@velum-labs/routekit-eval-setup 1.3.2 → 1.5.0

package/dist/test/repository-command-diagnostic.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/repository-command-diagnostic.test.js

@@ -0,0 +1,55 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { decodeRepositoryCommandDiagnosticV1, encodeRepositoryCommandDiagnosticV1, sanitizeRepositoryCommandDiagnosticV1, sanitizeRepositoryCommandOutputV1 } from "../adapters/repository-command-diagnostic.js";
+test("repository command diagnostics prefer stderr, remove terminal styling, and retain compiler context", () => {
+    const diagnostic = sanitizeRepositoryCommandDiagnosticV1("build completed with warnings", "\u001b[31msrc/index.ts(12,4): error TS2322: Type 'number' is not assignable to type 'string'.\u001b[0m");
+    assert.deepEqual(diagnostic, {
+        text: [
+            "src/index.ts(12,4): error TS2322: Type 'number' is not assignable to type 'string'.",
+            "build completed with warnings"
+        ].join("\n"),
+        truncated: false
+    });
+});
+test("repository command diagnostics redact common credential forms before bounding output", () => {
+    const diagnostic = sanitizeRepositoryCommandDiagnosticV1([
+        "Authorization: Bearer bearer-secret",
+        "api_key=api-secret",
+        "token: token-secret",
+        "https://alice:password@example.test/repo.git?access_token=query-secret",
+        "github_pat_123456789012345678901234567890",
+        "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.signature123"
+    ].join("\n"), "src/app.ts(1,1): error TS1005: ';' expected.");
+    assert.ok(diagnostic);
+    assert.match(diagnostic.text, /error TS1005/u);
+    assert.match(diagnostic.text, /Authorization: \[redacted\]/u);
+    assert.match(diagnostic.text, /api_key=\[redacted\]/u);
+    assert.match(diagnostic.text, /token: \[redacted\]/u);
+    assert.match(diagnostic.text, /https:\/\/\[redacted\]@example\.test\/repo\.git\?access_token=\[redacted\]/u);
+    assert.doesNotMatch(diagnostic.text, /bearer-secret|api-secret|token-secret|password|query-secret|github_pat_|eyJhbGci/u);
+});
+test("streaming command output sanitization redacts complete multiline secrets", () => {
+    const output = sanitizeRepositoryCommandOutputV1([
+        "token=stream-secret",
+        'Authorization: "Bearer quoted secret"',
+        "provider key sk-abcdefghijklmnopqrstuvwxyz123456",
+        "-----BEGIN PRIVATE KEY-----",
+        "private-material",
+        "-----END PRIVATE KEY-----",
+        "src/index.ts(1,1): error TS1005"
+    ].join("\n"));
+    assert.match(output, /token=\[redacted\]/u);
+    assert.match(output, /\[redacted\]/u);
+    assert.match(output, /error TS1005/u);
+    assert.doesNotMatch(output, /stream-secret|quoted secret|sk-abcdefghijklmnopqrstuvwxyz123456|private-material/u);
+});
+test("repository command diagnostics expose and preserve truncation through canonical transport", () => {
+    const diagnostic = sanitizeRepositoryCommandDiagnosticV1("x".repeat(10_000), "", true);
+    assert.ok(diagnostic);
+    assert.equal(diagnostic.text.length, 3_072);
+    assert.equal(diagnostic.truncated, true);
+    const encoded = encodeRepositoryCommandDiagnosticV1(diagnostic.text);
+    assert.equal(decodeRepositoryCommandDiagnosticV1(encoded), diagnostic.text);
+    assert.equal(decodeRepositoryCommandDiagnosticV1(`${encoded}=`), undefined);
+    assert.equal(decodeRepositoryCommandDiagnosticV1(Buffer.from("x".repeat(3_073), "utf8").toString("base64url")), undefined);
+});

package/dist/test/repository-command-signals.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/repository-command-signals.test.js

