@salesforce/afv-skills 1.13.0 → 1.15.0

package/skills/investigating-agentforce-architecture/scripts/tests/test_resolve_bot.py

@@ -0,0 +1,203 @@
+"""Tests for ``resolve_bot`` — Bot + version resolution helpers + main flow.
+
+Covers the small pure helpers (``scrub``, ``natural_key``,
+``emit_error_block``) plus a happy-path ``main`` end-to-end with
+``subprocess.run`` mocked.
+"""
+from __future__ import annotations
+
+import json
+import os
+import unittest
+from pathlib import Path
+from tempfile import TemporaryDirectory
+from types import SimpleNamespace
+from unittest import mock
+
+from . import _bootstrap  # noqa: F401  — sys.path setup
+
+import resolve_bot  # type: ignore
+
+
+# -----------------------------------------------------------------------------
+# scrub
+# -----------------------------------------------------------------------------
+
+
+class ScrubTests(unittest.TestCase):
+
+    def test_strips_dangerous_shell_chars(self):
+        # ` $ " \\ \r \t \0 \n all stripped; safe chars kept verbatim.
+        self.assertEqual(
+            resolve_bot.scrub("hello`bad$\"" + "\n" + "world"),
+            "hellobadworld",
+        )
+
+    def test_strips_carriage_return_and_tab(self):
+        self.assertEqual(resolve_bot.scrub("a\tb\rc"), "abc")
+
+    def test_returns_empty_string_for_none(self):
+        self.assertEqual(resolve_bot.scrub(None), "")
+
+    def test_coerces_non_strings(self):
+        self.assertEqual(resolve_bot.scrub(42), "42")
+
+    def test_passes_safe_chars_through(self):
+        self.assertEqual(resolve_bot.scrub("Customer_Support_Agent"),
+                         "Customer_Support_Agent")
+
+
+# -----------------------------------------------------------------------------
+# natural_key — version sorting
+# -----------------------------------------------------------------------------
+
+
+class NaturalKeyTests(unittest.TestCase):
+
+    def test_sorts_v10_after_v9(self):
+        keys = ["v9", "v10", "v2", "v1"]
+        keys.sort(key=resolve_bot.natural_key, reverse=True)
+        self.assertEqual(keys, ["v10", "v9", "v2", "v1"])
+
+    def test_handles_none_and_empty_string(self):
+        # Both should be safe (empty list)
+        self.assertEqual(resolve_bot.natural_key(""), [""])
+        self.assertEqual(resolve_bot.natural_key(None), [""])
+
+
+# -----------------------------------------------------------------------------
+# emit_error_block — terminal RESULT block + sys.exit
+# -----------------------------------------------------------------------------
+
+
+class EmitErrorBlockTests(unittest.TestCase):
+
+    def test_emits_result_block_and_exits_one(self):
+        old_env = dict(os.environ)
+        os.environ["AGENT_API_NAME"] = "MyAgent"
+        os.environ["ORG_ID_15"] = "00D000000000000"
+        os.environ["ORG_ID_18"] = "00D000000000000EAA"
+        os.environ.pop("ERROR_TEE", None)
+        try:
+            with mock.patch.object(resolve_bot.sys, "stdout") as out:
+                with self.assertRaises(SystemExit) as ctx:
+                    resolve_bot.emit_error_block(
+                        "AGENT_NOT_FOUND", "details here", {"AVAILABLE_BOTS": "A,B"},
+                    )
+            self.assertEqual(ctx.exception.code, 1)
+            written = "".join(c.args[0] for c in out.write.call_args_list)
+            self.assertIn("STATUS=AGENT_NOT_FOUND", written)
+            self.assertIn("ERROR_DETAIL=details here", written)
+            self.assertIn("AGENT_API_NAME=MyAgent", written)
+            self.assertIn("AVAILABLE_BOTS=A,B", written)
+        finally:
+            os.environ.clear()
+            os.environ.update(old_env)
+
+    def test_writes_error_tee_when_env_set(self):
+        with TemporaryDirectory() as t:
+            tee_path = Path(t) / "subdir" / "tee.txt"
+            old_env = dict(os.environ)
+            os.environ["ERROR_TEE"] = str(tee_path)
+            os.environ["AGENT_API_NAME"] = "MyAgent"
+            os.environ["ORG_ID_15"] = "x"
+            os.environ["ORG_ID_18"] = "y"
+            try:
+                with mock.patch.object(resolve_bot.sys, "stdout"):
