@principles/pd-cli 1.147.6 → 1.147.8

package/tests/commands/codex-setup.test.ts

@@ -0,0 +1,297 @@
+/**
+ * pd codex setup command tests (Slice D consent UX).
+ *
+ * Real-filesystem integration style: every test builds a disposable
+ * workspace (.pd/config.yaml included) and exercises the production config
+ * editor + consent store — no fs mocks, so round-trip verification, comment
+ * preservation, and atomic-rename behavior are proven, not assumed.
+ *
+ * Config fixtures are built from the production `getDefaultPdConfig()` (same
+ * source as `pd runtime init`) so they pass the full validator.
+ *
+ * Covers:
+ * - --show-disclosure: frozen text printed (zh + en), zero mutation.
+ * - --accept: consent recorded granted BEFORE flag flip; config.yaml gains
+ *   features.codex_conversation_ingestion.enabled=true; comments preserved;
+ *   production loader sees the flag enabled.
+ * - --decline: consent declined; a hand-enabled flag is regularized back off;
+ *   host.codex and other flags untouched.
+ * - cli-4: --accept --decline mutex refusal.
+ * - cli-5: refusals (no workspace config, malformed config) mutate nothing.
+ * - decision_required: --json without explicit decision; non-TTY interactive.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import * as yaml from 'js-yaml';
+import { getDefaultPdConfig } from '@principles/core/runtime-v2';
+
+let logLines: string[] = [];
+let savedExitCode: number | undefined;
+
+const HEADER_COMMENT = '# PD Runtime Configuration — single source of truth (.pd/config.yaml, ADR-0016)\n# Edited by the Owner. Comments must survive consent-driven flag edits.\n';
+
+const CORE = getDefaultPdConfig();
+// Everything except `features` — features blocks are appended per-test so the
+// editor's insert/replace/append paths are all exercised on real content.
+// Feature override keys are FLAT flag ids ('host.codex' is a literal key),
+// and every override requires category+enabled (validatePdConfig).
+const { features: _coreFeatures, ...coreWithoutFeatures } = CORE as unknown as Record<string, unknown>;
+const PRELUDE = HEADER_COMMENT + yaml.dump(
+  { ...coreWithoutFeatures, workspace: { default: '%WS%' } },
+  { indent: 2, lineWidth: 200, noRefs: true },
+);
+
+function makeWorkspace(configYaml: string | null): string {
+  const ws = fs.mkdtempSync(path.join(os.tmpdir(), 'pd-codex-setup-'));
+  if (configYaml !== null) {
+    fs.mkdirSync(path.join(ws, '.pd'), { recursive: true });
+    fs.writeFileSync(path.join(ws, '.pd', 'config.yaml'), renderConfig(ws, configYaml), 'utf8');
+  }
+  return ws;
+}
+
+function renderConfig(ws: string, template: string): string {
+  // workspace.default must be an absolute path (validatePdConfig); forward
+  // slashes keep the YAML plain scalar portable across platforms.
+  return template.replaceAll('%WS%', ws.replace(/\\/g, '/'));
+}
+
+async function run(options: Record<string, unknown>): Promise<{ reports: string[]; json: unknown[] }> {
+  const { handleCodexSetup } = await import('../../src/commands/codex-setup.js');
+  await handleCodexSetup(options as never);
+  const json: unknown[] = [];
+  const reports: string[] = [];
+  for (const line of logLines) {
+    if (line.startsWith('{')) {
+      try {
+        json.push(JSON.parse(line));
+      } catch {
+        reports.push(line);
+      }
+    } else {
+      reports.push(line);
+    }
+  }
+  return { reports, json };
+}
+
+function readConsent(ws: string): Record<string, unknown> | null {
+  const p = path.join(ws, '.pd', 'codex-ingestion-consent.json');
+  if (!fs.existsSync(p)) return null;
+  return JSON.parse(fs.readFileSync(p, 'utf8')) as Record<string, unknown>;
+}
+
+function readConfig(ws: string): string {
+  return fs.readFileSync(path.join(ws, '.pd', 'config.yaml'), 'utf8');
+}
+
+beforeEach(() => {
+  logLines = [];
+  savedExitCode = process.exitCode;
+  process.exitCode = undefined;
+  vi.spyOn(console, 'log').mockImplementation((...args: unknown[]) => {
+    logLines.push(args.map(String).join(' '));
+  });
+  // --show-disclosure writes via process.stdout.write; capture it too.
