artificial-code 1.17.13

package/test/mcp/oauth-callback.test.ts

@@ -0,0 +1,114 @@
+import { test, expect, describe, afterEach } from "bun:test"
+import { createConnection, createServer as createNetServer } from "net"
+import { McpOAuthCallback } from "../../src/mcp/oauth-callback"
+import { parseRedirectUri } from "../../src/mcp/oauth-provider"
+
+async function getFreeLoopbackPort(): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const probe = createNetServer()
+    probe.once("error", reject)
+    probe.listen(0, "127.0.0.1", () => {
+      const address = probe.address()
+      probe.close(() => {
+        if (typeof address === "object" && address) {
+          resolve(address.port)
+          return
+        }
+        reject(new Error("Could not allocate a loopback port"))
+      })
+    })
+  })
+}
+
+async function canConnect(host: string, port: number): Promise<boolean> {
+  return new Promise((resolve) => {
+    const socket = createConnection({ host, port })
+    const done = (ok: boolean) => {
+      socket.removeAllListeners()
+      socket.destroy()
+      resolve(ok)
+    }
+
+    socket.setTimeout(500)
+    socket.once("connect", () => done(true))
+    socket.once("error", () => done(false))
+    socket.once("timeout", () => done(false))
+  })
+}
+
+describe("parseRedirectUri", () => {
+  test("returns defaults when no URI provided", () => {
+    const result = parseRedirectUri()
+    expect(result.port).toBe(19876)
+    expect(result.path).toBe("/mcp/oauth/callback")
+  })
+
+  test("parses port and path from URI", () => {
+    const result = parseRedirectUri("http://127.0.0.1:8080/oauth/callback")
+    expect(result.port).toBe(8080)
+    expect(result.path).toBe("/oauth/callback")
+  })
+
+  test("returns defaults for invalid URI", () => {
+    const result = parseRedirectUri("not-a-valid-url")
+    expect(result.port).toBe(19876)
+    expect(result.path).toBe("/mcp/oauth/callback")
+  })
+})
+
+describe("McpOAuthCallback.ensureRunning", () => {
+  afterEach(async () => {
+    await McpOAuthCallback.stop()
+  })
+
+  test("starts server with custom redirectUri port and path", async () => {
+    await McpOAuthCallback.ensureRunning("http://127.0.0.1:18000/custom/callback")
+    expect(McpOAuthCallback.isRunning()).toBe(true)
+  })
+
+  test("stops after the callback completes", async () => {
+    const redirectUri = "http://127.0.0.1:18003/custom/callback"
+    await McpOAuthCallback.ensureRunning(redirectUri)
+    const callback = McpOAuthCallback.waitForCallback("success")
+
+    const response = await fetch(`${redirectUri}?code=code&state=success`)
+
+    expect(response.status).toBe(200)
+    expect(await callback).toBe("code")
+    expect(McpOAuthCallback.isRunning()).toBe(false)
+  })
+
+  test("escapes provider error markup in callback HTML", async () => {
+    const redirectUri = "http://127.0.0.1:18001/custom/callback"
+    await McpOAuthCallback.ensureRunning(redirectUri)
+
+    const error = `<script>alert("xss" & 'more')</script>`
+    const response = await fetch(
+      `${redirectUri}?state=test&error=access_denied&error_description=${encodeURIComponent(error)}`,
+    )
+    const body = await response.text()
+
+    expect(response.headers.get("content-type")).toBe("text/html; charset=utf-8")
+    expect(body).toContain("&lt;script&gt;alert(&quot;xss&quot; &amp; &#39;more&#39;)&lt;/script&gt;")
+    expect(body).not.toContain(error)
+  })
+
+  test("keeps normal provider errors readable", async () => {
+    const redirectUri = "http://127.0.0.1:18002/custom/callback"
+    await McpOAuthCallback.ensureRunning(redirectUri)
+
+    const response = await fetch(
+      `${redirectUri}?state=test&error=access_denied&error_description=${encodeURIComponent("The user denied access")}`,
+    )
+
+    expect(await response.text()).toContain('<pre class="detail" id="oc-detail">The user denied access</pre>')
+  })
+
+  test("binds the callback server to IPv4 loopback", async () => {
+    const port = await getFreeLoopbackPort()
+    await McpOAuthCallback.ensureRunning(`http://127.0.0.1:${port}/custom/callback`)
+
+    expect(await canConnect("127.0.0.1", port)).toBe(true)
+    expect(await canConnect("::1", port)).toBe(false)
+  })
+})

