@tryinget/pi-agent-vent 0.1.0

package/tests/release-artifact-check.test.js

@@ -0,0 +1,168 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import {
+  collectPackagedMarkdownLinkFailures,
+  parsePackJson,
+  runReleaseArtifactCheck,
+  validatePackageFilesWhitelist,
+} from "../scripts/release-artifact-check.mjs";
+
+const readFrom = (files) => (filePath) => files[filePath] ?? "";
+
+test("packaged markdown link validation accepts packaged local, directory, query, fragment, and external links", () => {
+  const actualFiles = ["README.md", "docs/guide.md", "docs/nested/index.md", "package.json"];
+  const markdown = [
+    "[guide](docs/guide.md)",
+    "[guide with query](docs/guide.md?view=full#intro)",
+    '[guide with title](<docs/guide.md> "maintainer guide")',
+    "[reference][guide-ref]",
+    '[guide-ref]: docs/guide.md "reference title"',
+    "[directory](docs/nested/)",
+    "[fragment](#local-section)",
+    "[external](https://example.invalid/docs)",
+    "[mailto](mailto:maintainer@example.invalid)",
+  ].join("\n");
+
+  const result = collectPackagedMarkdownLinkFailures({
+    actualFiles,
+    readFile: readFrom({ "README.md": markdown, "docs/guide.md": "# Guide" }),
+  });
+
+  assert.deepEqual(result, { failures: [], packagedMarkdownCount: 3 });
+});
+
+test("packaged markdown link validation fails closed for missing local and reference links", () => {
+  const result = collectPackagedMarkdownLinkFailures({
+    actualFiles: ["README.md", "package.json"],
+    readFile: readFrom({
+      "README.md": ["[missing](docs/missing.md)", "[missing-ref]: docs/also-missing.md"].join("\n"),
+    }),
+  });
+
+  assert.deepEqual(result.failures, [
+    "README.md: local link missing from npm artifact: docs/missing.md",
+    "README.md: local link missing from npm artifact: docs/also-missing.md",
+  ]);
+});
+
+test("packaged markdown link validation fails closed for path escapes", () => {
+  const result = collectPackagedMarkdownLinkFailures({
+    actualFiles: ["README.md", "docs/guide.md", "package.json"],
+    readFile: readFrom({
+      "README.md": ["[parent](../outside.md)", "[absolute](/etc/passwd)"].join("\n"),
+      "docs/guide.md": "[nested parent](../../outside.md)",
+    }),
+  });
+
+  assert.deepEqual(result.failures, [
+    "README.md: local link escapes package root: ../outside.md",
+    "README.md: local link escapes package root: /etc/passwd",
+    "docs/guide.md: local link escapes package root: ../../outside.md",
+  ]);
+});
+
+test("pack json parser fails closed for malformed, stale, or unsafe pack output", () => {
+  assert.throws(() => parsePackJson("not json"), /Could not parse npm pack/);
+  assert.throws(() => parsePackJson(JSON.stringify([{ files: null }])), /Could not parse npm pack/);
+  assert.throws(
+    () => parsePackJson(JSON.stringify([{ files: [{ path: "../outside.md" }] }])),
+    /unsafe package path/,
+  );
+  assert.throws(
+    () => parsePackJson(JSON.stringify([{ files: [{ path: "/etc/passwd" }] }])),
+    /unsafe package path/,
+  );
+});
+
+test("package files whitelist fails closed for wildcard entries", () => {
+  assert.throws(
+    () =>
+      validatePackageFilesWhitelist({
+        cwd: process.cwd(),
+        filesEntries: ["docs/*.md"],
+        actualFiles: ["package.json", "docs/readme.txt"],
+      }),
+    /Unsupported files\[\] wildcard entry/,
+  );
+});
+
+test("package files whitelist detects missing and extra artifact entries", () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "agent-vent-artifact-check-"));
+  try {
+    fs.writeFileSync(path.join(dir, "package.json"), "{}\n");
+    fs.mkdirSync(path.join(dir, "docs"));
+    fs.writeFileSync(path.join(dir, "docs", "guide.md"), "# Guide\n");
+
