@swarp/cli 0.0.1-rc.17

package/src/certs/generate.test.mjs

@@ -0,0 +1,265 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { X509Certificate } from 'node:crypto';
+import { generateCerts, rotateCert } from './generate.mjs';
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function makeTmpDir() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'swarp-certs-test-'));
+}
+
+function cleanDir(dir) {
+  fs.rmSync(dir, { recursive: true, force: true });
+}
+
+/**
+ * Builds an in-memory filesystem shim that captures writes.
+ * Files are stored as strings keyed by absolute path.
+ */
+function makeMemFs(initialFiles = {}) {
+  const store = { ...initialFiles };
+  return {
+    _store: store,
+    existsSync(p) { return Object.prototype.hasOwnProperty.call(store, p); },
+    mkdirSync(_p, _opts) {},
+    writeFileSync(p, data) { store[p] = data; },
+    readFileSync(p, _enc) {
+      if (!Object.prototype.hasOwnProperty.call(store, p)) {
+        throw Object.assign(new Error(`ENOENT: ${p}`), { code: 'ENOENT' });
+      }
+      return store[p];
+    },
+    appendFileSync(p, data) {
+      store[p] = (store[p] ?? '') + data;
+    },
+  };
+}
+
+// ---------------------------------------------------------------------------
+// generateCerts — output files
+// ---------------------------------------------------------------------------
+
+describe('generateCerts', () => {
+  let tmpDir;
+
+  beforeEach(() => {
+    tmpDir = makeTmpDir();
+    vi.spyOn(console, 'log').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    cleanDir(tmpDir);
+    vi.restoreAllMocks();
+  });
+
+  it('creates all six output files', async () => {
+    await generateCerts(path.join(tmpDir, 'certs'));
+
+    const expected = [
+      'ca.crt',
+      'ca.key',
+      'router.crt',
+      'router.key',
+      'agent-example.crt',
+      'agent-example.key',
+    ];
+    for (const name of expected) {
+      expect(fs.existsSync(path.join(tmpDir, 'certs', name)), `${name} must exist`).toBe(true);
+    }
+  });
+
+  it('ca.crt is a valid PEM certificate', async () => {
+    await generateCerts(path.join(tmpDir, 'certs'));
+    const pem = fs.readFileSync(path.join(tmpDir, 'certs', 'ca.crt'), 'utf8');
+    expect(() => new X509Certificate(pem)).not.toThrow();
+  });
+
+  it('ca.crt has isCA = true', async () => {
+    await generateCerts(path.join(tmpDir, 'certs'));
+    const pem = fs.readFileSync(path.join(tmpDir, 'certs', 'ca.crt'), 'utf8');
+    const cert = new X509Certificate(pem);
+    expect(cert.ca).toBe(true);
+  });
+
+  it('ca.crt has CN = swarp-ca', async () => {
+    await generateCerts(path.join(tmpDir, 'certs'));
+    const pem = fs.readFileSync(path.join(tmpDir, 'certs', 'ca.crt'), 'utf8');
+    const cert = new X509Certificate(pem);
+    expect(cert.subject).toContain('CN=swarp-ca');
+  });
+
+  it('router.crt has CN = swarp-router', async () => {
+    await generateCerts(path.join(tmpDir, 'certs'));
+    const pem = fs.readFileSync(path.join(tmpDir, 'certs', 'router.crt'), 'utf8');
+    const cert = new X509Certificate(pem);
+    expect(cert.subject).toContain('CN=swarp-router');
+  });
+
+  it('agent-example.crt has CN = example', async () => {
+    await generateCerts(path.join(tmpDir, 'certs'));
+    const pem = fs.readFileSync(path.join(tmpDir, 'certs', 'agent-example.crt'), 'utf8');
+    const cert = new X509Certificate(pem);
+    expect(cert.subject).toContain('CN=example');
+  });
+
+  it('router.crt is signed by CA', async () => {
+    await generateCerts(path.join(tmpDir, 'certs'));
+    const caPem = fs.readFileSync(path.join(tmpDir, 'certs', 'ca.crt'), 'utf8');
