@synth-deploy/server 1.0.6 → 1.2.0

package/tests/agent-mode.test.ts

@@ -1,14 +1,13 @@
 import { describe, it, expect, beforeAll } from "vitest";
 import Fastify from "fastify";
 import type { FastifyInstance } from "fastify";
-import { DecisionDebrief, PartitionStore, EnvironmentStore, ArtifactStore, SettingsStore, TelemetryStore, LlmClient } from "@synth-deploy/core";
-import type { LlmResult } from "@synth-deploy/core";
+import { DecisionDebrief, PartitionStore, EnvironmentStore, ArtifactStore, SettingsStore, TelemetryStore } from "@synth-deploy/core";
 import { SynthAgent, InMemoryDeploymentStore } from "../src/agent/synth-agent.js";
-import { registerDeploymentRoutes } from "../src/api/deployments.js";
+import { registerOperationRoutes } from "../src/api/operations.js";
 import { registerPartitionRoutes } from "../src/api/partitions.js";
 import { registerEnvironmentRoutes } from "../src/api/environments.js";
 import { registerArtifactRoutes } from "../src/api/artifacts.js";
-import { registerAgentRoutes, sanitizeUserInput, validateExtractedVersion, validateExtractedVariables } from "../src/api/agent.js";
+import { registerAgentRoutes } from "../src/api/agent.js";
 import { registerSettingsRoutes } from "../src/api/settings.js";
 
 // ---------------------------------------------------------------------------
@@ -67,7 +66,7 @@ beforeAll(async () => {
 
   app = Fastify();
   addMockAuth(app);
-  registerDeploymentRoutes(app, deployments, diary, partitions, environments, artifactStore, settings, telemetry);
+  registerOperationRoutes(app, deployments, diary, partitions, environments, artifactStore, settings, telemetry);
   registerPartitionRoutes(app, partitions, deployments, diary, telemetry);
   registerEnvironmentRoutes(app, environments, deployments, telemetry);
   registerArtifactRoutes(app, artifactStore, telemetry);
@@ -121,7 +120,7 @@ async function deployViaHttp(
 ) {
   return server.inject({
     method: "POST",
-    url: "/api/deployments",
+    url: "/api/operations",
     payload: {
       artifactId: params.artifactId,
       environmentId: params.environmentId,
@@ -164,373 +163,3 @@ describe("Agent mode — deployment context", () => {
 });
 
