aios-core 4.2.14 → 4.3.0

package/packages/installer/tests/unit/entity-registry-bootstrap.test.js

@@ -0,0 +1,186 @@
+'use strict';
+
+/**
+ * Entity Registry Bootstrap Tests (Story INS-4.6)
+ *
+ * Validates that the installer calls populate-entity-registry.js during install,
+ * handles failures gracefully, and that aios doctor can verify the registry.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const WIZARD_PATH = path.join(__dirname, '..', '..', 'src', 'wizard', 'index.js');
+const POPULATE_SCRIPT = path.join(
+  __dirname, '..', '..', '..', '..', '.aios-core', 'development', 'scripts', 'populate-entity-registry.js'
+);
+const DOCTOR_CHECK = path.join(
+  __dirname, '..', '..', '..', '..', '.aios-core', 'core', 'doctor', 'checks', 'entity-registry.js'
+);
+const REGISTRY_PATH = path.join(
+  __dirname, '..', '..', '..', '..', '.aios-core', 'data', 'entity-registry.yaml'
+);
+const PRE_PUSH_HOOK = path.join(__dirname, '..', '..', '..', '..', '.husky', 'pre-push');
+const IDS_PRE_PUSH = path.join(
+  __dirname, '..', '..', '..', '..', '.aios-core', 'hooks', 'ids-pre-push.js'
+);
+
+describe('Entity Registry Bootstrap (Story INS-4.6)', () => {
+  let wizardSource;
+
+  beforeAll(() => {
+    wizardSource = fs.readFileSync(WIZARD_PATH, 'utf8');
+  });
+
+  describe('AC1: Bootstrap called during install', () => {
+    test('wizard calls populate-entity-registry.js', () => {
+      expect(wizardSource).toContain('populate-entity-registry.js');
+      expect(wizardSource).toContain('Bootstrapping entity registry');
+    });
+
+    test('bootstrap runs after .aios-core/ copy (injection order)', () => {
+      const aiosCoreIdx = wizardSource.indexOf('AIOS core installed');
+      const bootstrapIdx = wizardSource.indexOf('Bootstrapping entity registry');
+      const envConfigIdx = wizardSource.indexOf('Configuring environment');
+
+      // Bootstrap must come after aios-core install
+      expect(bootstrapIdx).toBeGreaterThan(aiosCoreIdx);
+      // Bootstrap must come before environment configuration
+      expect(bootstrapIdx).toBeLessThan(envConfigIdx);
+    });
+
+    test('bootstrap has try/catch — failure does not abort install', () => {
+      // Verify the bootstrap block is wrapped in try/catch
+      expect(wizardSource).toContain("answers.entityRegistryStatus = 'failed'");
+      expect(wizardSource).toContain('Entity registry bootstrap failed');
+      // Should warn, not throw
+      expect(wizardSource).toContain("run 'aios doctor' post-install");
+    });
+
+    test('bootstrap uses 30s timeout guard', () => {
+      expect(wizardSource).toContain('timeout: 30000');
+    });
+
+    test('bootstrap reports entity count on success', () => {
+      expect(wizardSource).toContain("answers.entityRegistryStatus = 'populated'");
+      expect(wizardSource).toContain('answers.entityRegistryCount');
+      expect(wizardSource).toContain('answers.entityRegistryMs');
+    });
+
+    test('bootstrap handles missing script gracefully', () => {
+      expect(wizardSource).toContain("answers.entityRegistryStatus = 'skipped'");
+      expect(wizardSource).toContain('Entity registry script not found');
+    });
+  });
+
+  describe('AC2: Sanity check (relative threshold)', () => {
+    test('aios doctor entity-registry check exists', () => {
+      expect(fs.existsSync(DOCTOR_CHECK)).toBe(true);
+    });
+
+    test('doctor check uses relative validation (file exists + non-empty), not fixed threshold', () => {
+      const checkSource = fs.readFileSync(DOCTOR_CHECK, 'utf8');
+
