@lamentis/naome 1.4.0 → 1.4.2

package/crates/naome-cli/tests/task_cli_loop.rs

@@ -0,0 +1,383 @@
+use std::fs;
+use std::process::Command;
+
+use serde_json::{json, Value};
+
+mod task_cli_support;
+
+use task_cli_support::{
+    active_task, fixture_root, git, init_git, run_json, task_state, task_state_with_active_task,
+    write_fixture_file, write_verification_checks,
+};
+
+#[test]
+fn run_check_rejects_unknown_and_records_successful_safe_checks() {
+    let root = fixture_root(task_state());
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "changed\n");
+
+    let unknown = run_json(&root, ["task", "run-check", "--check", "missing", "--json"]);
+    assert_eq!(unknown["schema"], "naome.task.run-check.v1");
+    assert_eq!(unknown["executed"], false);
+    assert_eq!(unknown["findings"][0]["id"], "task.check.unknown");
+
+    let result = run_json(
+        &root,
+        [
+            "task",
+            "run-check",
+            "--check",
+            "diff-check",
+            "--record-proof",
+            "--json",
+            "--agent-session",
+            "loop-a",
+        ],
+    );
+    assert_eq!(result["executed"], true);
+    assert_eq!(result["exitCode"], 0);
+    assert_eq!(result["recordedProof"], true);
+    assert_eq!(result["agentSession"], "loop-a");
+
+    let task_state: Value =
+        serde_json::from_str(&fs::read_to_string(root.join(".naome/task-state.json")).unwrap())
+            .unwrap();
+    assert_eq!(
+        task_state["activeTask"]["proofBatches"][0]["proofs"][0]["agentSession"],
+        "loop-a"
+    );
+    assert_eq!(
+        task_state["activeTask"]["proofBatches"][0]["proofs"][0]["command"],
+        "git diff --check"
+    );
+    assert_eq!(
+        task_state["activeTask"]["proofBatches"][0]["proofs"][0]["cwd"],
+        "."
+    );
+}
+
+#[test]
+fn record_proof_requires_recent_success_evidence() {
+    let root = fixture_root(task_state());
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "changed\n");
+
+    let recorded = run_json(
+        &root,
+        ["task", "record-proof", "--from-proof-plan", "--json"],
+    );
+
+    assert_eq!(recorded["recorded"], false);
+    assert_eq!(
+        recorded["findings"][0]["id"],
+        "task.proof.no_recent_success"
+    );
+}
+
+#[test]
+fn record_proof_rejects_receipts_from_older_same_path_content() {
+    let root = fixture_root(task_state());
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "changed\n");
+
+    let checked = run_json(
+        &root,
+        ["task", "run-check", "--check", "diff-check", "--json"],
+    );
+    assert_eq!(checked["executed"], true);
+    assert_eq!(checked["exitCode"], 0);
+
+    write_fixture_file(&root, "README.md", "changed with trailing whitespace \n");
+    let recorded = run_json(
+        &root,
+        ["task", "record-proof", "--from-proof-plan", "--json"],
+    );
+
+    assert_eq!(recorded["recorded"], false);
+    assert_eq!(
+        recorded["findings"][0]["id"],
+        "task.proof.no_recent_success"
+    );
+}
+
+#[test]
+fn record_proof_rejects_receipts_from_old_check_metadata() {
+    let root = fixture_root(task_state());
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "changed\n");
+
+    let checked = run_json(
+        &root,
+        ["task", "run-check", "--check", "diff-check", "--json"],
+    );
+    assert_eq!(checked["executed"], true);
+    assert_eq!(checked["exitCode"], 0);
+
+    write_verification_checks(
+        &root,
+        json!([{
+            "id": "diff-check",
+            "command": "node .naome/bin/naome.js quality check --changed",
+            "cwd": ".",
+            "purpose": "Updated check command.",
+            "cost": "fast",
+            "source": "test",
+            "evidence": ["README.md"],
+            "lastVerified": null
+        }]),
+    );
+    git(&root, ["add", ".naome/verification.json"]);
+    git(&root, ["commit", "-m", "update verification metadata"]);
+
+    let recorded = run_json(
+        &root,
+        ["task", "record-proof", "--from-proof-plan", "--json"],
+    );
+
+    assert_eq!(recorded["recorded"], false);
+    assert_eq!(
+        recorded["findings"][0]["id"],
+        "task.proof.no_recent_success"
+    );
+}
+
+#[test]
+fn run_check_diff_check_covers_staged_diff() {
