@ryanfw/prompt-orchestration-pipeline 1.3.3 → 1.3.4

package/src/ui/server/__tests__/file-endpoints.test.ts

@@ -5,7 +5,7 @@ import path from "node:path";
 import { afterEach, describe, expect, it } from "vitest";
 
 import { handleTaskFile, handleTaskFileList } from "../endpoints/file-endpoints";
-import { initPATHS, resetPATHS } from "../config-bridge-node";
+import { resetPATHS } from "../config-bridge-node";
 
 const tempRoots: string[] = [];
 
@@ -26,7 +26,6 @@ describe("file endpoints", () => {
   it("lists task files from tasks-status metadata", async () => {
     const root = await makeTempRoot();
     process.env["PO_ROOT"] = root;
-    initPATHS(root);
 
     const jobDir = path.join(root, "pipeline-data", "current", "job-1");
     await mkdir(path.join(jobDir, "files", "artifacts"), { recursive: true });
@@ -46,7 +45,7 @@ describe("file endpoints", () => {
       }),
     );
 
-    const response = await handleTaskFileList(new Request("http://localhost/api/jobs/job-1/tasks/research/files?type=artifacts"), "job-1", "research");
+    const response = await handleTaskFileList(new Request("http://localhost/api/jobs/job-1/tasks/research/files?type=artifacts"), "job-1", "research", root);
 
     expect(response.status).toBe(200);
     await expect(response.json()).resolves.toEqual({ ok: true, data: ["research-output.json"] });
@@ -55,7 +54,6 @@ describe("file endpoints", () => {
   it("reads task-owned files from the shared job files directory", async () => {
     const root = await makeTempRoot();
     process.env["PO_ROOT"] = root;
-    initPATHS(root);
 
     const jobDir = path.join(root, "pipeline-data", "current", "job-1");
     await mkdir(path.join(jobDir, "files", "artifacts"), { recursive: true });
@@ -80,6 +78,7 @@ describe("file endpoints", () => {
       new Request("http://localhost/api/jobs/job-1/tasks/research/file?type=artifacts&filename=research-output.json"),
       "job-1",
       "research",
+      root,
     );
 
     expect(response.status).toBe(200);
@@ -93,7 +92,6 @@ describe("file endpoints", () => {
   it("rejects files not declared for the task", async () => {
     const root = await makeTempRoot();
     process.env["PO_ROOT"] = root;
-    initPATHS(root);
 
     const jobDir = path.join(root, "pipeline-data", "current", "job-1");
     await mkdir(path.join(jobDir, "files", "artifacts"), { recursive: true });
@@ -118,6 +116,7 @@ describe("file endpoints", () => {
       new Request("http://localhost/api/jobs/job-1/tasks/research/file?type=artifacts&filename=other.json"),
       "job-1",
       "research",
+      root,
     );
 
