@kirrosh/zond 0.22.0 → 0.26.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (282) hide show
  1. package/CHANGELOG.md +811 -0
  2. package/README.md +59 -6
  3. package/package.json +9 -7
  4. package/src/CLAUDE.md +112 -0
  5. package/src/cli/argv.ts +122 -0
  6. package/src/cli/commands/add-api.ts +146 -0
  7. package/src/cli/commands/api/annotate/idempotency.ts +59 -0
  8. package/src/cli/commands/api/annotate/index.ts +880 -0
  9. package/src/cli/commands/api/annotate/lifecycle.ts +74 -0
  10. package/src/cli/commands/api/annotate/overlay.ts +206 -0
  11. package/src/cli/commands/api/annotate/pagination.ts +64 -0
  12. package/src/cli/commands/api/annotate/prompts.ts +220 -0
  13. package/src/cli/commands/api/annotate/readback.ts +58 -0
  14. package/src/cli/commands/api/annotate/resources.ts +91 -0
  15. package/src/cli/commands/api/annotate/seed-bodies.ts +61 -0
  16. package/src/cli/commands/audit.ts +786 -0
  17. package/src/cli/commands/catalog.ts +35 -0
  18. package/src/cli/commands/check.ts +361 -0
  19. package/src/cli/commands/checks.ts +1072 -0
  20. package/src/cli/commands/ci-init.ts +43 -0
  21. package/src/cli/commands/clean.ts +212 -0
  22. package/src/cli/commands/cleanup.ts +236 -0
  23. package/src/cli/commands/completions.ts +16 -0
  24. package/src/cli/commands/coverage.ts +823 -132
  25. package/src/cli/commands/db.ts +486 -12
  26. package/src/cli/commands/describe.ts +37 -2
  27. package/src/cli/commands/discover.ts +1356 -0
  28. package/src/cli/commands/doctor.ts +661 -0
  29. package/src/cli/commands/fixtures.ts +402 -0
  30. package/src/cli/commands/generate.ts +438 -47
  31. package/src/cli/commands/init/bootstrap.ts +34 -2
  32. package/src/cli/commands/{init.ts → init/index.ts} +99 -5
  33. package/src/cli/commands/init/skills.ts +99 -3
  34. package/src/cli/commands/init/templates/agents.md +77 -64
  35. package/src/cli/commands/init/templates/skills/warm-up-target.md +122 -0
  36. package/src/cli/commands/init/templates/skills/zond-checks.md +621 -0
  37. package/src/cli/commands/init/templates/skills/zond-seed.md +114 -0
  38. package/src/cli/commands/init/templates/skills/zond-triage.md +272 -0
  39. package/src/cli/commands/init/templates/skills/zond.md +802 -125
  40. package/src/cli/commands/init/templates/zond-config.yml +8 -9
  41. package/src/cli/commands/prepare-fixtures.ts +97 -0
  42. package/src/cli/commands/probe/_seed-bodies.ts +52 -0
  43. package/src/cli/commands/probe/mass-assignment.ts +594 -0
  44. package/src/cli/commands/probe/security.ts +537 -0
  45. package/src/cli/commands/probe/static.ts +255 -0
  46. package/src/cli/commands/probe/webhooks.ts +163 -0
  47. package/src/cli/commands/probe.ts +535 -0
  48. package/src/cli/commands/reference.ts +87 -0
  49. package/src/cli/commands/refresh-api.ts +227 -0
  50. package/src/cli/commands/remove-api.ts +150 -0
  51. package/src/cli/commands/report-bundle.ts +310 -0
  52. package/src/cli/commands/report.ts +241 -0
  53. package/src/cli/commands/request.ts +495 -4
  54. package/src/cli/commands/run.ts +870 -53
  55. package/src/cli/commands/schema-from-runs.ts +128 -0
  56. package/src/cli/commands/secrets.ts +133 -0
  57. package/src/cli/commands/session.ts +244 -0
  58. package/src/cli/commands/use.ts +18 -1
  59. package/src/cli/index.ts +20 -3
  60. package/src/cli/json-envelope.ts +92 -3
  61. package/src/cli/json-schemas.ts +314 -0
  62. package/src/cli/output.ts +17 -1
  63. package/src/cli/program.ts +199 -635
  64. package/src/cli/resolve.ts +105 -0
  65. package/src/cli/safe-live.ts +24 -0
  66. package/src/cli/status-filter.ts +114 -0
  67. package/src/cli/util/api-context.ts +85 -0
  68. package/src/cli/version.ts +5 -0
  69. package/src/core/audit/persist.ts +183 -0
  70. package/src/core/checks/budget.ts +59 -0
  71. package/src/core/checks/checks/_crud-helpers.ts +133 -0
  72. package/src/core/checks/checks/_negative_mutator.ts +133 -0
  73. package/src/core/checks/checks/_readback-helpers.ts +133 -0
  74. package/src/core/checks/checks/content_type_conformance.ts +39 -0
  75. package/src/core/checks/checks/cross_call_references.ts +147 -0
  76. package/src/core/checks/checks/cursor_boundary_fuzzing.ts +219 -0
  77. package/src/core/checks/checks/ensure_resource_availability.ts +62 -0
  78. package/src/core/checks/checks/idempotency_replay.ts +242 -0
  79. package/src/core/checks/checks/ignored_auth.ts +254 -0
  80. package/src/core/checks/checks/index.ts +68 -0
  81. package/src/core/checks/checks/lifecycle_transitions.ts +416 -0
  82. package/src/core/checks/checks/missing_required_header.ts +40 -0
  83. package/src/core/checks/checks/negative_data_rejection.ts +148 -0
