@zaip-ai/cli 1.0.6 → 1.0.7

package/templates/.agents/dashboard/packages/local-runtime/src/server.test.ts

@@ -0,0 +1,580 @@
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { describe, expect, it } from "vitest";
+import {
+  createDashboardApp,
+  dashboardWorkspaceKey,
+  githubRepositoryFromRemote,
+  manifestRun,
+  mergeManifestRuns,
+  openWorkIds,
+  projectionPeriodFilter,
+  reconciliationResult,
+} from "./server.js";
+import { invocationSummary } from "./server.test-fixtures.js";
+
+const workspaceRoot = resolve(import.meta.dirname, "../../../../..");
+
+describe("dashboard backend", () => {
+  it("normalizes GitHub HTTPS and SSH remotes for display", () => {
+    expect(githubRepositoryFromRemote("git@github.com:zaip-ai/zaip-aios.git")).toBe(
+      "zaip-ai/zaip-aios",
+    );
+    expect(githubRepositoryFromRemote("https://github.com/zaip-ai/zaip-aios.git")).toBe(
+      "zaip-ai/zaip-aios",
+    );
+    expect(githubRepositoryFromRemote("zaip-ai/zaip-aios")).toBe("zaip-ai/zaip-aios");
+    expect(githubRepositoryFromRemote("")).toBeNull();
+    expect(githubRepositoryFromRemote("https://gitlab.com/zaip-ai/zaip-aios.git")).toBeNull();
+  });
+
+  it("exposes a modern read-only health endpoint", async () => {
+    const app = createDashboardApp(workspaceRoot, "test-session");
+    const response = await app.request("/api/v2/health");
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toMatchObject({
+      kind: "zaip-dashboard-local-runtime",
+      workspaceKey: dashboardWorkspaceKey(workspaceRoot),
+      api_version: 2,
+      read_only: true,
+      status: "ok",
+      workspace_layout: 3,
+    });
+  });
+
+  it("serves compact overview aggregates without Run detail", async () => {
+    const app = createDashboardApp(workspaceRoot, "test-session");
+    const response = await app.request("/api/v2/operations?scope=overview", {
+      headers: { "x-zaip-session": "test-session" },
+    });
+
+    expect(response.status).toBe(200);
+    const payload = await response.json();
+    if (
+      typeof payload !== "object" ||
+      payload === null ||
+      !("summary" in payload) ||
+      typeof payload.summary !== "object" ||
+      payload.summary === null ||
+      !("overview_metrics" in payload.summary)
+    ) {
+      throw new Error("Operations overview payload is not an object with summary");
+    }
+    expect(payload).toMatchObject({ runs: [], changes: [], executions: [], decisions: [] });
+    expect(payload.summary.overview_metrics).toEqual(
+      expect.objectContaining({
+        duration_ms: expect.any(Number),
+        execution_day_count: expect.any(Number),
+        tokens: expect.any(Number),
+        cost_brl: expect.any(Number),
+      }),
+    );
+  });
+
+  it("serves only allowlisted canonical agent portraits", async () => {
+    const app = createDashboardApp(workspaceRoot, "test-session");
+    const agentIds = [
+      "agent-orchestrator",
+      "agent-builder",
+      "agent-task-executor",
+      "agent-analyst",
+      "agent-finalizer",
+      "agent-reviewer",
+      "agent-integrator",
+      "agent-auditor",
+      "agent-text-summarizer",
+      "agent-data-analyst",
+      "agent-refactoring-specialist",
+      "agent-frontend",
+      "agent-backend",
+      "agent-website-developer",
+      "agent-designer",
+      "agent-cloud-engineer",
+      "agent-security-auditor",
+      "agent-marketing-analyst",
+    ];
+    for (const agentId of agentIds) {
+      const portrait = await app.request(
+        `/api/v2/agent-catalog-assets/${agentId}?token=test-session`,
+      );
+      expect(portrait.status, agentId).toBe(200);
+      expect(portrait.headers.get("content-type"), agentId).toBe("image/png");
+      expect((await portrait.arrayBuffer()).byteLength, agentId).toBeGreaterThan(1_000);
+    }
+
+    const traversal = await app.request(
+      "/api/v2/agent-catalog-assets/%2E%2E%2Fproject?token=test-session",
+    );
+    expect(traversal.status).toBe(404);
+  });
+
+  it("treats date-only dashboard filters as whole calendar days", () => {
+    const context = {
+      req: { query: (name: string) => (name === "from" ? "2026-07-10" : "2026-07-26") },
+    };
+
+    expect(projectionPeriodFilter(context as never)).toEqual({
+      from: "2026-07-10T00:00:00.000Z",
