@wenathlan/devthink 2.0.15 → 2.0.19

package/tests/flowlibrary.test.ts

@@ -1,242 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  exportlibrarymanifests,
-  forklibrary,
-  grantdiffof,
-  installlibrary,
-  librarybrowserow,
-  libraryentryof,
-  libraryeventof,
-  libraryproposalof,
-  librarysearch,
-  librarystepsview,
-  manifestdigest,
-  removelibrary,
-  sensitiveconsentfor,
-  signmanifest,
-  updatelibrary,
-  validatemanifest,
-  verifypublishersignature,
-} from "../flow.js";
-import {
-  librarycapabilitygate,
-  librarygrantgate,
-  libraryimportgate,
-  librarymanifestgate,
-  libraryquarantinegate,
-  librarysensitivegate,
-} from "../policy.js";
-import type { flowlibrarymanifest } from "../types.js";
-
-const now = 1_800_000_000_000;
-const capabilities = ["focus", "inspect", "click", "type", "scroll", "select", "hover"];
-
-function manifest(overrides: Partial<flowlibrarymanifest> = {}): flowlibrarymanifest {
-  return {
-    id: "invoice-digest",
-    title: "Invoice digest",
-    description: "Reads the invoice table and exports a digest.",
-    version: "1.0.0",
-    publisher: "example publisher",
-    registry: "https://registry.example.test",
-    steps: [
-      { id: "open", kind: "focus", label: "Focus the table", target: "#invoices", namespace: "main" },
-      { id: "read", kind: "inspect", label: "Inspect the rows" },
-    ],
-    kinds: ["focus", "inspect"],
-    requiredgrants: ["https://example.com"],
-    dataexpectations: [{ stepid: "read", family: "text content", fields: ["invoice number", "total"] }],
-    sensitive: false,
-    ...overrides,
-  };
-}
-
-describe("flowlibrary manifest validation", () => {
-  it("validates a manifest under schemastrict and refuses shape errors with their paths", async () => {
-    const result = await validatemanifest({ manifest: manifest(), capabilities });
-    expect(result.ok).toBe(true);
-    expect(result.reason).toMatch(/schemastrict/);
-    const broken = await validatemanifest({ manifest: { ...manifest(), title: " " }, capabilities });
-    expect(broken.ok).toBe(false);
-    expect(broken.errors.some((error) => error.path === "title")).toBe(true);
-    expect(librarymanifestgate({ errors: broken.errors }).allowed).toBe(false);
-    const unknownfield = await validatemanifest({ manifest: { ...manifest(), extra: "field" }, capabilities });
-    expect(unknownfield.ok).toBe(false);
-    expect(unknownfield.errors.some((error) => error.path === "extra")).toBe(true);
-    const notanobject = await validatemanifest({ manifest: "nope", capabilities });
-    expect(notanobject.ok).toBe(false);
-  });
-
-  it("refuses kinds that exceed the installed capability set", async () => {
-    const result = await validatemanifest({
-      manifest: manifest({ steps: [{ id: "pay", kind: "payinvoice", label: "Pay" }], kinds: ["payinvoice"] }),
-      capabilities,
-    });
-    expect(result.ok).toBe(false);
-    expect(result.reason).toMatch(/capability set lacks/);
-    expect(librarycapabilitygate({ kinds: ["payinvoice"], capabilities: capabilities }).allowed).toBe(false);
-    expect(librarycapabilitygate({ kinds: ["click"], capabilities }).allowed).toBe(true);
-  });
-
-  it("verifies publisher signatures over the manifest digest and refuses any other body", async () => {
-    const signed = { ...manifest(), publish: await signmanifest(manifest(), "registry.example.test publish", now) };
-    const verification = await verifypublishersignature(signed);
-    expect(verification.verified).toBe(true);
-    expect(verification.reason).toMatch(/verifies/);
-    const tampered = { ...signed, description: "a different body" };
-    expect((await verifypublishersignature(tampered)).verified).toBe(false);
-    expect((await verifypublishersignature(manifest())).verified).toBe(false);
-  });
-
