agenticreplay 0.1.0 → 0.1.2

package/packages/cli/test/pinned-fetch.test.ts

@@ -1,154 +0,0 @@
-import { readdir, readFile, stat } from 'node:fs/promises';
-import { join } from 'node:path';
-import { describe, expect, it } from 'vitest';
-
-/*
-EVERY REQUEST THAT CARRIES THE GATEWAY KEY IS PINNED TO THE HOST THE USER NAMED.
-
-`resolveGateway` decides whether the key may go to a host, and `fetch` then
-followed a `Location` anywhere — and undici strips `authorization` across
-origins but NOT `x-api-key`, which `gatewayHeaders` sets to the same key. One
-header from whoever answers for the gateway carried the credential to a host it
-was never issued for.
-
-The first fix pinned push and pull and left `probeModels` — the third request
-carrying the very same header pair, reached by `agenticreplay setup` and `agenticreplay models` —
-following redirects. That is the shape this fence exists for: the rule is about
-a CREDENTIAL, and a fix applied at the two call sites that were reported is a
-fix of the sites rather than of the rule.
-
-So the fence scans for a bare `fetch(` anywhere outside `fetchPinned` itself. It
-does not try to decide which calls carry the key — deciding that is exactly the
-judgement that was wrong the first time, and a request that does NOT carry the
-key loses nothing by being pinned.
-
-AND THE FIRST VERSION OF THIS FENCE WAS ITSELF TOO NARROW, TWICE OVER
-(orcacode-review). It walked `packages/cli/src` only, so the RECORDING PROXY —
-handed the same credential as `upstreamHeaders`, attaching it to both of its
-live call sites, on the path every `agenticreplay record` / `replay --loose` / `compare` /
-fork takes — was never looked at. And even under the wider scope it would have
-slipped through, because that call is an ALIAS: `const doFetch = options.fetchImpl ?? fetch`
-writes no bare `fetch(` for a scan to find.
-
-So the scope is now every package's `src`, and an alias assignment of the global
-`fetch` is treated as a raw fetch in its own right. A fence that only looks where
-the last bug was is not a fence.
-
-THE ONE EXEMPTION IS BOUND TO THE CALL'S SHAPE, NOT TO ITS FILE NAME.
-`refreshOpenCodeApiBases` cannot call `fetchPinned`: it is serialised with
-`.toString()` into the OpenCode plugin agenticreplay emits (see `opencode-capture.ts`),
-so an imported name would be a free variable in the generated module and throw
-at run time rather than pin anything. It is exempt because of what the call IS,
-not where it lives — a hard-coded public URL, `credentials: 'omit'`, and
-`redirect: 'error'`, which refuses a redirect outright rather than following it.
-EXEMPT_FETCHES asserts all three on the lines that follow the call, so the day
-that file grows a second fetch, or this one starts carrying a credential or
-following redirects, the fence reports it. Each entry must also still MATCH:
-an exemption that has stopped covering anything is a hole waiting for the next
-line to fall into, so it fails rather than sitting there looking satisfied.
-*/
-describe('gateway requests', () => {
-  async function tsFilesUnder(dir: string): Promise<string[]> {
-    const out: string[] = [];
-    for (const entry of await readdir(dir, { withFileTypes: true })) {
-      const path = join(dir, entry.name);
-      if (entry.isDirectory()) out.push(...(await tsFilesUnder(path)));
-      else if (entry.name.endsWith('.ts')) out.push(path);
-    }
-    return out;
-  }
-
-  it('are all pinned: no bare fetch( survives outside fetchPinned', async () => {
-    // EVERY package, not just this one: the credential travels to the proxy.
-    const packages = join(import.meta.dirname, '..', '..');
-    const files: string[] = [];
-    for (const pkg of await readdir(packages, { withFileTypes: true })) {
-      if (!pkg.isDirectory()) continue;
-      const src = join(packages, pkg.name, 'src');
-      if (!(await stat(src).catch(() => undefined))?.isDirectory()) continue;
-      files.push(...(await tsFilesUnder(src)));
-    }
-    expect(files.length, 'the scan found no sources, so it proves nothing').toBeGreaterThan(50);
-
-    // file -> why it may hold a raw fetch, and the shape that earns it.
-    // `requires` is checked against the call line and the few lines after it,
-    // which is where a fetch's init object is written.
-    const EXEMPT_FETCHES = [
-      {
-        file: join('adapters', 'src', 'opencode-catalog.ts'),
-        why: 'serialised into the emitted OpenCode plugin, so it cannot import fetchPinned',
-        requires: [
-          /https:\/\/models\.opencode\.ai\//,
-          /credentials:\s*'omit'/,
-          /redirect:\s*'error'/,
-        ],
-      },
-    ];
-    const exemptionUsed = new Map(EXEMPT_FETCHES.map((e) => [e.file, false]));
-
-    const offenders: string[] = [];
-    let sawDefinition = false;
-
-    for (const file of files) {
-      const src = await readFile(file, 'utf8');
-      const lines = src.split('\n');
-      // fetchPinned's own body holds the ONE raw fetch this codebase may have.
