRequestCheckDiagnostic sanitizes historical mixed diagnostics before rewrite', async () => {
+  const tempDir = await mkdtemp(join(tmpdir(), 'cursor-pool-diagnostics-'));
+  const diagnosticsFile = join(tempDir, 'diagnostics.jsonl');
+
+  try {
+    await writeFile(
+      diagnosticsFile,
+      [
+        JSON.stringify({ ...canary('1'), prompt: 'drop historical prompt' }),
+        JSON.stringify({ kind: 'agent-request-check', ...requestCheck('2'), apiKey: 'drop historical api key' }),
+        'not-json',
+      ].join('\n'),
+      'utf8',
+    );
+
+    await appendAgentRequestCheckDiagnostic(requestCheck('3'), { diagnosticsFile, maxEntries: 3 });
+
+    const content = await readFile(diagnosticsFile, 'utf8');
+    const saved = content
+      .trim()
+      .split('\n')
+      .map((line) => JSON.parse(line) as Record<string, unknown>);
+
+    assert.equal(saved.length, 3);
+    assert.equal(Object.hasOwn(saved[0], 'kind'), false);
+    assert.equal(saved[1].kind, 'agent-request-check');
+    assert.equal(saved[2].kind, 'agent-request-check');
+    for (const entry of saved) {
+      assert.equal(Object.hasOwn(entry, 'prompt'), false);
+      assert.equal(Object.hasOwn(entry, 'apiKey'), false);
+    }
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test('appendAgentGatewayDiagnostic writes only sanitized gateway JSONL fields', async () => {
+  const tempDir = await mkdtemp(join(tmpdir(), 'cursor-pool-diagnostics-'));
+  const diagnosticsFile = join(tempDir, 'diagnostics.jsonl');
+
+  try {
+    await appendAgentGatewayDiagnostic({
+      ...gateway('1'),
+      prompt: 'do not print',
+      apiKey: 'secret',
+      routeToken: 'rt_secret_value',
+    } as never, { diagnosticsFile });
+
+    const saved = JSON.parse((await readFile(diagnosticsFile, 'utf8')).trim()) as Record<string, unknown>;
+
+    assert.deepEqual(saved, {
+      kind: 'agent-request-gateway',
+      ...gateway('1'),
+    });
+    assert.doesNotMatch(JSON.stringify(saved), /prompt|apiKey|secret|routeToken|rt_secret_value/);
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test('appendAgentGatewayDiagnostic downgrades malformed runtime gateway decisions', async () => {
+  const tempDir = await mkdtemp(join(tmpdir(), 'cursor-pool-diagnostics-'));
+  const diagnosticsFile = join(tempDir, 'diagnostics.jsonl');
+
+  try {
+    await appendAgentGatewayDiagnostic({
+      ...gateway('1'),
+      decision: {
+        state: 'accepted',
+        productId: { apiKey: 'secret' },
+        modeStartedAt: 'token-secret',
+        route: {
+          state: 'ready',
+          expiresAt: { routeToken: 'rt_secret_value' },
+          token: 'secret',
+        },
+      },
+    } as never, { diagnosticsFile });
+
+    const saved = JSON.parse((await readFile(diagnosticsFile, 'utf8')).trim()) as Record<string, unknown>;
+
+    assert.deepEqual(saved.decision, { state: 'unknown' });
+    assert.doesNotMatch(
+      JSON.stringify(saved),
+      /secret|token|apiKey|routeToken|rt_secret_value|token-secret|expiresAt/i,
+    );
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test('appendAgentGatewayDiagnostic writes sanitized forward state', async () => {
+  const tempDir = await mkdtemp(join(tmpdir(), 'cursor-pool-diagnostics-'));
+  const diagnosticsFile = join(tempDir, 'diagnostics.jsonl');
+
+  try {
+    await appendAgentGatewayDiagnostic({
+      ...gateway('1'),
+      forward: {
+        state: 'forwarded',
+        upstreamRequestId: 'gw_req_1',
+        acceptedAt: '2026-05-31T00:30:00.000Z',
+        routeToken: 'rt_secret_value',
+      },
+    } as never, { diagnosticsFile });
+
+    const saved = JSON.parse((await readFile(diagnosticsFile, 'utf8')).trim()) as Record<string, unknown>;
+    assert.deepEqual(saved.forward, {
+      state: 'forwarded',
+      upstreamRequestId: 'gw_req_1',
+      acceptedAt: '2026-05-31T00:30:00.000Z',
+    });
+    assert.doesNotMatch(JSON.stringify(saved), /rt_secret_value/);
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test('appendAgentGatewayDiagnostic writes insufficient credits as safe reject reason', async () => {
+  const tempDir = await mkdtemp(join(tmpdir(), 'cursor-pool-diagnostics-'));
+  const diagnosticsFile = join(tempDir, 'diagnostics.jsonl');
+
+  try {
+    await appendAgentGatewayDiagnostic({
