@nathapp/nax 0.18.1

package/test/unit/interaction-network-failures.test.ts

@@ -0,0 +1,389 @@
+/**
+ * Interaction Plugins Network Failure Tests (v0.15.1)
+ *
+ * Tests network error handling, exponential backoff, payload limits, and malformed input.
+ */
+
+import { describe, expect, test } from "bun:test";
+import type { InteractionRequest } from "../../src/interaction";
+import { TelegramInteractionPlugin } from "../../src/interaction/plugins/telegram";
+import { WebhookInteractionPlugin } from "../../src/interaction/plugins/webhook";
+
+describe("TelegramInteractionPlugin - Network Failures", () => {
+  test("should handle network error in send()", async () => {
+    const plugin = new TelegramInteractionPlugin();
+    await plugin.init({ botToken: "test-token", chatId: "12345" });
+
+    // Mock fetch to throw network error
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = async () => {
+      throw new Error("ECONNREFUSED");
+    };
+
+    const request: InteractionRequest = {
+      id: "test-network-error",
+      type: "confirm",
+      featureName: "test-feature",
+      stage: "review",
+      summary: "Test network error",
+      fallback: "abort",
+      createdAt: Date.now(),
+    };
+
+    await expect(plugin.send(request)).rejects.toThrow("Failed to send Telegram message");
+
+    // Restore
+    globalThis.fetch = originalFetch;
+  });
+
+  test("should handle malformed API response in send()", async () => {
+    const plugin = new TelegramInteractionPlugin();
+    await plugin.init({ botToken: "test-token", chatId: "12345" });
+
+    // Mock fetch to return invalid JSON
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = async () => {
+      return new Response("not json", { status: 200 });
+    };
+
+    const request: InteractionRequest = {
+      id: "test-malformed-response",
+      type: "confirm",
+      featureName: "test-feature",
+      stage: "review",
+      summary: "Test malformed response",
+      fallback: "abort",
+      createdAt: Date.now(),
+    };
+
+    await expect(plugin.send(request)).rejects.toThrow("Failed to send Telegram message");
+
+    // Restore
+    globalThis.fetch = originalFetch;
+  });
+
+  test("should handle HTTP error status in send()", async () => {
+    const plugin = new TelegramInteractionPlugin();
+    await plugin.init({ botToken: "test-token", chatId: "12345" });
+
+    // Mock fetch to return 500 error
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = async () => {
+      return new Response("Internal Server Error", { status: 500 });
+    };
+
+    const request: InteractionRequest = {
+      id: "test-http-error",
+      type: "confirm",
+      featureName: "test-feature",
+      stage: "review",
+      summary: "Test HTTP error",
+      fallback: "abort",
+      createdAt: Date.now(),
+    };
+
+    await expect(plugin.send(request)).rejects.toThrow("Telegram API error (500)");
+
+    // Restore
+    globalThis.fetch = originalFetch;
+  });
+
+  test("should return empty updates on getUpdates() network failure", async () => {
+    const plugin = new TelegramInteractionPlugin();
+    await plugin.init({ botToken: "test-token", chatId: "12345" });
+
+    // Mock fetch to throw network error
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = async () => {
+      throw new Error("Network timeout");
+    };
+
+    // Access private method via type assertion for testing
+    const getUpdates = (plugin as unknown as { getUpdates: () => Promise<unknown[]> }).getUpdates;
+    const updates = await getUpdates.call(plugin);
+
+    expect(updates).toEqual([]);
+
+    // Restore
+    globalThis.fetch = originalFetch;
+  });
+
+  test("should apply exponential backoff on consecutive getUpdates() failures", async () => {
+    const plugin = new TelegramInteractionPlugin();
