@nathapp/nax 0.23.0 → 0.25.0

package/test/unit/interaction-plugins.test.ts

@@ -5,7 +5,8 @@
  * Tests for Telegram, Webhook, and Auto plugins.
  */
 
-import { describe, expect, test } from "bun:test";
+import { createHmac } from "node:crypto";
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 import type { InteractionRequest } from "../../src/interaction";
 import { AutoInteractionPlugin } from "../../src/interaction/plugins/auto";
 import { TelegramInteractionPlugin } from "../../src/interaction/plugins/telegram";
@@ -163,3 +164,309 @@ describe("AutoInteractionPlugin", () => {
     expect(plugin.name).toBe("auto");
   });
 });
+
+// ---------------------------------------------------------------------------
+// Telegram send() and poll() flow tests (TC-006)
+// ---------------------------------------------------------------------------
+
+describe("TelegramInteractionPlugin - send() and poll()", () => {
+  const originalFetch = globalThis.fetch;
+
+  afterEach(() => {
+    mock.restore();
+    globalThis.fetch = originalFetch;
+  });
+
+  function makeConfirmRequest(id: string): InteractionRequest {
+    return {
+      id,
+      type: "confirm",
+      featureName: "my-feature",
+      stage: "review",
+      summary: "Proceed with merge?",
+      fallback: "abort",
+      createdAt: Date.now(),
+    };
+  }
+
+  test("send() POSTs to correct Telegram API URL with message text and inline keyboard", async () => {
+    const calls: Array<{ url: string; body: Record<string, unknown> }> = [];
+
+    globalThis.fetch = mock(async (url: string | URL | Request, init?: RequestInit) => {
+      const urlStr = url.toString();
+      const body = JSON.parse((init?.body as string) ?? "{}");
+      calls.push({ url: urlStr, body });
+      return new Response(
+        JSON.stringify({ ok: true, result: { message_id: 42, chat: { id: 12345 } } }),
+        { status: 200, headers: { "Content-Type": "application/json" } },
+      );
+    }) as typeof fetch;
+
+    const plugin = new TelegramInteractionPlugin();
+    await plugin.init({ botToken: "bot-abc123", chatId: "99999" });
+
+    await plugin.send(makeConfirmRequest("tg-send-1"));
+
+    expect(calls).toHaveLength(1);
+    const { url, body } = calls[0];
+
+    // Correct API endpoint
+    expect(url).toContain("api.telegram.org/botbot-abc123/sendMessage");
+
+    // Correct chat_id
+    expect(body.chat_id).toBe("99999");
+
+    // Message text present
+    expect(typeof body.text).toBe("string");
+    expect((body.text as string).length).toBeGreaterThan(0);
+
+    // Inline keyboard has approve and reject buttons
+    const keyboard = (body.reply_markup as { inline_keyboard: Array<Array<{ text: string; callback_data: string }>> })
+      .inline_keyboard;
+    expect(Array.isArray(keyboard)).toBe(true);
+    const allButtons = keyboard.flat();
+    const approveBtn = allButtons.find((b) => b.callback_data === "tg-send-1:approve");
+    const rejectBtn = allButtons.find((b) => b.callback_data === "tg-send-1:reject");
+    expect(approveBtn).toBeDefined();
+    expect(rejectBtn).toBeDefined();
+  });
+
+  test("receive() parses callback_query correctly", async () => {
+    globalThis.fetch = mock(async (url: string | URL | Request, init?: RequestInit) => {
+      const urlStr = url.toString();
+
+      if (urlStr.includes("sendMessage")) {
+        return new Response(
+          JSON.stringify({ ok: true, result: { message_id: 10, chat: { id: 99999 } } }),
+          { status: 200, headers: { "Content-Type": "application/json" } },
+        );
+      }
+
+      if (urlStr.includes("getUpdates")) {
+        return new Response(
+          JSON.stringify({
+            ok: true,
+            result: [
+              {
+                update_id: 1,
+                callback_query: {
+                  id: "cq-001",
+                  data: "tg-poll-1:approve",
+                  message: { message_id: 10, chat: { id: 99999 } },
+                },
+              },
+            ],
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } },
+        );
+      }
+
+      if (urlStr.includes("answerCallbackQuery")) {
+        return new Response(JSON.stringify({ ok: true }), { status: 200 });
+      }
+
+      return new Response("not found", { status: 404 });
+    }) as typeof fetch;
+
+    const plugin = new TelegramInteractionPlugin();
+    await plugin.init({ botToken: "bot-abc123", chatId: "99999" });
+
+    // send() first so message_id is stored (needed for text-message flow, not callback_query)
+    await plugin.send(makeConfirmRequest("tg-poll-1"));
+
+    const response = await plugin.receive("tg-poll-1", 5000);
+
+    expect(response.action).toBe("approve");
+    expect(response.respondedBy).toBe("telegram");
+    expect(response.requestId).toBe("tg-poll-1");
