agenticreplay 0.1.0 → 0.1.2

package/packages/core/test/paths-permission-failure.test.ts

@@ -1,53 +0,0 @@
-import { mkdtemp } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-
-/**
- * The permission call refusing, which is a filesystem away rather than a bug.
- *
- * `mkdir`'s `mode` is a request: a filesystem without permissions ignores it and reports success.
- * `chmod` on that same filesystem fails — EPERM on vfat, ENOTSUP elsewhere — so a call that was
- * added for tidiness aborts whatever was going to be written. `ensureRunsDir` is the first thing
- * `record`, `attach`, `replay`, `pull` and `quickstart` all do, which makes it the worst place to
- * put one: an exFAT or vfat workspace that recorded before would stop recording at all.
- *
- * Mocked rather than staged on a real volume, because the machine this was written on has only
- * NTFS and CI only ext4 — the condition is not reachable by arranging a directory, only by
- * arranging the failure.
- */
-vi.mock('../src/private-files.js', async (importOriginal) => ({
-  ...(await importOriginal<typeof import('../src/private-files.js')>()),
-  restrictToOwner: vi
-    .fn()
-    .mockRejectedValue(
-      Object.assign(new Error('EPERM: operation not permitted, chmod'), { code: 'EPERM' }),
-    ),
-}));
-
-const { ensureRunsDir, runsDir } = await import('../src/paths.js');
-
-describe('ensureRunsDir when the permission call refuses', () => {
-  let cwd: string;
-  beforeEach(async () => {
-    cwd = await mkdtemp(join(tmpdir(), 'agenticreplay-perm-fail-'));
-  });
-
-  /**
-   * POSIX: the store is already what it should be. umask can only clear bits, so
-   * `mkdir(0o700)` has given at most 0700 and the call only restores what an exotic umask took
-   * away — worth losing on a filesystem that cannot answer. `sync.ts` swallows the same call in
-   * three places for the same reason.
-   */
-  it.runIf(process.platform !== 'win32')('records anyway, as it did before', async () => {
-    await expect(ensureRunsDir(cwd)).resolves.toBe(runsDir(cwd));
-  });
-
-  /**
-   * Windows: the mode was discarded and this call is the entire protection, so a refusal has to
-   * stop the recording rather than produce a store the machine can read.
-   */
-  it.runIf(process.platform === 'win32')('refuses, rather than recording unprotected', async () => {
-    await expect(ensureRunsDir(cwd)).rejects.toThrow(/not permitted/);
-  });
-});

package/packages/core/test/paths.test.ts

@@ -1,339 +0,0 @@
-import { execFile } from 'node:child_process';
-import { mkdir, mkdtemp, readdir, readFile, rm, utimes, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { promisify } from 'node:util';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import {
-  ensureRunsDir,
-  listRuns,
-  agenticreplayDir,
-  resolveRunSelector,
-  runDirFor,
-  runsDir,
-} from '../src/paths.js';
-import { TraceWriter } from '../src/writer.js';
-
-let cwd: string;
-
-beforeEach(async () => {
-  cwd = await mkdtemp(join(tmpdir(), 'agenticreplay-paths-'));
-});
-
-afterEach(async () => {
-  await rm(cwd, { recursive: true, force: true });
-});
-
-async function seedRun(runId: string, createdAt?: string): Promise<string> {
-  const dir = runDirFor(cwd, runId);
-  await mkdir(dir, { recursive: true });
-  if (createdAt !== undefined) {
-    await writeFile(
-      join(dir, 'manifest.json'),
-      JSON.stringify({ run_id: runId, created_at: createdAt }),
-    );
-  }
-  return dir;
-}
-
-describe('"last" after a replay', () => {
-  /**
-   * Since exact replay writes its own run, the newest run in a directory is usually a replay
-   * trace — which holds divergences and nothing else: no exchanges, no blobs, no filesystem store.
-   * Every command defaults to `last`, so that quietly redirected all of them.
-   *
-   * The sharpest case is `agenticreplay scrub last --match my-hostname`, which is the line in the README:
-   * it scrubbed the empty trace, found nothing, and printed "nothing matched — the trace is
-   * unchanged". A security tool telling you a trace is clean while the secret sits in the
-   * recording next to it.
