agenticreplay 0.1.0 → 0.1.2

package/packages/cli/src/upstream.ts

@@ -1,75 +0,0 @@
-import type { ParsedArgs } from './args.js';
-import { unusableOrigin } from '@agenticreplay/proxy';
-import { gatewayHeaders, readConfig, resolveUpstream, sameOrigin } from './config.js';
-
-/**
- * Where live model calls go, and what they carry.
- *
- * Needed by record *and* by replay: `--loose` and any fork continue live, and a fork that ignored
- * the override would quietly talk to the real provider instead of the gateway the user pointed it
- * at. Same precedence whichever command is running — flag, then environment, then the gateway from
- * `agenticreplay setup`.
- *
- * The headers are the half that makes `agenticreplay setup` worth having: a gateway needs a key, and this
- * is the only place one is attached. It goes on the *outbound* request only. What gets recorded is
- * built from the incoming request with auth stripped, so a key agenticreplay injects cannot reach a trace
- * by construction rather than by a rule someone has to remember.
- */
-export interface UpstreamPlan {
-  upstream: Record<string, string> | undefined;
-  headers: Record<string, string> | undefined;
-  /**
-   * The origin the headers belong to, when they belong to one.
-   *
-   * The gateway key is attached per request rather than to every outbound call, because a
-   * forwarded request can legitimately go somewhere the gateway is not — a `/forward/` path names
-   * its own destination, and sending the gateway's credential there hands a third party a key
-   * they were never meant to see, which is the one outcome this plan exists to make impossible.
-   */
-  headersOrigin: string | undefined;
-}
-
-export async function upstreamPlan(
-  args: ParsedArgs,
-  env: NodeJS.ProcessEnv = process.env,
-): Promise<UpstreamPlan> {
-  const config = await readConfig(env);
-  const upstream = await resolveUpstream(args, env);
-
-  // Refused here, because here is where all three sources meet: `--upstream-*`,
-  // `AGENTICREPLAY_UPSTREAM_*`, and the gateway from the config file. `agenticreplay setup` refuses one on the way
-  // in, but a config written before it did, a hand-edited one, an environment variable and a flag
-  // all still arrive unchecked — and on the record path an origin is not only sent, it is
-  // *printed*: `distinctOrigins` renders it on the recording line, and an origin `doFetch` cannot
-  // parse comes back inside undici's TypeError, which the proxy hands to the agent as a 500 body.
-  // Neither sink can be made safe by scrubbing alone, because `recordableOrigin` answers with a
-  // value for a scheme-less URL whose username parses as the protocol. Refusing closes both.
-  for (const [dialect, origin] of Object.entries(upstream ?? {})) {
-    const problem = unusableOrigin(origin);
-    if (problem === undefined) continue;
-    throw new Error(
-      `the upstream for ${dialect} is not an origin agenticreplay can use: ${problem}` +
-        '\n  give it as scheme, host and path: --upstream-openai https://gateway.example/v1' +
-        '\n  read in order: --upstream-*, then AGENTICREPLAY_UPSTREAM_*, then the gateway from agenticreplay setup',
-    );
-  }
-  const headers = gatewayHeaders(config, env);
-  // Unanimity, not `some`. `upstreamHeaders` are attached to every live call the proxy makes —
-  // there is no per-dialect header channel — so if any origin we might reach is not the gateway,
-  // attaching the key sends it there. A `.some()` check passed whenever *one* dialect still
-  // defaulted to the gateway, which is exactly what happens when a flag redirects the other: the
-  // gateway's credential went to api.anthropic.com. Verified against the built CLI.
-  //
-  // Erring towards withholding costs an unauthenticated request and a clear 401. Erring the other
-  // way hands a third party a key they were never meant to see, and nothing says it happened.
-  const origins = Object.values(upstream ?? {});
-  const goingToGateway =
-    config.gateway?.url !== undefined &&
-    origins.length > 0 &&
-    origins.every((origin) => sameOrigin(origin, config.gateway!.url));
-  return {
-    upstream,
-    headers: goingToGateway && Object.keys(headers).length > 0 ? headers : undefined,
-    headersOrigin: goingToGateway ? config.gateway!.url : undefined,
-  };
-}