 
-// ---------------------------------------------------------------------------
-// Input sanitization tests
-// ---------------------------------------------------------------------------
-
-describe("Agent mode — input sanitization", () => {
-  it("strips control characters from intent", () => {
-    const input = "Deploy\x01\x02\x03\x07 web-app\x0B\x0C\x0E v1.0.0";
-    const result = sanitizeUserInput(input);
-    // Control characters should be removed
-    expect(result).not.toMatch(/[\x00-\x08\x0B\x0C\x0E-\x1F]/);
-    // Printable content should remain
-    expect(result).toContain("Deploy");
-    expect(result).toContain("web-app");
-    expect(result).toContain("v1.0.0");
-  });
-
-  it("truncates long inputs to 1000 characters", () => {
-    const longInput = "a".repeat(2000);
-    const result = sanitizeUserInput(longInput);
-    expect(result.length).toBe(1000);
-  });
-
-  it("escapes XML tags in user input", () => {
-    const input = "<script>alert('xss')</script>";
-    const result = sanitizeUserInput(input);
-    expect(result).not.toContain("<script>");
-    expect(result).not.toContain("</script>");
-    expect(result).toContain("&lt;script&gt;");
-    expect(result).toContain("&lt;/script&gt;");
-  });
-
-  it("validates semver version format", () => {
-    // Valid formats
-    expect(validateExtractedVersion("1.2.3")).toBe(true);
-    expect(validateExtractedVersion("1.2.3-beta.1")).toBe(true);
-    expect(validateExtractedVersion("0.0.1")).toBe(true);
-    expect(validateExtractedVersion("10.20.30-alpha")).toBe(true);
-
-    // Invalid formats
-    expect(validateExtractedVersion("not-a-version")).toBe(false);
-    expect(validateExtractedVersion("1.2")).toBe(false);
-    expect(validateExtractedVersion("../../../etc/passwd")).toBe(false);
-    expect(validateExtractedVersion("v1.2.3")).toBe(false);
-    expect(validateExtractedVersion("")).toBe(false);
-  });
-
-  it("validates variable key format", () => {
-    // Valid keys
-    const valid = validateExtractedVariables({ APP_ENV: "production", DB_HOST: "localhost" });
-    expect(valid).toHaveProperty("APP_ENV", "production");
-    expect(valid).toHaveProperty("DB_HOST", "localhost");
-
-    // Invalid keys should be excluded
-    const invalid = validateExtractedVariables({
-      "../../path": "value",
-      "key with spaces": "value",
-      "": "value",
-      "123invalid": "value",
-    });
-    expect(Object.keys(invalid)).toHaveLength(0);
-  });
-
-  it("rejects variables with values exceeding 500 chars", () => {
-    const longValue = "x".repeat(600);
-    const result = validateExtractedVariables({ VALID_KEY: longValue, SHORT_KEY: "ok" });
-    expect(result).not.toHaveProperty("VALID_KEY");
-    expect(result).toHaveProperty("SHORT_KEY", "ok");
-  });
-});
-
-
-// ---------------------------------------------------------------------------
-// LLM-powered query classification tests
-// ---------------------------------------------------------------------------
-
-describe("Agent mode — LLM query classification", () => {
-  let qApp: FastifyInstance;
-  let qDiary: DecisionDebrief;
-  let qPartitions: PartitionStore;
-  let qEnvironments: EnvironmentStore;
-  let qDeployments: InMemoryDeploymentStore;
-  let qArtifactStore: ArtifactStore;
-  let qSettings: SettingsStore;
-  let qTelemetry: TelemetryStore;
-  let qAgent: SynthAgent;
-  let qMockLlm: LlmClient;
-
-  let qArtifactId: string;
-  let qPartitionId: string;
-  let qProdEnvId: string;
-  let qStagingEnvId: string;
-
-  // Track what classify() should return for query classification
-  let qClassifyResponse: LlmResult;
-
-  beforeAll(async () => {
-    qDiary = new DecisionDebrief();
-    qPartitions = new PartitionStore();
-    qEnvironments = new EnvironmentStore();
-    qDeployments = new InMemoryDeploymentStore();
-    qArtifactStore = new ArtifactStore();
-    qSettings = new SettingsStore();
-    qTelemetry = new TelemetryStore();
-    qAgent = new SynthAgent(
-      qDiary, qDeployments, qArtifactStore, qEnvironments, qPartitions,
-      undefined, { healthCheckBackoffMs: 1, executionDelayMs: 1 },
-    );
-
-    qMockLlm = new LlmClient(qDiary, "command", { apiKey: "test-key" });
-    qMockLlm.classify = async () => qClassifyResponse;
