@north-light/crouter 0.3.318 → 0.3.319

package/dist/core/canvas/__tests__/remote-canvas-source.test.js

@@ -1,328 +0,0 @@
-// remote-canvas-source.test.ts — `RemoteCanvasSource` (`../remote-canvas-source.ts`)
-// over its real wire contract: a POST to `/__crtr/source` carrying
-// `{kind:'exec', bin, args}` (see `../remote-transport.ts`), bearer-
-// authed. Mirrors `src/core/broker-client/__tests__/transport-relay.test.ts`'s
-// `startMockRelay` shape — a plain `node:http` server standing in for the
-// remote canvas's `/__crtr/source` endpoint, recording every request so
-// assertions land on the wire (argv shape, token placement), not just
-// behavior.
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { createServer } from 'node:http';
-import { RemoteCanvasSource } from '../remote-canvas-source.js';
-import { dashboardRowsAllFromSource, renderForestFromSource } from '../render-source.js';
-/** Stand up a bare `node:http` server on an ephemeral loopback port — the
- *  `/__crtr/source` endpoint a `RemoteCanvasSource` POSTs to. `route` decides
- *  the response per captured argv; every request is recorded first so a test
- *  can assert on the raw wire (headers, body) independent of what `route`
- *  returns. */
-function startMockCrtrServer(route) {
-    return new Promise((resolve) => {
-        const requests = [];
-        const server = createServer((req, res) => {
-            const chunks = [];
-            req.on('data', (c) => chunks.push(c));
-            req.on('end', () => {
-                const bodyText = Buffer.concat(chunks).toString('utf8');
-                const parsed = JSON.parse(bodyText);
-                // Reject any request that does not match the exec-only shelling contract
-                // (`{kind:'exec', bin:'crtr'}`) instead of silently routing it —
-                // RemoteCanvasSource must never send anything else over this wire.
-                if (parsed.kind !== 'exec' || parsed.bin !== 'crtr') {
-                    res.writeHead(500, { 'content-type': 'application/json' });
-                    res.end(JSON.stringify({ ok: false, exitCode: 1, stdout: '', stderr: `unexpected request shape: kind=${parsed.kind} bin=${parsed.bin}` }));
-                    return;
-                }
-                requests.push({
-                    authHeader: req.headers.authorization,
-                    url: req.url ?? '',
-                    method: req.method,
-                    headers: req.headers,
-                    rawBody: bodyText,
-                    kind: parsed.kind,
-                    bin: parsed.bin,
-                    args: parsed.args,
-                });
-                const result = route(parsed.args);
-                if (result.kind === 'json') {
-                    res.writeHead(result.status ?? 200, { 'content-type': 'application/json' });
-                    res.end(JSON.stringify({ ok: true, exitCode: 0, stdout: JSON.stringify(result.body), stderr: '' }));
-                }
-                else {
-                    res.writeHead(result.status, { 'content-type': result.contentType ?? 'text/plain' });
-                    res.end(result.body);
-                }
-            });
-        });
-        server.listen(0, '127.0.0.1', () => {
-            const addr = server.address();
-            const port = typeof addr === 'object' && addr !== null ? addr.port : 0;
-            resolve({
-                url: `http://127.0.0.1:${port}`,
-                requests,
-                close: () => new Promise((res) => server.close(() => res())),
-            });
-        });
-    });
-}
-function meta(id, over = {}) {
-    return {
-        node_id: id,
-        name: id,
-        created: new Date().toISOString(),
-        cwd: '/tmp/work',
-        kind: 'general',
-        mode: 'base',
-        lifecycle: 'terminal',
-        status: 'active',
-        ...over,
-    };
-}
-function showResponse(id, reports = []) {
-    return {
-        node: meta(id),
-        reports: reports.map((r) => ({ node_id: r.node_id, name: r.node_id, kind: 'general', status: 'active', active: r.active })),