+  vi.spyOn(process.stdout, 'write').mockImplementation(((chunk: unknown) => {
+    logLines.push(String(chunk));
+    return true;
+  }) as typeof process.stdout.write);
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  process.exitCode = savedExitCode;
+});
+
+describe('pd codex setup — show-disclosure', () => {
+  it('prints the frozen Chinese SSoT by default and English with --lang en, mutating nothing', async () => {
+    const ws = makeWorkspace(PRELUDE + 'features: {}\n');
+    await run({ workspace: ws, showDisclosure: true });
+    let all = logLines.join('\n');
+    expect(all).toContain('对话观察与治理闭环');
+    expect(all).toContain('默认关闭。只有你在看到本说明后明确选择开启才会生效');
+    await run({ workspace: ws, showDisclosure: true, lang: 'en' });
+    all = logLines.join('\n');
+    expect(all).toContain('Off by default');
+    expect(readConsent(ws)).toBeNull();
+    expect(readConfig(ws)).toBe(renderConfig(ws, PRELUDE + 'features: {}\n'));
+  });
+});
+
+describe('pd codex setup — accept flow', () => {
+  it('records granted consent, enables the flag, preserves comments, and round-trips', async () => {
+    const ws = makeWorkspace(PRELUDE + 'features: {}\n');
+    const { json } = await run({ workspace: ws, accept: true, json: true });
+    expect(json).toHaveLength(1);
+    const report = json[0] as Record<string, unknown>;
+    expect(report.status, JSON.stringify(report)).toBe('ok');
+    expect(report.decision).toBe('granted');
+    expect((report.ingestionFlag as Record<string, unknown>).enabled).toBe(true);
+    expect(report.disclosureVersion).toBe('g2a-2026-08-28');
+
+    const consent = readConsent(ws);
+    expect(consent?.decision).toBe('granted');
+    expect(consent?.decidedVia).toBe('pd_codex_setup');
+
+    const configAfter = readConfig(ws);
+    expect(configAfter).toContain('Comments must survive consent-driven flag edits.');
+    expect(configAfter).toContain('  codex_conversation_ingestion:');
+
+    // Production loader is the round-trip authority.
+    const { computeFeatureFlagsFromConfig, isFeatureEnabled } = await import('@principles/core/runtime-v2');
+    const { loadPdConfigForPlugin } = await import('@principles/host-runtime');
+    const result = loadPdConfigForPlugin(ws);
+    expect(result.ok).toBe(true);
+    expect(isFeatureEnabled(computeFeatureFlagsFromConfig(result.effective), 'codex_conversation_ingestion')).toBe(true);
+    expect(process.exitCode).toBeUndefined();
+  });
+
+  it('replaces an empty features mapping with the enabled flag block', async () => {
+    const ws = makeWorkspace(PRELUDE + 'features: {}\n');
+    const { json } = await run({ workspace: ws, accept: true, json: true });
+    expect((json[0] as Record<string, unknown>).status, JSON.stringify(json[0])).toBe('ok');
+    expect(readConfig(ws)).toMatch(/features:\r?\n {2}codex_conversation_ingestion:\r?\n {4}category: quiet\r?\n {4}enabled: true/);
+  });
+
+  it('inserts the flag into an existing features block that has other overrides', async () => {
+    const withOtherFlags = PRELUDE + 'features:\n  prompt:\n    category: core\n    enabled: true\n  internalization_auto_consumer:\n    category: core\n    enabled: true\n';
+    const ws = makeWorkspace(withOtherFlags);
+    const { json } = await run({ workspace: ws, accept: true, json: true });
+    expect((json[0] as Record<string, unknown>).status, JSON.stringify(json[0])).toBe('ok');
+    const configAfter = readConfig(ws);
+    expect(configAfter).toMatch(/ {2}codex_conversation_ingestion:\r?\n {4}category: quiet\r?\n {4}enabled: true/);
+    // Sibling overrides survive byte-for-byte.
+    expect(configAfter).toContain('  internalization_auto_consumer:');
+    expect(configAfter).toContain('  prompt:');
+  });
+});
+
+describe('pd codex setup — decline flow', () => {
+  it('records revoked consent and regularizes a hand-enabled flag back off', async () => {
+    const handEnabled = PRELUDE + 'features:\n  host.codex:\n    category: core\n    enabled: true\n  codex_conversation_ingestion:\n    category: quiet\n    enabled: true # hand-edited without consent\n';
+    const ws = makeWorkspace(handEnabled);
+    const { json } = await run({ workspace: ws, decline: true, json: true });
+    const report = json[0] as Record<string, unknown>;
+    expect(report.status, JSON.stringify(report)).toBe('ok');
+    expect(report.decision).toBe('revoked');
+    expect((report.ingestionFlag as Record<string, unknown>).enabled).toBe(false);
+    expect(report.nextAction).toContain('No transcript');
+
+    expect(readConsent(ws)?.decision).toBe('revoked');
+    const configAfter = readConfig(ws);
+    // The inline comment survives; only the value flips.
