@rune-kit/rune 2.13.0 → 2.15.0

package/compiler/__tests__/openclaw-adapter.test.js

@@ -115,10 +115,9 @@ test('generateManifest defaults version when missing', () => {
 });
 
 test('generateManifest declares artifact convention for OpenClaw skills', () => {
-  const manifest = openclaw.generateManifest(
-    [{ name: 'cook', layer: 'L1', group: 'orchestrator' }],
-    { version: '1.0.0' },
-  );
+  const manifest = openclaw.generateManifest([{ name: 'cook', layer: 'L1', group: 'orchestrator' }], {
+    version: '1.0.0',
+  });
   assert.ok(manifest.artifactConvention, 'artifactConvention field exists');
   assert.ok(Array.isArray(manifest.artifactConvention.outputDirPriority), 'outputDirPriority is array');
   assert.ok(manifest.artifactConvention.outputDirPriority.length >= 4, 'at least 4 fallback tiers');
@@ -129,12 +128,18 @@ test('generateManifest declares artifact convention for OpenClaw skills', () =>
   assert.ok(manifest.artifactConvention.outputContract, 'outputContract documented');
   assert.strictEqual(manifest.artifactConvention.outputContract.exitCodes[0], 'success');
   assert.strictEqual(manifest.artifactConvention.outputContract.exitCodes[4], 'timeout with partial results (accept)');
-  assert.strictEqual(manifest.artifactConvention.outputContract.exitCodes[124], 'timeout with zero results (retry or abort)');
+  assert.strictEqual(
+    manifest.artifactConvention.outputContract.exitCodes[124],
+    'timeout with zero results (retry or abort)',
+  );
 });
 
 test('generateManifest description scales with skill count', () => {
   const fewSkills = openclaw.generateManifest(
-    [{ name: 'cook', layer: 'L1' }, { name: 'plan', layer: 'L2' }],
+    [
+      { name: 'cook', layer: 'L1' },
+      { name: 'plan', layer: 'L2' },
+    ],
     { version: '1.0.0' },
   );
   assert.ok(fewSkills.description.includes('2-skill'), 'description reflects actual skill count');

package/compiler/__tests__/oracle-bundle-format.test.js

@@ -0,0 +1,210 @@
+/**
+ * Adversary oracle-mode context bundle format — verify the regex-validated
+ * structure that adversary emits when dispatching to a second model.
+ *
+ * The bundle has 3 mandatory sections:
+ *   1. [SYSTEM] line with exact role-priming text
+ *   2. [USER] line with template-driven problem statement
+ *   3. ### File N: <path> blocks with normalized content
+ *
+ * Validates:
+ *   - System prompt is invariant (must match exact text)
+ *   - User section non-empty, within length bounds
+ *   - File headers numbered sequentially
+ *   - Hard caps enforced (12 files, 4k chars per file, 100k bundle)
+ *   - Forbidden content stripped (secrets redacted)
+ *   - Citation validation (reply must cite files in bundle)
+ */
+
+import assert from 'node:assert';
+import { describe, test } from 'node:test';
+
+const SYSTEM_LINE_REGEX =
+  /^\[SYSTEM\] You are Oracle, a focused one-shot problem solver\. You have NO prior context — assume zero project knowledge\. Cite file:line for every claim\. Reject any claim you cannot ground in the provided files\.$/;
+
+const USER_LINE_REGEX = /^\[USER\] .{20,2000}$/;
+
+const FILE_HEADER_REGEX = /^### File \d+: [^\n]+$/;
+
+const HARD_CAPS = {
+  bundleChars: 400_000,
+  perFileChars: 4_000,
+  fileCount: 12,
+  userMaxChars: 2_000,
+};
+
+function buildSystemLine() {
+  return '[SYSTEM] You are Oracle, a focused one-shot problem solver. You have NO prior context — assume zero project knowledge. Cite file:line for every claim. Reject any claim you cannot ground in the provided files.';
+}
+
+function buildUserLine(source, payload) {