-   *
-   * A fork stays eligible — it has exchanges and a worktree and is a thing you act on. A replay
-   * trace is a report about another run, so `last` skips it.
-   */
-  async function writeRun(dir: string, opts: { parentRun?: string; forkPoint?: number } = {}) {
-    const writer = await TraceWriter.create(join(dir, '.agenticreplay', 'runs'), {
-      adapter: { id: 'claude-code', version: '0.0.0' },
-      argv: ['claude-code'],
-      cwd: dir,
-      agenticreplayVersion: '0.0.0',
-      ...(opts.parentRun === undefined ? {} : { parentRun: opts.parentRun }),
-      ...(opts.forkPoint === undefined ? {} : { forkPoint: opts.forkPoint }),
-    });
-    await writer.close(0);
-    // `created_at` has second-ish resolution in the sort; make the order unambiguous.
-    await new Promise((r) => setTimeout(r, 5));
-    return writer.runId;
-  }
-
-  it('skips a replay trace and resolves the recording it describes', async () => {
-    const dir = await mkdtemp(join(tmpdir(), 'agenticreplay-last-'));
-    try {
-      const recording = await writeRun(dir);
-      const replay = await writeRun(dir, { parentRun: recording });
-      expect((await listRuns(dir))[0]!.runId, 'the replay is newest').toBe(replay);
-
-      expect((await resolveRunSelector(dir, 'last')).runId).toBe(recording);
-      // Naming it explicitly still works — it is a real run, just not the default one.
-      expect((await resolveRunSelector(dir, replay)).runId).toBe(replay);
-    } finally {
-      await rm(dir, { recursive: true, force: true });
-    }
-  });
-
-  it('still resolves a fork, which is a run you act on', async () => {
-    const dir = await mkdtemp(join(tmpdir(), 'agenticreplay-last-'));
-    try {
-      const recording = await writeRun(dir);
-      const fork = await writeRun(dir, { parentRun: recording, forkPoint: 4 });
-      expect((await resolveRunSelector(dir, 'last')).runId).toBe(fork);
-    } finally {
-      await rm(dir, { recursive: true, force: true });
-    }
-  });
-
-  it('falls back to a replay trace rather than failing when it is all there is', async () => {
-    const dir = await mkdtemp(join(tmpdir(), 'agenticreplay-last-'));
-    try {
-      const only = await writeRun(dir, { parentRun: 'run_000000000000' });
-      expect((await resolveRunSelector(dir, 'last')).runId).toBe(only);
-    } finally {
-      await rm(dir, { recursive: true, force: true });
-    }
-  });
-});
-
-describe('ensureRunsDir on a store that already exists', () => {
-  /**
-   * The Windows ACL was applied only when this call created `.agenticreplay/runs`, and `mkdir` returns
-   * undefined for a directory that already exists — so a store skipped once was skipped forever.
-   * That is every install predating the fix, and every store `agenticreplay quickstart` laid down.
-   *
-   * POSIX keeps create-only semantics: there the mode is not load-bearing (every file beneath gets
-   * its own 0600 from the writer) and a directory the user opened up deliberately is theirs.
-   */
-  it.runIf(process.platform === 'win32')(
-    'restricts a directory it did not create, because an inherited ACL is nobody’s choice',
-    async () => {
-      const dir = join(cwd, '.agenticreplay', 'runs');
-      await mkdir(dir, { recursive: true });
-      const icacls = join(process.env['SystemRoot']!, 'System32', 'icacls.exe');
-      const read = async (): Promise<string> => (await promisify(execFile)(icacls, [dir])).stdout;
-
-      expect(await read(), 'precondition: a hand-made store inherits').toContain('(I)');
-
-      await ensureRunsDir(cwd);
-
-      expect(await read()).not.toContain('(I)');
-    },
-  );
-});
-
-describe('ensureRunsDir and the directory the store stands in', () => {
-  /**
-   * The store's container, not only the store. Modify on `.agenticreplay` is enough to delete `runs` — a
-   * child's own DACL does not decide whether its parent may remove it — and leave a junction in
-   * its place, which needs no privilege on Windows. `mkdir(…, { recursive: true })` then accepts
-   * the junction as an existing directory, and `icacls` does not follow a reparse point: the
-   * narrowing lands on the junction while every trace is written through it into whatever it
-   * points at, under that directory's ACL, with `restrictToOwner` reporting success throughout.
