@farhanic017/octocode 3.5.0

package/test/reference/reference.test.ts

@@ -0,0 +1,311 @@
+import { afterEach, describe, expect } from "bun:test"
+import path from "path"
+import { Effect, Layer } from "effect"
+import { FSUtil } from "@octocode-ai/core/fs-util"
+import { CrossSpawnSpawner } from "@octocode-ai/core/cross-spawn-spawner"
+import { Global } from "@octocode-ai/core/global"
+import { Config } from "../../src/config/config"
+import { ConfigReference } from "../../src/config/reference"
+import { RuntimeFlags } from "../../src/effect/runtime-flags"
+import { Git } from "../../src/git"
+import { Reference } from "../../src/reference/reference"
+import { RepositoryCache } from "../../src/reference/repository-cache"
+import { disposeAllInstances, provideTmpdirInstance, tmpdirScoped } from "../fixture/fixture"
+import { testEffect } from "../lib/effect"
+
+afterEach(async () => {
+  await disposeAllInstances()
+})
+
+const referenceLayer = (flags: Partial<RuntimeFlags.Info> = {}) =>
+  Reference.layer.pipe(
+    Layer.provide(Config.defaultLayer),
+    Layer.provide(RepositoryCache.defaultLayer),
+    Layer.provide(RuntimeFlags.layer(flags)),
+  )
+
+const it = testEffect(
+  Layer.mergeAll(FSUtil.defaultLayer, CrossSpawnSpawner.defaultLayer, Git.defaultLayer, referenceLayer()),
+)
+const references = testEffect(
+  Layer.mergeAll(
+    FSUtil.defaultLayer,
+    CrossSpawnSpawner.defaultLayer,
+    Git.defaultLayer,
+    referenceLayer({ experimentalReferences: true }),
+  ),
+)
+
+const githubBase = <A, E, R>(url: string, self: Effect.Effect<A, E, R>) =>
+  Effect.acquireUseRelease(
+    Effect.sync(() => {
+      const previous = process.env.OCTOCODE_REPO_CLONE_GITHUB_BASE_URL
+      process.env.OCTOCODE_REPO_CLONE_GITHUB_BASE_URL = url
+      return previous
+    }),
+    () => self,
+    (previous) =>
+      Effect.sync(() => {
+        if (previous) process.env.OCTOCODE_REPO_CLONE_GITHUB_BASE_URL = previous
+        else delete process.env.OCTOCODE_REPO_CLONE_GITHUB_BASE_URL
+      }),
+  )
+
+const git = Effect.fn("ReferenceTest.git")(function* (cwd: string, args: string[]) {
+  return yield* Effect.promise(async () => {
+    const proc = Bun.spawn(["git", ...args], {
+      cwd,
+      stdout: "pipe",
+      stderr: "pipe",
+    })
+    const [stdout, stderr, code] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited,
+    ])
+    if (code !== 0) throw new Error(stderr.trim() || stdout.trim() || `git ${args.join(" ")} failed`)
+    return stdout.trim()
+  })
+})
+
+const waitForContent = (
+  fs: FSUtil.Interface,
+  file: string,
+  content: string,
+  attempts = 50,
+): Effect.Effect<void, FSUtil.Error> =>
+  Effect.gen(function* () {
+    if ((yield* fs.readFileStringSafe(file)) === content) return
+    if (attempts <= 0) throw new Error(`timed out waiting for ${file}`)
+    yield* Effect.sleep("100 millis")
+    yield* waitForContent(fs, file, content, attempts - 1)
+  })
+
+describe("reference", () => {
+  it.live("resolves supported local and git config forms", () =>
+    Effect.gen(function* () {
+      const root = path.resolve("octocode-reference-root")
+      const local = Reference.resolve({
+        name: "docs",
+        reference: ConfigReference.normalizeEntry({ path: "../docs" }),
+        directory: path.join(root, "packages", "app"),
+        worktree: root,
+      })
+      const repo = Reference.resolve({
+        name: "effect",
+        reference: ConfigReference.normalizeEntry({ repository: "Effect-TS/effect", branch: "main" }),
+        directory: path.join(root, "packages", "app"),
+        worktree: root,
+      })
+      const localString = Reference.resolve({
+        name: "notes",
+        reference: ConfigReference.normalizeEntry("./notes"),
+        directory: path.join(root, "packages", "app"),
+        worktree: root,
+      })
+      const repoString = Reference.resolve({
+        name: "repo",
+        reference: ConfigReference.normalizeEntry("owner/repo"),
+        directory: path.join(root, "packages", "app"),
+        worktree: root,