+      // Should check file existence
+      expect(checkSource).toContain('existsSync');
+      // Should NOT have hardcoded threshold like >= 500
+      expect(checkSource).not.toMatch(/>= ?\d{3}/);
+      // Should report line count (relative measure)
+      expect(checkSource).toContain('lineCount');
+    });
+
+    test('doctor check validates recency (mtime)', () => {
+      const checkSource = fs.readFileSync(DOCTOR_CHECK, 'utf8');
+      expect(checkSource).toContain('mtimeMs');
+      expect(checkSource).toContain('MAX_AGE_MS');
+    });
+  });
+
+  describe('AC3: No duplication with pre-push hook', () => {
+    test('pre-push hook calls ids-pre-push.js (incremental), not populate script', () => {
+      const hookContent = fs.readFileSync(PRE_PUSH_HOOK, 'utf8');
+      expect(hookContent).toContain('ids-pre-push.js');
+      expect(hookContent).not.toContain('populate-entity-registry.js');
+    });
+
+    test('ids-pre-push.js uses RegistryUpdater.processChanges (incremental)', () => {
+      const idsSource = fs.readFileSync(IDS_PRE_PUSH, 'utf8');
+      expect(idsSource).toContain('RegistryUpdater');
+      expect(idsSource).toContain('processChanges');
+    });
+
+    test('bootstrap uses populate-entity-registry.js (full scan), distinct from incremental', () => {
+      // Wizard calls populate-entity-registry.js
+      expect(wizardSource).toContain('populate-entity-registry.js');
+      // Wizard does NOT call ids-pre-push.js
+      expect(wizardSource).not.toContain('ids-pre-push.js');
+    });
+  });
+
+  describe('AC4: Performance guard', () => {
+    test('populate-entity-registry.js exists and is executable', () => {
+      expect(fs.existsSync(POPULATE_SCRIPT)).toBe(true);
+    });
+
+    test('populate script has programmatic API (module.exports)', () => {
+      const scriptSource = fs.readFileSync(POPULATE_SCRIPT, 'utf8');
+      expect(scriptSource).toContain('module.exports');
+      expect(scriptSource).toContain('populate');
+    });
+
+    test('measured runtime is well under 15s threshold', () => {
+      // Run the actual script and measure time
+      const { execSync } = require('child_process');
+      const projectRoot = path.join(__dirname, '..', '..', '..', '..');
+      const start = Date.now();
+
+      try {
+        execSync(`node "${POPULATE_SCRIPT}"`, {
+          cwd: projectRoot,
+          encoding: 'utf8',
+          timeout: 30000,
+          stdio: 'pipe',
+        });
+      } catch {
+        // Script may fail in some environments — that's ok for timing test
+        console.log('SKIP: populate script execution failed — timing not measured');
+        return;
+      }
+
+      const elapsed = Date.now() - start;
+      // Must be under 15s (AC4 threshold)
+      expect(elapsed).toBeLessThan(15000);
+      console.log(`Measured runtime: ${(elapsed / 1000).toFixed(2)}s`);
+    });
+  });
+
+  describe('AC5: Post-bootstrap verification', () => {
+    test('entity-registry.yaml exists after bootstrap', () => {
+      expect(fs.existsSync(REGISTRY_PATH)).toBe(true);
+    });
+
+    test('entity-registry.yaml has at least 1 entity (non-empty)', () => {
+      const content = fs.readFileSync(REGISTRY_PATH, 'utf8');
+      const match = content.match(/entityCount:\s*(\d+)/);
+      expect(match).not.toBeNull();
+      const count = parseInt(match[1], 10);
+      expect(count).toBeGreaterThan(0);
+    });
+
+    // NOTE: This test depends on AC4 "measured runtime" test running first,
+    // which executes populate-entity-registry.js and refreshes the file mtime.
