artificial-code 1.17.13 → 1.17.15

package/test/permission-task.test.ts

@@ -1,319 +0,0 @@
-import { PermissionV1 } from "@ac/core/v1/permission"
-import { LayerNode } from "@ac/core/effect/layer-node"
-import { describe, test, expect } from "bun:test"
-import { Effect } from "effect"
-import { Permission } from "../src/permission"
-import { Config } from "@/config/config"
-import { testEffect } from "./lib/effect"
-
-const it = testEffect(LayerNode.compile(Config.node))
-
-const load = Config.use.get()
-
-describe("Permission.evaluate for permission.task", () => {
-  const createRuleset = (rules: Record<string, "allow" | "deny" | "ask">): PermissionV1.Ruleset =>
-    Object.entries(rules).map(([pattern, action]) => ({
-      permission: "task",
-      pattern,
-      action,
-    }))
-
-  test("returns ask when no match (default)", () => {
-    expect(Permission.evaluate("task", "code-reviewer", []).action).toBe("ask")
-  })
-
-  test("returns deny for explicit deny", () => {
-    const ruleset = createRuleset({ "code-reviewer": "deny" })
-    expect(Permission.evaluate("task", "code-reviewer", ruleset).action).toBe("deny")
-  })
-
-  test("returns allow for explicit allow", () => {
-    const ruleset = createRuleset({ "code-reviewer": "allow" })
-    expect(Permission.evaluate("task", "code-reviewer", ruleset).action).toBe("allow")
-  })
-
-  test("returns ask for explicit ask", () => {
-    const ruleset = createRuleset({ "code-reviewer": "ask" })
-    expect(Permission.evaluate("task", "code-reviewer", ruleset).action).toBe("ask")
-  })
-
-  test("matches wildcard patterns with deny", () => {
-    const ruleset = createRuleset({ "orchestrator-*": "deny" })
-    expect(Permission.evaluate("task", "orchestrator-fast", ruleset).action).toBe("deny")
-    expect(Permission.evaluate("task", "orchestrator-slow", ruleset).action).toBe("deny")
-    expect(Permission.evaluate("task", "general", ruleset).action).toBe("ask")
-  })
-
-  test("matches wildcard patterns with allow", () => {
-    const ruleset = createRuleset({ "orchestrator-*": "allow" })
-    expect(Permission.evaluate("task", "orchestrator-fast", ruleset).action).toBe("allow")
-    expect(Permission.evaluate("task", "orchestrator-slow", ruleset).action).toBe("allow")
-  })
-
-  test("matches wildcard patterns with ask", () => {
-    const ruleset = createRuleset({ "orchestrator-*": "ask" })
-    expect(Permission.evaluate("task", "orchestrator-fast", ruleset).action).toBe("ask")
-    const globalRuleset = createRuleset({ "*": "ask" })
-    expect(Permission.evaluate("task", "code-reviewer", globalRuleset).action).toBe("ask")
-  })
-
-  test("later rules take precedence (last match wins)", () => {
-    const ruleset = createRuleset({
-      "orchestrator-*": "deny",
-      "orchestrator-fast": "allow",
-    })
-    expect(Permission.evaluate("task", "orchestrator-fast", ruleset).action).toBe("allow")
-    expect(Permission.evaluate("task", "orchestrator-slow", ruleset).action).toBe("deny")
-  })
-
-  test("matches global wildcard", () => {
-    expect(Permission.evaluate("task", "any-agent", createRuleset({ "*": "allow" })).action).toBe("allow")
-    expect(Permission.evaluate("task", "any-agent", createRuleset({ "*": "deny" })).action).toBe("deny")
-    expect(Permission.evaluate("task", "any-agent", createRuleset({ "*": "ask" })).action).toBe("ask")
-  })
-})
-
-describe("Permission.disabled for task tool", () => {
-  // Note: The `disabled` function checks if a TOOL should be completely removed from the tool list.
-  // It only disables a tool when there's a rule with `pattern: "*"` and `action: "deny"`.