-        managers: [],
-        artifacts: { report: 0, doc: 0, roadmap: 0 },
-        pending_crons: 0,
-        paths: { context_dir: '/tmp/context', reports_dir: '/tmp/reports', session_file: null },
-        follow_up: '',
-    };
-}
-test('every request POSTs argv leading with --json, and the token appears ONLY in the Authorization header', async (t) => {
-    const server = await startMockCrtrServer((args) => {
-        if (args[0] === '--json' && args[1] === 'node' && args[2] === 'inspect' && args[3] === 'show') {
-            return { kind: 'json', body: showResponse(args[4]) };
-        }
-        return { kind: 'json', status: 500, body: {} };
-    });
-    t.after(() => server.close());
-    const source = new RemoteCanvasSource(server.url, 'secret-relay-token');
-    await source.getNode('a');
-    assert.equal(server.requests.length, 1);
-    const req = server.requests[0];
-    assert.equal(req.method, 'POST');
-    assert.equal(req.url, '/__crtr/source');
-    assert.equal(req.authHeader, 'Bearer secret-relay-token');
-    assert.equal(req.kind, 'exec', 'RemoteCanvasSource must only ever send the exec contract');
-    assert.equal(req.bin, 'crtr', 'RemoteCanvasSource must only ever shell the existing crtr binary, never an ad-hoc command');
-    assert.deepEqual(req.args.slice(0, 4), ['--json', 'node', 'inspect', 'show']);
-    assert.ok(!req.url.includes('secret-relay-token'));
-    assert.ok(!JSON.stringify(req.args).includes('secret-relay-token'));
-    assert.ok(!req.rawBody.includes('secret-relay-token'), 'the raw POST body must not carry the token');
-    for (const [k, v] of Object.entries(req.headers)) {
-        if (k.toLowerCase() === 'authorization')
-            continue;
-        assert.ok(!String(v).includes('secret-relay-token'), `header ${k} must not carry the token`);
-    }
-});
-test('view reads the batched roster topology and is cycle-safe', async (t) => {
-    const server = await startMockCrtrServer((args) => {
-        if (args[1] === 'canvas' && args[2] === 'roster') {
-            return {
-                kind: 'json',
-                body: {
-                    edges: [
-                        { from_id: 'root', to_id: 'a', active: true, created: '' },
-                        { from_id: 'a', to_id: 'b', active: true, created: '' },
-                        { from_id: 'b', to_id: 'a', active: true, created: '' },
-                    ],
-                },
-            };
-        }
-        return { kind: 'json', status: 500, body: {} };
-    });
-    t.after(() => server.close());
-    const source = new RemoteCanvasSource(server.url, 'tok');
-    const result = await source.view('root');
-    assert.deepEqual([...result].sort(), ['a', 'b']);
-    assert.equal(server.requests.length, 1, 'the whole traversal shares one roster request');
-});
-test('topology failures surface instead of rendering an empty remote graph', async (t) => {
-    const server = await startMockCrtrServer(() => ({ kind: 'json', status: 500, body: {} }));
-    t.after(() => server.close());
-    const source = new RemoteCanvasSource(server.url, 'tok');
-    await assert.rejects(source.subscriptionsOf('root'), /remote canvas topology is unavailable/);
-    await assert.rejects(source.subscriptionsOf('other-root'), /remote canvas topology is unavailable/);
-    assert.equal(server.requests.length, 1, 'a failed roster read is shared across roots for the cache TTL');
-});
-test('a 500 response, a non-JSON body, and a non-zero exitCode degrade optional reads gracefully', async (t) => {
-    const server = await startMockCrtrServer((args) => {
-        if (args.includes('http500'))
-            return { kind: 'json', status: 500, body: {} };
-        if (args.includes('badjson'))
-            return { kind: 'raw', status: 200, body: 'not json', contentType: 'application/json' };
-        if (args.includes('nonzero-exit')) {
-            // stdout is syntactically valid JSON that WOULD be accepted if execJson
-            // ignored exitCode — the assertion below only passes because the
-            // nonzero exitCode is honored and this payload is discarded.