+    const routerPem = fs.readFileSync(path.join(tmpDir, 'certs', 'router.crt'), 'utf8');
+
+    const caCert = new X509Certificate(caPem);
+    const routerCert = new X509Certificate(routerPem);
+
+    // verify() checks the signature — this is the authoritative "signed by CA" check
+    expect(routerCert.verify(caCert.publicKey)).toBe(true);
+  });
+
+  it('agent-example.crt is signed by CA', async () => {
+    await generateCerts(path.join(tmpDir, 'certs'));
+    const caPem = fs.readFileSync(path.join(tmpDir, 'certs', 'ca.crt'), 'utf8');
+    const agentPem = fs.readFileSync(path.join(tmpDir, 'certs', 'agent-example.crt'), 'utf8');
+
+    const caCert = new X509Certificate(caPem);
+    const agentCert = new X509Certificate(agentPem);
+
+    // verify() checks the signature — this is the authoritative "signed by CA" check
+    expect(agentCert.verify(caCert.publicKey)).toBe(true);
+  });
+
+  it('ca.key is valid PKCS8 PEM', async () => {
+    await generateCerts(path.join(tmpDir, 'certs'));
+    const keyPem = fs.readFileSync(path.join(tmpDir, 'certs', 'ca.key'), 'utf8');
+    expect(keyPem).toMatch(/-----BEGIN PRIVATE KEY-----/);
+  });
+
+  it('prints security instructions mentioning GitHub Secrets', async () => {
+    const logSpy = vi.spyOn(console, 'log');
+    await generateCerts(path.join(tmpDir, 'certs'));
+    const output = logSpy.mock.calls.map((c) => String(c[0])).join('\n');
+    expect(output).toContain('GitHub Secrets');
+    expect(output).toContain('Never commit');
+  });
+
+  it('adds certs/ to .gitignore when file exists and entry is absent', async () => {
+    // ensureGitignoreEntry resolves .gitignore relative to process.cwd()
+    const gitignorePath = path.resolve('.gitignore');
+    const memFs = makeMemFs({
+      [gitignorePath]: 'node_modules/\n',
+    });
+
+    await generateCerts(path.join(tmpDir, 'certs'), { fs: memFs });
+
+    // The entry should be 'certs/' (basename of the outDir)
+    expect(memFs._store[gitignorePath]).toContain('certs/');
+  });
+
+  it('does not duplicate certs/ in .gitignore when already present', async () => {
+    const gitignorePath = path.resolve('.gitignore');
+    const memFs = makeMemFs({
+      [gitignorePath]: 'node_modules/\ncerts/\n',
+    });
+
+    await generateCerts(path.join(tmpDir, 'certs'), { fs: memFs });
+
+    const content = memFs._store[gitignorePath];
+    const count = (content.match(/certs\//g) ?? []).length;
+    expect(count).toBe(1);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// rotateCert
+// ---------------------------------------------------------------------------
+
+describe('rotateCert', () => {
+  let tmpDir;
+
+  beforeEach(() => {
+    tmpDir = makeTmpDir();
+    vi.spyOn(console, 'log').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    cleanDir(tmpDir);
+    vi.restoreAllMocks();
+  });
+
+  it('generates agent-<name>.crt and agent-<name>.key', async () => {
+    const certsDir = path.join(tmpDir, 'certs');
+    await generateCerts(certsDir);
+    await rotateCert('myagent', certsDir);
+
+    expect(fs.existsSync(path.join(certsDir, 'agent-myagent.crt'))).toBe(true);
+    expect(fs.existsSync(path.join(certsDir, 'agent-myagent.key'))).toBe(true);
+  });
+
+  it('rotated cert is signed by the existing CA', async () => {
+    const certsDir = path.join(tmpDir, 'certs');
+    await generateCerts(certsDir);
+    await rotateCert('myagent', certsDir);
+
+    const caPem = fs.readFileSync(path.join(certsDir, 'ca.crt'), 'utf8');
+    const agentPem = fs.readFileSync(path.join(certsDir, 'agent-myagent.crt'), 'utf8');
+
+    const caCert = new X509Certificate(caPem);
