@mandujs/core 0.54.32 → 0.55.0-beta.1

package/src/brain/__tests__/redactor.test.ts

@@ -1,94 +1,94 @@
-/**
- * Tests for `packages/core/src/brain/redactor.ts`.
- *
- * Each test asserts BOTH invariants we care about:
- *   1. The secret no longer appears verbatim in the redacted output.
- *   2. A correctly-kinded `RedactionHit` shows up in the audit list.
- *
- * Regression guard — if someone relaxes a pattern to fix a false
- * positive, the matching test here will fail before a key leaks.
- */
-
-import { describe, it, expect } from "bun:test";
-import { redactSecrets, redact } from "../redactor";
-
-describe("redactSecrets — OpenAI-style keys", () => {
-  it("redacts sk-... keys and audits the hit", () => {
-    const secret = "sk-proj-ABCDEFGHIJKLMNOPQRSTUVWX";
-    const input = `Use key ${secret} to call.`;
-    const { redacted, hits } = redactSecrets(input);
-    expect(redacted).not.toContain(secret);
-    expect(redacted).toContain("[[REDACTED:openai-key]]");
-    expect(hits.length).toBeGreaterThanOrEqual(1);
-    const sampleContainsFullKey = hits.some((h) => h.sample.includes(secret));
-    expect(sampleContainsFullKey).toBe(false);
-  });
-});
-
-describe("redactSecrets — Bearer tokens", () => {
-  it("redacts Authorization: Bearer headers", () => {
-    const bearer = "Bearer eyJhbGciOiJIUzI1NiJ9abcdefghij.signature-blob";
-    const input = `curl -H 'Authorization: ${bearer}' api/host`;
-    const { redacted, hits } = redactSecrets(input);
-    expect(redacted).not.toContain(bearer);
-    expect(hits.some((h) => h.kind === "bearer-token")).toBe(true);
-  });
-});
-
-describe("redactSecrets — .env references", () => {
-  it("redacts bare .env and .env.production references", () => {
-    const input = "Credentials live in .env and overrides in .env.production.";
-    const { redacted, hits } = redactSecrets(input);
-    expect(redacted).not.toContain(" .env ");
-    expect(redacted).not.toContain(".env.production");
-    expect(hits.filter((h) => h.kind === "env-ref").length).toBeGreaterThanOrEqual(
-      2,
-    );
-  });
-});
-
-describe("redactSecrets — KEY=VALUE assignments", () => {
-  it("redacts API_KEY=... assignments in-place", () => {
-    const input = `OPENAI_API_KEY=sk-fake1234567890abcdef\nDEBUG=1`;
-    const { redacted, hits } = redactSecrets(input);
-    // The whole assignment collapses into a single marker.
-    expect(redacted).toContain("[[REDACTED:api-key-assignment]]");
-    expect(redacted).toContain("DEBUG=1"); // untouched
-    expect(hits.some((h) => h.kind === "api-key-assignment")).toBe(true);
-  });
-});
-
-describe("redactSecrets — multi-match, non-overlapping", () => {
-  it("redacts multiple secrets in a single payload", () => {
-    const gh = "ghp_1234567890abcdefghijklmnopqrstuvwxyz";
-    const aws = "AKIAIOSFODNN7EXAMPLE";
-    const input = `GitHub: ${gh}\nAWS: ${aws}\nNothing here.`;
-    const { redacted, hits } = redactSecrets(input);
-    expect(redacted).not.toContain(gh);
-    expect(redacted).not.toContain(aws);
-    expect(hits.some((h) => h.kind === "github-token")).toBe(true);
-    expect(hits.some((h) => h.kind === "aws-key")).toBe(true);
-  });
-});
-
-describe("redactSecrets — clean input passthrough", () => {
-  it("returns the input unchanged and an empty hit list when nothing matches", () => {
-    const input = "No secrets, just a normal message about the weather.";
-    const { redacted, hits } = redactSecrets(input);
-    expect(redacted).toBe(input);
-    expect(hits.length).toBe(0);
-  });
-});
-
-describe("redact() convenience", () => {
-  it("returns the redacted string directly", () => {
-    const secret = "sk-proj-THISISAFAKEKEY1234567890";
-    const out = redact(`token: ${secret}`);
-    expect(out).not.toContain(secret);
-  });
-
-  it("returns the original string when nothing matches", () => {
-    const input = "hello world";
-    expect(redact(input)).toBe(input);
-  });
-});
+/**
+ * Tests for `packages/core/src/brain/redactor.ts`.
+ *
+ * Each test asserts BOTH invariants we care about:
+ *   1. The secret no longer appears verbatim in the redacted output.
+ *   2. A correctly-kinded `RedactionHit` shows up in the audit list.