-            const poisoned = JSON.stringify({ counts: { 'nonzero-exit': 7 } });
-            return { kind: 'raw', status: 200, body: JSON.stringify({ ok: true, exitCode: 1, stdout: poisoned, stderr: 'boom' }), contentType: 'application/json' };
-        }
-        return { kind: 'json', status: 500, body: {} };
-    });
-    t.after(() => server.close());
-    const source = new RemoteCanvasSource(server.url, 'tok');
-    assert.equal(await source.getNode('http500'), null);
-    assert.deepEqual(await source.listNodes(), []);
-    assert.deepEqual(await source.ticketCountsForView('badjson'), {});
-    assert.deepEqual(await source.ticketCountsForView('nonzero-exit'), {});
-});
-test('malformed success JSON (exit 0, wrong shape) degrades cleanly instead of returning a shape a consumer would crash on', async (t) => {
-    const server = await startMockCrtrServer((args) => {
-        if (args[1] === 'canvas' && args[2] === 'roster')
-            return { kind: 'json', body: { edges: [] } };
-        if (args[3] === 'show') {
-            const id = args[4];
-            if (id === 'empty-object')
-                return { kind: 'json', body: {} };
-            if (id === 'null-node')
-                return { kind: 'json', body: { node: null, reports: [], managers: [] } };
-            if (id === 'reports-not-array')
-                return { kind: 'json', body: { node: meta('a'), reports: 'nope', managers: [] } };
-            if (id === 'node-missing-id')
-                return { kind: 'json', body: { node: { name: 'a' }, reports: [], managers: [] } };
-            return { kind: 'json', body: showResponse(id) };
-        }
-        if (args[3] === 'list') {
-            return { kind: 'json', body: { nodes: 'not-an-array' } };
-        }
-        if (args[2] === 'attention') {
-            return { kind: 'json', body: { counts: 'not-an-object' } };
-        }
-        return { kind: 'json', status: 500, body: {} };
-    });
-    t.after(() => server.close());
-    const source = new RemoteCanvasSource(server.url, 'tok');
-    // `{}` — no `node` key at all. Without shape validation this would cast
-    // through as a truthy "valid" RemoteShowResponse (an object with `.node ===
-    // undefined`), and a consumer like `node inspect show`'s remote passthrough
-    // branch (src/commands/node/inspect.ts) treats any non-null return as found, then
-    // its renderer dereferences fields on `undefined` and throws.
-    assert.equal(await source.getNode('empty-object'), null, 'a shape with no node key must degrade to null, not a malformed object');
-    assert.equal(await source.rawShow('empty-object'), null);
-    assert.equal(await source.getNode('null-node'), null, '`node: null` must degrade to null');
-    assert.deepEqual(await source.subscriptionsOf('reports-not-array'), [], 'a non-array reports field must degrade to []');
-    assert.equal(await source.getNode('node-missing-id'), null, 'a node object missing node_id must degrade to null');
-    // `listNodes()` with a non-array `nodes` field must degrade to [], never
-    // throw or return the malformed value.
-    assert.deepEqual(await source.listNodes(), []);
-    // `ticketCountsForView()` with a non-object `counts` field must degrade to {}.
-    assert.deepEqual(await source.ticketCountsForView('root'), {});
-});
-function fullNodeRow(id, over = {}) {
-    return {
-        node_id: id,
-        name: id,
-        kind: 'general',
-        mode: 'base',
-        lifecycle: 'terminal',
-        status: 'active',
-        cwd: '/tmp/work',
-        host_kind: null,
-        profile_id: null,
-        parent: null,
-        created: new Date().toISOString(),
-        intent: null,
-        waiting_for: null,
-        pi_pid: null,
-        pi_pid_identity: null,
-        window: null,
-        tmux_session: null,
-        pane: null,
-        ...over,
-    };
-}
-test('listNodes drops malformed row elements (null, missing required fields) instead of casting them through', async (t) => {
-    const server = await startMockCrtrServer((args) => {
-        if (args[3] === 'list') {
-            return {
-                kind: 'json',
-                body: { nodes: [null, { node_id: 'partial-only' }, fullNodeRow('good')] },
-            };
-        }
-        return { kind: 'json', status: 500, body: {} };
-    });
-    t.after(() => server.close());
-    const source = new RemoteCanvasSource(server.url, 'tok');
-    const nodes = await source.listNodes();
-    assert.deepEqual(nodes.map((n) => n.node_id), ['good'], 'a null element and a row missing required string fields must both be dropped, leaving only the well-formed row');
-});
-test('isValidShowResponse rejects a payload missing/malformed on artifacts/pending_crons/paths/follow_up (Phase 3 review Minor 2)', async (t) => {
-    const server = await startMockCrtrServer((args) => {
-        if (args[3] !== 'show')
-            return { kind: 'json', status: 500, body: {} };
-        const id = args[4];
-        const valid = showResponse(id);