-      // Skipping it by name would also skip any other call on the same line, so
-      // the exemption is the function's SPAN: from its declaration to the next
-      // closing brace in column 0.
-      let insideFetchPinned = false;
-      for (const [i, line] of lines.entries()) {
-        if (/export async function fetchPinned/.test(line)) {
-          sawDefinition = true;
-          insideFetchPinned = true;
-          continue;
-        }
-        if (insideFetchPinned) {
-          if (/^\}/.test(line)) insideFetchPinned = false;
-          continue;
-        }
-        // Strip line comments and jsdoc bodies, so the prose EXPLAINING the
-        // rule is not reported as a violation of it.
-        const code = line.replace(/\/\/.*$/, '').replace(/^\s*\*.*$/, '');
-        // `fetch(` not preceded by an identifier character, so `prefetch(` and
-        // `fetchPinned(` do not match.
-        const called = /(^|[^A-Za-z0-9_.])fetch\s*\(/.test(code);
-        // AND AN ALIAS IS A CALL. `const doFetch = options.fetchImpl ?? fetch`
-        // is how the proxy escaped the first version of this fence: it binds
-        // the global and calls it under another name, so nothing matches
-        // `fetch(` at all. Any assignment whose right-hand side ENDS in the
-        // bare identifier `fetch` is the same thing.
-        const aliased = /(=|\?\?)\s*fetch\s*(;|,|\)|$)/.test(code);
-        if (called || aliased) {
-          const exempt = EXEMPT_FETCHES.find(
-            (e) =>
-              file.endsWith(e.file) &&
-              e.requires.every((re) => re.test(lines.slice(i, i + 6).join('\n'))),
-          );
-          if (exempt) {
-            exemptionUsed.set(exempt.file, true);
-            continue;
-          }
-          offenders.push(`${file}:${i + 1}: ${line.trim()}`);
-        }
-      }
-    }
-
-    // The scan must still be able to find the one legitimate raw fetch, or it
-    // has stopped looking at anything.
-    expect(sawDefinition, 'fetchPinned was not found; this scan is no longer anchored').toBe(true);
-
-    // An exemption that matches nothing is not harmless: it stays behind as a
-    // standing permission for whatever that file is rewritten into next.
-    for (const [file, used] of exemptionUsed) {
-      expect(used, `EXEMPT_FETCHES still lists ${file}, but nothing there matched it`).toBe(true);
-    }
-
-    expect(
-      offenders,
-      'every request that can carry the gateway key must go through fetchPinned, or a redirect ' +
-        'hands the key to whatever answers:\n' +
-        offenders.join('\n'),
-    ).toEqual([]);
-  });
-});

package/packages/cli/test/prompt-scrub.test.ts

@@ -1,132 +0,0 @@
-import { execFileSync } from 'node:child_process';
-import { readFileSync, readdirSync, statSync } from 'node:fs';
-import { join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { describe, expect, it } from 'vitest';
-
-/**
- * What must never be true of a committed capture.
- *
- * `capture/capture.mjs` scrubs a prompt before it is written, and the rules live in a script with
- * no tests of their own. Two of them have been wrong in ways that only a published file showed:
- * one consumed `Recent commits:` along with the status block it was meant to replace, and one
- * fired where there was nothing to replace and inserted a placeholder above the prompt's own
- * text. A third gap was simpler and lasted longer — the rules did not cover the branch and status
- * at all, so four committed artifacts recorded the branch that happened to be checked out and
- * every file that happened to be dirty, `claude-opus-5` listing fifteen of them.
- *
- * So this checks the outcome rather than the regexes: whatever the rules say, no artifact under
- * `prompt/` may carry the capture machine's working state. It is deliberately a repo-wide sweep,
- * because the thing that went wrong was not one bad capture but a rule that was missing while
- * captures kept being taken.
- */
-
-const REPO = fileURLToPath(new URL('../../../', import.meta.url));
-const PROMPTS = join(REPO, 'prompt');
-
-/**
- * Tracked files, which is what "committed" in the name of this suite means.
- *
- * Reading the directory instead swept in whatever a capture in progress had left lying there —
- * three of them the first time this ran, from a session working on other harnesses — and failed
- * on work nobody had offered for review yet. A capture becomes this suite's business when someone
- * stages it; until then it is a scratch file.