+    let root = fixture_root(task_state());
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "staged trailing whitespace \n");
+    git(&root, ["add", "README.md"]);
+
+    let result = run_json(
+        &root,
+        [
+            "task",
+            "run-check",
+            "--check",
+            "diff-check",
+            "--record-proof",
+            "--json",
+        ],
+    );
+
+    assert_eq!(result["executed"], true);
+    assert_ne!(result["exitCode"], 0);
+    assert_eq!(result["recordedProof"], false);
+    assert!(result["stdoutSummary"]
+        .as_str()
+        .is_some_and(|summary| summary.contains("trailing whitespace")));
+}
+
+#[test]
+fn repair_execute_safe_runs_checks_but_refuses_scope_repairs() {
+    let root = fixture_root(task_state());
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "changed\n");
+    write_fixture_file(&root, "src/lib.rs", "outside\n");
+
+    let scope = run_json(
+        &root,
+        [
+            "task",
+            "repair",
+            "--plan",
+            "remove_out_of_scope_change_src_lib_rs",
+            "--execute-safe",
+            "--json",
+        ],
+    );
+    assert_eq!(scope["executed"], false);
+    assert_eq!(scope["requiresUserApproval"], true);
+
+    fs::remove_file(root.join("src/lib.rs")).unwrap();
+    let check = run_json(
+        &root,
+        [
+            "task",
+            "repair",
+            "--plan",
+            "rerun_diff-check",
+            "--execute-safe",
+            "--json",
+        ],
+    );
+    assert_eq!(check["executed"], true);
+    assert_eq!(check["steps"][0]["schema"], "naome.task.run-check.v1");
+}
+
+#[test]
+fn repair_execute_safe_rejects_dry_run_combo_and_unsafe_check_plans() {
+    let root = fixture_root(task_state_with_active_task(active_task(json!({
+        "requiredCheckIds": ["unsafe-check"],
+        "proofResults": []
+    }))));
+    write_verification_checks(
+        &root,
+        json!([{
+                "id": "unsafe-check",
+                "command": "sh -c 'echo unsafe'",
+                "cwd": ".",
+                "purpose": "Unsafe check for repair planning tests.",
+                "cost": "fast",
+                "source": "test",
+                "evidence": ["README.md"],
+                "lastVerified": null
+        }]),
+    );
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "changed\n");
+
+    let combo = Command::new(env!("CARGO_BIN_EXE_naome"))
+        .args([
+            "task",
+            "repair",
+            "--plan",
+            "rerun_unsafe-check",
+            "--dry-run",
+            "--execute-safe",
+            "--json",
+        ])
+        .current_dir(&root)
+        .output()
+        .unwrap();
+    assert!(!combo.status.success());
+    assert!(String::from_utf8_lossy(&combo.stderr).contains("--dry-run"));
+
+    let unsafe_repair = run_json(
+        &root,
+        [
+            "task",
+            "repair",
+            "--plan",
+            "rerun_unsafe-check",
+            "--execute-safe",
+            "--json",
+        ],
+    );
+    assert_eq!(unsafe_repair["executed"], false);
+    assert_eq!(unsafe_repair["requiresUserApproval"], true);
+    assert!(unsafe_repair["steps"].as_array().unwrap().is_empty());
+}
+
+#[test]
+fn run_check_rejects_changed_npm_scripts_from_safe_execution() {
+    let root = fixture_root(task_state_with_active_task(active_task(json!({
+        "requiredCheckIds": ["task-state-tests"],
+        "allowedPaths": ["package.json"],
+        "proofResults": []
+    }))));
+    write_verification_checks(
+        &root,
+        json!([{
+            "id": "task-state-tests",
+            "command": "npm run test:task-state",
+            "cwd": ".",
+            "purpose": "Task-state regression tests.",
+            "cost": "medium",
+            "source": "test",
+            "evidence": ["package.json"],
+            "lastVerified": null
+        }]),
+    );
+    init_git(&root);
+    write_fixture_file(
+        &root,
+        "package.json",
+        r#"{"scripts":{"test:task-state":"node -e \"process.exit(0)\"}}"#,
+    );
+
+    let result = run_json(
+        &root,
+        ["task", "run-check", "--check", "task-state-tests", "--json"],
+    );
+
+    assert_eq!(result["executed"], false);
