@oar-sh/oar 0.9.2 → 0.9.3

package/server/routes/messages-routes-test-harness.mjs

@@ -1,111 +0,0 @@
-// Shared scaffolding for the messages-routes test suites and the claude-worker
-// routes-integration test: the route-capturing fake express app, the res stub,
-// and the baseline deps stand-ins.
-//
-// server-runtime.mjs boots a live server on import, so the deps it injects are
-// reproduced here rather than imported. makeRouteDeps carries only the minimal
-// working defaults every suite shares; each suite supplies its own db/stmts —
-// the stub suites keep their hand-rolled fakes and prepared-statement mirrors,
-// the integration test passes a real better-sqlite3 database and the real
-// repositories. The harness owns the shape, the suite owns the fakes.
-import assert from 'node:assert/strict';
-
-import { registerMessagesRoutes } from './messages-routes.mjs';
-
-// Baseline deps: enough for registerMessagesRoutes to register every route
-// without touching a real server. Registration eagerly prepares statements for
-// many routes the suites never exercise, against tables they do not create —
-// the db stub absorbs those; suites that need real statement/transaction
-// semantics override db/stmts.
-export function makeRouteDeps(overrides = {}) {
-  return {
-    auth: (_req, _res, next) => next(),
-    db: { prepare: () => ({ run() {}, get: () => null, all: () => [] }) },
-    stmts: {},
-    MAX_UPLOAD_BYTES: 1024 * 1024,
-    touchCli: () => {},
-    ensureSessionId: () => 'session-1',
-    normalizeRelayMode: (value) => String(value || '').trim().toLowerCase() || null,
-    DEFAULT_RELAY_MODE: 'default',
-    DEFAULT_MODEL: 'gpt-5',
-    normalizeAttachments: () => [],
-    collectReferenceAttachmentsFromText: () => ({ attachments: [] }),
-    mergeMessageAttachments: (left, right) => [...(left || []), ...(right || [])],
-    resolveRequestedModel: (model) => ({
-      ok: false,
-      error: `Model "${String(model || '')}" is not supported`,
-      available: [],
-    }),
-    getOpenAIProviderSettings: () => ({ configured: false, enabled: false, model: '', models: [] }),
-    getCursorProviderSettings: () => ({ enabled: false, model: '', models: [] }),
-    featureFlags: {},
-    ...overrides,
-  };
-}
-
-// Registers the routes on a fake express app and returns the captured handlers
-// as a Map keyed 'METHOD /path' (last handler wins, matching how the suites
-// always grabbed the terminal handler after the auth middleware).
-export function captureRoutes(deps, registerFn = registerMessagesRoutes) {
-  const routes = new Map();
-  const register = (method) => (routePath, ...handlers) => {
-    routes.set(`${method} ${routePath}`, handlers[handlers.length - 1]);
-  };
-  const app = {
-    post: register('POST'),
-    get: register('GET'),
-    patch: register('PATCH'),
-    put: register('PUT'),
-    delete: register('DELETE'),
-    use() {},
-  };
-  registerFn(app, deps);
-  return routes;
-}
-
-// Express res stub capturing status/body.
-export function makeRes() {
-  const captured = { status: 200, body: null };
-  const res = {
-    setHeader() {},
-    status(code) { captured.status = code; return res; },
-    json(payload) { captured.body = payload; return res; },
-  };
-  return { res, captured };
-}
-
-// Dispatches into a captured handler and returns { status, body }.
-export async function invokeRoute(routes, method, routePath, { body = {}, headers = {}, query = {}, params = {}, socket = {} } = {}) {
-  const handler = routes.get(`${String(method).toUpperCase()} ${routePath}`);
-  assert.ok(handler, `${routePath} should be registered`);
-  const { res, captured } = makeRes();
-  await handler({ body, headers, query, params, socket }, res);
-  return captured;
-}
-
-// Registers once and returns an invoker for one POST route — for suites that
-// drive the same handler repeatedly against one database.
-export function postHandler(routePath, deps) {
-  const routes = captureRoutes(deps);
-  assert.ok(routes.has(`POST ${routePath}`), `${routePath} should be registered`);
-  return (body) => invokeRoute(routes, 'POST', routePath, { body });
-}
-
-// One-shot register + POST, the common form in the stub suites.
-export function invokePost(routePath, deps, body) {
-  return postHandler(routePath, deps)(body);
-}
-
-// The worker runner's `api(method, path, body)` against the captured handlers:
-// dispatch with a fixed header set (e.g. the bridge identity header the live
-// worker sends) and surface non-2xx as a rejection like the worker's HTTP
-// client does.
-export function makeApi(routes, { headers = {} } = {}) {
-  return async (method, routePath, body) => {
-    const { status, body: responseBody } = await invokeRoute(routes, method, routePath, { body: body || {}, headers });
-    if (status >= 400) {
-      throw new Error(`${method} ${routePath} -> ${status}: ${JSON.stringify(responseBody)}`);
-    }
-    return responseBody;
-  };
-}

