@zgeoff/atc 3.3.1 → 3.4.0

package/src/shared/claim-daemon-lock.ts

@@ -1,5 +1,7 @@
 import { FFIType, dlopen, ptr } from 'bun:ffi';
 import { closeSync, writeFileSync } from 'node:fs';
+import type { Clock } from './system-clock';
+import { systemClock } from './system-clock';
 
 export interface DaemonLock {
   // Releases the lock; safe to call more than once.
@@ -24,11 +26,13 @@ const RETRY_MS = 50;
  * racing at the same instant cannot both win, and the kernel drops it when
  * the holding process dies, so a crashed daemon never blocks the next one.
  * The file is never removed: removing it would let a newcomer lock a fresh
- * inode while an older daemon still holds the unlinked one.
+ * inode while an older daemon still holds the unlinked one. The wait reads
+ * its deadline from `clock` and waits out each retry through it.
  */
 export async function claimDaemonLock(
   lockPath: string,
   waitMs: number,
+  clock: Clock = systemClock,
 ): Promise<DaemonLock | null> {
   writeFileSync(lockPath, '', { flag: 'a' });
 
@@ -39,16 +43,18 @@ export async function claimDaemonLock(
     throw new Error(`atc daemon: cannot open the lock file ${lockPath}`);
   }
 
-  const deadline = Date.now() + waitMs;
+  const deadline = clock.now() + waitMs;
 
   while (libc.symbols.flock(fd, LOCK_EX | LOCK_NB) !== 0) {
-    if (Date.now() >= deadline) {
+    if (clock.now() >= deadline) {
       closeSync(fd);
 
       return null;
     }
 
-    await Bun.sleep(RETRY_MS);
+    await new Promise<void>((resolve) => {
+      clock.schedule(resolve, RETRY_MS);
+    });
   }
 
   let held = true;

package/src/shared/collect-dir-roots.ts

@@ -1,13 +1,13 @@
-import { homedir } from 'node:os';
 import { isRecord } from './report';
+import { resolveHomeDir } from './resolve-home-dir';
 
 /**
  * Reads `dirs.roots`: the directories whose children the spawn picker
  * lists. A non-string entry is dropped, a leading `~` expands to the home
  * directory, and trailing slashes are trimmed so a root compares equal to
- * the paths under it.
+ * the paths under it. `home` is the directory a `~` expands to.
  */
-export function collectDirRoots(raw: unknown): readonly string[] {
+export function collectDirRoots(raw: unknown, home: string = resolveHomeDir()): readonly string[] {
   if (!isRecord(raw) || !Array.isArray(raw['roots'])) {
     return [];
   }
@@ -19,14 +19,14 @@ export function collectDirRoots(raw: unknown): readonly string[] {
       continue;
     }
 
-    roots.push(normalizeRoot(item));
+    roots.push(normalizeRoot(item, home));
   }
 
   return roots;
 }
 
-function normalizeRoot(dir: string): string {
-  const expanded = dir === '~' ? homedir() : dir.replace(/^~\//u, `${homedir()}/`);
+function normalizeRoot(dir: string, home: string): string {
+  const expanded = dir === '~' ? home : dir.replace(/^~\//u, `${home}/`);
   const trimmed = expanded.replace(/\/+$/u, '');
 
   return trimmed === '' ? '/' : trimmed;

package/src/shared/collect-hooks.ts

@@ -1,6 +1,6 @@
-import { homedir } from 'node:os';
 import { z } from 'zod';
 import { isRecord } from './report';
+import { resolveHomeDir } from './resolve-home-dir';
 
 /**
  * One configured hook: a shell command the daemon runs when the named wire
@@ -30,9 +30,10 @@ const HOOK_ENTRY_SCHEMA = z.object({
  * is left out; an event name with no valid entries is dropped. Unknown event
  * names are kept as written — they never fire, and a future daemon that
  * emits them starts firing without a config change. A `dir` is stored with
- * `~` expanded and trailing slashes trimmed, ready for path matching.
+ * `~` expanded to `home` and trailing slashes trimmed, ready for path
+ * matching.
  */
-export function collectHooks(raw: unknown): HooksConfig {
+export function collectHooks(raw: unknown, home: string = resolveHomeDir()): HooksConfig {
   if (!isRecord(raw)) {
     return {};
   }
@@ -55,7 +56,7 @@ export function collectHooks(raw: unknown): HooksConfig {
 
       entries.push({
         command: parsed.data.command,
-        ...(parsed.data.dir === undefined ? {} : { dir: normalizeHookDir(parsed.data.dir) }),
+        ...(parsed.data.dir === undefined ? {} : { dir: normalizeHookDir(parsed.data.dir, home) }),
         ...(parsed.data.timeout === undefined ? {} : { timeout: parsed.data.timeout }),
       });
     }
@@ -68,8 +69,8 @@ export function collectHooks(raw: unknown): HooksConfig {
   return hooks;
 }
 
