@wenathlan/devthink 2.0.15 → 2.0.19

package/tests/confirmgates.test.ts

@@ -1,190 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  credspayload,
-  deletepayload,
-  gateforstep,
-  gatekindfor,
-  gateprompttext,
-  gatestateof,
-  nobatchresolution,
-  opengate,
-  paypayload,
-  resolvegate,
-} from "../gates.js";
-
-const now = 1_800_000_000_000;
-
-describe("confirmgates", () => {
-  it("maps the sensitive classes to their gated families", () => {
-    expect(gatekindfor(["payment"])).toBe("confirmpay");
-    expect(gatekindfor(["delete"])).toBe("confirmdelete");
-    expect(gatekindfor(["credential"])).toBe("confirmcreds");
-    expect(gatekindfor(["publish"])).toBeUndefined();
-    expect(gatekindfor([])).toBeUndefined();
-  });
-
-  it("shows the amount, payee origin and target element on confirmpay gates", () => {
-    const payload = paypayload({ amount: "49.90", payeeorigin: "https://shop.example", target: "#pay" });
-    expect(payload).toEqual({ amount: "49.90", payeeorigin: "https://shop.example", target: "#pay" });
-    const minimal = paypayload({ payeeorigin: "https://shop.example" });
-    expect(minimal).toEqual({ payeeorigin: "https://shop.example" });
-    const gate = opengate({
-      kind: "confirmpay",
-      stepid: "step",
-      runid: "run",
-      origin: "https://shop.example",
-      payload,
-      now,
-    });
-    expect(gate.state).toBe("open");
-    expect(gateprompttext(gate)).toMatch(/49\.90/);
-    expect(gateprompttext(gate)).toMatch(/https:\/\/shop\.example/);
-    expect(gateprompttext(gate)).toMatch(/distinct human action/);
-  });
-
-  it("shows the target, scope and irreversibility on confirmdelete gates", () => {
-    const gate = opengate({
-      kind: "confirmdelete",
-      stepid: "step",
-      runid: "run",
-      origin: "https://shop.example",
-      payload: deletepayload({
-        target: "#orders",
-        scope: "the order history",
-        irreversibility: "The deletion destroys the order history the site cannot restore.",
-      }),
-      now,
-    });
-    expect(gateprompttext(gate)).toMatch(/#orders/);
-    expect(gateprompttext(gate)).toMatch(/order history/);
-    expect(gateprompttext(gate)).toMatch(/cannot restore/);
-  });
-
-  it("shows the credential label only on confirmcreds gates and never the value", () => {
-    const payload = credspayload("Bank login");
-    expect(payload).toEqual({ label: "Bank login" });
-    expect(() => credspayload(" ")).toThrow(/label/);
-    const gate = opengate({
-      kind: "confirmcreds",
-      stepid: "step",
-      runid: "run",
-      origin: "https://bank.example",
-      payload,
-      now,
-    });
-    expect(gateprompttext(gate)).toMatch(/Bank login/);
-    expect(gateprompttext(gate)).toMatch(/value stays behind the vault/);
-    expect(gateprompttext(gate)).not.toMatch(/hunter2/);
-  });
-
-  it("resolves exactly one open gate through one explicit human action and stays terminal", () => {
-    const gate = opengate({
-      kind: "confirmpay",
-      stepid: "step",
-      runid: "run",
-      origin: "https://shop.example",
-      payload: paypayload({ payeeorigin: "https://shop.example" }),
-      now,
-    });
-    const resolved = resolvegate({
-      gates: [gate],
-      gateid: gate.gateid,
-      decision: "resolved",
-      actor: "user",
-      now: now + 1200,
-    });
-    expect(resolved.resolution?.decision).toBe("resolved");
-    expect(resolved.resolution?.actor).toBe("user");
-    const updated = resolved.gates?.[0];
-    expect(updated?.state).toBe("resolved");
-    expect(updated?.resolvedat).toBe(now + 1200);
-    const again = resolvegate({
-      gates: resolved.gates ?? [],
-      gateid: gate.gateid,
-      decision: "refused",
-      actor: "user",
-      now: now + 1500,
-    });
-    expect(again.resolution).toBeUndefined();
-    expect(again.gates?.[0]?.state).toBe("resolved");
