@ryanfw/prompt-orchestration-pipeline 1.3.3 → 1.3.4

package/src/ui/server/embedded-assets-imports.d.ts

@@ -0,0 +1,44 @@
+// Ambient module declarations for non-HTML Vite asset file imports used by the
+// generated src/ui/server/embedded-assets.ts module. `*.html` is intentionally
+// left to bun-types (declared as `import("bun").HTMLBundle`); the generator
+// casts every emitted `path` value `as unknown as string` to bridge the type.
+declare module "*.js" {
+  const path: string;
+  export default path;
+}
+declare module "*.css" {
+  const path: string;
+  export default path;
+}
+declare module "*.svg" {
+  const path: string;
+  export default path;
+}
+declare module "*.map" {
+  const path: string;
+  export default path;
+}
+declare module "*.png" {
+  const path: string;
+  export default path;
+}
+declare module "*.jpg" {
+  const path: string;
+  export default path;
+}
+declare module "*.ico" {
+  const path: string;
+  export default path;
+}
+declare module "*.woff" {
+  const path: string;
+  export default path;
+}
+declare module "*.woff2" {
+  const path: string;
+  export default path;
+}
+declare module "*.ttf" {
+  const path: string;
+  export default path;
+}

package/src/ui/server/embedded-assets.ts

@@ -1,7 +1,18 @@
+// Auto-generated by scripts/generate-embedded-assets.js — do not edit
+import _asset0 from "../dist/assets/index-DN3-zvtP.js" with { type: "file" };
+import _asset1 from "../dist/assets/index-DN3-zvtP.js.map" with { type: "file" };
+import _asset2 from "../dist/assets/style-CtZBnjlR.css" with { type: "file" };
+import _asset3 from "../dist/index.html" with { type: "file" };
+
 export interface EmbeddedAssetEntry {
   path: string;
   mime: string;
 }
 
-// Generated during UI build for embedded/binary distributions.
-export const embeddedAssets: Record<string, EmbeddedAssetEntry> = {};
+export const embeddedAssets: Record<string, EmbeddedAssetEntry> = {
+  "/assets/index-DN3-zvtP.js": { path: _asset0 as unknown as string, mime: "application/javascript" },
+  "/assets/index-DN3-zvtP.js.map": { path: _asset1 as unknown as string, mime: "application/json" },
+  "/assets/style-CtZBnjlR.css": { path: _asset2 as unknown as string, mime: "text/css" },
+  "/": { path: _asset3 as unknown as string, mime: "text/html" },
+  "/index.html": { path: _asset3 as unknown as string, mime: "text/html" }
+};