+      to: "2026-07-26T23:59:59.999Z",
+    });
+  });
+
+  it("dual-reads manifest summaries without losing legacy runs, costs, coverage, or hierarchy", () => {
+    const root = invocationSummary({
+      agent_invocation_id: "AINV-ROOT",
+      root_agent_invocation_id: "AINV-ROOT",
+      run_id: "RUN-ROOT",
+      invocation_kind: "orchestrator",
+      delegation_depth: 0,
+    });
+    const child = invocationSummary({
+      agent_invocation_id: "AINV-CHILD",
+      root_agent_invocation_id: "AINV-ROOT",
+      parent_agent_invocation_id: "AINV-ROOT",
+      run_id: "RUN-CHILD",
+      invocation_kind: "delegated",
+      delegation_depth: 1,
+    });
+    const legacyRoot = { ...manifestRun(root, [root, child]), client_thread_id: "legacy-thread" };
+    const legacyOnly = { ...legacyRoot, id: "RUN-LEGACY" };
+
+    const merged = mergeManifestRuns([legacyRoot, legacyOnly], [root, child]);
+    const mergedRoot = merged.find((run) => run.id === "RUN-ROOT");
+    const mergedChild = merged.find((run) => run.id === "RUN-CHILD");
+
+    expect(merged).toHaveLength(3);
+    expect(mergedRoot).toMatchObject({
+      client_thread_id: "legacy-thread",
+      run_role: "orchestrator",
+      run_kind: "run",
+      usage: {
+        total: {
+          cost: { usd: 1.25, brl: 7.5 },
+          coverage: { tokens: 1, usd: 1, brl: 1 },
+        },
+      },
+    });
+    expect(mergedChild).toMatchObject({
+      run_role: "subagent",
+      run_kind: "subrun",
+      parent_run_id: "RUN-ROOT",
+    });
+  });
+
+  it("retains bounded lifecycle duration when a manifest summary has no duration", () => {
+    const summary = invocationSummary();
+    summary.time.duration_ms = null;
+    summary.quantitative_coverage.duration_ms = "unavailable";
+    summary.quantitative_metrics.duration_ms = {
+      known_sum: null,
+      unknown_count: 1,
+      total_count: 1,
+      complete: 0,
+      coverage_ratio: 0,
+    };
+    const legacy = {
+      ...manifestRun(summary, [summary]),
+      duration_ms: 12_000,
+      source_duration_ms: 0,
+      source_started_at: "2026-07-26T12:00:00.000Z",
+      source_finished_at: "2026-07-26T12:00:00.000Z",
+      capture_lag_ms: 12_000,
+    };
+
+    const merged = mergeManifestRuns([legacy], [summary]);
+
+    expect(merged[0]).toMatchObject({
+      duration_ms: 12_000,
+      source_duration_ms: null,
+      source_started_at: null,
+      source_finished_at: null,
+      capture_lag_ms: null,
+    });
+  });
+
+  it("does not let an unavailable manifest duration erase recovered source timing", () => {
+    const summary = invocationSummary();
+    summary.time.duration_ms = null;
+    const legacy = {
+      ...manifestRun(summary, [summary]),
+      duration_ms: 12_000,
+      source_duration_ms: 12_000,
+      source_started_at: "2026-07-26T12:00:00.000Z",
+      source_finished_at: "2026-07-26T12:00:12.000Z",
+      capture_lag_ms: 0,
+    };
+
+    expect(mergeManifestRuns([legacy], [summary])[0]).toMatchObject({
+      duration_ms: 12_000,
+      source_duration_ms: 12_000,
+      source_started_at: "2026-07-26T12:00:00.000Z",
+      source_finished_at: "2026-07-26T12:00:12.000Z",
+    });
+  });
+
+  it("rejects mutating methods before route dispatch", async () => {
+    const app = createDashboardApp(workspaceRoot, "test-session");
+    const response = await app.request("/api/v2/operations", { method: "POST" });
+
+    expect(response.status).toBe(405);
+    expect(response.headers.get("allow")).toBe("GET, HEAD");
+  });
+
+  it("selects only entities represented in open work stages for reconciliation", () => {
+    expect(
+      openWorkIds([
+        { kind: "prd", id: "PRD-DRAFT", status: "draft" },
+        { kind: "spec", id: "SPEC-ACTIVE", status: "active" },
+        { kind: "change", id: "CHG-PLANNED", status: "planned" },
+        { kind: "task", id: "TASK-PLANNED", status: "planned" },
+        { kind: "task", id: "TASK-VERIFYING", status: "verifying" },
+        { kind: "execution", id: "EXEC-RUNNING", status: "running" },
+        { kind: "run", id: "RUN-RUNNING", status: "running" },
+        { kind: "task", id: "TASK-COMPLETED", status: "completed" },
+        { kind: "task", id: "TASK-BLOCKED", status: "blocked" },
+      ]),