@@ -0,0 +1,124 @@
+import assert from "node:assert/strict";
+import { execFile, spawn } from "node:child_process";
+import { once } from "node:events";
+import { mkdtemp, realpath, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import { promisify } from "node:util";
+import { Effect } from "effect";
+import { repositoryCommandTestEvidenceV1 } from "../adapters/repository-command-evidence.js";
+import { replayRepositoryCommandsV1 } from "../adapters/repository-command-runner.js";
+import { RepositoryCommandObservability } from "../services/command-observability/service.js";
+test("repository commands emit bounded sanitized live stdout and stderr observations", async (t) => {
+    const root = await realpath(await mkdtemp(join(tmpdir(), "repository-command-observation-")));
+    t.after(() => rm(root, { recursive: true, force: true }));
+    await writeFile(join(root, "observe.mjs"), `
+process.stdout.write("token=stream");
+setTimeout(() => process.stdout.write("-secret\\n"), 10);
+setTimeout(() => process.stderr.write("src/index.ts(1,1): error TS1005\\n"), 20);
+setTimeout(() => process.stdout.write("x".repeat(20 * 1024) + "\\n"), 30);
+`);
+    const execute = promisify(execFile);
+    const git = (...args) => execute("git", ["-C", root, ...args]);
+    await git("init", "-q");
+    await git("add", ".");
+    await git("-c", "core.hooksPath=/dev/null", "-c", "commit.gpgsign=false", "-c", "user.name=Fixture", "-c", "user.email=fixture@example.test", "commit", "-qm", "command observation fixture");
+    const observations = [];
+    const results = await Effect.runPromise(replayRepositoryCommandsV1({
+        repositoryRoot: root,
+        commit: "HEAD",
+        recipes: [
+            {
+                id: "observe-output",
+                kind: "test",
+                executable: "node",
+                cwd: ".",
+                args: ["observe.mjs"],
+                timeoutMs: 5_000
+            }
+        ],
+        repetitions: 1
+    }).pipe(Effect.provideService(RepositoryCommandObservability, {
+        observe: (event) => observations.push(event)
+    })));
+    assert.equal(results[0]?.exitCode, 0);
+    assert.equal(observations[0]?.kind, "started");
+    assert.equal(observations.at(-1)?.kind, "completed");
+    const output = observations.filter((event) => event.kind === "output");
+    assert.ok(output.some((event) => event.stream === "stdout"));
+    assert.ok(output.some((event) => event.stream === "stderr"));
+    assert.deepEqual(output.map((event) => event.sequence), output.map((_event, index) => index + 1));
+    const text = output.map((event) => event.chunk).join("");
+    assert.match(text, /token=\[redacted\]/u);
+    assert.match(text, /error TS1005/u);
+    assert.doesNotMatch(text, /stream-secret/u);
+    assert.ok(output.reduce((total, event) => total + event.chunkBytes, 0) > 20 * 1_024);
+    assert.ok(output.every((event) => event.chunkBytes <= 2 * 1_024));
+    assert.ok(output.every((event) => event.commandBytes <= 64 * 1_024));
+});
+test("sandboxed runners can terminate their children but cannot signal unrelated processes", async (t) => {
+    if (process.platform !== "darwin") {
+        t.skip("checks the macOS candidate sandbox signal boundary");
+        return;
+    }
+    const unrelated = spawn(process.execPath, ["-e", "setInterval(() => {}, 1000)"], {
+        stdio: "ignore"
+    });
+    await once(unrelated, "spawn");
+    assert.ok(unrelated.pid);
+    t.after(async () => {
+        if (unrelated.exitCode === null && unrelated.signalCode === null) {
+            const closed = once(unrelated, "close");
+            unrelated.kill("SIGKILL");
+            await closed;
+        }
+    });
+    const root = await realpath(await mkdtemp(join(tmpdir(), "repository-signal-boundary-")));
+    t.after(() => rm(root, { recursive: true, force: true }));
+    await writeFile(join(root, "case.test.mjs"), `
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { once } from "node:events";
+import { test } from "node:test";
+test("worker cleanup stays inside the process family", async () => {
+  const worker = spawn(process.execPath, ["-e", "setInterval(() => {}, 1000)"], { stdio: "ignore" });
+  await once(worker, "spawn");
+  const exited = once(worker, "exit");
+  assert.doesNotThrow(() => worker.kill("SIGTERM"));
+  await exited;
+  assert.equal(worker.signalCode, "SIGTERM");
+  assert.throws(
+    () => process.kill(${unrelated.pid}, 0),
+    error => error.code === "EPERM",
+    "signal zero must be denied for the separate host-owned process"
+  );
+});
+`);
+    const execute = promisify(execFile);
+    const git = (...args) => execute("git", ["-C", root, ...args]);
+    await git("init", "-q");
+    await git("add", ".");
+    await git("-c", "core.hooksPath=/dev/null", "-c", "commit.gpgsign=false", "-c", "user.name=Fixture", "-c", "user.email=fixture@example.test", "commit", "-qm", "synthetic worker lifecycle fixture");
+    const results = await Effect.runPromise(replayRepositoryCommandsV1({
+        repositoryRoot: root,
+        commit: "HEAD",
+        recipes: [
+            {
+                id: "worker-lifecycle",
+                kind: "test",
+                executable: "node",
+                cwd: ".",
+                args: ["--test", "case.test.mjs"],
+                timeoutMs: 10000
+            }
+        ],
+        repetitions: 2
+    }));
+    assert.equal(results.length, 2);
+    for (const result of results) {
+        assert.equal(repositoryCommandTestEvidenceV1(result, "worker-lifecycle").outcome, "pass", JSON.stringify(result));
+    }
+    assert.equal(unrelated.exitCode, null);
+    assert.equal(unrelated.signalCode, null);
+});

package/dist/test/repository-fixture-scope-coverage.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/repository-fixture-scope-coverage.test.js