  84. package/src/core/checks/checks/not_a_server_error.ts +35 -0
  85. package/src/core/checks/checks/open_cors_on_sensitive.ts +160 -0
  86. package/src/core/checks/checks/pagination_invariants.ts +419 -0
  87. package/src/core/checks/checks/positive_data_acceptance.ts +33 -0
  88. package/src/core/checks/checks/rate_limit_headers_absent.ts +77 -0
  89. package/src/core/checks/checks/response_headers_conformance.ts +74 -0
  90. package/src/core/checks/checks/response_schema_conformance.ts +30 -0
  91. package/src/core/checks/checks/status_code_conformance.ts +132 -0
  92. package/src/core/checks/checks/unsupported_method.ts +63 -0
  93. package/src/core/checks/checks/use_after_free.ts +78 -0
  94. package/src/core/checks/index.ts +30 -0
  95. package/src/core/checks/mode.ts +82 -0
  96. package/src/core/checks/recommended-action.ts +68 -0
  97. package/src/core/checks/registry.ts +78 -0
  98. package/src/core/checks/runner.ts +1461 -0
  99. package/src/core/checks/sarif.ts +230 -0
  100. package/src/core/checks/spec-findings.ts +308 -0
  101. package/src/core/checks/stateful.ts +121 -0
  102. package/src/core/checks/types.ts +305 -0
  103. package/src/core/checks/zond-extensions.ts +73 -0
  104. package/src/core/classifier/recommended-action.ts +251 -0
  105. package/src/core/context/current.ts +22 -6
  106. package/src/core/context/session.ts +78 -0
  107. package/src/core/coverage/loader.ts +216 -0
  108. package/src/core/coverage/reasons.ts +300 -0
  109. package/src/core/diagnostics/db-analysis.ts +293 -59
  110. package/src/core/diagnostics/failure-class.ts +140 -0
  111. package/src/core/diagnostics/failure-hints.ts +88 -89
  112. package/src/core/diagnostics/spec-pointer.ts +99 -0
  113. package/src/core/diagnostics/suggested-fixes.ts +155 -0
  114. package/src/core/exporter/case-study/index.ts +270 -0
  115. package/src/core/exporter/curl.ts +40 -0
  116. package/src/core/exporter/exporter.ts +48 -0
  117. package/src/core/exporter/html-report/escape.ts +24 -0
  118. package/src/core/exporter/html-report/index.ts +479 -0
  119. package/src/core/exporter/html-report/script.ts +100 -0
  120. package/src/core/exporter/html-report/styles.ts +408 -0
  121. package/src/core/generator/chunker.ts +38 -19
  122. package/src/core/generator/coverage-phase.ts +0 -0
  123. package/src/core/generator/data-factory.ts +586 -22
  124. package/src/core/generator/describe.ts +1 -1
  125. package/src/core/generator/fixtures-builder.ts +332 -0
  126. package/src/core/generator/index.ts +5 -5
  127. package/src/core/generator/openapi-reader.ts +135 -7
  128. package/src/core/generator/path-param-disambig.ts +140 -0
  129. package/src/core/generator/resources-builder.ts +898 -0
  130. package/src/core/generator/schema-utils.ts +33 -3
  131. package/src/core/generator/serializer.ts +103 -13
  132. package/src/core/generator/suite-generator.ts +583 -122
  133. package/src/core/generator/types.ts +14 -0
  134. package/src/core/identity/identity-file.ts +0 -0
  135. package/src/core/lint/affects.ts +28 -0
  136. package/src/core/lint/config.ts +96 -0
  137. package/src/core/lint/format.ts +42 -0
  138. package/src/core/lint/index.ts +94 -0
  139. package/src/core/lint/reporter.ts +128 -0
  140. package/src/core/lint/rules/consistency.ts +158 -0
  141. package/src/core/lint/rules/heuristics.ts +97 -0
  142. package/src/core/lint/rules/strictness.ts +109 -0
  143. package/src/core/lint/types.ts +96 -0
  144. package/src/core/lint/walker.ts +248 -0
  145. package/src/core/meta/meta-store.ts +6 -73
  146. package/src/core/output/README.md +73 -0
  147. package/src/core/output/index.ts +13 -0
  148. package/src/core/output/run.ts +91 -0
  149. package/src/core/output/types.ts +122 -0
  150. package/src/core/parser/dynamic-values.ts +160 -0
  151. package/src/core/parser/env-interpolation.ts +104 -0
  152. package/src/core/parser/filter.ts +57 -0
  153. package/src/core/parser/schema.ts +129 -4
  154. package/src/core/parser/types.ts +19 -1
  155. package/src/core/parser/variables.ts +0 -0
  156. package/src/core/parser/yaml-parser.ts +58 -12
  157. package/src/core/probe/bootstrap.ts +34 -0
  158. package/src/core/probe/dry-run-envelope.ts +61 -0
  159. package/src/core/probe/mass-assignment/classify.ts +175 -0
  160. package/src/core/probe/mass-assignment/cleanup.ts +52 -0
  161. package/src/core/probe/mass-assignment/digest.ts +114 -0
  162. package/src/core/probe/mass-assignment/orchestrator.ts +459 -0
  163. package/src/core/probe/mass-assignment/regression.ts +141 -0
  164. package/src/core/probe/mass-assignment/suspects.ts +92 -0
  165. package/src/core/probe/mass-assignment/types.ts +135 -0