+    const result = validatePackageFilesWhitelist({
+      cwd: dir,
+      filesEntries: ["docs/guide.md"],
+      actualFiles: ["README.md", "package.json", "unexpected.txt"],
+    });
+
+    assert.deepEqual(result, {
+      missing: ["docs/guide.md"],
+      extra: ["unexpected.txt"],
+    });
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("release artifact check accepts directory files entries and always-included metadata", () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "agent-vent-release-check-ok-"));
+  try {
+    fs.writeFileSync(path.join(dir, "package.json"), JSON.stringify({ files: ["docs"] }));
+    fs.writeFileSync(path.join(dir, "README.md"), "[guide](docs/guide.md)\n");
+    fs.writeFileSync(path.join(dir, "LICENSE"), "local test license\n");
+    fs.mkdirSync(path.join(dir, "docs"));
+    fs.writeFileSync(path.join(dir, "docs", "guide.md"), "# Guide\n");
+    const packJsonText = JSON.stringify([
+      {
+        files: [
+          { path: "README.md" },
+          { path: "LICENSE" },
+          { path: "docs/guide.md" },
+          { path: "package.json" },
+        ],
+      },
+    ]);
+    const logs = [];
+
+    runReleaseArtifactCheck({ cwd: dir, packJsonText, log: (message) => logs.push(message) });
+
+    assert.deepEqual(logs, [
+      "File whitelist OK (4 files).",
+      "Packaged Markdown links OK (2 files).",
+    ]);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("release artifact check reports packaged markdown failures with actionable wording", () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "agent-vent-release-check-"));
+  try {
+    fs.writeFileSync(
+      path.join(dir, "package.json"),
+      JSON.stringify({ files: ["README.md", "docs/guide.md"] }),
+    );
+    fs.mkdirSync(path.join(dir, "docs"));
+    fs.writeFileSync(path.join(dir, "README.md"), "[missing](docs/missing.md)\n");
+    fs.writeFileSync(path.join(dir, "docs", "guide.md"), "# Guide\n");
+    const packJsonText = JSON.stringify([
+      {
+        files: [{ path: "README.md" }, { path: "docs/guide.md" }, { path: "package.json" }],
+      },
+    ]);
+
+    assert.throws(
+      () => runReleaseArtifactCheck({ cwd: dir, packJsonText, log: () => {} }),
+      /Packaged Markdown link check failed\.\n- README\.md: local link missing from npm artifact: docs\/missing\.md/,
+    );
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});

package/tests/release-smoke-check.test.js

@@ -0,0 +1,235 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import {
+  assertAgentVentPathSmokeOutput,
+  assertInstalledArtifactPackage,
+  assertLocalTarballInstallSource,
+  assertPackageSpecInstalled,
+  buildLocalPathArtifactSettings,
+  executeInstalledArtifactToolPathSmoke,
+  packageSourcesFromSettings,
+} from "../scripts/release-smoke-check.mjs";
+
+test("release smoke settings check accepts only unfiltered string package entries", () => {
+  const settings = {
+    packages: [
+      "npm:/tmp/pkg-a.tgz",
+      { source: "npm:/tmp/pi-agent-vent.tgz", extensions: ["extensions/agent-vent.ts"] },
+      { source: 42 },
+      null,
+    ],
+  };
+
+  assert.deepEqual(packageSourcesFromSettings(settings), [
+    "npm:/tmp/pkg-a.tgz",
+    "npm:/tmp/pi-agent-vent.tgz",
+  ]);
+  assert.doesNotThrow(() =>
+    assertPackageSpecInstalled({ settings, packageSpec: "npm:/tmp/pkg-a.tgz" }),
+  );
+  assert.throws(
+    () => assertPackageSpecInstalled({ settings, packageSpec: "npm:/tmp/pi-agent-vent.tgz" }),
+    /requires an unfiltered package entry/,
+  );
+});
+
+test("release smoke settings check fails closed when package spec is missing", () => {
+  assert.throws(
+    () => assertPackageSpecInstalled({ settings: { packages: [] }, packageSpec: "" }),
+    /PACKAGE_SPEC is required/,
