@wenathlan/devthink 2.0.13 → 2.0.15

package/tests/confirmgates.test.ts

@@ -0,0 +1,190 @@
+import { describe, expect, it } from "vitest";
+import {
+  credspayload,
+  deletepayload,
+  gateforstep,
+  gatekindfor,
+  gateprompttext,
+  gatestateof,
+  nobatchresolution,
+  opengate,
+  paypayload,
+  resolvegate,
+} from "../gates.js";
+
+const now = 1_800_000_000_000;
+
+describe("confirmgates", () => {
+  it("maps the sensitive classes to their gated families", () => {
+    expect(gatekindfor(["payment"])).toBe("confirmpay");
+    expect(gatekindfor(["delete"])).toBe("confirmdelete");
+    expect(gatekindfor(["credential"])).toBe("confirmcreds");
+    expect(gatekindfor(["publish"])).toBeUndefined();
+    expect(gatekindfor([])).toBeUndefined();
+  });
+
+  it("shows the amount, payee origin and target element on confirmpay gates", () => {
+    const payload = paypayload({ amount: "49.90", payeeorigin: "https://shop.example", target: "#pay" });
+    expect(payload).toEqual({ amount: "49.90", payeeorigin: "https://shop.example", target: "#pay" });
+    const minimal = paypayload({ payeeorigin: "https://shop.example" });
+    expect(minimal).toEqual({ payeeorigin: "https://shop.example" });
+    const gate = opengate({
+      kind: "confirmpay",
+      stepid: "step",
+      runid: "run",
+      origin: "https://shop.example",
+      payload,
+      now,
+    });
+    expect(gate.state).toBe("open");
+    expect(gateprompttext(gate)).toMatch(/49\.90/);
+    expect(gateprompttext(gate)).toMatch(/https:\/\/shop\.example/);
+    expect(gateprompttext(gate)).toMatch(/distinct human action/);
+  });
+
+  it("shows the target, scope and irreversibility on confirmdelete gates", () => {
+    const gate = opengate({
+      kind: "confirmdelete",
+      stepid: "step",
+      runid: "run",
+      origin: "https://shop.example",
+      payload: deletepayload({
+        target: "#orders",
+        scope: "the order history",
+        irreversibility: "The deletion destroys the order history the site cannot restore.",
+      }),
+      now,
+    });
+    expect(gateprompttext(gate)).toMatch(/#orders/);
+    expect(gateprompttext(gate)).toMatch(/order history/);
+    expect(gateprompttext(gate)).toMatch(/cannot restore/);
+  });
+
+  it("shows the credential label only on confirmcreds gates and never the value", () => {
+    const payload = credspayload("Bank login");
+    expect(payload).toEqual({ label: "Bank login" });
+    expect(() => credspayload(" ")).toThrow(/label/);
+    const gate = opengate({
+      kind: "confirmcreds",
+      stepid: "step",
+      runid: "run",
+      origin: "https://bank.example",
+      payload,
+      now,
+    });
+    expect(gateprompttext(gate)).toMatch(/Bank login/);
+    expect(gateprompttext(gate)).toMatch(/value stays behind the vault/);
+    expect(gateprompttext(gate)).not.toMatch(/hunter2/);
+  });
+
+  it("resolves exactly one open gate through one explicit human action and stays terminal", () => {
+    const gate = opengate({
+      kind: "confirmpay",
+      stepid: "step",
+      runid: "run",
+      origin: "https://shop.example",
+      payload: paypayload({ payeeorigin: "https://shop.example" }),
+      now,
+    });
+    const resolved = resolvegate({
+      gates: [gate],
+      gateid: gate.gateid,
+      decision: "resolved",
+      actor: "user",
+      now: now + 1200,
+    });
+    expect(resolved.resolution?.decision).toBe("resolved");
+    expect(resolved.resolution?.actor).toBe("user");
+    const updated = resolved.gates?.[0];
+    expect(updated?.state).toBe("resolved");
+    expect(updated?.resolvedat).toBe(now + 1200);
+    const again = resolvegate({
+      gates: resolved.gates ?? [],
+      gateid: gate.gateid,
+      decision: "refused",
+      actor: "user",
+      now: now + 1500,
+    });
+    expect(again.resolution).toBeUndefined();
+    expect(again.gates?.[0]?.state).toBe("resolved");