+    assert_eq!(result["findings"][0]["id"], "task.check.unsafe_command");
+}
+
+#[test]
+fn run_check_rejects_pack_dry_run_as_not_read_only() {
+    let root = fixture_root(task_state_with_active_task(active_task(json!({
+        "requiredCheckIds": ["package-dry-run"],
+        "proofResults": []
+    }))));
+    write_verification_checks(
+        &root,
+        json!([{
+            "id": "package-dry-run",
+            "command": "npm run pack:dry-run",
+            "cwd": ".",
+            "purpose": "Package dry run.",
+            "cost": "medium",
+            "source": "test",
+            "evidence": ["README.md"],
+            "lastVerified": null
+        }]),
+    );
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "changed\n");
+
+    let result = run_json(
+        &root,
+        ["task", "run-check", "--check", "package-dry-run", "--json"],
+    );
+
+    assert_eq!(result["executed"], false);
+    assert_eq!(result["findings"][0]["id"], "task.check.unsafe_command");
+}
+
+#[test]
+fn task_loop_read_only_and_execute_safe_drive_proof_to_completion() {
+    let root = fixture_root(task_state());
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "changed\n");
+
+    let read_only = run_json(&root, ["task", "loop", "--json"]);
+    assert_eq!(read_only["schema"], "naome.task.loop.v1");
+    assert_eq!(read_only["mode"], "read_only");
+    assert!(read_only["executedSteps"].as_array().unwrap().is_empty());
+    assert_eq!(
+        read_only["status"]["proof"]["missingChecks"],
+        json!(["diff-check"])
+    );
+
+    let executed = run_json(&root, ["task", "loop", "--execute-safe", "--json"]);
+    assert_eq!(executed["mode"], "execute_safe");
+    assert_eq!(
+        executed["executedSteps"][0]["schema"],
+        "naome.task.run-check.v1"
+    );
+    assert_eq!(executed["executedSteps"][0]["recordedProof"], true);
+
+    let completed = run_json(
+        &root,
+        ["task", "complete", "--from-can-transition", "--json"],
+    );
+    assert_eq!(completed["schema"], "naome.task.complete.v1");
+    assert_eq!(completed["completed"], true);
+
+    let state: Value =
+        serde_json::from_str(&fs::read_to_string(root.join(".naome/task-state.json")).unwrap())
+            .unwrap();
+    assert_eq!(state["status"], "complete");
+}
+
+#[test]
+fn complete_blocks_when_transition_is_not_allowed() {
+    let root = fixture_root(task_state_with_active_task(active_task(json!({
+        "proofResults": []
+    }))));
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "changed\n");
+
+    let completed = run_json(
+        &root,
+        ["task", "complete", "--from-can-transition", "--json"],
+    );
+
+    assert_eq!(completed["completed"], false);
+    assert_eq!(
+        completed["blockingFindings"][0]["id"],
+        "task.proof.missing_check"
+    );
+}

package/crates/naome-cli/tests/task_cli_loop_edit.rs

@@ -0,0 +1,144 @@
+use std::process::Command;
+
+mod task_cli_support;
+
+use serde_json::json;
+
+use task_cli_support::{
+    active_task, fixture_root, init_git, run_json, task_state, task_state_with_active_task,
+    write_fixture_file,
+};
+
+#[test]
+fn can_edit_allows_in_scope_and_blocks_unsafe_paths() {
+    let root = fixture_root(task_state());
+    init_git(&root);
+
+    let allowed = run_json(&root, ["task", "can-edit", "--path", "README.md", "--json"]);
+    assert_eq!(allowed["schema"], "naome.task.can-edit.v1");
+    assert_eq!(allowed["path"], "README.md");
+    assert_eq!(allowed["allowed"], true);
+
+    let outside = run_json(
+        &root,
+        ["task", "can-edit", "--path", "src/lib.rs", "--json"],
+    );
+    assert_eq!(outside["allowed"], false);
+    assert_eq!(outside["findings"][0]["id"], "task.edit.out_of_scope");
+
+    let traversal = run_json(
+        &root,
+        ["task", "can-edit", "--path", "../README.md", "--json"],
+    );
+    assert_eq!(traversal["allowed"], false);
+    assert_eq!(traversal["findings"][0]["id"], "task.edit.unsafe_path");
+
+    let backslash_traversal = run_json(
+        &root,
+        ["task", "can-edit", "--path", "..\\README.md", "--json"],
+    );
+    assert_eq!(backslash_traversal["allowed"], false);
+    assert_eq!(
+        backslash_traversal["findings"][0]["id"],
+        "task.edit.unsafe_path"
+    );
+
+    let absolute = run_json(