  166. package/src/core/probe/mass-assignment-probe-class.ts +198 -0
  167. package/src/core/probe/mass-assignment-probe.ts +27 -0
  168. package/src/core/probe/mass-assignment-template.ts +240 -0
  169. package/src/core/probe/method-probe.ts +43 -76
  170. package/src/core/probe/method-shared.ts +69 -0
  171. package/src/core/probe/negative-probe.ts +183 -149
  172. package/src/core/probe/orphan-tracker.ts +188 -0
  173. package/src/core/probe/path-discovery.ts +439 -0
  174. package/src/core/probe/probe-harness.ts +119 -0
  175. package/src/core/probe/registry.ts +89 -0
  176. package/src/core/probe/runner.ts +136 -0
  177. package/src/core/probe/security/baseline.ts +174 -0
  178. package/src/core/probe/security/classify.ts +341 -0
  179. package/src/core/probe/security/cleanup.ts +125 -0
  180. package/src/core/probe/security/detectors.ts +71 -0
  181. package/src/core/probe/security/digest.ts +104 -0
  182. package/src/core/probe/security/orchestrator.ts +398 -0
  183. package/src/core/probe/security/regression.ts +103 -0
  184. package/src/core/probe/security/types.ts +151 -0
  185. package/src/core/probe/security-probe-class.ts +207 -0
  186. package/src/core/probe/security-probe.ts +32 -0
  187. package/src/core/probe/shared.ts +531 -0
  188. package/src/core/probe/static-probe-class.ts +125 -0
  189. package/src/core/probe/types.ts +165 -0
  190. package/src/core/probe/verdict-aggregator.ts +33 -0
  191. package/src/core/probe/webhooks-probe.ts +282 -0
  192. package/src/core/reporter/console.ts +41 -2
  193. package/src/core/reporter/index.ts +2 -3
  194. package/src/core/reporter/json.ts +11 -1
  195. package/src/core/reporter/junit.ts +27 -12
  196. package/src/core/reporter/ndjson.ts +37 -0
  197. package/src/core/reporter/types.ts +3 -0
  198. package/src/core/runner/assertions.ts +59 -2
  199. package/src/core/runner/async-pool.ts +108 -0
  200. package/src/core/runner/auth-path.ts +8 -0
  201. package/src/core/runner/ci-context.ts +72 -0
  202. package/src/core/runner/executor.ts +265 -36
  203. package/src/core/runner/form-encode.ts +41 -0
  204. package/src/core/runner/http-client.ts +112 -2
  205. package/src/core/runner/learn-drift.ts +293 -0
  206. package/src/core/runner/preflight-vars.ts +153 -0
  207. package/src/core/runner/progress-tracker.ts +73 -0
  208. package/src/core/runner/rate-limiter.ts +87 -33
  209. package/src/core/runner/run-kind.ts +45 -0
  210. package/src/core/runner/schema-validator.ts +308 -0
  211. package/src/core/runner/send-request.ts +158 -20
  212. package/src/core/runner/types.ts +44 -0
  213. package/src/core/secrets/registry.ts +164 -0
  214. package/src/core/secrets/secrets-file.ts +115 -0
  215. package/src/core/selectors/operation-filter.ts +144 -0
  216. package/src/core/setup-api.ts +457 -20
  217. package/src/core/severity/category.ts +94 -0
  218. package/src/core/severity/index.ts +58 -0
  219. package/src/core/spec/infer-schema.ts +102 -0
  220. package/src/core/spec/layers.ts +154 -0
  221. package/src/core/spec/merge-specs.ts +156 -0
  222. package/src/core/spec/schema-from-runs.ts +117 -0
  223. package/src/core/spec/schema-overlay.ts +130 -0
  224. package/src/core/util/ajv.ts +13 -0
  225. package/src/core/util/format-eta.ts +21 -0
  226. package/src/core/util/headers.ts +9 -0
  227. package/src/core/util/url.ts +24 -0
  228. package/src/core/utils.ts +5 -1
  229. package/src/core/workspace/config.ts +129 -0
  230. package/src/core/workspace/fixture-gap-report.ts +84 -0
  231. package/src/core/workspace/fixture-gaps.ts +71 -0
  232. package/src/core/workspace/manifest.ts +283 -0
  233. package/src/core/workspace/output-rotation.ts +62 -0
  234. package/src/core/workspace/root.ts +13 -11
  235. package/src/core/workspace/triage-path.ts +87 -0
  236. package/src/db/lint-runs.ts +47 -0
  237. package/src/db/migrate.ts +128 -0
  238. package/src/db/migrations/0001_run_kind.sql +25 -0
  239. package/src/db/migrations/0002_run_kind_request.sql +59 -0
  240. package/src/db/migrations/sql.d.ts +4 -0
  241. package/src/db/queries/collections.ts +133 -0
  242. package/src/db/queries/coverage.ts +9 -0
  243. package/src/db/queries/dashboard.ts +59 -0
  244. package/src/db/queries/results.ts +216 -0
  245. package/src/db/queries/runs.ts +289 -0
  246. package/src/db/queries/sessions.ts +42 -0
  247. package/src/db/queries/settings.ts +28 -0
  248. package/src/db/queries/types.ts +172 -0
  249. package/src/db/queries.ts +75 -802
  250. package/src/db/schema.ts +178 -50
  251. package/src/cli/commands/export.ts +0 -144
  252. package/src/cli/commands/guide.ts +0 -127