+  });
+
+  it("refuses resolutions without an acting user and batch approvals", () => {
+    const gate = opengate({
+      kind: "confirmdelete",
+      stepid: "step",
+      runid: "run",
+      origin: "https://shop.example",
+      payload: deletepayload({ scope: "history", irreversibility: "gone" }),
+      now,
+    });
+    expect(() => resolvegate({ gates: [gate], gateid: gate.gateid, decision: "resolved", actor: "", now })).toThrow(
+      /acting user/,
+    );
+    expect(nobatchresolution(["one"]).allowed).toBe(true);
+    expect(nobatchresolution(["one", "two"]).allowed).toBe(false);
+    expect(nobatchresolution(["one", "two"]).reason).toMatch(/no batch approval/);
+    expect(nobatchresolution([]).allowed).toBe(false);
+  });
+
+  it("reads the gate state of one step: none, open, resolved or refused", () => {
+    expect(gatestateof([], "step").state).toBe("none");
+    const gate = opengate({
+      kind: "confirmpay",
+      stepid: "step",
+      runid: "run",
+      origin: "https://shop.example",
+      payload: paypayload({ payeeorigin: "https://shop.example" }),
+      now,
+    });
+    expect(gatestateof([gate], "step").state).toBe("open");
+    const resolved = resolvegate({ gates: [gate], gateid: gate.gateid, decision: "refused", actor: "user", now });
+    expect(gatestateof(resolved.gates ?? [], "step").state).toBe("refused");
+    expect(gatestateof(resolved.gates ?? [], "other").state).toBe("none");
+  });
+
+  it("builds the gate of one gated step from its reviewed shape", () => {
+    const paystep = {
+      id: "pay",
+      kind: "fillcard" as const,
+      target: "#card",
+      options: JSON.stringify({ amount: "12.00", payeeorigin: "https://shop.example" }),
+    };
+    const paygate = gateforstep({
+      step: paystep,
+      classes: ["payment"],
+      runid: "run",
+      origin: "https://shop.example",
+      now,
+    });
+    expect(paygate?.kind).toBe("confirmpay");
+    expect(paygate?.payload.amount).toBe("12.00");
+    expect(paygate?.payload.payeeorigin).toBe("https://shop.example");
+    const deletestep = { id: "del", kind: "discardtab" as const, target: "#orders" };
+    const deletegate = gateforstep({
+      step: deletestep,
+      classes: ["delete"],
+      runid: "run",
+      origin: "https://shop.example",
+      now,
+    });
+    expect(deletegate?.kind).toBe("confirmdelete");
+    expect(deletegate?.payload.scope).toBe("https://shop.example");
+    const credstep = { id: "cred", kind: "consentpassword" as const, target: "#login" };
+    const credgate = gateforstep({
+      step: credstep,
+      classes: ["credential"],
+      runid: "run",
+      origin: "https://bank.example",
+      credentiallabel: "Bank login",
+      now,
+    });
+    expect(credgate?.payload).toEqual({ label: "Bank login" });
+    expect(
+      gateforstep({ step: credstep, classes: ["credential"], runid: "run", origin: "https://bank.example", now }),
+    ).toBeUndefined();
+    expect(
+      gateforstep({ step: paystep, classes: ["publish"], runid: "run", origin: "https://shop.example", now }),
+    ).toBeUndefined();
+  });
+});

package/tests/containerpack.test.ts

@@ -0,0 +1,143 @@
+import { access, constants, readFile } from "node:fs/promises";
+import { describe, expect, it } from "vitest";
+import { containerexposedsurfaces, containerrunnerentry } from "../pack.js";
+
+describe("containerpack", () => {
+  it("keeps THE Dockerfile and retires the compose stack and every second container script", async () => {
+    const dockerfile = await readFile("Dockerfile", "utf8");
+    expect(dockerfile.length).toBeGreaterThan(0);
+    await expect(access("compose.yml", constants.F_OK)).rejects.toThrow();
+    await expect(access("containerfile", constants.F_OK)).rejects.toThrow();
+  });
+
