agent-yes 1.287.0 → 1.288.0

package/ts/agentPermissions.bun.spec.ts

@@ -0,0 +1,117 @@
+import { afterEach, describe, expect, it } from "bun:test";
+import { derivePermissions, permissionBadge } from "./agentPermissions.ts";
+import { allowsSkipPermissions } from "./workspaceConfig.ts";
+
+// Issue #236. The pid record is the only place the answer to "was this agent
+// allowed to act without confirmation?" survives — the global index carries no
+// argv, and the wrapper's own flags never reach the CLI's args at all.
+
+describe("derivePermissions", () => {
+  const YES = ["--dangerously-skip-permissions"];
+
+  it("detects the configured yolo flag", () => {
+    expect(derivePermissions({ cliArgs: ["--print", ...YES], yesArgs: YES }).skip_permissions).toBe(
+      true,
+    );
+  });
+
+  it("detects a dangerous flag the config never declared", () => {
+    // A CLI with no yesArgs must still not hide a flag that disables its gate —
+    // the check is the union of configured and known-dangerous, not just config.
+    expect(derivePermissions({ cliArgs: ["--yolo"] }).skip_permissions).toBe(true);
+    expect(
+      derivePermissions({ cliArgs: ["--dangerously-bypass-approvals-and-sandbox"] })
+        .skip_permissions,
+    ).toBe(true);
+  });
+
+  it("matches the flag part of an --flag=value form", () => {
+    expect(derivePermissions({ cliArgs: ["--full-auto=true"] }).skip_permissions).toBe(true);
+  });
+
+  it("does not flag ordinary args", () => {
+    expect(
+      derivePermissions({ cliArgs: ["--model", "opus", "--continue"], yesArgs: YES })
+        .skip_permissions,
+    ).toBe(false);
+    expect(derivePermissions({ cliArgs: [] }).skip_permissions).toBe(false);
+  });
+
+  it("records the wrapper flags independently of the CLI's", () => {
+    const p = derivePermissions({ cliArgs: [], robust: true, autoContinue: true });
+    expect(p).toEqual({ skip_permissions: false, robust: true, auto_continue: true });
+  });
+
+  it("defaults every flag to false rather than undefined", () => {
+    // The record is serialized to JSON and read by both runtimes; an absent
+    // boolean would read as "unknown" where we mean "no".
+    expect(derivePermissions({ cliArgs: [] })).toEqual({
+      skip_permissions: false,
+      robust: false,
+      auto_continue: false,
+    });
+  });
+
+  it("ignores an empty yesArgs entry rather than matching everything", () => {
+    // A config with a stray "" must not make every arg look like a yolo flag.
+    expect(derivePermissions({ cliArgs: ["--model"], yesArgs: [""] }).skip_permissions).toBe(false);
+  });
+});
+
+describe("permissionBadge", () => {
+  it("reports skip only when the CLI gate is off", () => {
+    expect(permissionBadge({ skip_permissions: true, robust: false, auto_continue: false })).toBe(
+      "skip",
+    );
+    expect(permissionBadge({ skip_permissions: false, robust: false, auto_continue: false })).toBe(
+      "prompt",
+    );
+  });
+
+  it("never lets the wrapper flags soften the label", () => {
+    // robust/auto_continue change how the agent RECOVERS, not what it may do.
+    expect(permissionBadge({ skip_permissions: true, robust: true, auto_continue: true })).toBe(
+      "skip",
+    );
+  });
+
+  it("has nothing to show for a record with no stamp (pre-#236 agent)", () => {
+    expect(permissionBadge(null)).toBeNull();
+    expect(permissionBadge(undefined)).toBeNull();
+  });
+});
+
+describe("allowsSkipPermissions", () => {
+  const original = process.env.AGENT_YES_ALLOW_SKIP_PERMISSIONS;
+  afterEach(() => {
+    if (original === undefined) delete process.env.AGENT_YES_ALLOW_SKIP_PERMISSIONS;
+    else process.env.AGENT_YES_ALLOW_SKIP_PERMISSIONS = original;
+  });
+
+  it("is permissive by default — restricting is an opt-in", () => {
+    delete process.env.AGENT_YES_ALLOW_SKIP_PERMISSIONS;
+    expect(allowsSkipPermissions()).toBe(true);
+  });
+
+  it("is restricted by an explicit falsy env value", () => {
+    for (const v of ["0", "false", "no", "off", "FALSE"]) {
+      process.env.AGENT_YES_ALLOW_SKIP_PERMISSIONS = v;
+      expect(allowsSkipPermissions()).toBe(false);
+    }
+  });
+
+  it("stays permissive for any other value, including garbage", () => {
+    // Failing closed here would lock spawns out of a host over a typo; the
+    // enforcement point is an explicit opt-in, so an unparseable value must not
+    // silently become a restriction.
