@kirrosh/zond 0.22.0 → 0.26.0

package/src/db/migrations/0002_run_kind_request.sql

@@ -0,0 +1,59 @@
+-- ARV-265 (m-22): extend `runs.run_kind` CHECK constraint to include
+-- 'request' (zond request in-session) and 'fixture' (prepare-fixtures
+-- cascade list-calls), so audit-coverage can attribute HTTP touches
+-- back to those producers.
+--
+-- The CHECK constraint can't be added with ALTER TABLE in SQLite. Bun's
+-- bun:sqlite also locks `sqlite_master` against direct UPDATEs, so the
+-- usual `PRAGMA writable_schema=1` rewrite is rejected. We use the
+-- canonical SQLite 12-step rebuild: create a parallel table with the
+-- new constraint, copy rows over, drop the old, rename.
+--
+-- The migration runner wraps this in a transaction. FK references from
+-- `results.run_id` to `runs(id)` survive the DROP+RENAME because SQLite
+-- resolves FK targets by name at row-modification time, not at table
+-- definition time — when the new `runs` ends up with the same name the
+-- soft reference is reattached transparently. Indexes are explicitly
+-- recreated post-rename (they don't survive a DROP).
+
+CREATE TABLE runs_new (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  started_at    TEXT NOT NULL,
+  finished_at   TEXT,
+  total         INTEGER NOT NULL DEFAULT 0,
+  passed        INTEGER NOT NULL DEFAULT 0,
+  failed        INTEGER NOT NULL DEFAULT 0,
+  skipped       INTEGER NOT NULL DEFAULT 0,
+  trigger       TEXT DEFAULT 'manual',
+  commit_sha    TEXT,
+  branch        TEXT,
+  environment   TEXT,
+  duration_ms   INTEGER,
+  collection_id INTEGER REFERENCES collections(id),
+  session_id    TEXT,
+  tags          TEXT,
+  run_kind      TEXT NOT NULL DEFAULT 'regular'
+                CHECK (run_kind IN ('regular','probe','check','request','fixture'))
+);
+
+INSERT INTO runs_new (
+  id, started_at, finished_at, total, passed, failed, skipped, trigger,
+  commit_sha, branch, environment, duration_ms, collection_id, session_id,
+  tags, run_kind
+)
+SELECT
+  id, started_at, finished_at, total, passed, failed, skipped, trigger,
+  commit_sha, branch, environment, duration_ms, collection_id, session_id,
+  tags,
+  CASE
+    WHEN run_kind IN ('regular','probe','check','request','fixture') THEN run_kind
+    ELSE 'regular'
+  END
+FROM runs;
+
+DROP TABLE runs;
+ALTER TABLE runs_new RENAME TO runs;
+
+CREATE INDEX IF NOT EXISTS idx_runs_started    ON runs(started_at DESC);
+CREATE INDEX IF NOT EXISTS idx_runs_collection ON runs(collection_id);
+CREATE INDEX IF NOT EXISTS idx_runs_session    ON runs(session_id, started_at DESC);

package/src/db/migrations/sql.d.ts

@@ -0,0 +1,4 @@
+declare module "*.sql" {
+  const content: string;
+  export default content;
+}