-  });
-
-  it("refuses resolutions without an acting user and batch approvals", () => {
-    const gate = opengate({
-      kind: "confirmdelete",
-      stepid: "step",
-      runid: "run",
-      origin: "https://shop.example",
-      payload: deletepayload({ scope: "history", irreversibility: "gone" }),
-      now,
-    });
-    expect(() => resolvegate({ gates: [gate], gateid: gate.gateid, decision: "resolved", actor: "", now })).toThrow(
-      /acting user/,
-    );
-    expect(nobatchresolution(["one"]).allowed).toBe(true);
-    expect(nobatchresolution(["one", "two"]).allowed).toBe(false);
-    expect(nobatchresolution(["one", "two"]).reason).toMatch(/no batch approval/);
-    expect(nobatchresolution([]).allowed).toBe(false);
-  });
-
-  it("reads the gate state of one step: none, open, resolved or refused", () => {
-    expect(gatestateof([], "step").state).toBe("none");
-    const gate = opengate({
-      kind: "confirmpay",
-      stepid: "step",
-      runid: "run",
-      origin: "https://shop.example",
-      payload: paypayload({ payeeorigin: "https://shop.example" }),
-      now,
-    });
-    expect(gatestateof([gate], "step").state).toBe("open");
-    const resolved = resolvegate({ gates: [gate], gateid: gate.gateid, decision: "refused", actor: "user", now });
-    expect(gatestateof(resolved.gates ?? [], "step").state).toBe("refused");
-    expect(gatestateof(resolved.gates ?? [], "other").state).toBe("none");
-  });
-
-  it("builds the gate of one gated step from its reviewed shape", () => {
-    const paystep = {
-      id: "pay",
-      kind: "fillcard" as const,
-      target: "#card",
-      options: JSON.stringify({ amount: "12.00", payeeorigin: "https://shop.example" }),
-    };
-    const paygate = gateforstep({
-      step: paystep,
-      classes: ["payment"],
-      runid: "run",
-      origin: "https://shop.example",
-      now,
-    });
-    expect(paygate?.kind).toBe("confirmpay");
-    expect(paygate?.payload.amount).toBe("12.00");
-    expect(paygate?.payload.payeeorigin).toBe("https://shop.example");
-    const deletestep = { id: "del", kind: "discardtab" as const, target: "#orders" };
-    const deletegate = gateforstep({
-      step: deletestep,
-      classes: ["delete"],
-      runid: "run",
-      origin: "https://shop.example",
-      now,
-    });
-    expect(deletegate?.kind).toBe("confirmdelete");
-    expect(deletegate?.payload.scope).toBe("https://shop.example");
-    const credstep = { id: "cred", kind: "consentpassword" as const, target: "#login" };
-    const credgate = gateforstep({
-      step: credstep,
-      classes: ["credential"],
-      runid: "run",
-      origin: "https://bank.example",
-      credentiallabel: "Bank login",
-      now,
-    });
-    expect(credgate?.payload).toEqual({ label: "Bank login" });
-    expect(
-      gateforstep({ step: credstep, classes: ["credential"], runid: "run", origin: "https://bank.example", now }),
-    ).toBeUndefined();
-    expect(
-      gateforstep({ step: paystep, classes: ["publish"], runid: "run", origin: "https://shop.example", now }),
-    ).toBeUndefined();
-  });
-});

package/tests/containerpack.test.ts

@@ -1,143 +0,0 @@
-import { access, constants, readFile } from "node:fs/promises";
-import { describe, expect, it } from "vitest";
-import { containerexposedsurfaces, containerrunnerentry } from "../pack.js";
-
-describe("containerpack", () => {
-  it("keeps THE Dockerfile and retires the compose stack and every second container script", async () => {
-    const dockerfile = await readFile("Dockerfile", "utf8");
-    expect(dockerfile.length).toBeGreaterThan(0);
-    await expect(access("compose.yml", constants.F_OK)).rejects.toThrow();
-    await expect(access("containerfile", constants.F_OK)).rejects.toThrow();
-  });
-
-  it("builds the multi stage image with the dependency layer, the validated builder, the lean runtime and the folded binary target", async () => {