+  );
+  assert.throws(
+    () =>
+      assertPackageSpecInstalled({
+        settings: { packages: ["npm:/tmp/other.tgz"] },
+        packageSpec: "npm:/tmp/pi-agent-vent.tgz",
+      }),
+    /Installed package spec not found/,
+  );
+});
+
+test("release smoke validates local npm tarball specs as install sources only", () => {
+  assert.deepEqual(assertLocalTarballInstallSource({ packageSpec: "npm:/tmp/pi-agent-vent.tgz" }), {
+    tarballPath: "/tmp/pi-agent-vent.tgz",
+  });
+
+  assert.throws(
+    () => assertLocalTarballInstallSource({ packageSpec: "" }),
+    /PACKAGE_SPEC is required/,
+  );
+  assert.throws(
+    () => assertLocalTarballInstallSource({ packageSpec: "/tmp/pi-agent-vent.tgz" }),
+    /expected an npm: tarball install source/,
+  );
+  assert.throws(
+    () => assertLocalTarballInstallSource({ packageSpec: "npm:../pi-agent-vent.tgz" }),
+    /expected npm:<absolute \.tgz path>/,
+  );
+  assert.throws(
+    () => assertLocalTarballInstallSource({ packageSpec: "npm:/tmp/pi-agent-vent.zip" }),
+    /expected npm:<absolute \.tgz path>/,
+  );
+});
+
+test("release smoke installed artifact check verifies package identity and extension entrypoint", () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "agent-vent-installed-artifact-"));
+  try {
+    fs.mkdirSync(path.join(dir, "extensions"));
+    fs.writeFileSync(
+      path.join(dir, "extensions", "agent-vent.ts"),
+      "export default function() {}\n",
+    );
+    fs.writeFileSync(
+      path.join(dir, "package.json"),
+      JSON.stringify({
+        name: "@tryinget/pi-agent-vent",
+        version: "0.1.0",
+        pi: { extensions: ["./extensions/agent-vent.ts"] },
+      }),
+    );
+
+    assert.deepEqual(
+      assertInstalledArtifactPackage({
+        packageRoot: dir,
+        packageName: "@tryinget/pi-agent-vent",
+        packageVersion: "0.1.0",
+      }),
+      {
+        packageJsonPath: path.join(dir, "package.json"),
+        extensionPath: path.join(dir, "extensions", "agent-vent.ts"),
+      },
+    );
+
+    assert.throws(
+      () =>
+        assertInstalledArtifactPackage({
+          packageRoot: dir,
+          packageName: "@tryinget/pi-agent-vent",
+          packageVersion: "0.2.0",
+        }),
+      /Installed package version mismatch/,
+    );
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("release smoke can rewrite isolated settings to load installed artifact through local-path package discovery", () => {
+  assert.deepEqual(
+    buildLocalPathArtifactSettings({
+      settings: {
+        defaultProvider: "openai",
+        defaultModel: "gpt-4o",
+        packages: ["npm:/tmp/pi-agent-vent.tgz"],
+        extensions: ["/tmp/escape.ts"],
+      },
+      packageRoot: "/tmp/isolated-prefix/lib/node_modules/@tryinget/pi-agent-vent",
+    }),
+    {
+      defaultProvider: "openai",
+      defaultModel: "gpt-4o",
+      packages: ["/tmp/isolated-prefix/lib/node_modules/@tryinget/pi-agent-vent"],
+      extensions: [],
+    },
+  );
+});
+
+test("release smoke command output check accepts isolated agent vent path output", () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "agent-vent-smoke-ok-"));
+  try {
+    const output = [
+      `Agent vent store: ${dir}/vents.jsonl`,
+      `Agent vent review events: ${dir}/review-events.jsonl`,
+      `Agent vent curation events: ${dir}/curation-events.jsonl`,
+      `Agent vent retention events: ${dir}/retention-events.jsonl`,
+      `Agent vent retention backups: ${dir}/backups`,
+      "Schema: append-only JSONL events plus confirmation-gated local retention backup artifacts.",
+      "Override: set PI_AGENT_VENT_DIR to use a different private directory.",
