@pi-in-go/pigpen-jev 0.1.0

package/extensions/jev/review_test.go

@@ -0,0 +1,310 @@
+package jev_test
+
+import (
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+	"testing"
+)
+
+// Cases added by the adversarial review (rev-pigpen-jev), findings R1 to R4 in
+// port/PORT.md. Each was red before its fix.
+
+// R1. In enforce mode a flagged call runs only when the user allows it. When the
+// confirmation cannot be shown (the host UI call fails), the original's handler
+// throws and Pi blocks the call (agent-session.ts _installAgentToolHooks: "Extension
+// failed, blocking execution"); the port failed open and ran the flagged call.
+func TestReview_EnforceConfirmFailureBlocks(t *testing.T) {
+	e := newEnv(t)
+	t.Setenv("TYPESAFE_API_KEY", testKey)
+	srv := newFakeJev(t, always(gateBody(0.99, 0.04, 0.4, 0.5, 0.9)))
+	e.writeGlobal(t, jevConfig(srv, map[string]any{"gate": map[string]any{"mode": "enforce"}}))
+	hs := newHostState()
+	h := start(t, e, hs, HostOptions{OnCall: func(method string, args map[string]any) (map[string]any, string) {
+		if method == "ui.confirm" {
+			return nil, "ui_error: the terminal is gone"
+		}
+		return hs.onCall(method, args)
+	}})
+	block, reason := h.toolCall("bash", bash("rm -rf src"))
+	if !block {
+		t.Fatal("enforce mode ran a flagged call the user never approved")
+	}
+	mustContain(t, "reason", reason, "pi-jev: destructive 0.99", "not confirmed", "the terminal is gone")
+}
+
+// R2. The default judge is "the model PiG is configured with", named in the
+// disclosure as the provider that already receives the conversation. After the
+// user switches models, judging must follow: staying on the old provider keeps
+// sending content to a provider that no longer receives the conversation.
+func TestReview_DefaultJudgeFollowsTheSelectedModel(t *testing.T) {
+	e := newEnv(t)
+	e.writeGlobal(t, map[string]any{"enabled": true, "acknowledged": true, "display": "rich"})
+	hs := newHostState()
+	var mu sync.Mutex
+	var models []map[string]any
+	h := start(t, e, hs, HostOptions{ModelStream: func(model, _ map[string]any) []map[string]any {
+		mu.Lock()
+		models = append(models, model)
+		mu.Unlock()
+		return ModelText(gateAnswers(0, 0, 0, 0))
+	}})
+	next := map[string]any{"id": "private-1", "name": "private-1", "provider": "local"}
+	hs.mu.Lock()
+	hs.model = next
+	hs.mu.Unlock()
+	h.Fire("model_select", map[string]any{"model": next, "previousModel": map[string]any{"id": "judge-1", "provider": "acme"}, "source": "set"})
+	h.toolCall("bash", bash("ls"))
+	mu.Lock()
+	defer mu.Unlock()
+	if len(models) != 1 || models[0]["provider"] != "local" {
+		t.Fatalf("judge after switching to local/private-1 = %v", models)
+	}
+	h.Command("jev", "")
+	mustContain(t, "status", lastNote(h), "local/private-1")
+	if strings.Contains(lastNote(h), "acme/judge-1") {
+		t.Errorf("status still names the old model: %q", lastNote(h))
+	}
+}
+
+// R2b. A model named in the user's own config is not replaced by a model switch.
+func TestReview_ConfiguredJudgeIgnoresModelSwitch(t *testing.T) {
+	e := newEnv(t)
+	e.writeGlobal(t, map[string]any{"enabled": true, "acknowledged": true, "display": "plain", "model": "other/cheap-1"})
+	hs := newHostState()
+	var models []map[string]any
+	var mu sync.Mutex
+	h := start(t, e, hs, HostOptions{ModelStream: func(model, _ map[string]any) []map[string]any {
+		mu.Lock()
+		models = append(models, model)
+		mu.Unlock()
+		return ModelText(gateAnswers(0, 0, 0, 0))
+	}})
+	h.Fire("model_select", map[string]any{"model": map[string]any{"id": "private-1", "provider": "local"}, "source": "set"})
+	h.toolCall("bash", bash("ls"))
+	mu.Lock()
+	defer mu.Unlock()
+	if len(models) != 1 || models[0]["provider"] != "other" {
+		t.Fatalf("models = %v", models)
+	}
+}
+
+// R2c. With no model at start, the judge becomes available once one is selected.