+    const agentCert = new X509Certificate(agentPem);
+
+    expect(agentCert.verify(caCert.publicKey)).toBe(true);
+  });
+
+  it('rotated cert has the correct CN', async () => {
+    const certsDir = path.join(tmpDir, 'certs');
+    await generateCerts(certsDir);
+    await rotateCert('myagent', certsDir);
+
+    const pem = fs.readFileSync(path.join(certsDir, 'agent-myagent.crt'), 'utf8');
+    const cert = new X509Certificate(pem);
+    expect(cert.subject).toContain('CN=myagent');
+  });
+
+  it('generates a fresh keypair on rotation (cert differs from original)', async () => {
+    const certsDir = path.join(tmpDir, 'certs');
+    await generateCerts(certsDir);
+    const originalPem = fs.readFileSync(path.join(certsDir, 'agent-example.crt'), 'utf8');
+
+    await rotateCert('example', certsDir);
+    const rotatedPem = fs.readFileSync(path.join(certsDir, 'agent-example.crt'), 'utf8');
+
+    // Each cert has a random serial so PEM strings differ
+    expect(rotatedPem).not.toBe(originalPem);
+  });
+
+  it('throws when ca.key is missing', async () => {
+    const memFs = makeMemFs({
+      [path.join(tmpDir, 'certs', 'ca.crt')]: 'some-cert',
+    });
+    // ca.key is NOT in memFs
+    await expect(
+      rotateCert('agent1', path.join(tmpDir, 'certs'), { fs: memFs }),
+    ).rejects.toThrow(/CA files not found/);
+  });
+
+  it('throws when ca.crt is missing', async () => {
+    const memFs = makeMemFs({
+      [path.join(tmpDir, 'certs', 'ca.key')]: 'some-key',
+    });
+    // ca.crt is NOT in memFs
+    await expect(
+      rotateCert('agent1', path.join(tmpDir, 'certs'), { fs: memFs }),
+    ).rejects.toThrow(/CA files not found/);
+  });
+
+  it('prints GitHub Secrets update instructions', async () => {
+    const certsDir = path.join(tmpDir, 'certs');
+    await generateCerts(certsDir);
+    const logSpy = vi.spyOn(console, 'log');
+    await rotateCert('ranger', certsDir);
+    const output = logSpy.mock.calls.map((c) => String(c[0])).join('\n');
+    expect(output).toContain('SWARP_AGENT_RANGER_CERT');
+  });
+});

package/src/config.mjs

@@ -0,0 +1,11 @@
+import { readFileSync, existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+export function loadConfig(configPath = '.swarp.json') {
+  const fullPath = resolve(configPath);
+  if (!existsSync(fullPath)) {
+    throw new Error(`SWARP config not found at ${fullPath}. Run "swarp init" to create it.`);
+  }
+  const raw = readFileSync(fullPath, 'utf-8');
+  return JSON.parse(raw);
+}

package/src/generator/audit.mjs

@@ -0,0 +1,164 @@
+import { readFileSync, readdirSync, existsSync } from 'node:fs';
+import { resolve, join } from 'node:path';
+import yaml from 'js-yaml';
+import { validateAgentConfig } from './schema.mjs';
+
+export function discoverAgents(agentsDir) {
+  const dir = resolve(agentsDir);
+  const agents = [];
+
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (!entry.isDirectory() || entry.name === 'shared') continue;
+    const yamlPath = join(dir, entry.name, 'agent.yaml');
+    if (!existsSync(yamlPath)) continue;
+
+    const raw = readFileSync(yamlPath, 'utf-8');
+    const config = yaml.load(raw);
+    agents.push({
+      name: config.name ?? entry.name,
+      dir: join(dir, entry.name),
+      config,
+      yamlPath,
+    });
+  }
+
+  return agents;
+}
+
+export function auditAgent(agent, options = {}) {
+  const { skipRemote = false } = options;
+  const checks = [];
+  const { config, dir } = agent;
+
+  const schemaErrors = validateAgentConfig(config);
+  checks.push({
+    name: 'schema_valid',
+    severity: 'error',
+    status: schemaErrors.length === 0 ? 'pass' : 'fail',
