@oar-sh/oar 0.9.1 → 0.9.3

package/server/routes/messages-routes-test-harness.mjs

@@ -1,111 +0,0 @@
-// Shared scaffolding for the messages-routes test suites and the claude-worker
-// routes-integration test: the route-capturing fake express app, the res stub,
-// and the baseline deps stand-ins.
-//
-// server-runtime.mjs boots a live server on import, so the deps it injects are
-// reproduced here rather than imported. makeRouteDeps carries only the minimal
-// working defaults every suite shares; each suite supplies its own db/stmts —
-// the stub suites keep their hand-rolled fakes and prepared-statement mirrors,
-// the integration test passes a real better-sqlite3 database and the real
-// repositories. The harness owns the shape, the suite owns the fakes.
-import assert from 'node:assert/strict';
-
-import { registerMessagesRoutes } from './messages-routes.mjs';
-
-// Baseline deps: enough for registerMessagesRoutes to register every route
-// without touching a real server. Registration eagerly prepares statements for
-// many routes the suites never exercise, against tables they do not create —
-// the db stub absorbs those; suites that need real statement/transaction
-// semantics override db/stmts.
-export function makeRouteDeps(overrides = {}) {
-  return {
-    auth: (_req, _res, next) => next(),
-    db: { prepare: () => ({ run() {}, get: () => null, all: () => [] }) },
-    stmts: {},
-    MAX_UPLOAD_BYTES: 1024 * 1024,
-    touchCli: () => {},
-    ensureSessionId: () => 'session-1',
-    normalizeRelayMode: (value) => String(value || '').trim().toLowerCase() || null,
-    DEFAULT_RELAY_MODE: 'default',
-    DEFAULT_MODEL: 'gpt-5',
-    normalizeAttachments: () => [],
-    collectReferenceAttachmentsFromText: () => ({ attachments: [] }),
-    mergeMessageAttachments: (left, right) => [...(left || []), ...(right || [])],
-    resolveRequestedModel: (model) => ({
-      ok: false,
-      error: `Model "${String(model || '')}" is not supported`,
-      available: [],
-    }),
-    getOpenAIProviderSettings: () => ({ configured: false, enabled: false, model: '', models: [] }),
-    getCursorProviderSettings: () => ({ enabled: false, model: '', models: [] }),
-    featureFlags: {},
-    ...overrides,
-  };
-}
-
-// Registers the routes on a fake express app and returns the captured handlers
-// as a Map keyed 'METHOD /path' (last handler wins, matching how the suites
-// always grabbed the terminal handler after the auth middleware).
-export function captureRoutes(deps, registerFn = registerMessagesRoutes) {
-  const routes = new Map();
-  const register = (method) => (routePath, ...handlers) => {
-    routes.set(`${method} ${routePath}`, handlers[handlers.length - 1]);
-  };
-  const app = {
-    post: register('POST'),
-    get: register('GET'),
-    patch: register('PATCH'),
-    put: register('PUT'),
-    delete: register('DELETE'),
-    use() {},
-  };
-  registerFn(app, deps);
-  return routes;
-}
-
-// Express res stub capturing status/body.
-export function makeRes() {
-  const captured = { status: 200, body: null };
-  const res = {
-    setHeader() {},
-    status(code) { captured.status = code; return res; },
-    json(payload) { captured.body = payload; return res; },
-  };
-  return { res, captured };
-}
-
-// Dispatches into a captured handler and returns { status, body }.
-export async function invokeRoute(routes, method, routePath, { body = {}, headers = {}, query = {}, params = {}, socket = {} } = {}) {
-  const handler = routes.get(`${String(method).toUpperCase()} ${routePath}`);
-  assert.ok(handler, `${routePath} should be registered`);
-  const { res, captured } = makeRes();
-  await handler({ body, headers, query, params, socket }, res);
-  return captured;
-}
-
-// Registers once and returns an invoker for one POST route — for suites that
-// drive the same handler repeatedly against one database.
-export function postHandler(routePath, deps) {
-  const routes = captureRoutes(deps);
-  assert.ok(routes.has(`POST ${routePath}`), `${routePath} should be registered`);
-  return (body) => invokeRoute(routes, 'POST', routePath, { body });
-}
-
-// One-shot register + POST, the common form in the stub suites.
-export function invokePost(routePath, deps, body) {
-  return postHandler(routePath, deps)(body);
-}
-
-// The worker runner's `api(method, path, body)` against the captured handlers:
-// dispatch with a fixed header set (e.g. the bridge identity header the live
-// worker sends) and surface non-2xx as a rejection like the worker's HTTP
-// client does.
-export function makeApi(routes, { headers = {} } = {}) {
-  return async (method, routePath, body) => {
-    const { status, body: responseBody } = await invokeRoute(routes, method, routePath, { body: body || {}, headers });
-    if (status >= 400) {
-      throw new Error(`${method} ${routePath} -> ${status}: ${JSON.stringify(responseBody)}`);
-    }
-    return responseBody;
-  };
-}

