@mytegroupinc/myte-core 0.0.49 → 0.0.50

package/scripts/feedback-live-full-harness.js

@@ -2,14 +2,15 @@
 "use strict";
 
 const fs = require("node:fs");
-const os = require("node:os");
-const path = require("node:path");
+const os = require("node:os");
+const path = require("node:path");
 const { spawnSync } = require("node:child_process");
 const {
   createCertificationManifest,
   recordCertificationArtifact,
   validateCertificationManifest,
 } = require("../lib/certification-manifest");
+const { readYamlFile } = require("../cli");
 
 const CLI_PATH = path.resolve(__dirname, "..", "cli.js");
 const LIVE_SCENARIO_MATRIX = [
@@ -20,6 +21,15 @@ const LIVE_SCENARIO_MATRIX = [
   { id: "feedback-sync", kind: "read/local-sync", mutation: "local_temp_only", required: true },
   { id: "feedback-get-history", kind: "read", mutation: "none", required: true },
   { id: "feedback-comment", kind: "write", mutation: "test_comment", required: true },
+  { id: "feedback-comment-sync-roundtrip", kind: "read/local-sync", mutation: "local_temp_only", required: true },
+  {
+    id: "feedback-comment-attachment-sync",
+    kind: "web-write/read/local-sync",
+    mutation: "test_comment_attachment",
+    required: "when --require-comment-attachment-sync is set",
+  },
+  { id: "feedback-stale-edit-guard", kind: "conflict-safety", mutation: "test_feedback", required: true },
+  { id: "feedback-forced-stale-override", kind: "owner-conflict-override", mutation: "test_feedback", required: true },
   { id: "feedback-move-undo", kind: "governed-write", mutation: "test_feedback", required: true },
   { id: "feedback-validate-submit", kind: "review", mutation: "test_review", required: true },
   { id: "feedback-review-list-detail", kind: "read", mutation: "none", required: true },
@@ -74,6 +84,10 @@ function requireConfirm(args) {
 
 function runCli(cliArgs, cwd, { allowFailure = false, apiKey } = {}) {
   const env = { ...process.env };
+  delete env.MYTE_OWNER_API_KEY;
+  delete env.MYTE_DELEGATE_API_KEY;
+  delete env.MYTE_COLLABORATOR_API_KEY;
+  delete env.MYTE_WEB_ACCESS_TOKEN;
   if (apiKey) {
     env.MYTE_API_KEY = apiKey;
     env.MYTE_PROJECT_API_KEY = apiKey;
@@ -99,8 +113,75 @@ function runCli(cliArgs, cwd, { allowFailure = false, apiKey } = {}) {
       result.stderr || stdout || "(no output)",
     ].join("\n"));
   }
-  return { status: result.status, stdout: parsed, stderr: String(result.stderr || "").trim() };
-}
+  return { status: result.status, stdout: parsed, stderr: String(result.stderr || "").trim() };
+}
+
+function resolveHarnessApiBase(args) {
+  const raw = String(
+    args["base-url"]
+      || process.env.MYTE_API_BASE
+      || "https://api.myte.dev",
+  ).trim().replace(/\/+$/, "");
+  return raw.endsWith("/api") ? raw : `${raw}/api`;
+}
+
+async function createWebFeedbackCommentWithAttachment({
+  apiBase,
+  accessToken,
+  feedbackId,
+  projectId,
+  namespace,
+  timeoutMs,
+}) {
+  const attachmentName = `${namespace}-comment-context.md`;
+  const attachmentContent = [
+    `# ${namespace} Comment Attachment`,
+    "",
+    "This disposable document proves that a web-created Feedback comment attachment",
+    "remains associated with its comment and becomes readable after Project Assistant sync.",
+    "",
+  ].join("\n");
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  let response;
+  let body;
+  try {
+    response = await fetch(`${apiBase}/feedbacks/${feedbackId}/comments`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        project_id: projectId,
+        content: `${namespace} web attachment sync certification comment.`,
+        attachments: [
+          {
+            name: attachmentName,
+            data: `data:text/markdown;base64,${Buffer.from(attachmentContent, "utf8").toString("base64")}`,
+            size: Buffer.byteLength(attachmentContent, "utf8"),
+            type: "text/markdown",
+          },
+        ],
+      }),
+      signal: controller.signal,
+    });
+    body = await response.json();
+  } finally {
+    clearTimeout(timeout);
+  }
+  if (!response.ok || body?.status !== "success" || !body?.data?.comment_id) {
+    throw new Error(
+      `Web Feedback comment attachment fixture failed (${response.status}): ${body?.message || "unknown response"}`,
+    );
+  }
+  return {
+    commentId: String(body.data.comment_id),
+    commentContent: String(body.data.content || ""),
+    attachmentName,
+    attachmentContent,
+  };
+}
 