-        switch (id) {
-            case 'missing-artifacts': {
-                const { artifacts: _artifacts, ...rest } = valid;
-                return { kind: 'json', body: rest };
-            }
-            case 'artifacts-wrong-type':
-                return { kind: 'json', body: { ...valid, artifacts: { report: '0', doc: 0, roadmap: 0 } } };
-            case 'missing-pending-crons': {
-                const { pending_crons: _pt, ...rest } = valid;
-                return { kind: 'json', body: rest };
-            }
-            case 'paths-session-file-undefined': {
-                const { session_file: _sf, ...restPaths } = valid.paths;
-                return { kind: 'json', body: { ...valid, paths: restPaths } };
-            }
-            case 'paths-session-file-null':
-                return { kind: 'json', body: { ...valid, paths: { ...valid.paths, session_file: null } } };
-            case 'missing-follow-up': {
-                const { follow_up: _fu, ...rest } = valid;
-                return { kind: 'json', body: rest };
-            }
-            case 'fully-valid':
-                return { kind: 'json', body: valid };
-            default:
-                return { kind: 'json', status: 500, body: {} };
-        }
-    });
-    t.after(() => server.close());
-    const source = new RemoteCanvasSource(server.url, 'tok');
-    assert.equal(await source.rawShow('missing-artifacts'), null, 'a payload with no artifacts key must degrade to null');
-    assert.equal(await source.rawShow('artifacts-wrong-type'), null, 'artifacts.report as a string must degrade to null');
-    assert.equal(await source.rawShow('missing-pending-crons'), null, 'a payload with no pending_crons key must degrade to null');
-    assert.notEqual(await source.rawShow('paths-session-file-undefined'), null, 'an omitted session file is valid for a node that has not started a pi session');
-    assert.notEqual(await source.rawShow('paths-session-file-null'), null, 'paths.session_file explicitly null (no session yet) must be ACCEPTED');
-    assert.equal(await source.rawShow('missing-follow-up'), null, 'a payload with no follow_up key must degrade to null');
-    assert.notEqual(await source.rawShow('fully-valid'), null, 'the tightened validator must not false-reject the real, fully-valid shape');
-});
-test('a malformed row element does not crash dashboard row or forest rendering', async (t) => {
-    const server = await startMockCrtrServer((args) => {
-        if (args[3] === 'list') {
-            return { kind: 'json', body: { nodes: [null, { node_id: 'partial-only' }, fullNodeRow('good')] } };
-        }
-        if (args[3] === 'show') {
-            return { kind: 'json', body: showResponse('good') };
-        }
-        return { kind: 'json', status: 500, body: {} };
-    });
-    t.after(() => server.close());
-    const source = new RemoteCanvasSource(server.url, 'tok');
-    // `dashboardRowsAllFromSource` reaches the row shape through
-    // `dashboardRowFromNodeRow`; it relies on `listNodes()` dropping malformed
-    // elements before the renderer consumes them.
-    const rows = await dashboardRowsAllFromSource(source);
-    assert.deepEqual(rows.map((r) => r.node_id), ['good']);
-    const forest = await renderForestFromSource(source);
-    assert.ok(forest.includes('good'));
-});
-test('cache coalescing: two getNode calls inside the TTL hit the server once', async (t) => {
-    let hitCount = 0;
-    const server = await startMockCrtrServer((args) => {
-        if (args[3] === 'show') {
-            hitCount += 1;
-            return { kind: 'json', body: showResponse(args[4]) };
-        }
-        return { kind: 'json', status: 500, body: {} };
-    });
-    t.after(() => server.close());
-    const source = new RemoteCanvasSource(server.url, 'tok');
-    await source.getNode('a');
-    await source.getNode('a');
-    assert.equal(hitCount, 1);
-});

package/dist/core/canvas/__tests__/remote-transport.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/core/canvas/__tests__/remote-transport.test.js

@@ -1,97 +0,0 @@
-// remote-transport.test.ts — `createRemoteExec` (`../remote-transport.ts`), the
-// Node-side POST transport `RemoteCanvasSource` shells every remote read
-// through. Covers the one thing a bare `fetch(...)` with no
-// AbortController/timeout doesn't give you for free: a hung endpoint fails
-// CLOSED within a bound instead of wedging the caller forever. WITHOUT the
-// timeout, the "stalled endpoint" test below would hang past its own
-// assertion deadline (the promise the transport returns never settles).
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { createServer } from 'node:http';
-import { createRemoteExec } from '../remote-transport.js';
-function startStalledServer() {
-    return new Promise((resolve) => {
-        // Accept the connection but never write a response — the request just
-        // hangs, exactly what a wedged in-guest `/__crtr/source` handler looks
-        // like from the caller's side.