+func TestReview_ModelSelectedLaterEnablesTheDefaultJudge(t *testing.T) {
+	e := newEnv(t)
+	e.writeGlobal(t, map[string]any{"enabled": true, "acknowledged": true, "display": "plain"})
+	hs := newHostState()
+	hs.model = map[string]any{}
+	var n int
+	var mu sync.Mutex
+	h := start(t, e, hs, HostOptions{ModelStream: func(_, _ map[string]any) []map[string]any {
+		mu.Lock()
+		n++
+		mu.Unlock()
+		return ModelText(gateAnswers(0, 0, 0, 0))
+	}})
+	next := map[string]any{"id": "judge-2", "name": "judge-2", "provider": "acme"}
+	hs.mu.Lock()
+	hs.model = next
+	hs.mu.Unlock()
+	h.Fire("model_select", map[string]any{"model": next, "source": "set"})
+	h.toolCall("bash", bash("ls"))
+	mu.Lock()
+	defer mu.Unlock()
+	if n != 1 {
+		t.Fatalf("judge requests after a model was selected = %d", n)
+	}
+	registered := false
+	for _, c := range h.CallsTo("registerTool") {
+		registered = registered || c.Args["name"] == "jev_ask"
+	}
+	if !registered {
+		t.Error("jev_ask was not registered once a judge became available")
+	}
+}
+
+// R3. The disclosure lists what leaves the machine. jev_ask sends text the model
+// chooses (up to maxStateChars) and /jev check sends the user's text; neither was
+// listed.
+func TestReview_DisclosureNamesJevAskAndCheck(t *testing.T) {
+	e := newEnv(t)
+	t.Setenv("TYPESAFE_API_KEY", testKey)
+	srv := newFakeJev(t, always(clearGate()))
+	cfg := jevConfig(srv, map[string]any{"display": "rich"})
+	delete(cfg, "enabled")
+	e.writeGlobal(t, cfg)
+	hs := newHostState()
+	h := start(t, e, hs, HostOptions{})
+	h.Command("jev", "on")
+	c := hs.confirmCalls()
+	if len(c) != 1 {
+		t.Fatalf("confirm calls = %d", len(c))
+	}
+	mustContain(t, "disclosure", c[0]["message"].(string), "jev_ask", "8000", "/jev check")
+}
+
+// R4. A repository's .pig/pi-jev.json may tune the gate, but relaxing the
+// protection the user configured (turning the gate off, enforce to shadow, higher
+// thresholds) must not be silent.
+func TestReview_ProjectThatRelaxesTheGateIsReported(t *testing.T) {
+	e := newEnv(t)
+	t.Setenv("TYPESAFE_API_KEY", testKey)
+	srv := newFakeJev(t, always(clearGate()))
+	e.writeGlobal(t, jevConfig(srv, map[string]any{"gate": map[string]any{"mode": "enforce", "blockWithoutUI": true}}))
+	e.writeProject(t, map[string]any{
+		"gate":   map[string]any{"enabled": false, "mode": "shadow", "blockWithoutUI": false, "blockOn": map[string]any{"destructive": 1, "impact": 3}},
+		"output": map[string]any{"enabled": false, "leakThreshold": 1},
+	})
+	h := start(t, e, newHostState(), HostOptions{})
+	var warn string
+	for _, n := range h.notifications() {
+		if strings.Contains(n, "relaxes") {
+			warn = n
+		}
+	}
+	if warn == "" {
+		t.Fatalf("no warning for a project that turned the gate off: %q", h.notifications())
+	}
+	mustContain(t, "warning", warn, "gate.enabled false", "gate.mode shadow", "gate.blockWithoutUI false",
+		"gate.blockOn.destructive 1", "gate.blockOn.impact 3", "output.enabled false", "output.leakThreshold 1")
+}
+
+func TestReview_StricterProjectIsNotReported(t *testing.T) {
+	e := newEnv(t)
+	t.Setenv("TYPESAFE_API_KEY", testKey)
+	srv := newFakeJev(t, always(clearGate()))
+	e.writeGlobal(t, jevConfig(srv, nil))
+	e.writeProject(t, map[string]any{"gate": map[string]any{"mode": "enforce", "blockOn": map[string]any{"destructive": 0.4}}})
+	h := start(t, e, newHostState(), HostOptions{})
+	if h.anyNotification("relaxes") {
+		t.Errorf("a stricter project was reported as relaxing: %q", h.notifications())
+	}
+}
+
+// R5. Guard tests for the trust boundary (PORT.md C2). The existing test sets every
+// destination key in one project file against a user config that already names the
+// backend, model and key, so a project-applied apiKeyFile, backend, model or
+// acknowledged survived as mutants (x-project-*). Each key is tested alone here.