-  it("quarantines entries from unverified publishers while verified entries stay available", async () => {
-    const unsigned = await libraryentryof({ manifest: manifest(), provenance: "a local file", now });
-    expect(unsigned.state).toBe("quarantined");
-    expect(libraryquarantinegate({ verified: false, signaturepresent: false, signaturevalid: false }).allowed).toBe(
-      false,
-    );
-    const signedmanifest = {
-      ...manifest(),
-      publish: await signmanifest(manifest(), "registry.example.test publish", now),
-    };
-    const verified = await libraryentryof({ manifest: signedmanifest, provenance: "the registry", now });
-    expect(verified.state).toBe("available");
-    expect(libraryquarantinegate({ verified: true, signaturepresent: true, signaturevalid: true }).allowed).toBe(true);
-    expect(libraryquarantinegate({ verified: false, signaturepresent: true, signaturevalid: false }).allowed).toBe(
-      false,
-    );
-  });
-
-  it("requires a fresh consent for sensitive manifests only", () => {
-    expect(sensitiveconsentfor(manifest(), false).required).toBe(false);
-    expect(librarysensitivegate({ sensitive: false, freshconsent: false }).allowed).toBe(true);
-    expect(librarysensitivegate({ sensitive: true, freshconsent: false }).allowed).toBe(false);
-    expect(sensitiveconsentfor(manifest({ sensitive: true }), true).reason).toMatch(/fresh consent/);
-    expect(librarysensitivegate({ sensitive: true, freshconsent: true }).allowed).toBe(true);
-  });
-
-  it("surfaces the grant diff and maps the required grants onto originprofiles", () => {
-    const diff = grantdiffof({
-      manifest: manifest({ requiredgrants: ["https://example.com", "https://other.test"] }),
-      heldgrants: ["https://example.com"],
-    });
-    expect(diff.added).toEqual(["https://other.test"]);
-    expect(diff.kept).toEqual(["https://example.com"]);
-    expect(diff.originmappings).toHaveLength(2);
-    expect(diff.originmappings[0]?.kinds).toContain("focus");
-    expect(
-      librarygrantgate({ requiredgrants: ["https://other.test"], heldgrants: ["https://example.com"] }).allowed,
-    ).toBe(false);
-    expect(
-      librarygrantgate({ requiredgrants: ["https://example.com"], heldgrants: ["https://example.com"] }).allowed,
-    ).toBe(true);
-  });
-
-  it("lands every import as a proposal that still passes the plan review", () => {
-    const entry = {
-      id: "invoice-digest@1.0.0",
-      manifest: manifest(),
-      digest: "d".repeat(64),
-      state: "available" as const,
-      provenance: "test",
-      addedat: now,
-    };
-    const proposal = libraryproposalof(entry);
-    expect(proposal.objective).toMatch(/Invoice digest/);
-    expect(libraryimportgate({ proposal: true, planreviewed: true }).allowed).toBe(true);
-    expect(libraryimportgate({ proposal: false, planreviewed: true }).allowed).toBe(false);
-    expect(libraryimportgate({ proposal: true, planreviewed: false }).allowed).toBe(false);
-  });
-});
-
-describe("flowlibrary install, update, fork and removal", () => {
-  it("resolves a manifest into a pending workflow record and rewrites selector namespaces", async () => {
-    const entry = await libraryentryof({ manifest: manifest(), provenance: "test", now });
-    const record = installlibrary({ entry, selectornamespace: "#app", now });
-    expect(record.id).toBe("library:invoice-digest:1.0.0");
-    expect(record.reviewstate).toBe("pending");
-    expect(record.origins).toEqual(["https://example.com"]);
-    expect(record.steps[0]?.target).toBe("#app #invoices");
-    expect(record.steps[1]?.target).toBeUndefined();
-    const plain = installlibrary({ entry, now });
-    expect(plain.steps[0]?.target).toBe("#invoices");
-  });
-
-  it("diffs versions before an update replaces a local entry", async () => {
-    const existing = await libraryentryof({ manifest: manifest(), provenance: "test", now });