package/server/services/fixtures/claude-auth-stub.sh

@@ -1,62 +0,0 @@
-#!/bin/sh
-# Stand-in for the `claude` CLI auth subcommands, injected through
-# COPILOT_WEB_RELAY_CLAUDE_AUTH_BIN so the auth service can be exercised without
-# touching the host's real Claude login.
-#
-# Mirrors the shapes observed on CLI 2.1.247:
-#   auth status --json -> one line of JSON
-#   auth login         -> browser notice, an OSC-8 + SGR wrapped authorize URL,
-#                         then `Paste code here if prompted > ` and a blocking read
-#   auth logout        -> removes the credentials file
-#
-# Fake credentials file path comes from CLAUDE_AUTH_STUB_CRED_FILE; "logged in"
-# means that file exists.
-
-CRED_FILE="${CLAUDE_AUTH_STUB_CRED_FILE:-}"
-AUTH_URL="${CLAUDE_AUTH_STUB_URL:-https://claude.com/oauth/authorize?code=true&client_id=stub-client&code_challenge=Xk3nQ7pLm2vB8sT1wY6zR0aC5dF9gH4jK7lN2oP3qS8&redirect_uri=https%3A%2F%2Fplatform.claude.com%2Foauth%2Fcode%2Fcallback}"
-
-command="$1 $2"
-
-case "$command" in
-  "auth status")
-    if [ -n "$CRED_FILE" ] && [ -f "$CRED_FILE" ]; then
-      printf '{"loggedIn":true,"authMethod":"claudeai","apiProvider":null,"email":"stub@example.com","orgId":"org_stub","orgName":"Stub Org","subscriptionType":"max"}\n'
-    else
-      printf '{"loggedIn":false,"authMethod":null,"apiProvider":null,"email":null,"orgId":null,"orgName":null,"subscriptionType":null}\n'
-    fi
-    exit 0
-    ;;
-  "auth login")
-    printf 'Opening browser to sign in…\n'
-    # OSC-8 hyperlink (target + visible label) wrapped in SGR colour codes, the
-    # exact shape the real CLI emits under a PTY.
-    printf 'If the browser did not open, visit: \033]8;;%s\033\\\033[4;34m%s\033[0m\033]8;;\033\\\n' "$AUTH_URL" "$AUTH_URL"
-    printf '\033[2mPaste code here if prompted > \033[0m'
-    if ! read -r submitted_code; then
-      printf '\nAborted.\n'
-      exit 1
-    fi
-    if [ "$submitted_code" = "goodcode" ]; then
-      if [ -n "$CRED_FILE" ]; then
-        # Deliberately short fake tokens: anything with 20+ characters after
-        # `sk-ant-` trips the secret scanner in server/test-hygiene.test.mjs.
-        printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-stub","refreshToken":"sk-ant-ort01-stub"}}\n' > "$CRED_FILE"
-      fi
-      printf '\nLogin successful. Logged in as stub@example.com\n'
-      exit 0
-    fi
-    printf '\nOAuth error: invalid_grant - the authorization code is invalid or has expired.\n' >&2
-    exit 1
-    ;;
-  "auth logout")
-    if [ -n "$CRED_FILE" ]; then
-      rm -f "$CRED_FILE"
-    fi
-    printf 'Logged out.\n'
-    exit 0
-    ;;
-  *)
-    printf 'claude-auth-stub: unsupported command: %s\n' "$*" >&2
-    exit 2
-    ;;
-esac