+
+func TestReview_ProjectCannotChooseTheKeyFile(t *testing.T) {
+	e := newEnv(t)
+	srv := newFakeJev(t, always(clearGate()))
+	e.writeGlobal(t, jevConfig(srv, nil)) // no key of the user's own
+	secret := filepath.Join(e.cwd, "not-a-key.txt")
+	if err := os.WriteFile(secret, []byte("contents-of-a-private-file"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	e.writeProject(t, map[string]any{"apiKeyFile": secret})
+	h := start(t, e, newHostState(), HostOptions{})
+	h.toolCall("bash", bash("ls"))
+	for _, r := range srv.requests() {
+		if strings.Contains(r.Auth, "contents-of-a-private-file") {
+			t.Fatalf("a project file chose the file sent as the API key: %q", r.Auth)
+		}
+	}
+	if !h.anyNotification("ignored project setting apiKeyFile") {
+		t.Errorf("notifications = %q", h.notifications())
+	}
+}
+
+func TestReview_ProjectCannotSwitchTheBackend(t *testing.T) {
+	e := newEnv(t)
+	t.Setenv("TYPESAFE_API_KEY", testKey)
+	attacker := newFakeJev(t, always(clearGate()))
+	e.writeGlobal(t, map[string]any{"enabled": true, "acknowledged": true, "display": "plain", "endpoint": attacker.srv.URL, "model": "acme/judge-1"})
+	e.writeProject(t, map[string]any{"backend": "typesafe"})
+	var n int
+	var mu sync.Mutex
+	h := start(t, e, newHostState(), HostOptions{ModelStream: func(_, _ map[string]any) []map[string]any {
+		mu.Lock()
+		n++
+		mu.Unlock()
+		return ModelText(gateAnswers(0, 0, 0, 0))
+	}})
+	h.toolCall("bash", bash("ls"))
+	mu.Lock()
+	defer mu.Unlock()
+	if attacker.count() != 0 || n != 1 {
+		t.Fatalf("project backend applied: %d HTTP requests, %d model requests", attacker.count(), n)
+	}
+}
+
+func TestReview_ProjectCannotChooseTheModel(t *testing.T) {
+	e := newEnv(t)
+	e.writeGlobal(t, map[string]any{"enabled": true, "acknowledged": true, "display": "plain"})
+	e.writeProject(t, map[string]any{"model": "elsewhere/judge"})
+	var models []map[string]any
+	var mu sync.Mutex
+	h := start(t, e, newHostState(), HostOptions{ModelStream: func(model, _ map[string]any) []map[string]any {
+		mu.Lock()
+		models = append(models, model)
+		mu.Unlock()
+		return ModelText(gateAnswers(0, 0, 0, 0))
+	}})
+	h.toolCall("bash", bash("ls"))
+	mu.Lock()
+	defer mu.Unlock()
+	if len(models) != 1 || models[0]["provider"] != "acme" {
+		t.Fatalf("a project file chose the judge model: %v", models)
+	}
+}
+
+func TestReview_ProjectCannotHideTheDisclosure(t *testing.T) {
+	e := newEnv(t)
+	e.writeGlobal(t, map[string]any{"enabled": true, "display": "rich"})
+	e.writeProject(t, map[string]any{"acknowledged": true})
+	h := start(t, e, newHostState(), HostOptions{})
+	if !h.anyNotification("What leaves this machine") {
+		t.Errorf("a project file acknowledged the disclosure for the user: %q", h.notifications())
+	}
+}
+
+// R5b. http is accepted only for this machine; an IP literal is not "localhost".
+func TestReview_PlainHTTPToARemoteIPIsRefused(t *testing.T) {
+	e := newEnv(t)
+	t.Setenv("TYPESAFE_API_KEY", testKey)
+	e.writeGlobal(t, map[string]any{"enabled": true, "acknowledged": true, "backend": "typesafe", "display": "plain",
+		"endpoint": "http://192.0.2.10/v1/systemone", "model": "m"})
+	h := start(t, e, newHostState(), HostOptions{})
+	if !h.anyNotification("must use https") {
+		t.Errorf("http:// to a remote IP was accepted: %q", h.notifications())
+	}
+}
+
+// R5c. The original's output cache key is tool and output (output.ts outputKey).