-    const same = await libraryentryof({ manifest: manifest(), provenance: "test", now });
-    expect(updatelibrary({ incoming: same, existing }).replace).toBe(false);
-    const changed = await libraryentryof({
-      manifest: manifest({
-        version: "2.0.0",
-        requiredgrants: ["https://example.com", "https://new.test"],
-        steps: [...manifest().steps, { id: "scroll", kind: "scroll", label: "Scroll" }],
-      }),
-      provenance: "test",
-      now,
-    });
-    const diff = updatelibrary({ incoming: changed, existing });
-    expect(diff.replace).toBe(true);
-    expect(diff.versionfrom).toBe("1.0.0");
-    expect(diff.versionto).toBe("2.0.0");
-    expect(diff.changedsteps).toContain("scroll");
-    expect(diff.addedgrants).toEqual(["https://new.test"]);
-  });
-
-  it("keeps local forks untouched on removal and forks create independent workflows", async () => {
-    const entry = await libraryentryof({ manifest: manifest(), provenance: "test", now });
-    const fork = forklibrary({ entry, now });
-    expect(fork.id.startsWith("fork:invoice-digest:")).toBe(true);
-    expect(fork.name).toBe("Invoice digest fork");
-    expect(fork.reviewstate).toBe("pending");
-    const outcome = removelibrary({ entry, forks: [fork] });
-    expect(outcome.removed).toBe(entry.id);
-    expect(outcome.keptforks).toEqual([fork.id]);
-    expect(outcome.reason).toMatch(/stay untouched/);
-  });
-
-  it("searches the library and renders browser rows, step views and audit exports", async () => {
-    const a = await libraryentryof({ manifest: manifest(), provenance: "test", now });
-    const b = await libraryentryof({
-      manifest: manifest({ id: "other", title: "Other flow", publisher: "second publisher", sensitive: true }),
-      provenance: "test",
-      now,
-    });
-    expect(librarysearch({ entries: [a, b], query: "other flow" })).toHaveLength(1);
-    expect(librarysearch({ entries: [a, b], filter: { publisher: "second publisher" } })).toHaveLength(1);
-    expect(librarysearch({ entries: [a, b] })).toHaveLength(2);
-    const row = librarybrowserow(a);
-    expect(row.publisher).toBe("example publisher");
-    expect(row.grants).toEqual(["https://example.com"]);
-    const steps = librarystepsview(a);
-    expect(steps).toHaveLength(2);
-    expect(steps[1]?.fields).toEqual(["invoice number", "total"]);
-    const events = libraryeventof({
-      kind: "install",
-      entryid: a.id,
-      title: a.manifest.title,
-      version: a.manifest.version,
-      detail: "installed",
-      now,
-    });
-    expect(events.kind).toBe("install");
-    expect(() => libraryeventof({ kind: "install", entryid: " ", title: "", version: "", detail: "", now })).toThrow(
-      /entry id/,
-    );
-    const exported = exportlibrarymanifests([a, b]);
-    expect(exported).toHaveLength(2);
-    expect(exported[0]?.digest).toBe(a.digest);
-    expect(await manifestdigest(a.manifest)).not.toBe(await manifestdigest(b.manifest));
-  });
-
-  it("deduplicates entries by manifest digest in the memory store semantics", async () => {
-    const a = await libraryentryof({ manifest: manifest(), provenance: "test", now });
-    const duplicate = await libraryentryof({ manifest: manifest(), provenance: "second import", now });
-    expect(a.digest).toBe(duplicate.digest);
-    const store = [a];
-    const deduped = [duplicate, ...store.filter((candidate) => candidate.digest !== duplicate.digest)];
-    expect(deduped).toHaveLength(1);
-    expect(deduped[0]?.provenance).toBe(
-      "second import; The manifest invoice-digest of example publisher carries no publisher signature; the entry quarantines until the user verifies its publisher.",
-    );
-  });
-});

package/tests/flowrun.test.ts

@@ -1,303 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  dryflowdriver,