+    test('entity-registry.yaml updatedAt is recent (within 5 minutes)', () => {
+      const stat = fs.statSync(REGISTRY_PATH);
+      const ageMs = Date.now() - stat.mtimeMs;
+      const FIVE_MINUTES = 5 * 60 * 1000;
+      expect(ageMs).toBeLessThan(FIVE_MINUTES);
+    });
+
+    test('aios doctor entity-registry check passes on current registry', async () => {
+      const { run } = require(DOCTOR_CHECK);
+      const projectRoot = path.join(__dirname, '..', '..', '..', '..');
+      const result = await run({ projectRoot });
+      expect(result.status).toBe('PASS');
+    });
+  });
+});

package/packages/installer/tests/unit/generate-settings-json/generate-settings-json.test.js

@@ -0,0 +1,309 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+const {
+  generate,
+  validateBoundaryPath,
+  readBoundaryConfig,
+  expandProtectedPaths,
+  expandExceptionPaths,
+  generatePermissions,
+  writeSettingsJson,
+} = require('../../../../../.aios-core/infrastructure/scripts/generate-settings-json');
+
+function createTempProject(boundary, existingSettings) {
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gen-settings-'));
+
+  // Create core-config.yaml with boundary section
+  const aiosCoreDir = path.join(tmpDir, '.aios-core');
+  fs.mkdirSync(aiosCoreDir, { recursive: true });
+
+  const yamlContent = [
+    'boundary:',
+    `  frameworkProtection: ${boundary.frameworkProtection}`,
+    '  protected:',
+    ...boundary.protected.map(p => `    - ${p}`),
+    '  exceptions:',
+    ...boundary.exceptions.map(p => `    - ${p}`),
+  ].join('\n') + '\n';
+
+  fs.writeFileSync(path.join(tmpDir, '.aios-core', 'core-config.yaml'), yamlContent, 'utf8');
+
+  // Create directory structure for expansion tests
+  if (boundary.protected.includes('.aios-core/core/**')) {
+    const coreDir = path.join(tmpDir, '.aios-core', 'core');
+    fs.mkdirSync(coreDir, { recursive: true });
+    fs.mkdirSync(path.join(coreDir, 'utils'), { recursive: true });
+    fs.mkdirSync(path.join(coreDir, 'events'), { recursive: true });
+    fs.writeFileSync(path.join(coreDir, 'index.js'), '', 'utf8');
+  }
+
+  // Create .claude directory and optionally existing settings
+  const claudeDir = path.join(tmpDir, '.claude');
+  fs.mkdirSync(claudeDir, { recursive: true });
+
+  if (existingSettings) {
+    fs.writeFileSync(
+      path.join(claudeDir, 'settings.json'),
+      JSON.stringify(existingSettings, null, 2) + '\n',
+      'utf8'
+    );
+  }
+
+  return tmpDir;
+}
+
+function cleanupTempProject(tmpDir) {
+  fs.rmSync(tmpDir, { recursive: true, force: true });
+}
+
+describe('generate-settings-json', () => {
+  describe('readBoundaryConfig', () => {
+    test('reads boundary config from core-config.yaml', () => {
+      const tmpDir = createTempProject({
+        frameworkProtection: true,
+        protected: ['.aios-core/core/**', 'bin/aios.js'],
+        exceptions: ['.aios-core/data/**'],
+      });
+
+      try {
+        const config = readBoundaryConfig(tmpDir);
+
+        expect(config.frameworkProtection).toBe(true);
+        expect(config.protected).toContain('.aios-core/core/**');
+        expect(config.protected).toContain('bin/aios.js');
+        expect(config.exceptions).toContain('.aios-core/data/**');
+      } finally {
+        cleanupTempProject(tmpDir);
+      }
+    });
+
+    test('throws when core-config.yaml not found', () => {
+      expect(() => readBoundaryConfig('/nonexistent/path')).toThrow('core-config.yaml not found');
+    });
+
+    test('rejects path traversal in protected paths', () => {
+      const tmpDir = createTempProject({
+        frameworkProtection: true,
+        protected: ['../../etc/passwd'],
+        exceptions: [],
+      });
+
+      try {
+        expect(() => readBoundaryConfig(tmpDir)).toThrow('Path traversal detected');
+      } finally {
+        cleanupTempProject(tmpDir);
+      }