package/server/services/fixtures/cli-install-stub.sh

@@ -1,75 +0,0 @@
-#!/bin/sh
-# Stand-in for a vendor CLI installer, injected through
-# COPILOT_WEB_RELAY_CLI_INSTALL_COMMAND so the install flow can be exercised end
-# to end without ever fetching from x.ai / claude.ai or writing to the host's
-# real bin directories.
-#
-# The install service calls it as:  cli-install-stub.sh <provider> <action>
-# (both values come from the frozen descriptor table, never from a request
-# body). It prints installer-shaped progress, then writes a fake binary into
-# CLI_INSTALL_STUB_BIN_DIR — which the relay is pointed at through
-# COPILOT_WEB_RELAY_CLI_BIN_DIR — so the resolve -> bind -> broadcast chain runs
-# against something real.
-#
-#   CLI_INSTALL_STUB_BIN_DIR   where the fake binary lands (required)
-#   CLI_INSTALL_STUB_VERSION   version the fake binary reports (default 9.9.9)
-#   CLI_INSTALL_STUB_FAIL      non-empty -> print an error and exit 1
-#   CLI_INSTALL_STUB_SLEEP     seconds to stall mid-install (cancel/timeout tests)
-
-provider="$1"
-action="$2"
-bin_dir="${CLI_INSTALL_STUB_BIN_DIR:-}"
-version="${CLI_INSTALL_STUB_VERSION:-9.9.9}"
-
-printf 'Installing %s (%s)…\n' "$provider" "$action"
-printf 'Resolving latest release for linux-x86_64\n'
-
-if [ -n "${CLI_INSTALL_STUB_SLEEP:-}" ]; then
-  sleep "$CLI_INSTALL_STUB_SLEEP"
-fi
-
-if [ -n "${CLI_INSTALL_STUB_FAIL:-}" ]; then
-  printf 'error: download failed (stub)\n' >&2
-  exit 1
-fi
-
-if [ -z "$bin_dir" ]; then
-  printf 'cli-install-stub: CLI_INSTALL_STUB_BIN_DIR is not set\n' >&2
-  exit 2
-fi
-
-mkdir -p "$bin_dir"
-target="$bin_dir/$provider"
-
-# The fake binary answers exactly the probes cli-install-service runs: the
-# version banner in each descriptor's shape, `update --check --json` for Grok,
-# and `doctor` for Claude.
-cat > "$target" <<STUB
-#!/bin/sh
-case "\$1 \$2" in
-  "--version ")
-    case "$provider" in
-      grok)    printf 'grok %s (stubcommit) [stable]\n' "$version" ;;
-      claude)  printf '%s (Claude Code)\n' "$version" ;;
-      *)       printf '%s\n' "$version" ;;
-    esac
-    exit 0
-    ;;
-  "update --check")
-    printf '{"currentVersion":"%s","latestVersion":"%s","updateAvailable":false,"installer":"internal","channel":"stable","autoUpdate":null,"error":null}\n' "$version" "$version"
-    exit 0
-    ;;
-  "doctor ")
-    printf 'Running: native (%s)\n' "$version"
-    printf 'Path: %s\n' "$target"
-    printf 'Auto-updates: enabled\n'
-    exit 0
-    ;;
-esac
-printf 'cli-stub: unsupported command: %s\n' "\$*" >&2
-exit 2
-STUB
-chmod +x "$target"
-
-printf 'Installed %s %s to %s\n' "$provider" "$version" "$target"
-exit 0