- */
-const tracked = new Set(
-  execFileSync('git', ['ls-files', 'prompt'], { cwd: REPO, encoding: 'utf8' })
-    .split('\n')
-    .map((l) => l.trim())
-    .filter((l) => l.endsWith('.md')),
-);
-
-const artifacts = readdirSync(PROMPTS)
-  .filter((d) => statSync(join(PROMPTS, d)).isDirectory())
-  .flatMap((d) =>
-    readdirSync(join(PROMPTS, d))
-      .filter((f) => f.endsWith('.md') && tracked.has(`prompt/${d}/${f}`))
-      .map((f) => [`${d}/${f}`, readFileSync(join(PROMPTS, d, f), 'utf8')] as const),
-  );
-
-describe('committed prompt artifacts', () => {
-  it('finds the artifacts at all', () => {
-    // A path that stops resolving would make every assertion below vacuously true.
-    expect(artifacts.length).toBeGreaterThan(20);
-  });
-
-  it.each(artifacts)('%s carries no branch name', (_name, text) => {
-    // `{{GIT_BRANCH}}` is fine; anything else is the branch someone had checked out.
-    expect(text.match(/^Current branch: (?!\{\{GIT_BRANCH\}\}$).*$/m)?.[0]).toBeUndefined();
-  });
-
-  it.each(artifacts)('%s carries no git status listing', (_name, text) => {
-    // A porcelain entry right after the heading: `(clean)`, or one or two status letters and a
-    // space. `{{GIT_STATUS}}` matches neither, which is the point.
-    expect(text.match(/^Status:\n(?:\(clean\)|[ MADRCU?!]{1,2} [^\n]*)$/m)?.[0]).toBeUndefined();
-  });
-
-  it.each(artifacts)('%s carries no per-project directory name', (_name, text) => {
-    // ZCode's is `<basename>-<16 hex of the absolute path>`, which makes the artifact a fact
-    // about the directory it was captured in and is below the `{{HEX}}` rule's floor of 32.
-    expect(
-      text.match(/[\\/]\.zcode[\\/]cli[\\/]memories[\\/]projects[\\/](?!\{\{)[^\\/\s"']+/)?.[0],
-    ).toBeUndefined();
-  });
-
-  it.each(artifacts)('%s carries no home directory or account id', (_name, text) => {
-    // The rules these cover are older and have their own history — a Crush capture shipped eight
-    // `<location>` lines of a real home path and two account uuids, because `pathRe` did not yet
-    // match a path written with forward slashes. Kept here so the whole set is swept at once.
-    //
-    // The home-path patterns require the path to continue into a config directory, and that is
-    // not fussiness: a harness prompt may legitimately talk about home directories, and two here
-    // do. Hermes explains Windows paths with `` `C:/Users/x`-style `` and Cursor's uses
-    // `/Users/me`. A pattern that stopped at the user name flagged both, which is a guard that
-    // teaches people to delete the guard. What a leak looks like is `C:/Users/<name>/.claude/…`
-    // or `…/AppData/…` — the name followed by something only a real home has.
-    for (const [what, re] of [
-      ['home path', /[A-Za-z]:[\\/]+Users[\\/]+[A-Za-z0-9_.-]+[\\/]+(?:\.[A-Za-z]|AppData)/],
-      ['posix home', /\/(?:home|Users)\/[a-z0-9_.-]+\/\.[a-z]/i],
-      ['uuid', /(?<![0-9a-f])[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i],
-      ['long hex', /(?<![0-9a-f])[0-9a-f]{32,}(?![0-9a-f])/i],
-      ['email', /[\w.+-]+@[\w-]+\.[\w.]{2,}/],
-      ['key-shaped value', /\bsk-[A-Za-z0-9_-]{16,}/],
-    ] as const) {
-      expect(text.match(re)?.[0], what).toBeUndefined();
-    }
-  });
-
-  it('would have caught the leaks these rules were written for', () => {
-    // A guard nobody has seen fail is a guard nobody knows works. These are the shapes that
-    // reached committed files before the rules existed, reduced to one line each — with the user
-    // name and the account id replaced, because a test that pins a leak by quoting it verbatim
-    // commits the leak. The patterns do not care which name it is.
-    const leaks = [
-      'Current branch: capture-opencode',
-      'Status:\n?? .venv/\n',
-      'Status:\nM capture/README.md\n',
-      'Status:\n(clean)\n',
-      'memory at `C:\\Users\\someone\\.zcode\\cli\\memories\\projects\\tmp-x-0123456789abcdef\\memory/`',
-      '<location>C:/Users/someone/.claude/skills/synced/00000000-1111-2222-3333-444444444444/x</location>',
-    ];
-    const checks = [
-      /^Current branch: (?!\{\{GIT_BRANCH\}\}$).*$/m,
-      /^Status:\n(?:\(clean\)|[ MADRCU?!]{1,2} [^\n]*)$/m,
-      /[\\/]\.zcode[\\/]cli[\\/]memories[\\/]projects[\\/](?!\{\{)[^\\/\s"']+/,
-      /[A-Za-z]:[\\/]+Users[\\/]+[A-Za-z0-9_.-]+[\\/]+(?:\.[A-Za-z]|AppData)/,
-      /(?<![0-9a-f])[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i,
-    ];
-    for (const leak of leaks) {
-      expect(
-        checks.some((re) => re.test(leak)),
-        leak.slice(0, 48),
-      ).toBe(true);
-    }
-    // And the two harness prompts that legitimately mention a home directory are not flagged.