+  if (source === 'debug') {
+    return `[USER] Agent stuck after ${payload.cycles} hypothesis cycles. Disproved: ${payload.disproved}. Error: ${payload.error}. What is the most likely root cause not yet considered?`;
+  }
+  if (source === 'fix') {
+    return `[USER] Agent stuck after ${payload.attempts} failed fix attempts on ${payload.file}. Each attempt's tests failed with: ${payload.testFailure}. What is the most likely cause of the test failure?`;
+  }
+  return `[USER] ${payload}`;
+}
+
+function buildBundle({ files = [], userLine, systemLine = buildSystemLine() }) {
+  const sections = [systemLine, '', userLine, ''];
+  files.forEach((f, i) => {
+    sections.push(`### File ${i + 1}: ${f.path}`);
+    sections.push(f.content);
+    sections.push('');
+  });
+  return sections.join('\n');
+}
+
+function validateBundle(bundle) {
+  const errors = [];
+  if (bundle.length > HARD_CAPS.bundleChars) errors.push('bundle_too_large');
+  const lines = bundle.split('\n');
+  const sysLine = lines.find((l) => l.startsWith('[SYSTEM]'));
+  if (!sysLine || !SYSTEM_LINE_REGEX.test(sysLine)) errors.push('invalid_system_line');
+  const userLine = lines.find((l) => l.startsWith('[USER]'));
+  if (!userLine || !USER_LINE_REGEX.test(userLine)) errors.push('invalid_user_line');
+  const fileHeaders = lines.filter((l) => l.startsWith('### File '));
+  if (fileHeaders.length > HARD_CAPS.fileCount) errors.push('too_many_files');
+  for (let i = 0; i < fileHeaders.length; i++) {
+    if (!FILE_HEADER_REGEX.test(fileHeaders[i])) errors.push(`invalid_file_header_${i}`);
+    const expectedNum = i + 1;
+    if (!fileHeaders[i].startsWith(`### File ${expectedNum}:`)) errors.push(`out_of_order_file_${i}`);
+  }
+  return { valid: errors.length === 0, errors };
+}
+
+function redactSecrets(content) {
+  return content
+    .replace(/(api[_-]?key|secret|password|token)\s*[:=]\s*["'][^"']{8,}["']/gi, '$1=<REDACTED>')
+    .replace(/Authorization:\s*Bearer\s+\S{20,}/g, 'Authorization: Bearer <REDACTED>')
+    .replace(/process\.env\.[A-Z_]+\s*=\s*["'][^"']+["']/g, (match) => match.replace(/["'][^"']+["']/, '"<REDACTED>"'));
+}
+
+describe('System prompt invariance', () => {
+  test('exact system line matches regex', () => {
+    assert.match(buildSystemLine(), SYSTEM_LINE_REGEX);
+  });
+
+  test('rejects modified system prompt (no improvising)', () => {
+    const tampered = '[SYSTEM] You are Oracle, an improved problem solver with extra context.';
+    assert.doesNotMatch(tampered, SYSTEM_LINE_REGEX);
+  });
+
+  test('rejects empty system line', () => {
+    assert.doesNotMatch('[SYSTEM]', SYSTEM_LINE_REGEX);
+  });
+});
+
+describe('User section template', () => {
+  test('debug-source user line matches regex', () => {
+    const line = buildUserLine('debug', { cycles: 3, disproved: 'H1; H2; H3', error: '401 intermittent' });
+    assert.match(line, USER_LINE_REGEX);
+  });
+
+  test('fix-source user line matches regex', () => {
+    const line = buildUserLine('fix', {
+      attempts: 2,
+      file: 'src/auth.ts',
+      testFailure: 'expected 200, got 401',
+    });
+    assert.match(line, USER_LINE_REGEX);
+  });
+
+  test('rejects user line under 20 chars', () => {
+    assert.doesNotMatch('[USER] short', USER_LINE_REGEX);
+  });
+
+  test('manual mode accepts free-form within bounds', () => {
+    const line = `[USER] ${'x'.repeat(100)}`;
+    assert.match(line, USER_LINE_REGEX);
+  });
+});
+
+describe('File header structure', () => {
+  test('valid file header passes regex', () => {
+    assert.match('### File 1: src/auth/login.ts', FILE_HEADER_REGEX);