-    const dockerfile = await readFile("Dockerfile", "utf8");
-    /* the build stages pin to the native build platform (the saddle
-    container doctrine: the toolchain installs native and the library build
-    runs at native speed — the prisma dmmf json corrupts under the qemu
-    emulation of the emulated legs) while the runtime stages stay per leg. */
-    expect(dockerfile).toContain("FROM --platform=$BUILDPLATFORM ${NODE_IMAGE} AS deps");
-    expect(dockerfile).toContain("FROM --platform=$BUILDPLATFORM ${NODE_IMAGE} AS builder");
-    expect(dockerfile).toContain("COPY --from=builder /work /work");
-    expect(dockerfile).toContain("FROM --platform=$BUILDPLATFORM ${NODE_IMAGE} AS binary-builder");
-    expect(dockerfile).toContain("FROM gcr.io/distroless/cc-debian12:nonroot AS binary-runtime");
-    /* the runtime base is its own arg: the four-arch family surface rides
-    the trixie slim line (the only 26.8.x tag whose manifest answers amd64,
-    arm64, ppc64le and s390x) while the build stages keep the toolchain
-    line pinned to the engines floor. */
-    expect(dockerfile).toContain('ARG NODE_RUNTIME_IMAGE="node:26.8.1-trixie-slim"');
-    expect(dockerfile).toContain("FROM ${NODE_RUNTIME_IMAGE} AS runtime");
-    /* the runner stage closes the file: it stays the default build target
-    (a plain docker build and the publish lanes build the runner image, the
-    single-binary surface stays behind its own --target) */
-    const fromLines = [...dockerfile.matchAll(/^FROM .*$/gm)].map((match) => match[0]);
-    expect(fromLines.at(-1)).toBe("FROM ${NODE_RUNTIME_IMAGE} AS runtime");
-  });
-
-  it("resolves the compiled binary target from TARGETARCH so the arm64 image never carries an x64 binary", async () => {
-    const dockerfile = await readFile("Dockerfile", "utf8");
-    expect(dockerfile).toContain("ARG TARGETARCH");
-    expect(dockerfile).toContain('arm64|aarch64) buntarget="bun-linux-arm64"');
-    expect(dockerfile).toContain('buntarget="bun-linux-x64"');
-    expect(dockerfile).not.toContain("--target=bun-linux-x64");
-  });
-
-  it("runs the library build and the deterministic build checks in the builder before the runtime ships", async () => {
-    const dockerfile = await readFile("Dockerfile", "utf8");
-    expect(dockerfile).toContain("RUN node tests/build.mjs");
-    expect(dockerfile).toContain("RUN node dist/cli.js manifest");
-    expect(dockerfile).toContain(
-      "RUN node dist/cli.js headless dist/fixtures/plans/release-notes-plan.json --fixtures dist/fixtures",
-    );
-    expect(dockerfile).toContain("RUN node tests/nativesmoke.mjs");
-    expect(dockerfile).toContain("RUN node tests/packageextension.mjs");
-    expect(dockerfile).toContain("web/manifest.json");
-  });
-
-  it("runs the vitest suite in the builder with the qemu scaled timeouts before the runtime ships", async () => {
-    const dockerfile = await readFile("Dockerfile", "utf8");
-    expect(dockerfile).toContain(
-      'RUN if [ "$(uname -m)" = "aarch64" ]; then export DEVTHINK_TEST_TIMEOUT_MS=120000 DEVTHINK_TEST_BUDGET_MS=10000; fi',
-    );
-    const vitestconfig = await readFile("vitest.config.ts", "utf8");
-    expect(vitestconfig).toContain("Number(process.env.DEVTHINK_TEST_TIMEOUT_MS ?? 5000)");
-  });
-
-  it("scales the smoke boot budget for the emulated legs so the four-arch build never flakes on qemu", async () => {
-    const dockerfile = await readFile("Dockerfile", "utf8");
-    expect(dockerfile).toContain("node container.mjs --check & runnerpid=$!");
-    expect(dockerfile).toContain("the container runner died during the smoke boot");
-    expect(dockerfile).toContain('case "${TARGETARCH}" in ppc64le|s390x) smokebudget=90 ;; esac');
-    expect(dockerfile).toContain("the container runner never answered /healthz within ${smokebudget}s");