+    for (const v of ["1", "true", "yes", "on", "banana"]) {
+      process.env.AGENT_YES_ALLOW_SKIP_PERMISSIONS = v;
+      expect(allowsSkipPermissions()).toBe(true);
+    }
+  });
+
+  it("treats an empty env value as unset (falls through to config)", () => {
+    process.env.AGENT_YES_ALLOW_SKIP_PERMISSIONS = "   ";
+    expect(allowsSkipPermissions()).toBe(true);
+  });
+});

package/ts/agentShare.bun.spec.ts

@@ -0,0 +1,240 @@
+import { describe, it, expect } from "bun:test";
+import { scopedFetch } from "./agentShare.ts";
+
+// The security core of single-agent view-only sharing: scopedFetch wraps the full
+// `ay serve` API and must DEFAULT-DENY, exposing only reads scoped to ONE agent_id.
+// These drive the real filter with a mock inner handler (no WebRTC / no registry).
+
+const SHARED = "aaaaaaaaaaaa"; // the shared agent's stable id
+const OTHER = "bbbbbbbbbbbb"; // a sibling on the same host — must never leak
+
+function rec(pid: number, agent_id: string) {
+  return { pid, agent_id, cli: "claude", cwd: "/x", status: "running", title: "t" };
+}
+
+// A stand-in for the master apiFetch. Records what it was asked and answers a few
+// endpoints; the scoped wrapper is what we're testing.
+function makeInner(seen: { url?: string }) {
+  return async (req: Request): Promise<Response> => {
+    const url = new URL(req.url);
+    seen.url = req.method + " " + url.pathname + url.search;
+    const p = url.pathname;
+    if (p === "/api/ls") {
+      // The real handler honours ?keyword=; emulate that so we can assert the
+      // wrapper both narrows via keyword AND post-filters by exact agent_id.
+      const kw = url.searchParams.get("keyword");
+      const all = [rec(1, SHARED), rec(2, OTHER)];
+      const out = kw ? all.filter((r) => r.agent_id === kw || r.cwd.includes(kw)) : all;
+      return Response.json(out);
+    }
+    if (p === "/api/whoami") return Response.json({ host: "me@box" });
+    if (p === "/api/version") return new Response("1.2.3");
+    if (p === "/api/ls/subscribe") {
+      const enc = new TextEncoder();
+      const body = new ReadableStream({
+        start(ctrl) {
+          // Initial full snapshot with BOTH agents, then a delta touching each.
+          ctrl.enqueue(
+            enc.encode(
+              `data: ${JSON.stringify({ full: true, upsert: [rec(1, SHARED), rec(2, OTHER)], remove: [] })}\n\n`,
+            ),
+          );
+          ctrl.enqueue(enc.encode(`: ping\n\n`));
+          ctrl.enqueue(
+            enc.encode(`data: ${JSON.stringify({ upsert: [rec(2, OTHER)], remove: [] })}\n\n`),
+          );
+          ctrl.enqueue(
+            enc.encode(`data: ${JSON.stringify({ upsert: [rec(1, SHARED)], remove: [] })}\n\n`),
+          );
+          ctrl.close();
+        },
+      });
+      return new Response(body, { headers: { "Content-Type": "text/event-stream" } });
+    }
+    // read/tail/status/size land here only if the wrapper allowed them through.
+    return new Response("inner-ok");
+  };
+}
+
+const mk = (seen: { url?: string } = {}) => scopedFetch(SHARED, makeInner(seen), "r");
+
+async function sse(res: Response): Promise<string> {
+  return await res.text();
+}
+
+describe("scopedFetch — default-deny writes", () => {
+  for (const [method, path] of [
+    ["POST", "/api/send"],
+    ["POST", "/api/resize/1"],
+    ["POST", "/api/kill"],
+    ["POST", "/api/restart"],
+    ["POST", "/api/spawn"],
+    ["POST", "/api/presence"],
+    ["GET", "/api/presence"],
+    ["POST", "/api/share"],
+    ["GET", "/api/notes"],
+    ["GET", "/api/spawn-config"],
+  ] as const) {
+    it(`403s ${method} ${path}`, async () => {
+      const res = await mk()(new Request("http://ay.local" + path, { method }));
+      expect(res.status).toBe(403);
+    });
+  }
+});
+
+describe("scopedFetch — /api/ls is narrowed and post-filtered", () => {
+  it("injects keyword=agentId and returns ONLY the shared agent", async () => {
+    const seen: { url?: string } = {};
+    const res = await mk(seen)(new Request("http://ay.local/api/ls"));
+    expect(seen.url).toContain("keyword=" + SHARED); // narrowed server-side
+    const out = (await res.json()) as { agent_id: string }[];
+    expect(out).toHaveLength(1);
+    expect(out[0]!.agent_id).toBe(SHARED);
+  });
+
+  it("post-filters even if the inner handler over-matches (fuzzy keyword)", async () => {
+    // Inner that ignores keyword and returns everyone — the wrapper must still cut
+    // it down to the shared agent by EXACT agent_id.