 function assert(condition, message) {
   if (!condition) {
@@ -221,22 +302,23 @@ function writeCertificationManifest(manifestPath, manifest) {
   fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
 }
 
-function loadFeedbackManifest(workspace) {
+function loadFeedbackManifest(workspace) {
   const manifestPath = path.join(workspace, "MyteCommandCenter", "data", "feedback.yml");
   if (!fs.existsSync(manifestPath)) {
     return { items: [] };
-  }
-  const text = fs.readFileSync(manifestPath, "utf8");
-  try {
-    const parsed = JSON.parse(text);
-    const items = []
-      .concat(Array.isArray(parsed.items) ? parsed.items : [])
-      .concat(Array.isArray(parsed.queue) ? parsed.queue : []);
-    return { items };
-  } catch (_err) {
-    // Older local files may still be YAML-like. Keep a small fallback parser so
-    // the harness can validate either shape without adding runtime deps.
-  }
+  }
+  try {
+    const parsed = readYamlFile(manifestPath);
+    if (parsed && typeof parsed === "object") {
+      return {
+        ...parsed,
+        items: Array.isArray(parsed.items) ? parsed.items : [],
+      };
+    }
+  } catch (_err) {
+    // Keep a small fallback parser for a partially written legacy snapshot.
+  }
+  const text = fs.readFileSync(manifestPath, "utf8");
   const items = [];
   let current = null;
   for (const line of text.split(/\r?\n/)) {
@@ -258,8 +340,62 @@ function loadFeedbackManifest(workspace) {
     }
   }
   if (current) items.push(current);
-  return { items };
-}
+  return { items };
+}
+
+function findFeedbackItem(workspace, feedbackId) {
+  const manifest = loadFeedbackManifest(workspace);
+  return (manifest.items || []).find(
+    (item) => String(item?.feedback_id || item?.id || "") === String(feedbackId),
+  ) || null;
+}
+
+function assertSynchronizedComment({
+  workspace,
+  feedbackId,
+  commentId,
+  expectedContent,
+  expectedAttachment,
+}) {
+  const item = findFeedbackItem(workspace, feedbackId);
+  assert(item, `Feedback ${feedbackId} was missing while validating synchronized comments.`);
+  const turn = (item.conversation_turns || []).find(
+    (candidate) => String(candidate?.comment_id || "") === String(commentId),
+  );
+  assert(turn, `Comment ${commentId} was not linked to Feedback ${feedbackId} after sync.`);
+  assert(
+    String(turn.content || "").includes(expectedContent),
+    `Comment ${commentId} did not preserve its expected content after sync.`,
+  );
+
+  if (!expectedAttachment) return;
+  const attachment = (turn.attachments || []).find(
+    (candidate) => String(candidate?.name || "") === expectedAttachment.name,
+  );
+  assert(
+    attachment,
+    `Comment ${commentId} did not preserve attachment ${expectedAttachment.name}.`,
+  );
+  assert(
+    attachment.context_status === "readable",
+    `Comment attachment ${expectedAttachment.name} was not synchronized as readable context.`,
+  );
+  assert(
+    attachment.local_file,
+    `Comment attachment ${expectedAttachment.name} did not receive a local file reference.`,
+  );
+  const commandCenterRoot = path.resolve(workspace, "MyteCommandCenter");
+  const localPath = path.resolve(commandCenterRoot, String(attachment.local_file));
+  assert(
+    localPath.startsWith(`${commandCenterRoot}${path.sep}`),
+    `Comment attachment local path escaped MyteCommandCenter: ${attachment.local_file}`,
+  );
+  assert(fs.existsSync(localPath), `Synchronized comment attachment file is missing: ${localPath}`);
+  assert(
+    fs.readFileSync(localPath, "utf8").includes(expectedAttachment.contentMarker),
+    `Synchronized comment attachment ${expectedAttachment.name} lost its readable content.`,
+  );
+}
 