-   */
-  it.runIf(process.platform === 'win32')(
-    'narrows the directory the store stands in, not only the store',
-    async () => {
-      await mkdir(join(cwd, '.agenticreplay', 'runs'), { recursive: true });
-      const icacls = join(process.env['SystemRoot']!, 'System32', 'icacls.exe');
-      const read = async (path: string): Promise<string> =>
-        (await promisify(execFile)(icacls, [path])).stdout;
-
-      expect(await read(join(cwd, '.agenticreplay')), 'precondition').toContain('(I)');
-
-      await ensureRunsDir(cwd);
-
-      for (const path of [join(cwd, '.agenticreplay'), join(cwd, '.agenticreplay', 'runs')]) {
-        expect(await read(path), path).not.toContain('(I)');
-      }
-    },
-  );
-
-  /**
-   * A link already in place, which narrowing the container does nothing about — and that is the
-   * population this exists for. `icacls` does not follow a reparse point, so the permissions
-   * would land on the link entry while the recording went through it into whatever it points at.
-   */
-  it.runIf(process.platform === 'win32')('refuses a store that is a link', async () => {
-    const elsewhere = join(cwd, 'elsewhere');
-    await mkdir(elsewhere);
-    await mkdir(join(cwd, '.agenticreplay'));
-    await promisify(execFile)('cmd.exe', [
-      '/d',
-      '/s',
-      '/c',
-      'mklink',
-      '/J',
-      join(cwd, '.agenticreplay', 'runs'),
-      elsewhere,
-    ]);
-
-    // `is a link`, not `is a link to <target>`: the check is `lstat` on the entry now, which
-    // answers whether this is a reparse point without resolving where it points. That is
-    // deliberate — `realpath` resolves, and a path that resolves elsewhere without being a link
-    // (a `subst` drive, a mapped drive, an 8.3 short name) was being refused as one.
-    await expect(ensureRunsDir(cwd)).rejects.toThrow(/is a link,/);
-  });
-
-  /**
-   * The container, which is the half the store's protection now rests on: it is created and
-   * narrowed *before* `runs` exists, so that nothing else can delete or replace what goes under
-   * it. A link standing there is refused before a single directory is made inside it.
-   */
-  it.runIf(process.platform === 'win32')(
-    'refuses a store whose container is a link, before making anything inside it',
-    async () => {
-      const elsewhere = join(cwd, 'elsewhere');
-      await mkdir(elsewhere);
-      await promisify(execFile)('cmd.exe', [
-        '/d',
-        '/s',
-        '/c',
-        'mklink',
-        '/J',
-        join(cwd, '.agenticreplay'),
-        elsewhere,
-      ]);
-
-      await expect(ensureRunsDir(cwd)).rejects.toThrow(/is a link,/);
-      // And nothing was written through it on the way to finding out.