-function normalizeHookDir(dir: string): string {
-  const expanded = dir === '~' ? homedir() : dir.replace(/^~\//u, `${homedir()}/`);
+function normalizeHookDir(dir: string, home: string): string {
+  const expanded = dir === '~' ? home : dir.replace(/^~\//u, `${home}/`);
   const trimmed = expanded.replace(/\/+$/u, '');
 
   return trimmed === '' ? '/' : trimmed;

package/src/shared/config.ts

@@ -176,13 +176,18 @@ const CONFIG_SCHEMA = z.object({
  * defaults out. A file that exists but cannot be read or parsed loads as
  * unusable: every default but the targets, which it leaves empty with the
  * problem as the one target error, so nothing runs until the file is fixed.
- * Never throws.
+ * `home` is the directory a `~` in the file expands to, and `state` is the
+ * state directory it creates. Never throws.
  */
-export function loadConfig(file: string = configFile): Config {
+export function loadConfig(
+  file: string = configFile,
+  home: string = resolveHomeDir(),
+  state: string = stateDir,
+): Config {
   // Every atc process writes under the state directory; a failure here
   // comes back from the first write into it.
   try {
-    mkdirSync(stateDir, { recursive: true });
+    mkdirSync(state, { recursive: true });
   } catch {}
 
   let text: string;
@@ -213,7 +218,7 @@ export function loadConfig(file: string = configFile): Config {
     return buildUnusableConfig('config_malformed', file, 'the file is not valid JSON');
   }
 
-  return parseConfig(raw, file);
+  return parseConfig(raw, file, home);
 }
 
 /**
@@ -292,10 +297,15 @@ export function renderDefaultConfig(): string {
  * Parses a user-written config.json's already-decoded JSON value into a
  * Config, applying every default a malformed or absent field falls back to.
  * A root that is not an object leaves the config unusable, with no targets,
- * and `file` is the path its error holds. Total: no shape of `raw` throws,
- * so a hand-edited config never stops atc starting.
+ * and `file` is the path its error holds. `home` is the directory a `~` in
+ * a directory root or a hook's `dir` expands to. Total: no shape of `raw`
+ * throws, so a hand-edited config never stops atc starting.
  */
-export function parseConfig(raw: unknown, file: string = configFile): Config {
+export function parseConfig(
+  raw: unknown,
+  file: string = configFile,
+  home: string = resolveHomeDir(),
+): Config {
   if (!isRecord(raw) || Array.isArray(raw)) {
     return buildUnusableConfig(
       'config_malformed',
@@ -320,7 +330,7 @@ export function parseConfig(raw: unknown, file: string = configFile): Config {
     return buildUnusableConfig('config_malformed', file, formatMixedAgentKeys(present));
   }
 
-  const dirs = { roots: collectDirRoots(parsed.data.dirs) };
+  const dirs = { roots: collectDirRoots(parsed.data.dirs, home) };
   const workspaces = collectWorkspacesConfig(parsed.data.workspaces);
   const authProfiles = collectAuthProfiles(parsed.data.authProfiles);
 
@@ -340,7 +350,7 @@ export function parseConfig(raw: unknown, file: string = configFile): Config {
         authProfiles.profiles,
       );
 