package/server/services/fixtures/claude-auth-stub.cmd

@@ -1 +0,0 @@
-@node "%~dp0claude-auth-stub.mjs" %*

package/server/services/fixtures/claude-auth-stub.mjs

@@ -1,76 +0,0 @@
-// Stand-in for the `claude` CLI auth subcommands, injected through
-// COPILOT_WEB_RELAY_CLAUDE_AUTH_BIN so the auth service can be exercised without
-// touching the host's real Claude login.
-//
-// Node port of claude-auth-stub.sh so Windows can run it too; the platform
-// wrappers next to it (`claude-auth-stub.sh`, `claude-auth-stub.cmd`) just exec
-// this file.
-//
-// Mirrors the shapes observed on CLI 2.1.247:
-//   auth status --json -> one line of JSON
-//   auth login         -> browser notice, an OSC-8 + SGR wrapped authorize URL,
-//                         then `Paste code here if prompted > ` and a blocking read
-//   auth logout        -> removes the credentials file
-//
-// Fake credentials file path comes from CLAUDE_AUTH_STUB_CRED_FILE; "logged in"
-// means that file exists.
-
-import fs from 'node:fs';
-import process from 'node:process';
-import readline from 'node:readline';
-
-const CRED_FILE = process.env.CLAUDE_AUTH_STUB_CRED_FILE || '';
-const AUTH_URL = process.env.CLAUDE_AUTH_STUB_URL
-  || 'https://claude.com/oauth/authorize?code=true&client_id=stub-client&code_challenge=Xk3nQ7pLm2vB8sT1wY6zR0aC5dF9gH4jK7lN2oP3qS8&redirect_uri=https%3A%2F%2Fplatform.claude.com%2Foauth%2Fcode%2Fcallback';
-
-const [first = '', second = ''] = process.argv.slice(2);
-const command = `${first} ${second}`;
-const out = (text) => process.stdout.write(text);
-const err = (text) => process.stderr.write(text);
-
-if (command === 'auth status') {
-  if (CRED_FILE && fs.existsSync(CRED_FILE)) {
-    out('{"loggedIn":true,"authMethod":"claudeai","apiProvider":null,"email":"stub@example.com","orgId":"org_stub","orgName":"Stub Org","subscriptionType":"max"}\n');
-  } else {
-    out('{"loggedIn":false,"authMethod":null,"apiProvider":null,"email":null,"orgId":null,"orgName":null,"subscriptionType":null}\n');
-  }
-  process.exit(0);
-} else if (command === 'auth login') {
-  out('Opening browser to sign in…\n');
-  // OSC-8 hyperlink (target + visible label) wrapped in SGR colour codes, the
-  // exact shape the real CLI emits under a PTY.
-  out(`If the browser did not open, visit: \x1b]8;;${AUTH_URL}\x1b\\\x1b[4;34m${AUTH_URL}\x1b[0m\x1b]8;;\x1b\\\n`);
-  out('\x1b[2mPaste code here if prompted > \x1b[0m');
-  const rl = readline.createInterface({ input: process.stdin });
-  let submitted = null;
-  rl.on('line', (line) => {
-    submitted = line;
-    rl.close();
-  });
-  rl.on('close', () => {
-    if (submitted === null) {
-      out('\nAborted.\n');
-      process.exit(1);
-    }
-    if (submitted === 'goodcode') {
-      if (CRED_FILE) {
-        // Deliberately short fake tokens: anything with 20+ characters after
-        // `sk-ant-` trips the secret scanner in server/test-hygiene.test.mjs.
-        fs.writeFileSync(CRED_FILE, '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-stub","refreshToken":"sk-ant-ort01-stub"}}\n');
-      }
-      out('\nLogin successful. Logged in as stub@example.com\n');
-      process.exit(0);
-    }
-    err('\nOAuth error: invalid_grant - the authorization code is invalid or has expired.\n');
-    process.exit(1);
-  });
-} else if (command === 'auth logout') {
-  if (CRED_FILE) {
-    fs.rmSync(CRED_FILE, { force: true });
-  }
-  out('Logged out.\n');
-  process.exit(0);
-} else {
-  err(`claude-auth-stub: unsupported command: ${process.argv.slice(2).join(' ')}\n`);
-  process.exit(2);
-}