+      ...gateway('8'),
+      forward: {
+        state: 'rejected',
+        reason: 'insufficient-credits',
+      },
+      credits: 0,
+      routeToken: 'rt_secret_value',
+    } as never, { diagnosticsFile });
+
+    const saved = JSON.parse((await readFile(diagnosticsFile, 'utf8')).trim()) as Record<string, unknown>;
+    assert.deepEqual(saved.forward, {
+      state: 'rejected',
+      reason: 'insufficient-credits',
+    });
+    assert.equal(Object.hasOwn(saved, 'credits'), false);
+    assert.equal(Object.hasOwn(saved, 'routeToken'), false);
+    assert.doesNotMatch(JSON.stringify(saved), /rt_secret_value/);
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test('appendAgentGatewayDiagnostic downgrades malformed forward state', async () => {
+  const tempDir = await mkdtemp(join(tmpdir(), 'cursor-pool-diagnostics-'));
+  const diagnosticsFile = join(tempDir, 'diagnostics.jsonl');
+
+  try {
+    await appendAgentGatewayDiagnostic({
+      ...gateway('1'),
+      forward: {
+        state: 'forwarded',
+        upstreamRequestId: 'gw_req_1 token=rt_secret_value',
+        acceptedAt: 'not-a-date',
+      },
+    } as never, { diagnosticsFile });
+
+    const saved = JSON.parse((await readFile(diagnosticsFile, 'utf8')).trim()) as Record<string, unknown>;
+    assert.deepEqual(saved.forward, { state: 'unknown' });
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test('appendAgentGatewayDiagnostic sanitizes historical gateway entries before rewrite', async () => {
+  const tempDir = await mkdtemp(join(tmpdir(), 'cursor-pool-diagnostics-'));
+  const diagnosticsFile = join(tempDir, 'diagnostics.jsonl');
+
+  try {
+    await writeFile(
+      diagnosticsFile,
+      `${JSON.stringify({ kind: 'agent-request-gateway', ...gateway('1'), routeToken: 'rt_secret_value' })}\n`,
+      'utf8',
+    );
+    await appendAgentGatewayDiagnostic({
+      ...gateway('2'),
+      decision: {
+        state: 'route-missing',
+        productId: 'prod_basic',
+        modeStartedAt: '2026-05-31T00:05:00.000Z',
+        route: { state: 'missing' },
+      },
+    }, { diagnosticsFile });
+
+    const saved = (await readFile(diagnosticsFile, 'utf8'))
+      .trim()
+      .split('\n')
+      .map((line) => JSON.parse(line) as Record<string, unknown>);
+
+    assert.equal(saved.length, 2);
+    assert.equal(saved[0].kind, 'agent-request-gateway');
+    assert.equal(saved[1].kind, 'agent-request-gateway');
+    assert.doesNotMatch(JSON.stringify(saved), /routeToken|rt_secret_value/);
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});

package/node_modules/@cursor-pool/service/test/metadata.test.ts

@@ -0,0 +1,63 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { sanitizeServiceMetadata, sanitizeExtensionStatus } from '../src/metadata';
+
+test('sanitizeServiceMetadata retains whitelisted request fields and defaults unknown model', () => {
+  assert.deepEqual(
+    sanitizeServiceMetadata({
+      requestId: 'req-1',
+      requestType: 'agent',
+      source: 'cursor-agent-exec',
+      prompt: 'secret prompt',
+      apiKey: 'secret-key',
+      authorization: 'bearer secret',
+    }),
+    {
+      requestId: 'req-1',
+      model: 'unknown',
+      requestType: 'agent',
+      source: 'cursor-agent-exec',
+    },
+  );
+});
+
+test('sanitizeServiceMetadata keeps allowed optional metadata fields', () => {
+  assert.deepEqual(
+    sanitizeServiceMetadata({
+      requestId: 'req-2',
+      model: 'claude-4',
+      requestType: 'chat',
+      source: 'cursor',
+      cursorVersion: '1.2.3',
+      clientVersion: '0.1.0',
+      entrypoint: 'agent',
+      messages: ['secret'],
+    }),
+    {
+      requestId: 'req-2',
+      model: 'claude-4',
+      requestType: 'chat',
+      source: 'cursor',
+      cursorVersion: '1.2.3',
+      clientVersion: '0.1.0',
+      entrypoint: 'agent',
+    },
+  );
+});
+
+test('sanitizeExtensionStatus discards forbidden extension status fields', () => {
+  assert.deepEqual(
+    sanitizeExtensionStatus({
+      connected: true,
+      cursorVersion: '1.0.0',
+      clientVersion: '0.1.0',
+      token: 'secret',
+      prompt: 'secret prompt',
+    }),
+    {
+      connected: true,
+      cursorVersion: '1.0.0',
+      clientVersion: '0.1.0',
+    },
+  );
+});