-  const hooks = collectHooks(parsed.data.hooks);
+  const hooks = collectHooks(parsed.data.hooks, home);
   const targets = collectTargets(parsed.data.targets, parsed.data.defaultTarget);
   const principals = collectPrincipals(parsed.data.principals);
 

package/src/shared/system-clock.ts

@@ -0,0 +1,24 @@
+/**
+ * The time and the timers a module reads, so a test can step them. `now`
+ * returns milliseconds since the epoch; `schedule` runs the callback once
+ * after the delay and returns a function that cancels it, which does
+ * nothing once the callback has run.
+ */
+export interface Clock {
+  readonly now: () => number;
+  readonly schedule: (callback: () => void, delayMs: number) => () => void;
+}
+
+/**
+ * The wall clock and the runtime's own timers.
+ */
+export const systemClock: Clock = {
+  now: () => Date.now(),
+  schedule: (callback, delayMs) => {
+    const timer = setTimeout(callback, delayMs);
+
+    return () => {
+      clearTimeout(timer);
+    };
+  },
+};

package/src/sources/github/collect-github-repos.ts

@@ -89,7 +89,7 @@ export async function collectGitHubRepos(
 
   const timeoutMs = request.timeoutMs ?? GH_TIMEOUT_MS;
 
-  const listed = await runGH(bin, timeoutMs, [
+  const listed = await runGH(bin, AbortSignal.timeout(timeoutMs), [
     'repo',
     'list',
     ...(request.owner === null ? [] : [request.owner]),

package/src/sources/github/read-git-protocol.ts

@@ -5,7 +5,7 @@ import { runGH } from './run-gh';
  * so, else `https`, which a gh that fails or takes too long also gives.
  */
 export async function readGitProtocol(bin: string, timeoutMs: number): Promise<'https' | 'ssh'> {
-  const run = await runGH(bin, timeoutMs, ['config', 'get', 'git_protocol']);
+  const run = await runGH(bin, AbortSignal.timeout(timeoutMs), ['config', 'get', 'git_protocol']);
 
   return run.exitCode === 0 && run.stdout.trim() === 'ssh' ? 'ssh' : 'https';
 }

package/src/sources/github/run-gh.ts

@@ -6,14 +6,14 @@ export interface GHRun {
 }
 
 /**
- * Runs gh with arguments and a time limit, killing its whole process group
- * once the limit passes, so a wrapper or extension leaves no process
+ * Runs gh with arguments until it exits or the signal aborts, killing its
+ * whole process group on abort, so a wrapper or extension leaves no process
  * behind. gh reads its own config and the host's environment for its
  * token, and is kept from prompting, colouring, or checking for updates.
  */
 export async function runGH(
   bin: string,
-  timeoutMs: number,
+  signal: Readonly<AbortSignal>,
   args: readonly string[],
 ): Promise<GHRun> {
   const proc = Bun.spawn([bin, ...args], {
@@ -40,15 +40,21 @@ export async function runGH(
     proc.exited,
   ]);
 
-  const limit = Promise.withResolvers<null>();
+  const aborted = Promise.withResolvers<null>();
 
-  const timer = setTimeout(() => {
-    limit.resolve(null);
-  }, timeoutMs);
+  const onAbort = () => {
+    aborted.resolve(null);
+  };
 
-  const settled = await Promise.race([finished, limit.promise]);
+  if (signal.aborted) {
+    onAbort();
+  } else {
+    signal.addEventListener('abort', onAbort, { once: true });
+  }
+
+  const settled = await Promise.race([finished, aborted.promise]);
 
-  clearTimeout(timer);
+  signal.removeEventListener('abort', onAbort);
 
   if (settled === null) {
     try {

package/src/store/state-store.ts

@@ -2,7 +2,14 @@ import { Database } from 'bun:sqlite';
 import { randomUUID } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { Kysely, SqliteAdapter, SqliteIntrospector, SqliteQueryCompiler, sql } from 'kysely';
-import type { Expression, ExpressionBuilder, SqlBool, Transaction } from 'kysely';
+import type {
+  CompiledQuery,
+  Expression,
+  ExpressionBuilder,
+  LogEvent,
+  SqlBool,
+  Transaction,
+} from 'kysely';
 import type { AdapterEvent } from '../protocol/adapter-event';
 import { DaemonError } from '../protocol/daemon-error';
 import type { HookEvent } from '../protocol/hook-event';
@@ -129,6 +136,9 @@ export class StateStore {
   // migration that created session ownership.
   readonly daemonID: DaemonID;
 
+  // The close under way or done, which every later close waits on.
+  private stopping: Promise<void> | null = null;
+
   private constructor(sqlite: Database, db: Kysely<StateStoreSchema>, daemonID: DaemonID) {
     this.sqlite = sqlite;
     this.db = db;
@@ -136,8 +146,13 @@ export class StateStore {
   }
 