package/packages/cli/src/version.ts

@@ -1,21 +0,0 @@
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-
-/**
- * Read from the manifest rather than restating it.
- *
- * This was a hardcoded constant, and `npm version --workspaces` does not touch source, so 0.2.0
- * shipped reporting 0.1.2 — from `--version`, from the MCP server's `serverInfo`, and into
- * `manifest.agenticreplay_version` on every trace it wrote. A recording that misreports the version that
- * produced it is a provenance bug, not a cosmetic one.
- *
- * `../package.json` resolves the same way in all three places this is loaded from:
- * `dist/version.js` in the published package, `dist/version.js` in the repo, and `src/version.ts`
- * under vitest — each is exactly one directory below `packages/cli/package.json`, and npm always
- * ships the manifest.
- */
-const manifest = fileURLToPath(new URL('../package.json', import.meta.url));
-
-export const AGENTICREPLAY_VERSION: string = (
-  JSON.parse(readFileSync(manifest, 'utf8')) as { version: string }
-).version;

package/packages/cli/test/agent-spans-drain.test.ts

@@ -1,157 +0,0 @@
-import { execFile } from 'node:child_process';
-import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { promisify } from 'node:util';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-
-/**
- * The third transport, through the drain that writes it.
- *
- * `agent-spans.jsonl` is appended to by every Python process the run starts, so what the reader
- * hands the drain is whatever survived several writers sharing one file. The drain then builds a
- * `Date` out of `started_at` and gives it to `TraceWriter.append` as `occurredAt` — and that runs
- * *after* `discardAgentSpanTransport` has taken the file away, deliberately, so a throw there is
- * not one lost span: it is the run ending with no `run.end`, `verifyIntegrity` calling it tampered
- * with, and every span the run recorded already deleted.
- *
- * Planted through `installAgentSpans` so it is the real `record` path that reads it, the same way
- * `shell-frames-drain.test.ts` does for the shim's frames.
- */
-const planted = vi.hoisted(() => ({ line: '' }));
-vi.mock('../src/agent-spans.js', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('../src/agent-spans.js')>();
-  return {
-    ...actual,
-    installAgentSpans: async (runDir: string) => {
-      const capture = await actual.installAgentSpans(runDir);
-      // After the install, so this is what the drain finds; the processor only ever appends.
-      if (planted.line !== '') await writeFile(capture.spansPath, `${planted.line}\n`, 'utf8');
-      return capture;
-    },
-  };
-});
-import { parseArgs } from '../src/args.js';
-import { recordCommand } from '../src/commands/record.js';
-import { Output } from '../src/out.js';
-
-interface Row {
-  type: string;
-  ts: string;
-  attrs?: Record<string, unknown>;
-}
-
-describe('a span line the drain cannot stamp', () => {
-  const exec = promisify(execFile);
-  let workspace: string;
-
-  beforeEach(async () => {
-    planted.line = '';
-    workspace = await mkdtemp(join(tmpdir(), 'agenticreplay-spans-drain-'));
-    await exec('git', ['init', '-q'], { cwd: workspace });
-    await exec('git', ['config', 'user.email', 'test@example.com'], { cwd: workspace });
-    await exec('git', ['config', 'user.name', 'Test'], { cwd: workspace });
-  });
-
-  afterEach(async () => {
-    await rm(workspace, { recursive: true, force: true });
-  });
-
-  /** One recorded run, and the events it wrote. */
-  async function record(): Promise<Row[]> {
-    const agent = join(workspace, 'agent.mjs');
-    await writeFile(agent, "console.log('GOT: done');\n");
-    const result = await recordCommand(
-      parseArgs(['record', 'generic-openai', '--', process.execPath, agent]),
