@openparachute/agent 0.2.2 → 0.2.3-rc.3

package/src/def-vaults.test.ts

@@ -1,136 +0,0 @@
-/**
- * Unit tests for the def-vault config (design 2026-06-17-vault-native-agents,
- * Phase 4a "Commit 3"). Sandboxed to a throwaway state dir (NEVER the operator's
- * ~/.parachute); the mint is driven by an injected fetch — deterministic, no real hub.
- */
-
-import { describe, test, expect, afterEach } from "bun:test";
-import { mkdtempSync, rmSync, existsSync, readFileSync, writeFileSync, statSync } from "fs";
-import { join } from "path";
-import { tmpdir } from "os";
-import {
-  readDefVaultsFile,
-  writeDefVaultsFile,
-  defVaultsFilePath,
-  resolveDefVaults,
-  DEFAULT_DEF_VAULT_NAME,
-} from "./def-vaults.ts";
-
-const dirs: string[] = [];
-function freshDir(): string {
-  const d = mkdtempSync(join(tmpdir(), "agent-defvaults-"));
-  dirs.push(d);
-  return d;
-}
-afterEach(() => {
-  for (const d of dirs.splice(0)) rmSync(d, { recursive: true, force: true });
-});
-
-/** A fake hub mint endpoint returning a scripted token. */
-function fakeMint(token: string): { fetchFn: typeof fetch; calls: Array<Record<string, unknown>> } {
-  const calls: Array<Record<string, unknown>> = [];
-  const fetchFn = (async (_url: string | URL | Request, init?: RequestInit) => {
-    calls.push(JSON.parse(String(init?.body ?? "{}")));
-    return new Response(JSON.stringify({ token, jti: "j", expires_at: "", scope: "vault:default:write" }), {
-      status: 200,
-      headers: { "content-type": "application/json" },
-    });
-  }) as typeof fetch;
-  return { fetchFn, calls };
-}
-
-describe("agent-vaults.json read/write", () => {
-  test("readDefVaultsFile returns null when absent", () => {
-    expect(readDefVaultsFile(freshDir())).toBeNull();
-  });
-
-  test("write then read round-trips; file is 0600", () => {
-    const dir = freshDir();
-    writeDefVaultsFile({ vaults: [{ vault: "default", vaultUrl: "http://x", token: "t" }] }, dir);
-    const back = readDefVaultsFile(dir);
-    expect(back?.vaults).toEqual([{ vault: "default", vaultUrl: "http://x", token: "t" }]);
-    const mode = statSync(defVaultsFilePath(dir)).mode & 0o777;
-    expect(mode).toBe(0o600);
-  });
-
-  test("a malformed file throws (operator error, not silently defaulted)", () => {
-    const dir = freshDir();
-    writeFileSync(defVaultsFilePath(dir), JSON.stringify({ nope: true }));
-    expect(() => readDefVaultsFile(dir)).toThrow(/"vaults" array/);
-  });
-
-  test("an entry missing vault throws", () => {
-    const dir = freshDir();
-    writeFileSync(defVaultsFilePath(dir), JSON.stringify({ vaults: [{ token: "t" }] }));
-    expect(() => readDefVaultsFile(dir)).toThrow(/non-empty "vault"/);
-  });
-});
-
-describe("resolveDefVaults", () => {
-  test("explicit agent-vaults.json wins (multi-vault, verbatim tokens, no mint)", async () => {
-    const dir = freshDir();
-    writeDefVaultsFile(
-      {
-        vaults: [
-          { vault: "default", vaultUrl: "http://127.0.0.1:1940", token: "tok-default" },
-          { vault: "research", vaultUrl: "http://127.0.0.1:1940", token: "tok-research" },
-        ],
-      },
-      dir,
-    );
-    const { fetchFn, calls } = fakeMint("SHOULD-NOT-BE-USED");
-    const bindings = await resolveDefVaults({ stateDir: dir, managerBearer: "op", fetchFn });
-    expect(bindings.map((b) => b.vault)).toEqual(["default", "research"]);
-    expect(bindings[0]!.token).toBe("tok-default");
-    expect(bindings[1]!.token).toBe("tok-research");
-    // No mint when the file carries tokens.
-    expect(calls).toHaveLength(0);
-  });
-
-  test("no file + a manager bearer → mints a default vault:default:write token + persists", async () => {
-    const dir = freshDir();
-    const { fetchFn, calls } = fakeMint("minted-token");
-    const bindings = await resolveDefVaults({
-      stateDir: dir,
-      hubOrigin: "http://127.0.0.1:1939",
-      managerBearer: "operator-bearer",
-      fetchFn,
-    });
-    expect(bindings).toHaveLength(1);
-    expect(bindings[0]).toMatchObject({ vault: DEFAULT_DEF_VAULT_NAME, token: "minted-token" });
-    // Minted with the vault:default:write scope, attenuated to the operator bearer.