+    await plugin.init({ botToken: "test-token", chatId: "12345" });
+
+    const originalFetch = globalThis.fetch;
+    let fetchCallCount = 0;
+
+    globalThis.fetch = async () => {
+      fetchCallCount++;
+      throw new Error("Network error");
+    };
+
+    // Access private getUpdates
+    const getUpdates = (plugin as unknown as { getUpdates: () => Promise<unknown[]> }).getUpdates;
+
+    // Call getUpdates multiple times to trigger backoff
+    await getUpdates.call(plugin);
+    await getUpdates.call(plugin);
+    await getUpdates.call(plugin);
+
+    // Verify backoff is increasing (check private backoffMs property)
+    const backoffMs = (plugin as unknown as { backoffMs: number }).backoffMs;
+    expect(backoffMs).toBeGreaterThan(1000); // Should have increased from initial 1000ms
+
+    // Restore
+    globalThis.fetch = originalFetch;
+  });
+
+  test("should reset backoff on successful getUpdates()", async () => {
+    const plugin = new TelegramInteractionPlugin();
+    await plugin.init({ botToken: "test-token", chatId: "12345" });
+
+    const originalFetch = globalThis.fetch;
+    let callCount = 0;
+
+    globalThis.fetch = async () => {
+      callCount++;
+      if (callCount === 1) {
+        // First call fails
+        throw new Error("Network error");
+      }
+      // Second call succeeds
+      return new Response(JSON.stringify({ ok: true, result: [] }), { status: 200 });
+    };
+
+    const getUpdates = (plugin as unknown as { getUpdates: () => Promise<unknown[]> }).getUpdates;
+
+    // First call - triggers backoff
+    await getUpdates.call(plugin);
+    const backoffAfterFailure = (plugin as unknown as { backoffMs: number }).backoffMs;
+    expect(backoffAfterFailure).toBeGreaterThan(1000);
+
+    // Second call - should reset backoff
+    await getUpdates.call(plugin);
+    const backoffAfterSuccess = (plugin as unknown as { backoffMs: number }).backoffMs;
+    expect(backoffAfterSuccess).toBe(1000); // Reset to initial value
+
+    // Restore
+    globalThis.fetch = originalFetch;
+  });
+});
+
+describe("WebhookInteractionPlugin - Network Failures", () => {
+  test("should handle network error in send()", async () => {
+    const plugin = new WebhookInteractionPlugin();
+    await plugin.init({ url: "https://example.com/webhook" });
+
+    // Mock fetch to throw network error
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = async () => {
+      throw new Error("ECONNREFUSED");
+    };
+
+    const request: InteractionRequest = {
+      id: "test-network-error",
+      type: "confirm",
+      featureName: "test-feature",
+      stage: "review",
+      summary: "Test network error",
+      fallback: "abort",
+      createdAt: Date.now(),
+    };
+
+    await expect(plugin.send(request)).rejects.toThrow("Failed to send webhook request");
+
+    // Restore
+    globalThis.fetch = originalFetch;
+    await plugin.destroy();
+  });
+
+  test("should handle HTTP error in send()", async () => {
+    const plugin = new WebhookInteractionPlugin();
+    await plugin.init({ url: "https://example.com/webhook" });
+
+    // Mock fetch to return 503 error
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = async () => {
+      return new Response("Service Unavailable", { status: 503 });
+    };
+
+    const request: InteractionRequest = {
+      id: "test-http-error",
+      type: "confirm",
+      featureName: "test-feature",
+      stage: "review",
+      summary: "Test HTTP error",
+      fallback: "abort",
+      createdAt: Date.now(),
+    };
+
+    await expect(plugin.send(request)).rejects.toThrow("Webhook POST failed (503)");
+
+    // Restore
+    globalThis.fetch = originalFetch;
+    await plugin.destroy();
+  });
+
+  test("should apply exponential backoff in receive() polling", async () => {