+    assert.match('### File 12: tests/e2e/checkout.spec.ts', FILE_HEADER_REGEX);
+  });
+
+  test('rejects malformed file headers', () => {
+    assert.doesNotMatch('### File: src/auth.ts', FILE_HEADER_REGEX);
+    assert.doesNotMatch('### file 1: src/auth.ts', FILE_HEADER_REGEX);
+    assert.doesNotMatch('## File 1: src/auth.ts', FILE_HEADER_REGEX);
+  });
+
+  test('files numbered sequentially from 1', () => {
+    const bundle = buildBundle({
+      systemLine: buildSystemLine(),
+      userLine: buildUserLine('manual', 'Why does the test fail intermittently?'),
+      files: [
+        { path: 'a.ts', content: 'a' },
+        { path: 'b.ts', content: 'b' },
+        { path: 'c.ts', content: 'c' },
+      ],
+    });
+    const result = validateBundle(bundle);
+    assert.strictEqual(result.valid, true, `unexpected errors: ${result.errors.join(', ')}`);
+  });
+});
+
+describe('Hard caps', () => {
+  test('rejects bundle with 13+ files', () => {
+    const files = Array.from({ length: 13 }, (_, i) => ({ path: `f${i}.ts`, content: 'x' }));
+    const bundle = buildBundle({ userLine: buildUserLine('manual', 'Why does this break under load?'), files });
+    const result = validateBundle(bundle);
+    assert.ok(result.errors.includes('too_many_files'));
+  });
+
+  test('accepts bundle with exactly 12 files', () => {
+    const files = Array.from({ length: 12 }, (_, i) => ({ path: `f${i}.ts`, content: 'x' }));
+    const bundle = buildBundle({ userLine: buildUserLine('manual', 'Why does this break under load?'), files });
+    const result = validateBundle(bundle);
+    assert.strictEqual(result.valid, true);
+  });
+
+  test('rejects bundle exceeding 400k chars total', () => {
+    const oversize = 'x'.repeat(50_000);
+    const files = Array.from({ length: 10 }, () => ({ path: 'big.ts', content: oversize }));
+    const bundle = buildBundle({ userLine: buildUserLine('manual', 'Why does this break under load?'), files });
+    const result = validateBundle(bundle);
+    assert.ok(result.errors.includes('bundle_too_large'));
+  });
+});
+
+describe('Secret redaction', () => {
+  test('redacts hardcoded api keys', () => {
+    const input = 'const apiKey = "sk-1234567890abcdef"';
+    const out = redactSecrets(input);
+    assert.match(out, /<REDACTED>/);
+    assert.doesNotMatch(out, /sk-1234567890abcdef/);
+  });
+
+  test('redacts Bearer tokens', () => {
+    const input = 'Authorization: Bearer abc123def456ghi789jkl000mno111';
+    const out = redactSecrets(input);
+    assert.match(out, /Bearer <REDACTED>/);
+  });
+
+  test('preserves non-secret content', () => {
+    const input = 'function login(user) { return user.id; }';
+    assert.strictEqual(redactSecrets(input), input);
+  });
+});
+
+describe('Signal naming compliance', () => {
+  const SIGNAL_PATTERN = /^[a-z][a-z0-9]*(\.[a-z][a-z0-9]*)+$/;
+
+  test('oracle.dispatched conforms to signal naming', () => {
+    assert.match('oracle.dispatched', SIGNAL_PATTERN);
+  });
+
+  test('oracle.response conforms to signal naming', () => {
+    assert.match('oracle.response', SIGNAL_PATTERN);
+  });
+
+  test('oracle.failed conforms to signal naming', () => {
+    assert.match('oracle.failed', SIGNAL_PATTERN);
+  });
+});

package/compiler/__tests__/oracle-pending-schema.test.js

@@ -0,0 +1,209 @@
+/**
+ * Oracle-pending record schema (v2.15+) — verify the JSON schema written by
+ * session-bridge detach mode. The pending file in .rune/oracle-pending/<id>.json
+ * is the rendezvous point between adversary (dispatcher) and primary agent
+ * (reattach poller).