-    expect(calls[0]!.scope).toBe("vault:default:write");
-    // Persisted so a restart reuses it (no re-mint).
-    expect(existsSync(defVaultsFilePath(dir))).toBe(true);
-    const persisted = readDefVaultsFile(dir);
-    expect(persisted?.vaults[0]!.token).toBe("minted-token");
-  });
-
-  test("persist:false → mints but does NOT write the file", async () => {
-    const dir = freshDir();
-    const { fetchFn } = fakeMint("minted");
-    const bindings = await resolveDefVaults({
-      stateDir: dir,
-      managerBearer: "op",
-      fetchFn,
-      persist: false,
-    });
-    expect(bindings).toHaveLength(1);
-    expect(existsSync(defVaultsFilePath(dir))).toBe(false);
-  });
-
-  test("no file + no manager bearer → NO bindings (vault-native path idle; channels.json unaffected)", async () => {
-    const bindings = await resolveDefVaults({ stateDir: freshDir(), managerBearer: null });
-    expect(bindings).toEqual([]);
-  });
-
-  test("a mint failure → no bindings (best-effort; boot is not crashed)", async () => {
-    const dir = freshDir();
-    const fetchFn = (async () =>
-      new Response(JSON.stringify({ error: "invalid_scope" }), { status: 400 })) as unknown as typeof fetch;
-    const bindings = await resolveDefVaults({ stateDir: dir, managerBearer: "op", fetchFn });
-    expect(bindings).toEqual([]);
-    // Nothing persisted on a failed mint.
-    expect(existsSync(defVaultsFilePath(dir))).toBe(false);
-  });
-});

package/src/delivery-state.test.ts

@@ -1,110 +0,0 @@
-/**
- * DeliveryState tests — the per-channel high-water-mark that gates backlog replay.
- *
- * Covered:
- *  - monotonic advance (never rewinds; reports whether it moved);
- *  - default-to-bootTime for an unknown channel (so a first connect never replays
- *    ancient history);
- *  - persist + reload across a simulated restart (a new instance reads the file);
- *  - blank-ts advance is a no-op (we never mark to an empty ts).
- *
- * Each test points the store at a throwaway temp dir, so there's no shared global
- * state and no touch of the real `~/.parachute/agent/`.
- */
-import { describe, test, expect, beforeEach, afterEach } from "bun:test";
-import { mkdtempSync, rmSync, existsSync, readFileSync, writeFileSync } from "fs";
-import { join } from "path";
-import { tmpdir } from "os";
-import { DeliveryState } from "./delivery-state.ts";
-
-let dir: string;
-beforeEach(() => {
-  dir = mkdtempSync(join(tmpdir(), "channel-delivery-"));
-});
-afterEach(() => {
-  rmSync(dir, { recursive: true, force: true });
-});
-
-describe("getLastDelivered default", () => {
-  test("an unknown channel returns the boot-time default mark, not epoch", () => {
-    const boot = "2026-06-16T12:00:00.000Z";
-    const ds = new DeliveryState({ stateDir: dir, defaultMark: boot });
-    expect(ds.getLastDelivered("never-seen")).toBe(boot);
-  });
-
-  test("defaultMark defaults to ~now when omitted", () => {
-    const before = Date.now();
-    const ds = new DeliveryState({ stateDir: dir });
-    const mark = Date.parse(ds.getLastDelivered("x"));
-    const after = Date.now();
-    expect(mark).toBeGreaterThanOrEqual(before);
-    expect(mark).toBeLessThanOrEqual(after + 1000);
-  });
-});
-
-describe("advance is monotonic", () => {
-  test("moves forward + reports true; a stale/equal ts is a no-op reporting false", () => {
-    const ds = new DeliveryState({ stateDir: dir, defaultMark: "2026-01-01T00:00:00.000Z" });
-    expect(ds.advance("c", "2026-06-16T10:00:00.000Z")).toBe(true);
-    expect(ds.getLastDelivered("c")).toBe("2026-06-16T10:00:00.000Z");
-
-    // An OLDER ts must not rewind the mark.
-    expect(ds.advance("c", "2026-06-16T09:00:00.000Z")).toBe(false);
-    expect(ds.getLastDelivered("c")).toBe("2026-06-16T10:00:00.000Z");
-
-    // The SAME ts is also a no-op (strictly-greater advance).
-    expect(ds.advance("c", "2026-06-16T10:00:00.000Z")).toBe(false);
-    expect(ds.getLastDelivered("c")).toBe("2026-06-16T10:00:00.000Z");
-
-    // A NEWER ts advances again.
