@cyanautomation/kaseki-agent 1.4.1

package/src/kaseki-api-config.test.ts

@@ -0,0 +1,315 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { loadConfig, validateApiKey } from './kaseki-api-config';
+import { secretValueCache } from './secret-value-cache';
+
+describe('kaseki-api-config load configuration', () => {
+  const originalEnv = process.env;
+  let testDir: string;
+
+  beforeEach(() => {
+    jest.resetModules();
+    secretValueCache.clear();
+    process.env = { ...originalEnv };
+    testDir = fs.mkdtempSync(path.join('/tmp', 'kaseki-config-test-'));
+  });
+
+  afterEach(() => {
+    secretValueCache.clear();
+    process.env = originalEnv;
+    fs.rmSync(testDir, { recursive: true, force: true });
+  });
+
+  test('loadConfig loads valid configuration from environment variables', () => {
+    process.env.KASEKI_API_KEYS = 'key1,key2,key3';
+    process.env.KASEKI_API_PORT = '3000';
+    process.env.KASEKI_API_MAX_CONCURRENT_RUNS = '5';
+    process.env.KASEKI_AGENT_TIMEOUT_SECONDS = '600';
+    process.env.KASEKI_MAX_DIFF_BYTES = '500000';
+    process.env.KASEKI_TASK_MODE = 'inspect';
+    process.env.KASEKI_RESULTS_DIR = testDir;
+    process.env.KASEKI_API_LOG_LEVEL = 'debug';
+    process.env.KASEKI_API_JOB_INDEX_MAX_ENTRIES = '250';
+    process.env.KASEKI_ARTIFACT_CACHE_MAX_ENTRIES = '7';
+    process.env.KASEKI_ARTIFACT_CACHE_TTL_MS = '12345';
+    process.env.KASEKI_ARTIFACT_CACHE_MAX_FILE_BYTES = '4096';
+
+    const config = loadConfig();
+
+    expect(config.apiKeys).toEqual(['key1', 'key2', 'key3']);
+    expect(config.port).toBe(3000);
+    expect(config.maxConcurrentRuns).toBe(5);
+    expect(config.agentTimeoutSeconds).toBe(600);
+    expect(config.maxDiffBytes).toBe(500000);
+    expect(config.defaultTaskMode).toBe('inspect');
+    expect(config.resultsDir).toBe(testDir);
+    expect(config.logLevel).toBe('debug');
+    expect(config.jobIndexMaxEntries).toBe(250);
+    expect(config.artifactCacheMaxEntries).toBe(7);
+    expect(config.artifactCacheTtlMs).toBe(12345);
+    expect(config.artifactCacheMaxFileBytes).toBe(4096);
+  });
+
+  test('loadConfig uses default values when env vars are not set', () => {
+    process.env.KASEKI_API_KEYS = 'default-key';
+    process.env.KASEKI_RESULTS_DIR = testDir;
+    delete process.env.KASEKI_API_PORT;
+    delete process.env.KASEKI_API_MAX_CONCURRENT_RUNS;
+    delete process.env.KASEKI_AGENT_TIMEOUT_SECONDS;
+    delete process.env.KASEKI_MAX_DIFF_BYTES;
+    delete process.env.KASEKI_TASK_MODE;
+    delete process.env.KASEKI_API_LOG_LEVEL;
+    delete process.env.KASEKI_API_JOB_INDEX_MAX_ENTRIES;
+    delete process.env.KASEKI_ARTIFACT_CACHE_MAX_ENTRIES;
+    delete process.env.KASEKI_ARTIFACT_CACHE_TTL_MS;
+    delete process.env.KASEKI_ARTIFACT_CACHE_MAX_FILE_BYTES;
+
+    const config = loadConfig();
+
+    expect(config.port).toBe(8080); // default
+    expect(config.maxConcurrentRuns).toBe(3); // default
+    expect(config.agentTimeoutSeconds).toBe(5700); // default
+    expect(config.maxDiffBytes).toBe(200000); // default
+    expect(config.defaultTaskMode).toBe('patch'); // default