+ *
+ * Validates:
+ *   - Required fields present + correct type
+ *   - sessionId pattern: oracle-<unix-ms>-<rand>
+ *   - bundleHash pattern: sha256:<hex>
+ *   - status enum: pending | complete | failed
+ *   - sourceSkill enum: debug | fix | manual
+ *   - Idempotency: same bundleHash returns same sessionId
+ *   - Timeout transition: pending → failed when now > timeoutAt
+ *   - Cleanup: records older than 24h dropped
+ */
+
+import assert from 'node:assert';
+import { describe, test } from 'node:test';
+
+const SESSION_ID_PATTERN = /^oracle-\d+-[a-z0-9]+$/;
+const BUNDLE_HASH_PATTERN = /^sha256:[a-f0-9]{8,64}$/;
+const STATUS_VALUES = new Set(['pending', 'complete', 'failed']);
+const SOURCE_SKILL_VALUES = new Set(['debug', 'fix', 'manual']);
+
+function isIso8601(s) {
+  if (typeof s !== 'string') return false;
+  const d = new Date(s);
+  return !Number.isNaN(d.getTime()) && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/.test(s);
+}
+
+function validatePendingRecord(rec) {
+  const errors = [];
+  if (typeof rec.sessionId !== 'string' || !SESSION_ID_PATTERN.test(rec.sessionId)) errors.push('invalid_sessionId');
+  if (!isIso8601(rec.dispatchedAt)) errors.push('invalid_dispatchedAt');
+  if (typeof rec.triggerSignal !== 'string') errors.push('invalid_triggerSignal');
+  if (!SOURCE_SKILL_VALUES.has(rec.sourceSkill)) errors.push('invalid_sourceSkill');
+  if (typeof rec.targetModel !== 'string') errors.push('invalid_targetModel');
+  if (typeof rec.bundleHash !== 'string' || !BUNDLE_HASH_PATTERN.test(rec.bundleHash))
+    errors.push('invalid_bundleHash');
+  if (!STATUS_VALUES.has(rec.status)) errors.push('invalid_status');
+  if (!isIso8601(rec.timeoutAt)) errors.push('invalid_timeoutAt');
+
+  // Conditional fields
+  if (rec.status === 'complete') {
+    if (rec.responseId === null || typeof rec.responseId !== 'string') errors.push('missing_responseId_when_complete');
+    if (rec.responseExcerpt === null || typeof rec.responseExcerpt !== 'string')
+      errors.push('missing_responseExcerpt_when_complete');
+    if (typeof rec.responseExcerpt === 'string' && rec.responseExcerpt.length > 500)
+      errors.push('responseExcerpt_too_long');
+  }
+  if (rec.status === 'pending') {
+    if (rec.responseId !== null) errors.push('responseId_must_be_null_when_pending');
+    if (rec.responseExcerpt !== null) errors.push('responseExcerpt_must_be_null_when_pending');
+  }
+  return { valid: errors.length === 0, errors };
+}
+
+function timeoutCheck(record, now) {
+  if (record.status !== 'pending') return record;
+  if (new Date(now).getTime() >= new Date(record.timeoutAt).getTime()) {
+    return { ...record, status: 'failed' };
+  }
+  return record;
+}
+
+function cleanupExpired(records, now, ttlMs = 24 * 60 * 60 * 1000) {
+  return records.filter((r) => new Date(now).getTime() - new Date(r.dispatchedAt).getTime() <= ttlMs);
+}
+
+function buildPending(overrides = {}) {
+  return {
+    sessionId: 'oracle-1714234500-abc123',
+    dispatchedAt: '2026-04-27T12:34:56Z',
+    triggerSignal: 'agent.stuck',
+    sourceSkill: 'debug',
+    targetModel: 'claude-opus-4-7',
+    bundleHash: 'sha256:9f3a4b5c6d7e8f90',
+    status: 'pending',
+    timeoutAt: '2026-04-27T12:44:56Z',
+    responseId: null,
+    responseExcerpt: null,
+    ...overrides,
+  };
+}
+
+describe('Pending record schema', () => {
+  test('valid pending record passes', () => {
+    const result = validatePendingRecord(buildPending());
+    assert.strictEqual(result.valid, true, `unexpected errors: ${result.errors.join(', ')}`);
+  });
+
+  test('valid complete record passes', () => {
+    const result = validatePendingRecord(
+      buildPending({
+        status: 'complete',
+        responseId: 'resp_xyz789',
+        responseExcerpt: 'Root cause: missing await on session refresh in middleware/auth.ts:47',
+      }),
+    );
+    assert.strictEqual(result.valid, true, `unexpected errors: ${result.errors.join(', ')}`);
+  });
+
+  test('valid failed record passes', () => {
+    const result = validatePendingRecord(buildPending({ status: 'failed' }));
+    assert.strictEqual(result.valid, true);