  253. package/src/cli/commands/init/templates/skills/scenarios.md +0 -97
  254. package/src/cli/commands/probe-methods.ts +0 -108
  255. package/src/cli/commands/probe-validation.ts +0 -124
  256. package/src/cli/commands/serve.ts +0 -114
  257. package/src/cli/commands/sync.ts +0 -268
  258. package/src/cli/commands/update.ts +0 -189
  259. package/src/cli/commands/validate.ts +0 -34
  260. package/src/core/diagnostics/render-md.ts +0 -112
  261. package/src/core/exporter/postman.ts +0 -963
  262. package/src/core/generator/guide-builder.ts +0 -253
  263. package/src/core/meta/types.ts +0 -19
  264. package/src/core/parser/index.ts +0 -21
  265. package/src/core/runner/execute-run.ts +0 -132
  266. package/src/core/runner/index.ts +0 -12
  267. package/src/core/sync/spec-differ.ts +0 -38
  268. package/src/web/data/collection-state.ts +0 -362
  269. package/src/web/routes/api.ts +0 -314
  270. package/src/web/routes/dashboard.ts +0 -350
  271. package/src/web/routes/runs.ts +0 -64
  272. package/src/web/schemas.ts +0 -121
  273. package/src/web/server.ts +0 -134
  274. package/src/web/static/htmx.min.cjs +0 -1
  275. package/src/web/static/style.css +0 -1148
  276. package/src/web/views/endpoints-tab.ts +0 -174
  277. package/src/web/views/explorer-tab.ts +0 -402
  278. package/src/web/views/health-strip.ts +0 -92
  279. package/src/web/views/layout.ts +0 -48
  280. package/src/web/views/results.ts +0 -210
  281. package/src/web/views/runs-tab.ts +0 -126
  282. package/src/web/views/suites-tab.ts +0 -181
@@ -0,0 +1,293 @@
1
+ import { readFile, writeFile, mkdir } from "node:fs/promises";
2
+ import { dirname } from "node:path";
3
+ import type { TestRunResult, AssertionResult, StepResult } from "./types.ts";
4
+
5
+ export interface DriftCase {
6
+ suite_name: string;
7
+ suite_file?: string;
8
+ step_name: string;
9
+ method?: string;
10
+ path?: string;
11
+ expected: number;
12
+ observed: number;
13
+ schema_validated: boolean;
14
+ }
15
+
16
+ /**
17
+ * Detect status-code drift cases: step would have passed if `expect.status`
18
+ * matched the observed status, every body/header assertion is green, and the
19
+ * response body matches the OpenAPI schema (no `kind: schema` failures).
20
+ *
21
+ * Skipped on purpose:
22
+ * - `error` steps (network/transport — not a drift signal)
23
+ * - `expect.status` arrays (`one of [...]`) — drift only triggers on a single
24
+ * expected value; arrays already encode tolerance
25
+ * - steps without `kind: schema` evidence — treated as drift_without_schema
26
+ * and surfaced separately to the caller via `schema_validated: false`
27
+ */
28
+ export interface DetectOptions {
29
+ /** True when the run was launched with a schema validator attached. The
30
+ * validator produces no assertions on success, so step.assertions alone
31
+ * can't distinguish "schema ok" from "no validator". */
32
+ schemaValidatorAttached: boolean;
33
+ }
34
+
35
+ export function detectStatusDrifts(results: TestRunResult[], opts: DetectOptions = { schemaValidatorAttached: false }): DriftCase[] {
36
+ const cases: DriftCase[] = [];
37
+ for (const r of results) {
38
+ for (const step of r.steps) {
39
+ const drift = classifyStep(step, opts);
40
+ if (!drift) continue;
41
+ cases.push({
42
+ suite_name: r.suite_name,
43
+ suite_file: r.suite_file,
44
+ step_name: step.name,
45
+ method: step.request?.method,
46
+ path: extractPathFromUrl(step.request?.url),
47
+ expected: drift.expected,
48
+ observed: drift.observed,
49
+ schema_validated: drift.schemaValidated,
50
+ });
51
+ }
52
+ }
53
+ return cases;
54
+ }
55
+
56
+ interface StepDrift {
57
+ expected: number;
58
+ observed: number;
59
+ schemaValidated: boolean;
60
+ }
61
+
62
+ function classifyStep(step: StepResult, opts: DetectOptions): StepDrift | null {
63
+ if (step.status !== "fail") return null;
64
+ if (!step.response) return null;
65
+
66
+ const statusFails = step.assertions.filter(
67
+ a => a.field === "status" && !a.passed && typeof a.rule === "string" && a.rule.startsWith("equals "),
68
+ );
69
+ if (statusFails.length !== 1) return null;
70
+
71
+ const otherFails = step.assertions.filter(a => !a.passed && a !== statusFails[0]);
72
+ if (otherFails.length > 0) return null;
73
+
74
+ const expected = parseExpected(statusFails[0]!);
75
+ if (expected === null) return null;
76
+
77
+ const observed = step.response.status;
78
+ if (expected === observed) return null;
79
+
80
+ // Schema validation evidence — when the validator was attached, assertions
81
+ // contain `kind: "schema"` entries on failure and nothing on success. So
82
+ // "validator attached AND no failing schema assertion" is the success case.
