@ikon85/agent-workflow-kit 0.42.1 → 0.44.0

package/scripts/census-contract.test.mjs

@@ -1,227 +0,0 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-import { cp, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import {
-  CENSUS_BUILDER_VERSION,
-  activateCensus,
-  diffCensus,
-  scanCensus,
-} from './census/index.mjs';
-
-const exec = promisify(execFile);
-const FIXTURES = new URL('../test/fixtures/census-consumers/', import.meta.url);
-const REPO = fileURLToPath(new URL('../', import.meta.url));
-
-async function consumer(name, tracked = ['.']) {
-  const root = await mkdtemp(join(tmpdir(), `awk-census-${name}-`));
-  await cp(new URL(`${name}/`, FIXTURES), root, { recursive: true });
-  await exec('git', ['init', '--quiet'], { cwd: root });
-  await exec('git', ['add', ...tracked], { cwd: root });
-  return root;
-}
-
-async function cleanup(root) {
-  await rm(root, { recursive: true, force: true });
-}
-
-async function json(path) {
-  return JSON.parse(await readFile(path, 'utf8'));
-}
-
-async function backstopStatus(root) {
-  const { stdout } = await exec('python3', [
-    join(REPO, '.claude/hooks/drift-guard.py'), '--census-status',
-  ], { cwd: root });
-  return JSON.parse(stdout);
-}
-
-test('brownfield reports real X of Y surfaces separately from behaviors', async () => {
-  const root = await consumer('brownfield');
-  try {
-    const profile = await json(join(root, '.census/profile.json'));
-    const census = await scanCensus({
-      repoRoot: root,
-      enabled: profile.enabled,
-      hasActive: true,
-      behaviorFamilies: profile.decisions.map(({ family, status }) => ({ name: family, status })),
-    });
-    const covered = census.families.surfaces.filter(({ status }) => status === 'abgedeckt').length;
-
-    assert.equal(census.state, 'current');
-    assert.equal(`${covered} of ${census.families.surfaces.length}`, '3 of 3');
-    assert.deepEqual(census.families.behaviors, [
-      { name: 'authentication', status: 'abgedeckt', type: 'behavior' },
-      { name: 'email-delivery', status: 'nicht relevant', type: 'behavior' },
-    ]);
-    assert.ok(census.families.surfaces.every(({ type }) => type === 'surface'));
-  } finally { await cleanup(root); }
-});
-
-test('greenfield without an active snapshot remains honest bootstrap', async () => {
-  const root = await consumer('greenfield');
-  try {
-    const census = await scanCensus({ repoRoot: root, enabled: true, hasActive: false });
-    assert.equal(census.state, 'bootstrap');
-    assert.ok(census.denominator.length > 0, 'bootstrap still reports discovered facts');
-  } finally { await cleanup(root); }
-});
-
-test('unknown pattern stays open until its repository-local scanner test passes', async () => {
-  const root = await consumer('unknown-pattern', ['package.json', 'src', '.census']);
-  try {
-    const activePath = join(root, '.census/active.json');
-    const profilePath = join(root, '.census/profile.json');
-    const surface = 'services/payments/src';
-    const scannerRecord = {
-      surface,
-      module: 'scripts/census-local/scan-services.mjs',
-      export: 'scanServices',
-      test: 'test/census-services.test.mjs',
-    };
-
-    const untracked = await scanCensus({ repoRoot: root, enabled: true, hasActive: true });
-    assert.equal(untracked.state, 'refresh_required');
-    assert.deepEqual(diffCensus(untracked, untracked).open, [surface]);
-
-    // Establish real active history before the repository grows the unknown surface.
-    await rm(join(root, 'services'), { recursive: true });
-    await rm(join(root, 'scripts'), { recursive: true });
-    await rm(join(root, 'test'), { recursive: true });
-    const known = await scanCensus({ repoRoot: root, enabled: true, hasActive: true });
-    await writeFile(activePath, `${JSON.stringify({
-      ...known,
-      profileReport: { decisions: [], localScanners: [], overrides: [] },
-    })}\n`);
-
-    await cp(new URL('unknown-pattern/services/', FIXTURES), join(root, 'services'), { recursive: true });
-    await exec('git', ['add', 'services'], { cwd: root });
-    const trackedOnly = await backstopStatus(root);
-    assert.equal(trackedOnly.state, 'refresh_required');
-    assert.ok(trackedOnly.reasons.includes('topology'));
-
-    const profile = await json(profilePath);
-    profile.localScanners.push(scannerRecord);
-    await writeFile(profilePath, `${JSON.stringify(profile)}\n`);
-    const missingProof = await backstopStatus(root);
-    assert.equal(missingProof.state, 'refresh_required');
-    assert.ok(missingProof.reasons.includes(`proof:${surface}`));
-
-    await cp(new URL('unknown-pattern/scripts/', FIXTURES), join(root, 'scripts'), { recursive: true });
-    await cp(new URL('unknown-pattern/test/', FIXTURES), join(root, 'test'), { recursive: true });
-    await writeFile(
-      join(root, scannerRecord.test),