-  flowgateof,
-  flowproposalvalue,
-  flowrunexitcodeof,
-  flowstepsensitive,
-  flowtimelinerowsof,
-  parseflowrunrequest,
-  parsegrantsfile,
-  renderflowevents,
-  renderflowtimeline,
-  runflow,
-  type flowdriver,
-} from "../flow.js";
-import { verifylogchain } from "../security.js";
-import { packageversion } from "../version.js";
-import type { flowrunevent, flowrungate, planfile, planfilestep } from "../types.js";
-
-const now = 1_800_000_000_000;
-
-function plan(overrides?: Partial<planfile>): planfile {
-  return {
-    version: packageversion,
-    goal: "digest the changelog of the release",
-    origin: "https://example.org",
-    steps: [
-      { id: "observe", kind: "observe", label: "Observe the page" },
-      { id: "read", kind: "readtext", label: "Read the changelog", target: "main" },
-    ],
-    ...overrides,
-  };
-}
-
-/** The fixture browser of the suite: one driver that executes the read steps and fails or defers exactly what the test asks. */
-function fixturedriver(behavior: Record<string, "done" | "failed"> = {}): flowdriver & { executed: string[] } {
-  const executed: string[] = [];
-  return {
-    executed,
-    async execute(step: planfilestep) {
-      executed.push(step.id);
-      const outcome = behavior[step.id] ?? "done";
-      return {
-        state: outcome,
-        summary:
-          outcome === "done"
-            ? `The fixture browser executed the step ${step.id} of kind ${step.kind}.`
-            : `The fixture browser failed the step ${step.id}.`,
-        duration: 5,
-      };
-    },
-  };
-}
-
-describe("flowrun requests", () => {
-  it("parses terminal arguments into one request with its options", () => {
-    const request = parseflowrunrequest([
-      "plan.json",
-      "--format",
-      "json",
-      "--output",
-      "runs",
-      "--grants",
-      "grants.json",
-    ]);
-    expect(request.planpath).toBe("plan.json");
-    expect(request.options).toMatchObject({
-      format: "json",
-      outputdir: "runs",
-      grantspath: "grants.json",
-      interactive: false,
-      dryrun: false,
-    });
-    const inline = parseflowrunrequest(["plan.json", "--interactive=true"]);
-    expect(inline.options.interactive).toBe(true);
-    expect(() => parseflowrunrequest([])).toThrow(/needs the plan file path/);
-    expect(() => parseflowrunrequest(["plan.json", "--format", "table"])).toThrow(/human or json/);
-    expect(() => parseflowrunrequest(["plan.json"])).toThrow(/grants file or the interactive flag/);
-  });
-
-  it("parses one grants file of granted HTTPS origins only", () => {
-    expect(parsegrantsfile({ origins: ["https://example.org"] })).toEqual(["https://example.org"]);
-    expect(() => parsegrantsfile({ origins: [] })).toThrow(/non-empty origins list/);
-    expect(() => parsegrantsfile({ origins: ["http://example.org"] })).toThrow(/HTTPS/);
-    expect(() => parsegrantsfile([])).toThrow(/json object/);
-  });
-
-  it("builds the workflow proposal value the same validation the extension runs", () => {
-    const proposal = flowproposalvalue(plan());
-    expect(proposal.version).toBe(packageversion);
-    expect((proposal.workflow as { origins: string[] }).origins).toEqual(["https://example.org"]);
-    expect(() => flowproposalvalue(plan({ origin: "https://elsewhere.org" }))).not.toThrow();
-  });
-
-  it("derives the sensitivity of one step the same way the runtime does", () => {
-    expect(flowstepsensitive({ id: "s", kind: "observe", label: "l" })).toBe(false);
-    expect(flowstepsensitive({ id: "s", kind: "type", label: "l", target: "input" })).toBe(true);
-    expect(flowgateof({ id: "s", kind: "type", label: "l" } as never, "https://example.org", "waits").id).toBe(
-      "gate:s",
-    );
-  });
-
-  it("maps run states onto terminal exit codes", () => {