@@ -0,0 +1,127 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { assertRepositoryFixtureScopeCoverageV1 } from "../services/case-generation/service.js";
+const scope = [{ id: "eligible-conversion" }, { id: "unrelated-mime-preservation" }];
+const proposal = () => ({
+    fixtures: [
+        {
+            id: "conversion",
+            description: "Eligible transport conversion",
+            expectedBehavior: "Eligible bodies convert to the public response object.",
+            testPath: "test/transport.test.ts",
+            kind: "historical-regression",
+            expectationMode: "changes"
+        },
+        {
+            id: "preservation",
+            description: "Preserved ineligible transport",
+            expectedBehavior: "Unrelated media types retain their original readable bodies.",
+            testPath: "test/transport.test.ts",
+            kind: "metamorphic",
+            expectationMode: "preserved"
+        }
+    ],
+    overlays: [
+        { path: "test/transport.test.ts", fixtureIds: ["conversion"], content: "// conversion" },
+        { path: "test/transport.test.ts", fixtureIds: ["preservation"], content: "// preservation" }
+    ],
+    knownLimitations: [],
+    scopeCoverage: [
+        {
+            scopeId: "eligible-conversion",
+            outcome: "covered",
+            fixtureIds: ["conversion"],
+            detail: "Checks converted output and metadata for every eligible input category."
+        },
+        {
+            scopeId: "unrelated-mime-preservation",
+            outcome: "covered",
+            fixtureIds: ["preservation"],
+            detail: "Checks readable original bytes and metadata for unrelated media types."
+        }
+    ]
+});
+test("grounded fixture coverage rejects missing, duplicate, invented, and unbound obligations", () => {
+    const valid = proposal();
+    const coverage = valid.scopeCoverage;
+    const invalid = [
+        ["absent coverage", { ...valid, scopeCoverage: undefined }],
+        ["empty coverage", { ...valid, scopeCoverage: [] }],
+        ["omitted clause", { ...valid, scopeCoverage: coverage.slice(0, 1) }],
+        ["duplicate clause", { ...valid, scopeCoverage: [coverage[0], coverage[0]] }],
+        [
+            "invented clause",
+            {
+                ...valid,
+                scopeCoverage: [coverage[0], { ...coverage[1], scopeId: "not-in-grounded-scope" }]
+            }
+        ],
+        [
+            "invented fixture",
+            {
+                ...valid,
+                scopeCoverage: [coverage[0], { ...coverage[1], fixtureIds: ["not-an-existing-fixture"] }]
+            }
+        ],
+        [
+            "empty fixture binding",
+            {
+                ...valid,
+                scopeCoverage: [coverage[0], { ...coverage[1], fixtureIds: [] }]
+            }
+        ],
+        [
+            "duplicate fixture binding",
+            {
+                ...valid,
+                scopeCoverage: [
+                    coverage[0],
+                    { ...coverage[1], fixtureIds: ["preservation", "preservation"] }
+                ]
+            }
+        ],
+        [
+            "no explanation",
+            {
+                ...valid,
+                scopeCoverage: [coverage[0], { ...coverage[1], detail: "   " }]
+            }
+        ]
+    ];
+    for (const [name, candidate] of invalid) {
+        assert.throws(() => assertRepositoryFixtureScopeCoverageV1(candidate, scope), /every grounded behavioral scope clause/u, name);
+    }
+});
+test("known limitations cannot excuse unsupported, contradictory, or uncertain required coverage", () => {
+    for (const outcome of ["unsupported", "contradictory", "uncertain"]) {
+        const candidate = proposal();
+        assert.throws(() => assertRepositoryFixtureScopeCoverageV1({
+            ...candidate,
+            knownLimitations: [
+                "The reference cannot satisfy this visible requirement, so its assertion is omitted."
+            ],
+            scopeCoverage: [
+                candidate.scopeCoverage[0],
+                { ...candidate.scopeCoverage[1], outcome }
+            ]
+        }, scope), /known limitations cannot excuse mandatory omissions/u, outcome);
+    }
+});
+test("complete scope declarations preserve metadata and legacy proposals remain optional", () => {
+    const candidate = proposal();
+    const original = structuredClone(candidate);
+    assertRepositoryFixtureScopeCoverageV1(candidate, scope);
+    assert.deepEqual(candidate, original);
+    assertRepositoryFixtureScopeCoverageV1({
+        ...candidate,
+        knownLimitations: ["Performance under high concurrency is outside this behavioral scope."]
+    }, scope);
+    const { scopeCoverage: _coverage, ...legacy } = candidate;
+    assertRepositoryFixtureScopeCoverageV1(legacy, undefined);
+    // Existing plans do not acquire a new semantic gate merely because an optional
+    // declaration was returned by a model that was not given a grounded scope.
+    assertRepositoryFixtureScopeCoverageV1({
+        ...legacy,
+        scopeCoverage: [{ ...candidate.scopeCoverage[0], outcome: "uncertain" }]
+    }, undefined);
+});

package/dist/test/repository-fixture-validation.test.d.ts

@@ -0,0 +1 @@
+export {};