-  // It does NOT evaluate complex subagent patterns - those are handled at runtime by `evaluate`.
-  const createRuleset = (rules: Record<string, "allow" | "deny" | "ask">): PermissionV1.Ruleset =>
-    Object.entries(rules).map(([pattern, action]) => ({
-      permission: "task",
-      pattern,
-      action,
-    }))
-
-  test("task tool is disabled when global deny pattern exists (even with specific allows)", () => {
-    // When "*": "deny" exists, the task tool is disabled because the disabled() function
-    // only checks for wildcard deny patterns - it doesn't consider that specific subagents might be allowed
-    const ruleset = createRuleset({
-      "orchestrator-*": "allow",
-      "*": "deny",
-    })
-    const disabled = Permission.disabled(["task", "bash", "read"], ruleset)
-    // The task tool IS disabled because there's a pattern: "*" with action: "deny"
-    expect(disabled.has("task")).toBe(true)
-  })
-
-  test("task tool is disabled when global deny pattern exists (even with ask overrides)", () => {
-    const ruleset = createRuleset({
-      "orchestrator-*": "ask",
-      "*": "deny",
-    })
-    const disabled = Permission.disabled(["task"], ruleset)
-    // The task tool IS disabled because there's a pattern: "*" with action: "deny"
-    expect(disabled.has("task")).toBe(true)
-  })
-
-  test("task tool is disabled when global deny pattern exists", () => {
-    const ruleset = createRuleset({ "*": "deny" })
-    const disabled = Permission.disabled(["task"], ruleset)
-    expect(disabled.has("task")).toBe(true)
-  })
-
-  test("task tool is NOT disabled when only specific patterns are denied (no wildcard)", () => {
-    // The disabled() function only disables tools when pattern: "*" && action: "deny"
-    // Specific subagent denies don't disable the task tool - those are handled at runtime
-    const ruleset = createRuleset({
-      "orchestrator-*": "deny",
-      general: "deny",
-    })
-    const disabled = Permission.disabled(["task"], ruleset)
-    // The task tool is NOT disabled because no rule has pattern: "*" with action: "deny"
-    expect(disabled.has("task")).toBe(false)
-  })
-
-  test("task tool is enabled when no task rules exist (default ask)", () => {
-    const disabled = Permission.disabled(["task"], [])
-    expect(disabled.has("task")).toBe(false)
-  })
-
-  test("task tool is NOT disabled when last wildcard pattern is allow", () => {
-    // Last matching rule wins - if wildcard allow comes after wildcard deny, tool is enabled
-    const ruleset = createRuleset({
-      "*": "deny",
-      "orchestrator-coder": "allow",
-    })
-    const disabled = Permission.disabled(["task"], ruleset)
-    // The disabled() function uses findLast and checks if the last matching rule
-    // has pattern: "*" and action: "deny". In this case, the last rule matching
-    // "task" permission has pattern "orchestrator-coder", not "*", so not disabled
-    expect(disabled.has("task")).toBe(false)
-  })
-})
-
-// Integration tests that load permissions from real config files
-describe("permission.task with real config files", () => {
-  it.instance(
-    "loads task permissions from opencode.json config",
-    () =>
-      Effect.gen(function* () {
-        const config = yield* load
-        const ruleset = Permission.fromConfig(config.permission ?? {})
-        // general and orchestrator-fast should be allowed, code-reviewer denied
-        expect(Permission.evaluate("task", "general", ruleset).action).toBe("allow")
-        expect(Permission.evaluate("task", "orchestrator-fast", ruleset).action).toBe("allow")
-        expect(Permission.evaluate("task", "code-reviewer", ruleset).action).toBe("deny")
-      }),
-    {
-      git: true,
-      config: {
-        permission: {
-          task: {
-            "*": "allow",
-            "code-reviewer": "deny",
-          },
-        },
-      },