+    ).toEqual(["EXEC-RUNNING", "SPEC-ACTIVE", "TASK-PLANNED", "TASK-VERIFYING"]);
+  });
+
+  it("separates canonical reconciliation outcomes from blocked and unresolved work", () => {
+    expect(
+      reconciliationResult({
+        reconciliations: [
+          {
+            status: "closed",
+            error: null,
+            tasks: [
+              { id: "TASK-COMPLETED", status: "completed" },
+              { id: "TASK-BLOCKED", status: "blocked", status_reason: "Missing finalizer." },
+            ],
+            changes: [{ id: "CHG-COMPLETED", status: "completed" }],
+            executions: [],
+            specs: [],
+            prds: [],
+          },
+          {
+            status: "deferred",
+            error: "Canonical gates are incomplete.",
+            tasks: [{ id: "TASK-DEFERRED", status: "executing" }],
+            changes: [],
+            executions: [],
+            specs: [],
+            prds: [],
+          },
+        ],
+        orphaned_executions: ["EXEC-ORPHANED"],
+        reconciliation_errors: [{ run_id: "RUN-FAILED", error: "Could not read Run." }],
+        unresolved_running_run_ids: ["RUN-ACTIVE"],
+      }),
+    ).toEqual({
+      reconciled_ids: ["CHG-COMPLETED", "TASK-COMPLETED"],
+      blocked: [
+        {
+          id: "EXEC-ORPHANED",
+          reason: "Execution orphaned after the reconciliation grace period.",
+        },
+        { id: "TASK-BLOCKED", reason: "Missing finalizer." },
+      ],
+      not_reconciled: [
+        { id: "RUN-ACTIVE", reason: "Invocation is still running." },
+        { id: "RUN-FAILED", reason: "Could not read Run." },
+        { id: "TASK-DEFERRED", reason: "Canonical gates are incomplete." },
+      ],
+    });
+  });
+
+  it("requires the local session for projections", async () => {
+    const app = createDashboardApp(workspaceRoot, "test-session");
+    const response = await app.request("/api/v2/operations");
+
+    expect(response.status).toBe(401);
+  });
+
+  it("bootstraps a protected browser session from the dashboard document", async () => {
+    const app = createDashboardApp(workspaceRoot, "test-session");
+    const document = await app.request("/", {
+      headers: { "sec-fetch-site": "none" },
+    });
+    const cookie = document.headers.get("set-cookie");
+
+    expect(cookie).toContain("zaip-dashboard-session=test-session");
+    expect(cookie).toContain("HttpOnly");
+    expect(cookie).toContain("SameSite=Strict");
+    expect(cookie).toContain("Path=/");
+
+    const response = await app.request("/api/v2/operations", {
+      headers: {
+        cookie: cookie?.split(";", 1)[0] ?? "",
+        "x-zaip-session": "",
+      },
+    });
+    expect(response.status, await response.clone().text()).toBe(200);
+  });
+
+  it("does not bootstrap sessions for cross-site requests", async () => {
+    const app = createDashboardApp(workspaceRoot, "test-session");
+    const response = await app.request("/", {
+      headers: { "sec-fetch-site": "cross-site" },
+    });
+
+    expect(response.headers.get("set-cookie")).toBeNull();
+  });
+
+  it("keeps origin checks and accepts a valid cookie alongside a stale header", async () => {
+    const app = createDashboardApp(workspaceRoot, "test-session");
+    const cookie = "zaip-dashboard-session=test-session";
+    const rejectedOrigin = await app.request("/api/v2/pricing", {
+      method: "PUT",
+      headers: { cookie, origin: "https://example.com" },
+    });
+    const rejectedHeader = await app.request("/api/v2/pricing", {
+      headers: { "x-zaip-session": "invalid-session" },
+    });
+    const recoveredSession = await app.request("/api/v2/pricing", {
+      headers: { cookie, "x-zaip-session": "stale-session" },
+    });
+
+    expect(rejectedOrigin.status).toBe(403);
+    expect(rejectedHeader.status).toBe(401);
+    expect(recoveredSession.status, await recoveredSession.clone().text()).toBe(200);
+  });
+
+  it("allowlists authenticated project settings updates and rejects invalid config", async () => {
+    const fixtureRoot = await mkdtemp(join(tmpdir(), "zaip-dashboard-project-settings-"));
+    const configPath = join(fixtureRoot, ".agents", "config", "project.yaml");
+    const projectSource = await readFile(
+      join(workspaceRoot, ".agents", "config", "project.yaml"),