+    expect(config.logLevel).toBe('info'); // default
+    expect(config.jobIndexMaxEntries).toBe(1000); // default
+    expect(config.artifactCacheMaxEntries).toBe(20); // default
+    expect(config.artifactCacheTtlMs).toBe(5 * 60 * 1000); // default
+    expect(config.artifactCacheMaxFileBytes).toBe(10 * 1024 * 1024); // default
+  });
+
+  test('loadConfig throws when KASEKI_API_KEYS is not set', () => {
+    delete process.env.KASEKI_API_KEYS;
+    delete process.env.KASEKI_API_KEYS_FILE;
+    process.env.KASEKI_RESULTS_DIR = testDir;
+
+    expect(() => loadConfig()).toThrow('KASEKI_API_KEYS environment variable is required');
+  });
+
+  test('loadConfig throws when KASEKI_API_PORT is invalid', () => {
+    process.env.KASEKI_API_KEYS = 'test-key';
+    process.env.KASEKI_RESULTS_DIR = testDir;
+    process.env.KASEKI_API_PORT = 'not-a-port';
+
+    expect(() => loadConfig()).toThrow('KASEKI_API_PORT must be a valid port number');
+  });
+
+  test('loadConfig throws when KASEKI_API_PORT is out of range', () => {
+    process.env.KASEKI_API_KEYS = 'test-key';
+    process.env.KASEKI_RESULTS_DIR = testDir;
+    process.env.KASEKI_API_PORT = '99999';
+
+    expect(() => loadConfig()).toThrow('KASEKI_API_PORT must be a valid port number');
+  });
+
+  test('loadConfig throws when KASEKI_API_MAX_CONCURRENT_RUNS is invalid', () => {
+    process.env.KASEKI_API_KEYS = 'test-key';
+    process.env.KASEKI_RESULTS_DIR = testDir;
+    process.env.KASEKI_API_MAX_CONCURRENT_RUNS = '-1';
+
+    expect(() => loadConfig()).toThrow('KASEKI_API_MAX_CONCURRENT_RUNS must be >= 1');
+  });
+
+  test('loadConfig throws when KASEKI_AGENT_TIMEOUT_SECONDS is invalid', () => {
+    process.env.KASEKI_API_KEYS = 'test-key';
+    process.env.KASEKI_RESULTS_DIR = testDir;
+    process.env.KASEKI_AGENT_TIMEOUT_SECONDS = 'not-a-number';
+
+    expect(() => loadConfig()).toThrow('KASEKI_AGENT_TIMEOUT_SECONDS must be >= 1');
+  });
+
+  test('loadConfig throws when KASEKI_MAX_DIFF_BYTES is invalid', () => {
+    process.env.KASEKI_API_KEYS = 'test-key';
+    process.env.KASEKI_RESULTS_DIR = testDir;
+    process.env.KASEKI_MAX_DIFF_BYTES = '0';
+
+    expect(() => loadConfig()).toThrow('KASEKI_MAX_DIFF_BYTES must be >= 1');
+  });
+
+  test('loadConfig throws when KASEKI_API_JOB_INDEX_MAX_ENTRIES is invalid', () => {
+    process.env.KASEKI_API_KEYS = 'test-key';
+    process.env.KASEKI_RESULTS_DIR = testDir;
+    process.env.KASEKI_API_JOB_INDEX_MAX_ENTRIES = '-1';
+
+    expect(() => loadConfig()).toThrow('KASEKI_API_JOB_INDEX_MAX_ENTRIES must be >= 0');
+  });
+
+  test('loadConfig throws when artifact cache configuration is invalid', () => {
+    process.env.KASEKI_API_KEYS = 'test-key';
+    process.env.KASEKI_RESULTS_DIR = testDir;
+    process.env.KASEKI_ARTIFACT_CACHE_MAX_ENTRIES = '-1';
+    expect(() => loadConfig()).toThrow('KASEKI_ARTIFACT_CACHE_MAX_ENTRIES must be >= 0');
+
+    process.env.KASEKI_ARTIFACT_CACHE_MAX_ENTRIES = '1';
+    process.env.KASEKI_ARTIFACT_CACHE_TTL_MS = '-1';
+    expect(() => loadConfig()).toThrow('KASEKI_ARTIFACT_CACHE_TTL_MS must be >= 0');