 function findFeedbackState(workspace, feedbackId) {
   const manifest = loadFeedbackManifest(workspace);
@@ -294,7 +430,7 @@ function assertFeedbackAbsent(workspace, feedbackIds) {
   }
 }
 
-function main() {
+async function main() {
   const args = parseArgs(process.argv.slice(2));
   if (!args["confirm-live"]) {
     console.log(JSON.stringify({
@@ -303,11 +439,13 @@ function main() {
       message: "No network, project mutation, or local certification artifact was created.",
       required_live_flag: "--confirm-live",
       optional_strict_role_flag: "--require-role-matrix",
+      optional_comment_attachment_flag: "--require-comment-attachment-sync",
       required_role_environment: [
         "MYTE_OWNER_API_KEY",
         "MYTE_DELEGATE_API_KEY",
         "MYTE_COLLABORATOR_API_KEY",
       ],
+      comment_attachment_environment: "MYTE_WEB_ACCESS_TOKEN",
       scenario_matrix: LIVE_SCENARIO_MATRIX,
     }, null, 2));
     return;
@@ -322,6 +460,7 @@ function main() {
   ).trim();
   const delegateApiKey = String(process.env.MYTE_DELEGATE_API_KEY || "").trim();
   const collaboratorApiKey = String(process.env.MYTE_COLLABORATOR_API_KEY || "").trim();
+  const webAccessToken = String(process.env.MYTE_WEB_ACCESS_TOKEN || "").trim();
   process.env.MYTE_API_KEY = ownerApiKey;
   process.env.MYTE_PROJECT_API_KEY = ownerApiKey;
   if (
@@ -332,6 +471,11 @@ function main() {
       "--require-role-matrix requires MYTE_OWNER_API_KEY, MYTE_DELEGATE_API_KEY, and MYTE_COLLABORATOR_API_KEY.",
     );
   }
+  if (args["require-comment-attachment-sync"] && !webAccessToken) {
+    throw new Error(
+      "--require-comment-attachment-sync requires an ephemeral MYTE_WEB_ACCESS_TOKEN for a user assigned to the target project.",
+    );
+  }
 
   const workspace = path.resolve(
     args.workspace || fs.mkdtempSync(path.join(os.tmpdir(), "myte-feedback-full-harness-")),
@@ -359,8 +503,13 @@ function main() {
     collaborator: Boolean(collaboratorApiKey),
     same_project: true,
     collaborator_review_denied: null,
+    collaborator_direct_apply_denied: null,
+    collaborator_archive_denied: null,
+    collaborator_writes_used: false,
+    owner_review_used: false,
     delegate_review_used: false,
   };
+  let commentAttachmentSyncVerified = false;
   const manifestPath = path.resolve(
     args.manifest
       || path.join(workspace, "MyteCommandCenter", "certification", `${runId}.json`),
@@ -507,6 +656,7 @@ function main() {
 