+      "utf8",
+    );
+    await mkdir(join(fixtureRoot, ".agents", "config"), { recursive: true });
+    await writeFile(configPath, projectSource, "utf8");
+
+    try {
+      const app = createDashboardApp(fixtureRoot, "test-session");
+      const unauthorized = await app.request("/api/v2/project-settings", { method: "PUT" });
+      const settings = await app.request("/api/v2/project-settings", {
+        headers: { "x-zaip-session": "test-session" },
+      });
+      const payload = (await settings.json()) as {
+        zaip?: { enabled: boolean };
+        project: { id: string };
+        stack: { profile: string; overrides: Record<string, unknown> };
+        tracking: { currency: string };
+      };
+      const updated = await app.request("/api/v2/project-settings", {
+        method: "PUT",
+        headers: {
+          "content-type": "application/json",
+          "x-zaip-session": "test-session",
+        },
+        body: JSON.stringify({
+          ...payload,
+          zaip: { enabled: false },
+          stack: {
+            ...payload.stack,
+            overrides: {
+              ...payload.stack.overrides,
+              languages: {
+                frontend: ["TypeScript"],
+                backend: ["TypeScript"],
+                site: ["Astro"],
+              },
+            },
+          },
+        }),
+      });
+      const invalid = await app.request("/api/v2/project-settings", {
+        method: "PUT",
+        headers: {
+          "content-type": "application/json",
+          "x-zaip-session": "test-session",
+        },
+        body: JSON.stringify({
+          ...payload,
+          tracking: { ...payload.tracking, currency: "real" },
+        }),
+      });
+
+      expect(unauthorized.status).toBe(401);
+      expect(updated.status, await updated.clone().text()).toBe(200);
+      await expect(updated.json()).resolves.toMatchObject({
+        zaip: { enabled: false },
+        stack: {
+          overrides: {
+            languages: {
+              frontend: ["TypeScript"],
+              backend: ["TypeScript"],
+              site: ["Astro"],
+            },
+          },
+        },
+      });
+      expect(invalid.status).toBe(400);
+    } finally {
+      await rm(fixtureRoot, { recursive: true, force: true });
+    }
+  });
+
+  it("serves and atomically updates the central agent catalog with adapter sync", async () => {
+    const fixtureRoot = await mkdtemp(join(tmpdir(), "zaip-dashboard-agent-catalog-"));
+    const catalogSource = await readFile(
+      join(workspaceRoot, ".agents", "config", "agents", "catalog.yaml"),
+      "utf8",
+    );
+    const projectSource = await readFile(
+      join(workspaceRoot, ".agents", "config", "project.yaml"),
+      "utf8",
+    );
+    await mkdir(join(fixtureRoot, ".agents", "config", "agents"), { recursive: true });
+    await writeFile(
+      join(fixtureRoot, ".agents", "config", "agents", "catalog.yaml"),
+      catalogSource,
+      "utf8",
+    );
+    await writeFile(join(fixtureRoot, ".agents", "config", "project.yaml"), projectSource, "utf8");
+    let syncCalls = 0;
+
+    try {
+      const app = createDashboardApp(fixtureRoot, "test-session", undefined, {
+        syncAgentAdapters: async () => {
+          syncCalls += 1;
+          return { valid: true, drifted: [] };
+        },
+      });
+      const settings = await app.request("/api/v2/agent-catalog", {
+        headers: { "x-zaip-session": "test-session" },
+      });
+      expect(settings.status, await settings.clone().text()).toBe(200);
+      const payload = (await settings.json()) as {
+        catalog: {
+          agents: Array<{
+            id: string;
+            model: { preferred: string[] };
+            persona: Record<string, unknown>;
+          }>;
+        };
+      };
+      const update = await app.request("/api/v2/agent-catalog", {
+        method: "PUT",
+        headers: {
+          "content-type": "application/json",
+          "x-zaip-session": "test-session",
+        },
+        body: JSON.stringify({
+          agents: payload.catalog.agents.map((agent) =>
+            agent.id === "agent-orchestrator"
+              ? { ...agent, persona: { ...agent.persona, nome: "renata", cargo: "owner" } }
+              : agent,