package/src/ui/server/endpoints/__tests__/pipeline-analysis-endpoint.test.ts

@@ -0,0 +1,167 @@
+import { afterEach, beforeEach, describe, expect, it, mock } from "bun:test";
+import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import type { AnalysisResult } from "../../../../task-analysis/analyzer";
+
+// ─── Mock the analyzer so no LLM/gateway is exercised ─────────────────────────
+//     `analyzeResults` is keyed by task name; default is an `ok` result.
+const analyzeResults: Record<string, AnalysisResult> = {};
+let lastAnalyzedSource: string | null = null;
+
+function okResult(): AnalysisResult {
+  return {
+    summary: "does a thing",
+    stages: [{ name: "main", purpose: "runs" }],
+    artifacts: { reads: [], writes: [] },
+    models: [],
+    analysisStatus: "ok",
+  };
+}
+
+mock.module("../../../../task-analysis/analyzer", () => ({
+  analyzeTask: mock((code: string) => {
+    lastAnalyzedSource = code;
+    return Promise.resolve(analyzeResults[code] ?? okResult());
+  }),
+}));
+
+import { handlePipelineAnalysis } from "../pipeline-analysis-endpoint";
+import { TaskAnalysisRepository } from "../../../../task-analysis/repository";
+import { getLockStatus, releaseLock } from "../../../state/analysis-lock";
+
+// ─── SSE helpers ──────────────────────────────────────────────────────────────
+
+interface SseEvent {
+  event: string;
+  data: Record<string, unknown>;
+}
+
+async function readEvents(res: Response): Promise<SseEvent[]> {
+  const text = await res.text();
+  const events: SseEvent[] = [];
+  for (const block of text.split("\n\n")) {
+    const trimmed = block.trim();
+    if (!trimmed) continue;
+    const eventLine = trimmed.split("\n").find((l) => l.startsWith("event: "));
+    const dataLine = trimmed.split("\n").find((l) => l.startsWith("data: "));
+    if (!eventLine || !dataLine) continue;
+    events.push({
+      event: eventLine.slice("event: ".length),
+      data: JSON.parse(dataLine.slice("data: ".length)),
+    });
+  }
+  return events;
+}
+
+// ─── Fixture: a workspace root with a registry + one task source ──────────────
+
+let root: string;
+
+function writeWorkspace(tasks: Record<string, string>): void {
+  const tasksDir = join(root, "pipeline-config", "demo", "tasks");
+  mkdirSync(tasksDir, { recursive: true });
+
+  // Registry entry so resolvePipelineSync finds the slug.
+  const registry = { version: 1, pipelines: { demo: { name: "demo", description: "d" } } };
+  writeFileSync(join(root, "pipeline-config", "registry.json"), JSON.stringify(registry));
+
+  // Task registry index (default export: task name -> relative module path).
+  const entries = Object.keys(tasks)
+    .map((name) => `  ${JSON.stringify(name)}: ${JSON.stringify(`./${name}.ts`)},`)
+    .join("\n");
+  writeFileSync(join(tasksDir, "index.ts"), `export default {\n${entries}\n};\n`);
+
+  for (const [name, source] of Object.entries(tasks)) {
+    writeFileSync(join(tasksDir, `${name}.ts`), source);
+  }
+}
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), "po-analysis-"));
+  for (const key of Object.keys(analyzeResults)) delete analyzeResults[key];
+  lastAnalyzedSource = null;
+});
+
+afterEach(() => {
+  if (getLockStatus()) releaseLock(getLockStatus()!.pipelineSlug);
+  rmSync(root, { recursive: true, force: true });
+});
+
+describe("handlePipelineAnalysis", () => {
+  it("emits started, per-task task:start/task:complete, then complete", async () => {
+    writeWorkspace({ alpha: "// alpha source", beta: "// beta source" });
+
+    const res = await handlePipelineAnalysis(new Request("http://localhost/"), "demo", root);
+    const events = await readEvents(res);
+
+    expect(events[0]).toEqual({ event: "started", data: { slug: "demo", totalTasks: 2 } });
+
+    const names = events.map((e) => e.event);
+    expect(names).toEqual([
+      "started",
+      "task:start",
+      "task:complete",
+      "task:start",
+      "task:complete",
+      "complete",
+    ]);
+    expect(events.at(-1)).toEqual({ event: "complete", data: { slug: "demo" } });
+  });
+
+  it("persists each analyzed task via the repository", async () => {
+    writeWorkspace({ alpha: "// alpha source" });
+
+    const res = await handlePipelineAnalysis(new Request("http://localhost/"), "demo", root);
+    await readEvents(res);
+
+    const persisted = await TaskAnalysisRepository.read(root, "demo", "alpha");
+    expect(persisted?.analysisStatus).toBe("ok");
+    expect(persisted?.summary).toBe("does a thing");
+    expect(typeof persisted?.analyzedAt).toBe("string");
+  });
+
+  it("persists an error placeholder for a failing task yet still reaches complete", async () => {
+    writeWorkspace({ good: "// good source", bad: "// bad source" });
+    // Force the analyzer to throw for the bad task's source.
+    analyzeResults["// bad source"] = undefined as unknown as AnalysisResult;
+    const analyzerMod = await import("../../../../task-analysis/analyzer");
+    (analyzerMod.analyzeTask as ReturnType<typeof mock>).mockImplementation((code: string) => {
+      if (code === "// bad source") throw new Error("analyzer blew up");
+      return Promise.resolve(okResult());
+    });
+
+    const res = await handlePipelineAnalysis(new Request("http://localhost/"), "demo", root);
+    const events = await readEvents(res);
+
+    expect(events.at(-1)?.event).toBe("complete");
+    const errorEvent = events.find((e) => e.event === "error");
+    expect(errorEvent?.data["task"]).toBe("bad");
+
+    const badAnalysis = await TaskAnalysisRepository.read(root, "demo", "bad");
+    expect(badAnalysis?.analysisStatus).toBe("error");
+    expect(badAnalysis?.analysisError).toContain("analyzer blew up");
+
+    // Restore the default mock implementation for later tests.
+    (analyzerMod.analyzeTask as ReturnType<typeof mock>).mockImplementation((code: string) => {
+      lastAnalyzedSource = code;
+      return Promise.resolve(analyzeResults[code] ?? okResult());
+    });
+  });
+
+  it("blocks a concurrent run with a 409 while the lock is held", async () => {
+    writeWorkspace({ alpha: "// alpha source" });
+
+    // Acquire the lock by starting one run but not draining its stream.
+    const first = await handlePipelineAnalysis(new Request("http://localhost/"), "demo", root);
+
+    const second = await handlePipelineAnalysis(new Request("http://localhost/"), "demo", root);
+    expect(second.status).toBe(409);
+    const body = await second.json();
+    expect(body.code).toBe("BAD_REQUEST");
+
+    // Drain the first to release the lock.
+    await readEvents(first);
+  });
+});