   // Migrations run statements that cannot happen inside a constructor, so
-  // opening a store is this factory instead of `new`.
-  static async open(dbPath: string, legacyFleetPath?: string): Promise<StateStore> {
+  // opening a store is this factory instead of `new`. A caller that passes
+  // a query listener receives each statement the store runs once it ran.
+  static async open(
+    dbPath: string,
+    legacyFleetPath?: string,
+    onQuery?: (query: CompiledQuery) => void,
+  ): Promise<StateStore> {
     const sqlite = new Database(dbPath, { create: true });
 
     sqlite.run('PRAGMA journal_mode = WAL;');
@@ -149,6 +164,15 @@ export class StateStore {
         createIntrospector: (kysely) => new SqliteIntrospector(kysely),
         createQueryCompiler: () => new SqliteQueryCompiler(),
       },
+      ...(onQuery === undefined
+        ? {}
+        : {
+            log: (event: LogEvent) => {
+              if (event.level === 'query') {
+                onQuery(event.query);
+              }
+            },
+          }),
     });
 
     await runMigrations(db);
@@ -414,7 +438,13 @@ export class StateStore {
     });
   }
 
-  async recordEvent(e: HookEvent, ev: Readonly<AdapterEvent> | null = null): Promise<void> {
+  // Records a hook event in the trail, stamped with the given time in epoch
+  // milliseconds, or the wall clock's when absent.
+  async recordEvent(
+    e: HookEvent,
+    ev: Readonly<AdapterEvent> | null = null,
+    at: number = Date.now(),
+  ): Promise<void> {
     const rawMessage = e.payload['message'];
     const rawSessionID = e.payload['session_id'] ?? e.payload['sessionId'];
     const message = typeof rawMessage === 'string' ? rawMessage : null;
@@ -424,7 +454,7 @@ export class StateStore {
     await this.db
       .insertInto('events')
       .values({
-        ts: new Date().toISOString(),
+        ts: new Date(at).toISOString(),
         atc_id: atcID,
         event: e.event,
         message,
@@ -1132,10 +1162,30 @@ export class StateStore {
       .execute();
   }
 
+  // A second close, or a disposal after one, waits on the first and closes
+  // nothing again; a close that fails is forgotten, so the next one retries.
   async stop(): Promise<void> {
-    await this.db.destroy();
+    this.stopping ??= (async () => {
+      await this.db.destroy();
+
+      this.sqlite.close();
+    })();
+
+    const current = this.stopping;
+
+    try {
+      await current;
+    } catch (error) {
+      if (this.stopping === current) {
+        this.stopping = null;
+      }
+
+      throw error;
+    }
+  }
 
-    this.sqlite.close();
+  [Symbol.asyncDispose](): Promise<void> {
+    return this.stop();
   }
 
   private async adoptLegacyFleet(legacyFleetPath: string): Promise<void> {

package/src/tap.ts

@@ -19,6 +19,24 @@ interface InboxMessage {
   readonly sentAt: number;
 }
 
+// Where the tap prints and how it exits: stdout, stderr, and the process by
+// default.
+interface TapIO {
+  readonly writeStdout: (text: string) => Promise<unknown>;
+  readonly printError: (line: string) => void;
+  readonly exit: (code: number) => void;
+}
+
+const PROCESS_IO: TapIO = {
+  writeStdout: (text) => Bun.write(Bun.stdout, text),
+  printError: (line) => {
+    console.error(line);
+  },
+  exit: (code) => {
+    process.exit(code);
+  },
+};
+
 /**
  * Streams one session's inbox to stdout, one NDJSON line per message, and
  * acks each message once its line is written. It talks to the daemon that
@@ -26,15 +44,20 @@ interface InboxMessage {
  * serves, so a restart from here would take the whole fleet down. Exits 1
  * with a hint when no daemon listens or the session cannot be tapped, and
  * 0 once the daemon closes the connection or ends the subscription because
- * another tap replaced it or the session was removed.
+ * another tap replaced it or the session was removed. It dials the daemon
+ * at `socketPath`, the running daemon's socket by default.
  */
-export async function runTap(session: string): Promise<void> {
+export async function runTap(
+  session: string,
+  socketPath: string = daemonSocketPath,
+  io: TapIO = PROCESS_IO,
+): Promise<void> {
   const bridge = process.env['ATC_SOCKET'];
 