+ *
+ * Regression guard — if someone relaxes a pattern to fix a false
+ * positive, the matching test here will fail before a key leaks.
+ */
+
+import { describe, it, expect } from "bun:test";
+import { redactSecrets, redact } from "../redactor";
+
+describe("redactSecrets — OpenAI-style keys", () => {
+  it("redacts sk-... keys and audits the hit", () => {
+    const secret = "sk-proj-ABCDEFGHIJKLMNOPQRSTUVWX";
+    const input = `Use key ${secret} to call.`;
+    const { redacted, hits } = redactSecrets(input);
+    expect(redacted).not.toContain(secret);
+    expect(redacted).toContain("[[REDACTED:openai-key]]");
+    expect(hits.length).toBeGreaterThanOrEqual(1);
+    const sampleContainsFullKey = hits.some((h) => h.sample.includes(secret));
+    expect(sampleContainsFullKey).toBe(false);
+  });
+});
+
+describe("redactSecrets — Bearer tokens", () => {
+  it("redacts Authorization: Bearer headers", () => {
+    const bearer = "Bearer eyJhbGciOiJIUzI1NiJ9abcdefghij.signature-blob";
+    const input = `curl -H 'Authorization: ${bearer}' api/host`;
+    const { redacted, hits } = redactSecrets(input);
+    expect(redacted).not.toContain(bearer);
+    expect(hits.some((h) => h.kind === "bearer-token")).toBe(true);
+  });
+});
+
+describe("redactSecrets — .env references", () => {
+  it("redacts bare .env and .env.production references", () => {
+    const input = "Credentials live in .env and overrides in .env.production.";
+    const { redacted, hits } = redactSecrets(input);
+    expect(redacted).not.toContain(" .env ");
+    expect(redacted).not.toContain(".env.production");
+    expect(hits.filter((h) => h.kind === "env-ref").length).toBeGreaterThanOrEqual(
+      2,
+    );
+  });
+});
+
+describe("redactSecrets — KEY=VALUE assignments", () => {
+  it("redacts API_KEY=... assignments in-place", () => {
+    const input = `OPENAI_API_KEY=sk-fake1234567890abcdef\nDEBUG=1`;
+    const { redacted, hits } = redactSecrets(input);
+    // The whole assignment collapses into a single marker.
+    expect(redacted).toContain("[[REDACTED:api-key-assignment]]");
+    expect(redacted).toContain("DEBUG=1"); // untouched
+    expect(hits.some((h) => h.kind === "api-key-assignment")).toBe(true);
+  });
+});
+
+describe("redactSecrets — multi-match, non-overlapping", () => {
+  it("redacts multiple secrets in a single payload", () => {
+    const gh = "ghp_1234567890abcdefghijklmnopqrstuvwxyz";
+    const aws = "AKIAIOSFODNN7EXAMPLE";
+    const input = `GitHub: ${gh}\nAWS: ${aws}\nNothing here.`;
+    const { redacted, hits } = redactSecrets(input);
+    expect(redacted).not.toContain(gh);
+    expect(redacted).not.toContain(aws);
+    expect(hits.some((h) => h.kind === "github-token")).toBe(true);
+    expect(hits.some((h) => h.kind === "aws-key")).toBe(true);
+  });
+});
+
+describe("redactSecrets — clean input passthrough", () => {
+  it("returns the input unchanged and an empty hit list when nothing matches", () => {
+    const input = "No secrets, just a normal message about the weather.";
+    const { redacted, hits } = redactSecrets(input);
+    expect(redacted).toBe(input);
+    expect(hits.length).toBe(0);
+  });
+});
+
+describe("redact() convenience", () => {
+  it("returns the redacted string directly", () => {
+    const secret = "sk-proj-THISISAFAKEKEY1234567890";
+    const out = redact(`token: ${secret}`);
+    expect(out).not.toContain(secret);
+  });
+
+  it("returns the original string when nothing matches", () => {
+    const input = "hello world";
+    expect(redact(input)).toBe(input);
+  });
+});

package/src/brain/adapters/__tests__/_helpers.ts

@@ -1,83 +1,83 @@
-/**
- * Shared test fixtures for brain adapter tests.
- *
- * Every helper here stays framework-free so the unit tests do not pull
- * in the real network / keychain / filesystem paths.
- */
-
-import path from "node:path";
-import os from "node:os";
-import {
-  CredentialStore,
-  type CredentialBackend,
-  type StoredToken,
-} from "../../credentials";
-import type { HttpClient, OAuthEndpoints } from "../oauth-flow";
-import { ChatGPTAuth } from "../chatgpt-auth";
-
-/**
- * In-memory credential store that satisfies `CredentialBackend`. We
- * construct a regular `CredentialStore` around it so the adapters see
- * the exact public API (.load/.save/.delete/.list/.touch/.backendName).