-      expect(await readdir(elsewhere)).toEqual([]);
-    },
-  );
-});
-
-describe('path helpers', () => {
-  it('puts everything under .agenticreplay', () => {
-    expect(agenticreplayDir('/w')).toBe(join('/w', '.agenticreplay'));
-    expect(runsDir('/w')).toBe(join('/w', '.agenticreplay', 'runs'));
-    expect(runDirFor('/w', 'run_9f2c14')).toBe(join('/w', '.agenticreplay', 'runs', 'run_9f2c14'));
-  });
-
-  it('refuses a run id that does not match the spec pattern', () => {
-    expect(() => runDirFor('/w', '../../etc')).toThrow(/run id/i);
-    expect(() => runDirFor('/w', 'RUN_9F2C14')).toThrow(/run id/i);
-  });
-});
-
-describe('listRuns', () => {
-  it('returns nothing for a workspace that has never recorded', async () => {
-    expect(await listRuns(cwd)).toEqual([]);
-  });
-
-  it('lists runs newest first', async () => {
-    await seedRun('run_aaaaaa', '2026-08-01T00:00:00.000Z');
-    await seedRun('run_cccccc', '2026-08-29T00:00:00.000Z');
-    await seedRun('run_bbbbbb', '2026-08-15T00:00:00.000Z');
-    expect((await listRuns(cwd)).map((r) => r.runId)).toEqual([
-      'run_cccccc',
-      'run_bbbbbb',
-      'run_aaaaaa',
-    ]);
-  });
-
-  it('reports the directory alongside the id', async () => {
-    const dir = await seedRun('run_abc123', '2026-08-01T00:00:00.000Z');
-    const [run] = await listRuns(cwd);
-    expect(run?.dir).toBe(dir);
-    expect(run?.createdAt).toBe('2026-08-01T00:00:00.000Z');
-  });
-
-  it('ignores strays that are not runs', async () => {
-    await seedRun('run_abc123', '2026-08-01T00:00:00.000Z');
-    await mkdir(join(runsDir(cwd), 'not-a-run'), { recursive: true });
-    await writeFile(join(runsDir(cwd), 'README'), 'hi');
-    expect((await listRuns(cwd)).map((r) => r.runId)).toEqual(['run_abc123']);
-  });
-
-  it('falls back to the directory time when the manifest is missing or unreadable', async () => {
-    const dir = await seedRun('run_abc123');
-    await utimes(dir, new Date('2026-07-04T00:00:00.000Z'), new Date('2026-07-04T00:00:00.000Z'));
-    await seedRun('run_def456', 'not-a-date-at-all');
-    const runs = await listRuns(cwd);
-    expect(runs).toHaveLength(2);
-    expect(runs.find((r) => r.runId === 'run_abc123')?.createdAt).toBe('2026-07-04T00:00:00.000Z');
-  });
-});
-
-describe('resolveRunSelector', () => {
-  it('resolves "last" to the newest run', async () => {
-    await seedRun('run_aaaaaa', '2026-08-01T00:00:00.000Z');
-    const newest = await seedRun('run_bbbbbb', '2026-08-29T00:00:00.000Z');
-    const run = await resolveRunSelector(cwd, 'last');
-    expect(run.runId).toBe('run_bbbbbb');
-    expect(run.dir).toBe(newest);
-  });
-
-  it('resolves anything else as a run id', async () => {
-    const dir = await seedRun('run_aaaaaa', '2026-08-01T00:00:00.000Z');
-    await seedRun('run_bbbbbb', '2026-08-29T00:00:00.000Z');
-    const run = await resolveRunSelector(cwd, 'run_aaaaaa');
-    expect(run.runId).toBe('run_aaaaaa');
-    expect(run.dir).toBe(dir);
-    expect(run.createdAt).toBe('2026-08-01T00:00:00.000Z');
-  });
-
-  it('names the command to run when the workspace has no runs', async () => {
-    await expect(resolveRunSelector(cwd, 'last')).rejects.toThrow(/agenticreplay record/);
-  });
-
-  it('names the missing run and how to list runs', async () => {
-    await seedRun('run_aaaaaa', '2026-08-01T00:00:00.000Z');
-    await expect(resolveRunSelector(cwd, 'run_beef99')).rejects.toThrow(/run_beef99/);
-    await expect(resolveRunSelector(cwd, 'run_beef99')).rejects.toThrow(/agenticreplay list/);
-  });
-
-  it('rejects a selector that is not a run id at all', async () => {
-    await seedRun('run_aaaaaa', '2026-08-01T00:00:00.000Z');
-    await expect(resolveRunSelector(cwd, '../../etc/passwd')).rejects.toThrow(/run id/i);
-  });
-});
-
-describe('ensureRunsDir', () => {
-  it('makes the trace store ignore itself, so a recording cannot be committed by accident', async () => {
-    // A trace is the conversation the model saw — your source — plus shell output, a snapshot of
-    // the whole workspace and an environment allowlist. It was landing in `git status` as an
-    // untracked directory, one `git add -A` away from being pushed, in the repo it just recorded.