-      "import { test } from 'node:test'; test('failing local proof', () => { throw new Error('no'); });\n",
-    );
-    await exec('git', ['add', 'scripts', 'test', '.census/profile.json'], { cwd: root });
-    const failedProof = await backstopStatus(root);
-    assert.equal(failedProof.state, 'refresh_required');
-    assert.ok(failedProof.reasons.includes(`proof:${surface}`));
-
-    await cp(
-      new URL('unknown-pattern/test/census-services.test.mjs', FIXTURES),
-      join(root, scannerRecord.test),
-    );
-    const candidate = await scanCensus({ repoRoot: root, enabled: true, hasActive: true });
-    assert.equal(candidate.state, 'current');
-    await activateCensus({
-      activePath,
-      candidate: {
-        ...candidate,
-        profileReport: { decisions: [], localScanners: [scannerRecord], overrides: [] },
-      },
-      verify: async () => {
-        await exec('node', ['--test', scannerRecord.test], { cwd: root });
-        const scanner = await import(`${pathToFileURL(join(root, scannerRecord.module)).href}?proof=${Date.now()}`);
-        return scanner[scannerRecord.export]().includes(surface);
-      },
-    });
-
-    const proven = await backstopStatus(root);
-    assert.equal(proven.state, 'current');
-    assert.deepEqual(proven.reasons, []);
-    const active = await json(activePath);
-    assert.equal(active.profileReport.localScanners[0].test, scannerRecord.test);
-  } finally { await cleanup(root); }
-});
-
-test('scan and compact delta do not overwrite a consumer-local modification', async () => {
-  const root = await consumer('local-modified');
-  try {
-    const sourcePath = join(root, 'src/index.mjs');
-    const activePath = join(root, '.census/active.json');
-    const sourceBefore = await readFile(sourcePath);
-    const activeBefore = await readFile(activePath);
-    const previous = { denominator: [], families: { surfaces: [], behaviors: [] } };
-    const current = await scanCensus({ repoRoot: root, enabled: true, hasActive: true });
-    const delta = diffCensus(previous, current);
-
-    assert.deepEqual(Object.keys(delta), ['added', 'changed', 'open', 'removed']);
-    assert.ok(JSON.stringify(delta).length < JSON.stringify(current).length);
-    assert.deepEqual(await readFile(sourcePath), sourceBefore);
-    assert.deepEqual(await readFile(activePath), activeBefore);
-  } finally { await cleanup(root); }
-});
-
-test('secret canary is absent from scan, delta, and file reads', async () => {
-  const root = await consumer('secret-canary');
-  try {
-    const reads = [];
-    const scan = await scanCensus({
-      repoRoot: root,
-      readText: async (path) => {
-        reads.push(path);
-        return readFile(path, 'utf8');
-      },
-    });
-    const output = JSON.stringify({ scan, delta: diffCensus({ denominator: [] }, scan) });
-    assert.doesNotMatch(output, /CENSUS_SECRET_CANARY/);
-    assert.ok(reads.every((path) => !path.includes('credentials')));
-  } finally { await cleanup(root); }
-});
-
-test('interrupted activation preserves the active census byte-for-byte', async () => {
-  const root = await consumer('interrupted');
-  try {
-    const activePath = join(root, '.census/active.json');
-    const before = await readFile(activePath);
-    const candidate = await scanCensus({ repoRoot: root, enabled: true, hasActive: true });
-    await assert.rejects(activateCensus({
-      activePath,
-      candidate,
-      verify: async () => true,
-      renameCandidate: async () => { throw new Error('fixture interruption'); },
-    }), (error) => error.state === 'failed');
-    assert.deepEqual(await readFile(activePath), before);
-  } finally { await cleanup(root); }
-});
-
-test('consumer update reports a newer builder without silently mutating its census', async () => {
-  const root = await consumer('consumer-update');
-  try {
-    const activePath = join(root, '.census/active.json');
-    const profilePath = join(root, '.census/profile.json');
-    const fresh = await scanCensus({ repoRoot: root, enabled: true, hasActive: true });
-    await writeFile(activePath, `${JSON.stringify({
-      ...fresh,
-      fingerprints: { ...fresh.fingerprints, builder: 'older-builder-fingerprint' },
-      profileReport: { decisions: [], localScanners: [], overrides: [] },
-    })}\n`);
-    const activeBefore = await readFile(activePath);
-    const profileBefore = await readFile(profilePath);
-    const { stdout } = await exec('python3', [
-      join(REPO, '.claude/hooks/drift-guard.py'), '--census-status',
-    ], { cwd: root });
-    const status = JSON.parse(stdout);
-
-    assert.equal(status.state, 'refresh_required');
-    assert.equal(status.detail, `builder ${CENSUS_BUILDER_VERSION}`);
-    assert.ok(status.reasons.includes('builder'));
-    assert.deepEqual(await readFile(activePath), activeBefore);
-    assert.deepEqual(await readFile(profilePath), profileBefore);
-  } finally { await cleanup(root); }
-});