package/server/services/fixtures/claude-auth-stub.sh

@@ -1,4 +0,0 @@
-#!/bin/sh
-# POSIX launcher for claude-auth-stub.mjs (the logic lives there;
-# claude-auth-stub.cmd is the Windows twin).
-exec node "$(dirname "$0")/claude-auth-stub.mjs" "$@"

package/server/services/fixtures/cli-install-stub.cmd

@@ -1 +0,0 @@
-@node "%~dp0cli-install-stub.mjs" %*

package/server/services/fixtures/cli-install-stub.mjs

@@ -1,98 +0,0 @@
-// Stand-in for a vendor CLI installer, injected through
-// COPILOT_WEB_RELAY_CLI_INSTALL_COMMAND so the install flow can be exercised end
-// to end without ever fetching from x.ai / claude.ai or writing to the host's
-// real bin directories.
-//
-// Node port of cli-install-stub.sh so Windows can run it too; the platform
-// wrappers next to it (`cli-install-stub.sh`, `cli-install-stub.cmd`) just exec
-// this file.
-//
-// The install service calls it as:  cli-install-stub <provider> <action>
-// (both values come from the frozen descriptor table, never from a request
-// body). It prints installer-shaped progress, then writes a fake binary into
-// CLI_INSTALL_STUB_BIN_DIR — which the relay is pointed at through
-// COPILOT_WEB_RELAY_CLI_BIN_DIR — so the resolve -> bind -> broadcast chain runs
-// against something real. The fake binary is itself a Node script behind a
-// platform launcher: a bare `#!/bin/sh` file on POSIX, a `<provider>.cmd` shim
-// on Windows (which also exercises the services' batch-launcher spawn path,
-// the same shape a real npm-installed CLI has there).
-//
-//   CLI_INSTALL_STUB_BIN_DIR   where the fake binary lands (required)
-//   CLI_INSTALL_STUB_VERSION   version the fake binary reports (default 9.9.9)
-//   CLI_INSTALL_STUB_FAIL      non-empty -> print an error and exit 1
-//   CLI_INSTALL_STUB_SLEEP     seconds to stall mid-install (cancel/timeout tests)
-
-import fs from 'node:fs';
-import path from 'node:path';
-import process from 'node:process';
-
-const [provider = '', action = ''] = process.argv.slice(2);
-const binDir = process.env.CLI_INSTALL_STUB_BIN_DIR || '';
-const version = process.env.CLI_INSTALL_STUB_VERSION || '9.9.9';
-const out = (text) => process.stdout.write(text);
-const err = (text) => process.stderr.write(text);
-
-out(`Installing ${provider} (${action})…\n`);
-out('Resolving latest release for linux-x86_64\n');
-
-const stallSeconds = Number(process.env.CLI_INSTALL_STUB_SLEEP || '0');
-if (stallSeconds > 0) {
-  await new Promise((resolve) => setTimeout(resolve, stallSeconds * 1000));
-}
-
-if (process.env.CLI_INSTALL_STUB_FAIL) {
-  err('error: download failed (stub)\n');
-  process.exit(1);
-}
-
-if (!binDir) {
-  err('cli-install-stub: CLI_INSTALL_STUB_BIN_DIR is not set\n');
-  process.exit(2);
-}
-
-fs.mkdirSync(binDir, { recursive: true });
-
-// The fake binary answers exactly the probes cli-install-service runs: the
-// version banner in each descriptor's shape, `update --check --json` for Grok,
-// and `doctor` for Claude. The answering logic is one Node script; only the
-// launcher in front of it differs per platform.
-// host-platform: the launcher must match the platform the relay under test
-// runs on — an extensionless shebang file on POSIX, a .cmd shim on Windows.
-const windows = process.platform === 'win32';
-const target = path.join(binDir, windows ? `${provider}.cmd` : provider);
-
-const implPath = path.join(binDir, `${provider}-fake-cli.mjs`);
-const impl = `import process from 'node:process';
-const [first = '', second = ''] = process.argv.slice(2);
-const command = \`\${first} \${second}\`.trimEnd();
-if (command === '--version') {
-  const banners = {
-    grok: 'grok ${version} (stubcommit) [stable]\\n',
-    claude: '${version} (Claude Code)\\n',
-  };
-  process.stdout.write(banners['${provider}'] || '${version}\\n');
-  process.exit(0);
-}
-if (command === 'update --check') {
-  process.stdout.write('{"currentVersion":"${version}","latestVersion":"${version}","updateAvailable":false,"installer":"internal","channel":"stable","autoUpdate":null,"error":null}\\n');
-  process.exit(0);
-}
-if (command === 'doctor') {
-  process.stdout.write('Running: native (${version})\\n');
-  process.stdout.write('Path: ${JSON.stringify(target).slice(1, -1)}\\n');
-  process.stdout.write('Auto-updates: enabled\\n');
-  process.exit(0);
-}
-process.stderr.write(\`cli-stub: unsupported command: \${process.argv.slice(2).join(' ')}\\n\`);
-process.exit(2);
-`;
-fs.writeFileSync(implPath, impl);
-if (windows) {
-  fs.writeFileSync(target, `@node "%~dp0${provider}-fake-cli.mjs" %*\r\n`);
-} else {
-  fs.writeFileSync(target, `#!/bin/sh\nexec node "$(dirname "$0")/${provider}-fake-cli.mjs" "$@"\n`);
-  fs.chmodSync(target, 0o755);
-}
-
-out(`Installed ${provider} ${version} to ${target}\n`);
-process.exit(0);