package/src/ui/server/endpoints/__tests__/schema-file-endpoint.test.ts

@@ -0,0 +1,104 @@
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+
+import { handleSchemaFile } from "../schema-file-endpoint";
+
+const SLUG = "demo";
+
+async function ensureDir(dir: string): Promise<void> {
+  await mkdir(dir, { recursive: true });
+}
+
+describe("handleSchemaFile", () => {
+  let root: string;
+
+  beforeEach(async () => {
+    root = await mkdtemp(path.join(tmpdir(), "schema-file-endpoint-"));
+  });
+
+  afterEach(async () => {
+    await rm(root, { recursive: true, force: true });
+  });
+
+  it("rejects a plain `..` slug with 400 and does not serve a file outside pipeline-config", async () => {
+    await ensureDir(path.join(root, "schemas"));
+    await writeFile(path.join(root, "schemas", "schema.json"), "LEAKED");
+
+    const res = await handleSchemaFile(new Request("http://x"), "..", "schema.json", root);
+    const text = await res.text();
+
+    expect(res.status).toBe(400);
+    expect(text).not.toContain("LEAKED");
+    const body = JSON.parse(text) as { ok: boolean; code: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_REQUEST");
+  });
+
+  it("rejects an encoded traversal slug with 400", async () => {
+    const res = await handleSchemaFile(new Request("http://x"), "..%2f..", "schema.json", root);
+
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { ok: boolean; code: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_REQUEST");
+  });
+
+  it("rejects a traversal filename with 400 and does not read outside pipeline-config", async () => {
+    await ensureDir(path.join(root, "pipeline-config", SLUG, "schemas"));
+    await writeFile(path.join(root, "secret.json"), "LEAKED");
+
+    const res = await handleSchemaFile(
+      new Request("http://x"),
+      SLUG,
+      "..%2f..%2f..%2fsecret.json",
+      root,
+    );
+    const text = await res.text();
+
+    expect(res.status).toBe(400);
+    expect(text).not.toContain("LEAKED");
+    const body = JSON.parse(text) as { ok: boolean; code: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_REQUEST");
+  });
+
+  it("returns 200 with file contents for a valid request", async () => {
+    await ensureDir(path.join(root, "pipeline-config", SLUG, "schemas"));
+    await writeFile(
+      path.join(root, "pipeline-config", SLUG, "schemas", "schema.json"),
+      '{"type":"object"}',
+    );
+
+    const res = await handleSchemaFile(new Request("http://x"), SLUG, "schema.json", root);
+
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { ok: boolean; data: string };
+    expect(body.ok).toBe(true);
+    expect(body.data).toBe('{"type":"object"}');
+  });
+
+  it("returns 404 for a contained-but-missing schema file", async () => {
+    await ensureDir(path.join(root, "pipeline-config", SLUG, "schemas"));
+
+    const res = await handleSchemaFile(new Request("http://x"), SLUG, "missing.json", root);
+
+    expect(res.status).toBe(404);
+    const body = (await res.json()) as { ok: boolean; code: string; message: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("NOT_FOUND");
+  });
+
+  it("serves a legitimately percent-encoded filename (decode-once correctness)", async () => {
+    await ensureDir(path.join(root, "pipeline-config", SLUG, "schemas"));
+    await writeFile(path.join(root, "pipeline-config", SLUG, "schemas", "my file.json"), "ok");
+
+    const res = await handleSchemaFile(new Request("http://x"), SLUG, "my%20file.json", root);
+
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { ok: boolean; data: string };
+    expect(body.data).toBe("ok");
+  });
+});