+  it("builds the multi stage image with the dependency layer, the validated builder, the lean runtime and the folded binary target", async () => {
+    const dockerfile = await readFile("Dockerfile", "utf8");
+    /* the build stages pin to the native build platform (the saddle
+    container doctrine: the toolchain installs native and the library build
+    runs at native speed — the prisma dmmf json corrupts under the qemu
+    emulation of the emulated legs) while the runtime stages stay per leg. */
+    expect(dockerfile).toContain("FROM --platform=$BUILDPLATFORM ${NODE_IMAGE} AS deps");
+    expect(dockerfile).toContain("FROM --platform=$BUILDPLATFORM ${NODE_IMAGE} AS builder");
+    expect(dockerfile).toContain("COPY --from=builder /work /work");
+    expect(dockerfile).toContain("FROM --platform=$BUILDPLATFORM ${NODE_IMAGE} AS binary-builder");
+    expect(dockerfile).toContain("FROM gcr.io/distroless/cc-debian12:nonroot AS binary-runtime");
+    /* the runtime base is its own arg: the four-arch family surface rides
+    the trixie slim line (the only 26.8.x tag whose manifest answers amd64,
+    arm64, ppc64le and s390x) while the build stages keep the toolchain
+    line pinned to the engines floor. */
+    expect(dockerfile).toContain('ARG NODE_RUNTIME_IMAGE="node:26.8.1-trixie-slim"');
+    expect(dockerfile).toContain("FROM ${NODE_RUNTIME_IMAGE} AS runtime");
+    /* the runner stage closes the file: it stays the default build target
+    (a plain docker build and the publish lanes build the runner image, the
+    single-binary surface stays behind its own --target) */
+    const fromLines = [...dockerfile.matchAll(/^FROM .*$/gm)].map((match) => match[0]);
+    expect(fromLines.at(-1)).toBe("FROM ${NODE_RUNTIME_IMAGE} AS runtime");
+  });
+
+  it("resolves the compiled binary target from TARGETARCH so the arm64 image never carries an x64 binary", async () => {
+    const dockerfile = await readFile("Dockerfile", "utf8");
+    expect(dockerfile).toContain("ARG TARGETARCH");
+    expect(dockerfile).toContain('arm64|aarch64) buntarget="bun-linux-arm64"');
+    expect(dockerfile).toContain('buntarget="bun-linux-x64"');
+    expect(dockerfile).not.toContain("--target=bun-linux-x64");
+  });
+
+  it("runs the library build and the deterministic build checks in the builder before the runtime ships", async () => {
+    const dockerfile = await readFile("Dockerfile", "utf8");
+    expect(dockerfile).toContain("RUN node tests/build.mjs");
+    expect(dockerfile).toContain("RUN node dist/cli.js manifest");
+    expect(dockerfile).toContain(
+      "RUN node dist/cli.js headless dist/fixtures/plans/release-notes-plan.json --fixtures dist/fixtures",
+    );
+    expect(dockerfile).toContain("RUN node tests/nativesmoke.mjs");
+    expect(dockerfile).toContain("RUN node tests/packageextension.mjs");
+    expect(dockerfile).toContain("web/manifest.json");
+  });
+
+  it("runs the vitest suite in the builder with the qemu scaled timeouts before the runtime ships", async () => {
+    const dockerfile = await readFile("Dockerfile", "utf8");
+    expect(dockerfile).toContain(
+      'RUN if [ "$(uname -m)" = "aarch64" ]; then export DEVTHINK_TEST_TIMEOUT_MS=120000 DEVTHINK_TEST_BUDGET_MS=10000; fi',
+    );
+    const vitestconfig = await readFile("vitest.config.ts", "utf8");
+    expect(vitestconfig).toContain("Number(process.env.DEVTHINK_TEST_TIMEOUT_MS ?? 5000)");
+  });
+
+  it("scales the smoke boot budget for the emulated legs so the four-arch build never flakes on qemu", async () => {
+    const dockerfile = await readFile("Dockerfile", "utf8");
+    expect(dockerfile).toContain("node container.mjs --check & runnerpid=$!");
+    expect(dockerfile).toContain("the container runner died during the smoke boot");
+    expect(dockerfile).toContain('case "${TARGETARCH}" in ppc64le|s390x) smokebudget=90 ;; esac');
+    expect(dockerfile).toContain("the container runner never answered /healthz within ${smokebudget}s");