-    },
-  )
-
-  it.instance(
-    "loads task permissions with wildcard patterns from config",
-    () =>
-      Effect.gen(function* () {
-        const config = yield* load
-        const ruleset = Permission.fromConfig(config.permission ?? {})
-        // general and code-reviewer should be ask, orchestrator-* denied
-        expect(Permission.evaluate("task", "general", ruleset).action).toBe("ask")
-        expect(Permission.evaluate("task", "code-reviewer", ruleset).action).toBe("ask")
-        expect(Permission.evaluate("task", "orchestrator-fast", ruleset).action).toBe("deny")
-      }),
-    {
-      git: true,
-      config: {
-        permission: {
-          task: {
-            "*": "ask",
-            "orchestrator-*": "deny",
-          },
-        },
-      },
-    },
-  )
-
-  it.instance(
-    "evaluate respects task permission from config",
-    () =>
-      Effect.gen(function* () {
-        const config = yield* load
-        const ruleset = Permission.fromConfig(config.permission ?? {})
-        expect(Permission.evaluate("task", "general", ruleset).action).toBe("allow")
-        expect(Permission.evaluate("task", "code-reviewer", ruleset).action).toBe("deny")
-        // Unspecified agents default to "ask"
-        expect(Permission.evaluate("task", "unknown-agent", ruleset).action).toBe("ask")
-      }),
-    {
-      git: true,
-      config: {
-        permission: {
-          task: {
-            general: "allow",
-            "code-reviewer": "deny",
-          },
-        },
-      },
-    },
-  )
-
-  it.instance(
-    "mixed permission config with task and other tools",
-    () =>
-      Effect.gen(function* () {
-        const config = yield* load
-        const ruleset = Permission.fromConfig(config.permission ?? {})
-
-        // Verify task permissions
-        expect(Permission.evaluate("task", "general", ruleset).action).toBe("allow")
-        expect(Permission.evaluate("task", "code-reviewer", ruleset).action).toBe("deny")
-
-        // Verify other tool permissions
-        expect(Permission.evaluate("bash", "*", ruleset).action).toBe("allow")
-        expect(Permission.evaluate("edit", "*", ruleset).action).toBe("ask")
-
-        // Verify disabled tools
-        const disabled = Permission.disabled(["bash", "edit", "task"], ruleset)
-        expect(disabled.has("bash")).toBe(false)
-        expect(disabled.has("edit")).toBe(false)
-        // task is NOT disabled because disabled() uses findLast, and the last rule
-        // matching "task" permission is {pattern: "general", action: "allow"}, not pattern: "*"
-        expect(disabled.has("task")).toBe(false)
-      }),
-    {
-      git: true,
-      config: {
-        permission: {
-          bash: "allow",
-          edit: "ask",
-          task: {
-            "*": "deny",
-            general: "allow",
-          },
-        },
-      },
-    },
-  )
-
-  it.instance(
-    "task tool disabled when global deny comes last in config",
-    () =>
-      Effect.gen(function* () {
-        const config = yield* load
-        const ruleset = Permission.fromConfig(config.permission ?? {})
-
-        // Last matching rule wins - "*" deny is last, so all agents are denied
-        expect(Permission.evaluate("task", "general", ruleset).action).toBe("deny")
-        expect(Permission.evaluate("task", "code-reviewer", ruleset).action).toBe("deny")
-        expect(Permission.evaluate("task", "unknown", ruleset).action).toBe("deny")
-
-        // Since "*": "deny" is the last rule, disabled() finds it with findLast
-        // and sees pattern: "*" with action: "deny", so task is disabled
-        const disabled = Permission.disabled(["task"], ruleset)
-        expect(disabled.has("task")).toBe(true)
-      }),
-    {
-      git: true,
-      config: {
-        permission: {
-          task: {
-            general: "allow",
-            "code-reviewer": "allow",