83
+ const schemaFails = step.assertions.filter(a => a.kind === "schema" && !a.passed);
84
+ if (schemaFails.length > 0) return null; // body diverges from spec — not a drift
85
+ const schemaValidated = opts.schemaValidatorAttached;
86
+
87
+ return { expected, observed, schemaValidated };
88
+ }
89
+
90
+ function parseExpected(a: AssertionResult): number | null {
91
+ if (typeof a.expected === "number") return a.expected;
92
+ if (typeof a.expected === "string") {
93
+ const n = Number(a.expected);
94
+ return Number.isFinite(n) ? n : null;
95
+ }
96
+ return null;
97
+ }
98
+
99
+ function extractPathFromUrl(url: string | undefined): string | undefined {
100
+ if (!url) return undefined;
101
+ try {
102
+ return new URL(url).pathname;
103
+ } catch {
104
+ return url;
105
+ }
106
+ }
107
+
108
+ export function formatDriftPlan(cases: DriftCase[]): string {
109
+ if (cases.length === 0) return "No status-code drift detected.\n";
110
+ const lines: string[] = [];
111
+ lines.push(`Drift detected (${cases.length} case${cases.length === 1 ? "" : "s"}):`);
112
+ for (const c of cases) {
113
+ const ep = `${c.method ?? "?"} ${c.path ?? "?"}`.padEnd(40);
114
+ const schema = c.schema_validated ? "body-schema=ok" : "body-schema=unverified";
115
+ lines.push(` ${ep} spec=${c.expected} observed=${c.observed} ${schema} → suggest: update test, or add to drifts`);
116
+ }
117
+ lines.push("");
118
+ lines.push("Run with --learn-apply --learn-target=test to rewrite expect.status in YAML");
119
+ lines.push("Run with --learn-apply --learn-target=drifts to record in apis/<name>/tolerated-drifts.yaml");
120
+ return lines.join("\n") + "\n";
121
+ }
122
+
123
+ export interface ApplyResult {
124
+ updated: number;
125
+ errors: { suite_file: string; step_name: string; reason: string }[];
126
+ }
127
+
128
+ /**
129
+ * Rewrite `expect.status: <expected>` → `<observed>` in each suite file.
130
+ *
131
+ * Implementation is line-based: locate the step block by `name:`, then scan
132
+ * forward until the next sibling step or dedent looking for the first
133
+ * `status:` line at a deeper indent. We don't reparse the YAML — preserves
134
+ * comments, key order, and trailing whitespace so the diff is minimal.
135
+ */
136
+ export async function applyDriftsToTests(cases: DriftCase[]): Promise<ApplyResult> {
137
+ const result: ApplyResult = { updated: 0, errors: [] };
138
+
139
+ // Group by file — read once, write once per file.
140
+ const byFile = new Map<string, DriftCase[]>();
141
+ for (const c of cases) {
142
+ if (!c.suite_file) {
143
+ result.errors.push({ suite_file: "<unknown>", step_name: c.step_name, reason: "suite_file missing" });
144
+ continue;
145
+ }
146
+ const list = byFile.get(c.suite_file) ?? [];
147
+ list.push(c);
148
+ byFile.set(c.suite_file, list);
149
+ }
150
+
151
+ for (const [file, fileCases] of byFile) {
152
+ let content: string;
153
+ try {
154
+ content = await readFile(file, "utf-8");
155
+ } catch (err) {
156
+ for (const c of fileCases) {
157
+ result.errors.push({ suite_file: file, step_name: c.step_name, reason: `read failed: ${(err as Error).message}` });
158
+ }
159
+ continue;
160
+ }
161
+
162
+ let lines = content.split("\n");
163
+ let touched = false;
164
+ for (const c of fileCases) {
165
+ const edited = rewriteExpectStatus(lines, c.step_name, c.expected, c.observed);
166
+ if (edited.ok) {
167
+ lines = edited.lines;
168
+ touched = true;
169
+ result.updated++;
170
+ } else {
171
+ result.errors.push({ suite_file: file, step_name: c.step_name, reason: edited.reason });
172
+ }
173
+ }
174
+
175
+ if (touched) {
176
+ try {
177
+ await writeFile(file, lines.join("\n"), "utf-8");
178
+ } catch (err) {
179
+ for (const c of fileCases) {
180
+ result.errors.push({ suite_file: file, step_name: c.step_name, reason: `write failed: ${(err as Error).message}` });
181
+ }
182
+ }
183
+ }
184
+ }
185
+
186
+ return result;
187
+ }
188
+
189
+ function rewriteExpectStatus(
190
+ lines: string[],
191
+ stepName: string,
192
+ expected: number,
193
+ observed: number,
194
+ ): { ok: true; lines: string[] } | { ok: false; reason: string } {
195
+ // Match `- name: foo` or `- name: "foo"` — capture indent of the dash so we
196
+ // know where the step block ends.
