agent-control-plane 0.1.0

package/tools/tests/test-branch-verification-guard-targeted-coverage.sh

@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+FLOW_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+GUARD_SCRIPT="${FLOW_ROOT}/tools/bin/branch-verification-guard.sh"
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+
+origin_repo="$tmpdir/origin.git"
+repo_root="$tmpdir/repo-root"
+run_dir="$tmpdir/run"
+
+mkdir -p "$run_dir"
+
+git init --bare "$origin_repo" >/dev/null 2>&1
+git clone "$origin_repo" "$repo_root" >/dev/null 2>&1
+
+mkdir -p \
+  "$repo_root/apps/api/src/modules/auth" \
+  "$repo_root/apps/web/e2e/archive/auth" \
+  "$repo_root/apps/web/src/app/(auth)/login"
+
+cat >"$repo_root/apps/api/src/modules/auth/auth.service.ts" <<'EOF'
+export const loginFailureMode = 'legacy';
+EOF
+
+cat >"$repo_root/apps/api/src/modules/auth/auth.service.extended.spec.ts" <<'EOF'
+describe('auth service', () => {
+  it('handles login failures', () => {
+    expect(true).toBe(true)
+  })
+})
+EOF
+
+cat >"$repo_root/apps/web/src/app/(auth)/login/page.tsx" <<'EOF'
+export default function LoginPage() {
+  return null
+}
+EOF
+
+cat >"$repo_root/apps/web/src/app/(auth)/login/page.spec.tsx" <<'EOF'
+describe('login page', () => {
+  it('renders', () => {
+    expect(true).toBe(true)
+  })
+})
+EOF
+
+cat >"$repo_root/apps/web/e2e/archive/auth/tenant-isolation-login.spec.ts" <<'EOF'
+test('tenant isolation login', async () => {
+  expect(true).toBeTruthy()
+})
+EOF
+
+git -C "$repo_root" add .
+git -C "$repo_root" -c user.name=Test -c user.email=test@example.com commit -m "init" >/dev/null
+git -C "$repo_root" branch -M main >/dev/null 2>&1
+git -C "$repo_root" push origin main >/dev/null 2>&1
+
+git -C "$repo_root" checkout -b openclaw/pr-coverage >/dev/null 2>&1
+
+cat >"$repo_root/apps/api/src/modules/auth/auth.service.ts" <<'EOF'
+export const loginFailureMode = 'generic-invalid-credentials';
+EOF
+
+cat >"$repo_root/apps/api/src/modules/auth/auth.service.extended.spec.ts" <<'EOF'
+describe('auth service', () => {
+  it('normalizes tenant login failures', () => {
+    expect(true).toBe(true)
+  })
+})
+EOF
+
+cat >"$repo_root/apps/web/src/app/(auth)/login/page.tsx" <<'EOF'
+export default function LoginPage() {
+  return 'Invalid credentials'
+}
+EOF
+
+cat >"$repo_root/apps/web/src/app/(auth)/login/page.spec.tsx" <<'EOF'
+describe('login page', () => {
+  it('shows the generic invalid credentials message', () => {
+    expect(true).toBe(true)
+  })
+})
+EOF
+
+cat >"$repo_root/apps/web/e2e/archive/auth/tenant-isolation-login.spec.ts" <<'EOF'
+test('tenant isolation login hides tenant existence', async () => {
+  expect(true).toBeTruthy()
+})
+EOF
+
+cat >"$run_dir/verification.jsonl" <<'EOF'
+{"status":"pass","command":"pnpm --filter api typecheck"}
+{"status":"pass","command":"pnpm --filter api test -- --testPathPatterns=\"auth.service.extended\""}
+{"status":"pass","command":"pnpm --filter web test -- login/page.spec"}
+EOF
+
+set +e
+guard_output="$("$GUARD_SCRIPT" --worktree "$repo_root" --base-ref origin/main --run-dir "$run_dir" 2>&1)"
+guard_status=$?