-      new Output({ write: () => {}, isTTY: false }),
-      workspace,
-    );
-    const events = join(workspace, '.agenticreplay', 'runs', result.runId, 'events.jsonl');
-    return (await readFile(events, 'utf8'))
-      .split('\n')
-      .filter((line) => line.trim() !== '')
-      .map((line) => JSON.parse(line) as Row);
-  }
-
-  /**
-   * An instant a `date-time` cannot write down.
-   *
-   * `Date.parse` accepts far more than the schema's `ts` can express — it types `ts` as
-   * `date-time`, which admits a four-digit year and nothing else. `+275760-09-13T00:00:00+00:00`
-   * parses to 8640000000000000 and formats as `+275760-09-13T00:00:00.000Z`, which `assertEvent`
-   * rejects inside `TraceWriter.append`. The other two transports each bound this; this one did
-   * not, and the throw lands where the trace is being sealed.
-   */
-  it('does not take the run down with it, and the run is sealed', async () => {
-    planted.line = JSON.stringify({
-      kind: 'span',
-      type: 'HandoffSpanData',
-      span_id: 's1',
-      started_at: '+275760-09-13T00:00:00+00:00',
-      data: { from_agent: 'A', to_agent: 'B' },
-    });
-
-    const rows = await record();
-    expect(
-      rows.some((row) => row.type === 'run.end'),
-      'the run was left unsealed by one span it could not stamp',
-    ).toBe(true);
-  }, 60_000);
-
-  /** And one it can: the ordinary span still becomes an event, stamped from its own instant. */
-  it('keeps a span whose instant the trace can hold', async () => {
-    planted.line = JSON.stringify({
-      kind: 'span',
-      type: 'HandoffSpanData',
-      span_id: 's1',
-      started_at: '2026-09-12T00:00:00.000Z',
-      data: { from_agent: 'A', to_agent: 'B' },
-    });
-
-    const rows = await record();
-    const handoff = rows.find((row) => row.type === 'agent.handoff');
-    expect(handoff, 'the span never reached the trace').toBeDefined();
-    expect(handoff!.ts.startsWith('2026-09-12'), `stamped ${handoff!.ts}`).toBe(true);
-  }, 60_000);
-
-  /**
-   * A record that closes something carries `ended_at` and no `started_at`.
-   *
-   * Reading only `started_at` left every one of them stamped from the drain's own clock, which
-   * runs after the agent has exited. Measured on a three-node graph: all three `graph.node.end`
-   * events landed within a millisecond of each other, 600ms after the last node actually finished,
-   * so the first node appeared to close after the second had opened — a timeline saying the
-   * opposite of what happened, in the one layer whose entire purpose is ordering.
-   */
-  it('stamps a closing record from the instant it does carry', async () => {
-    planted.line = JSON.stringify({
-      kind: 'span',
-      type: 'LangGraphNodeEnd',
-      span_id: 'r1',
-      ended_at: '2026-09-12T00:00:00.000Z',
-      data: { node: 'validate', step: 2 },
-    });
-
-    const rows = await record();
-    const end = rows.find((row) => row.type === 'graph.node.end');
-    expect(end, 'the span never reached the trace').toBeDefined();
-    expect(end!.ts.startsWith('2026-09-12'), `stamped ${end!.ts}`).toBe(true);
-  }, 60_000);
-
-  /** And the bound has to cover that field too, or it is a hole the size of the one it closed. */
-  it('does not take the run down with an end it cannot stamp either', async () => {
-    planted.line = JSON.stringify({
-      kind: 'span',
-      type: 'LangGraphNodeEnd',
-      span_id: 'r1',
-      ended_at: '+275760-09-13T00:00:00+00:00',
-      data: { node: 'validate' },
-    });
-
-    const rows = await record();
-    expect(
-      rows.some((row) => row.type === 'run.end'),
-      'the run was left unsealed by one closing span it could not stamp',
-    ).toBe(true);
-  }, 60_000);
-});