+    expect(configAfter).toContain('enabled: false # hand-edited without consent');
+    // host.codex governance is untouched by the decline.
+    expect(configAfter).toContain('category: core');
+    expect(configAfter).toContain('host.codex:');
+    expect(process.exitCode).toBeUndefined();
+  });
+});
+
+describe('pd codex setup — consent transition state machine (review round 2)', () => {
+  it('Case 1: consent write ok + flag enable ok ⇒ state=granted, runtime enabled=true', async () => {
+    const ws = makeWorkspace(PRELUDE + 'features: {}\n');
+    const { json } = await run({ workspace: ws, accept: true, json: true });
+    const report = json[0] as Record<string, unknown>;
+    expect(report.status, JSON.stringify(report)).toBe('ok');
+    expect(report.decision).toBe('granted');
+    expect(report.consentState).toBe('granted');
+    expect((report.ingestionFlag as Record<string, unknown>).enabled).toBe(true);
+    expect(readConsent(ws)?.decision).toBe('granted');
+  });
+
+  it('Case 2: flag enable fails ⇒ state != granted, runtime enabled=false, failure reason recorded and surfaced', async () => {
+    const ws = makeWorkspace(PRELUDE + 'features: {}\n');
+    // Break the config AFTER the initial validation so the round-trip
+    // verification inside the flag editor fails: consent went to 'pending'
+    // first, then the activation fails ⇒ terminal state 'failed' with the
+    // reason, and the flag stays off (no granted/disabled mismatch).
+    const original = await import('../../src/commands/codex-setup.js');
+    const brokenLoader = await import('@principles/host-runtime');
+    const realLoad = brokenLoader.loadPdConfigForPlugin;
+    let loadCalls = 0;
+    const spy = vi.spyOn(brokenLoader, 'loadPdConfigForPlugin').mockImplementation((dir: string) => {
+      loadCalls += 1;
+      // Call 1 is the handler's pre-check (ok); call 2 is the round-trip
+      // verification INSIDE setCodexConversationIngestionFlag — break it there.
+      if (loadCalls === 1) return realLoad(dir);
+      return {
+        ok: false,
+        effective: realLoad(dir).effective,
+        source: 'malformed',
+        configPath: dir,
+        warnings: [],
+        errors: [{ path: 'features', reason: 'injected round-trip failure (test)', nextAction: 'fix yaml' }],
+      };
+    });
+    try {
+      const { json } = await run({ workspace: ws, accept: true, json: true });
+      const report = json[0] as Record<string, unknown>;
+      expect(report.status, JSON.stringify(report)).toBe('degraded');
+      expect(report.decision).toBe('failed');
+      expect(report.consentState).toBe('failed');
+      expect(report.reason).toContain('injected round-trip failure');
+      expect((report.ingestionFlag as Record<string, unknown>).enabled).toBe(false);
+      // NOT granted — the whole point of the state machine.
+      expect(report.consentState).not.toBe('granted');
+      const consent = readConsent(ws);
+      expect(consent?.decision).toBe('failed');
+      expect(String(consent?.failureReason)).toContain('injected round-trip failure');
+      expect(process.exitCode).toBe(1);
+    } finally {
+      spy.mockRestore();
+      void original;
+    }
+  });
+
+  it('re-running accept after a failed attempt reaches granted (state machine recovers)', async () => {
+    const ws = makeWorkspace(PRELUDE + 'features: {}\n');
+    // Simulate the failed state on disk, then accept again.