+  });
+
+  test("receive() handles choose callback_query with value", async () => {
+    globalThis.fetch = mock(async (url: string | URL | Request) => {
+      const urlStr = url.toString();
+
+      if (urlStr.includes("sendMessage")) {
+        return new Response(
+          JSON.stringify({ ok: true, result: { message_id: 11, chat: { id: 99999 } } }),
+          { status: 200, headers: { "Content-Type": "application/json" } },
+        );
+      }
+
+      if (urlStr.includes("getUpdates")) {
+        return new Response(
+          JSON.stringify({
+            ok: true,
+            result: [
+              {
+                update_id: 2,
+                callback_query: {
+                  id: "cq-002",
+                  data: "tg-choose-1:choose:option-b",
+                  message: { message_id: 11, chat: { id: 99999 } },
+                },
+              },
+            ],
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } },
+        );
+      }
+
+      if (urlStr.includes("answerCallbackQuery")) {
+        return new Response(JSON.stringify({ ok: true }), { status: 200 });
+      }
+
+      return new Response("not found", { status: 404 });
+    }) as typeof fetch;
+
+    const plugin = new TelegramInteractionPlugin();
+    await plugin.init({ botToken: "bot-abc123", chatId: "99999" });
+
+    const chooseRequest: InteractionRequest = {
+      id: "tg-choose-1",
+      type: "choose",
+      featureName: "my-feature",
+      stage: "review",
+      summary: "Which option?",
+      fallback: "continue",
+      createdAt: Date.now(),
+      options: [
+        { key: "a", label: "Option A" },
+        { key: "b", label: "Option B" },
+      ],
+    };
+
+    await plugin.send(chooseRequest);
+    const response = await plugin.receive("tg-choose-1", 5000);
+
+    expect(response.action).toBe("choose");
+    expect(response.value).toBe("option-b");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Webhook send() and HMAC validation tests (TC-006)
+// ---------------------------------------------------------------------------
+
+describe("WebhookInteractionPlugin - send() and HMAC validation", () => {
+  afterEach(async () => {
+    mock.restore();
+  });
+
+  function makeWebhookRequest(id: string): InteractionRequest {
+    return {
+      id,
+      type: "confirm",
+      featureName: "wh-feature",
+      stage: "merge",
+      summary: "Approve merge?",
+      fallback: "abort",
+      createdAt: Date.now(),
+    };
+  }
+
+  test("send() POSTs payload with correct Content-Type", async () => {
+    // Start a local server to capture the outgoing request
+    const captured: { contentType: string | null; body: unknown } = { contentType: null, body: null };
+
+    const testServer = Bun.serve({
+      port: 19977,
+      fetch: async (req) => {
+        captured.contentType = req.headers.get("content-type");
+        captured.body = await req.json();
+        return new Response("OK", { status: 200 });
+      },
+    });
+
+    const plugin = new WebhookInteractionPlugin();
+    try {
+      await plugin.init({ url: "http://localhost:19977/hook" });
+
+      await plugin.send(makeWebhookRequest("wh-send-1"));
+
+      expect(captured.contentType).toBe("application/json");
+      expect((captured.body as { id: string }).id).toBe("wh-send-1");
+      // callbackUrl is injected by send()
+      expect(typeof (captured.body as { callbackUrl: string }).callbackUrl).toBe("string");
+    } finally {
+      testServer.stop();
+      await plugin.destroy();
+    }
+  });
+
+  test("send() includes X-Nax-Signature header when secret is configured", async () => {
+    const captured: { signature: string | null; body: string } = { signature: null, body: "" };
+
+    const testServer = Bun.serve({
+      port: 19978,
+      fetch: async (req) => {
+        captured.signature = req.headers.get("x-nax-signature");
+        captured.body = await req.text();
+        return new Response("OK", { status: 200 });
+      },
+    });
+
+    const plugin = new WebhookInteractionPlugin();
+    try {
+      await plugin.init({ url: "http://localhost:19978/hook", secret: "my-secret" });
+
+      await plugin.send(makeWebhookRequest("wh-sig-1"));
+
+      expect(captured.signature).not.toBeNull();
+      // Verify the signature matches expected HMAC
+      const expected = createHmac("sha256", "my-secret").update(captured.body).digest("hex");
+      expect(captured.signature).toBe(expected);
+    } finally {
+      testServer.stop();
+      await plugin.destroy();
+    }
+  });
+
+  test("HMAC validation: tampered payload (no signature) is rejected with 401", async () => {
+    const plugin = new WebhookInteractionPlugin();
+    // url won't be called in this test — we test the callback server
+    await plugin.init({