-    qMockLlm.isAvailable = () => true;
-
-    qApp = Fastify();
-    addMockAuth(qApp);
-    registerDeploymentRoutes(qApp, qDeployments, qDiary, qPartitions, qEnvironments, qArtifactStore, qSettings, qTelemetry);
-    registerPartitionRoutes(qApp, qPartitions, qDeployments, qDiary, qTelemetry);
-    registerEnvironmentRoutes(qApp, qEnvironments, qDeployments, qTelemetry);
-    registerArtifactRoutes(qApp, qArtifactStore, qTelemetry);
-    registerSettingsRoutes(qApp, qSettings, qTelemetry);
-    registerAgentRoutes(qApp, qAgent, qPartitions, qEnvironments, qArtifactStore, qDeployments, qDiary, qSettings, qMockLlm);
-
-    await qApp.ready();
-
-    // Seed test data
-    const envRes = await qApp.inject({
-      method: "POST",
-      url: "/api/environments",
-      payload: { name: "production", variables: { APP_ENV: "production" } },
-    });
-    qProdEnvId = JSON.parse(envRes.payload).environment.id;
-
-    const stagingRes = await qApp.inject({
-      method: "POST",
-      url: "/api/environments",
-      payload: { name: "staging", variables: { APP_ENV: "staging" } },
-    });
-    qStagingEnvId = JSON.parse(stagingRes.payload).environment.id;
-
-    const artifactRes = await qApp.inject({
-      method: "POST",
-      url: "/api/artifacts",
-      payload: { name: "web-app", type: "nodejs" },
-    });
-    qArtifactId = JSON.parse(artifactRes.payload).artifact.id;
-
-    const partRes = await qApp.inject({
-      method: "POST",
-      url: "/api/partitions",
-      payload: { name: "Acme Corp" },
-    });
-    qPartitionId = JSON.parse(partRes.payload).partition.id;
-
-    // Create a deployment so data queries have something to find
-    await deployViaHttp(qApp, { artifactId: qArtifactId, partitionId: qPartitionId, environmentId: qProdEnvId, version: "1.0.0" });
-  });
-
-  it("navigate action: resolves 'show partition Acme Corp' to partition-detail", async () => {
-    qClassifyResponse = {
-      ok: true,
-      text: JSON.stringify({
-        action: "navigate",
-        view: "partition-detail",
-        params: { id: "Acme Corp" },
-        title: "Acme Corp",
-      }),
-      model: "claude-haiku-4-5-20251001",
-      responseTimeMs: 80,
-    };
-
-    const res = await qApp.inject({
-      method: "POST",
-      url: "/api/agent/query",
-      payload: { query: "show partition Acme Corp" },
-    });
-
-    expect(res.statusCode).toBe(200);
-    const result = JSON.parse(res.payload);
-    expect(result.action).toBe("navigate");
-    expect(result.view).toBe("partition-detail");
-    expect(result.params.id).toBe(qPartitionId);
-  });
-
-  it("data action: resolves 'recent deployments' to deployment-list", async () => {
-    qClassifyResponse = {
-      ok: true,
-      text: JSON.stringify({
-        action: "data",
-        view: "deployment-list",
-        params: {},
-        title: "Recent Deployments",
-      }),
-      model: "claude-haiku-4-5-20251001",
-      responseTimeMs: 60,
-    };
-
-    const res = await qApp.inject({
-      method: "POST",
-      url: "/api/agent/query",
-      payload: { query: "recent deployments" },
-    });
-
-    expect(res.statusCode).toBe(200);
-    const result = JSON.parse(res.payload);
-    expect(result.action).toBe("data");
-    expect(result.view).toBe("deployment-list");
-  });
-
-  it("create action: returns create intent for UI confirmation", async () => {
-    qClassifyResponse = {
-      ok: true,
-      text: JSON.stringify({
-        action: "create",
-        view: "partition-list",
-        params: { name: "New Corp" },
-        title: "Create Partition",
-      }),
-      model: "claude-haiku-4-5-20251001",
-      responseTimeMs: 90,
-    };
-
-    const res = await qApp.inject({
-      method: "POST",
-      url: "/api/agent/query",
-      payload: { query: "create partition New Corp" },
-    });
-
-    expect(res.statusCode).toBe(200);
-    const result = JSON.parse(res.payload);
-    // After #63, create actions are returned as-is for UI confirmation
-    expect(result.action).toBe("create");
-    expect(result.view).toBe("partition-list");
-    expect(result.params.name).toBe("New Corp");
-  });
-
-  it("falls back to regex when LLM returns invalid JSON", async () => {
-    qClassifyResponse = {