+    fs.mkdirSync(path.join(ws, '.pd'), { recursive: true });
+    fs.writeFileSync(path.join(ws, '.pd', 'codex-ingestion-consent.json'), JSON.stringify({
+      decision: 'failed', disclosureVersion: 'g2a-2026-08-28', decidedAt: new Date().toISOString(),
+      decidedVia: 'pd_codex_setup', failureReason: 'flag activation failed: prior run', schemaVersion: '2',
+    }), 'utf8');
+    const { json } = await run({ workspace: ws, accept: true, json: true });
+    const report = json[0] as Record<string, unknown>;
+    expect(report.status, JSON.stringify(report)).toBe('ok');
+    expect(report.decision).toBe('granted');
+    expect(readConsent(ws)?.decision).toBe('granted');
+  });
+});
+
+describe('pd codex setup — refusals mutate nothing (cli-4/cli-5/cli-6)', () => {
+  it('refuses --accept together with --decline', async () => {
+    const ws = makeWorkspace(PRELUDE + 'features: {}\n');
+    const { json } = await run({ workspace: ws, accept: true, decline: true, json: true });
+    expect((json[0] as Record<string, unknown>).reason).toBe('accept_decline_mutex');
+    expect(readConsent(ws)).toBeNull();
+    expect(process.exitCode).toBe(1);
+  });
+
+  it('refuses when the workspace has no .pd/config.yaml', async () => {
+    const ws = makeWorkspace(null);
+    const { json } = await run({ workspace: ws, accept: true, json: true });
+    expect((json[0] as Record<string, unknown>).reason).toBe('workspace_config_not_found');
+    expect(fs.existsSync(path.join(ws, '.pd'))).toBe(false);
+  });
+
+  it('refuses a malformed config without recording consent', async () => {
+    const ws = makeWorkspace(PRELUDE + 'features: [not, a, mapping]\n');
+    const { json } = await run({ workspace: ws, accept: true, json: true });
+    expect((json[0] as Record<string, unknown>).reason).toMatch(/^workspace_config_malformed/);
+    expect(readConsent(ws)).toBeNull();
+  });
+
+  it('requires an explicit decision in --json mode and without a TTY', async () => {
+    const ws = makeWorkspace(PRELUDE + 'features: {}\n');
+    const viaJson = await run({ workspace: ws, json: true });
+    expect((viaJson.json[0] as Record<string, unknown>).reason).toBe('decision_required');
+    const viaNonTty = await run({ workspace: ws });
+    expect(viaNonTty.reports.join('\n')).toContain('decision_required');
+    expect(readConsent(ws)).toBeNull();
+  });
+});

package/tests/commands/codex-worker-registration.test.ts

@@ -18,6 +18,16 @@ function buildTestProgram(): Command {
   const program = new Command();
   const codex = program.command('codex');
   codex.command('reconcile');
+  // PRI-625 Slice D: consent UX command (mirrors src/index.ts registration).
+  codex
+    .command('setup')
+    .option('-w, --workspace <path>', 'Workspace directory')
+    .option('--accept', 'Explicitly accept after the disclosure has been presented (non-interactive)')
+    .option('--decline', 'Explicitly decline; the ingestion flag stays off and no transcript is ever read')
+    .option('--show-disclosure', 'Print the frozen disclosure text (zh default, --lang en) and exit without mutating anything')
+    .option('--lang <zh|en>', 'Disclosure language for presentation')
+    .option('--json', 'Output raw JSON (decision must be explicit: --accept or --decline)')
+    .action(() => {});
   const ingest = codex.command('ingest');
   ingest
     .command('catch-up')
@@ -36,6 +46,25 @@ function buildTestProgram(): Command {
   return program;
 }
 
+describe('codex Slice D setup command registration (cli-7)', () => {
+  it('parses codex setup flags including --accept/--decline/--show-disclosure', () => {
+    const program = buildTestProgram();
+    program.parse(['node', 'pd', 'codex', 'setup', '--workspace', '/tmp/ws', '--accept', '--lang', 'en']);
+    const codex = program.commands.find((c) => c.name() === 'codex');
+    const setup = codex?.commands.find((c) => c.name() === 'setup');
+    expect(setup).toBeDefined();
+    expect(setup?.opts().workspace).toBe('/tmp/ws');
+    expect(setup?.opts().accept).toBe(true);
+    expect(setup?.opts().decline).toBeUndefined();
+    expect(setup?.opts().lang).toBe('en');
+
+    const program2 = buildTestProgram();
+    program2.parse(['node', 'pd', 'codex', 'setup', '--show-disclosure']);
+    const setup2 = program2.commands.find((c) => c.name() === 'codex')?.commands.find((c) => c.name() === 'setup');
+    expect(setup2?.opts().showDisclosure).toBe(true);
+  });
+});
+
 describe('codex Slice C command registration (cli-7)', () => {
   it('parses codex ingest catch-up flags', () => {
     const program = buildTestProgram();