package/src/db/queries/collections.ts

@@ -0,0 +1,133 @@
+import { getDb } from "../schema.ts";
+import {
+  normalizePath,
+  type CollectionRecord,
+  type CollectionSummary,
+  type CreateCollectionOpts,
+  type RunRecord,
+} from "./types.ts";
+
+export function createCollection(opts: CreateCollectionOpts): number {
+  const db = getDb();
+  const stmt = db.prepare(`
+    INSERT INTO collections (name, base_dir, test_path, openapi_spec)
+    VALUES ($name, $base_dir, $test_path, $openapi_spec)
+  `);
+  const result = stmt.run({
+    $name: opts.name,
+    $base_dir: opts.base_dir ?? null,
+    $test_path: opts.test_path,
+    $openapi_spec: opts.openapi_spec ?? null,
+  });
+  return Number(result.lastInsertRowid);
+}
+
+export function getCollectionById(id: number): CollectionRecord | null {
+  const db = getDb();
+  return db.query("SELECT * FROM collections WHERE id = ?").get(id) as CollectionRecord | null;
+}
+
+export function getLatestRunByCollection(
+  collectionId: number,
+  opts: { runKind?: import("../../core/runner/run-kind.ts").RunKind | "any" } = {},
+): RunRecord | null {
+  const db = getDb();
+  // ARV-55: 'regular' is the default so coverage skips probe-only runs
+  // without an explicit predicate. 'any' opts back into the legacy
+  // behaviour (used by `coverage`'s probe-run hint logic).
+  const kind = opts.runKind ?? "regular";
+  const kindClause = kind === "any" ? "" : "AND run_kind = ?";
+  const params: (string | number)[] = [collectionId];
+  if (kind !== "any") params.push(kind);
+  const row = db.query(`
+    SELECT * FROM runs
+    WHERE collection_id = ? AND finished_at IS NOT NULL ${kindClause}
+    ORDER BY started_at DESC
+    LIMIT 1
+  `).get(...params) as (Record<string, unknown> & { tags?: unknown }) | null;
+  if (!row) return null;
+  let tags: string[] | null = null;
+  if (typeof row.tags === "string") {
+    try {
+      const v = JSON.parse(row.tags);
+      if (Array.isArray(v) && v.every((x) => typeof x === "string")) tags = v;
+    } catch {
+      // legacy/corrupt — leave null
+    }
+  }
+  // ARV-55: normalise run_kind alongside tags so RunRecord stays consistent.
+  const rk = row.run_kind;
+  const run_kind: import("../../core/runner/run-kind.ts").RunKind =
+    rk === "probe" || rk === "check" || rk === "request" || rk === "fixture" ? rk : "regular";
+  return { ...(row as unknown as RunRecord), tags, run_kind };
+}
+
+export function listCollections(): CollectionSummary[] {
+  const db = getDb();
+  return db.query(`
+    SELECT
+      c.id, c.name, c.base_dir, c.test_path, c.openapi_spec, c.created_at,
+      COUNT(r.id) AS total_runs,
+      CASE WHEN SUM(r.total) > 0
+        THEN ROUND(SUM(r.passed) * 100.0 / SUM(r.total), 1)
+        ELSE 0 END AS pass_rate,
+      MAX(r.started_at) AS last_run_at,
+      COALESCE((SELECT passed FROM runs WHERE collection_id = c.id ORDER BY started_at DESC LIMIT 1), 0) AS last_run_passed,
+      COALESCE((SELECT failed FROM runs WHERE collection_id = c.id ORDER BY started_at DESC LIMIT 1), 0) AS last_run_failed,
+      COALESCE((SELECT total FROM runs WHERE collection_id = c.id ORDER BY started_at DESC LIMIT 1), 0) AS last_run_total
+    FROM collections c
+    LEFT JOIN runs r ON r.collection_id = c.id AND r.finished_at IS NOT NULL
+    GROUP BY c.id
+    ORDER BY c.name
+  `).all() as CollectionSummary[];
+}
+
+export function updateCollection(id: number, opts: Partial<CreateCollectionOpts>): boolean {
+  const db = getDb();
+  const sets: string[] = [];
+  const params: Record<string, any> = { $id: id };
+
+  if (opts.name !== undefined) { sets.push("name = $name"); params.$name = opts.name; }
+  if (opts.base_dir !== undefined) { sets.push("base_dir = $base_dir"); params.$base_dir = opts.base_dir; }
+  if (opts.test_path !== undefined) { sets.push("test_path = $test_path"); params.$test_path = opts.test_path; }
+  if (opts.openapi_spec !== undefined) { sets.push("openapi_spec = $openapi_spec"); params.$openapi_spec = opts.openapi_spec; }
+
+  if (sets.length === 0) return false;
+
+  const result = db.prepare(`UPDATE collections SET ${sets.join(", ")} WHERE id = $id`).run(params);
+  return result.changes > 0;
+}
+
+export function deleteCollection(id: number, deleteRuns = false): boolean {
+  const db = getDb();
+  if (deleteRuns) {
+    const runIds = db.query("SELECT id FROM runs WHERE collection_id = ?").all(id) as { id: number }[];
+    for (const row of runIds) {
+      db.prepare("DELETE FROM results WHERE run_id = ?").run(row.id);
+    }
+    db.prepare("DELETE FROM runs WHERE collection_id = ?").run(id);
+  } else {
+    db.prepare("UPDATE runs SET collection_id = NULL WHERE collection_id = ?").run(id);
+  }
+  const result = db.prepare("DELETE FROM collections WHERE id = ?").run(id);
+  return result.changes > 0;
+}
+
+export function findCollectionByTestPath(path: string): CollectionRecord | null {
+  const db = getDb();
+  const normalized = normalizePath(path);
+  return db.query("SELECT * FROM collections WHERE test_path = ?").get(normalized) as CollectionRecord | null;
+}
+
+export function findCollectionByNameOrId(nameOrId: string): CollectionRecord | null {
+  const db = getDb();
+  // Try as numeric ID first
+  const id = parseInt(nameOrId, 10);
+  if (!isNaN(id)) {
+    const byId = db.query("SELECT * FROM collections WHERE id = ?").get(id) as CollectionRecord | null;
+    if (byId) return byId;
+  }
+  // Then by name (case-insensitive)
+  return db.query("SELECT * FROM collections WHERE lower(name) = lower(?)").get(nameOrId) as CollectionRecord | null;
+}
+