     const collaboratorWriteKey = collaboratorApiKey || ownerApiKey;
     const operationalReviewKey = delegateApiKey || ownerApiKey;
+    roleMatrix.collaborator_writes_used = Boolean(collaboratorApiKey);
     const commentApprovalPath = writeCommentApproval(
       workspace,
       runId,
@@ -535,6 +685,204 @@ function main() {
         cleanup: "retained_with_archived_parent",
       },
     });
+    let webAttachmentFixture = null;
+    if (webAccessToken) {
+      webAttachmentFixture = await createWebFeedbackCommentWithAttachment({
+        apiBase: resolveHarnessApiBase(args),
+        accessToken: webAccessToken,
+        feedbackId: createdFeedbackIds[0],
+        projectId: manifest.project_id,
+        namespace,
+        timeoutMs: Number(args["timeout-ms"] || 60000),
+      });
+      recordCertificationArtifact(manifest, {
+        kind: "comment",
+        id: webAttachmentFixture.commentId,
+        metadata: {
+          feedback_id: createdFeedbackIds[0],
+          attachment_name: webAttachmentFixture.attachmentName,
+          cleanup: "retained_with_archived_parent",
+        },
+      });
+    }
+
+    runCli(["feedback-sync", "--json", ...baseArgs], workspace);
+    assertSynchronizedComment({
+      workspace,
+      feedbackId: createdFeedbackIds[0],
+      commentId: String(comment.comment_id),
+      expectedContent: runId,
+    });
+    if (webAttachmentFixture) {
+      assertSynchronizedComment({
+        workspace,
+        feedbackId: createdFeedbackIds[0],
+        commentId: webAttachmentFixture.commentId,
+        expectedContent: namespace,
+        expectedAttachment: {
+          name: webAttachmentFixture.attachmentName,
+          contentMarker: `${namespace} Comment Attachment`,
+        },
+      });
+      commentAttachmentSyncVerified = true;
+    }
+
+    const staleGuardFeedbackId = createdFeedbackIds[4];
+    const staleDraft = runCli([
+      "feedback",
+      "edit",
+      "--feedback-id",
+      staleGuardFeedbackId,
+      "--title",
+      `${namespace} stale local proposal`,
+      "--reason",
+      "Harness creates this artifact before a remote revision.",
+      "--json",
+      ...baseArgs,
+    ], workspace).stdout;
+    assert(staleDraft.artifact_path, "Stale-edit guard did not create its initial local artifact.");
+
+    const staleRemoteMove = runCli([
+      "feedback",
+      "move",
+      "--feedback-id",
+      staleGuardFeedbackId,
+      "--from-state",
+      "todo",
+      "--to-state",
+      "in_progress",
+      "--reason",
+      "Harness advances the server revision after the local artifact was created.",
+      "--no-sync",
+      "--json",
+      ...baseArgs,
+    ], workspace, { apiKey: collaboratorWriteKey }).stdout;
+    const staleRemoteMoveEventId = responseEventId(staleRemoteMove);
+    assert(staleRemoteMoveEventId, "Stale-edit guard move did not return an event id.");
+
+    const staleValidation = runCli([
+      "feedback",
+      "validate",
+      "--file",
+      staleDraft.artifact_path,
+      "--json",
+      ...baseArgs,
+    ], workspace, { apiKey: collaboratorWriteKey }).stdout;
+    assert(staleValidation.ok === true && staleValidation.valid === false, "A stale local Feedback artifact unexpectedly validated.");
+    assert(
+      (staleValidation.errors || []).some((error) => error?.code === "snapshot_mismatch"),
+      `Stale artifact did not return snapshot_mismatch: ${JSON.stringify(staleValidation, null, 2)}`,
+    );
+
+    const staleGuardUndo = runCli([
+      "feedback",
+      "undo",
+      "--feedback-id",
+      staleGuardFeedbackId,
+      "--event-id",
+      staleRemoteMoveEventId,
+      "--reason",