197
+ const nameRe = new RegExp(`^(\\s*)-\\s+name:\\s+["']?${escapeRegExp(stepName)}["']?\\s*$`);
198
+ let stepStart = -1;
199
+ let stepIndent = 0;
200
+ for (let i = 0; i < lines.length; i++) {
201
+ const m = lines[i]!.match(nameRe);
202
+ if (m) {
203
+ stepStart = i;
204
+ stepIndent = m[1]!.length;
205
+ break;
206
+ }
207
+ }
208
+ if (stepStart < 0) return { ok: false, reason: `step "${stepName}" not found in YAML` };
209
+
210
+ // Step block ends at next sibling (`- name:` at the same indent) or at the
211
+ // first line that dedents past the step's column.
212
+ let stepEnd = lines.length;
213
+ for (let i = stepStart + 1; i < lines.length; i++) {
214
+ const line = lines[i]!;
215
+ if (line.trim() === "") continue;
216
+ const indent = line.match(/^(\s*)/)![1]!.length;
217
+ if (indent <= stepIndent) {
218
+ stepEnd = i;
219
+ break;
220
+ }
221
+ }
222
+
223
+ const statusRe = new RegExp(`^(\\s*)status:\\s*${expected}\\s*(#.*)?$`);
224
+ for (let i = stepStart + 1; i < stepEnd; i++) {
225
+ const m = lines[i]!.match(statusRe);
226
+ if (m) {
227
+ const tail = m[2] ? ` ${m[2]}` : "";
228
+ lines[i] = `${m[1]}status: ${observed}${tail}`;
229
+ return { ok: true, lines };
230
+ }
231
+ }
232
+ return { ok: false, reason: `expect.status: ${expected} not found within step "${stepName}"` };
233
+ }
234
+
235
+ function escapeRegExp(s: string): string {
236
+ return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
237
+ }
238
+
239
+ /**
240
+ * Append drift cases to `<apiDir>/tolerated-drifts.yaml`. The file is a flat
241
+ * `drifts:` list; we de-duplicate on (method, path, expected, observed).
242
+ *
243
+ * Format kept intentionally minimal — runner-side enforcement (skip the
244
+ * status assertion when a tolerated drift matches) is a follow-up task; this
245
+ * call just records the data so a human can review.
246
+ */
247
+ export async function appendToleratedDrifts(apiDir: string, cases: DriftCase[]): Promise<{ written: number; file: string }> {
248
+ const file = `${apiDir}/tolerated-drifts.yaml`;
249
+ let existing = "";
250
+ try {
251
+ existing = await readFile(file, "utf-8");
252
+ } catch {
253
+ // new file — keep empty
254
+ }
255
+
256
+ const seen = new Set<string>();
257
+ const driftRe = /^\s*-\s*method:\s*(\w+)\s*$\n\s*path:\s*(\S+)\s*$\n\s*expected:\s*(\d+)\s*$\n\s*observed:\s*(\d+)/gm;
258
+ let m: RegExpExecArray | null;
259
+ while ((m = driftRe.exec(existing)) !== null) {
260
+ seen.add(`${m[1]!.toUpperCase()} ${m[2]} ${m[3]}->${m[4]}`);
261
+ }
262
+
263
+ const fresh: DriftCase[] = [];
264
+ for (const c of cases) {
265
+ const key = `${(c.method ?? "?").toUpperCase()} ${c.path ?? "?"} ${c.expected}->${c.observed}`;
266
+ if (seen.has(key)) continue;
267
+ seen.add(key);
268
+ fresh.push(c);
269
+ }
270
+
271
+ if (fresh.length === 0) return { written: 0, file };
272
+
273
+ let body = existing;
274
+ if (!/^drifts:\s*$/m.test(body)) {
275
+ body = body.trim();
276
+ if (body.length > 0) body += "\n";
277
+ body += "drifts:\n";
278
+ } else if (!body.endsWith("\n")) {
279
+ body += "\n";
280
+ }
281
+
282
+ for (const c of fresh) {
283
+ body += ` - method: ${c.method ?? "?"}\n`;
284
+ body += ` path: ${c.path ?? "?"}\n`;
285
+ body += ` expected: ${c.expected}\n`;
286
+ body += ` observed: ${c.observed}\n`;
287
+ body += ` note: ""\n`;
288
+ }
289
+
290
+ await mkdir(dirname(file), { recursive: true });
291
+ await writeFile(file, body, "utf-8");
292
+ return { written: fresh.length, file };
293
+ }
@@ -0,0 +1,153 @@
1
+ import type { TestSuite, TestStep, AssertionRule } from "../parser/types.ts";
2
+ import { GENERATORS } from "../parser/variables.ts";
3
+
4
+ const VAR_PATTERN = /\{\{([^{}]+)\}\}/g;
5
+
6
+ function scanRefs(value: unknown, out: Set<string>): void {
7
+ if (typeof value === "string") {
8
+ for (const match of value.matchAll(VAR_PATTERN)) {
9
+ const key = match[1]!.trim();
10
+ if (!key.startsWith("$")) out.add(key);
11
+ }
12
+ } else if (Array.isArray(value)) {
13
+ for (const item of value) scanRefs(item, out);
14
+ } else if (typeof value === "object" && value !== null) {
15