+      "Authority boundary: records, review states, and curation projections are local diagnostics, not tasks, issues, incidents, evidence, telemetry, or ASC/self state; retention receipts and backups are local diagnostics too.",
+    ].join("\n");
+
+    assert.doesNotThrow(() => assertAgentVentPathSmokeOutput({ output, ventDir: dir }));
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("release smoke installed shadow registered-tool path stays isolated and does not read active stores", async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "agent-vent-tool-smoke-"));
+  try {
+    const unsafeTarget = path.join(dir, "unsafe-target.jsonl");
+    fs.writeFileSync(unsafeTarget, "", "utf8");
+    fs.symlinkSync(unsafeTarget, path.join(dir, "vents.jsonl"));
+
+    const result = await executeInstalledArtifactToolPathSmoke({
+      packageRoot: process.cwd(),
+      ventDir: dir,
+    });
+
+    assert.equal(result.executionMode, "shadow-copy");
+    assert.match(result.output, /Agent vent store:/);
+    assert.match(result.output, /not tasks, issues, incidents, evidence/);
+    assert.equal(fs.lstatSync(path.join(dir, "vents.jsonl")).isSymbolicLink(), true);
+    assert.equal(fs.existsSync(path.join(dir, "review-events.jsonl")), false);
+    assert.equal(fs.existsSync(path.join(dir, "curation-events.jsonl")), false);
+    assert.equal(fs.existsSync(path.join(dir, "retention-events.jsonl")), false);
+    assert.equal(fs.existsSync(path.join(dir, "backups")), false);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("release smoke installed shadow registered-tool path fails closed when tool is not registered", async () => {
+  const packageRoot = fs.mkdtempSync(path.join(os.tmpdir(), "agent-vent-no-tool-"));
+  const ventDir = fs.mkdtempSync(path.join(os.tmpdir(), "agent-vent-no-tool-store-"));
+  try {
+    fs.mkdirSync(path.join(packageRoot, "extensions"));
+    fs.writeFileSync(
+      path.join(packageRoot, "extensions", "agent-vent.ts"),
+      "export default function(pi) { pi.registerCommand('agent_vent', { handler() {} }); }\n",
+    );
+
+    await assert.rejects(
+      () => executeInstalledArtifactToolPathSmoke({ packageRoot, ventDir }),
+      /did not register executable agent_vent tool/,
+    );
+  } finally {
+    fs.rmSync(packageRoot, { recursive: true, force: true });
+    fs.rmSync(ventDir, { recursive: true, force: true });
+  }
+});
+
+test("release smoke command output check fails closed for wrong store, missing boundary, or default store", () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "agent-vent-smoke-bad-"));
+  try {
+    assert.throws(
+      () =>
+        assertAgentVentPathSmokeOutput({
+          output: "Agent vent store: /tmp/other/vents.jsonl",
+          ventDir: dir,
+        }),
+      /did not match the expected local diagnostic contract/,
+    );
+
+    const defaultStoreOutput = [
+      `Agent vent store: ${dir}/vents.jsonl`,
+      `Agent vent review events: ${dir}/review-events.jsonl`,
+      `Agent vent curation events: ${dir}/curation-events.jsonl`,
+      `Agent vent retention events: ${dir}/retention-events.jsonl`,
+      `Agent vent retention backups: ${dir}/backups`,
+      "Override: set PI_AGENT_VENT_DIR to use a different private directory.",
+      "Authority boundary: records, review states, and curation projections are local diagnostics, not tasks, issues, incidents, evidence, telemetry, or ASC/self state; retention receipts and backups are local diagnostics too.",
+      "accidental /.pi/agent/agent-vent/vents.jsonl leak",
+    ].join("\n");
+
+    assert.throws(
+      () => assertAgentVentPathSmokeOutput({ output: defaultStoreOutput, ventDir: dir }),
+      /default operator vent store/,
+    );
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});