-      ok: true,
-      text: "This is not valid JSON, just random text",
-      model: "claude-haiku-4-5-20251001",
-      responseTimeMs: 100,
-    };
-
-    const res = await qApp.inject({
-      method: "POST",
-      url: "/api/agent/query",
-      payload: { query: "show partition Acme Corp" },
-    });
-
-    expect(res.statusCode).toBe(200);
-    const result = JSON.parse(res.payload);
-    // Regex fallback should still classify the query — it matches partition name + "show"
-    expect(result.action).toBe("navigate");
-    expect(result.view).toBe("partition-detail");
-    expect(result.params.id).toBe(qPartitionId);
-  });
-
-  it("falls back to regex when LLM returns hallucinated entity names", async () => {
-    qClassifyResponse = {
-      ok: true,
-      text: JSON.stringify({
-        action: "navigate",
-        view: "partition-detail",
-        params: { id: "Nonexistent Partition" },
-        title: "Nonexistent Partition",
-      }),
-      model: "claude-haiku-4-5-20251001",
-      responseTimeMs: 90,
-    };
-
-    const res = await qApp.inject({
-      method: "POST",
-      url: "/api/agent/query",
-      payload: { query: "show partition Acme Corp" },
-    });
-
-    expect(res.statusCode).toBe(200);
-    const result = JSON.parse(res.payload);
-    // classifyQueryWithLlm validates the partition name and returns null for unknown names,
-    // causing fallback to regex which finds "Acme Corp" in the query
-    expect(result.action).toBe("navigate");
-    expect(result.view).toBe("partition-detail");
-    expect(result.params.id).toBe(qPartitionId);
-  });
-
-  it("falls back to regex when LLM call fails", async () => {
-    qClassifyResponse = {
-      ok: false,
-      fallback: true,
-      reason: "LLM rate limit exceeded (20 calls/min)",
-    };
-
-    const res = await qApp.inject({
-      method: "POST",
-      url: "/api/agent/query",
-      payload: { query: "show all deployments" },
-    });
-
-    expect(res.statusCode).toBe(200);
-    const result = JSON.parse(res.payload);
-    // Regex fallback detects "deployments" keyword → returns inline markdown table
-    expect(result.action).toBe("answer");
-    expect(result.content).toBeDefined();
-  });
-
-  it("records debrief entry for LLM-classified queries", async () => {
-    const existingIds = new Set(qDiary.getRecent(200).map((e) => e.id));
-
-    qClassifyResponse = {
-      ok: true,
-      text: JSON.stringify({
-        action: "data",
-        view: "deployment-list",
-        params: {},
-        title: "Deployments",
-      }),
-      model: "claude-haiku-4-5-20251001",
-      responseTimeMs: 50,
-    };
-
-    await qApp.inject({
-      method: "POST",
-      url: "/api/agent/query",
-      payload: { query: "show all deployments" },
-    });
-
-    const allEntries = qDiary.getRecent(200);
-    const newEntries = allEntries.filter((e) => !existingIds.has(e.id));
-    const queryEntry = newEntries.find(
-      (e) => e.decisionType === "system" && e.decision.includes("Canvas query"),
-    );
-    expect(queryEntry).toBeDefined();
-    expect(queryEntry!.decision).toContain("data");
-    expect(queryEntry!.decision).toContain("deployment-list");
-  });
-
-  it("returns 400 for empty query", async () => {
-    const res = await qApp.inject({
-      method: "POST",
-      url: "/api/agent/query",
-      payload: { query: "" },
-    });
-
-    expect(res.statusCode).toBe(400);
-  });
-
-  it("handles LLM response missing action field by falling back to regex", async () => {
-    qClassifyResponse = {
-      ok: true,
-      text: JSON.stringify({
-        view: "deployment-list",
-        params: {},
-      }),
-      model: "claude-haiku-4-5-20251001",
-      responseTimeMs: 100,
-    };
-
-    const res = await qApp.inject({
-      method: "POST",
-      url: "/api/agent/query",
-      payload: { query: "recent deployments" },
-    });
-
-    expect(res.statusCode).toBe(200);
-    const result = JSON.parse(res.payload);
-    // Missing action field → classifyQueryWithLlm returns null → regex fallback
-    // "deployments" matches the deployment list pattern → returns inline markdown table
-    expect(result.action).toBe("answer");
-    expect(result.content).toBeDefined();
-  });
-});