package/src/db/queries/coverage.ts

@@ -0,0 +1,9 @@
+/**
+ * Reserved for coverage-domain DB queries. As of TASK-187, coverage
+ * tables (`coverage_runs`, etc.) are still managed entirely from
+ * `src/core/coverage/`; nothing in `queries.ts` was coverage-specific to
+ * move here. The file exists so the per-domain layout is future-proof
+ * — when a coverage table-backed feature lands, queries land here and
+ * the cli/UI imports stay stable.
+ */
+export {};

package/src/db/queries/dashboard.ts

@@ -0,0 +1,59 @@
+import { getDb } from "../schema.ts";
+import type {
+  DashboardStats,
+  PassRateTrendPoint,
+  SlowestTest,
+  FlakyTest,
+} from "./types.ts";
+
+export function getDashboardStats(): DashboardStats {
+  const db = getDb();
+  const row = db.query(`
+    SELECT
+      COUNT(*)            AS totalRuns,
+      COALESCE(SUM(total), 0)   AS totalTests,
+      CASE WHEN SUM(total) > 0
+        THEN ROUND(SUM(passed) * 100.0 / SUM(total), 1)
+        ELSE 0 END        AS overallPassRate,
+      COALESCE(ROUND(AVG(duration_ms), 0), 0) AS avgDuration
+    FROM runs
+    WHERE finished_at IS NOT NULL
+  `).get() as { totalRuns: number; totalTests: number; overallPassRate: number; avgDuration: number };
+  return row;
+}
+
+export function getPassRateTrend(limit = 30): PassRateTrendPoint[] {
+  const db = getDb();
+  return db.query(`
+    SELECT id AS run_id, started_at,
+      CASE WHEN total > 0 THEN ROUND(passed * 100.0 / total, 1) ELSE 0 END AS pass_rate
+    FROM runs
+    WHERE finished_at IS NOT NULL
+    ORDER BY started_at DESC
+    LIMIT ?
+  `).all(limit) as PassRateTrendPoint[];
+}
+
+export function getSlowestTests(limit = 5): SlowestTest[] {
+  const db = getDb();
+  return db.query(`
+    SELECT suite_name, test_name, ROUND(AVG(duration_ms), 0) AS avg_duration
+    FROM results
+    GROUP BY suite_name, test_name
+    ORDER BY avg_duration DESC
+    LIMIT ?
+  `).all(limit) as SlowestTest[];
+}
+
+export function getFlakyTests(runsBack = 20, limit = 5): FlakyTest[] {
+  const db = getDb();
+  return db.query(`
+    SELECT r.suite_name, r.test_name, COUNT(DISTINCT r.status) AS distinct_statuses
+    FROM results r
+    INNER JOIN (SELECT id FROM runs ORDER BY started_at DESC LIMIT ?) recent ON r.run_id = recent.id
+    GROUP BY r.suite_name, r.test_name
+    HAVING COUNT(DISTINCT r.status) > 1
+    ORDER BY distinct_statuses DESC
+    LIMIT ?
+  `).all(runsBack, limit) as FlakyTest[];
+}