package/src/ui/server/endpoints/__tests__/task-analysis-endpoint.test.ts

@@ -0,0 +1,103 @@
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+
+import { handleTaskAnalysis } from "../task-analysis-endpoint";
+import { TaskAnalysisRepository } from "../../../../task-analysis/repository";
+import type { PersistedTaskAnalysis } from "../../../../task-analysis/types";
+
+const SLUG = "demo-pipeline";
+const TASK = "extract";
+
+function makeAnalysis(): PersistedTaskAnalysis {
+  return {
+    summary: "Extracts structured fields from raw input.",
+    stages: [{ name: "extract", purpose: "Pull fields out." }],
+    artifacts: {
+      reads: [{ fileName: "input.json", role: "source" }],
+      writes: [{ fileName: "output.json", role: "result" }],
+    },
+    models: [{ provider: "deepseek", method: "chat", stage: "extract" }],
+    analyzedAt: "2026-06-22T00:00:00.000Z",
+    analysisStatus: "ok",
+  };
+}
+
+describe("handleTaskAnalysis", () => {
+  let root: string;
+
+  beforeEach(async () => {
+    root = await mkdtemp(path.join(tmpdir(), "task-analysis-endpoint-"));
+  });
+
+  afterEach(async () => {
+    await rm(root, { recursive: true, force: true });
+  });
+
+  it("returns a generated analysis written through the repository", async () => {
+    const analysis = makeAnalysis();
+    await TaskAnalysisRepository.write(root, SLUG, TASK, analysis);
+
+    const res = await handleTaskAnalysis(new Request("http://x"), SLUG, TASK, root);
+
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { ok: boolean; data: PersistedTaskAnalysis };
+    expect(body.ok).toBe(true);
+    expect(body.data).toEqual(analysis);
+  });
+
+  it("returns 404 only when the analysis is truly absent", async () => {
+    const res = await handleTaskAnalysis(new Request("http://x"), SLUG, "missing-task", root);
+
+    expect(res.status).toBe(404);
+    const body = (await res.json()) as { ok: boolean; code: string; message: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("NOT_FOUND");
+  });
+
+  it("returns 400 and does not read outside pipeline-config for a traversal slug", async () => {
+    const sentinelDir = path.join(root, "tasks");
+    await mkdir(sentinelDir, { recursive: true });
+    const sentinelPayload = "SENTINEL_OUTSIDE_PIPELINE_CONFIG";
+    await writeFile(path.join(sentinelDir, `${TASK}.analysis.json`), sentinelPayload);
+
+    const res = await handleTaskAnalysis(new Request("http://x"), "..", TASK, root);
+
+    expect(res.status).toBe(400);
+    const text = await res.text();
+    expect(text).not.toContain(sentinelPayload);
+    const body = JSON.parse(text) as { ok: boolean; code: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_PATH");
+  });
+
+  it("returns 400 and does not read outside pipeline-config for a traversal taskId", async () => {
+    const sentinelPayload = "SENTINEL_OUTSIDE_ROOT_VIA_TASKID";
+    await writeFile(path.join(root, "secret.analysis.json"), sentinelPayload);
+
+    const res = await handleTaskAnalysis(
+      new Request("http://x"),
+      SLUG,
+      "..%2f..%2f..%2fsecret",
+      root,
+    );
+
+    expect(res.status).toBe(400);
+    const text = await res.text();
+    expect(text).not.toContain(sentinelPayload);
+    const body = JSON.parse(text) as { ok: boolean; code: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_PATH");
+  });
+
+  it("returns 400 for a malformed percent-encoded slug", async () => {
+    const res = await handleTaskAnalysis(new Request("http://x"), "%zz", TASK, root);
+
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { ok: boolean; code: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_PATH");
+  });
+});