+      })
+
+      expect(local.kind).toBe("local")
+      if (local.kind === "local") expect(local.path).toBe(path.resolve(root, "../docs"))
+      expect(localString.kind).toBe("local")
+      if (localString.kind === "local") expect(localString.path).toBe(path.resolve(root, "notes"))
+      expect(repo.kind).toBe("git")
+      if (repo.kind === "git") {
+        expect(repo.repository).toBe("Effect-TS/effect")
+        expect(repo.branch).toBe("main")
+        expect(repo.path).toBe(path.join(Global.Path.repos, "github.com", "Effect-TS", "effect"))
+      }
+      expect(repoString.kind).toBe("git")
+      if (repoString.kind === "git") {
+        expect(repoString.repository).toBe("owner/repo")
+        expect(repoString.path).toBe(path.join(Global.Path.repos, "github.com", "owner", "repo"))
+      }
+    }),
+  )
+
+  it.live("keeps invalid repository references visible without materializing", () =>
+    provideTmpdirInstance(
+      (_dir) =>
+        Effect.gen(function* () {
+          const reference = yield* Reference.Service
+          const references = yield* reference.list()
+          const invalid = yield* reference.get("bad")
+
+          expect(references.map((item) => item.name)).toEqual(["bad"])
+          expect(invalid).toMatchObject({
+            name: "bad",
+            kind: "invalid",
+            repository: "not-a-repo",
+          })
+          if (invalid?.kind === "invalid") expect(invalid.message).toContain("Repository must be a git URL")
+        }),
+      {
+        config: {
+          reference: {
+            bad: "not-a-repo",
+          },
+        },
+      },
+    ),
+  )
+
+  it.live("marks same-cache references with different branches invalid", () =>
+    Effect.gen(function* () {
+      const root = path.resolve("octocode-reference-root")
+      const references = Reference.resolveAll({
+        directory: root,
+        worktree: root,
+        references: ConfigReference.normalize({
+          main: { repository: "owner/repo", branch: "main" },
+          dev: { repository: "github.com/owner/repo", branch: "dev" },
+          alsoMain: { repository: "https://github.com/owner/repo", branch: "main" },
+        }),
+      })
+
+      expect(references.map((reference) => reference.kind)).toEqual(["git", "invalid", "git"])
+      expect(references[1]?.kind).toBe("invalid")
+      if (references[1]?.kind === "invalid") {
+        expect(references[1].message).toContain("conflicts with @main")
+        expect(references[1].message).toContain("@dev requests dev")
+      }
+    }),
+  )
+
+  it.live("represents invalid aliases as invalid references", () =>
+    Effect.gen(function* () {
+      const root = path.resolve("octocode-reference-root")
+      const references = Reference.resolveAll({
+        directory: root,
+        worktree: root,
+        references: ConfigReference.normalize({
+          "bad/name": "owner/repo",
+        }),
+      })
+
+      expect(references).toEqual([
+        {
+          name: "bad/name",
+          kind: "invalid",
+          message: "Reference alias must not contain /, whitespace, comma, or backtick",
+        },
+      ])
+    }),
+  )
+
+  references.live("materializes configured git references during init", () =>
+    provideTmpdirInstance(
+      (_dir) =>
+        Effect.gen(function* () {
+          const fs = yield* FSUtil.Service
+          const cache = path.join(Global.Path.repos, "github.com", "octocode-reference-test", "repo")
+          yield* fs.remove(cache, { recursive: true }).pipe(Effect.ignore)
+          yield* Effect.addFinalizer(() => fs.remove(cache, { recursive: true }).pipe(Effect.ignore))
+
+          const source = yield* tmpdirScoped({ git: true })
+          const remoteRoot = yield* tmpdirScoped()
+          const remoteDir = path.join(remoteRoot, "octocode-reference-test")
+          const remoteRepo = path.join(remoteDir, "repo.git")
+
+          yield* Effect.promise(() => Bun.write(path.join(source, "README.md"), "configured\n"))
+          yield* git(source, ["add", "."])