package/tests/api-handlers.test.ts

@@ -13,7 +13,7 @@ import { SynthAgent, InMemoryDeploymentStore } from "../src/agent/synth-agent.js
 import { registerPartitionRoutes } from "../src/api/partitions.js";
 import { registerEnvironmentRoutes } from "../src/api/environments.js";
 import { registerSettingsRoutes } from "../src/api/settings.js";
-import { registerDeploymentRoutes } from "../src/api/deployments.js";
+import { registerOperationRoutes } from "../src/api/operations.js";
 import { registerArtifactRoutes } from "../src/api/artifacts.js";
 import { registerHealthRoutes } from "../src/api/health.js";
 
@@ -76,7 +76,7 @@ async function createTestServer(): Promise<TestContext> {
   registerPartitionRoutes(app, partitions, deployments, diary, telemetry);
   registerEnvironmentRoutes(app, environments, deployments, telemetry);
   registerSettingsRoutes(app, settings, telemetry);
-  registerDeploymentRoutes(app, deployments, diary, partitions, environments, artifactStore, settings, telemetry);
+  registerOperationRoutes(app, deployments, diary, partitions, environments, artifactStore, settings, telemetry);
   registerArtifactRoutes(app, artifactStore, telemetry);
   registerHealthRoutes(app);
 
@@ -93,7 +93,7 @@ async function deployViaHttp(
 ) {
   return server.inject({
     method: "POST",
-    url: "/api/deployments",
+    url: "/api/operations",
     payload: {
       artifactId: params.artifactId,
       environmentId: params.environmentId,
@@ -637,7 +637,7 @@ describe("Settings Routes", () => {
       expect(body.settings.environmentsEnabled).toBe(true);
       expect(body.settings.agent).toBeDefined();
       expect(body.settings.agent.conflictPolicy).toBe("permissive");
-      expect(body.settings.deploymentDefaults).toBeDefined();
+      expect(body.settings.operationDefaults).toBeDefined();
       expect(body.settings.envoy).toBeDefined();
     });
   });
@@ -763,9 +763,9 @@ describe("Deployment Routes", () => {
     return artifact.id;
   }
 
-  // --- POST /api/deployments ---
+  // --- POST /api/operations ---
 
-  describe("POST /api/deployments", () => {
+  describe("POST /api/operations", () => {
     it("creates a deployment and returns 201", async () => {
       const env = ctx.environments.create("production", { APP_ENV: "production" });
       const partition = ctx.partitions.create("Acme", { DB_HOST: "acme-db" });
@@ -781,7 +781,7 @@ describe("Deployment Routes", () => {
       expect(res.statusCode).toBe(201);
       const body = JSON.parse(res.payload);
       expect(body.deployment).toBeDefined();
-      expect(body.deployment.artifactId).toBe(artifactId);
+      expect((body.deployment.input as any).artifactId).toBe(artifactId);
       expect(body.deployment.partitionId).toBe(partition.id);
       expect(body.deployment.version).toBe("1.0.0");
     });
@@ -789,7 +789,7 @@ describe("Deployment Routes", () => {
     it("returns 400 for invalid trigger", async () => {
       const res = await ctx.app.inject({
         method: "POST",
-        url: "/api/deployments",
+        url: "/api/operations",
         payload: {},
       });
 
@@ -801,7 +801,7 @@ describe("Deployment Routes", () => {
 
       const res = await ctx.app.inject({
         method: "POST",
-        url: "/api/deployments",
+        url: "/api/operations",
         payload: {
           artifactId: "nonexistent-artifact",
           environmentId: env.id,
@@ -817,7 +817,7 @@ describe("Deployment Routes", () => {
 
       const res = await ctx.app.inject({
         method: "POST",
-        url: "/api/deployments",
+        url: "/api/operations",
         payload: {
           artifactId,
           environmentId: "nonexistent",
@@ -834,7 +834,7 @@ describe("Deployment Routes", () => {
 
       const res = await ctx.app.inject({
         method: "POST",
-        url: "/api/deployments",
+        url: "/api/operations",
         payload: {
           artifactId,
           environmentId: env.id,
@@ -847,13 +847,13 @@ describe("Deployment Routes", () => {
     });
   });
 