+
+    process.env.KASEKI_ARTIFACT_CACHE_TTL_MS = '1';
+    process.env.KASEKI_ARTIFACT_CACHE_MAX_FILE_BYTES = '-1';
+    expect(() => loadConfig()).toThrow('KASEKI_ARTIFACT_CACHE_MAX_FILE_BYTES must be >= 0');
+  });
+
+  test('loadConfig throws when KASEKI_TASK_MODE is invalid', () => {
+    process.env.KASEKI_API_KEYS = 'test-key';
+    process.env.KASEKI_RESULTS_DIR = testDir;
+    process.env.KASEKI_TASK_MODE = 'invalid-mode';
+
+    expect(() => loadConfig()).toThrow("KASEKI_TASK_MODE must be 'patch' or 'inspect'");
+  });
+
+  test('loadConfig throws when KASEKI_RESULTS_DIR does not exist', () => {
+    process.env.KASEKI_API_KEYS = 'test-key';
+    process.env.KASEKI_RESULTS_DIR = '/nonexistent/path/to/dir';
+
+    expect(() => loadConfig()).toThrow('KASEKI_RESULTS_DIR does not exist');
+  });
+
+  test('loadConfig throws when KASEKI_API_LOG_LEVEL is invalid', () => {
+    process.env.KASEKI_API_KEYS = 'test-key';
+    process.env.KASEKI_RESULTS_DIR = testDir;
+    process.env.KASEKI_API_LOG_LEVEL = 'verbose';
+
+    expect(() => loadConfig()).toThrow('KASEKI_API_LOG_LEVEL must be debug/info/warn/error');
+  });
+
+  test('loadConfig strips whitespace from API keys', () => {
+    process.env.KASEKI_API_KEYS = '  key1  ,  key2  ,  key3  ';
+    process.env.KASEKI_RESULTS_DIR = testDir;
+
+    const config = loadConfig();
+
+    expect(config.apiKeys).toEqual(['key1', 'key2', 'key3']);
+  });
+});
+
+describe('kaseki-api-config load API keys from file', () => {
+  const originalEnv = process.env;
+  let testDir: string;
+
+  beforeEach(() => {
+    jest.resetModules();
+    secretValueCache.clear();
+    process.env = { ...originalEnv };
+    testDir = fs.mkdtempSync(path.join('/tmp', 'kaseki-config-keys-test-'));
+  });
+
+  afterEach(() => {
+    secretValueCache.clear();
+    process.env = originalEnv;
+    fs.rmSync(testDir, { recursive: true, force: true });
+  });
+
+  test('loadConfig reads API keys from KASEKI_API_KEYS_FILE', () => {
+    const keysFile = path.join(testDir, 'api-keys.txt');
+    fs.writeFileSync(keysFile, 'file-key-1\nfile-key-2\nfile-key-3\n');
+
+    process.env.KASEKI_API_KEYS_FILE = keysFile;
+    process.env.KASEKI_RESULTS_DIR = testDir;
+
+    const config = loadConfig();
+
+    expect(config.apiKeys).toEqual(['file-key-1', 'file-key-2', 'file-key-3']);
+  });
+
+  test('loadConfig prefers KASEKI_API_KEYS over KASEKI_API_KEYS_FILE', () => {
+    const keysFile = path.join(testDir, 'api-keys.txt');
+    fs.writeFileSync(keysFile, 'file-key-1\nfile-key-2\n');
+
+    process.env.KASEKI_API_KEYS = 'env-key-1,env-key-2';
+    process.env.KASEKI_API_KEYS_FILE = keysFile;
+    process.env.KASEKI_RESULTS_DIR = testDir;
+
+    const config = loadConfig();
+
+    expect(config.apiKeys).toEqual(['env-key-1', 'env-key-2']);
+  });
+
+  test('loadConfig reuses cached API key file contents when metadata is unchanged', () => {
+    const keysFile = path.join(testDir, 'api-keys.txt');
+    const fixedTime = new Date('2020-01-01T00:00:00.000Z');
+    fs.writeFileSync(keysFile, 'file-key-1\nfile-key-2\n');