+          yield* git(source, ["commit", "-m", "add readme"])
+          yield* fs.makeDirectory(remoteDir, { recursive: true }).pipe(Effect.orDie)
+          yield* git(remoteRoot, ["clone", "--bare", source, remoteRepo])
+
+          const reference = yield* Reference.Service
+          yield* githubBase(
+            `file://${remoteRoot}/`,
+            Effect.gen(function* () {
+              yield* reference.init()
+              yield* waitForContent(fs, path.join(cache, "README.md"), "configured\n")
+            }),
+          )
+
+          expect(yield* fs.existsSafe(path.join(cache, ".git"))).toBe(true)
+          expect(yield* fs.readFileString(path.join(cache, "README.md"))).toBe("configured\n")
+
+          const resolved = yield* reference.get("docs")
+          expect(resolved?.kind).toBe("git")
+          if (resolved?.kind === "git") expect(resolved.path).toBe(cache)
+        }),
+      {
+        config: {
+          reference: {
+            docs: "octocode-reference-test/repo",
+          },
+        },
+      },
+    ),
+  )
+
+  references.live("refreshes configured git references on new instance init", () =>
+    Effect.gen(function* () {
+      const fs = yield* FSUtil.Service
+      const cache = path.join(Global.Path.repos, "github.com", "octocode-reference-refresh", "repo")
+      yield* fs.remove(cache, { recursive: true }).pipe(Effect.ignore)
+      yield* Effect.addFinalizer(() => fs.remove(cache, { recursive: true }).pipe(Effect.ignore))
+
+      const source = yield* tmpdirScoped({ git: true })
+      const remoteRoot = yield* tmpdirScoped()
+      const remoteDir = path.join(remoteRoot, "octocode-reference-refresh")
+      const remoteRepo = path.join(remoteDir, "repo.git")
+
+      yield* Effect.promise(() => Bun.write(path.join(source, "README.md"), "v1\n"))
+      yield* git(source, ["add", "."])
+      yield* git(source, ["commit", "-m", "add readme"])
+      yield* fs.makeDirectory(remoteDir, { recursive: true }).pipe(Effect.orDie)
+      yield* git(remoteRoot, ["clone", "--bare", source, remoteRepo])
+
+      yield* githubBase(
+        `file://${remoteRoot}/`,
+        provideTmpdirInstance(
+          (_dir) =>
+            Effect.gen(function* () {
+              const reference = yield* Reference.Service
+              yield* reference.init()
+              yield* waitForContent(fs, path.join(cache, "README.md"), "v1\n")
+            }),
+          {
+            config: {
+              reference: {
+                docs: "octocode-reference-refresh/repo",
+              },
+            },
+          },
+        ),
+      )
+
+      const branch = yield* git(source, ["branch", "--show-current"])
+      yield* git(source, ["remote", "add", "origin", remoteRepo])
+      yield* Effect.promise(() => Bun.write(path.join(source, "README.md"), "v2\n"))
+      yield* git(source, ["add", "."])
+      yield* git(source, ["commit", "-m", "update readme"])
+      yield* git(source, ["push", "origin", `${branch}:${branch}`])
+
+      yield* githubBase(
+        `file://${remoteRoot}/`,
+        provideTmpdirInstance(
+          (_dir) =>
+            Effect.gen(function* () {
+              const reference = yield* Reference.Service
+              yield* reference.init()
+              yield* waitForContent(fs, path.join(cache, "README.md"), "v2\n")
+            }),
+          {
+            config: {
+              reference: {
+                docs: "octocode-reference-refresh/repo",
+              },
+            },
+          },
+        ),
+      )
+    }),
+  30_000,
+)
+})

package/test/server/AGENTS.md

@@ -0,0 +1,15 @@
+# Server Test Guide
+
+Use these patterns for server and HttpApi middleware tests in this directory.
+
+- Prefer focused middleware tests with tiny fake routes over full API route trees when testing routing, context, proxying, or middleware policy.