-    const cwd = await mkdtemp(join(tmpdir(), 'agenticreplay-ignore-'));
-    try {
-      const dir = await ensureRunsDir(cwd);
-      expect(dir).toBe(join(cwd, '.agenticreplay', 'runs'));
-      const ignore = await readFile(join(cwd, '.agenticreplay', '.gitignore'), 'utf8');
-      // `*` is git's own idiom for a directory that excludes itself: no edit to the user's
-      // .gitignore, and it works in a repo agenticreplay has never seen before.
-      expect(ignore.split('\n')).toContain('*');
-    } finally {
-      await rm(cwd, { recursive: true, force: true });
-    }
-  });
-
-  it('never rewrites one the user changed, so opting back in sticks', async () => {
-    const cwd = await mkdtemp(join(tmpdir(), 'agenticreplay-ignore-'));
-    try {
-      await ensureRunsDir(cwd);
-      // Someone who deliberately wants their traces tracked empties this. AgenticReplay must not undo that
-      // on the next recording.
-      await writeFile(join(cwd, '.agenticreplay', '.gitignore'), '', { mode: 0o600 });
-      await ensureRunsDir(cwd);
-      expect(await readFile(join(cwd, '.agenticreplay', '.gitignore'), 'utf8')).toBe('');
-    } finally {
-      await rm(cwd, { recursive: true, force: true });
-    }
-  });
-
-  it('is safe to call repeatedly', async () => {
-    const cwd = await mkdtemp(join(tmpdir(), 'agenticreplay-ignore-'));
-    try {
-      await expect(ensureRunsDir(cwd)).resolves.toBeDefined();
-      await expect(ensureRunsDir(cwd)).resolves.toBeDefined();
-    } finally {
-      await rm(cwd, { recursive: true, force: true });
-    }
-  });
-});

package/packages/core/test/private-files-owner.test.ts

@@ -1,77 +0,0 @@
-import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterEach, describe, expect, it, vi } from 'vitest';
-
-const probe = vi.hoisted(() => ({ owner: '', writes: 0, sid: '' }));
-vi.mock('node:child_process', async (importOriginal) => {
-  const real = await importOriginal<typeof import('node:child_process')>();
-  const { promisify } = await import('node:util');
-  const execFile = (...args: Parameters<typeof real.execFile>) => real.execFile(...args);
-  Object.defineProperty(execFile, promisify.custom, {
-    value: async (exe: string, argv: string[], options: object = {}) => {
-      if (exe.endsWith('powershell.exe')) return { stdout: probe.owner, stderr: '' };
-      if (argv.includes('/grant:r')) probe.writes++;
-      const result = await promisify(real.execFile)(exe, argv, options);
-      if (probe.sid && argv.includes('/save')) {
-        const { readFile, writeFile } = await import('node:fs/promises');
-        const saved = argv[argv.indexOf('/save') + 1]!;
-        await writeFile(
-          saved,
-          (await readFile(saved, 'utf16le')).replaceAll(probe.sid, 'LA'),
-          'utf16le',
-        );
-      }
-      return result;
-    },
-  });
-  return {
-    ...real,
-    execFile,
-  };
-});
-
-const { restrictToOwner } = await import('../src/private-files.js');
-
-describe.runIf(process.platform === 'win32')('private file ownership', () => {
-  let dir: string;
-  afterEach(async () => {
-    probe.sid = '';
-    if (dir) await rm(dir, { recursive: true, force: true });
-  });
-
-  // A foreign owner can retain WRITE_DAC even when it has no ACE. Inject only the OS owner
-  // response: the real filesystem, SID lookup and icacls calls remain in use, with no account
-  // creation or privileged ownership changes needed on the developer's machine.