+func TestReview_OutputCacheIsPerTool(t *testing.T) {
+	e := newEnv(t)
+	t.Setenv("TYPESAFE_API_KEY", testKey)
+	srv := newFakeJev(t, always(outBody(0.01, "no_failure", 0.99)))
+	e.writeGlobal(t, jevConfig(srv, map[string]any{"output": map[string]any{"tools": []any{"bash", "read"}}}))
+	h := start(t, e, newHostState(), HostOptions{})
+	h.toolResult("bash", bash("cat x"), text("same text"), false)
+	h.toolResult("read", map[string]any{"path": "x"}, text("same text"), false)
+	if srv.count() != 2 {
+		t.Errorf("requests = %d, want one per tool", srv.count())
+	}
+}
+
+// R5d. PORT.md C3: when shortening is not enough, the arguments go before the
+// user's request (which by then is shortened too).
+func TestReview_StateCapDropsArgumentsBeforeTheRequest(t *testing.T) {
+	e := newEnv(t)
+	t.Setenv("TYPESAFE_API_KEY", testKey)
+	srv := newFakeJev(t, always(clearGate()))
+	e.writeGlobal(t, jevConfig(srv, map[string]any{"maxStateChars": 300}))
+	hs := newHostState()
+	hs.user = "tidy the build"
+	h := start(t, e, hs, HostOptions{})
+	in := map[string]any{}
+	for i := 0; i < 40; i++ {
+		in["k"+strconv.Itoa(i)] = i
+	}
+	h.toolCall("bash", in)
+	st := stateOf(t, srv.first(t))
+	user, _ := st["user_request"].(string)
+	if st["arguments"] != "…[elided to fit maxStateChars]" || !strings.HasPrefix(user, "tidy the") {
+		t.Errorf("state = %v", st)
+	}
+}

package/extensions/jev/source_test.go

@@ -0,0 +1,57 @@
+package jev_test
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func goSources(t *testing.T) map[string]string {
+	t.Helper()
+	files, _ := filepath.Glob("*.go")
+	out := map[string]string{}
+	for _, f := range files {
+		if strings.HasSuffix(f, "_test.go") {
+			continue
+		}
+		b, err := os.ReadFile(f)
+		if err != nil {
+			t.Fatal(err)
+		}
+		out[f] = string(b)
+	}
+	return out
+}
+
+// The task: "use the model from PiG configuration, no hardcoded provider".
+func TestNoHardcodedProviderOrEndpoint(t *testing.T) {
+	for name, src := range goSources(t) {
+		for _, bad := range []string{"api.typesafe.ai", "jev-latest", "api.openai.com", "api.anthropic.com", "openrouter.ai"} {
+			if strings.Contains(src, bad) {
+				t.Errorf("%s hardcodes %q", name, bad)
+			}
+		}
+	}
+}
+
+// Public PiG Go SDK only: no PiG-internal imports, no Node.
+func TestOnlyPublicSDKImports(t *testing.T) {
+	for name, src := range goSources(t) {
+		for _, line := range strings.Split(src, "\n") {
+			l := strings.TrimSpace(line)
+			if strings.HasPrefix(l, `"github.com/MichaelKinsy/PiG/`) && !strings.HasPrefix(l, `"github.com/MichaelKinsy/PiG/extensions/sdk`) {
+				t.Errorf("%s imports %s", name, l)
+			}
+			if strings.Contains(l, "os/exec") {
+				t.Errorf("%s starts a process (%s)", name, l)
+			}
+		}
+	}
+}
+
+// Named gaps (Skill step 3: a gap is a named skipped test, never silent).
+
+func TestUserRequestJoinsTextBlocksWithNewline_GAP(t *testing.T) {
+	t.Skip("upstream joins a user message's text blocks with \\n (index.ts messageText); the Go SDK's BranchEntry flattens them with no separator; a prompt sent over RPC is one block, so no scenario differs")
+}

package/extensions/jev/text.go

@@ -0,0 +1,174 @@
+package jev
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"math"
+	"math/big"
+	"runtime"
+	"sort"
+	"strings"
+	"unicode/utf8"
+)
+
+// The original measures strings in UTF-16 code units (JavaScript .length and
+// .slice). Every limit here uses the same unit so a configured 400 keeps meaning
+// what the README says.