+        &root,
+        ["task", "can-edit", "--path", "/tmp/file.rs", "--json"],
+    );
+    assert_eq!(absolute["allowed"], false);
+    assert_eq!(absolute["findings"][0]["id"], "task.edit.unsafe_path");
+
+    let control = run_json(
+        &root,
+        [
+            "task",
+            "can-edit",
+            "--path",
+            ".naome/task-state.json",
+            "--json",
+        ],
+    );
+    assert_eq!(control["allowed"], false);
+    assert_eq!(control["findings"][0]["id"], "task.edit.control_path");
+
+    let ignore_control = run_json(
+        &root,
+        ["task", "can-edit", "--path", ".naomeignore", "--json"],
+    );
+    assert_eq!(ignore_control["allowed"], false);
+    assert_eq!(
+        ignore_control["findings"][0]["id"],
+        "task.edit.control_path"
+    );
+}
+
+#[test]
+fn can_edit_honors_ignore_directories_wildcards_and_blocked_states() {
+    let root = fixture_root(task_state_with_active_task(active_task(json!({
+        "allowedPaths": ["**"]
+    }))));
+    std::fs::write(
+        root.join(".naomeignore"),
+        ".naome/archive/\n.naome/tasks/\ndist/\n",
+    )
+    .unwrap();
+    init_git(&root);
+    write_fixture_file(&root, "dist/bundle.js", "generated\n");
+
+    let ignored = run_json(
+        &root,
+        ["task", "can-edit", "--path", "dist/bundle.js", "--json"],
+    );
+    assert_eq!(ignored["allowed"], false);
+    assert_eq!(ignored["findings"][0]["id"], "task.edit.ignored_path");
+
+    let wildcard_root = fixture_root(task_state_with_active_task(active_task(json!({
+        "allowedPaths": ["scripts/*.js"]
+    }))));
+    init_git(&wildcard_root);
+    let wildcard = run_json(
+        &wildcard_root,
+        ["task", "can-edit", "--path", "scripts/check.js", "--json"],
+    );
+    assert_eq!(wildcard["allowed"], true);
+
+    let blocked_root = fixture_root(task_state_with_active_task(active_task(json!({
+        "allowedPaths": ["README.md"]
+    }))));
+    let mut state: serde_json::Value = serde_json::from_str(
+        &std::fs::read_to_string(blocked_root.join(".naome/task-state.json")).unwrap(),
+    )
+    .unwrap();
+    state["status"] = json!("blocked");
+    state["activeTask"]["status"] = json!("blocked");
+    task_cli_support::write_json(&blocked_root, ".naome/task-state.json", &state);
+    init_git(&blocked_root);
+    let blocked = run_json(
+        &blocked_root,
+        ["task", "can-edit", "--path", "README.md", "--json"],
+    );
+    assert_eq!(blocked["allowed"], false);
+    assert_eq!(blocked["findings"][0]["id"], "task.edit.no_active_task");
+}
+
+#[test]
+fn agent_session_is_validated_and_reflected_in_json() {
+    let root = fixture_root(task_state());
+    init_git(&root);
+
+    let status = run_json(
+        &root,
+        ["task", "status", "--json", "--agent-session", "agent-42"],
+    );
+    assert_eq!(status["agentSession"], "agent-42");
+
+    let rejected = Command::new(env!("CARGO_BIN_EXE_naome"))
+        .args(["task", "status", "--json", "--agent-session", "../bad"])
+        .current_dir(root)
+        .output()
+        .unwrap();
+    assert!(!rejected.status.success());
+    assert!(String::from_utf8_lossy(&rejected.stderr).contains("agent-session"));
+}

package/crates/naome-cli/tests/task_cli_support/mod.rs

@@ -0,0 +1,178 @@
+#![allow(dead_code)]
+
+use std::fs;
+use std::process::Command;
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use serde_json::{json, Value};
+
+static FIXTURE_COUNTER: AtomicU64 = AtomicU64::new(0);
+
+pub fn task_state() -> Value {
+    task_state_with_active_task(active_task(json!({ "proofResults": [] })))
+}
+
+pub fn task_state_with_active_task(active_task: Value) -> Value {
+    let mut state: Value = serde_json::from_str(include_str!(
+        "../../../../templates/naome-root/.naome/task-state.json"
+    ))
+    .unwrap();
+    state["status"] = json!("implementing");
+    state["activeTask"] = active_task;
+    state["updatedAt"] = json!("2026-05-04T12:00:00.000Z");
+    state
+}
+
+pub fn active_task(overrides: Value) -> Value {
+    let mut task = json!({
+        "id": "cli-task",
+        "request": "Exercise task CLI.",
+        "userPrompt": {
+            "receivedAt": "2026-05-04T12:00:00.000Z",
+            "text": "Exercise task CLI."