+  });
+
+  test('rejects invalid sessionId pattern', () => {
+    const result = validatePendingRecord(buildPending({ sessionId: 'NotAnOracleId' }));
+    assert.ok(result.errors.includes('invalid_sessionId'));
+  });
+
+  test('rejects invalid bundleHash pattern', () => {
+    const result = validatePendingRecord(buildPending({ bundleHash: 'md5:abc123' }));
+    assert.ok(result.errors.includes('invalid_bundleHash'));
+  });
+
+  test('rejects unknown status', () => {
+    const result = validatePendingRecord(buildPending({ status: 'in_flight' }));
+    assert.ok(result.errors.includes('invalid_status'));
+  });
+
+  test('rejects unknown sourceSkill', () => {
+    const result = validatePendingRecord(buildPending({ sourceSkill: 'review' }));
+    assert.ok(result.errors.includes('invalid_sourceSkill'));
+  });
+
+  test('complete record without responseId is invalid', () => {
+    const result = validatePendingRecord(buildPending({ status: 'complete' }));
+    assert.ok(result.errors.includes('missing_responseId_when_complete'));
+    assert.ok(result.errors.includes('missing_responseExcerpt_when_complete'));
+  });
+
+  test('responseExcerpt > 500 chars rejected', () => {
+    const result = validatePendingRecord(
+      buildPending({ status: 'complete', responseId: 'r', responseExcerpt: 'x'.repeat(501) }),
+    );
+    assert.ok(result.errors.includes('responseExcerpt_too_long'));
+  });
+
+  test('pending record with responseId set is invalid', () => {
+    const result = validatePendingRecord(buildPending({ responseId: 'r1' }));
+    assert.ok(result.errors.includes('responseId_must_be_null_when_pending'));
+  });
+});
+
+describe('Idempotency', () => {
+  test('same bundleHash returns same sessionId on duplicate dispatch', () => {
+    const existing = buildPending({ sessionId: 'oracle-1714234500-abc' });
+    const inbox = [existing];
+
+    const dispatch = (bundleHash) => {
+      const match = inbox.find((r) => r.bundleHash === bundleHash && r.status === 'pending');
+      if (match) return match.sessionId;
+      const newId = `oracle-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+      inbox.push(buildPending({ sessionId: newId, bundleHash }));
+      return newId;
+    };
+
+    const id1 = dispatch(existing.bundleHash);
+    const id2 = dispatch(existing.bundleHash);
+    assert.strictEqual(id1, id2);
+    assert.strictEqual(id1, existing.sessionId);
+  });
+});
+
+describe('Timeout transition', () => {
+  test('pending record becomes failed when now > timeoutAt', () => {
+    const record = buildPending({ timeoutAt: '2026-04-27T12:00:00Z' });
+    const after = timeoutCheck(record, '2026-04-27T13:00:00Z');
+    assert.strictEqual(after.status, 'failed');
+  });
+
+  test('pending stays pending when now < timeoutAt', () => {
+    const record = buildPending({ timeoutAt: '2026-04-27T13:00:00Z' });
+    const after = timeoutCheck(record, '2026-04-27T12:30:00Z');
+    assert.strictEqual(after.status, 'pending');
+  });
+
+  test('complete records not affected by timeout check', () => {
+    const record = buildPending({
+      status: 'complete',
+      responseId: 'r',
+      responseExcerpt: 'done',
+      timeoutAt: '2026-04-27T12:00:00Z',
+    });
+    const after = timeoutCheck(record, '2026-04-27T20:00:00Z');
+    assert.strictEqual(after.status, 'complete');
+  });
+});
+
+describe('Cleanup orphaned records', () => {
+  test('records >24h old are dropped', () => {
+    const records = [
+      buildPending({ sessionId: 'oracle-1-fresh', dispatchedAt: '2026-04-27T11:00:00Z' }),
+      buildPending({ sessionId: 'oracle-2-stale', dispatchedAt: '2026-04-25T11:00:00Z' }),
+    ];
+    const remaining = cleanupExpired(records, '2026-04-27T12:00:00Z');
+    assert.strictEqual(remaining.length, 1);
+    assert.strictEqual(remaining[0].sessionId, 'oracle-1-fresh');
+  });
+
+  test('records <24h old are kept', () => {
+    const records = [buildPending({ dispatchedAt: '2026-04-26T13:00:00Z' })];
+    const remaining = cleanupExpired(records, '2026-04-27T12:00:00Z');
+    assert.strictEqual(remaining.length, 1);
+  });
+});