+    const plugin = new WebhookInteractionPlugin();
+    await plugin.init({ url: "https://example.com/webhook" });
+
+    const startTime = Date.now();
+
+    // Call receive with short timeout
+    const response = await plugin.receive("test-request", 500);
+
+    const duration = Date.now() - startTime;
+
+    // Should timeout with exponential backoff
+    expect(response.action).toBe("skip");
+    expect(response.respondedBy).toBe("timeout");
+
+    // Duration should be at least timeout (500ms) but less than timeout + max backoff
+    expect(duration).toBeGreaterThanOrEqual(500);
+    expect(duration).toBeLessThan(3000); // Max backoff is 2s
+
+    await plugin.destroy();
+  });
+});
+
+describe("WebhookInteractionPlugin - Payload Security", () => {
+  test("should reject oversized payload via Content-Length header", async () => {
+    const plugin = new WebhookInteractionPlugin();
+    await plugin.init({ url: "https://example.com/webhook", maxPayloadBytes: 1000 });
+
+    // Create a mock request with large Content-Length
+    const req = new Request("http://localhost:8765/nax/interact/test-id", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Content-Length": "10000", // 10KB - exceeds 1000 byte limit
+      },
+      body: JSON.stringify({ requestId: "test-id", action: "approve" }),
+    });
+
+    const handleRequest = (plugin as unknown as { handleRequest: (req: Request) => Promise<Response> }).handleRequest;
+    const response = await handleRequest.call(plugin, req);
+
+    expect(response.status).toBe(413); // Payload Too Large
+    expect(await response.text()).toBe("Payload Too Large");
+
+    await plugin.destroy();
+  });
+
+  test("should reject oversized payload by actual body size", async () => {
+    const plugin = new WebhookInteractionPlugin();
+    await plugin.init({ url: "https://example.com/webhook", secret: "test-secret", maxPayloadBytes: 100 });
+
+    // Create a large payload
+    const largePayload = "x".repeat(200);
+
+    const req = new Request("http://localhost:8765/nax/interact/test-id", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Nax-Signature": "dummy-signature",
+      },
+      body: largePayload,
+    });
+
+    const handleRequest = (plugin as unknown as { handleRequest: (req: Request) => Promise<Response> }).handleRequest;
+    const response = await handleRequest.call(plugin, req);
+
+    expect(response.status).toBe(413); // Payload Too Large
+
+    await plugin.destroy();
+  });
+
+  test("should reject malformed JSON with sanitized error", async () => {
+    const plugin = new WebhookInteractionPlugin();
+    await plugin.init({ url: "https://example.com/webhook" });
+
+    const req = new Request("http://localhost:8765/nax/interact/test-id", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: "not valid json{",
+    });
+
+    const handleRequest = (plugin as unknown as { handleRequest: (req: Request) => Promise<Response> }).handleRequest;
+    const response = await handleRequest.call(plugin, req);
+
+    expect(response.status).toBe(400);
+    const errorText = await response.text();
+
+    // Should not leak parse error details
+    expect(errorText).toBe("Bad Request: Invalid response format");
+    expect(errorText).not.toContain("JSON");
+    expect(errorText).not.toContain("parse");
+    expect(errorText).not.toContain("Unexpected");
+
+    await plugin.destroy();
+  });
+
+  test("should reject invalid schema with sanitized error", async () => {
+    const plugin = new WebhookInteractionPlugin();
+    await plugin.init({ url: "https://example.com/webhook" });
+
+    // Valid JSON but invalid InteractionResponse schema
+    const req = new Request("http://localhost:8765/nax/interact/test-id", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ malicious: "payload", action: "invalid-action" }),