   // Inside a remote host the daemon's own socket is out of reach, and the
   // session bridge serves the tap instead.
   if (process.env['ATC_BRIDGE'] === '1' && bridge !== undefined && bridge !== '') {
-    await runBridgeTap(bridge, process.env['ATC_OUTBOX'] ?? '');
+    await runBridgeTap(bridge, process.env['ATC_OUTBOX'] ?? '', io);
 
     return;
   }
@@ -42,10 +65,12 @@ export async function runTap(session: string): Promise<void> {
   let client: DaemonClient;
 
   try {
-    client = await DaemonClient.open(daemonSocketPath);
+    client = await DaemonClient.open(socketPath);
   } catch {
-    console.error(`atc tap: no daemon at ${daemonSocketPath} — start atc first`);
-    process.exit(1);
+    io.printError(`atc tap: no daemon at ${socketPath} — start atc first`);
+    io.exit(1);
+
+    return;
   }
 
   const closed = Promise.withResolvers<void>();
@@ -83,7 +108,7 @@ export async function runTap(session: string): Promise<void> {
 
     written = (async () => {
       await previous;
-      await ackInboxMessage(client, session, msg);
+      await ackInboxMessage(client, session, msg, io);
     })();
   };
 
@@ -91,15 +116,18 @@ export async function runTap(session: string): Promise<void> {
     await client.sendHello(getBuild());
     await client.sendRequest('session.tap', { session });
   } catch (error) {
-    console.error(`atc tap: ${formatError(error)}`);
+    io.printError(`atc tap: ${formatError(error)}`);
     client.stop();
-    process.exit(1);
+    io.exit(1);
+
+    return;
   }
 
   await closed.promise;
   await written;
 
-  process.exit(0);
+  client.stop();
+  io.exit(0);
 }
 
 interface RequestSender {
@@ -110,19 +138,22 @@ async function ackInboxMessage(
   client: RequestSender,
   session: string,
   msg: InboxMessage,
+  io: TapIO,
 ): Promise<void> {
   const line = `${JSON.stringify({ id: msg.message, from: msg.from, text: msg.text, sentAt: msg.sentAt })}\n`;
 
   try {
-    await Bun.write(Bun.stdout, line);
+    await io.writeStdout(line);
   } catch {
-    process.exit(1);
+    io.exit(1);
+
+    return;
   }
 
   try {
     await client.sendRequest('message.ack', { session, message: msg.message });
   } catch (error) {
-    console.error(`atc tap: ${formatError(error)}`);
+    io.printError(`atc tap: ${formatError(error)}`);
   }
 }
 

package/src/test-utils/build-mock-agent-adapter.ts

@@ -0,0 +1,25 @@
+import type { AgentAdapter } from '../agents/agent-adapter';
+
+/**
+ * An agent adapter for daemon tests: id `claude`, a spawn that runs
+ * `sleep 30` so the session stays alive with no agent CLI behind it, every
+ * hook read as a heartbeat, no name, no resume command, no headless runner,
+ * no screen detector, and no inbox messages. Every optional member is
+ * absent, so the daemon takes the stand-in path for each one, and
+ * `agents.list` reports the adapter as not installed. An override replaces
+ * the member it names.
+ */
+export function buildMockAgentAdapter(overrides: Partial<AgentAdapter> = {}): AgentAdapter {
+  return {
+    id: 'claude',
+    headlessRunner: null,
+    screenDetector: null,
+    takesMessages: false,
+    planSpawn: () => ({ bin: 'sleep', args: ['30'] }),
+    normalizeHook: () => ({ kind: 'heartbeat' }),
+    loadName: () => Promise.resolve(null),
+    canResume: () => true,
+    buildResumeCommand: () => null,
+    ...overrides,
+  };
+}

package/src/test-utils/build-mock-agent-entry.ts

@@ -0,0 +1,32 @@
+import { faker } from '@faker-js/faker';
+import type { AgentEntry } from '../shared/collect-agents';
+import { mergeDeep } from './merge-deep';
+import type { MockOverrides } from './mock-overrides';
+
+/**
+ * The fields the defaults set; every other field is absent until an
+ * override gives it whole.
+ */
+type DefaultedKey = 'id' | 'kind' | 'label' | 'mark' | 'bin' | 'args' | 'env';
+
+/**
+ * A registry entry for a plain Claude agent: kind `claude`, no arguments,
+ * no environment, and none of the gateway fields. The id, label, mark, and
+ * binary are arbitrary. Overrides merge into fresh defaults at every depth.
+ */
+export function buildMockAgentEntry(
+  overrides: MockOverrides<AgentEntry, DefaultedKey> = {},
+): AgentEntry {
+  return mergeDeep<AgentEntry, DefaultedKey>(
+    {
+      id: faker.string.alpha({ length: 8, casing: 'lower' }),
+      kind: 'claude',
+      label: faker.company.name(),
+      mark: faker.string.alpha({ length: 1, casing: 'lower' }),
+      bin: faker.system.filePath(),
+      args: [],
+      env: {},
+    },
+    overrides,
+  );
+}