+      url: "http://localhost:19900/unused",
+      secret: "test-secret",
+      callbackPort: 19988,
+    });
+
+    // Start the callback server by calling receive() in the background
+    const receivePromise = plugin.receive("wh-hmac-1", 4000);
+
+    // Give the server a moment to bind
+    await Bun.sleep(60);
+
+    try {
+      // POST without signature → 401
+      const noSigResp = await fetch("http://localhost:19988/nax/interact/wh-hmac-1", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ requestId: "wh-hmac-1", action: "approve", respondedAt: Date.now() }),
+      });
+      expect(noSigResp.status).toBe(401);
+
+      // POST with wrong signature → 401
+      const badSigResp = await fetch("http://localhost:19988/nax/interact/wh-hmac-1", {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "X-Nax-Signature": "deadbeef" },
+        body: JSON.stringify({ requestId: "wh-hmac-1", action: "approve", respondedAt: Date.now() }),
+      });
+      expect(badSigResp.status).toBe(401);
+
+      // POST with correct HMAC signature → 200, receive() resolves
+      const payload = JSON.stringify({ requestId: "wh-hmac-1", action: "approve", respondedAt: Date.now() });
+      const sig = createHmac("sha256", "test-secret").update(payload).digest("hex");
+      const validResp = await fetch("http://localhost:19988/nax/interact/wh-hmac-1", {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "X-Nax-Signature": sig },
+        body: payload,
+      });
+      expect(validResp.status).toBe(200);
+
+      const response = await receivePromise;
+      expect(response.action).toBe("approve");
+    } finally {
+      await plugin.destroy();
+    }
+  });
+});

package/test/unit/pipeline/stages/completion-review-gate.test.ts

@@ -0,0 +1,218 @@
+/**
+ * Unit tests for review-gate trigger wiring in completion stage (TC-004)
+ *
+ * Covers:
+ * - review-gate trigger fires after each story passes when enabled
+ * - review-gate is disabled by default
+ * - trigger responds abort → logs warning (non-blocking)
+ * - trigger responds approve → continues normally
+ */
+
+import { afterEach, describe, expect, mock, test } from "bun:test";
+import { mkdtempSync } from "fs";
+import { tmpdir } from "os";
+import type { NaxConfig } from "../../../../src/config";
+import { InteractionChain } from "../../../../src/interaction/chain";
+import type { InteractionPlugin, InteractionResponse } from "../../../../src/interaction/types";
+import { _completionDeps } from "../../../../src/pipeline/stages/completion";
+import type { PipelineContext } from "../../../../src/pipeline/types";
+import type { PRD, UserStory } from "../../../../src/prd";
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Save originals for restoration
+// ─────────────────────────────────────────────────────────────────────────────
+
+const originalCheckReviewGate = _completionDeps.checkReviewGate;
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Helpers
+// ─────────────────────────────────────────────────────────────────────────────
+
+function makeChain(action: InteractionResponse["action"]): InteractionChain {
+  const chain = new InteractionChain({ defaultTimeout: 5000, defaultFallback: "abort" });
+  const plugin: InteractionPlugin = {
+    name: "test",
+    send: mock(async () => {}),
+    receive: mock(async (id: string): Promise<InteractionResponse> => ({
+      requestId: id,
+      action,
+      respondedBy: "user",
+      respondedAt: Date.now(),
+    })),
+  };
+  chain.register(plugin);
+  return chain;
+}
+
+function makeConfig(triggers: Record<string, unknown>): NaxConfig {
+  return {
+    autoMode: { defaultAgent: "test-agent" },
+    models: { fast: "claude-haiku-4-5", balanced: "claude-sonnet-4-5", powerful: "claude-opus-4-5" },
+    execution: {
+      sessionTimeoutSeconds: 60,
+      dangerouslySkipPermissions: false,
+      costLimit: 10,
+      maxIterations: 10,
+      rectification: { maxRetries: 3 },
+    },
+    interaction: {
+      plugin: "cli",
+      defaults: { timeout: 30000, fallback: "abort" as const },
+      triggers,
+    },
+  } as unknown as NaxConfig;
+}
+
+function makeStory(): UserStory {
+  return {
+    id: "US-001",
+    title: "Test Story",
+    description: "Test",
+    acceptanceCriteria: [],
+    tags: [],
+    dependencies: [],
+    status: "in-progress",
+    passes: false,
+    escalations: [],
+    attempts: 1,
+  };
+}
+
+function makePRD(): PRD {
+  return {
+    project: "test",
+    feature: "my-feature",
+    branchName: "test-branch",
+    createdAt: new Date().toISOString(),
+    updatedAt: new Date().toISOString(),
+    userStories: [makeStory()],
+  };
+}
+
+function makeCtx(config: NaxConfig, interaction?: InteractionChain): PipelineContext {
+  const tempDir = mkdtempSync(`${tmpdir()}/nax-test-`);