+    });
+
+    const handleRequest = (plugin as unknown as { handleRequest: (req: Request) => Promise<Response> }).handleRequest;
+    const response = await handleRequest.call(plugin, req);
+
+    expect(response.status).toBe(400);
+    const errorText = await response.text();
+
+    // Should not leak Zod validation error details
+    expect(errorText).toBe("Bad Request: Invalid response format");
+    expect(errorText).not.toContain("Zod");
+    expect(errorText).not.toContain("validation");
+    expect(errorText).not.toContain("enum");
+
+    await plugin.destroy();
+  });
+
+  test("should reject request without signature when secret is configured", async () => {
+    const plugin = new WebhookInteractionPlugin();
+    await plugin.init({ url: "https://example.com/webhook", secret: "test-secret" });
+
+    const req = new Request("http://localhost:8765/nax/interact/test-id", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ requestId: "test-id", action: "approve", respondedAt: Date.now() }),
+    });
+
+    const handleRequest = (plugin as unknown as { handleRequest: (req: Request) => Promise<Response> }).handleRequest;
+    const response = await handleRequest.call(plugin, req);
+
+    expect(response.status).toBe(401); // Unauthorized
+    expect(await response.text()).toBe("Unauthorized");
+
+    await plugin.destroy();
+  });
+
+  test("should reject request with invalid signature", async () => {
+    const plugin = new WebhookInteractionPlugin();
+    await plugin.init({ url: "https://example.com/webhook", secret: "test-secret" });
+
+    const req = new Request("http://localhost:8765/nax/interact/test-id", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Nax-Signature": "invalid-signature",
+      },
+      body: JSON.stringify({ requestId: "test-id", action: "approve", respondedAt: Date.now() }),
+    });
+
+    const handleRequest = (plugin as unknown as { handleRequest: (req: Request) => Promise<Response> }).handleRequest;
+    const response = await handleRequest.call(plugin, req);
+
+    expect(response.status).toBe(401); // Unauthorized
+
+    await plugin.destroy();
+  });
+});

package/test/unit/interaction-plugins.test.ts

@@ -0,0 +1,164 @@
+/**
+ * Interaction Plugins Unit Tests (v0.15.0 Phase 2)
+ *
+ * Tests for Telegram, Webhook, and Auto plugins.
+ */
+
+import { describe, expect, test } from "bun:test";
+import type { InteractionRequest } from "../../src/interaction";
+import { AutoInteractionPlugin } from "../../src/interaction/plugins/auto";
+import { TelegramInteractionPlugin } from "../../src/interaction/plugins/telegram";
+import { WebhookInteractionPlugin } from "../../src/interaction/plugins/webhook";
+
+describe("TelegramInteractionPlugin", () => {
+  test("should validate required config", async () => {
+    const plugin = new TelegramInteractionPlugin();
+
+    // Should throw without botToken and chatId
+    await expect(plugin.init({})).rejects.toThrow("botToken and chatId");
+  });
+
+  test("should initialize with config", async () => {
+    const plugin = new TelegramInteractionPlugin();
+
+    await plugin.init({
+      botToken: "test-token",
+      chatId: "12345",
+    });
+
+    expect(plugin.name).toBe("telegram");
+  });
+
+  test("should initialize with env vars", async () => {
+    const plugin = new TelegramInteractionPlugin();
+
+    // Set env vars
+    process.env.NAX_TELEGRAM_TOKEN = "env-token";
+    process.env.NAX_TELEGRAM_CHAT_ID = "env-chat";
+
+    await plugin.init({});
+
+    expect(plugin.name).toBe("telegram");
+
+    // Cleanup
+    process.env.NAX_TELEGRAM_TOKEN = undefined;
+    process.env.NAX_TELEGRAM_CHAT_ID = undefined;
+  });
+});
+
+describe("WebhookInteractionPlugin", () => {
+  test("should validate required config", async () => {
+    const plugin = new WebhookInteractionPlugin();