-    expect(dockerfile).toContain('wait "${runnerpid}"');
-  });
-
-  it("exposes the static site, the socket relay and the mcp server behind the operator chosen environment", async () => {
-    const dockerfile = await readFile("Dockerfile", "utf8");
-    for (const surface of containerexposedsurfaces()) {
-      expect(dockerfile).toContain(surface.bindenv);
-      expect(dockerfile).toContain(surface.portenv);
-    }
-    expect(containerrunnerentry()).toBe("node container.mjs");
-    expect(dockerfile).toContain("DEVTHINK_RELAY_PATH=/relay");
-    expect(dockerfile).toContain("DEVTHINK_MCP_BIND=127.0.0.1");
-    expect(dockerfile).toContain("EXPOSE 8080 7436");
-    expect(dockerfile).toContain('ENTRYPOINT ["node", "container.mjs"]');
-    expect(dockerfile).toContain("COPY --from=builder --chown=10000:10000 /work/dist/site /app/dist/site");
-    expect(dockerfile).toContain("COPY --from=builder --chown=10000:10000 /work/dist/cli.js /app/dist/cli.js");
-    expect(dockerfile).toContain("COPY --from=builder --chown=10000:10000 /work/dist/http.js /app/dist/http.js");
-  });
-
-  it("absorbs the retired compose behaviors into the one container file", async () => {
-    const dockerfile = await readFile("Dockerfile", "utf8");
-    for (const flag of [
-      "--read-only",
-      "--cap-drop ALL",
-      "no-new-privileges:true",
-      "--pids-limit 512",
-      "--network none",
-      "--tmpfs /tmp:size=2g,mode=1777",
-    ]) {
-      expect(dockerfile).toContain(flag);
-    }
-    expect(dockerfile).toContain("DEVTHINK_MEMORY_ENGINE=ram");
-    expect(dockerfile).toContain('DEVTHINK_PLATFORM=""');
-    expect(dockerfile).toContain('DEVTHINK_CDN_URL=""');
-  });
-
-  it("runs the image as the non root devthink user with a live healthcheck and the OCI labels of the DevThink identity", async () => {
-    const dockerfile = await readFile("Dockerfile", "utf8");
-    expect(dockerfile).toContain("groupadd --gid 10000 devthink");
-    expect(dockerfile).toContain("useradd --uid 10000 --gid 10000");
-    expect(dockerfile).toMatch(/HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3/);
-    expect(dockerfile).toContain("/healthz");
-    expect(dockerfile).toContain('org.opencontainers.image.version="${DEVTHINK_VERSION}"');
-    expect(dockerfile).toContain('org.opencontainers.image.source="https://github.com/wenathlan/devthink"');
-    expect(dockerfile).not.toMatch(/:latest\b/);
-  });
-
-  it("publishes the image with version tags only, the registry buildcache and the four architecture family surface", async () => {
-    const publish = await readFile(".github/workflows/publishghcr.yml", "utf8");
-    expect(publish).not.toContain(":latest");
-    expect(publish).toContain("target: runtime");
-    expect(publish).toContain("devthink-buildcache");
-    expect(publish).toContain("type=gha");
-    expect(publish).toContain("mode=max");
-    /* the four-arch family union the saddle publish lane established
-    (amd64, arm64, ppc64le, s390x) with the qemu pin for the emulated
-    legs and the index assertion that fixes the published surface. */
-    expect(publish).toContain("platforms: linux/arm64,linux/ppc64le,linux/s390x");
-    expect(publish).toContain("platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x");
-    expect(publish).toContain('. == ["amd64", "arm64", "ppc64le", "s390x"]');
-    expect(publish).toContain("provenance: mode=max");
-    expect(publish).toContain("sbom: true");
-    expect(publish).toContain("aquasecurity/trivy-action@v0.36.0");
-  });
-
-  it("builds the release container archive from THE Dockerfile", async () => {
-    const container = await readFile(".github/workflows/container.yml", "utf8");
-    expect(container).toContain("docker build");
-    expect(container).toContain("--build-arg DEVTHINK_VERSION=");
-    expect(container).toContain("docker save");
-  });
-});