+    message: schemaErrors.length === 0 ? 'Schema is valid' : schemaErrors.join('; '),
+  });
+
+  const dirName = agent.dir.split('/').pop();
+  if (dirName !== config.name) {
+    checks.push({
+      name: 'name_match',
+      severity: 'warning',
+      status: 'fail',
+      message: `Directory "${dirName}" doesn't match agent name "${config.name}"`,
+    });
+  }
+
+  if (config.persona?.avatar) {
+    const exists = existsSync(join(dir, config.persona.avatar));
+    checks.push({
+      name: 'avatar_exists',
+      severity: 'warning',
+      status: exists ? 'pass' : 'fail',
+      message: exists ? 'Avatar found' : `Avatar missing: ${config.persona.avatar}`,
+    });
+  }
+
+  for (const [modeName, mode] of Object.entries(config.modes || {})) {
+    if (mode.prompt && mode.input) {
+      const refs = [...mode.prompt.matchAll(/\{\{\s*(\w+)/g)].map((m) => m[1]);
+      const inputs = Object.keys(mode.input);
+      const builtins = ['persona', 'display_name', 'message'];
+      const missing = refs.filter((r) => !inputs.includes(r) && !builtins.includes(r));
+      checks.push({
+        name: `prompt_refs_${modeName}`,
+        severity: 'error',
+        status: missing.length === 0 ? 'pass' : 'fail',
+        message:
+          missing.length === 0
+            ? `${modeName}: prompt refs valid`
+            : `${modeName}: undefined refs: ${missing.join(', ')}`,
+      });
+    }
+
+    if (mode.prompt && mode.output?.schema) {
+      const keys = Object.keys(mode.output.schema);
+      const missing = keys.filter((k) => !mode.prompt.includes(k));
+      checks.push({
+        name: `output_schema_${modeName}`,
+        severity: 'warning',
+        status: missing.length === 0 ? 'pass' : 'fail',
+        message:
+          missing.length === 0
+            ? `${modeName}: output keys in prompt`
+            : `${modeName}: keys missing from prompt: ${missing.join(', ')}`,
+      });
+    }
+
+    const modeSkills = mode.skills || config.skills || [];
+    if (modeSkills.length > 0) {
+      const hasSkill = mode.tools?.allowed?.includes('Skill');
+      checks.push({
+        name: `skill_access_${modeName}`,
+        severity: 'error',
+        status: hasSkill ? 'pass' : 'fail',
+        message: hasSkill
+          ? `${modeName}: Skill in allowedTools`
+          : `${modeName}: has skills but Skill not in allowedTools`,
+      });
+    }
+
+    if (modeName === 'chat' && mode.model !== 'haiku') {
+      checks.push({
+        name: `budget_${modeName}`,
+        severity: 'warning',
+        status: 'fail',
+        message: `${modeName}: should use haiku, using ${mode.model}`,
+      });
+    }
+
+    if (mode.max_turns > 100) {
+      checks.push({
+        name: `budget_turns_${modeName}`,
+        severity: 'warning',
+        status: 'fail',
+        message: `${modeName}: max_turns=${mode.max_turns} excessive`,
+      });
+    }
+  }
+
+  const settingsPath = join(dir, 'settings.generated.json');
+  checks.push({
+    name: 'settings_generated',
+    severity: 'warning',
+    status: existsSync(settingsPath) ? 'pass' : 'skip',
+    message: existsSync(settingsPath)
+      ? 'settings.generated.json exists'
+      : 'Not yet generated',
+  });
+
+  if (!skipRemote) {
+    checks.push({
+      name: 'remote_env',
+      severity: 'error',
+      status: 'skip',
+      message: 'Remote env check — not yet implemented',
+    });
+    checks.push({
+      name: 'remote_plugins',
+      severity: 'warning',
+      status: 'skip',
+      message: 'Remote plugin check — not yet implemented',
+    });
+  }
+
+  return { agent: config.name, checks };
+}
+