+
+    // Should throw without url
+    await expect(plugin.init({})).rejects.toThrow("url");
+  });
+
+  test("should initialize with config", async () => {
+    const plugin = new WebhookInteractionPlugin();
+
+    await plugin.init({
+      url: "https://example.com/webhook",
+      callbackPort: 9999,
+    });
+
+    expect(plugin.name).toBe("webhook");
+
+    await plugin.destroy();
+  });
+
+  test("should default callbackPort to 8765", async () => {
+    const plugin = new WebhookInteractionPlugin();
+
+    await plugin.init({
+      url: "https://example.com/webhook",
+    });
+
+    expect(plugin.name).toBe("webhook");
+
+    await plugin.destroy();
+  });
+});
+
+describe("AutoInteractionPlugin", () => {
+  test("should initialize with defaults", async () => {
+    const plugin = new AutoInteractionPlugin();
+
+    await plugin.init({});
+
+    expect(plugin.name).toBe("auto");
+  });
+
+  test("should respect config overrides", async () => {
+    const plugin = new AutoInteractionPlugin();
+
+    await plugin.init({
+      model: "balanced",
+      confidenceThreshold: 0.8,
+      maxCostPerDecision: 0.05,
+    });
+
+    expect(plugin.name).toBe("auto");
+  });
+
+  test("should reject security-review triggers", async () => {
+    const plugin = new AutoInteractionPlugin();
+
+    // Mock config
+    await plugin.init({
+      naxConfig: {
+        models: {
+          fast: { model: "claude-haiku-3-5" },
+        },
+      } as unknown as import("../../src/config").NaxConfig,
+    });
+
+    const request: InteractionRequest = {
+      id: "test-security-review",
+      type: "confirm",
+      featureName: "test-feature",
+      stage: "review",
+      summary: "Security review failed",
+      fallback: "abort",
+      createdAt: Date.now(),
+      metadata: {
+        trigger: "security-review",
+        safety: "red",
+      },
+    };
+
+    const response = await plugin.decide(request);
+
+    // Should return undefined to escalate to human
+    expect(response).toBeUndefined();
+  });
+
+  test("should escalate on low confidence", async () => {
+    const plugin = new AutoInteractionPlugin();
+
+    // Set high threshold
+    await plugin.init({
+      confidenceThreshold: 0.9,
+      naxConfig: {
+        models: {
+          fast: { model: "claude-haiku-3-5" },
+        },
+      } as unknown as import("../../src/config").NaxConfig,
+    });
+
+    // Mock a request that would get low confidence
+    const request: InteractionRequest = {
+      id: "test-low-confidence",
+      type: "confirm",
+      featureName: "test-feature",
+      stage: "custom",
+      summary: "Ambiguous decision",
+      fallback: "continue",
+      createdAt: Date.now(),
+    };
+
+    // Note: This would require mocking the LLM call in a real test
+    // For now, we just verify the plugin is configured correctly
+    expect(plugin.name).toBe("auto");
+  });
+});

package/test/unit/isolation.test.ts

@@ -0,0 +1,134 @@
+/**
+ * Tests for src/tdd/isolation.ts
+ *
+ * Covers: isTestFile, isSourceFile, matchesAllowedPath (via verify functions)
+ */
+
+import { describe, expect, it } from "bun:test";
+import { isSourceFile, isTestFile } from "../../src/tdd/isolation";
+
+// ─────────────────────────────────────────────────────────────────────────────
+// isTestFile
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe("isTestFile", () => {
+  it("detects test/ directory files", () => {
+    expect(isTestFile("test/unit/foo.ts")).toBe(true);
+    expect(isTestFile("test/integration/bar.test.ts")).toBe(true);
+    expect(isTestFile("test/fixtures/data.json")).toBe(true);
+  });
+
+  it("detects tests/ directory files", () => {
+    expect(isTestFile("tests/unit/foo.ts")).toBe(true);
+    expect(isTestFile("tests/integration/bar.test.ts")).toBe(true);