+set -e
+
+test "$guard_status" = "43"
+grep -q 'changed test files were not covered by a targeted test command' <<<"$guard_output"
+grep -q 'Changed test files still missing explicit coverage:' <<<"$guard_output"
+grep -q 'apps/web/e2e/archive/auth/tenant-isolation-login.spec.ts' <<<"$guard_output"
+if grep -q 'apps/api/src/modules/auth/auth.service.extended.spec.ts | accepted anchors' <<<"$guard_output"; then
+  echo "API spec should have been recognized as covered by auth.service.extended test command" >&2
+  exit 1
+fi
+if grep -q 'apps/web/src/app/(auth)/login/page.spec.tsx | accepted anchors' <<<"$guard_output"; then
+  echo "web page spec should have been recognized as covered by login/page.spec test command" >&2
+  exit 1
+fi
+
+cat >>"$run_dir/verification.jsonl" <<'EOF'
+{"status":"pass","command":"pnpm exec playwright test apps/web/e2e/archive/auth/tenant-isolation-login.spec.ts"}
+EOF
+
+"$GUARD_SCRIPT" --worktree "$repo_root" --base-ref origin/main --run-dir "$run_dir" >/dev/null
+
+echo "branch verification guard targeted coverage test passed"

package/tools/tests/test-codex-quota-manager-failure-driven-rotation.sh

@@ -0,0 +1,178 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+FLOW_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+SOURCE_SCRIPT="${FLOW_ROOT}/tools/vendor/codex-quota-manager/scripts/auto-switch.sh"
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+
+bin_dir="$tmpdir/bin"
+cache_dir="$tmpdir/cache"
+state_file="$cache_dir/rotation-state.json"
+switch_state_file="$cache_dir/last-switch.env"
+switch_log="$tmpdir/switch.log"
+home_dir="$tmpdir/home"
+
+mkdir -p "$bin_dir" "$cache_dir" "$home_dir"
+
+cat >"$bin_dir/codex-quota" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+
+scenario="${MOCK_QUOTA_SCENARIO:?}"
+fixture_dir="${MOCK_QUOTA_FIXTURE_DIR:?}"
+switch_log="${MOCK_QUOTA_SWITCH_LOG:?}"
+
+case "${1:-}:${2:-}:${3:-}" in
+  codex:list:--json)
+    cat "${fixture_dir}/${scenario}/list.json"
+    ;;
+  codex:quota:*)
+    label="${3:-}"
+    if [[ -f "${fixture_dir}/${scenario}/quota-${label}.err" ]]; then
+      cat "${fixture_dir}/${scenario}/quota-${label}.err" >&2
+      exit 1
+    fi
+    cat "${fixture_dir}/${scenario}/quota-${label}.json"
+    ;;
+  codex:switch:*)
+    label="${3:-}"
+    printf '%s\n' "$label" >>"$switch_log"
+    if [[ -f "${fixture_dir}/${scenario}/switch-${label}.err" ]]; then
+      cat "${fixture_dir}/${scenario}/switch-${label}.err" >&2
+      exit 1
+    fi
+    printf 'Switched to %s.\n' "$label"
+    ;;
+  *)
+    echo "unexpected codex-quota invocation: $*" >&2
+    exit 1
+    ;;
+esac
+EOF
+
+chmod +x "$bin_dir/codex-quota"
+
+fixture_dir="$tmpdir/fixtures"
+mkdir -p "$fixture_dir/usage-switch" "$fixture_dir/deferred" "$fixture_dir/auth-401"
+
+cat >"$fixture_dir/usage-switch/list.json" <<'EOF'
+{"activeInfo":{"trackedLabel":"current-a"},"accounts":[{"label":"current-a","isActive":true},{"label":"next-b"},{"label":"next-c"}]}
+EOF
+cat >"$fixture_dir/usage-switch/quota-current-a.json" <<'EOF'
+[{"label":"current-a","usage":{"rate_limit":{"allowed":false,"limit_reached":true,"primary_window":{"used_percent":92,"reset_at":4102444800},"secondary_window":{"used_percent":65,"reset_at":4102444800}}}}]
+EOF
+cat >"$fixture_dir/usage-switch/quota-next-b.json" <<'EOF'