package/server/services/fixtures/grok-stub.sh

@@ -1,86 +0,0 @@
-#!/bin/sh
-# Stand-in for the `grok` CLI, injected through GROK_CLI_COMMAND so the auth
-# service (and the CLI install/probe path) can be exercised without touching the
-# host's real Grok login.
-#
-# Mirrors the shapes probed live on Grok Build 1.0.13 (2026-08-31):
-#   --version            -> `grok 1.0.13 (5e9a58528b76)`
-#   update --check --json-> the machine-readable update payload
-#   login --device-auth  -> a device URL carrying the code, the code again on its
-#                           own line, one grey (SGR 90) warning line, then
-#                           `Waiting for authorization...` and a poll loop. No
-#                           TTY, no stdin read: the real CLI ignores stdin and
-#                           exits by itself once the browser authorises.
-#   logout               -> removes the fake auth.json
-#
-# The poll loop stands in for the browser: it exits 0 when GROK_STUB_SUCCESS_SENTINEL
-# appears (writing the fake auth store) and non-zero when GROK_STUB_FAILURE_SENTINEL
-# does. "Logged in" means GROK_STUB_AUTH_FILE exists, matching what
-# readGrokCliAuthKey() actually looks at.
-
-set -u
-
-VERSION="${GROK_STUB_VERSION:-1.0.13}"
-AUTH_FILE="${GROK_STUB_AUTH_FILE:-}"
-DEVICE_CODE="${GROK_STUB_DEVICE_CODE:-D7SV-M4TR}"
-DEVICE_URL="${GROK_STUB_DEVICE_URL:-https://accounts.x.ai/oauth2/device?user_code=${DEVICE_CODE}}"
-SUCCESS_SENTINEL="${GROK_STUB_SUCCESS_SENTINEL:-}"
-FAILURE_SENTINEL="${GROK_STUB_FAILURE_SENTINEL:-}"
-TIMEOUT_SECONDS="${GROK_STUB_TIMEOUT_SECONDS:-60}"
-POLL_SECONDS="${GROK_STUB_POLL_SECONDS:-0.2}"
-UPDATE_AVAILABLE="${GROK_STUB_UPDATE_AVAILABLE:-false}"
-LATEST_VERSION="${GROK_STUB_LATEST_VERSION:-$VERSION}"
-
-command="${1:-} ${2:-}"
-
-case "$command" in
-  "--version "*|"--version")
-    printf 'grok %s (5e9a58528b76)\n' "$VERSION"
-    exit 0
-    ;;
-  "update --check")
-    printf '{"currentVersion":"%s","latestVersion":"%s","updateAvailable":%s,"installer":"internal","channel":"stable","autoUpdate":null,"error":null}\n' \
-      "$VERSION" "$LATEST_VERSION" "$UPDATE_AVAILABLE"
-    exit 0
-    ;;
-  "login --device-auth")
-    # Byte-for-byte the banner the real CLI printed under piped stdio, including
-    # the blank lines and the one grey warning line — the escape-stripping in the
-    # URL/code scrape is tested against exactly this.
-    printf '\nTo sign in, open this URL in your browser:\n\n  %s\n\n' "$DEVICE_URL"
-    printf '  (Could not open browser automatically — open the URL above manually.)\n\n'
-    printf 'Confirm this code in your browser:\n\n  %s\n\n' "$DEVICE_CODE"
-    printf '\033[90mOnly continue with a code you requested. Do not share it with anyone.\033[0m\n\n'
-    printf 'Waiting for authorization...\n'
-    deadline=$(( $(date +%s) + TIMEOUT_SECONDS ))
-    while [ "$(date +%s)" -le "$deadline" ]; do
-      if [ -n "$FAILURE_SENTINEL" ] && [ -f "$FAILURE_SENTINEL" ]; then
-        printf '\nAuthorization failed: the device code expired.\n' >&2
-        exit 1
-      fi
-      if [ -n "$SUCCESS_SENTINEL" ] && [ -f "$SUCCESS_SENTINEL" ]; then
-        if [ -n "$AUTH_FILE" ]; then
-          # Deliberately short fake key: anything 32+ characters long trips the
-          # secret scanner in server/test-hygiene.test.mjs.
-          printf '{"https://auth.x.ai::stub":{"key":"grok-stub-key","create_time":"2026-08-31T00:00:00Z","expires_at":"2099-01-01T00:00:00Z"}}\n' > "$AUTH_FILE"
-        fi
-        printf '\nSigned in.\n'
-        exit 0
-      fi
-      sleep "$POLL_SECONDS"
-    done
-    printf '\nTimed out waiting for authorization.\n' >&2
-    exit 1
-    ;;
-  "logout "*|"logout")
-    if [ -n "$AUTH_FILE" ]; then
-      rm -f "$AUTH_FILE"
-    fi
-    printf 'Signed out.\n'
-    exit 0
-    ;;
-  *)
-    printf 'grok-stub: unsupported command: %s\n' "$*" >&2
-    exit 2
-    ;;
-esac