+    });
+
+    test('rejects absolute paths in boundary config', () => {
+      const tmpDir = createTempProject({
+        frameworkProtection: true,
+        protected: ['/etc/passwd'],
+        exceptions: [],
+      });
+
+      try {
+        expect(() => readBoundaryConfig(tmpDir)).toThrow('Absolute path not allowed');
+      } finally {
+        cleanupTempProject(tmpDir);
+      }
+    });
+  });
+
+  describe('generatePermissions — frameworkProtection: true', () => {
+    test('generates deny rules covering all protected paths', () => {
+      const tmpDir = createTempProject({
+        frameworkProtection: true,
+        protected: ['.aios-core/core/**', '.aios-core/infrastructure/**', 'bin/aios.js'],
+        exceptions: ['.aios-core/data/**'],
+      });
+
+      // Create infrastructure dir (no expansion for non-core paths)
+      fs.mkdirSync(path.join(tmpDir, '.aios-core', 'infrastructure'), { recursive: true });
+
+      try {
+        const boundary = readBoundaryConfig(tmpDir);
+        const permissions = generatePermissions(boundary, tmpDir);
+
+        // Should have deny rules for core subdirs (events/**, utils/**, index.js) + infrastructure/** + bin/aios.js
+        expect(permissions.deny.length).toBeGreaterThan(0);
+
+        // Core expansion: events/**, utils/**, index.js → 6 deny rules (3 paths x 2 tools)
+        expect(permissions.deny).toContain('Edit(.aios-core/core/events/**)');
+        expect(permissions.deny).toContain('Write(.aios-core/core/events/**)');
+        expect(permissions.deny).toContain('Edit(.aios-core/core/utils/**)');
+        expect(permissions.deny).toContain('Write(.aios-core/core/utils/**)');
+        expect(permissions.deny).toContain('Edit(.aios-core/core/index.js)');
+        expect(permissions.deny).toContain('Write(.aios-core/core/index.js)');
+
+        // Non-core paths stay as globs
+        expect(permissions.deny).toContain('Edit(.aios-core/infrastructure/**)');
+        expect(permissions.deny).toContain('Write(.aios-core/infrastructure/**)');
+        expect(permissions.deny).toContain('Edit(bin/aios.js)');
+        expect(permissions.deny).toContain('Write(bin/aios.js)');
+
+        // Allow rules from exceptions
+        expect(permissions.allow).toContain('Edit(.aios-core/data/**)');
+        expect(permissions.allow).toContain('Write(.aios-core/data/**)');
+        expect(permissions.allow).toContain('Read(.aios-core/**)');
+      } finally {
+        cleanupTempProject(tmpDir);
+      }
+    });
+
+    test('all 9 protected paths from core-config produce deny rules', () => {
+      const projectRoot = path.resolve(__dirname, '../../../../..');
+      const boundary = readBoundaryConfig(projectRoot);
+      // Force frameworkProtection: true for this test (core-config may have it disabled for contributor mode)
+      boundary.frameworkProtection = true;
+      const permissions = generatePermissions(boundary, projectRoot);
+
+      // Verify all 9 config paths are covered
+      const protectedRoots = [
+        '.aios-core/core/',
+        '.aios-core/development/tasks/',
+        '.aios-core/development/templates/',
+        '.aios-core/development/checklists/',
+        '.aios-core/development/workflows/',
+        '.aios-core/infrastructure/',
+        '.aios-core/constitution.md',
+        'bin/aios.js',
+        'bin/aios-init.js',
+      ];
+
+      for (const root of protectedRoots) {
+        const hasDenyRule = permissions.deny.some(r => r.includes(root));
+        expect(hasDenyRule).toBe(true);
+      }
+
+      // Verify deny rules use only Edit and Write (no MultiEdit)
+      for (const rule of permissions.deny) {
+        expect(rule).toMatch(/^(Edit|Write)\(/);
+      }
+    });
+  });
+
+  describe('generatePermissions — frameworkProtection: false', () => {
+    test('produces no boundary deny rules', () => {
+      const boundary = {