-    for (const fine of ['Pass `C:/Users/x`-style forward-slash paths', 'e.g. /Users/me/project']) {
-      expect(
-        checks.some((re) => re.test(fine)),
-        fine,
-      ).toBe(false);
-    }
-  });
-});

package/packages/cli/test/publish-order.test.ts

@@ -1,87 +0,0 @@
-import { execFileSync } from 'node:child_process';
-import { readFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { describe, expect, it } from 'vitest';
-
-const repoRoot = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
-const script = join(repoRoot, 'scripts', 'publish-order.mjs');
-
-const order = (): string[] =>
-  execFileSync(process.execPath, [script], { cwd: repoRoot, encoding: 'utf8' }).trim().split('\n');
-
-const manifest = (
-  dir: string,
-): {
-  name: string;
-  version: string;
-  dependencies?: Record<string, string>;
-  repository?: { url?: string; directory?: string };
-} => JSON.parse(readFileSync(join(repoRoot, dir, 'package.json'), 'utf8'));
-
-/**
- * The release workflow publishes in this order and only ever runs on a tag, so a mistake here is
- * discovered at the worst possible moment — halfway through pushing irreversible versions to a
- * public registry.
- */
-describe('publish order', () => {
-  it('puts every package after all of its internal dependencies', () => {
-    const published = new Set<string>();
-    for (const dir of order()) {
-      const pkg = manifest(dir);
-      for (const dep of Object.keys(pkg.dependencies ?? {})) {
-        if (!dep.startsWith('@agenticreplay/')) continue;
-        expect(published, `${pkg.name} is published before its dependency ${dep}`).toContain(dep);
-      }
-      published.add(pkg.name);
-    }
-  });
-
-  it('includes every publishable workspace and no private one', () => {
-    const listed = order().map((d) => manifest(d).name);
-    expect(new Set(listed).size, 'a package listed twice would publish twice').toBe(listed.length);
-    expect(listed).toContain('agenticreplay');
-    expect(listed).toContain('@agenticreplay/core');
-    expect(listed).not.toContain('agenticreplay-monorepo');
-  });
-
-  /**
-   * `--provenance` refuses to sign a package whose `package.json` does not name the repository the
-   * build claims to come from, and the registry rejects the upload with a 422. Eleven of the twelve
-   * packages had no `repository` field at all, which nothing noticed until a tag was pushed and the
-   * release died on the first package — the exact moment this file exists to protect.
-   */
-  it('names the repository in every package, which provenance signing requires', () => {
-    const expected = 'https://github.com/askdkc/AgenticReplay.git';
-    for (const dir of order()) {
-      const pkg = manifest(dir);
-      expect(pkg.repository?.url, `${pkg.name} declares no repository.url`).toBe(expected);
-      // The directory too, so npm links at the package rather than the monorepo root. The
-      // script prints native separators; a `package.json` path is always forward slashes.
-      expect(pkg.repository?.directory, `${pkg.name} declares no repository.directory`).toBe(
-        dir.split(/[\\\\/]/).join('/'),
-      );
-    }
-  });
-
-  it('pins internal dependencies to an exact version, never a range', () => {
-    // `*` resolves to whatever is latest on the registry, so a 0.1.0 CLI would silently install a
-    // 0.9.0 core — and on a first publish it cannot resolve at all, because nothing exists yet.
-    for (const dir of order()) {
-      const pkg = manifest(dir);
-      for (const [dep, range] of Object.entries(pkg.dependencies ?? {})) {
-        if (!dep.startsWith('@agenticreplay/')) continue;
-        expect(range, `${pkg.name} depends on ${dep} as "${range}"`).toMatch(/^\d+\.\d+\.\d+$/);
-      }
-    }
-  });
-
-  it('fails loudly when two packages disagree about a version', () => {
-    // Exercised through the real script rather than a unit of it: the guard exists so a release
-    // cannot publish a CLI naming a core version that is not the one being published beside it.
-    const versions = new Set(order().map((d) => manifest(d).version));
-    expect(versions.size, `workspaces are on different versions: ${[...versions].join(', ')}`).toBe(
-      1,
-    );
-  });
-});