-  // --- GET /api/deployments ---
+  // --- GET /api/operations ---
 
-  describe("GET /api/deployments", () => {
+  describe("GET /api/operations", () => {
     it("returns empty list when no deployments exist", async () => {
       const res = await ctx.app.inject({
         method: "GET",
-        url: "/api/deployments",
+        url: "/api/operations",
       });
 
       expect(res.statusCode).toBe(200);
@@ -875,7 +875,7 @@ describe("Deployment Routes", () => {
 
       const res = await ctx.app.inject({
         method: "GET",
-        url: "/api/deployments",
+        url: "/api/operations",
       });
 
       expect(res.statusCode).toBe(200);
@@ -904,7 +904,7 @@ describe("Deployment Routes", () => {
 
       const res = await ctx.app.inject({
         method: "GET",
-        url: `/api/deployments?partitionId=${p1.id}`,
+        url: `/api/operations?partitionId=${p1.id}`,
       });
 
       expect(res.statusCode).toBe(200);
@@ -934,19 +934,19 @@ describe("Deployment Routes", () => {
 
       const res = await ctx.app.inject({
         method: "GET",
-        url: `/api/deployments?artifactId=${art1}`,
+        url: `/api/operations?artifactId=${art1}`,
       });
 
       expect(res.statusCode).toBe(200);
       const body = JSON.parse(res.payload);
       expect(body.deployments).toHaveLength(1);
-      expect(body.deployments[0].artifactId).toBe(art1);
+      expect((body.deployments[0].input as any).artifactId).toBe(art1);
     });
   });
 
-  // --- GET /api/deployments/:id ---
+  // --- GET /api/operations/:id ---
 
-  describe("GET /api/deployments/:id", () => {
+  describe("GET /api/operations/:id", () => {
     it("returns a deployment with debrief entries", async () => {
       const env = ctx.environments.create("production");
       const partition = ctx.partitions.create("Acme");
@@ -962,7 +962,7 @@ describe("Deployment Routes", () => {
 
       const res = await ctx.app.inject({
         method: "GET",
-        url: `/api/deployments/${deploymentId}`,
+        url: `/api/operations/${deploymentId}`,
       });
 
       expect(res.statusCode).toBe(200);
@@ -975,18 +975,18 @@ describe("Deployment Routes", () => {
     it("returns 404 for non-existent deployment", async () => {
       const res = await ctx.app.inject({
         method: "GET",
-        url: "/api/deployments/does-not-exist",
+        url: "/api/operations/does-not-exist",
       });
 
       expect(res.statusCode).toBe(404);
       const body = JSON.parse(res.payload);
-      expect(body.error).toBe("Deployment not found");
+      expect(body.error).toBe("Operation not found");
     });
   });
 
-  // --- GET /api/deployments/:id/postmortem ---
+  // --- GET /api/operations/:id/postmortem ---
 
-  describe("GET /api/deployments/:id/postmortem", () => {
+  describe("GET /api/operations/:id/postmortem", () => {
     it("returns a postmortem for a deployment", async () => {
       const env = ctx.environments.create("production");
       const partition = ctx.partitions.create("Acme");
@@ -1002,7 +1002,7 @@ describe("Deployment Routes", () => {
 
       const res = await ctx.app.inject({
         method: "GET",
-        url: `/api/deployments/${deploymentId}/postmortem`,
+        url: `/api/operations/${deploymentId}/postmortem`,
       });
 
       expect(res.statusCode).toBe(200);
@@ -1013,7 +1013,7 @@ describe("Deployment Routes", () => {
     it("returns 404 for non-existent deployment", async () => {
       const res = await ctx.app.inject({
         method: "GET",
-        url: "/api/deployments/does-not-exist/postmortem",
+        url: "/api/operations/does-not-exist/postmortem",
       });
 
       expect(res.statusCode).toBe(404);