+                    with self.assertRaises(SystemExit):
+                        resolve_bot.emit_error_block("X", "y", {})
+                # tee_path got the same content
+                self.assertTrue(tee_path.is_file())
+                self.assertIn("STATUS=X", tee_path.read_text())
+            finally:
+                os.environ.clear()
+                os.environ.update(old_env)
+
+
+# -----------------------------------------------------------------------------
+# main — happy path with mocked sf data query
+# -----------------------------------------------------------------------------
+
+
+def _versions_payload() -> str:
+    return json.dumps({
+        "result": {
+            "records": [
+                {"DeveloperName": "v3", "Status": "Active",
+                 "BotDefinitionId": "0Xx000000000ABC",
+                 "BotDefinition": {"DeveloperName": "MyAgent",
+                                   "MasterLabel": "My Agent"}},
+                {"DeveloperName": "v2", "Status": "Inactive",
+                 "BotDefinitionId": "0Xx000000000ABC",
+                 "BotDefinition": {"DeveloperName": "MyAgent",
+                                   "MasterLabel": "My Agent"}},
+            ],
+        },
+    })
+
+
+def _bot_def_payload() -> str:
+    return json.dumps({
+        "result": {
+            "records": [
+                {"DeveloperName": "MyAgent", "MasterLabel": "My Agent",
+                 "Description": "demo", "AgentType": "Internal",
+                 "Type": "AiCopilot", "AgentTemplate": "T",
+                 "BotSource": "AgentforceAgentCopilot"},
+            ],
+        },
+    })
+
+
+class MainTests(unittest.TestCase):
+
+    def _run_main(self, *, agent_version: str = "") -> tuple[int, str]:
+        old_env = dict(os.environ)
+        with TemporaryDirectory() as t:
+            tmp = Path(t)
+            os.environ["ORG_ALIAS"] = "my-org"
+            os.environ["AGENT_API_NAME"] = "MyAgent"
+            os.environ["WORK_DIR"] = str(tmp)
+            os.environ["AGENT_VERSION"] = agent_version
+
+            calls: list = []
+
+            def fake_run(argv, **kw):
+                # Two distinct sf data queries: BotVersion then BotDefinition
+                calls.append(argv)
+                if "BotVersion" in argv[-1]:
+                    return SimpleNamespace(returncode=0, stdout=_versions_payload(), stderr="")
+                if "BotDefinition" in argv[-1]:
+                    return SimpleNamespace(returncode=0, stdout=_bot_def_payload(), stderr="")
+                return SimpleNamespace(returncode=0, stdout="{}", stderr="")
+
+            stdout_buf: list[str] = []
+
+            try:
+                with mock.patch.object(resolve_bot.subprocess, "run", side_effect=fake_run):
+                    with mock.patch.object(resolve_bot.sys, "stdout") as out:
+                        out.write = lambda s: stdout_buf.append(s)
+                        rc = resolve_bot.main()
+            finally:
+                os.environ.clear()
+                os.environ.update(old_env)
+        return rc, "".join(stdout_buf)
+
+    def test_main_succeeds_with_auto_pick(self):
+        rc, written = self._run_main()
+        self.assertEqual(rc, 0)
+        # v3 is Active and lexically highest → auto-picked
+        self.assertIn("AGENT_VERSION=v3", written)
+        self.assertIn("VERSION_AUTO_PICKED=true", written)
+        self.assertIn("BOT_FOUND=true", written)
+        self.assertIn("BOT_ID=0Xx000000000ABC", written)
+
+    def test_main_succeeds_with_explicit_version_match(self):
+        rc, written = self._run_main(agent_version="v2")
+        self.assertEqual(rc, 0)
+        self.assertIn("AGENT_VERSION=v2", written)
+        self.assertIn("VERSION_AUTO_PICKED=false", written)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/skills/investigating-agentforce-architecture/scripts/tests/test_resolve_creds.py

@@ -0,0 +1,157 @@
+"""Tests for ``main._resolve_creds`` — the two-path access-token retrieval
+introduced for forcedotcom/cli#3560 (sf CLI v2 redaction, effective
+2026-05-27).