+- Use `testEffect(...)` with `NodeHttpServer.layerTest` for the primary in-test server and make relative `HttpClient` requests against it.
+- Use tiny `HttpApiBuilder` probe groups that declare the typed middleware under test and expose context such as `WorkspaceRouteContext`, `InstanceRef`, or `WorkspaceRef`.
+- Declare middleware in the same order as production when testing interactions, for example `InstanceContextMiddleware` followed by `WorkspaceRoutingMiddleware`.
+- For secondary upstream servers, build Effect `NodeHttpServer.layer(...)` into the current test scope with `Layer.build(...)` so the listener stays alive until the test scope exits.
+- Avoid `Bun.serve` when testing Effect HTTP middleware. Keep the test in the Effect HTTP stack unless the production path being tested is Bun-specific.
+- For WebSocket paths, use `Socket.makeWebSocket(...)` from the test client and assert protocol forwarding or frame relay when relevant.
+- Use scoped test layers for flags, database reset, and other global mutable state. Restore flags and reset state in finalizers.
+- Use `tmpdirScoped({ git: true })` plus `Project.use.fromDirectory(dir)` for project-backed requests.
+- If a test needs persisted state without matching runtime state, keep direct database setup inside a narrowly named helper that explains that state.
+- Add comments for non-obvious test topology, especially tests involving both the local test server and a fake upstream server.

package/test/server/auth.test.ts

@@ -0,0 +1,59 @@
+import { afterEach, describe, expect, test } from "bun:test"
+import { Option, Redacted } from "effect"
+import { Flag } from "@octocode-ai/core/flag/flag"
+import { ServerAuth } from "../../src/server/auth"
+
+const original = {
+  OCTOCODE_SERVER_PASSWORD: Flag.OCTOCODE_SERVER_PASSWORD,
+  OCTOCODE_SERVER_USERNAME: Flag.OCTOCODE_SERVER_USERNAME,
+}
+
+afterEach(() => {
+  Flag.OCTOCODE_SERVER_PASSWORD = original.OCTOCODE_SERVER_PASSWORD
+  Flag.OCTOCODE_SERVER_USERNAME = original.OCTOCODE_SERVER_USERNAME
+})
+
+describe("ServerAuth", () => {
+  test("does not emit auth headers without a password", () => {
+    Flag.OCTOCODE_SERVER_PASSWORD = undefined
+    Flag.OCTOCODE_SERVER_USERNAME = "alice"
+
+    expect(ServerAuth.header()).toBeUndefined()
+    expect(ServerAuth.headers()).toBeUndefined()
+  })
+
+  test("defaults to the octo username", () => {
+    Flag.OCTOCODE_SERVER_PASSWORD = "secret"
+    Flag.OCTOCODE_SERVER_USERNAME = undefined
+
+    expect(ServerAuth.headers()).toEqual({
+      Authorization: `Basic ${Buffer.from("octo:secret").toString("base64")}`,
+    })
+  })
+
+  test("uses the configured username", () => {
+    Flag.OCTOCODE_SERVER_PASSWORD = "secret"
+    Flag.OCTOCODE_SERVER_USERNAME = "alice"
+
+    expect(ServerAuth.headers()).toEqual({
+      Authorization: `Basic ${Buffer.from("alice:secret").toString("base64")}`,
+    })
+  })
+
+  test("prefers explicit credentials", () => {
+    Flag.OCTOCODE_SERVER_PASSWORD = "secret"
+    Flag.OCTOCODE_SERVER_USERNAME = "alice"
+
+    expect(ServerAuth.headers({ password: "cli-secret", username: "bob" })).toEqual({
+      Authorization: `Basic ${Buffer.from("bob:cli-secret").toString("base64")}`,
+    })
+  })
+
+  test("validates decoded credentials against effect config", () => {
+    const config = { password: Option.some("secret"), username: "alice" }
+
+    expect(ServerAuth.required(config)).toBe(true)
+    expect(ServerAuth.authorized({ username: "alice", password: Redacted.make("secret") }, config)).toBe(true)
+    expect(ServerAuth.authorized({ username: "octo", password: Redacted.make("secret") }, config)).toBe(false)
+  })
+})

package/test/server/global-bus.ts

@@ -0,0 +1,31 @@