-        const server = createServer(() => { });
-        server.listen(0, '127.0.0.1', () => {
-            const addr = server.address();
-            const port = typeof addr === 'object' && addr !== null ? addr.port : 0;
-            resolve({
-                url: `http://127.0.0.1:${port}`,
-                close: () => new Promise((res) => server.close(() => res())),
-            });
-        });
-    });
-}
-test('a stalled endpoint returns a timeout failure within the configured bound instead of hanging forever', async (t) => {
-    const server = await startStalledServer();
-    // Register the close before assertions so a failure cannot leave a listening
-    // server holding this test process open.
-    t.after(() => server.close());
-    const exec = createRemoteExec(server.url, 'tok', 100); // small timeout for the test
-    const started = Date.now();
-    // Race against a generous outer deadline: if the transport doesn't
-    // self-bound, this whole test times out instead of asserting cleanly —
-    // still proves the point, but assert explicitly for a clear failure message.
-    const result = await Promise.race([
-        exec('crtr', ['--json', 'node', 'inspect', 'list']),
-        new Promise((_resolve, reject) => setTimeout(() => reject(new Error('transport did not resolve within the outer deadline — no timeout is wired')), 2000)),
-    ]);
-    const elapsed = Date.now() - started;
-    assert.equal(result.ok, false);
-    assert.match(result.stderr, /timeout/i);
-    assert.ok(elapsed < 1000, `expected the timeout to fire near the configured 100ms bound, took ${elapsed}ms`);
-});
-test('a normal fast response is unaffected by the timeout wiring', async (t) => {
-    const server = createServer((req, res) => {
-        const chunks = [];
-        req.on('data', (c) => chunks.push(c));
-        req.on('end', () => {
-            res.writeHead(200, { 'content-type': 'application/json' });
-            res.end(JSON.stringify({ ok: true, exitCode: 0, stdout: JSON.stringify({ nodes: [] }), stderr: '' }));
-        });
-    });
-    t.after(() => new Promise((r) => server.close(() => r())));
-    await new Promise((r) => server.listen(0, '127.0.0.1', r));
-    const addr = server.address();
-    const port = typeof addr === 'object' && addr !== null ? addr.port : 0;
-    const exec = createRemoteExec(`http://127.0.0.1:${port}`, 'tok', 5000);
-    const result = await exec('crtr', ['--json', 'node', 'inspect', 'list']);
-    assert.equal(result.ok, true);
-    assert.equal(result.stdout, JSON.stringify({ nodes: [] }));
-});
-// Phase 3 review Minor 1: no token bytes may ever reach returned stderr
-test('an unreachable endpoint returns a flat generic network-error message, never the raw exception text', async () => {
-    const exec = createRemoteExec('http://127.0.0.1:1', 'valid-token-123');
-    const result = await exec('crtr', ['--json', 'node', 'inspect', 'list']);
-    assert.equal(result.ok, false);
-    assert.equal(result.stderr, 'remote source: network error');
-});
-test('a malformed token (contains a newline) is rejected up front with a generic message, never reaching fetch/Headers', async () => {
-    const exec = createRemoteExec('http://127.0.0.1:1', 'bad\ntoken');
-    const result = await exec('crtr', ['--json', 'node', 'inspect', 'list']);
-    assert.equal(result.ok, false);
-    assert.equal(result.stderr, 'remote source: invalid stored relay token');
-    assert.ok(!result.stderr.includes('bad\ntoken'));
-    assert.ok(!result.stderr.includes('bad'));
-});
-test('a valid token containing typical bearer-token punctuation (-, _, .) still round-trips against a real server', async (t) => {
-    const server = createServer((req, res) => {
-        const chunks = [];
-        req.on('data', (c) => chunks.push(c));
-        req.on('end', () => {
-            res.writeHead(200, { 'content-type': 'application/json' });
-            res.end(JSON.stringify({ ok: true, exitCode: 0, stdout: JSON.stringify({ nodes: [] }), stderr: '' }));
-        });
-    });
-    t.after(() => new Promise((r) => server.close(() => r())));
-    await new Promise((r) => server.listen(0, '127.0.0.1', r));
-    const addr = server.address();
-    const port = typeof addr === 'object' && addr !== null ? addr.port : 0;
-    const exec = createRemoteExec(`http://127.0.0.1:${port}`, 'a1b2c3-real-token_ABC.789', 5000);
-    const result = await exec('crtr', ['--json', 'node', 'inspect', 'list']);
-    assert.equal(result.ok, true);
-    assert.equal(result.stdout, JSON.stringify({ nodes: [] }));
-});

package/dist/core/canvas/__tests__/render-remote.test.d.ts

@@ -1 +0,0 @@
-export {};