+    fs.utimesSync(keysFile, fixedTime, fixedTime);
+
+    process.env.KASEKI_API_KEYS_FILE = keysFile;
+    process.env.KASEKI_RESULTS_DIR = testDir;
+
+    expect(loadConfig().apiKeys).toEqual(['file-key-1', 'file-key-2']);
+
+    fs.writeFileSync(keysFile, 'file-key-3\nfile-key-4\n');
+    fs.utimesSync(keysFile, fixedTime, fixedTime);
+
+    expect(loadConfig().apiKeys).toEqual(['file-key-1', 'file-key-2']);
+  });
+
+  test('loadConfig skips comments and empty lines in API keys file', () => {
+    const keysFile = path.join(testDir, 'api-keys.txt');
+    fs.writeFileSync(keysFile, '# This is a comment\nfile-key-1\n\n# Another comment\nfile-key-2\n');
+
+    process.env.KASEKI_API_KEYS_FILE = keysFile;
+    process.env.KASEKI_RESULTS_DIR = testDir;
+
+    const config = loadConfig();
+
+    expect(config.apiKeys).toEqual(['file-key-1', 'file-key-2']);
+  });
+
+  test('loadConfig strips whitespace from keys in file', () => {
+    const keysFile = path.join(testDir, 'api-keys.txt');
+    fs.writeFileSync(keysFile, '  file-key-1  \n  file-key-2  \n  file-key-3  \n');
+
+    process.env.KASEKI_API_KEYS_FILE = keysFile;
+    process.env.KASEKI_RESULTS_DIR = testDir;
+
+    const config = loadConfig();
+
+    expect(config.apiKeys).toEqual(['file-key-1', 'file-key-2', 'file-key-3']);
+  });
+
+  test('loadConfig falls back to KASEKI_API_KEYS when file is empty', () => {
+    const keysFile = path.join(testDir, 'api-keys.txt');
+    fs.writeFileSync(keysFile, '');
+
+    process.env.KASEKI_API_KEYS_FILE = keysFile;
+    process.env.KASEKI_API_KEYS = 'fallback-key';
+    process.env.KASEKI_RESULTS_DIR = testDir;
+
+    const config = loadConfig();
+
+    expect(config.apiKeys).toEqual(['fallback-key']);
+  });
+
+  test('loadConfig throws when KASEKI_API_KEYS_FILE is unreadable', () => {
+    process.env.KASEKI_API_KEYS_FILE = '/nonexistent/path/keys.txt';
+    process.env.KASEKI_RESULTS_DIR = testDir;
+
+    expect(() => loadConfig()).toThrow('Failed to read KASEKI_API_KEYS_FILE');
+  });
+});
+
+describe('kaseki-api-config validate API key', () => {
+  const config = {
+    port: 8080,
+    apiKeys: ['valid-key-1', 'valid-key-2'],
+    resultsDir: '/tmp',
+    maxConcurrentRuns: 3,
+    defaultTaskMode: 'patch' as const,
+    maxDiffBytes: 200000,
+    agentTimeoutSeconds: 1200,
+    logLevel: 'info' as const,
+  };
+
+  test('validateApiKey returns true for valid API key', () => {
+    expect(validateApiKey(config, 'valid-key-1')).toBe(true);
+    expect(validateApiKey(config, 'valid-key-2')).toBe(true);
+  });
+
+  test('validateApiKey returns false for invalid API key', () => {
+    expect(validateApiKey(config, 'invalid-key')).toBe(false);
+    expect(validateApiKey(config, '')).toBe(false);
+  });
+
+  test('validateApiKey is case-sensitive', () => {
+    expect(validateApiKey(config, 'VALID-KEY-1')).toBe(false);
+    expect(validateApiKey(config, 'Valid-Key-1')).toBe(false);
+  });
+});

package/src/kaseki-api-config.ts

@@ -0,0 +1,175 @@
+import * as fs from 'fs';
+import { secretValueCache } from './secret-value-cache';
+
+/**
+ * Configuration for the Kaseki API service.