package/scripts/check-kit-staleness.mjs

@@ -1,45 +0,0 @@
-/** Verify that the checked-in install manifest matches a fresh public-SSOT build. */
-import { mkdtemp, readFile, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { buildKit } from './build-kit.mjs';
-
-const index = (manifest) => new Map(manifest.files.map((file) => [file.path, file.sha256]));
-
-export function diffManifests(checked, built) {
-  const before = index(checked);
-  const after = index(built);
-  const added = [...after.keys()].filter((path) => !before.has(path)).sort();
-  const removed = [...before.keys()].filter((path) => !after.has(path)).sort();
-  const changed = [...after.keys()].filter(
-    (path) => before.has(path) && before.get(path) !== after.get(path),
-  ).sort();
-  return { added, removed, changed };
-}
-
-export async function checkKitStaleness({ repoRoot } = {}) {
-  repoRoot ??= join(dirname(fileURLToPath(import.meta.url)), '..');
-  const distDir = await mkdtemp(join(tmpdir(), 'awkit-staleness-'));
-  try {
-    await buildKit({ repoRoot, distDir });
-    const checked = JSON.parse(await readFile(join(repoRoot, 'agent-workflow-kit.package.json'), 'utf8'));
-    const built = JSON.parse(await readFile(join(distDir, 'agent-workflow-kit.package.json'), 'utf8'));
-    const diff = diffManifests(checked, built);
-    const drift = Object.values(diff).some((paths) => paths.length);
-    return { status: drift ? 'drift' : 'ok', ...diff };
-  } finally {
-    await rm(distDir, { recursive: true, force: true });
-  }
-}
-
-if (import.meta.url === `file://${process.argv[1]}`) {
-  checkKitStaleness().then((result) => {
-    if (result.status === 'ok') return console.log('kit:staleness — OK');
-    console.error('kit:staleness — DRIFT');
-    for (const key of ['added', 'removed', 'changed']) {
-      if (result[key].length) console.error(`  ${key}: ${result[key].join(', ')}`);
-    }
-    process.exitCode = 1;
-  }).catch((error) => { console.error(error.message); process.exitCode = 1; });
-}

package/scripts/check-kit-staleness.test.mjs

@@ -1,19 +0,0 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdtemp, writeFile, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { diffManifests } from './check-kit-staleness.mjs';
-
-test('manifest parity reports no drift for identical path hashes', () => {
-  const manifest = { files: [{ path: 'a', sha256: 'one' }] };
-  assert.deepEqual(diffManifests(manifest, manifest), { added: [], removed: [], changed: [] });
-});
-
-test('manifest parity counts added, removed, and changed files', () => {
-  const checked = { files: [{ path: 'gone', sha256: '1' }, { path: 'same', sha256: '1' }, { path: 'changed', sha256: '1' }] };
-  const built = { files: [{ path: 'new', sha256: '1' }, { path: 'same', sha256: '1' }, { path: 'changed', sha256: '2' }] };
-  assert.deepEqual(diffManifests(checked, built), {
-    added: ['new'], removed: ['gone'], changed: ['changed'],
-  });
-});