package/src/db/queries/results.ts

@@ -0,0 +1,216 @@
+import { getDb, withDbRetry } from "../schema.ts";
+import type { TestRunResult } from "../../core/runner/types.ts";
+import { getSecretRegistry } from "../../core/secrets/registry.ts";
+import type { StoredStepResult } from "./types.ts";
+
+function parseProvenance(raw: unknown): import("../../core/parser/types.ts").SourceMetadata | null {
+  if (typeof raw !== "string" || raw.length === 0) return null;
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+export function saveResults(runId: number, suiteResults: TestRunResult[]): void {
+  const db = getDb();
+
+  const stmt = db.prepare(`
+    INSERT INTO results
+      (run_id, suite_name, test_name, status, duration_ms,
+       request_method, request_url, request_body,
+       response_status, response_body, response_headers, error_message, assertions, captures, suite_file, provenance, failure_class, failure_class_reason, spec_pointer, spec_excerpt)
+    VALUES
+      ($run_id, $suite_name, $test_name, $status, $duration_ms,
+       $request_method, $request_url, $request_body,
+       $response_status, $response_body, $response_headers, $error_message, $assertions, $captures, $suite_file, $provenance, $failure_class, $failure_class_reason, $spec_pointer, $spec_excerpt)
+  `);
+
+  // TASK-167 (m-10): every string field that can carry a leaked secret
+  // (URL with token in query, body echo on 401, Set-Cookie header, etc.)
+  // goes through the registry sanitizer before INSERT.
+  const reg = getSecretRegistry();
+  const redactString = (s: string | null | undefined): string | null =>
+    s == null ? null : reg.redact(s);
+  const redactJson = (v: unknown): string | null => {
+    if (v == null) return null;
+    if (typeof v === "string") return reg.redact(v);
+    return reg.redact(JSON.stringify(v));
+  };
+
+  withDbRetry("saveResults", () => db.transaction(() => {
+    for (const suite of suiteResults) {
+      for (const step of suite.steps) {
+        const maxBodySize = 50_000;
+        const truncBody = (s: string | null | undefined) =>
+          s && s.length > maxBodySize ? s.slice(0, maxBodySize) + "\n...[truncated]" : (s ?? null);
+        stmt.run({
+          $run_id: runId,
+          $suite_name: suite.suite_name,
+          $test_name: step.name,
+          $status: step.status,
+          $duration_ms: step.duration_ms,
+          $request_method: step.request.method,
+          $request_url: redactString(step.request.url),
+          $request_body: redactString(truncBody(step.request.body)),
+          $response_status: step.response?.status ?? null,
+          $response_body: redactString(truncBody(step.response?.body)),
+          $response_headers: step.response?.headers
+            ? redactJson(step.response.headers)
+            : null,
+          $error_message: redactString(step.error ?? null),
+          $assertions: step.assertions.length > 0 ? redactJson(step.assertions) : null,
+          $captures: Object.keys(step.captures).length > 0 ? redactJson(step.captures) : null,
+          $suite_file: suite.suite_file ?? null,
+          $provenance: step.provenance ? JSON.stringify(step.provenance) : null,
+          $failure_class: step.failure_class ?? null,
+          $failure_class_reason: step.failure_class_reason ?? null,
+          $spec_pointer: step.spec_pointer ?? null,
+          $spec_excerpt: redactString(step.spec_excerpt ?? null),
+        });
+      }
+    }
+  })());
+}
+
+export function getResultsByRunId(runId: number): StoredStepResult[] {
+  const db = getDb();
+  const rows = db.query("SELECT * FROM results WHERE run_id = ? ORDER BY id").all(runId) as Array<
+    Omit<StoredStepResult, "assertions" | "captures" | "provenance"> & {
+      assertions: string | null;
+      captures: string | null;
+      provenance: string | null;
+    }
+  >;
+  return rows.map((row) => ({
+    ...row,
+    assertions: row.assertions ? JSON.parse(row.assertions) : [],
+    captures: row.captures ? JSON.parse(row.captures) : {},
+    provenance: parseProvenance(row.provenance),
+  }));
+}
+
+/**
+ * Row shape for the fixture-kind POST history matched by
+ * `getRecentFixturePosts`'s SQL LIKE pattern (typically the
+ * create-endpoint URL with `{var}` path params replaced by `%`).
+ */
+export interface LastFixtureAttempt {
+  request_method: string;
+  request_url: string;
+  request_body: string | null;
+  response_status: number | null;
+  response_body: string | null;
+  attempted_at: string;
+}
+
+/**