package/server/services/fixtures/cli-install-stub.sh

@@ -1,4 +0,0 @@
-#!/bin/sh
-# POSIX launcher for cli-install-stub.mjs (the logic lives there;
-# cli-install-stub.cmd is the Windows twin).
-exec node "$(dirname "$0")/cli-install-stub.mjs" "$@"

package/server/services/fixtures/grok-stub.cmd

@@ -1 +0,0 @@
-@node "%~dp0grok-stub.mjs" %*

package/server/services/fixtures/grok-stub.mjs

@@ -1,89 +0,0 @@
-// Stand-in for the `grok` CLI, injected through GROK_CLI_COMMAND so the auth
-// service (and the CLI install/probe path) can be exercised without touching the
-// host's real Grok login.
-//
-// Node port of grok-stub.sh so Windows can run it too (no shebang support, .sh
-// not in PATHEXT); the platform wrappers next to it (`grok-stub.sh`,
-// `grok-stub.cmd`) just exec this file. Batch was rejected as the port target
-// because the poll interval is sub-second and `timeout /t` can't sleep below 1s.
-//
-// Mirrors the shapes probed live on Grok Build 1.0.13 (2026-08-31):
-//   --version            -> `grok 1.0.13 (5e9a58528b76)`
-//   update --check --json-> the machine-readable update payload
-//   login --device-auth  -> a device URL carrying the code, the code again on its
-//                           own line, one grey (SGR 90) warning line, then
-//                           `Waiting for authorization...` and a poll loop. No
-//                           TTY, no stdin read: the real CLI ignores stdin and
-//                           exits by itself once the browser authorises.
-//   logout               -> removes the fake auth.json
-//
-// The poll loop stands in for the browser: it exits 0 when GROK_STUB_SUCCESS_SENTINEL
-// appears (writing the fake auth store) and non-zero when GROK_STUB_FAILURE_SENTINEL
-// does. "Logged in" means GROK_STUB_AUTH_FILE exists, matching what
-// readGrokCliAuthKey() actually looks at.
-
-import fs from 'node:fs';
-import process from 'node:process';
-
-const env = process.env;
-const VERSION = env.GROK_STUB_VERSION || '1.0.13';
-const AUTH_FILE = env.GROK_STUB_AUTH_FILE || '';
-const DEVICE_CODE = env.GROK_STUB_DEVICE_CODE || 'D7SV-M4TR';
-const DEVICE_URL = env.GROK_STUB_DEVICE_URL
-  || `https://accounts.x.ai/oauth2/device?user_code=${DEVICE_CODE}`;
-const SUCCESS_SENTINEL = env.GROK_STUB_SUCCESS_SENTINEL || '';
-const FAILURE_SENTINEL = env.GROK_STUB_FAILURE_SENTINEL || '';
-const TIMEOUT_SECONDS = Number(env.GROK_STUB_TIMEOUT_SECONDS || '60');
-const POLL_SECONDS = Number(env.GROK_STUB_POLL_SECONDS || '0.2');
-const UPDATE_AVAILABLE = env.GROK_STUB_UPDATE_AVAILABLE || 'false';
-const LATEST_VERSION = env.GROK_STUB_LATEST_VERSION || VERSION;