+    const leaky = scopedFetch(
+      SHARED,
+      async () => Response.json([rec(1, SHARED), rec(2, OTHER)]),
+      "r",
+    );
+    const out = (await (await leaky(new Request("http://ay.local/api/ls"))).json()) as {
+      agent_id: string;
+    }[];
+    expect(out.map((r) => r.agent_id)).toEqual([SHARED]);
+  });
+});
+
+describe("scopedFetch — /api/ls/subscribe SSE is filtered", () => {
+  it("keeps only the shared agent across snapshot + deltas", async () => {
+    const res = await mk()(new Request("http://ay.local/api/ls/subscribe"));
+    const text = await sse(res);
+    expect(text).toContain('"full":true');
+    expect(text).toContain(SHARED);
+    expect(text).not.toContain(OTHER); // sibling never crosses the channel
+    expect(text).toContain(": ping"); // heartbeat passes through
+    // The delta that touched only OTHER must be dropped entirely.
+    const dataEvents = text.split("\n\n").filter((e) => e.startsWith("data:"));
+    // full snapshot (shared only) + the shared-agent delta = 2 data events.
+    expect(dataEvents).toHaveLength(2);
+  });
+});
+
+describe("scopedFetch — /api/ls/subscribe remove + teardown", () => {
+  // Inner whose stream announces both agents, then removes them: only the removal
+  // of a pid we actually FORWARDED may cross; a never-forwarded sibling pid is
+  // information (its existence) and must be dropped.
+  function removalInner(): (req: Request) => Promise<Response> {
+    const enc = new TextEncoder();
+    return async () =>
+      new Response(
+        new ReadableStream({
+          start(ctrl) {
+            ctrl.enqueue(
+              enc.encode(
+                `data: ${JSON.stringify({ full: true, upsert: [rec(1, SHARED), rec(2, OTHER)], remove: [] })}\n\n`,
+              ),
+            );
+            ctrl.enqueue(enc.encode(`data: ${JSON.stringify({ upsert: [], remove: [2] })}\n\n`));
+            ctrl.enqueue(enc.encode(`data: ${JSON.stringify({ upsert: [], remove: [1] })}\n\n`));
+            ctrl.close();
+          },
+        }),
+        { headers: { "Content-Type": "text/event-stream" } },
+      );
+  }
+
+  it("forwards removes only for pids it forwarded (sibling removals stay hidden)", async () => {
+    const res = await scopedFetch(
+      SHARED,
+      removalInner(),
+      "r",
+    )(new Request("http://ay.local/api/ls/subscribe"));
+    const events = (await sse(res))
+      .split("\n\n")
+      .filter((e) => e.startsWith("data:"))
+      .map((e) => JSON.parse(e.slice(5)) as { upsert: unknown[]; remove: number[] });
+    // Snapshot (shared only) + the remove of OUR pid; OTHER's removal is dropped.
+    expect(events).toHaveLength(2);
+    expect(events[0]!.upsert).toHaveLength(1);
+    expect(events[1]!.remove).toEqual([1]);
+  });
+
+  it("cancelling the filtered stream tears down the upstream reader", async () => {
+    const res = await mk()(new Request("http://ay.local/api/ls/subscribe"));
+    await res.body!.cancel(); // viewer went away — must not leak the inner stream
+    expect(res.status).toBe(200);
+  });
+});
+
+describe("scopedFetch — read metadata", () => {
+  it("passes /api/version through untouched", async () => {
+    const res = await mk()(new Request("http://ay.local/api/version"));
+    expect(await res.text()).toBe("1.2.3");
+  });
+
+  it("advertises read-only capability on /api/whoami", async () => {
+    const res = await mk()(new Request("http://ay.local/api/whoami"));
+    const who = (await res.json()) as {
+      host: string;
+      share: { readonly: boolean; agent_id: string; perm: string };
+    };
+    expect(who.host).toBe("me@box");
+    expect(who.share.readonly).toBe(true);
+    expect(who.share.agent_id).toBe(SHARED);
+    expect(who.share.perm).toBe("r");
+  });
+
+  it("403s a read of an agent that is not the shared one (unknown keyword)", async () => {
+    // resolveOne throws for an unknown keyword → targetIsAgent false → 403. Uses a
+    // keyword that cannot resolve on this machine, so it never leaks a real agent.