+ * ARV-278: return the most recent N fixture-POST attempts (most recent
+ * first). Powers `dump --with-last-attempt --history N` so the agent
+ * sees the progression of errors as the overlay was iterated — e.g.
+ * "first 400 said missing X, after fixing the body the next 400 said
+ * resource_missing customer" surfaces the cascade-staleness issue (see
+ * ARV-282) one level earlier than a single-snapshot view.
+ */
+export function getRecentFixturePosts(
+  urlLikePattern: string,
+  limit: number,
+): LastFixtureAttempt[] {
+  if (!Number.isFinite(limit) || limit <= 0) return [];
+  const db = getDb();
+  const rows = db.query(`
+    SELECT
+      r.request_method  AS request_method,
+      r.request_url     AS request_url,
+      r.request_body    AS request_body,
+      r.response_status AS response_status,
+      r.response_body   AS response_body,
+      ru.started_at     AS attempted_at
+    FROM results r
+    JOIN runs ru ON r.run_id = ru.id
+    WHERE ru.run_kind = 'fixture'
+      AND r.request_method = 'POST'
+      AND r.request_url LIKE ?
+    ORDER BY ru.started_at DESC, r.id DESC
+    LIMIT ?
+  `).all(urlLikePattern, Math.floor(limit)) as LastFixtureAttempt[];
+  return rows;
+}
+
+/**
+ * ARV-330: like `getRecentFixturePosts` but across ALL run kinds
+ * (`check`/`probe`/`run`/`request`/`fixture`). A root resource with no
+ * seed_body is `skip-no-create` by prepare-fixtures, so it never records
+ * a fixture-kind POST — yet a depth-check or probe may have POSTed the
+ * same create-path and captured the account-level capability error. The
+ * hard-blocked classifier reads this wider source so it can still
+ * diagnose the gate. Caller is responsible for filtering auth-probe
+ * noise (deliberately-broken-cred 401/403s).
+ */
+export function getRecentCreatePosts(
+  urlLikePattern: string,
+  limit: number,
+  excludeLikePattern?: string,
+): LastFixtureAttempt[] {
+  if (!Number.isFinite(limit) || limit <= 0) return [];
+  const db = getDb();
+  // `excludeLikePattern` filters out child sub-resource POSTs in SQL (e.g.
+  // `%/v1/accounts/%` drops `/v1/accounts/{id}/reject`); without it the
+  // loose trailing wildcard lets a burst of probe sub-calls monopolize the
+  // LIMIT window and starve the real create-path attempts (ARV-330).
+  const rows = excludeLikePattern
+    ? db.query(`
+        SELECT r.request_method AS request_method, r.request_url AS request_url,
+               r.request_body AS request_body, r.response_status AS response_status,
+               r.response_body AS response_body, ru.started_at AS attempted_at
+        FROM results r JOIN runs ru ON r.run_id = ru.id
+        WHERE r.request_method = 'POST' AND r.request_url LIKE ? AND r.request_url NOT LIKE ?
+        ORDER BY ru.started_at DESC, r.id DESC LIMIT ?
+      `).all(urlLikePattern, excludeLikePattern, Math.floor(limit))
+    : db.query(`
+        SELECT r.request_method AS request_method, r.request_url AS request_url,
+               r.request_body AS request_body, r.response_status AS response_status,
+               r.response_body AS response_body, ru.started_at AS attempted_at
+        FROM results r JOIN runs ru ON r.run_id = ru.id
+        WHERE r.request_method = 'POST' AND r.request_url LIKE ?
+        ORDER BY ru.started_at DESC, r.id DESC LIMIT ?
+      `).all(urlLikePattern, Math.floor(limit));
+  return rows as LastFixtureAttempt[];
+}
+
+export function getFilteredResults(
+  runId: number,
+  filters: {
+    method?: string;
+    /** Compiled SQL fragment for the `--status` filter (TASK-140). */
+    statusSql?: { sql: string; params: number[] };
+  },
+): StoredStepResult[] {
+  const db = getDb();
+  const conditions = ["run_id = ?"];
+  const params: (string | number)[] = [runId];
+
+  if (filters.method) {
+    conditions.push("request_method = ?");
+    params.push(filters.method.toUpperCase());
+  }
+  if (filters.statusSql) {
+    conditions.push(filters.statusSql.sql);
+    params.push(...filters.statusSql.params);
+  }
+
+  const rows = db.query(`SELECT * FROM results WHERE ${conditions.join(" AND ")} ORDER BY id`).all(...params) as Array<
+    Omit<StoredStepResult, "assertions" | "captures" | "provenance"> & {
+      assertions: string | null;
+      captures: string | null;
+      provenance: string | null;
+    }
+  >;
+  return rows.map((row) => ({
+    ...row,
+    assertions: row.assertions ? JSON.parse(row.assertions) : [],
+    captures: row.captures ? JSON.parse(row.captures) : {},
+    provenance: parseProvenance(row.provenance),
+  }));
+}