+          ),
+        }),
+      });
+
+      expect(update.status, await update.clone().text()).toBe(200);
+      await expect(update.json()).resolves.toMatchObject({
+        sync: { required: true, valid: true, drifted: [] },
+      });
+      expect(syncCalls).toBe(1);
+      expect(
+        await readFile(join(fixtureRoot, ".agents", "config", "agents", "catalog.yaml"), "utf8"),
+      ).toContain("renata_owner_zaip_agent");
+    } finally {
+      await rm(fixtureRoot, { recursive: true, force: true });
+    }
+  });
+
+  it("rolls back the agent catalog when adapter synchronization fails", async () => {
+    const fixtureRoot = await mkdtemp(join(tmpdir(), "zaip-dashboard-agent-rollback-"));
+    const catalogPath = join(fixtureRoot, ".agents", "config", "agents", "catalog.yaml");
+    const original = await readFile(
+      join(workspaceRoot, ".agents", "config", "agents", "catalog.yaml"),
+      "utf8",
+    );
+    const projectSource = await readFile(
+      join(workspaceRoot, ".agents", "config", "project.yaml"),
+      "utf8",
+    );
+    await mkdir(join(fixtureRoot, ".agents", "config", "agents"), { recursive: true });
+    await writeFile(catalogPath, original, "utf8");
+    await writeFile(join(fixtureRoot, ".agents", "config", "project.yaml"), projectSource, "utf8");
+
+    try {
+      const app = createDashboardApp(fixtureRoot, "test-session", undefined, {
+        syncAgentAdapters: async () => {
+          throw new Error("sync unavailable");
+        },
+      });
+      const settings = await app.request("/api/v2/agent-catalog", {
+        headers: { "x-zaip-session": "test-session" },
+      });
+      const payload = (await settings.json()) as {
+        catalog: {
+          agents: Array<{
+            id: string;
+            model: { preferred: string[] };
+            persona: Record<string, unknown>;
+          }>;
+        };
+      };
+      const response = await app.request("/api/v2/agent-catalog", {
+        method: "PUT",
+        headers: {
+          "content-type": "application/json",
+          "x-zaip-session": "test-session",
+        },
+        body: JSON.stringify({
+          agents: payload.catalog.agents.map((agent) =>
+            agent.id === "agent-orchestrator"
+              ? { ...agent, persona: { ...agent.persona, nome: "renata", cargo: "owner" } }
+              : agent,
+          ),
+        }),
+      });
+
+      expect(response.status).toBe(500);
+      await expect(response.json()).resolves.toMatchObject({
+        error: expect.stringContaining("adapter synchronization failed"),
+      });
+      await expect(readFile(catalogPath, "utf8")).resolves.toBe(original);
+    } finally {
+      await rm(fixtureRoot, { recursive: true, force: true });
+    }
+  });
+
+  it("does not serve files outside the configured UI root", async () => {
+    const parent = await mkdtemp(join(tmpdir(), "zaip-dashboard-static-boundary-"));
+    const uiRoot = join(parent, "ui");
+    await mkdir(uiRoot);
+    await writeFile(join(uiRoot, "index.html"), "<title>Dashboard</title>", "utf8");
+    await writeFile(join(parent, "secret.txt"), "must-not-be-served", "utf8");
+
+    try {
+      const app = createDashboardApp(workspaceRoot, "test-session", uiRoot);
+      const response = await app.request("/..%2Fsecret.txt");
+
+      expect(response.status).not.toBe(200);
+      await expect(response.text()).resolves.not.toContain("must-not-be-served");
+    } finally {
+      await rm(parent, { recursive: true, force: true });
+    }
+  });
+
+  it("serves the UI root index for the dashboard root and SPA routes", async () => {
+    const parent = await mkdtemp(join(tmpdir(), "zaip-dashboard-static-root-"));
+    const uiRoot = join(parent, "ui");
+    await mkdir(uiRoot);
+    await writeFile(join(uiRoot, "index.html"), "<title>ZAIP Dashboard</title>", "utf8");
+
+    try {
+      const app = createDashboardApp(workspaceRoot, "test-session", uiRoot);
+      for (const path of ["/", "/operations/overview"]) {
+        const response = await app.request(path);
+        expect(response.status, path).toBe(200);
+        await expect(response.text()).resolves.toContain("ZAIP Dashboard");
+      }
+    } finally {
+      await rm(parent, { recursive: true, force: true });
+    }
+  });
+});