-            "*": "deny",
-          },
-        },
-      },
-    },
-  )
-
-  it.instance(
-    "task tool NOT disabled when specific allow comes last in config",
-    () =>
-      Effect.gen(function* () {
-        const config = yield* load
-        const ruleset = Permission.fromConfig(config.permission ?? {})
-
-        // Evaluate uses findLast - "general" allow comes after "*" deny
-        expect(Permission.evaluate("task", "general", ruleset).action).toBe("allow")
-        // Other agents still denied by the earlier "*" deny
-        expect(Permission.evaluate("task", "code-reviewer", ruleset).action).toBe("deny")
-
-        // disabled() uses findLast and checks if the last rule has pattern: "*" with action: "deny"
-        // In this case, the last rule is {pattern: "general", action: "allow"}, not pattern: "*"
-        // So the task tool is NOT disabled (even though most subagents are denied)
-        const disabled = Permission.disabled(["task"], ruleset)
-        expect(disabled.has("task")).toBe(false)
-      }),
-    {
-      git: true,
-      config: {
-        permission: {
-          task: {
-            "*": "deny",
-            general: "allow",
-          },
-        },
-      },
-    },
-  )
-})

package/test/plugin/auth-override.test.ts

@@ -1,101 +0,0 @@
-import { describe, expect, test } from "bun:test"
-import path from "path"
-import { pathToFileURL } from "url"
-import { LayerNode } from "@ac/core/effect/layer-node"
-import { Effect } from "effect"
-import { FSUtil } from "@ac/core/fs-util"
-import { provideInstance, TestInstance, tmpdirScoped } from "../fixture/fixture"
-import { ProviderAuth } from "@/provider/auth"
-
-import { RuntimeFlags } from "@/effect/runtime-flags"
-import { TestConfig } from "../fixture/config"
-import { testEffect } from "../lib/effect"
-import { CrossSpawnSpawner } from "@ac/core/cross-spawn-spawner"
-import { ProviderV2 } from "@ac/core/provider"
-import { Config } from "@/config/config"
-
-const it = testEffect(LayerNode.compile(LayerNode.group([CrossSpawnSpawner.node, FSUtil.node])))
-
-function providerAuthLayer(directory: string, plugins: string[]) {
-  return LayerNode.compile(ProviderAuth.node, [
-    [
-      Config.node,
-      TestConfig.layer({
-        get: () =>
-          Effect.succeed({
-            plugin: plugins,
-            plugin_origins: plugins.map((plugin) => ({
-              spec: plugin,
-              source: path.join(directory, "opencode.json"),
-              scope: "local" as const,
-            })),
-          }),
-        directories: () => Effect.succeed([directory]),
-      }),
-    ],
-    [RuntimeFlags.node, RuntimeFlags.layer()],
-  ])
-}
-
-describe("plugin.auth-override", () => {
-  it.instance(
-    "user plugin overrides built-in github-copilot auth",
-    () =>
-      Effect.gen(function* () {
-        const tmp = yield* TestInstance
-        const fs = yield* FSUtil.Service
-        const pluginDir = path.join(tmp.directory, ".ac", "plugin")
-
-        yield* fs.writeWithDirs(
-          path.join(pluginDir, "custom-copilot-auth.ts"),
-          [
-            "export default {",
-            '  id: "demo.custom-copilot-auth",',
-            "  server: async () => ({",
-            "    auth: {",
-            '      provider: "github-copilot",',
-            "      methods: [",
-            '        { type: "api", label: "Test Override Auth" },',
-            "      ],",
-            "      loader: async () => ({ access: 'test-token' }),",
-            "    },",
-            "  }),",
-            "}",
-            "",
-          ].join("\n"),
-        )
-
-        const plain = yield* tmpdirScoped({ git: true })
-        const plugin = pathToFileURL(path.join(pluginDir, "custom-copilot-auth.ts")).href
-        const methods = yield* ProviderAuth.use
-          .methods()
-          .pipe(Effect.provide(providerAuthLayer(tmp.directory, [plugin])))