-  it.each(['S-1-5-21-111-222-333-444', '', 'not a SID'])(
-    'refuses owner %j before changing permissions',
-    async (owner) => {
-      dir = await mkdtemp(join(tmpdir(), 'agenticreplay-owner-test-'));
-      const file = join(dir, 'secret');
-      await writeFile(file, 'previous contents');
-      probe.owner = owner;
-      probe.writes = 0;
-      await expect(restrictToOwner(file, 0o600)).rejects.toThrow(/untrusted owner/);
-      expect(probe.writes).toBe(0);
-      expect(await readFile(file, 'utf8')).toBe('previous contents');
-    },
-  );
-
-  it('accepts the current account spelling supplied by Windows instead of guessing aliases', async () => {
-    const { execFile } =
-      await vi.importActual<typeof import('node:child_process')>('node:child_process');
-    const { promisify } = await import('node:util');
-    const { stdout } = await promisify(execFile)(
-      join(process.env['SystemRoot']!, 'System32', 'whoami.exe'),
-      ['/user', '/fo', 'csv', '/nh'],
-    );
-    probe.sid = /S-1-[\d-]+/.exec(stdout)![0];
-    probe.owner = `${probe.sid}\nD:(A;;FA;;;LA)`;
-    dir = await mkdtemp(join(tmpdir(), 'agenticreplay-owner-alias-'));
-    const file = join(dir, 'secret');
-    await writeFile(file, 'previous contents');
-    await expect(restrictToOwner(file, 0o600)).resolves.toBeUndefined();
-    await expect(restrictToOwner(file, 0o600)).resolves.toBeUndefined();
-    expect(await readFile(file, 'utf8')).toBe('previous contents');
-  });
-});

package/packages/core/test/private-files-scratch-race.test.ts

@@ -1,62 +0,0 @@
-import { execFile } from 'node:child_process';
-import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { promisify } from 'node:util';
-import { afterEach, describe, expect, it, vi } from 'vitest';
-
-const attack = vi.hoisted(() => ({ enabled: false, path: '', displaced: '' }));
-vi.mock('node:fs/promises', async (importOriginal) => {
-  const fs = await importOriginal<typeof import('node:fs/promises')>();
-  return {
-    ...fs,
-    writeFile: async (...args: Parameters<typeof fs.writeFile>) => {
-      if (attack.enabled && String(args[0]).endsWith('in-use')) {
-        attack.enabled = false;
-        attack.path = dirname(String(args[0]));
-        attack.displaced = `${attack.path}.displaced`;
-        await fs.rename(attack.path, attack.displaced);
-        await fs.mkdir(attack.path);
-        // Same valid DACL, different directory: the ACL read-back cannot detect this swap.
-        const run = promisify(execFile);
-        const sys = join(process.env['SystemRoot']!, 'System32');
-        const { stdout } = await run(join(sys, 'whoami.exe'), ['/user', '/fo', 'csv', '/nh']);
-        const sid = /S-1-[\d-]+/.exec(stdout)![0];
-        await run(join(sys, 'icacls.exe'), [
-          attack.path,
-          '/inheritance:r',
-          '/grant:r',
-          `*${sid}:(OI)(CI)(F)`,
-          '*S-1-5-18:(OI)(CI)(F)',
-          '*S-1-5-32-544:(OI)(CI)(F)',
-          '/q',
-        ]);
-        await fs.writeFile(join(attack.path, 'keep'), 'replacement data');
-      }
-      return fs.writeFile(...args);
-    },
-  };
-});
-
-const { restrictToOwner } = await import('../src/private-files.js');
-
-describe.runIf(process.platform === 'win32')('ACL scratch replacement', () => {
-  let root: string;
-  afterEach(async () => {
-    attack.enabled = false;
-    for (const path of [root, attack.path, attack.displaced]) {
-      // Each is an exact directory created by this test; no untrusted recursive traversal.
-      if (path) await rm(path, { recursive: true, force: true });
-    }
-  });
-
-  it('rechecks identity after the sentinel write before trusting any saved descriptor', async () => {
-    root = await mkdtemp(join(tmpdir(), 'agenticreplay-scratch-race-'));
-    const file = join(root, 'secret');
-    await writeFile(file, 'original contents');
-    attack.enabled = true;
-    await expect(restrictToOwner(file, 0o600)).rejects.toThrow(/was replaced/);
-    expect(await readFile(file, 'utf8')).toBe('original contents');
-    expect(await readFile(join(attack.path, 'keep'), 'utf8')).toBe('replacement data');
-  });
-});