-    expect(ds.advance("c", "2026-06-16T11:00:00.000Z")).toBe(true);
-    expect(ds.getLastDelivered("c")).toBe("2026-06-16T11:00:00.000Z");
-  });
-
-  test("a blank ts never advances the mark", () => {
-    const ds = new DeliveryState({ stateDir: dir, defaultMark: "2026-01-01T00:00:00.000Z" });
-    expect(ds.advance("c", "")).toBe(false);
-    expect(ds.getLastDelivered("c")).toBe("2026-01-01T00:00:00.000Z");
-  });
-
-  test("per-channel marks are independent", () => {
-    const ds = new DeliveryState({ stateDir: dir, defaultMark: "2026-01-01T00:00:00.000Z" });
-    ds.advance("a", "2026-06-16T10:00:00.000Z");
-    expect(ds.getLastDelivered("a")).toBe("2026-06-16T10:00:00.000Z");
-    // b is untouched — still the default.
-    expect(ds.getLastDelivered("b")).toBe("2026-01-01T00:00:00.000Z");
-  });
-});
-
-describe("persist + reload (simulated restart)", () => {
-  test("a fresh instance reads the persisted marks (the restart case)", () => {
-    const ds1 = new DeliveryState({ stateDir: dir, defaultMark: "2026-01-01T00:00:00.000Z" });
-    ds1.advance("eng", "2026-06-16T10:00:00.000Z");
-    ds1.advance("ops", "2026-06-16T11:00:00.000Z");
-    expect(existsSync(join(dir, "delivery-state.json"))).toBe(true);
-
-    // Simulate a daemon restart: a brand-new instance with a LATER boot default.
-    // The persisted per-channel marks must win over the new default — that's what
-    // makes the replay-the-gap behavior work across a bounce.
-    const ds2 = new DeliveryState({ stateDir: dir, defaultMark: "2026-06-16T12:00:00.000Z" });
-    expect(ds2.getLastDelivered("eng")).toBe("2026-06-16T10:00:00.000Z");
-    expect(ds2.getLastDelivered("ops")).toBe("2026-06-16T11:00:00.000Z");
-    // A channel with no persisted mark still falls back to the new boot default.
-    expect(ds2.getLastDelivered("brand-new")).toBe("2026-06-16T12:00:00.000Z");
-  });
-
-  test("the persisted file is valid JSON of channel→ts", () => {
-    const ds = new DeliveryState({ stateDir: dir, defaultMark: "2026-01-01T00:00:00.000Z" });
-    ds.advance("eng", "2026-06-16T10:00:00.000Z");
-    const onDisk = JSON.parse(readFileSync(join(dir, "delivery-state.json"), "utf8"));
-    expect(onDisk).toEqual({ eng: "2026-06-16T10:00:00.000Z" });
-  });
-
-  test("a corrupt file is tolerated — starts empty, the default covers unknowns", () => {
-    writeFileSync(join(dir, "delivery-state.json"), "{ not json");
-    const ds = new DeliveryState({ stateDir: dir, defaultMark: "2026-06-16T12:00:00.000Z" });
-    expect(ds.getLastDelivered("eng")).toBe("2026-06-16T12:00:00.000Z");
-    // Still usable: advance + persist overwrites the corrupt file.
-    expect(ds.advance("eng", "2026-06-16T13:00:00.000Z")).toBe(true);
-  });
-});

package/src/effective-env.test.ts

@@ -1,114 +0,0 @@
-/**
- * Unit tests for the PURE effective-env composition (effective-env.ts) — the
- * precedence/overridden logic + the no-material grant-name derivation, isolated from
- * the daemon route + any I/O. (The route integration lives in daemon-agent-env-api.test.ts.)