+[{"label":"next-b","usage":{"rate_limit":{"allowed":false,"limit_reached":true,"primary_window":{"used_percent":81,"reset_at":4102441200},"secondary_window":{"used_percent":20,"reset_at":4102441200}}}}]
+EOF
+cat >"$fixture_dir/usage-switch/quota-next-c.json" <<'EOF'
+[{"label":"next-c","usage":{"rate_limit":{"allowed":true,"limit_reached":false,"primary_window":{"used_percent":12,"reset_at":4102437600},"secondary_window":{"used_percent":18,"reset_at":4102448400}}}}]
+EOF
+
+cat >"$fixture_dir/deferred/list.json" <<'EOF'
+{"activeInfo":{"trackedLabel":"current-a"},"accounts":[{"label":"current-a","isActive":true},{"label":"next-b"}]}
+EOF
+cat >"$fixture_dir/deferred/quota-current-a.json" <<'EOF'
+[{"label":"current-a","usage":{"rate_limit":{"allowed":false,"limit_reached":true,"primary_window":{"used_percent":91,"reset_at":4102444800},"secondary_window":{"used_percent":30,"reset_at":4102444800}}}}]
+EOF
+cat >"$fixture_dir/deferred/quota-next-b.json" <<'EOF'
+[{"label":"next-b","usage":{"rate_limit":{"allowed":false,"limit_reached":true,"primary_window":{"used_percent":88,"reset_at":4102441200},"secondary_window":{"used_percent":21,"reset_at":4102441200}}}}]
+EOF
+
+cat >"$fixture_dir/auth-401/list.json" <<'EOF'
+{"activeInfo":{"trackedLabel":"bad-auth"},"accounts":[{"label":"bad-auth","isActive":true},{"label":"good-next"}]}
+EOF
+cat >"$fixture_dir/auth-401/quota-good-next.json" <<'EOF'
+[{"label":"good-next","usage":{"rate_limit":{"allowed":true,"limit_reached":false,"primary_window":{"used_percent":15,"reset_at":4102437600},"secondary_window":{"used_percent":19,"reset_at":4102448400}}}}]
+EOF
+
+run_usage_switch_case() {
+  rm -f "$state_file" "$switch_state_file" "$switch_log"
+
+  output="$(
+    HOME="$home_dir" \
+    PATH="$bin_dir:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin" \
+    CODEX_QUOTA_BIN="$bin_dir/codex-quota" \
+    MOCK_QUOTA_SCENARIO="usage-switch" \
+    MOCK_QUOTA_FIXTURE_DIR="$fixture_dir" \
+    MOCK_QUOTA_SWITCH_LOG="$switch_log" \
+    CODEX_QUOTA_MANAGER_STATE_FILE="$state_file" \
+    CODEX_QUOTA_MANAGER_SWITCH_STATE_FILE="$switch_state_file" \
+    bash "$SOURCE_SCRIPT" \
+      --trigger-reason usage-limit \
+      --current-label current-a \
+      --five-hour-threshold 70 \
+      --weekly-threshold 90
+  )"
+
+  grep -q '^SELECTED_LABEL=next-c$' <<<"$output"
+  grep -q '^SWITCH_DECISION=switched$' <<<"$output"
+  test "$(tail -n 1 "$switch_log")" = "next-c"
+  test "$(jq -r '.accounts["current-a"].next_retry_at' "$state_file")" = "4102444800"
+  test "$(jq -r '.accounts["next-b"].next_retry_at' "$state_file")" = "4102441200"
+  test "$(jq -r '.accounts["next-c"].removed // false' "$state_file")" = "false"
+}
+
+run_deferred_case() {
+  rm -f "$state_file" "$switch_state_file" "$switch_log"
+
+  set +e
+  output="$(
+    HOME="$home_dir" \
+    PATH="$bin_dir:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin" \
+    CODEX_QUOTA_BIN="$bin_dir/codex-quota" \
+    MOCK_QUOTA_SCENARIO="deferred" \
+    MOCK_QUOTA_FIXTURE_DIR="$fixture_dir" \
+    MOCK_QUOTA_SWITCH_LOG="$switch_log" \
+    CODEX_QUOTA_MANAGER_STATE_FILE="$state_file" \
+    CODEX_QUOTA_MANAGER_SWITCH_STATE_FILE="$switch_state_file" \
+    bash "$SOURCE_SCRIPT" \
+      --trigger-reason usage-limit \
+      --current-label current-a \
+      --five-hour-threshold 70 \
+      --weekly-threshold 90
+  )"
+  status=$?