-
-const [first = '', second = ''] = process.argv.slice(2);
-const out = (text) => process.stdout.write(text);
-const err = (text) => process.stderr.write(text);
-const sleep = (seconds) => new Promise((resolve) => setTimeout(resolve, seconds * 1000));
-
-if (first === '--version') {
-  out(`grok ${VERSION} (5e9a58528b76)\n`);
-  process.exit(0);
-} else if (first === 'update' && second === '--check') {
-  out(`{"currentVersion":"${VERSION}","latestVersion":"${LATEST_VERSION}","updateAvailable":${UPDATE_AVAILABLE},"installer":"internal","channel":"stable","autoUpdate":null,"error":null}\n`);
-  process.exit(0);
-} else if (first === 'login' && second === '--device-auth') {
-  // Byte-for-byte the banner the real CLI printed under piped stdio, including
-  // the blank lines and the one grey warning line — the escape-stripping in the
-  // URL/code scrape is tested against exactly this.
-  out(`\nTo sign in, open this URL in your browser:\n\n  ${DEVICE_URL}\n\n`);
-  out('  (Could not open browser automatically — open the URL above manually.)\n\n');
-  out(`Confirm this code in your browser:\n\n  ${DEVICE_CODE}\n\n`);
-  out('\x1b[90mOnly continue with a code you requested. Do not share it with anyone.\x1b[0m\n\n');
-  out('Waiting for authorization...\n');
-  const deadline = Date.now() + TIMEOUT_SECONDS * 1000;
-  while (Date.now() <= deadline) {
-    if (FAILURE_SENTINEL && fs.existsSync(FAILURE_SENTINEL)) {
-      err('\nAuthorization failed: the device code expired.\n');
-      process.exit(1);
-    }
-    if (SUCCESS_SENTINEL && fs.existsSync(SUCCESS_SENTINEL)) {
-      if (AUTH_FILE) {
-        // Deliberately short fake key: anything 32+ characters long trips the
-        // secret scanner in server/test-hygiene.test.mjs.
-        fs.writeFileSync(AUTH_FILE, '{"https://auth.x.ai::stub":{"key":"grok-stub-key","create_time":"2026-08-31T00:00:00Z","expires_at":"2099-01-01T00:00:00Z"}}\n');
-      }
-      out('\nSigned in.\n');
-      process.exit(0);
-    }
-    await sleep(POLL_SECONDS);
-  }
-  err('\nTimed out waiting for authorization.\n');
-  process.exit(1);
-} else if (first === 'logout') {
-  if (AUTH_FILE) {
-    fs.rmSync(AUTH_FILE, { force: true });
-  }
-  out('Signed out.\n');
-  process.exit(0);
-} else {
-  err(`grok-stub: unsupported command: ${process.argv.slice(2).join(' ')}\n`);
-  process.exit(2);
-}

package/server/services/fixtures/grok-stub.sh

@@ -1,4 +0,0 @@
-#!/bin/sh
-# POSIX launcher for grok-stub.mjs (the logic lives there; grok-stub.cmd is the
-# Windows twin).
-exec node "$(dirname "$0")/grok-stub.mjs" "$@"