-    expect(flowrunexitcodeof("done")).toBe(0);
-    expect(flowrunexitcodeof("failed")).toBe(1);
-    expect(flowrunexitcodeof("revoked")).toBe(2);
-  });
-});
-
-describe("flowrun execution", () => {
-  it("runs one plan through the fixture browser, seals the chain and exits zero", async () => {
-    const driver = fixturedriver();
-    const run = await runflow({
-      request: {
-        planpath: "plan.json",
-        options: { format: "human", outputdir: "out", grantspath: "grants.json", interactive: false, dryrun: false },
-      },
-      file: plan(),
-      grants: ["https://example.org"],
-      driver,
-      now,
-      clock: () => now,
-    });
-    expect(driver.executed).toEqual(["observe", "read"]);
-    expect(run.outcome).toMatchObject({ state: "done", steps: 2, exitcode: 0 });
-    expect(run.outcome.sealhash).toBeDefined();
-    const verification = await verifylogchain(run.log.entries);
-    expect(verification.valid).toBe(true);
-    expect(run.events.map((event) => event.kind)).toEqual(["start", "step", "step", "done"]);
-    expect(run.log.seal?.entries).toBe(run.log.entries.length);
-  });
-
-  it("passes the proposal validation of the extension before any step runs", async () => {
-    const unknownkind = plan({ steps: [{ id: "boom", kind: "explode", label: "Explode" }] });
-    await expect(
-      runflow({
-        request: {
-          planpath: "plan.json",
-          options: { format: "human", outputdir: "out", grantspath: "grants.json", interactive: false, dryrun: false },
-        },
-        file: unknownkind,
-        grants: ["https://example.org"],
-        driver: fixturedriver(),
-        now,
-      }),
-    ).rejects.toThrow(/reviewed action kind|outside the grants/);
-    const ungranted = plan({ origin: "https://elsewhere.org" });
-    await expect(
-      runflow({
-        request: {
-          planpath: "plan.json",
-          options: { format: "human", outputdir: "out", grantspath: "grants.json", interactive: false, dryrun: false },
-        },
-        file: ungranted,
-        grants: ["https://example.org"],
-        driver: fixturedriver(),
-        now,
-      }),
-    ).rejects.toThrow(/outside the grants/);
-  });
-
-  it("never starts without an origin grant file or an interactive prompt", async () => {
-    await expect(
-      runflow({
-        request: {
-          planpath: "plan.json",
-          options: { format: "human", outputdir: "out", interactive: false, dryrun: true },
-        },
-        file: plan(),
-        grants: [],
-        driver: dryflowdriver(),
-        now,
-      }),
-    ).rejects.toThrow(/never starts/);
-  });
-
-  it("routes every sensitive gate wait to the consent provider and counts the approval", async () => {
-    const gates: string[] = [];
-    const provider = {
-      resolvegate: async (gate: flowrungate) => {
-        gates.push(gate.id);
-        return "approve" as const;
-      },
-    };
-    const typing = plan({ steps: [{ id: "type", kind: "type", label: "Type the query", target: "input" }] });
-    const run = await runflow({
-      request: {
-        planpath: "plan.json",
-        options: { format: "human", outputdir: "out", grantspath: "grants.json", interactive: true, dryrun: false },
-      },
-      file: typing,
-      grants: ["https://example.org"],
-      provider,
-      driver: fixturedriver(),
-      now,
-      clock: () => now,
-    });
-    expect(gates).toEqual(["gate:type"]);
-    expect(run.outcome.state).toBe("done");
-    expect(run.events.some((event) => event.kind === "gate" && event.stepid === "type")).toBe(true);
-  });
-
-  it("revokes the run when the consent provider refuses and when no provider resolves the gate", async () => {
-    const typing = plan({ steps: [{ id: "type", kind: "type", label: "Type the query", target: "input" }] });
-    const request = {