- */
-export function makeMemoryStore(
-  seed: Record<string, StoredToken> = {},
-): CredentialStore {
-  const map = new Map<string, StoredToken>(Object.entries(seed));
-  const backend: CredentialBackend = {
-    name: "memory",
-    async save(provider, token) {
-      map.set(provider, token);
-    },
-    async load(provider) {
-      return map.get(provider) ?? null;
-    },
-    async delete(provider) {
-      map.delete(provider);
-    },
-    async list() {
-      return [...map.keys()];
-    },
-  };
-  return new CredentialStore(backend);
-}
-
-/**
- * Build a stub `HttpClient` whose behavior is driven by a response
- * factory. The factory receives the URL and RequestInit and returns a
- * `Response`. Tests use this to simulate 401 sequences, token
- * refresh, etc. without spinning up a live server.
- */
-export function makeStubHttpClient(
-  respond: (url: string, init?: RequestInit) => Response | Promise<Response>,
-): HttpClient {
-  return async (url, init) => respond(url, init);
-}
-
-export const FAKE_ENDPOINTS: OAuthEndpoints = {
-  authorizationUrl: "https://example.test/oauth/authorize",
-  tokenUrl: "https://example.test/oauth/token",
-};
-
-export function jsonResponse(body: unknown, status = 200): Response {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "content-type": "application/json" },
-  });
-}
-
-/**
- * Isolated ChatGPTAuth that always reports no session token — points at
- * a nonexistent path so it never picks up the developer's real
- * `~/.codex/auth.json`. Tests that exercise the keychain path must
- * pass this helper to prevent the ChatGPT code path from short-
- * circuiting the test's intended flow.
- */
-export function makeEmptyChatGPTAuth(): ChatGPTAuth {
-  return new ChatGPTAuth({
-    authFilePath: path.join(
-      os.tmpdir(),
-      `mandu-test-no-auth-${process.pid}-${Date.now()}.json`,
-    ),
-  });
-}
+/**
+ * Shared test fixtures for brain adapter tests.
+ *
+ * Every helper here stays framework-free so the unit tests do not pull
+ * in the real network / keychain / filesystem paths.
+ */
+
+import path from "node:path";
+import os from "node:os";
+import {
+  CredentialStore,
+  type CredentialBackend,
+  type StoredToken,
+} from "../../credentials";
+import type { HttpClient, OAuthEndpoints } from "../oauth-flow";
+import { ChatGPTAuth } from "../chatgpt-auth";
+
+/**
+ * In-memory credential store that satisfies `CredentialBackend`. We
+ * construct a regular `CredentialStore` around it so the adapters see
+ * the exact public API (.load/.save/.delete/.list/.touch/.backendName).
+ */
+export function makeMemoryStore(
+  seed: Record<string, StoredToken> = {},
+): CredentialStore {
+  const map = new Map<string, StoredToken>(Object.entries(seed));
+  const backend: CredentialBackend = {
+    name: "memory",
+    async save(provider, token) {
+      map.set(provider, token);
+    },
+    async load(provider) {
+      return map.get(provider) ?? null;
+    },
+    async delete(provider) {
+      map.delete(provider);
+    },
+    async list() {
+      return [...map.keys()];
+    },
+  };
+  return new CredentialStore(backend);
+}
+
+/**
+ * Build a stub `HttpClient` whose behavior is driven by a response
+ * factory. The factory receives the URL and RequestInit and returns a
+ * `Response`. Tests use this to simulate 401 sequences, token
+ * refresh, etc. without spinning up a live server.
+ */
+export function makeStubHttpClient(
+  respond: (url: string, init?: RequestInit) => Response | Promise<Response>,
+): HttpClient {
+  return async (url, init) => respond(url, init);
+}
+
+export const FAKE_ENDPOINTS: OAuthEndpoints = {
+  authorizationUrl: "https://example.test/oauth/authorize",
+  tokenUrl: "https://example.test/oauth/token",
+};
+
+export function jsonResponse(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+/**
+ * Isolated ChatGPTAuth that always reports no session token — points at
+ * a nonexistent path so it never picks up the developer's real
+ * `~/.codex/auth.json`. Tests that exercise the keychain path must
+ * pass this helper to prevent the ChatGPT code path from short-
+ * circuiting the test's intended flow.
+ */
+export function makeEmptyChatGPTAuth(): ChatGPTAuth {
+  return new ChatGPTAuth({
+    authFilePath: path.join(
+      os.tmpdir(),
+      `mandu-test-no-auth-${process.pid}-${Date.now()}.json`,
+    ),
+  });
+}