+  return {
+    config,
+    prd: makePRD(),
+    story: makeStory(),
+    stories: [makeStory()],
+    routing: { complexity: "simple", modelTier: "fast", testStrategy: "test-after", reasoning: "" },
+    workdir: tempDir,
+    featureDir: tempDir,
+    agentResult: { success: true, estimatedCost: 0.01, output: "", stderr: "", exitCode: 0, rateLimited: false },
+    hooks: {} as PipelineContext["hooks"],
+    interaction,
+    storyStartTime: new Date().toISOString(),
+  } as unknown as PipelineContext;
+}
+
+afterEach(() => {
+  mock.restore();
+  _completionDeps.checkReviewGate = originalCheckReviewGate;
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// review-gate trigger tests (via _completionDeps injection)
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe("completionStage — review-gate trigger", () => {
+  test("calls review-gate trigger after story passes when enabled", async () => {
+    const { completionStage } = await import("../../../../src/pipeline/stages/completion");
+    _completionDeps.checkReviewGate = mock(async () => true);
+
+    const config = makeConfig({ "review-gate": { enabled: true } });
+    const chain = makeChain("approve");
+    const ctx = makeCtx(config, chain);
+
+    const result = await completionStage.execute(ctx);
+
+    expect(result.action).toBe("continue");
+    expect(_completionDeps.checkReviewGate).toHaveBeenCalledTimes(1);
+  });
+
+  test("does not call trigger when review-gate is disabled (default)", async () => {
+    const { completionStage } = await import("../../../../src/pipeline/stages/completion");
+    _completionDeps.checkReviewGate = mock(async () => true);
+
+    const config = makeConfig({});
+    const chain = makeChain("approve");
+    const ctx = makeCtx(config, chain);
+
+    const result = await completionStage.execute(ctx);
+
+    expect(result.action).toBe("continue");
+    expect(_completionDeps.checkReviewGate).not.toHaveBeenCalled();
+  });
+
+  test("does not fail pipeline when trigger responds abort", async () => {
+    const { completionStage } = await import("../../../../src/pipeline/stages/completion");
+    _completionDeps.checkReviewGate = mock(async () => false);
+
+    const config = makeConfig({ "review-gate": { enabled: true } });
+    const chain = makeChain("abort");
+    const ctx = makeCtx(config, chain);
+
+    const result = await completionStage.execute(ctx);
+
+    expect(result.action).toBe("continue");
+    expect(_completionDeps.checkReviewGate).toHaveBeenCalledTimes(1);
+  });
+
+  test("continues normally when trigger approves", async () => {
+    const { completionStage } = await import("../../../../src/pipeline/stages/completion");
+    _completionDeps.checkReviewGate = mock(async () => true);
+
+    const config = makeConfig({ "review-gate": { enabled: true } });
+    const chain = makeChain("approve");
+    const ctx = makeCtx(config, chain);
+
+    const result = await completionStage.execute(ctx);
+
+    expect(result.action).toBe("continue");
+  });
+
+  test("does not call trigger when no interaction chain", async () => {
+    const { completionStage } = await import("../../../../src/pipeline/stages/completion");
+    _completionDeps.checkReviewGate = mock(async () => true);
+
+    const config = makeConfig({ "review-gate": { enabled: true } });
+    const ctx = makeCtx(config); // no chain
+
+    const result = await completionStage.execute(ctx);
+
+    expect(result.action).toBe("continue");
+    expect(_completionDeps.checkReviewGate).not.toHaveBeenCalled();
+  });
+
+  test("passes correct context to checkReviewGate", async () => {
+    const { completionStage } = await import("../../../../src/pipeline/stages/completion");
+    _completionDeps.checkReviewGate = mock(async () => true);
+
+    const config = makeConfig({ "review-gate": { enabled: true } });
+    const chain = makeChain("approve");
+    const ctx = makeCtx(config, chain);
+
+    await completionStage.execute(ctx);
+
+    const callArgs = (_completionDeps.checkReviewGate as any).mock.calls[0];
+    expect(callArgs[0].featureName).toBe("my-feature");
+    expect(callArgs[0].storyId).toBe("US-001");
+  });
+
+  test("calls trigger for each story when multiple stories passed", async () => {
+    const { completionStage } = await import("../../../../src/pipeline/stages/completion");
+    _completionDeps.checkReviewGate = mock(async () => true);
+
+    const config = makeConfig({ "review-gate": { enabled: true } });
+    const chain = makeChain("approve");
+    const ctx = makeCtx(config, chain);
+
+    const story2 = makeStory();
+    story2.id = "US-002";
+    ctx.stories = [makeStory(), story2];
+
+    await completionStage.execute(ctx);
+
+    expect(_completionDeps.checkReviewGate).toHaveBeenCalledTimes(2);
+  });
+});