+
+Path 1 (primary): ``sf org auth show-access-token --json --no-prompt``
+                  via the ``show_access_token`` recipe.
+Path 2 (fallback): ``sf org display`` payload with
+                   ``SF_TEMP_SHOW_SECRETS=true`` env var.
+
+We mock ``run_sf`` (not subprocess) since these tests target the
+orchestration logic in ``main.py``, not the recipe loader. The recipe
+loader and subprocess env injection have their own coverage in
+``test_sf_cli.py``.
+"""
+from __future__ import annotations
+
+import unittest
+from unittest import mock
+
+from . import _bootstrap  # noqa: F401  — sys.path setup
+
+import main  # type: ignore
+from sf_cli import AuthRequired, SfCliError  # type: ignore
+
+
+REDACTED_TOKEN = "[REDACTED] Use 'sf org auth show-access-token' to view"
+
+
+def _display_payload(*, instance_url="https://example.salesforce.com",
+                     access_token="TOKEN_FROM_DISPLAY"):
+    return {"result": {
+        "instanceUrl": instance_url,
+        "accessToken": access_token,
+    }}
+
+
+def _show_token_payload(*, access_token="TOKEN_FROM_SHOW"):
+    return {"result": {"accessToken": access_token}}
+
+
+class ResolveCredsTests(unittest.TestCase):
+    """Cover every branch of the two-path retrieval."""
+
+    def _route(self, *, primary_payload=None, primary_exc=None,
+               display_payload=None):
+        """Build a ``run_sf`` side-effect that dispatches by recipe name."""
+        display = display_payload or _display_payload()
+        primary = primary_payload or _show_token_payload()
+
+        def fake_run_sf(name, **params):
+            if name == "org_display":
+                return display
+            if name == "show_access_token":
+                if primary_exc is not None:
+                    raise primary_exc
+                return primary
+            raise AssertionError(f"unexpected recipe: {name}")
+
+        return fake_run_sf
+
+    def test_primary_path_returns_show_token(self):
+        """Happy path — dedicated command returns a clean token."""
+        with mock.patch.object(main, "run_sf", side_effect=self._route()):
+            url, token = main._resolve_creds("my-org")
+        self.assertEqual(url, "https://example.salesforce.com")
+        self.assertEqual(token, "TOKEN_FROM_SHOW")
+
+    def test_primary_unknown_falls_back_to_display(self):
+        """Older sf CLI without the dedicated command surfaces SfCliError;
+        we fall back to the display payload's accessToken."""
+        with mock.patch.object(
+            main, "run_sf",
+            side_effect=self._route(
+                primary_exc=SfCliError("sf CLI 'show_access_token' failed"),
+            ),
+        ):
+            url, token = main._resolve_creds("my-org")
+        self.assertEqual(url, "https://example.salesforce.com")
+        self.assertEqual(token, "TOKEN_FROM_DISPLAY")
+
+    def test_primary_returns_redacted_token_falls_back(self):
+        """Edge case: dedicated command runs cleanly but returns the
+        placeholder string. Treat as failure and use the display fallback."""
+        with mock.patch.object(
+            main, "run_sf",
+            side_effect=self._route(
+                primary_payload=_show_token_payload(access_token=REDACTED_TOKEN),
+            ),
+        ):
+            _, token = main._resolve_creds("my-org")
+        self.assertEqual(token, "TOKEN_FROM_DISPLAY")
+
+    def test_primary_returns_empty_token_falls_back(self):
+        """Empty string from the dedicated command also triggers fallback."""
+        with mock.patch.object(
+            main, "run_sf",
+            side_effect=self._route(
+                primary_payload=_show_token_payload(access_token=""),
+            ),
+        ):
+            _, token = main._resolve_creds("my-org")
+        self.assertEqual(token, "TOKEN_FROM_DISPLAY")
+
+    def test_both_paths_redacted_raises_authrequired(self):
+        """If both paths come back redacted/empty, surface AuthRequired
+        rather than handing the placeholder to downstream Tooling/REST
+        callers (which would 401 with INVALID_AUTH_HEADER)."""