+
+func utf16Len(s string) int {
+	n := 0
+	for _, r := range s {
+		n++
+		if r >= 0x10000 {
+			n++
+		}
+	}
+	return n
+}
+
+// sliceUTF16 returns the first n UTF-16 units of s. JavaScript can cut a
+// surrogate pair in two and send a lone surrogate; a Go string cannot hold one,
+// so a cut through a pair yields U+FFFD in its place.
+func sliceUTF16(s string, n int) string {
+	if n <= 0 {
+		return ""
+	}
+	units := 0
+	for i, r := range s {
+		w := 1
+		if r >= 0x10000 {
+			w = 2
+		}
+		if units+w > n {
+			if units < n { // half of a pair
+				return s[:i] + "\uFFFD"
+			}
+			return s[:i]
+		}
+		units += w
+	}
+	return s
+}
+
+// elide keeps the first max units and states how many were cut, as
+// `${value.slice(0, max)}…[N chars elided]`.
+func elide(s string, max int) string {
+	total := utf16Len(s)
+	if total <= max {
+		return s
+	}
+	return fmt.Sprintf("%s…[%d chars elided]", sliceUTF16(s, max), total-max)
+}
+
+// truncateText is the gate's user-request cut: `…[truncated]`.
+func truncateText(s string, max int) string {
+	if utf16Len(s) <= max {
+		return s
+	}
+	return sliceUTF16(s, max) + "…[truncated]"
+}
+
+// toFixed2 is JavaScript's Number.prototype.toFixed(2): the exact decimal value
+// of the double, a tie rounds up (0.125 gives 0.13, where Go's %.2f gives 0.12).
+func toFixed2(x float64) string {
+	switch {
+	case math.IsNaN(x):
+		return "NaN"
+	case math.IsInf(x, 1):
+		return "Infinity"
+	case math.IsInf(x, -1):
+		return "-Infinity"
+	}
+	neg := x < 0
+	r := new(big.Rat).SetFloat64(math.Abs(x))
+	r.Mul(r, big.NewRat(100, 1))
+	r.Add(r, big.NewRat(1, 2))
+	n := new(big.Int).Div(r.Num(), r.Denom())
+	digits := n.String()
+	for len(digits) < 3 {
+		digits = "0" + digits
+	}
+	out := digits[:len(digits)-2] + "." + digits[len(digits)-2:]
+	if neg {
+		out = "-" + out
+	}
+	return out
+}
+
+// jsonString encodes s without HTML escaping.
+func jsonString(s string) []byte {
+	var buf bytes.Buffer
+	enc := json.NewEncoder(&buf)
+	enc.SetEscapeHTML(false)
+	_ = enc.Encode(s)
+	return bytes.TrimRight(buf.Bytes(), "\n")
+}
+
+func jsonValue(v any) []byte {
+	var buf bytes.Buffer
+	enc := json.NewEncoder(&buf)
+	enc.SetEscapeHTML(false)
+	if err := enc.Encode(v); err != nil {
+		return []byte("null")
+	}
+	return bytes.TrimRight(buf.Bytes(), "\n")
+}
+
+const maxNesting = 64
+
+// summarize copies a decoded JSON value, eliding every string longer than max
+// (at any depth: the original stopped at depth 4 and let deeper strings out
+// whole, see PORT.md C7). Keys are written sorted; the SDK hands events over as
+// Go maps, so the wire order of the original's argument keys is not available.
+func summarize(v any, max, depth int) any {
+	if depth > maxNesting {
+		return "…[nested value elided]"
+	}
+	switch t := v.(type) {
+	case string:
+		return elide(t, max)
+	case []any:
+		out := make([]any, len(t))
+		for i, item := range t {
+			out[i] = summarize(item, max, depth+1)
+		}
+		return out
+	case map[string]any:
+		out := make(map[string]any, len(t))
+		for k, item := range t {
+			out[k] = summarize(item, max, depth+1)
+		}
+		return out
+	}
+	return v
+}
+
+// platform is process.platform as Node spells it.
+func platform() string {
+	if runtime.GOOS == "windows" {
+		return "win32"
+	}
+	return runtime.GOOS
+}
+
+func sortedKeys[V any](m map[string]V) []string {
+	keys := make([]string, 0, len(m))
+	for k := range m {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys
+}
+
+// collapse folds whitespace runs and trims, as the original's error text does.
+func collapse(s string) string {
+	return strings.Join(strings.Fields(s), " ")
+}
+
+func cut(s string, max int) string {
+	if utf8.RuneCountInString(s) <= max {
+		return s
+	}
+	return string([]rune(s)[:max]) + "…"
+}