+  });
+
+  it("detects __tests__/ directory files", () => {
+    expect(isTestFile("__tests__/unit/foo.ts")).toBe(true);
+    expect(isTestFile("src/__tests__/foo.test.ts")).toBe(true);
+  });
+
+  it("detects .spec extension", () => {
+    expect(isTestFile("src/foo.spec.ts")).toBe(true);
+    expect(isTestFile("src/utils/bar.spec.js")).toBe(true);
+    expect(isTestFile("lib/baz.spec.tsx")).toBe(true);
+  });
+
+  it("detects .test extension", () => {
+    expect(isTestFile("src/foo.test.ts")).toBe(true);
+    expect(isTestFile("src/utils/bar.test.js")).toBe(true);
+    expect(isTestFile("lib/baz.test.tsx")).toBe(true);
+  });
+
+  it("detects .e2e-spec extension (NestJS convention)", () => {
+    expect(isTestFile("src/app.e2e-spec.ts")).toBe(true);
+    expect(isTestFile("test/e2e/auth.e2e-spec.ts")).toBe(true);
+  });
+
+  it("returns false for source files", () => {
+    expect(isTestFile("src/index.ts")).toBe(false);
+    expect(isTestFile("lib/utils.ts")).toBe(false);
+    expect(isTestFile("packages/core/foo.ts")).toBe(false);
+  });
+
+  it("returns false for config/doc files", () => {
+    expect(isTestFile("package.json")).toBe(false);
+    expect(isTestFile("README.md")).toBe(false);
+    expect(isTestFile("tsconfig.json")).toBe(false);
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// isSourceFile
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe("isSourceFile", () => {
+  it("detects src/ directory files", () => {
+    expect(isSourceFile("src/index.ts")).toBe(true);
+    expect(isSourceFile("src/utils/foo.ts")).toBe(true);
+    expect(isSourceFile("src/components/Bar.tsx")).toBe(true);
+  });
+
+  it("detects lib/ directory files", () => {
+    expect(isSourceFile("lib/index.ts")).toBe(true);
+    expect(isSourceFile("lib/utils/foo.ts")).toBe(true);
+  });
+
+  it("detects packages/ directory files (monorepo)", () => {
+    expect(isSourceFile("packages/core/index.ts")).toBe(true);
+    expect(isSourceFile("packages/utils/foo.ts")).toBe(true);
+  });
+
+  it("returns false for test files", () => {
+    expect(isSourceFile("test/unit/foo.test.ts")).toBe(false);
+    expect(isSourceFile("tests/integration/bar.test.ts")).toBe(false);
+    expect(isSourceFile("__tests__/baz.ts")).toBe(false);
+  });
+
+  it("returns false for config/doc files", () => {
+    expect(isSourceFile("package.json")).toBe(false);
+    expect(isSourceFile("README.md")).toBe(false);
+    expect(isSourceFile("tsconfig.json")).toBe(false);
+  });
+
+  it("returns false for root files", () => {
+    expect(isSourceFile("index.ts")).toBe(false);
+    expect(isSourceFile("utils.ts")).toBe(false);
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Combined behavior tests
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe("combined isTestFile + isSourceFile", () => {
+  it("test files in src/ are detected as both test and source", () => {
+    const file = "src/foo.test.ts";
+    expect(isTestFile(file)).toBe(true);
+    expect(isSourceFile(file)).toBe(true);
+  });
+
+  it("spec files in src/ are detected as both test and source", () => {
+    const file = "src/foo.spec.ts";
+    expect(isTestFile(file)).toBe(true);
+    expect(isSourceFile(file)).toBe(true);
+  });
+
+  it("regular src/ files are source but not test", () => {
+    const file = "src/foo.ts";
+    expect(isTestFile(file)).toBe(false);
+    expect(isSourceFile(file)).toBe(true);
+  });
+
+  it("test/ directory files are test but not source (default)", () => {
+    const file = "test/foo.ts";
+    expect(isTestFile(file)).toBe(true);
+    expect(isSourceFile(file)).toBe(false);
+  });
+
+  it("config files are neither test nor source", () => {
+    const file = "package.json";
+    expect(isTestFile(file)).toBe(false);
+    expect(isSourceFile(file)).toBe(false);
+  });
+});