+        with mock.patch.object(
+            main, "run_sf",
+            side_effect=self._route(
+                primary_payload=_show_token_payload(access_token=REDACTED_TOKEN),
+                display_payload=_display_payload(access_token=REDACTED_TOKEN),
+            ),
+        ):
+            with self.assertRaises(AuthRequired) as ctx:
+                main._resolve_creds("my-org")
+        self.assertIn("could not retrieve a usable access token", str(ctx.exception))
+
+    def test_missing_instance_url_raises_authrequired(self):
+        """display returning empty instanceUrl is a hard failure — no
+        amount of token-juggling helps if we can't talk to the org."""
+        with mock.patch.object(
+            main, "run_sf",
+            side_effect=self._route(
+                display_payload=_display_payload(instance_url=""),
+            ),
+        ):
+            with self.assertRaises(AuthRequired) as ctx:
+                main._resolve_creds("my-org")
+        self.assertIn("instanceUrl", str(ctx.exception))
+
+    def test_primary_path_recipe_name_is_show_access_token(self):
+        """Tripwire — the primary call MUST go through the
+        ``show_access_token`` recipe. Without it the patch silently
+        regresses to the env-var-only path on sf CLI versions that
+        already shipped the dedicated command."""
+        recipes_called: list[str] = []
+
+        def fake_run_sf(name, **params):
+            recipes_called.append(name)
+            if name == "org_display":
+                return _display_payload()
+            if name == "show_access_token":
+                return _show_token_payload()
+            raise AssertionError(f"unexpected recipe: {name}")
+
+        with mock.patch.object(main, "run_sf", side_effect=fake_run_sf):
+            main._resolve_creds("my-org")
+
+        self.assertIn("show_access_token", recipes_called)
+        # And the alias was passed through:
+        # (We don't capture params here, but the recipe loader enforces
+        # required_params at run_sf time — see test_sf_cli.py.)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/skills/investigating-agentforce-architecture/scripts/tests/test_resolve_invocation_target.py

@@ -0,0 +1,145 @@
+"""Tests for resolve_invocation_target.resolve_target_id never raises,
+and `resolve_or_unresolved` records unknown prefixes + invalid shapes into
+`_unresolved[]` so the wave orchestrator can keep running when Salesforce
+ships a new NGA target type.
+"""
+from __future__ import annotations
+
+import unittest
+
+from . import _bootstrap  # noqa: F401
+
+import resolve_invocation_target as rit  # type: ignore
+
+
+# A valid-shape Salesforce Id is 15 or 18 alphanumeric chars. Prefixes below
+# are chosen to avoid collision with _PREFIX_MAP so they exercise the
+# "unknown prefix" path.
+_APEX_ID_15 = "01p0000000ABC12"
+_APEX_ID_18 = "01p0000000ABC12AAA"
+_FLOW_DEF_ID_15 = "3000000000XYZ99"
+_FLOW_VER_ID_15 = "3010000000XYZ99"
+_PROMPT_ID_15 = "0hf0000000QRS77"
+_UNKNOWN_PREFIX_ID_15 = "0aN000000000XYZ"
+
+
+class KnownPrefixTests(unittest.TestCase):
+    def test_apex_prefix(self):
+        self.assertEqual(rit.resolve_target_id(_APEX_ID_15), ("apex", "tooling_soql"))
+
+    def test_flow_definition_prefix(self):
+        self.assertEqual(
+            rit.resolve_target_id(_FLOW_DEF_ID_15),
+            ("flow_definition", "tooling_soql"),
+        )
+
+    def test_flow_version_prefix(self):
+        self.assertEqual(
+            rit.resolve_target_id(_FLOW_VER_ID_15),
+            ("flow_version", "tooling_soql"),
+        )
+
+    def test_prompt_template_prefix(self):
+        self.assertEqual(
+            rit.resolve_target_id(_PROMPT_ID_15),
+            ("prompt_template", "retrieve_required"),
+        )
+
+    def test_eighteen_char_id_works(self):
+        self.assertEqual(
+            rit.resolve_target_id(_APEX_ID_18),
+            ("apex", "tooling_soql"),
+        )
+
+
+class UnknownPrefixTests(unittest.TestCase):
+    def test_resolve_target_id_never_raises(self):
+        # Unknown prefix → ("unknown", "skip"), no exception.