+      "Harness restores the disposable card after stale-artifact certification.",
+      "--no-sync",
+      "--json",
+      ...baseArgs,
+    ], workspace, { apiKey: collaboratorWriteKey }).stdout;
+    assert(
+      String(staleGuardUndo.feedback_state || "") === "todo",
+      `Stale-edit guard cleanup did not restore todo: ${JSON.stringify(staleGuardUndo, null, 2)}`,
+    );
+
+    const forcedStaleApply = runCli([
+      "feedback",
+      "apply",
+      "--file",
+      staleDraft.artifact_path,
+      "--force",
+      "--no-sync",
+      "--json",
+      ...baseArgs,
+    ], workspace, { apiKey: ownerApiKey }).stdout;
+    assert(
+      String(forcedStaleApply.feedback?.title || "") === `${namespace} stale proposal`,
+      `Owner forced stale override did not apply the intended title: ${JSON.stringify(forcedStaleApply, null, 2)}`,
+    );
+    assert(
+      (forcedStaleApply.warnings || []).some(
+        (warning) => warning?.code === "snapshot_mismatch_forced",
+      ),
+      `Owner forced stale override did not report snapshot_mismatch_forced: ${JSON.stringify(forcedStaleApply, null, 2)}`,
+    );
+    assert(
+      forcedStaleApply.history?.force === true
+        && Boolean(String(forcedStaleApply.history?.reason || "").trim()),
+      `Owner forced stale override was not explicitly audited with a reason: ${JSON.stringify(forcedStaleApply, null, 2)}`,
+    );
+
+    runCli(["feedback-sync", "--json", ...baseArgs], workspace);
+    const freshDraft = runCli([
+      "feedback",
+      "edit",
+      "--feedback-id",
+      staleGuardFeedbackId,
+      "--title",
+      `${namespace} fresh proposal after resync`,
+      "--reason",
+      "Harness confirms a fresh artifact can replace the rejected stale proposal.",
+      "--json",
+      ...baseArgs,
+    ], workspace).stdout;
+    const freshValidation = runCli([
+      "feedback",
+      "validate",
+      "--file",
+      freshDraft.artifact_path,
+      "--json",
+      ...baseArgs,
+    ], workspace, { apiKey: collaboratorWriteKey }).stdout;
+    assert(
+      freshValidation.ok === true && freshValidation.valid !== false,
+      `Fresh artifact did not validate after resync: ${JSON.stringify(freshValidation, null, 2)}`,
+    );
+
+    if (collaboratorApiKey) {
+      const directApplyDenied = runCli([
+        "feedback",
+        "apply",
+        "--file",
+        freshDraft.artifact_path,
+        "--no-sync",
+        "--json",
+        ...baseArgs,
+      ], workspace, { allowFailure: true, apiKey: collaboratorApiKey }).stdout;
+      roleMatrix.collaborator_direct_apply_denied =
+        directApplyDenied.ok === false && directApplyDenied.status === 403;
+      assert(
+        roleMatrix.collaborator_direct_apply_denied,
+        `Regular collaborator direct apply was not denied: ${JSON.stringify(directApplyDenied, null, 2)}`,
+      );
+
+      const collaboratorArchiveDenied = runCli([
+        "feedback",
+        "move",
+        "--feedback-id",
+        staleGuardFeedbackId,
+        "--from-state",
+        "todo",
+        "--to-state",
+        "archived",
+        "--reason",
+        "Harness expects regular collaborator archive to be denied.",
+        "--no-sync",
+        "--json",
+        ...baseArgs,
+      ], workspace, { allowFailure: true, apiKey: collaboratorApiKey }).stdout;
+      roleMatrix.collaborator_archive_denied =
+        collaboratorArchiveDenied.ok === false && collaboratorArchiveDenied.status === 403;
+      assert(
+        roleMatrix.collaborator_archive_denied,
+        `Regular collaborator archive was not denied: ${JSON.stringify(collaboratorArchiveDenied, null, 2)}`,
+      );
+    }
 