+        frameworkProtection: false,
+        protected: ['.aios-core/core/**', '.aios-core/infrastructure/**'],
+        exceptions: ['.aios-core/data/**'],
+      };
+
+      const permissions = generatePermissions(boundary, '/tmp');
+
+      expect(permissions.deny).toEqual([]);
+      expect(permissions.allow).toEqual([]);
+    });
+  });
+
+  describe('idempotency', () => {
+    test('running generator twice produces identical output', () => {
+      const tmpDir = createTempProject({
+        frameworkProtection: true,
+        protected: ['.aios-core/core/**', 'bin/aios.js'],
+        exceptions: ['.aios-core/data/**'],
+      });
+
+      try {
+        // First run
+        generate(tmpDir);
+        const firstRun = fs.readFileSync(path.join(tmpDir, '.claude', 'settings.json'), 'utf8');
+
+        // Second run
+        generate(tmpDir);
+        const secondRun = fs.readFileSync(path.join(tmpDir, '.claude', 'settings.json'), 'utf8');
+
+        expect(firstRun).toBe(secondRun);
+      } finally {
+        cleanupTempProject(tmpDir);
+      }
+    });
+
+    test('JSON output is valid and parseable', () => {
+      const tmpDir = createTempProject({
+        frameworkProtection: true,
+        protected: ['.aios-core/core/**'],
+        exceptions: ['.aios-core/data/**'],
+      });
+
+      try {
+        generate(tmpDir);
+        const content = fs.readFileSync(path.join(tmpDir, '.claude', 'settings.json'), 'utf8');
+        const parsed = JSON.parse(content);
+
+        expect(parsed).toHaveProperty('permissions');
+        expect(parsed.permissions).toHaveProperty('deny');
+        expect(parsed.permissions).toHaveProperty('allow');
+        expect(Array.isArray(parsed.permissions.deny)).toBe(true);
+        expect(Array.isArray(parsed.permissions.allow)).toBe(true);
+      } finally {
+        cleanupTempProject(tmpDir);
+      }
+    });
+  });
+
+  describe('section preservation', () => {
+    test('preserves user-set language key after generator run', () => {
+      const tmpDir = createTempProject(
+        {
+          frameworkProtection: true,
+          protected: ['bin/aios.js'],
+          exceptions: [],
+        },
+        { language: 'pt', customSetting: true }
+      );
+
+      try {
+        generate(tmpDir);
+        const content = fs.readFileSync(path.join(tmpDir, '.claude', 'settings.json'), 'utf8');
+        const parsed = JSON.parse(content);
+
+        expect(parsed.language).toBe('pt');
+        expect(parsed.customSetting).toBe(true);
+        expect(parsed.permissions).toBeDefined();
+        expect(parsed.permissions.deny.length).toBeGreaterThan(0);
+      } finally {
+        cleanupTempProject(tmpDir);
+      }
+    });
+
+    test('frameworkProtection false preserves user settings and removes permissions', () => {
+      const tmpDir = createTempProject(
+        {
+          frameworkProtection: false,
+          protected: ['bin/aios.js'],
+          exceptions: [],
+        },
+        { language: 'pt', permissions: { deny: ['old-rule'], allow: [] } }
+      );
+
+      try {
+        generate(tmpDir);
+        const content = fs.readFileSync(path.join(tmpDir, '.claude', 'settings.json'), 'utf8');
+        const parsed = JSON.parse(content);
+
+        expect(parsed.language).toBe('pt');
+        expect(parsed.permissions).toBeUndefined();
+      } finally {
+        cleanupTempProject(tmpDir);
+      }
+    });
+  });
+
+  describe('CLI entry point', () => {
+    test('module exports required functions', () => {
+      expect(typeof generate).toBe('function');
+      expect(typeof readBoundaryConfig).toBe('function');
+      expect(typeof expandProtectedPaths).toBe('function');
+      expect(typeof expandExceptionPaths).toBe('function');
+      expect(typeof generatePermissions).toBe('function');
+      expect(typeof writeSettingsJson).toBe('function');
+    });
+  });
+});