+  set -e
+
+  test "$status" = "10"
+  grep -q '^SWITCH_DECISION=deferred$' <<<"$output"
+  grep -q '^NEXT_RETRY_AT=4102441200$' <<<"$output"
+  grep -q '^NEXT_RETRY_LABEL=next-b$' <<<"$output"
+  test "$(jq -r '.accounts["current-a"].next_retry_at' "$state_file")" = "4102444800"
+  test "$(jq -r '.accounts["next-b"].next_retry_at' "$state_file")" = "4102441200"
+}
+
+run_auth_401_case() {
+  rm -f "$state_file" "$switch_state_file" "$switch_log"
+
+  output="$(
+    HOME="$home_dir" \
+    PATH="$bin_dir:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin" \
+    CODEX_QUOTA_BIN="$bin_dir/codex-quota" \
+    MOCK_QUOTA_SCENARIO="auth-401" \
+    MOCK_QUOTA_FIXTURE_DIR="$fixture_dir" \
+    MOCK_QUOTA_SWITCH_LOG="$switch_log" \
+    CODEX_QUOTA_MANAGER_STATE_FILE="$state_file" \
+    CODEX_QUOTA_MANAGER_SWITCH_STATE_FILE="$switch_state_file" \
+    bash "$SOURCE_SCRIPT" \
+      --trigger-reason auth-401 \
+      --current-label bad-auth \
+      --five-hour-threshold 70 \
+      --weekly-threshold 90
+  )"
+
+  grep -q '^REMOVED_LABEL=bad-auth$' <<<"$output"
+  grep -q '^REMOVED_REASON=auth-401$' <<<"$output"
+  grep -q '^SELECTED_LABEL=good-next$' <<<"$output"
+  grep -q '^SWITCH_DECISION=switched$' <<<"$output"
+  test "$(tail -n 1 "$switch_log")" = "good-next"
+  test "$(jq -r '.accounts["bad-auth"].removed' "$state_file")" = "true"
+}
+
+run_usage_switch_case
+run_deferred_case
+run_auth_401_case
+
+echo "codex quota manager failure-driven rotation test passed"

package/tools/tests/test-codex-quota-wrapper.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+FLOW_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+WRAPPER="${FLOW_ROOT}/tools/bin/codex-quota"
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+
+bin_dir="$tmpdir/bin"
+log_file="$tmpdir/node-args.log"
+expected_entry="${FLOW_ROOT}/tools/vendor/codex-quota/codex-quota.js"
+
+mkdir -p "$bin_dir"
+
+cat >"$bin_dir/node" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+printf '%s\n' "$@" >"${LOG_FILE:?}"
+EOF
+
+chmod +x "$bin_dir/node"
+
+LOG_FILE="$log_file" \
+ACP_CODEX_QUOTA_NODE_BIN="$bin_dir/node" \
+bash "$WRAPPER" codex list --json
+
+actual_entry="$(
+  python3 -c 'import os, sys; print(os.path.realpath(sys.argv[1]))' "$(sed -n '1p' "$log_file")"
+)"
+
+test "$actual_entry" = "$expected_entry"
+test "$(sed -n '2p' "$log_file")" = "codex"
+test "$(sed -n '3p' "$log_file")" = "list"
+test "$(sed -n '4p' "$log_file")" = "--json"
+
+echo "codex quota wrapper test passed"

package/tools/tests/test-contribution-docs.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
+
+test -f "$ROOT_DIR/CONTRIBUTING.md"
+test -f "$ROOT_DIR/CLA.md"
+test -f "$ROOT_DIR/.github/pull_request_template.md"
+
+grep -q 'This CLA is a license grant, not a copyright assignment\.' "$ROOT_DIR/CLA.md"
+grep -q 'You retain copyright in your contribution\.' "$ROOT_DIR/CLA.md"
+grep -q 'relicense the contribution' "$ROOT_DIR/CLA.md"
+grep -q 'The PR template includes a checkbox for this\.' "$ROOT_DIR/CONTRIBUTING.md"
+grep -q 'sponsorships do not automatically create payment obligations to contributors' "$ROOT_DIR/CONTRIBUTING.md"
+grep -q 'sponsorship does not transfer ownership, copyright, patent rights, or control' "$ROOT_DIR/README.md"
+grep -q '\[CLA.md\](\./CLA.md)' "$ROOT_DIR/README.md"
+
+echo "contribution docs test passed"