-      planpath: "plan.json",
-      options: {
-        format: "human" as const,
-        outputdir: "out",
-        grantspath: "grants.json",
-        interactive: true,
-        dryrun: false,
-      },
-    };
-    const refused = await runflow({
-      request,
-      file: typing,
-      grants: ["https://example.org"],
-      provider: { resolvegate: async () => "refuse" as const },
-      driver: fixturedriver(),
-      now,
-      clock: () => now,
-    });
-    expect(refused.outcome).toMatchObject({ state: "revoked", steps: 0, exitcode: 2 });
-    expect(refused.log.entries.some((entry) => entry.kind === "deny")).toBe(true);
-    const denydefault = await runflow({
-      request,
-      file: typing,
-      grants: ["https://example.org"],
-      driver: fixturedriver(),
-      now,
-      clock: () => now,
-    });
-    expect(denydefault.outcome.state).toBe("revoked");
-    expect(denydefault.outcome.exitcode).toBe(2);
-    expect(denydefault.events.some((event) => event.kind === "revoked")).toBe(true);
-  });
-
-  it("fails the run with exit code one when the fixture browser fails a step", async () => {
-    const failing = plan({
-      steps: [
-        { id: "observe", kind: "observe", label: "Observe" },
-        { id: "read", kind: "readtext", label: "Read", target: "main" },
-      ],
-    });
-    const run = await runflow({
-      request: {
-        planpath: "plan.json",
-        options: { format: "human", outputdir: "out", grantspath: "grants.json", interactive: false, dryrun: false },
-      },
-      file: failing,
-      grants: ["https://example.org"],
-      driver: fixturedriver({ read: "failed" }),
-      now,
-      clock: () => now,
-    });
-    expect(run.outcome).toMatchObject({ state: "failed", steps: 2, exitcode: 1 });
-    expect(run.events.some((event) => event.kind === "failed" && event.stepid === "read")).toBe(true);
-  });
-
-  it("streams the logstream events and renders the stepstimeline for the terminal", () => {
-    const events: flowrunevent[] = [
-      { kind: "start", summary: "The flowrun started.", at: now },
-      { kind: "gate", stepid: "type", summary: "The step waits at its gate.", at: now + 10 },
-      { kind: "step", stepid: "type", summary: "The step ran.", at: now + 20 },
-      { kind: "done", summary: "The flowrun completed.", at: now + 30 },
-    ];
-    expect(flowtimelinerowsof(events)).toEqual([
-      { stepid: "type", status: "waiting", summary: "The step waits at its gate.", at: now + 10 },
-      { stepid: "type", status: "done", summary: "The step ran.", at: now + 20 },
-    ]);
-    expect(renderflowtimeline(events)).toContain("[done] type");
-    expect(renderflowtimeline([{ kind: "start", summary: "none", at: now }])).toContain("no step");
-    expect(renderflowevents(events, "json").split("\n")).toHaveLength(4);
-    expect(renderflowevents(events, "human")).toContain("GATE type");
-  });
-
-  it("walks the plan in dry run mode with no page effects", async () => {
-    const run = await runflow({
-      request: {
-        planpath: "plan.json",
-        options: { format: "human", outputdir: "out", grantspath: "grants.json", interactive: false, dryrun: true },
-      },
-      file: plan(),
-      grants: ["https://example.org"],
-      now,
-      clock: () => now,
-    });
-    expect(run.outcome.state).toBe("done");
-    expect(run.events.some((event) => event.summary.includes("without page effects"))).toBe(true);
-    await expect(
-      runflow({
-        request: {
-          planpath: "plan.json",
-          options: { format: "human", outputdir: "out", grantspath: "grants.json", interactive: false, dryrun: false },
-        },
-        file: plan(),
-        grants: ["https://example.org"],
-        now,
-      }),
-    ).rejects.toThrow(/remote endpoint.*dry run flag/);
-  });
-});