+export function auditConfigs(agentsDir) {
+  const dir = resolve(agentsDir);
+  if (!existsSync(dir)) {
+    throw new Error(`Agents directory not found: ${dir}`);
+  }
+
+  const agents = discoverAgents(dir);
+  if (agents.length === 0) {
+    throw new Error(`No agent.yaml files found in ${dir}`);
+  }
+
+  return agents.map((agent) => auditAgent(agent, { skipRemote: true }));
+}

package/src/generator/generate.mjs

@@ -0,0 +1,105 @@
+import { readFileSync, writeFileSync, existsSync, readdirSync } from 'node:fs';
+import { resolve, join } from 'node:path';
+import yaml from 'js-yaml';
+import { validateAgentConfig } from './schema.mjs';
+
+export function renderPrompt(template, params, persona = {}) {
+  let result = template;
+  if (persona.bio) {
+    result = result.replace(/\{\{\s*persona\.bio\s*\}\}/g, persona.bio);
+  }
+  for (const [key, val] of Object.entries(params)) {
+    const re = new RegExp(`\\{\\{\\s*${key}\\s*\\}\\}`, 'g');
+    result = result.replace(re, String(val));
+  }
+  return result;
+}
+
+export function parseStructuredOutput(resultText) {
+  if (!resultText || !resultText.trim()) {
+    return { structured: null, parseError: 'empty result' };
+  }
+
+  const text = resultText.trim();
+  let depth = 0;
+  let end = -1;
+  let start = -1;
+
+  for (let i = text.length - 1; i >= 0; i--) {
+    const ch = text[i];
+    if (ch === '}' && end === -1) {
+      end = i;
+      depth = 1;
+    } else if (end !== -1) {
+      if (ch === '}') depth++;
+      if (ch === '{') depth--;
+      if (depth === 0) {
+        start = i;
+        break;
+      }
+    }
+  }
+
+  if (start === -1 || end === -1) {
+    return { structured: null, parseError: 'no JSON object found' };
+  }
+
+  try {
+    const jsonStr = text.slice(start, end + 1);
+    return { structured: JSON.parse(jsonStr), parseError: null };
+  } catch (e) {
+    return { structured: null, parseError: `JSON parse failed: ${e.message}` };
+  }
+}
+
+export function buildRunnerConfig(agentConfig) {
+  const modes = {};
+  for (const [name, mode] of Object.entries(agentConfig.modes ?? {})) {
+    modes[name] = {
+      description: mode.description,
+      model: mode.model,
+      max_turns: mode.max_turns,
+      timeout_minutes: mode.timeout_minutes,
+      allowed_tools: mode.tools?.allowed ?? [],
+      blocked_tools: mode.tools?.blocked ?? [],
+      required_inputs: Object.entries(mode.input ?? {})
+        .filter(([, v]) => v && typeof v === 'object' && v.required)
+        .map(([k]) => k),
+      input_schema: mode.input ?? {},
+      output_schema: mode.output?.schema ?? {},
+      prompt: mode.prompt ?? '',
+    };
+  }
+
+  return {
+    name: agentConfig.name,
+    version: agentConfig.version ?? '1.0.0',
+    grpc_port: agentConfig.grpc_port ?? 50052,
+    router_url: agentConfig.router_url ?? '${SWARP_ROUTER_URL}',
+    preamble: agentConfig.preamble ?? '',
+    persona_bio: agentConfig.persona?.bio ?? '',
+    modes,
+  };
+}
+
+export async function generateRunnerConfig(agentsDir) {
+  const dir = resolve(agentsDir);
+
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (!entry.isDirectory() || entry.name === 'shared') continue;
+    const yamlPath = join(dir, entry.name, 'agent.yaml');
+    if (!existsSync(yamlPath)) continue;
+
+    const agentConfig = yaml.load(readFileSync(yamlPath, 'utf-8'));
+
+    const errors = validateAgentConfig(agentConfig);
+    if (errors.length > 0) {
+      throw new Error(`${agentConfig.name}: schema errors — ${errors.join('; ')}`);
+    }
+
+    const runnerConfig = buildRunnerConfig(agentConfig);
+    const outPath = join(dir, entry.name, 'runner.generated.yaml');