     const directMove = runCli([
       "feedback",
@@ -819,11 +1167,38 @@ function main() {
     assert(blocked.status === 409, `Expected 409 pending review block, got ${blocked.status}.`);
     assert(blocked.data?.code === "pending_feedback_review", `Expected pending_feedback_review, got ${JSON.stringify(blocked, null, 2)}.`);
 
+    const ownerApproval = runCli([
+      "feedback",
+      "review",
+      "--request-id",
+      reviewRequestIds[0],
+      "--action",
+      "approve",
+      "--reason",
+      "Harness owner approval.",
+      "--verification-evidence",
+      "Stale-state, validation, role denial, request-changes, and revision checks passed.",
+      "--deployment-evidence",
+      "Dev post-deploy certification run; artifacts will be archived.",
+      "--no-sync",
+      "--json",
+      ...baseArgs,
+    ], workspace, { apiKey: ownerApiKey }).stdout;
+    roleMatrix.owner_review_used = true;
+    assert(
+      String(ownerApproval.request?.status || ownerApproval.status || "") === "applied",
+      `Owner approval did not apply: ${JSON.stringify(ownerApproval, null, 2)}`,
+    );
+
+    const batchApprovalRequestIds = [
+      reviewRequestIds[3],
+      reviewRequestIds[4],
+    ];
     const review = runCli([
       "feedback",
       "review",
       "--request-ids",
-      pendingApprovalRequestIds.join(","),
+      batchApprovalRequestIds.join(","),
       "--action",
       "approve",
       "--reason",
@@ -836,7 +1211,7 @@ function main() {
       ...baseArgs,
     ], workspace, { apiKey: operationalReviewKey }).stdout;
     roleMatrix.delegate_review_used = Boolean(delegateApiKey);
-    assert(review.ok !== false && review.updated_count === 3, `batch review failed: ${JSON.stringify(review, null, 2)}`);
+    assert(review.ok !== false && review.updated_count === 2, `batch review failed: ${JSON.stringify(review, null, 2)}`);
 
     runCli(["feedback-sync", "--json", ...baseArgs], workspace);
     assertFeedbackPresent(
@@ -1086,14 +1461,35 @@ function main() {
 
     if (roleMatrix.required) {
       assert(roleMatrix.same_project, "Certification role keys were not scoped to one project.");
+      assert(roleMatrix.collaborator_writes_used, "Regular collaborator writes were not certified.");
       assert(roleMatrix.collaborator_review_denied, "Collaborator approval denial was not certified.");
+      assert(roleMatrix.collaborator_direct_apply_denied, "Collaborator direct-apply denial was not certified.");
+      assert(roleMatrix.collaborator_archive_denied, "Collaborator archive denial was not certified.");
+      assert(roleMatrix.owner_review_used, "Owner approval was not used during strict role certification.");
       assert(roleMatrix.delegate_review_used, "Delegate approval was not used during strict role certification.");
     }
+    if (args["require-comment-attachment-sync"]) {
+      assert(
+        commentAttachmentSyncVerified,
+        "Web-created Feedback comment attachment did not survive Project Assistant sync.",
+      );
+    }
     manifest.checks = LIVE_SCENARIO_MATRIX.map((scenario) => ({
       id: scenario.id,
-      status:
-        scenario.id === "owner-delegate-collaborator-matrix" && !roleMatrix.required
-          ? "optional_not_requested"
+      status: scenario.id === "owner-delegate-collaborator-matrix"
+        ? (
+            roleMatrix.required
+              ? "passed"
+              : delegateApiKey && collaboratorApiKey
+                ? "passed_optional"
+                : "optional_not_requested"
+          )
+        : scenario.id === "feedback-comment-attachment-sync"
+          ? (
+              commentAttachmentSyncVerified
+                ? "passed"
+                : "optional_not_requested"
+            )
           : "passed",
       checked_at: new Date().toISOString(),
     }));
@@ -1114,6 +1510,10 @@ function main() {
       review_request_ids: reviewRequestIds,
       role_matrix: roleMatrix,
       comment_verified: true,
+      comment_sync_roundtrip_verified: true,
+      comment_attachment_sync_verified: commentAttachmentSyncVerified,
+      stale_edit_rejection_and_resync_verified: true,
+      forced_stale_override_verified: true,
       move_undo_history_verified: true,
       validation_verified: true,
       request_changes_revision_verified: true,
@@ -1180,4 +1580,10 @@ function main() {
   }
 }
 
-main();
+main().catch((err) => {
+  console.error(JSON.stringify({
+    ok: false,
+    message: err?.message || String(err),
+  }, null, 2));
+  process.exitCode = 1;
+});