+    const res = await mk()(new Request("http://ay.local/api/read/zzzzzzzzzzzz-nope"));
+    expect(res.status).toBe(403);
+  });
+});
+
+describe("scopedFetch — read-write (rw / steer) share", () => {
+  const mkRw = () => scopedFetch(SHARED, makeInner({}), "rw");
+
+  it("advertises perm=rw and readonly=false on /api/whoami", async () => {
+    const res = await mkRw()(new Request("http://ay.local/api/whoami"));
+    const who = (await res.json()) as { share: { readonly: boolean; perm: string } };
+    expect(who.share.perm).toBe("rw");
+    expect(who.share.readonly).toBe(false);
+  });
+
+  it("still DENIES control (kill / restart / spawn) — rw is steer, not control", async () => {
+    for (const path of ["/api/kill", "/api/restart", "/api/spawn"]) {
+      const res = await mkRw()(new Request("http://ay.local" + path, { method: "POST" }));
+      expect(res.status).toBe(403);
+    }
+  });
+
+  it("DENIES send/resize aimed at an agent that isn't the shared one", async () => {
+    // keyword can't resolve on this machine → targetIsAgent false → 403, so an rw
+    // holder can only steer THE shared agent, never a sibling.
+    const send = await mkRw()(
+      new Request("http://ay.local/api/send", {
+        method: "POST",
+        body: JSON.stringify({ keyword: "zzzzzzzzzzzz-nope", msg: "x" }),
+      }),
+    );
+    expect(send.status).toBe(403);
+    const resize = await mkRw()(
+      new Request("http://ay.local/api/resize/zzzzzzzzzzzz-nope", { method: "POST" }),
+    );
+    expect(resize.status).toBe(403);
+  });
+
+  it("still denies send on a VIEW-ONLY (r) share", async () => {
+    const res = await mk()(
+      new Request("http://ay.local/api/send", {
+        method: "POST",
+        body: JSON.stringify({ keyword: "1", msg: "x" }),
+      }),
+    );
+    expect(res.status).toBe(403);
+  });
+});

package/ts/agentTree.bun.spec.ts

@@ -0,0 +1,92 @@
+import { expect, test } from "bun:test";
+import { buildAgentForest, flattenForest, foldLayers } from "./agentTree.ts";
+import type { LayerNode } from "./agentTree.ts";
+import type { GlobalPidRecord } from "./globalPidIndex.ts";
+
+const mk = (pid: number, wrapper_pid: number, parent_pid?: number): GlobalPidRecord =>
+  ({ pid, wrapper_pid, parent_pid }) as GlobalPidRecord;
+
+const pidsOf = (recs: GlobalPidRecord[]) =>
+  flattenForest(buildAgentForest(recs))
+    .map((r) => r.record.pid)
+    .sort((a, b) => a - b);
+
+test("links child under parent via parent_pid === wrapper_pid", () => {
+  const rows = flattenForest(buildAgentForest([mk(1, 10), mk(2, 20, 10)]));
+  expect(rows.map((r) => r.record.pid)).toEqual([1, 2]);
+  expect(rows[1]!.depth).toBe(1); // child indented under root
+});
+
+test("orphan (parent not present) renders at top level, never vanishes", () => {
+  const rows = flattenForest(buildAgentForest([mk(1, 10), mk(2, 20, 10), mk(3, 30, 999)]));
+  expect(pidsOf([mk(1, 10), mk(2, 20, 10), mk(3, 30, 999)])).toEqual([1, 2, 3]);
+  expect(rows.find((r) => r.record.pid === 3)!.depth).toBe(0); // orphan is a root
+});
+
+// Regression: a parent_pid cycle (only via pid reuse across a reboot) used to
+// drop every node in the cycle, since none became a root — they'd disappear from
+// `ay ls` entirely. Each node must still render exactly once.