+ */
+export const DEFAULT_JOB_INDEX_MAX_ENTRIES = 1000;
+// Artifact cache constants moved to private scope (no longer exported as they are only used internally)
+const DEFAULT_ARTIFACT_CACHE_MAX_ENTRIES = 20;
+const DEFAULT_ARTIFACT_CACHE_TTL_MS = 5 * 60 * 1000;
+const DEFAULT_ARTIFACT_CACHE_MAX_FILE_BYTES = 10 * 1024 * 1024;
+
+export interface KasekiApiConfig {
+  port: number;
+  apiKeys: string[];
+  resultsDir: string;
+  maxConcurrentRuns: number;
+  defaultTaskMode: 'patch' | 'inspect';
+  maxDiffBytes: number;
+  agentTimeoutSeconds: number;
+  logLevel: 'debug' | 'info' | 'warn' | 'error';
+  /**
+   * Maximum number of terminal jobs retained in the API jobs index.
+   * Active queued/running jobs are always retained in addition to this cap.
+   */
+  jobIndexMaxEntries?: number;
+  /** Maximum number of artifact content files cached in memory. Set to 0 to disable caching. */
+  artifactCacheMaxEntries?: number;
+  /** Artifact content cache time-to-live in milliseconds. */
+  artifactCacheTtlMs?: number;
+  /** Maximum artifact file size eligible for content caching, in bytes. */
+  artifactCacheMaxFileBytes?: number;
+}
+
+/**
+ * Load and validate configuration from environment variables.
+ */
+export function loadConfig(): KasekiApiConfig {
+  const apiKeys = loadApiKeys();
+  if (!apiKeys || apiKeys.length === 0) {
+    throw new Error(
+      'KASEKI_API_KEYS environment variable is required. ' +
+        'Set it to a comma-separated list of API keys, or KASEKI_API_KEYS_FILE pointing to a file.'
+    );
+  }
+
+  const port = parseInt(process.env.KASEKI_API_PORT || '8080', 10);
+  if (isNaN(port) || port < 1 || port > 65535) {
+    throw new Error(`KASEKI_API_PORT must be a valid port number, got: ${process.env.KASEKI_API_PORT}`);
+  }
+
+  const maxConcurrentRuns = parseInt(process.env.KASEKI_API_MAX_CONCURRENT_RUNS || '3', 10);
+  if (isNaN(maxConcurrentRuns) || maxConcurrentRuns < 1) {
+    throw new Error(`KASEKI_API_MAX_CONCURRENT_RUNS must be >= 1, got: ${process.env.KASEKI_API_MAX_CONCURRENT_RUNS}`);
+  }
+
+  const agentTimeoutSeconds = parseInt(process.env.KASEKI_AGENT_TIMEOUT_SECONDS || '5700', 10);
+  if (isNaN(agentTimeoutSeconds) || agentTimeoutSeconds < 1) {
+    throw new Error(
+      `KASEKI_AGENT_TIMEOUT_SECONDS must be >= 1, got: ${process.env.KASEKI_AGENT_TIMEOUT_SECONDS}`
+    );
+  }
+
+  const maxDiffBytes = parseInt(process.env.KASEKI_MAX_DIFF_BYTES || '200000', 10);
+  if (isNaN(maxDiffBytes) || maxDiffBytes < 1) {
+    throw new Error(`KASEKI_MAX_DIFF_BYTES must be >= 1, got: ${process.env.KASEKI_MAX_DIFF_BYTES}`);
+  }
+
+  const jobIndexMaxEntries = parseInt(
+    process.env.KASEKI_API_JOB_INDEX_MAX_ENTRIES || String(DEFAULT_JOB_INDEX_MAX_ENTRIES),
+    10
+  );
+  if (isNaN(jobIndexMaxEntries) || jobIndexMaxEntries < 0) {
+    throw new Error(
+      `KASEKI_API_JOB_INDEX_MAX_ENTRIES must be >= 0, got: ${process.env.KASEKI_API_JOB_INDEX_MAX_ENTRIES}`
+    );
+  }
+
+  const artifactCacheMaxEntries = parseInt(