+import { GlobalBus, type GlobalEvent } from "@/bus/global"
+import { Cause, Effect } from "effect"
+
+export function waitGlobalBusEvent(input: {
+  timeout?: number
+  message?: string
+  predicate: (event: GlobalEvent) => boolean
+}) {
+  return Effect.callback<GlobalEvent, unknown>((resume) => {
+    const cleanup = () => GlobalBus.off("event", handler)
+
+    const handler = (event: GlobalEvent) => {
+      try {
+        if (!input.predicate(event)) return
+        cleanup()
+        resume(Effect.succeed(event))
+      } catch (error) {
+        cleanup()
+        resume(Effect.fail(error))
+      }
+    }
+
+    GlobalBus.on("event", handler)
+    return Effect.sync(cleanup)
+  }).pipe(
+    Effect.timeout(input.timeout ?? 10_000),
+    Effect.mapError((error) =>
+      Cause.isTimeoutError(error) ? new Error(input.message ?? "timed out waiting for global bus event") : error,
+    ),
+  )
+}

package/test/server/httpapi-authorization.test.ts

@@ -0,0 +1,174 @@
+import { NodeHttpServer } from "@effect/platform-node"
+import { describe, expect } from "bun:test"
+import { Effect, Layer, Option, Schema } from "effect"
+import { HttpClient, HttpClientRequest, HttpRouter } from "effect/unstable/http"
+import { HttpApi, HttpApiBuilder, HttpApiEndpoint, HttpApiError, HttpApiGroup } from "effect/unstable/httpapi"
+import { ServerAuth } from "../../src/server/auth"
+import {
+  Authorization,
+  authorizationLayer,
+  ServerAuthorization,
+  serverAuthorizationLayer,
+} from "../../src/server/routes/instance/httpapi/middleware/authorization"
+import { testEffect } from "../lib/effect"
+
+const Api = HttpApi.make("test-authorization").add(
+  HttpApiGroup.make("test")
+    .add(
+      HttpApiEndpoint.get("probe", "/probe", {
+        success: Schema.String,
+      }),
+      HttpApiEndpoint.get("missing", "/missing", {
+        success: Schema.String,
+        error: HttpApiError.NotFound,
+      }),
+    )
+    .middleware(Authorization),
+)
+
+const ServerApi = HttpApi.make("test-server-authorization").add(
+  HttpApiGroup.make("test.v2")
+    .add(
+      HttpApiEndpoint.get("probe", "/api/probe", {
+        success: Schema.String,
+      }),
+    )
+    .middleware(ServerAuthorization),
+)
+
+const handlers = HttpApiBuilder.group(Api, "test", (handlers) =>
+  handlers
+    .handle("probe", () => Effect.succeed("ok"))
+    .handle("missing", () => Effect.fail(new HttpApiError.NotFound({}))),
+)
+
+const serverHandlers = HttpApiBuilder.group(ServerApi, "test.v2", (handlers) =>
+  handlers.handle("probe", () => Effect.succeed("ok")),
+)
+
+const apiLayer = HttpRouter.serve(
+  HttpApiBuilder.layer(Api).pipe(Layer.provide(handlers), Layer.provide(authorizationLayer)),
+  { disableListenLog: true, disableLogger: true },
+).pipe(Layer.provideMerge(NodeHttpServer.layerTest))
+
+const v2ApiLayer = HttpRouter.serve(
+  HttpApiBuilder.layer(ServerApi).pipe(Layer.provide(serverHandlers), Layer.provide(serverAuthorizationLayer)),
+  { disableListenLog: true, disableLogger: true },
+).pipe(Layer.provideMerge(NodeHttpServer.layerTest))
+
+const noAuthLayer = ServerAuth.Config.layer({ password: Option.none(), username: "octo" })
+const secretLayer = ServerAuth.Config.layer({ password: Option.some("secret"), username: "octo" })
+const kitSecretLayer = ServerAuth.Config.layer({ password: Option.some("secret"), username: "kit" })
+
+const it = testEffect(apiLayer.pipe(Layer.provide(noAuthLayer)))
+const itSecret = testEffect(apiLayer.pipe(Layer.provide(secretLayer)))
+const itKitSecret = testEffect(apiLayer.pipe(Layer.provide(kitSecretLayer)))
+const itV2Secret = testEffect(v2ApiLayer.pipe(Layer.provide(secretLayer)))
+
+const basic = (username: string, password: string) => ServerAuth.header({ username, password }) ?? ""