+test("2-node parent_pid cycle still renders both nodes", () => {
+  expect(pidsOf([mk(1, 10, 20), mk(2, 20, 10)])).toEqual([1, 2]);
+});
+
+test("3-node parent_pid cycle still renders all nodes", () => {
+  expect(pidsOf([mk(1, 10, 30), mk(2, 20, 10), mk(3, 30, 20)])).toEqual([1, 2, 3]);
+});
+
+test("self-parent is treated as a root, not dropped or self-nested", () => {
+  expect(pidsOf([mk(1, 10, 10)])).toEqual([1]);
+});
+
+// foldLayers: the VSCode-explorer-style collapse used by the console to nest
+// rooms > peers > agents and fold single-child chains onto one row.
+const ln = (label: string, children: LayerNode[] = []): LayerNode => ({
+  label,
+  kind: "node",
+  children,
+});
+
+test("foldLayers collapses a single-child chain onto one row", () => {
+  const rows = foldLayers([ln("a", [ln("b", [ln("c")])])]);
+  expect(rows).toHaveLength(1);
+  expect(rows[0]!.segments.map((s) => s.label)).toEqual(["a", "b", "c"]);
+  expect(rows[0]!.depth).toBe(0);
+  expect(rows[0]!.prefix).toBe("");
+});
+
+test("foldLayers branches a multi-child node into indented ├─/└─ rows", () => {
+  const rows = foldLayers([ln("root", [ln("x"), ln("y")])]);
+  expect(rows.map((r) => r.segments[0]!.label)).toEqual(["root", "x", "y"]);
+  expect(rows[0]!.depth).toBe(0);
+  expect(rows[1]!).toMatchObject({ depth: 1, prefix: "├─ " });
+  expect(rows[2]!).toMatchObject({ depth: 1, prefix: "└─ " }); // last child
+});
+
+test("foldLayers builds nested prefixes with both ancestor connectors", () => {
+  // root → {a (not last), b (last)}, each with two children, so depth-2 rows
+  // exercise both ancestor connectors: "│  " under a, "   " under the last child b.
+  const rows = foldLayers([
+    ln("root", [ln("a", [ln("a1"), ln("a2")]), ln("b", [ln("b1"), ln("b2")])]),
+  ]);
+  const at = (label: string) => rows.find((r) => r.segments[0]!.label === label)!;
+  expect(at("a1")).toMatchObject({ depth: 2, prefix: "│  ├─ " });
+  expect(at("a2").prefix).toBe("│  └─ ");
+  expect(at("b1").prefix).toBe("   ├─ ");
+  expect(at("b2").prefix).toBe("   └─ ");
+});
+
+test("foldLayers renders a node shared by two parents only once (visited guard)", () => {
+  // Diamond: root → {a, b}, both pointing at the same leaf c. The visited guard
+  // folds c into whichever branch reaches it first (a), so it isn't duplicated.
+  const c = ln("c");
+  const rows = foldLayers([ln("root", [ln("a", [c]), ln("b", [c])])]);
+  const labelsOf = (i: number) => rows[i]!.segments.map((s) => s.label);
+  expect(labelsOf(0)).toEqual(["root"]);
+  expect(labelsOf(1)).toEqual(["a", "c"]); // c folded into a's chain
+  expect(rows[1]!.prefix).toBe("├─ ");
+  expect(labelsOf(2)).toEqual(["b"]); // b's duplicate c is skipped, not re-rendered
+  expect(rows[2]!.prefix).toBe("└─ ");
+  expect(rows.flatMap((r) => r.segments.map((s) => s.label)).filter((l) => l === "c")).toHaveLength(
+    1,
+  );
+});

package/ts/agentYesHome.bun.spec.ts

@@ -0,0 +1,25 @@
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { homedir } from "os";
+import path from "path";
+import { agentYesHome } from "./agentYesHome.ts";
+
+describe("agentYesHome", () => {
+  let original: string | undefined;
+  beforeEach(() => {
+    original = process.env.AGENT_YES_HOME;
+  });
+  afterEach(() => {
+    if (original === undefined) delete process.env.AGENT_YES_HOME;
+    else process.env.AGENT_YES_HOME = original;
+  });
+
+  it("uses $AGENT_YES_HOME when set", () => {
+    process.env.AGENT_YES_HOME = "/custom/ay-home";
+    expect(agentYesHome()).toBe("/custom/ay-home");
+  });
+
+  it("falls back to ~/.agent-yes when unset", () => {
+    delete process.env.AGENT_YES_HOME;
+    expect(agentYesHome()).toBe(path.join(homedir(), ".agent-yes"));
+  });
+});