     expect(response.status).toBe(404);
@@ -127,4 +126,183 @@ describe("file endpoints", () => {
       message: "file not found for task: artifacts/other.json",
     });
   });
+
+  it("reads files from the threaded root, ignoring PO_ROOT (AC-5)", async () => {
+    const threadedRoot = await makeTempRoot();
+    const envRoot = await makeTempRoot();
+    process.env["PO_ROOT"] = envRoot;
+
+    const jobDir = path.join(threadedRoot, "pipeline-data", "current", "job-1");
+    await mkdir(path.join(jobDir, "files", "artifacts"), { recursive: true });
+    await writeFile(path.join(jobDir, "files", "artifacts", "threaded.json"), '{"source":"threaded"}\n');
+    await writeFile(
+      path.join(jobDir, "tasks-status.json"),
+      JSON.stringify({
+        id: "job-1",
+        tasks: {
+          research: {
+            files: {
+              artifacts: ["threaded.json"],
+              logs: [],
+              tmp: [],
+            },
+          },
+        },
+      }),
+    );
+
+    const response = await handleTaskFile(
+      new Request("http://localhost/api/jobs/job-1/tasks/research/file?type=artifacts&filename=threaded.json"),
+      "job-1",
+      "research",
+      threadedRoot,
+    );
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toMatchObject({
+      ok: true,
+      data: '{"source":"threaded"}\n',
+      mime: "application/json",
+    });
+  });
+
+  it("rejects a traversal type query param with 400 (AC-5)", async () => {
+    const root = await makeTempRoot();
+    process.env["PO_ROOT"] = root;
+
+    const jobDir = path.join(root, "pipeline-data", "current", "job-1");
+    await mkdir(path.join(jobDir, "files", "artifacts"), { recursive: true });
+    await writeFile(
+      path.join(jobDir, "tasks-status.json"),
+      JSON.stringify({
+        id: "job-1",
+        tasks: { research: { files: { artifacts: ["x.json"], logs: [], tmp: [] } } },
+      }),
+    );
+
+    const response = await handleTaskFile(
+      new Request("http://localhost/api/jobs/job-1/tasks/research/file?type=../..&filename=x.json"),
+      "job-1",
+      "research",
+      root,
+    );
+
+    expect(response.status).toBe(400);
+    await expect(response.json()).resolves.toEqual({ ok: false, code: "BAD_REQUEST", message: "invalid filename" });
+  });
+
+  it("rejects a traversal filename query param with 400 (AC-5)", async () => {
+    const root = await makeTempRoot();
+    process.env["PO_ROOT"] = root;
+
+    const jobDir = path.join(root, "pipeline-data", "current", "job-1");
+    await mkdir(path.join(jobDir, "files", "artifacts"), { recursive: true });
+    await writeFile(
+      path.join(jobDir, "tasks-status.json"),
+      JSON.stringify({
+        id: "job-1",
+        tasks: { research: { files: { artifacts: ["x.json"], logs: [], tmp: [] } } },
+      }),
+    );
+
+    const response = await handleTaskFile(
+      new Request("http://localhost/api/jobs/job-1/tasks/research/file?type=artifacts&filename=../../secret"),
+      "job-1",
+      "research",
+      root,
+    );
+
+    expect(response.status).toBe(400);
+    await expect(response.json()).resolves.toEqual({ ok: false, code: "BAD_REQUEST", message: "invalid filename" });
+  });
+
+  it("returns 404 for a listed-but-absent task file (AC-5)", async () => {
+    const root = await makeTempRoot();
+    process.env["PO_ROOT"] = root;
+
+    const jobDir = path.join(root, "pipeline-data", "current", "job-1");
+    await mkdir(path.join(jobDir, "files", "artifacts"), { recursive: true });
+    await writeFile(
+      path.join(jobDir, "tasks-status.json"),
+      JSON.stringify({
+        id: "job-1",
+        tasks: { research: { files: { artifacts: ["ghost.json"], logs: [], tmp: [] } } },
+      }),
+    );
+
+    const response = await handleTaskFile(
+      new Request("http://localhost/api/jobs/job-1/tasks/research/file?type=artifacts&filename=ghost.json"),
+      "job-1",
+      "research",
+      root,
+    );
+
+    expect(response.status).toBe(404);
+    await expect(response.json()).resolves.toEqual({
+      ok: false,
+      code: "NOT_FOUND",
+      message: "file not found for task: artifacts/ghost.json",
+    });
+  });
+
+  it("reads a nested filename listed in task metadata (AC-5)", async () => {
+    const root = await makeTempRoot();
+    process.env["PO_ROOT"] = root;
+
+    const jobDir = path.join(root, "pipeline-data", "current", "job-1");
+    await mkdir(path.join(jobDir, "files", "artifacts", "data"), { recursive: true });
+    await writeFile(path.join(jobDir, "files", "artifacts", "data", "foo.json"), '{"nested":true}\n');
+    await writeFile(
+      path.join(jobDir, "tasks-status.json"),
+      JSON.stringify({
+        id: "job-1",
+        tasks: { research: { files: { artifacts: ["data/foo.json"], logs: [], tmp: [] } } },
+      }),
+    );
+
+    const response = await handleTaskFile(
+      new Request("http://localhost/api/jobs/job-1/tasks/research/file?type=artifacts&filename=data/foo.json"),
+      "job-1",
+      "research",
+      root,
+    );
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toMatchObject({
+      ok: true,
+      data: '{"nested":true}\n',
+      mime: "application/json",
+    });
+  });
+
+  it("does not double-decode already-decoded query values (AC-5)", async () => {
+    const root = await makeTempRoot();
+    process.env["PO_ROOT"] = root;
+
+    const jobDir = path.join(root, "pipeline-data", "current", "job-1");
+    await mkdir(path.join(jobDir, "files", "artifacts"), { recursive: true });
+    await writeFile(path.join(root, "secret.json"), "LEAKED");
+    await writeFile(
+      path.join(jobDir, "tasks-status.json"),
+      JSON.stringify({
+        id: "job-1",
+        tasks: { research: { files: { artifacts: ["real.json"], logs: [], tmp: [] } } },
+      }),
+    );
+
+    const response = await handleTaskFile(
+      new Request("http://localhost/api/jobs/job-1/tasks/research/file?type=artifacts&filename=%252e%252e"),
+      "job-1",
+      "research",
+      root,
+    );
+
+    expect(response.status).toBe(404);
+    await expect(response.json()).resolves.toEqual({
+      ok: false,
+      code: "NOT_FOUND",
+      message: "file not found for task: artifacts/%2e%2e",
+    });
+    expect(await Bun.file(path.join(root, "secret.json")).text()).toBe("LEAKED");
+  });
 });

package/src/ui/server/__tests__/gate-endpoints.test.ts

@@ -168,6 +168,61 @@ describe("handleGateDecision", () => {
     expect(events[0]).toMatchObject({ type: "gate_decided", action: "reject", afterTask: "plan", note: "needs another pass" });
   });
 