+
+const token = (username: string, password: string) => Buffer.from(`${username}:${password}`).toString("base64")
+
+const getProbe = (headers?: Record<string, string>) =>
+  HttpClientRequest.get("/probe").pipe(
+    headers ? HttpClientRequest.setHeaders(headers) : (request) => request,
+    HttpClient.execute,
+  )
+
+describe("HttpApi authorization middleware", () => {
+  it.live("allows requests when server password is not configured", () =>
+    Effect.gen(function* () {
+      const response = yield* getProbe()
+
+      expect(response.status).toBe(200)
+      expect(yield* response.json).toBe("ok")
+    }),
+  )
+
+  itSecret.live("requires configured password for basic auth", () =>
+    Effect.gen(function* () {
+      const [missing, badPassword, good] = yield* Effect.all(
+        [
+          getProbe(),
+          getProbe({ authorization: basic("octo", "wrong") }),
+          getProbe({ authorization: basic("octo", "secret") }),
+        ],
+        { concurrency: "unbounded" },
+      )
+
+      expect(missing.status).toBe(401)
+      expect(missing.headers["www-authenticate"] ?? "").toContain("Basic")
+      expect(badPassword.status).toBe(401)
+      expect(badPassword.headers["www-authenticate"] ?? "").toContain("Basic")
+      expect(good.status).toBe(200)
+    }),
+  )
+
+  itKitSecret.live("respects configured basic auth username", () =>
+    Effect.gen(function* () {
+      const [defaultUser, configuredUser] = yield* Effect.all(
+        [getProbe({ authorization: basic("octo", "secret") }), getProbe({ authorization: basic("kit", "secret") })],
+        { concurrency: "unbounded" },
+      )
+
+      expect(defaultUser.status).toBe(401)
+      expect(configuredUser.status).toBe(200)
+    }),
+  )
+
+  itSecret.live("accepts auth token query credentials", () =>
+    Effect.gen(function* () {
+      const response = yield* HttpClient.get(`/probe?auth_token=${encodeURIComponent(token("octo", "secret"))}`)
+
+      expect(response.status).toBe(200)
+    }),
+  )
+
+  itSecret.live("prefers auth token query credentials over basic auth", () =>
+    Effect.gen(function* () {
+      const response = yield* HttpClientRequest.get(
+        `/probe?auth_token=${encodeURIComponent(token("octo", "secret"))}`,
+      ).pipe(HttpClientRequest.setHeader("authorization", basic("octo", "wrong")), HttpClient.execute)
+
+      expect(response.status).toBe(200)
+    }),
+  )
+
+  itSecret.live("preserves handler errors when basic auth succeeds", () =>
+    Effect.gen(function* () {
+      const response = yield* HttpClientRequest.get("/missing").pipe(
+        HttpClientRequest.setHeader("authorization", basic("octo", "secret")),
+        HttpClient.execute,
+      )
+
+      expect(response.status).toBe(404)
+    }),
+  )
+
+  itSecret.live("preserves handler errors when auth token query succeeds", () =>
+    Effect.gen(function* () {
+      const response = yield* HttpClient.get(`/missing?auth_token=${encodeURIComponent(token("octo", "secret"))}`)
+
+      expect(response.status).toBe(404)
+    }),
+  )
+
+  itSecret.live("rejects malformed auth token query credentials", () =>
+    Effect.gen(function* () {
+      const response = yield* HttpClient.get("/probe?auth_token=not-base64")
+
+      expect(response.status).toBe(401)
+    }),
+  )
+
+  itV2Secret.live("returns bodyful v2 unauthorized errors", () =>
+    Effect.gen(function* () {
+      const response = yield* HttpClient.get("/api/probe")
+      const body = yield* response.json
+
+      expect(response.status).toBe(401)
+      expect(response.headers["www-authenticate"] ?? "").toContain("Basic")
+      expect(body).toEqual({ _tag: "UnauthorizedError", message: "Authentication required" })
+    }),
+  )
+})