-        const plainMethods = yield* ProviderAuth.use
-          .methods()
-          .pipe(Effect.provide(providerAuthLayer(plain, [])), provideInstance(plain))
-
-        const copilot = methods[ProviderV2.ID.make("github-copilot")]
-        expect(copilot).toBeDefined()
-        expect(copilot.length).toBe(1)
-        expect(copilot[0].label).toBe("Test Override Auth")
-        expect(plainMethods[ProviderV2.ID.make("github-copilot")][0].label).not.toBe("Test Override Auth")
-      }),
-    { git: true },
-    30000,
-  )
-})
-
-const file = path.join(import.meta.dir, "../../src/plugin/index.ts")
-
-describe("plugin.config-hook-error-isolation", () => {
-  test("config hooks are individually error-isolated in the layer factory", async () => {
-    const src = await Bun.file(file).text()
-
-    // Each hook's config call is wrapped in Effect.tryPromise with error logging + Effect.ignore
-    expect(src).toContain("plugin config hook failed")
-
-    const pattern =
-      /for\s*\(const hook of hooks\)\s*\{[\s\S]*?Effect\.tryPromise[\s\S]*?\.config\?\.\([\s\S]*?plugin config hook failed[\s\S]*?Effect\.ignore/
-    expect(pattern.test(src)).toBe(true)
-  })
-})

package/test/plugin/cloudflare.test.ts

@@ -1,68 +0,0 @@
-import { expect, test } from "bun:test"
-import { CloudflareAIGatewayAuthPlugin } from "@/plugin/cloudflare"
-
-const pluginInput = {
-  client: {} as never,
-  project: {} as never,
-  directory: "",
-  worktree: "",
-  experimental_workspace: {
-    register() {},
-  },
-  serverUrl: new URL("https://example.com"),
-  $: {} as never,
-}
-
-function makeHookInput(overrides: { providerID?: string; apiId?: string; reasoning?: boolean }) {
-  return {
-    sessionID: "s",
-    agent: "a",
-    provider: {} as never,
-    message: {} as never,
-    model: {
-      providerID: overrides.providerID ?? "cloudflare-ai-gateway",
-      api: { id: overrides.apiId ?? "openai/gpt-5.2-codex", url: "", npm: "ai-gateway-provider" },
-      capabilities: {
-        reasoning: overrides.reasoning ?? true,
-        temperature: false,
-        attachment: true,
-        toolcall: true,
-        input: { text: true, audio: false, image: false, video: false, pdf: false },
-        output: { text: true, audio: false, image: false, video: false, pdf: false },
-        interleaved: false,
-      },
-    } as never,
-  }
-}
-
-function makeHookOutput() {
-  return { temperature: 0, topP: 1, topK: 0, maxOutputTokens: 32_000 as number | undefined, options: {} }
-}
-
-test("omits maxOutputTokens for openai reasoning models on cloudflare-ai-gateway", async () => {
-  const hooks = await CloudflareAIGatewayAuthPlugin(pluginInput)
-  const out = makeHookOutput()
-  await hooks["chat.params"]!(makeHookInput({ apiId: "openai/gpt-5.2-codex", reasoning: true }), out)
-  expect(out.maxOutputTokens).toBeUndefined()
-})
-
-test("keeps maxOutputTokens for openai non-reasoning models", async () => {
-  const hooks = await CloudflareAIGatewayAuthPlugin(pluginInput)
-  const out = makeHookOutput()
-  await hooks["chat.params"]!(makeHookInput({ apiId: "openai/gpt-4-turbo", reasoning: false }), out)
-  expect(out.maxOutputTokens).toBe(32_000)
-})
-
-test("keeps maxOutputTokens for non-openai reasoning models on cloudflare-ai-gateway", async () => {
-  const hooks = await CloudflareAIGatewayAuthPlugin(pluginInput)
-  const out = makeHookOutput()
-  await hooks["chat.params"]!(makeHookInput({ apiId: "anthropic/claude-sonnet-4-5", reasoning: true }), out)
-  expect(out.maxOutputTokens).toBe(32_000)
-})
-
-test("ignores non-cloudflare-ai-gateway providers", async () => {
-  const hooks = await CloudflareAIGatewayAuthPlugin(pluginInput)
-  const out = makeHookOutput()
-  await hooks["chat.params"]!(makeHookInput({ providerID: "openai", apiId: "gpt-5.2-codex", reasoning: true }), out)
-  expect(out.maxOutputTokens).toBe(32_000)
-})