package/packages/cli/test/agent-spans-race.test.ts

@@ -1,97 +0,0 @@
-import { existsSync } from 'node:fs';
-import { lstat, mkdir, mkdtemp, readFile, rename, rm, symlink, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterEach, describe, expect, it, vi } from 'vitest';
-
-const attack = vi.hoisted(() => ({
-  kind: '',
-  phase: 'acl',
-  target: '',
-  transport: '',
-  displaced: '',
-}));
-
-vi.mock('node:fs/promises', async (importOriginal) => {
-  const fs = await importOriginal<typeof import('node:fs/promises')>();
-  return {
-    ...fs,
-    writeFile: async (...args: Parameters<typeof fs.writeFile>) => {
-      const path = String(args[0]);
-      if (attack.kind && attack.phase === 'spans' && path.endsWith('agent-spans.jsonl')) {
-        attack.transport = path.slice(0, -'agent-spans.jsonl'.length - 1);
-        attack.displaced = `${attack.transport}.displaced`;
-        await fs.rename(attack.transport, attack.displaced);
-        await fs.symlink(attack.target, attack.transport, 'junction');
-        attack.kind = '';
-      }
-      return fs.writeFile(...args);
-    },
-  };
-});
-
-vi.mock('@agenticreplay/core', async (importOriginal) => {
-  const core = await importOriginal<typeof import('@agenticreplay/core')>();
-  return {
-    ...core,
-    restrictToOwner: async (path: string, mode: 0o600 | 0o700) => {
-      if (attack.kind && attack.phase === 'acl' && path.includes('agenticreplay-spans-')) {
-        attack.transport = path;
-        attack.displaced = `${path}.displaced`;
-        await rename(path, attack.displaced);
-        if (attack.kind === 'junction') await symlink(attack.target, path, 'junction');
-        else if (attack.kind === 'directory') await mkdir(path);
-        else throw new Error('injected ACL failure');
-      }
-      await core.restrictToOwner(path, mode);
-    },
-  };
-});
-
-const { installAgentSpans } = await import('../src/agent-spans.js');
-
-describe.runIf(process.platform === 'win32')('agent-span transport replacement', () => {
-  let root: string;
-
-  afterEach(async () => {
-    attack.kind = '';
-    attack.phase = 'acl';
-    // All targets are test-created children or the exact mkdtemp captured above. Never recurse
-    // through the injected junction; the attacker's marker must survive installation failure.
-    if (attack.transport && existsSync(attack.transport)) {
-      if ((await lstat(attack.transport)).isSymbolicLink()) await rm(attack.transport);
-      else await rm(attack.transport, { recursive: true, force: true });
-    }
-    if (attack.displaced) await rm(attack.displaced, { recursive: true, force: true });
-    if (root) await rm(root, { recursive: true, force: true });
-    attack.transport = '';
-    attack.displaced = '';
-  });
-
-  it.each(['junction', 'directory', 'missing'])(
-    'refuses a %s swapped in during ACL setup',
-    async (kind) => {
-      root = await mkdtemp(join(tmpdir(), 'agenticreplay-transport-race-'));
-      attack.target = join(root, 'attacker');
-      await mkdir(attack.target);
-      await writeFile(join(attack.target, 'keep'), 'attacker data');
-      attack.kind = kind;
-
-      await expect(installAgentSpans(root)).rejects.toThrow();
-      expect(existsSync(join(attack.target, 'agent-spans.jsonl'))).toBe(false);
-      expect(await readFile(join(attack.target, 'keep'), 'utf8')).toBe('attacker data');
-    },
-  );
-
-  it('refuses a directory replaced when the spans file is created after narrowing', async () => {
-    root = await mkdtemp(join(tmpdir(), 'agenticreplay-transport-race-'));
-    attack.target = join(root, 'attacker');
-    await mkdir(attack.target);
-    await writeFile(join(attack.target, 'keep'), 'attacker data');
-    attack.phase = 'spans';
-    attack.kind = 'junction';
-
-    await expect(installAgentSpans(root)).rejects.toThrow(/is a link|was replaced/);
-    expect(await readFile(join(attack.target, 'keep'), 'utf8')).toBe('attacker data');
-  });
-});