package/scripts/codex-exec-scenarios/fake-codex.mjs

@@ -1,152 +0,0 @@
-#!/usr/bin/env node
-import { appendFileSync, writeFileSync } from 'node:fs';
-import { spawn } from 'node:child_process';
-
-const args = process.argv.slice(2);
-const scenario = process.env.FAKE_CODEX_SCENARIO ?? 'ok';
-const pause = Number(process.env.FAKE_CODEX_PAUSE_MS ?? 1_000);
-
-if (args.includes('--version') || args[0] === '--version') {
-  console.log(`codex-cli ${process.env.FAKE_CODEX_VERSION ?? '0.144.6'}`);
-  process.exit(0);
-}
-if (args[0] === 'login' && args[1] === 'status') {
-  if (scenario === 'auth-fail') {
-    console.error('Not logged in');
-    process.exit(1);
-  }
-  console.log('Logged in using fake credentials');
-  process.exit(0);
-}
-if (args.includes('--help')) {
-  const resumeHelp = args[0] === 'exec' && args[1] === 'resume';
-  if (process.env.FAKE_CODEX_MISSING_CAPABILITY === '1'
-      || (resumeHelp && process.env.FAKE_CODEX_RESUME_MISSING_CAPABILITY === '1')) {
-    console.log('Usage: codex exec [PROMPT]');
-  } else if (resumeHelp) {
-    console.log('Usage: codex exec resume [--config key=value] [--json] THREAD PROMPT');
-  } else {
-    console.log('Usage: codex exec [--json] [--sandbox MODE] resume THREAD');
-  }
-  process.exit(0);
-}
-
-if (process.env.FAKE_CODEX_LAUNCH_LOG) {
-  appendFileSync(process.env.FAKE_CODEX_LAUNCH_LOG, `${JSON.stringify(args)}\n`);
-}
-
-if (args[0] === 'exec' && args[1] === 'resume') {
-  const configIndex = args.indexOf('-c');
-  const expected = `sandbox_mode=${process.env.FAKE_EXPECTED_SANDBOX ?? 'read-only'}`;
-  if (args.includes('--sandbox') || configIndex < 0 || args[configIndex + 1] !== expected) {
-    console.error('invalid resume sandbox contract');
-    process.exit(64);
-  }
-}
-
-const emit = (value) => console.log(JSON.stringify(value));
-const thread = process.env.FAKE_CODEX_THREAD ?? 'fake-thread-1';
-const started = () => emit({ type: 'thread.started', thread_id: thread });
-const verdict = () => emit({
-  type: 'item.completed',
-  item: { id: 'fake-item', type: 'agent_message', text: 'fake verdict' },
-});
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-
-switch (scenario) {
-  case 'silent':
-    await sleep(pause);
-    break;
-  case 'startup-byte-silence':
-    process.stderr.write('x');
-    await sleep(pause);
-    break;
-  case 'quiet-post-thread':
-    started();
-    await sleep(pause);
-    verdict();
-    break;
-  case 'malformed':
-    console.log('{definitely-not-json');
-    break;
-  case 'json-null':
-    emit(null);
-    break;
-  case 'json-array':
-    emit([]);
-    break;
-  case 'json-scalar':
-    emit('scalar');
-    break;
-  case 'item-null':
-    emit({ type: 'item.completed', item: null });
-    break;
-  case 'item-array':
-    emit({ type: 'item.completed', item: [] });
-    break;
-  case 'event-type-null':
-    emit({ type: null });
-    break;
-  case 'event-type-array':
-    emit({ type: [] });
-    break;
-  case 'item-type-null':
-    emit({ type: 'item.completed', item: { type: null } });
-    break;
-  case 'item-type-array':
-    emit({ type: 'item.completed', item: { type: [] } });
-    break;
-  case 'thread-non-string':
-    emit({ type: 'thread.started', thread_id: 42 });
-    break;
-  case 'verdict-non-string':
-    started();
-    emit({ type: 'item.completed', item: { type: 'agent_message', text: 42 } });
-    break;
-  case 'missing-thread':
-    verdict();
-    break;
-  case 'missing-verdict':
-    started();
-    emit({ type: 'turn.completed' });
-    break;
-  case 'exec-fail':
-    started();
-    console.error('fake execution failed token=super-secret');
-    process.exit(23);
-    break;
-  case 'split-secret':
-    started();
-    writeFileSync(2, `${'x'.repeat(65_530)}token=super-secret`);
-    process.exit(24);
-    break;
-  case 'signal':
-    process.kill(process.pid, 'SIGTERM');
-    break;
-  case 'group-hang': {
-    started();
-    const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)']);
-    if (process.env.FAKE_CODEX_CHILD_PID) {
-      writeFileSync(process.env.FAKE_CODEX_CHILD_PID, String(child.pid));
-    }
-    await sleep(pause);
-    break;
-  }
-  case 'orphan-group': {
-    started();
-    const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'inherit' });
-    if (process.env.FAKE_CODEX_CHILD_PID) {
-      writeFileSync(process.env.FAKE_CODEX_CHILD_PID, String(child.pid));
-    }
-    child.unref();
-    break;
-  }
-  case 'pipe-burst':
-    process.stderr.write('x'.repeat(2 * 1024 * 1024));
-    started();
-    verdict();
-    break;
-  default:
-    started();
-    verdict();
-}