+        self.assertEqual(
+            rit.resolve_target_id(_UNKNOWN_PREFIX_ID_15),
+            ("unknown", "skip"),
+        )
+
+    def test_resolve_or_unresolved_records_unknown_prefix(self):
+        unresolved: list[dict] = []
+        result = rit.resolve_or_unresolved(_UNKNOWN_PREFIX_ID_15, unresolved)
+        self.assertEqual(result, ("unknown", "skip"))
+        self.assertEqual(len(unresolved), 1)
+        entry = unresolved[0]
+        self.assertEqual(entry["id"], _UNKNOWN_PREFIX_ID_15)
+        self.assertEqual(entry["reason"], "unknown-id-prefix:0aN")
+
+    def test_known_prefix_does_not_touch_unresolved(self):
+        unresolved: list[dict] = []
+        result = rit.resolve_or_unresolved(_APEX_ID_15, unresolved)
+        self.assertEqual(result, ("apex", "tooling_soql"))
+        self.assertEqual(unresolved, [])
+
+
+class InvalidShapeTests(unittest.TestCase):
+    def test_empty_string(self):
+        unresolved: list[dict] = []
+        result = rit.resolve_or_unresolved("", unresolved)
+        self.assertEqual(result, ("unknown", "skip"))
+        self.assertEqual(len(unresolved), 1)
+        self.assertEqual(unresolved[0]["reason"], "invalid-id-format")
+        self.assertEqual(unresolved[0]["id"], "")
+
+    def test_none_coerced_via_str(self):
+        unresolved: list[dict] = []
+        result = rit.resolve_or_unresolved(None, unresolved)
+        self.assertEqual(result, ("unknown", "skip"))
+        self.assertEqual(len(unresolved), 1)
+        self.assertEqual(unresolved[0]["reason"], "invalid-id-format")
+        self.assertEqual(unresolved[0]["id"], "None")
+
+    def test_wrong_length_is_invalid(self):
+        # A 10-char id-like string is not 15 or 18 — invalid shape, not
+        # an unknown prefix.
+        unresolved: list[dict] = []
+        rit.resolve_or_unresolved("01pABC1234", unresolved)
+        self.assertEqual(len(unresolved), 1)
+        self.assertEqual(unresolved[0]["reason"], "invalid-id-format")
+
+    def test_bad_chars_rejected(self):
+        # 15-char length but contains punctuation — not an Id shape.
+        unresolved: list[dict] = []
+        rit.resolve_or_unresolved("01p!!!!!!!!!!99", unresolved)
+        self.assertEqual(len(unresolved), 1)
+        self.assertEqual(unresolved[0]["reason"], "invalid-id-format")
+
+    def test_short_string_is_invalid(self):
+        unresolved: list[dict] = []
+        rit.resolve_or_unresolved("ab", unresolved)
+        self.assertEqual(len(unresolved), 1)
+        self.assertEqual(unresolved[0]["reason"], "invalid-id-format")
+
+
+class RegisteredPrefixesTests(unittest.TestCase):
+    def test_exact_membership(self):
+        self.assertEqual(
+            rit.REGISTERED_PREFIXES,
+            frozenset({"01p", "300", "301", "0hf"}),
+        )
+
+    def test_is_frozenset(self):
+        """Immutable so callers can't accidentally corrupt the table."""
+        self.assertIsInstance(rit.REGISTERED_PREFIXES, frozenset)
+
+
+class ResolveTargetIdRobustnessTests(unittest.TestCase):
+    """`resolve_target_id` is the lower-level helper — it must also never
+    raise, even on garbage input."""
+
+    def test_none_input(self):
+        self.assertEqual(rit.resolve_target_id(None), ("unknown", "skip"))  # type: ignore[arg-type]
+
+    def test_empty_string(self):
+        self.assertEqual(rit.resolve_target_id(""), ("unknown", "skip"))
+
+    def test_too_short(self):
+        self.assertEqual(rit.resolve_target_id("ab"), ("unknown", "skip"))
+
+
+if __name__ == "__main__":
+    unittest.main()