+    expect(dockerfile).toContain('wait "${runnerpid}"');
+  });
+
+  it("exposes the static site, the socket relay and the mcp server behind the operator chosen environment", async () => {
+    const dockerfile = await readFile("Dockerfile", "utf8");
+    for (const surface of containerexposedsurfaces()) {
+      expect(dockerfile).toContain(surface.bindenv);
+      expect(dockerfile).toContain(surface.portenv);
+    }
+    expect(containerrunnerentry()).toBe("node container.mjs");
+    expect(dockerfile).toContain("DEVTHINK_RELAY_PATH=/relay");
+    expect(dockerfile).toContain("DEVTHINK_MCP_BIND=127.0.0.1");
+    expect(dockerfile).toContain("EXPOSE 8080 7436");
+    expect(dockerfile).toContain('ENTRYPOINT ["node", "container.mjs"]');
+    expect(dockerfile).toContain("COPY --from=builder --chown=10000:10000 /work/dist/site /app/dist/site");
+    expect(dockerfile).toContain("COPY --from=builder --chown=10000:10000 /work/dist/cli.js /app/dist/cli.js");
+    expect(dockerfile).toContain("COPY --from=builder --chown=10000:10000 /work/dist/http.js /app/dist/http.js");
+  });
+
+  it("absorbs the retired compose behaviors into the one container file", async () => {
+    const dockerfile = await readFile("Dockerfile", "utf8");
+    for (const flag of [
+      "--read-only",
+      "--cap-drop ALL",
+      "no-new-privileges:true",
+      "--pids-limit 512",
+      "--network none",
+      "--tmpfs /tmp:size=2g,mode=1777",
+    ]) {
+      expect(dockerfile).toContain(flag);
+    }
+    expect(dockerfile).toContain("DEVTHINK_MEMORY_ENGINE=ram");
+    expect(dockerfile).toContain('DEVTHINK_PLATFORM=""');
+    expect(dockerfile).toContain('DEVTHINK_CDN_URL=""');
+  });
+
+  it("runs the image as the non root devthink user with a live healthcheck and the OCI labels of the DevThink identity", async () => {
+    const dockerfile = await readFile("Dockerfile", "utf8");
+    expect(dockerfile).toContain("groupadd --gid 10000 devthink");
+    expect(dockerfile).toContain("useradd --uid 10000 --gid 10000");
+    expect(dockerfile).toMatch(/HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3/);
+    expect(dockerfile).toContain("/healthz");
+    expect(dockerfile).toContain('org.opencontainers.image.version="${DEVTHINK_VERSION}"');
+    expect(dockerfile).toContain('org.opencontainers.image.source="https://github.com/wenathlan/devthink"');
+    expect(dockerfile).not.toMatch(/:latest\b/);
+  });
+
+  it("publishes the image with version tags only, the registry buildcache and the four architecture family surface", async () => {
+    const publish = await readFile(".github/workflows/publishghcr.yml", "utf8");
+    expect(publish).not.toContain(":latest");
+    expect(publish).toContain("target: runtime");
+    expect(publish).toContain("devthink-buildcache");
+    expect(publish).toContain("type=gha");
+    expect(publish).toContain("mode=max");
+    /* the four-arch family union the saddle publish lane established
+    (amd64, arm64, ppc64le, s390x) with the qemu pin for the emulated
+    legs and the index assertion that fixes the published surface. */
+    expect(publish).toContain("platforms: linux/arm64,linux/ppc64le,linux/s390x");
+    expect(publish).toContain("platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x");
+    expect(publish).toContain('. == ["amd64", "arm64", "ppc64le", "s390x"]');
+    expect(publish).toContain("provenance: mode=max");
+    expect(publish).toContain("sbom: true");
+    expect(publish).toContain("aquasecurity/trivy-action@v0.36.0");
+  });
+
+  it("builds the release container archive from THE Dockerfile", async () => {
+    const container = await readFile(".github/workflows/container.yml", "utf8");
+    expect(container).toContain("docker build");
+    expect(container).toContain("--build-arg DEVTHINK_VERSION=");
+    expect(container).toContain("docker save");
+  });
+});