package/src/test-utils/build-mock-auth-binding.ts

@@ -0,0 +1,28 @@
+import { faker } from '@faker-js/faker';
+import type { AuthBinding } from '../daemon/build-auth-binding';
+import { toAgentID } from '../shared/to-agent-id';
+import { mergeDeep } from './merge-deep';
+import type { MockOverrides } from './mock-overrides';
+
+/**
+ * A runtime auth binding for agent `glm` at an arbitrary endpoint, reaching
+ * no profile and needing no secret, with no placeholder or profile
+ * variables and an arbitrary hash. Overrides merge into fresh defaults at
+ * every depth, and a list replaces its default whole.
+ */
+export function buildMockAuthBinding(
+  overrides: MockOverrides<AuthBinding, keyof AuthBinding> = {},
+): AuthBinding {
+  return mergeDeep<AuthBinding>(
+    {
+      agent: toAgentID('glm'),
+      baseURL: faker.internet.url(),
+      profiles: [],
+      secrets: [],
+      placeholderEnv: {},
+      profileEnv: {},
+      hash: faker.string.hexadecimal({ length: 64, casing: 'lower', prefix: '' }),
+    },
+    overrides,
+  );
+}

package/src/test-utils/build-mock-auth-profile.ts

@@ -0,0 +1,62 @@
+import { faker } from '@faker-js/faker';
+import type { AuthProfile } from '../shared/collect-auth-profiles';
+import { mergeDeep } from './merge-deep';
+import type { MockOverrides } from './mock-overrides';
+
+/**
+ * The auth profile kinds that inject a header for a broker host.
+ */
+type HeaderAuthProfile = Extract<AuthProfile, { readonly host: string }>;
+
+/**
+ * The auth profile kind that signs in to GitHub.
+ */
+type GitHubAuthProfile = Extract<AuthProfile, { readonly kind: 'github' }>;
+
+type HeaderOverrides = MockOverrides<HeaderAuthProfile, keyof HeaderAuthProfile>;
+
+type GitHubOverrides = MockOverrides<GitHubAuthProfile, keyof GitHubAuthProfile> & {
+  readonly kind: 'github';
+};
+
+/**
+ * An auth profile of kind `custom` that sends its secret as a bearer token
+ * in a header, or, for an override of kind `github`, a GitHub profile.
+ * Either has no environment and no dependencies, and an arbitrary name and
+ * secret; a custom profile's host and header name are arbitrary too.
+ * Overrides merge into fresh defaults at every depth.
+ */
+export function buildMockAuthProfile(overrides?: HeaderOverrides): HeaderAuthProfile;
+export function buildMockAuthProfile(overrides: GitHubOverrides): GitHubAuthProfile;
+
+export function buildMockAuthProfile(
+  overrides: HeaderOverrides | GitHubOverrides = {},
+): AuthProfile {
+  const name = faker.string.alpha({ length: 8, casing: 'lower' });
+  const secret = faker.string.alpha({ length: 8, casing: 'lower' });
+
+  return isGitHubOverrides(overrides)
+    ? mergeDeep<GitHubAuthProfile>(
+        { name, secret, kind: 'github', env: {}, dependencies: [] },
+        overrides,
+      )
+    : mergeDeep<HeaderAuthProfile>(
+        {
+          name,
+          secret,
+          kind: 'custom',
+          host: faker.internet.domainName(),
+          header: `x-${faker.string.alpha({ length: 6, casing: 'lower' })}-key`,
+          scheme: 'bearer',
+          env: {},
+          dependencies: [],
+        },
+        overrides,
+      );
+}
+
+function isGitHubOverrides(
+  overrides: HeaderOverrides | GitHubOverrides,
+): overrides is GitHubOverrides {
+  return overrides.kind === 'github';
+}