- */
-import { describe, test, expect } from "bun:test";
-import {
-  approvedGrantEnvNames,
-  composeEffectiveEnv,
-  resolveEffectiveEnv,
-} from "./effective-env.ts";
-
-describe("approvedGrantEnvNames — names only, approved-service grants only, NO material", () => {
-  test("maps an approved service grant to its env-var name via serviceEnvVar", () => {
-    const out = approvedGrantEnvNames([{ kind: "service", target: "github", status: "approved" }]);
-    expect(out).toEqual([{ name: "GITHUB_TOKEN", source: "grant:github" }]);
-  });
-
-  test("a non-default service maps to <TARGET>_TOKEN", () => {
-    const out = approvedGrantEnvNames([{ kind: "service", target: "fireflies", status: "approved" }]);
-    expect(out).toEqual([{ name: "FIREFLIES_TOKEN", source: "grant:fireflies" }]);
-  });
-
-  test("ignores pending grants, vault grants, and mcp grants (none inject an env var)", () => {
-    const out = approvedGrantEnvNames([
-      { kind: "service", target: "github", status: "pending" }, // not approved
-      { kind: "vault", target: "research", status: "approved" }, // vault → MCP, not env
-      { kind: "mcp", target: "https://x/mcp", status: "approved" }, // remote MCP, not env
-      { kind: "service", target: "cloudflare", status: "approved" }, // the only env one
-    ]);
-    expect(out).toEqual([{ name: "CLOUDFLARE_API_TOKEN", source: "grant:cloudflare" }]);
-  });
-
-  test("undefined connections → empty", () => {
-    expect(approvedGrantEnvNames(undefined)).toEqual([]);
-  });
-});
-
-describe("composeEffectiveEnv — precedence channel > default > grant + overridden marking", () => {
-  const channelEnv = {
-    default: ["DEFAULT_VAR", "GITHUB_TOKEN"],
-    channels: { "uni-dev": ["CHANNEL_VAR", "GITHUB_TOKEN"] },
-  };
-  const connections = [{ kind: "service", target: "github", status: "approved" }];
-
-  test("a name set in all three layers → channel wins, default + grant marked overridden", () => {
-    const out = composeEffectiveEnv("uni-dev", channelEnv, connections);
-    const gh = out.filter((e) => e.name === "GITHUB_TOKEN");
-    expect(gh).toHaveLength(3);
-    const winner = gh.find((e) => !e.overridden)!;
-    expect(winner.source).toBe("channel");
-    expect(gh.filter((e) => e.overridden).map((e) => e.source).sort()).toEqual(["default", "grant:github"]);
-  });
-
-  test("single-layer names carry no overridden flag", () => {
-    const out = composeEffectiveEnv("uni-dev", channelEnv, connections);
-    expect(out.find((e) => e.name === "DEFAULT_VAR")).toEqual({ name: "DEFAULT_VAR", source: "default" });
-    expect(out.find((e) => e.name === "CHANNEL_VAR")).toEqual({ name: "CHANNEL_VAR", source: "channel" });
-  });
-
-  test("default beats grant when no channel override exists", () => {
-    const out = composeEffectiveEnv(
-      "uni-dev",
-      { default: ["GITHUB_TOKEN"], channels: {} },
-      connections,
-    );
-    const gh = out.filter((e) => e.name === "GITHUB_TOKEN");
-    expect(gh.find((e) => !e.overridden)!.source).toBe("default");
-    expect(gh.find((e) => e.overridden)!.source).toBe("grant:github");
-  });
-
-  test("an agent with no env-store entries + no connections → empty", () => {
-    expect(composeEffectiveEnv("nobody", { default: [], channels: {} }, undefined)).toEqual([]);
-  });
-
-  test("only the matching agent's channel layer is used (another agent's overrides are ignored)", () => {
-    const out = composeEffectiveEnv(
-      "uni-dev",
-      { default: [], channels: { other: ["OTHER_VAR"], "uni-dev": ["MINE"] } },
-      undefined,
-    );
-    expect(out.map((e) => e.name)).toEqual(["MINE"]);
-  });
-});
-
-describe("resolveEffectiveEnv — degraded note when no def, never returns values", () => {
-  test("hasDef:false → attaches a note + still returns env layers", () => {
-    const res = resolveEffectiveEnv("uni-dev", {
-      describeEnv: () => ({ default: ["DEFAULT_VAR"], channels: { "uni-dev": ["CHANNEL_VAR"] } }),
-      hasDef: false,
-    });
-    expect(res.note).toBeDefined();
-    expect(res.env.map((e) => e.name).sort()).toEqual(["CHANNEL_VAR", "DEFAULT_VAR"]);
-  });
-
-  test("hasDef:true → no note", () => {
-    const res = resolveEffectiveEnv("uni-dev", {
-      describeEnv: () => ({ default: [], channels: {} }),
-      connections: [{ kind: "service", target: "github", status: "approved" }],
-      hasDef: true,
-    });
-    expect(res.note).toBeUndefined();
-    expect(res.env).toEqual([{ name: "GITHUB_TOKEN", source: "grant:github" }]);
-  });
-
-  test("the shape carries NO `value` field on any entry", () => {
-    const res = resolveEffectiveEnv("uni-dev", {
-      describeEnv: () => ({ default: ["A"], channels: { "uni-dev": ["B"] } }),
-      connections: [{ kind: "service", target: "github", status: "approved" }],
-      hasDef: true,
-    });
-    for (const e of res.env) expect(Object.keys(e).sort()).not.toContain("value");
-  });
-});