+ for (const v of Object.values(value)) scanRefs(v, out);
16
+ }
17
+ }
18
+
19
+ export function collectCapturesAndSets(step: TestStep, out: Set<string>): void {
20
+ if (step.set) {
21
+ for (const k of Object.keys(step.set)) out.add(k);
22
+ }
23
+ if (step.for_each?.var) out.add(step.for_each.var);
24
+ const scanRule = (rule: AssertionRule | undefined): void => {
25
+ if (!rule) return;
26
+ if (rule.capture) out.add(rule.capture);
27
+ if (rule.each) {
28
+ for (const r of Object.values(rule.each)) scanRule(r);
29
+ }
30
+ if (rule.contains_item) {
31
+ for (const r of Object.values(rule.contains_item)) scanRule(r);
32
+ }
33
+ };
34
+ if (step.expect?.body) {
35
+ for (const r of Object.values(step.expect.body)) scanRule(r);
36
+ }
37
+ if (step.expect?.headers) {
38
+ for (const v of Object.values(step.expect.headers)) {
39
+ if (typeof v === "object" && v !== null) scanRule(v as AssertionRule);
40
+ }
41
+ }
42
+ }
43
+
44
+ export interface MissingVarHit {
45
+ suite: string;
46
+ file?: string;
47
+ step?: string;
48
+ variable: string;
49
+ }
50
+
51
+ /**
52
+ * Pre-flight scan: find {{var}} references in suites that have no producer
53
+ * (env value, suite-level parameterize/set, prior-step capture). Excludes
54
+ * built-in $generators.
55
+ *
56
+ * Conservative: per-suite — accumulates all captures/sets across steps, so
57
+ * forward references inside the suite are tolerated (correctness requires
58
+ * runtime ordering checks anyway).
59
+ */
60
+ /** All non-generator {{var}} references a step reads (path, headers, body,
61
+ * query, skip_if, retry_until, set, for_each). Excludes `$generators`. */
62
+ export function collectStepRefs(step: TestStep): Set<string> {
63
+ const refs = new Set<string>();
64
+ scanRefs(step.path, refs);
65
+ scanRefs(step.headers, refs);
66
+ scanRefs(step.json, refs);
67
+ scanRefs(step.form, refs);
68
+ scanRefs(step.multipart, refs);
69
+ scanRefs(step.query, refs);
70
+ if (step.skip_if) scanRefs(step.skip_if, refs);
71
+ if (step.retry_until) scanRefs(step.retry_until.condition, refs);
72
+ if (step.set) scanRefs(step.set, refs);
73
+ if (step.for_each) scanRefs(step.for_each.in, refs);
74
+ return refs;
75
+ }
76
+
77
+ export function preflightCheckVars(
78
+ suites: TestSuite[],
79
+ env: Record<string, string>,
80
+ ): MissingVarHit[] {
81
+ const hits: MissingVarHit[] = [];
82
+ const generatorKeys = new Set(Object.keys(GENERATORS));
83
+
84
+ for (const suite of suites) {
85
+ const known = new Set<string>(Object.keys(env));
86
+ if (suite.parameterize) {
87
+ for (const k of Object.keys(suite.parameterize)) known.add(k);
88
+ }
89
+ for (const step of suite.tests) collectCapturesAndSets(step, known);
90
+
91
+ const scanStepRefs = collectStepRefs;
92
+
93
+ const suiteRefs = new Set<string>();
94
+ if (suite.base_url) scanRefs(suite.base_url, suiteRefs);
95
+ if (suite.headers) scanRefs(suite.headers, suiteRefs);
96
+ for (const v of suiteRefs) {
97
+ if (!known.has(v) && !generatorKeys.has(v)) {
98
+ hits.push({ suite: suite.name, file: suite.filePath, variable: v });
99
+ }
100
+ }
101
+
102
+ for (const step of suite.tests) {
103
+ const refs = scanStepRefs(step);
104
+ for (const v of refs) {
105
+ if (!known.has(v) && !generatorKeys.has(v)) {
106
+ hits.push({
107
+ suite: suite.name,
108
+ file: suite.filePath,
109
+ step: step.name,
110
+ variable: v,
111
+ });
112
+ }
113
+ }
114
+ }
115
+ }
116
+
117
+ return hits;
118
+ }
119
+
120
+ export function formatMissingVarLine(hit: MissingVarHit): string {
121
+ const where = hit.step ? `${hit.suite} → ${hit.step}` : hit.suite;
122
+ const file = hit.file ? ` (${hit.file})` : "";
123
+ return `Undefined variable {{${hit.variable}}} in ${where}${file}`;
124
+ }
125
+
126
+ /**
127
+ * TASK-248: collapse per-(suite,step,variable) hits into one summary line per
128
+ * unique variable. When the same {{var}} is referenced in 8–12 places (typical
129
+ * when running outside a workspace and `.env.yaml` is missing), per-hit emit
130
+ * spams stderr — the aggregated form keeps signal (the *names* of the missing
131
+ * vars) while dropping noise.