+        },
+        "admission": {
+            "command": "node .naome/bin/check-task-state.js --admission",
+            "cwd": ".",
+            "exitCode": 0,
+            "checkedAt": "2026-05-04T12:00:00.000Z",
+            "gitHead": "pending-test-head",
+            "changedPaths": []
+        },
+        "allowedPaths": ["README.md"],
+        "declaredChangeTypes": ["docs"],
+        "requiredCheckIds": ["diff-check"],
+        "humanReview": {
+            "required": false,
+            "approved": false,
+            "reason": null
+        }
+    });
+    for (key, value) in overrides.as_object().unwrap() {
+        task.as_object_mut()
+            .unwrap()
+            .insert(key.clone(), value.clone());
+    }
+    task
+}
+
+pub fn successful_proof(evidence: Value) -> Value {
+    json!({
+        "checkId": "diff-check",
+        "command": "git diff --check",
+        "cwd": ".",
+        "exitCode": 0,
+        "checkedAt": "2026-05-04T12:00:00.000Z",
+        "evidence": evidence
+    })
+}
+
+pub fn fixture_root(task_state: Value) -> std::path::PathBuf {
+    let nonce = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap()
+        .as_nanos();
+    let counter = FIXTURE_COUNTER.fetch_add(1, Ordering::Relaxed);
+    let root = std::env::temp_dir().join(format!(
+        "naome-task-cli-fixture-{}-{nonce}-{counter}",
+        std::process::id()
+    ));
+    fs::create_dir_all(root.join(".naome")).unwrap();
+    fs::write(
+        root.join(".naomeignore"),
+        ".naome/archive/\n.naome/tasks/\n",
+    )
+    .unwrap();
+    write_json(&root, ".naome/task-state.json", &task_state);
+    write_json(&root, ".naome/verification.json", &verification());
+    write_fixture_file(&root, "README.md", "initial\n");
+    root
+}
+
+pub fn init_git(root: &std::path::Path) {
+    git(root, ["init"]);
+    git(root, ["config", "user.email", "naome@example.com"]);
+    git(root, ["config", "user.name", "NAOME Test"]);
+    git(root, ["add", "."]);
+    git(root, ["commit", "-m", "baseline"]);
+    let head = git(root, ["rev-parse", "HEAD"]).trim().to_string();
+    let path = root.join(".naome/task-state.json");
+    let mut state: Value = serde_json::from_str(&fs::read_to_string(&path).unwrap()).unwrap();
+    state["activeTask"]["admission"]["gitHead"] = json!(head);
+    write_json(root, ".naome/task-state.json", &state);
+}
+
+pub fn git<const N: usize>(root: &std::path::Path, args: [&str; N]) -> String {
+    let output = Command::new("git")
+        .args(args)
+        .current_dir(root)
+        .output()
+        .unwrap();
+    assert!(
+        output.status.success(),
+        "{}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    String::from_utf8_lossy(&output.stdout).to_string()
+}
+
+pub fn write_fixture_file(root: &std::path::Path, path: &str, content: &str) {
+    let target = root.join(path);
+    fs::create_dir_all(target.parent().unwrap()).unwrap();
+    fs::write(target, content).unwrap();
+}
+
+pub fn write_json(root: &std::path::Path, path: &str, value: &Value) {
+    write_fixture_file(
+        root,
+        path,
+        &format!("{}\n", serde_json::to_string_pretty(value).unwrap()),
+    );
+}
+
+pub fn write_verification_checks(root: &std::path::Path, checks: Value) {
+    write_json(
+        root,
+        ".naome/verification.json",
+        &json!({
+            "schema": "naome.verification.v1",
+            "version": 1,
+            "status": "ready",
+            "checks": checks
+        }),
+    );
+}
+
+pub fn run_json<const N: usize>(root: &std::path::Path, args: [&str; N]) -> Value {
+    let output = Command::new(env!("CARGO_BIN_EXE_naome"))
+        .args(args)
+        .current_dir(root)
+        .output()
+        .unwrap();
+    assert!(
+        output.status.success(),
+        "{}{}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+    serde_json::from_slice(&output.stdout).unwrap()
+}
+
+fn verification() -> Value {
+    json!({
+        "schema": "naome.verification.v1",
+        "version": 1,
+        "status": "ready",
+        "checks": [{
+            "id": "diff-check",
+            "command": "git diff --check",
+            "cwd": ".",
+            "purpose": "Detect whitespace and patch formatting issues.",
+            "cost": "fast",
+            "source": "git",
+            "evidence": ["README.md"],
+            "lastVerified": null
+        }]
+    })
+}