+  it("rejecting a control_invalid gate marks the job failed while preserving task done + controlError (AC-10)", async () => {
+    const root = await makeTempRoot();
+    initPATHS(root);
+    const jobId = "reject-control-invalid-job";
+    const statusOverride = makeSnapshot({
+      gate: {
+        afterTask: "plan",
+        kind: "control_invalid",
+        message: "Control file invalid for plan: bad patch. Repair tasks/plan/control.json and approve to retry.",
+        requestedAt: "2026-04-01T10:00:00.000Z",
+      },
+      tasks: {
+        plan: {
+          state: "done",
+          executionTimeMs: 99,
+          refinementAttempts: 1,
+          controlApplied: false,
+          controlError: { message: "bad patch", violations: ["bad patch"] },
+        },
+        implement: { state: "pending" },
+      },
+    });
+    const jobDir = await setupJob(root, jobId, statusOverride);
+    const spawnSpy = vi.spyOn(Bun, "spawn");
+
+    const res = await handleGateDecision(
+      jobId,
+      gateRequest(jobId, { action: "reject", note: "control file is too broken" }),
+      root,
+    );
+    const body = await res.json() as Record<string, unknown>;
+
+    expect(res.status).toBe(202);
+    expect(body).toMatchObject({ ok: true, jobId, action: "reject", spawned: false });
+    expect(spawnSpy).not.toHaveBeenCalled();
+
+    const snapshot = await readJobStatus(jobDir);
+    expect(snapshot!.state).toBe("failed");
+    expect(snapshot!.gate).toBeNull();
+    expect(snapshot!["error"]).toEqual({ name: "GateRejected", message: "control file is too broken" });
+
+    const task = snapshot!.tasks["plan"] as {
+      state?: string;
+      executionTimeMs?: number;
+      refinementAttempts?: number;
+      controlApplied?: boolean;
+      controlError?: { message?: string; violations?: string[] };
+    };
+    expect(task.state).toBe("done");
+    expect(task.executionTimeMs).toBe(99);
+    expect(task.refinementAttempts).toBe(1);
+    expect(task.controlApplied).toBe(false);
+    expect(task.controlError).toEqual({ message: "bad patch", violations: ["bad patch"] });
+  });
+
   it("returns 409 when another gate decision already holds the job slot", async () => {
     const root = await makeTempRoot();
     initPATHS(root);

package/src/ui/server/__tests__/index.test.ts

@@ -80,6 +80,28 @@ describe("server index", () => {
       await handle.close();
     }
   });
+
+  it("rejects startServer before binding when env config is invalid", async () => {
+    const root = await makeTempRoot();
+    const priorPoRoot = process.env["PO_ROOT"];
+    const priorMaxRunningJobs = process.env["PO_MAX_RUNNING_JOBS"];
+    const serveSpy = vi.spyOn(Bun, "serve");
+    try {
+      process.env["PO_ROOT"] = root;
+      process.env["PO_MAX_RUNNING_JOBS"] = "foo";
+      resetConfig();
+
+      await expect(startServer({ dataDir: root, port: 4113 })).rejects.toThrow(/PO_MAX_RUNNING_JOBS/);
+      expect(serveSpy).not.toHaveBeenCalled();
+    } finally {
+      serveSpy.mockRestore();
+      if (priorMaxRunningJobs === undefined) delete process.env["PO_MAX_RUNNING_JOBS"];
+      else process.env["PO_MAX_RUNNING_JOBS"] = priorMaxRunningJobs;
+      if (priorPoRoot === undefined) delete process.env["PO_ROOT"];
+      else process.env["PO_ROOT"] = priorPoRoot;
+      resetConfig();
+    }
+  });
 });
 
 describe("initializeWatcher concurrency paths", () => {
@@ -151,3 +173,44 @@ describe("initializeWatcher concurrency paths", () => {
     spy.mockRestore();
   });
 });
+
+describe("startServer workspace-root resolution (AC-7)", () => {
+  it("resolves via explicit dataDir even when PO_ROOT points elsewhere", async () => {
+    const explicitRoot = await makeTempRoot();
+    const envRoot = await makeTempRoot();
+    const priorPoRoot = process.env["PO_ROOT"];
+
+    try {
+      process.env["PO_ROOT"] = envRoot;
+      await mkdir(path.join(explicitRoot, "pipeline-data", "current", "explicit-job"), { recursive: true });
+      await writeFile(
+        path.join(explicitRoot, "pipeline-data", "current", "explicit-job", "tasks-status.json"),
+        '{"id":"explicit-job","tasks":{}}',
+      );
+
+      const handle = await startServer({ dataDir: explicitRoot, port: 4114 });
+      try {
+        const response = await fetch(`${handle.url}/api/jobs/explicit-job`);
+        expect(response.status).toBe(200);
+      } finally {
+        await handle.close();
+      }
+    } finally {
+      if (priorPoRoot === undefined) delete process.env["PO_ROOT"];
+      else process.env["PO_ROOT"] = priorPoRoot;
+    }
+  });
+
+  it("throws the resolver error when PO_ROOT is unset and dataDir is empty", async () => {
+    const priorPoRoot = process.env["PO_ROOT"];
+    try {
+      delete process.env["PO_ROOT"];
+      await expect(
+        startServer({ dataDir: "" as string, port: 4115 }),
+      ).rejects.toThrow(/Workspace root is required/);
+    } finally {
+      if (priorPoRoot === undefined) delete process.env["PO_ROOT"];
+      else process.env["PO_ROOT"] = priorPoRoot;
+    }
+  });
+});