132
+ */
133
+ export function summarizeMissingVars(hits: MissingVarHit[]): string[] {
134
+ if (hits.length === 0) return [];
135
+ const byVar = new Map<string, { refs: number; suites: Set<string> }>();
136
+ for (const h of hits) {
137
+ let entry = byVar.get(h.variable);
138
+ if (!entry) {
139
+ entry = { refs: 0, suites: new Set() };
140
+ byVar.set(h.variable, entry);
141
+ }
142
+ entry.refs++;
143
+ entry.suites.add(h.suite);
144
+ }
145
+ const names = [...byVar.keys()].sort();
146
+ const totalRefs = hits.length;
147
+ const totalSuites = new Set(hits.map((h) => h.suite)).size;
148
+ const head = names.slice(0, 6).map((n) => `{{${n}}}`).join(", ");
149
+ const tail = names.length > 6 ? `, … and ${names.length - 6} more` : "";
150
+ return [
151
+ `Undefined variables: ${head}${tail} (${totalRefs} reference${totalRefs === 1 ? "" : "s"} across ${totalSuites} suite${totalSuites === 1 ? "" : "s"})`,
152
+ ];
153
+ }
@@ -0,0 +1,73 @@
1
+ /**
2
+ * ARV-249: lightweight progress tracker for `zond run`. A separate module
3
+ * so the formatter can be unit-tested without spinning up an executor.
4
+ *
5
+ * Architecture: run.ts owns the tracker + `setInterval`. Every completed
6
+ * step calls `tracker.recordStep(...)` via `RunSuiteOptions.onStepDone`,
7
+ * the interval ticks every PROGRESS_INTERVAL_MS and writes one stderr
8
+ * line, and run.ts clears the interval before printing the final report.
9
+ */
10
+ import { formatEta } from "../util/format-eta.ts";
11
+ import type { StepResult } from "./types.ts";
12
+
13
+ export const PROGRESS_INTERVAL_MS = 5000;
14
+ /** Wait this long before emitting the first progress line. Short runs
15
+ * that finish under the threshold stay silent. */
16
+ export const PROGRESS_QUIET_MS = 5000;
17
+
18
+ export interface ProgressSnapshot {
19
+ elapsedMs: number;
20
+ completedSteps: number;
21
+ totalSteps: number;
22
+ httpRequests: number;
23
+ effectiveRps: number;
24
+ etaSeconds: number;
25
+ }
26
+
27
+ export class ProgressTracker {
28
+ private completedSteps = 0;
29
+ private httpRequests = 0;
30
+ private readonly startedAt: number;
31
+
32
+ constructor(private readonly totalSteps: number, now: number = Date.now()) {
33
+ this.startedAt = now;
34
+ }
35
+
36
+ recordStep(step: StepResult): void {
37
+ this.completedSteps += 1;
38
+ if (step.status !== "skip" && step.response !== undefined) {
39
+ this.httpRequests += 1;
40
+ }
41
+ }
42
+
43
+ snapshot(now: number = Date.now()): ProgressSnapshot {
44
+ const elapsedMs = Math.max(0, now - this.startedAt);
45
+ const elapsedSec = elapsedMs / 1000;
46
+ const effectiveRps = elapsedSec > 0 ? this.httpRequests / elapsedSec : 0;
47
+ const remaining = Math.max(0, this.totalSteps - this.completedSteps);
48
+ const stepRate = elapsedSec > 0 ? this.completedSteps / elapsedSec : 0;
49
+ const etaSeconds = stepRate > 0 ? remaining / stepRate : Infinity;
50
+ return {
51
+ elapsedMs,
52
+ completedSteps: this.completedSteps,
53
+ totalSteps: this.totalSteps,
54
+ httpRequests: this.httpRequests,
55
+ effectiveRps,
56
+ etaSeconds,
57
+ };
58
+ }
59
+ }
60
+
61
+ /** Format a progress snapshot for stderr. Stable wording — agents may
62
+ * grep the line. */
63
+ export function formatProgressLine(snap: ProgressSnapshot): string {
64
+ const elapsed = formatEta(snap.elapsedMs / 1000);
65
+ const pct = snap.totalSteps > 0
66
+ ? Math.min(100, Math.floor((snap.completedSteps / snap.totalSteps) * 100))
67
+ : 0;
68
+ const rps = snap.effectiveRps >= 10
69
+ ? Math.round(snap.effectiveRps).toString()
70
+ : snap.effectiveRps.toFixed(1);
71
+ const eta = Number.isFinite(snap.etaSeconds) ? formatEta(snap.etaSeconds) : "?";
72
+ return `zond: [${elapsed}] ${snap.completedSteps}/${snap.totalSteps} steps (${pct}%), ${snap.httpRequests} req, ~${rps} req/s, ETA ${eta}`;
73
+ }