+    process.env.KASEKI_ARTIFACT_CACHE_MAX_ENTRIES || String(DEFAULT_ARTIFACT_CACHE_MAX_ENTRIES),
+    10
+  );
+  if (isNaN(artifactCacheMaxEntries) || artifactCacheMaxEntries < 0) {
+    throw new Error(
+      `KASEKI_ARTIFACT_CACHE_MAX_ENTRIES must be >= 0, got: ${process.env.KASEKI_ARTIFACT_CACHE_MAX_ENTRIES}`
+    );
+  }
+
+  const artifactCacheTtlMs = parseInt(
+    process.env.KASEKI_ARTIFACT_CACHE_TTL_MS || String(DEFAULT_ARTIFACT_CACHE_TTL_MS),
+    10
+  );
+  if (isNaN(artifactCacheTtlMs) || artifactCacheTtlMs < 0) {
+    throw new Error(
+      `KASEKI_ARTIFACT_CACHE_TTL_MS must be >= 0, got: ${process.env.KASEKI_ARTIFACT_CACHE_TTL_MS}`
+    );
+  }
+
+  const artifactCacheMaxFileBytes = parseInt(
+    process.env.KASEKI_ARTIFACT_CACHE_MAX_FILE_BYTES || String(DEFAULT_ARTIFACT_CACHE_MAX_FILE_BYTES),
+    10
+  );
+  if (isNaN(artifactCacheMaxFileBytes) || artifactCacheMaxFileBytes < 0) {
+    throw new Error(
+      `KASEKI_ARTIFACT_CACHE_MAX_FILE_BYTES must be >= 0, got: ${process.env.KASEKI_ARTIFACT_CACHE_MAX_FILE_BYTES}`
+    );
+  }
+
+  const taskMode = (process.env.KASEKI_TASK_MODE || 'patch') as 'patch' | 'inspect';
+  if (!['patch', 'inspect'].includes(taskMode)) {
+    throw new Error(`KASEKI_TASK_MODE must be 'patch' or 'inspect', got: ${taskMode}`);
+  }
+
+  const resultsDir = process.env.KASEKI_RESULTS_DIR || '/agents/kaseki-results';
+  if (!fs.existsSync(resultsDir)) {
+    throw new Error(`KASEKI_RESULTS_DIR does not exist: ${resultsDir}`);
+  }
+
+  const logLevel = (process.env.KASEKI_API_LOG_LEVEL || 'info') as 'debug' | 'info' | 'warn' | 'error';
+  if (!['debug', 'info', 'warn', 'error'].includes(logLevel)) {
+    throw new Error(`KASEKI_API_LOG_LEVEL must be debug/info/warn/error, got: ${logLevel}`);
+  }
+
+  return {
+    port,
+    apiKeys,
+    resultsDir,
+    maxConcurrentRuns,
+    defaultTaskMode: taskMode,
+    maxDiffBytes,
+    agentTimeoutSeconds,
+    logLevel,
+    jobIndexMaxEntries,
+    artifactCacheMaxEntries,
+    artifactCacheTtlMs,
+    artifactCacheMaxFileBytes,
+  };
+}
+
+/**
+ * Load API keys from environment variable or file.
+ */
+function loadApiKeys(): string[] {
+  const keysEnv = process.env.KASEKI_API_KEYS;
+  if (keysEnv) {
+    return keysEnv
+      .split(',')
+      .map((key) => key.trim())
+      .filter((key) => key);
+  }
+
+  const keysFile = process.env.KASEKI_API_KEYS_FILE;
+  if (keysFile) {
+    try {
+      const content = secretValueCache.readFile(keysFile).trim();
+      if (content) {
+        return content
+          .split('\n')
+          .map((line) => line.trim())
+          .filter((line) => line && !line.startsWith('#'));
+      }
+    } catch (err) {
+      throw new Error(`Failed to read KASEKI_API_KEYS_FILE: ${keysFile}: ${err}`);
+    }
+  }
+
+  return [];
+}
+
+/**
+ * Validate that an API key is valid.
+ */
+export function validateApiKey(config: KasekiApiConfig, token: string): boolean {
+  return config.apiKeys.includes(token);
+}