+    writeFileSync(outPath, yaml.dump(runnerConfig));
+    console.log(`Generated ${outPath}`);
+  }
+}

package/src/generator/schema.mjs

@@ -0,0 +1,105 @@
+import { z } from 'zod';
+
+const VALID_MODELS = ['haiku', 'sonnet', 'opus'];
+const RESERVED_NAMES = ['status', 'health', 'keepalive', 'modes', 'task'];
+const BUILTIN_VARS = ['persona', 'display_name', 'message'];
+
+const ToolsSchema = z.object({
+  allowed: z.array(z.string()),
+  blocked: z.array(z.string()),
+});
+
+const ModeSchema = z.object({
+  description: z.string(),
+  model: z.enum(VALID_MODELS),
+  max_turns: z.number().int().positive(),
+  timeout_minutes: z.number().positive(),
+  tools: ToolsSchema,
+  input: z.record(z.unknown()),
+  output: z.object({ schema: z.record(z.unknown()).optional() }).optional(),
+  prompt: z.string(),
+  skills: z.array(z.string()).optional(),
+}).passthrough();
+
+const PersonaSchema = z.object({
+  role: z.string(),
+  bio: z.string(),
+  avatar: z.string(),
+}).passthrough();
+
+const AgentConfigSchema = z.object({
+  name: z.string(),
+  display_name: z.string(),
+  sprite: z.string(),
+  sprite_url: z.string(),
+  region: z.string(),
+  persona: PersonaSchema,
+  preamble: z.string(),
+  modes: z.record(ModeSchema),
+  skills: z.array(z.string()).optional(),
+}).passthrough();
+
+export function validateAgentConfig(raw) {
+  const zodResult = AgentConfigSchema.safeParse(raw);
+  const errors = [];
+
+  if (!zodResult.success) {
+    for (const issue of zodResult.error.issues) {
+      errors.push(`${issue.path.join('.')}: ${issue.message}`);
+    }
+  }
+
+  if (typeof raw === 'object' && raw !== null) {
+    if (raw.modes && typeof raw.modes === 'object') {
+      if (!raw.modes.chat) {
+        errors.push('Every agent must have a chat mode');
+      }
+
+      for (const [name, mode] of Object.entries(raw.modes)) {
+        const p = `modes.${name}`;
+
+        if (RESERVED_NAMES.includes(name)) {
+          errors.push(`${p}: "${name}" is a reserved mode name`);
+        }
+
+        if (name === 'chat' && typeof mode === 'object' && mode !== null) {
+          if (mode.model && mode.model !== 'haiku') {
+            errors.push(`${p}: chat must use haiku, got "${mode.model}"`);
+          }
+          if (mode.max_turns !== undefined && mode.max_turns !== 1) {
+            errors.push(`${p}: chat must have max_turns: 1, got ${mode.max_turns}`);
+          }
+          if (!mode.input?.message) {
+            errors.push(`${p}: chat must have message input`);
+          }
+          if (mode.tools?.allowed?.length > 0) {
+            errors.push(`${p}: chat must have tools.allowed: [] (no tools)`);
+          }
+        }
+
+        if (typeof mode === 'object' && mode !== null) {
+          const modeSkills = mode.skills || raw.skills || [];
+          if (modeSkills.length > 0 && mode.tools?.allowed && !mode.tools.allowed.includes('Skill')) {
+            errors.push(`${p}: has skills but "Skill" not in tools.allowed`);
+          }
+
+          if (mode.prompt && mode.input) {
+            const refs = [...mode.prompt.matchAll(/\{\{\s*(\w+)/g)].map((m) => m[1]);
+            const inputs = Object.keys(mode.input);
+            for (const ref of refs) {
+              if (!inputs.includes(ref) && !BUILTIN_VARS.includes(ref)) {
+                errors.push(`${p}: prompt references "{{ ${ref} }}" but no matching input`);
+              }
+            }
+          }
+
+          if (mode.max_turns > 100) {
+            errors.push(`${p}: max_turns=${mode.max_turns} seems excessive (>100)`);
+          }
+        }
+      }
+    }
+  }
+
+  return errors;
+}