package/test/mcp/oauth-provider.test.ts

@@ -0,0 +1,102 @@
+import { test, expect, describe } from "bun:test"
+import { determineScope } from "@modelcontextprotocol/sdk/client/auth.js"
+import { McpOAuthProvider, OAUTH_CALLBACK_PORT, OAUTH_CALLBACK_PATH } from "../../src/mcp/oauth-provider"
+import type { McpAuth } from "../../src/mcp/auth"
+
+// Stub auth — only synchronous getters are exercised in these tests
+const stubAuth = {} as McpAuth.Interface
+
+const makeProvider = (config: ConstructorParameters<typeof McpOAuthProvider>[2]) =>
+  new McpOAuthProvider("test-server", "https://mcp.example.com/mcp", config, { onRedirect: async () => {} }, stubAuth)
+
+describe("McpOAuthProvider.redirectUrl", () => {
+  test("defaults to 127.0.0.1:19876/mcp/oauth/callback", () => {
+    const provider = makeProvider({})
+    expect(provider.redirectUrl).toBe(`http://127.0.0.1:${OAUTH_CALLBACK_PORT}${OAUTH_CALLBACK_PATH}`)
+  })
+
+  test("uses callbackPort when set", () => {
+    const provider = makeProvider({ callbackPort: 6620 })
+    expect(provider.redirectUrl).toBe(`http://127.0.0.1:6620${OAUTH_CALLBACK_PATH}`)
+  })
+
+  test("redirectUri takes precedence over callbackPort", () => {
+    const provider = makeProvider({
+      callbackPort: 6620,
+      redirectUri: "http://127.0.0.1:9999/custom/callback",
+    })
+    expect(provider.redirectUrl).toBe("http://127.0.0.1:9999/custom/callback")
+  })
+
+  test("uses explicit redirectUri when set without callbackPort", () => {
+    const provider = makeProvider({ redirectUri: "http://127.0.0.1:8080/oauth/callback" })
+    expect(provider.redirectUrl).toBe("http://127.0.0.1:8080/oauth/callback")
+  })
+})
+
+describe("McpOAuthProvider.clientMetadata", () => {
+  test("includes redirect_uris from redirectUrl", () => {
+    const provider = makeProvider({ callbackPort: 6620 })
+    expect(provider.clientMetadata.redirect_uris).toEqual([`http://127.0.0.1:6620${OAUTH_CALLBACK_PATH}`])
+  })
+
+  test("includes scope when set in config", () => {
+    const provider = makeProvider({ scope: "openid offline_access" })
+    expect(provider.clientMetadata.scope).toBe("openid offline_access")
+  })
+
+  test("omits scope when not set in config", () => {
+    const provider = makeProvider({})
+    expect(provider.clientMetadata.scope).toBeUndefined()
+  })
+
+  test("sets token_endpoint_auth_method to client_secret_post when clientSecret provided", () => {
+    const provider = makeProvider({ clientSecret: "secret" })
+    expect(provider.clientMetadata.token_endpoint_auth_method).toBe("client_secret_post")
+  })
+
+  test("sets token_endpoint_auth_method to none when no clientSecret", () => {
+    const provider = makeProvider({})
+    expect(provider.clientMetadata.token_endpoint_auth_method).toBe("none")
+  })
+})
+
+describe("MCP OAuth scope selection", () => {
+  test("adds offline_access when the authorization server and client support refresh tokens", () => {
+    expect(
+      determineScope({
+        resourceMetadata: {
+          resource: "https://mcp.example.com/mcp",
+          scopes_supported: ["resource.read"],
+        },
+        authServerMetadata: {
+          issuer: "https://auth.example.com",
+          authorization_endpoint: "https://auth.example.com/authorize",
+          token_endpoint: "https://auth.example.com/token",
+          response_types_supported: ["code"],
+          scopes_supported: ["resource.read", "offline_access"],
+        },
+        clientMetadata: makeProvider({}).clientMetadata,
+      }),
+    ).toBe("resource.read offline_access")
+  })
+
+  test("does not add unsupported authorization server scopes", () => {
+    expect(
+      determineScope({
+        resourceMetadata: {
+          resource: "https://mcp.example.com/mcp",
+          scopes_supported: ["resource.read"],
+        },
+        authServerMetadata: {
+          issuer: "https://auth.example.com",
+          authorization_endpoint: "https://auth.example.com/authorize",
+          token_endpoint: "https://auth.example.com/token",
+          response_types_supported: ["code"],
+          scopes_supported: ["resource.read"],
+        },
+        clientMetadata: makeProvider({}).clientMetadata,
+      }),
+    ).toBe("resource.read")
+  })
+})

package/test/mcp/session-recovery.test.ts

@@ -0,0 +1,27 @@
+import path from "node:path"
+import { describe, expect, test } from "bun:test"
+
+describe("mcp session recovery", () => {
+  test("reinitializes and retries once after a session-bound POST returns 404", async () => {
+    const child = Bun.spawn([process.execPath, path.join(import.meta.dir, "../fixture/mcp-session-recovery.ts")], {
+      cwd: path.join(import.meta.dir, "../.."),
+      stdout: "pipe",
+      stderr: "pipe",
+    })
+    const [code, stdout, stderr] = await Promise.all([
+      child.exited,
+      Bun.readableStreamToText(child.stdout),
+      Bun.readableStreamToText(child.stderr),
+    ])
+
+    expect(code, stderr).toBe(0)
+    expect(JSON.parse(stdout)).toEqual([
+      { method: "initialize", session: null },
+      { method: "notifications/initialized", session: "expired" },
+      { method: "ping", session: "expired" },
+      { method: "initialize", session: null },
+      { method: "notifications/initialized", session: "replacement" },
+      { method: "ping", session: "replacement" },
+    ])
+  })
+})

package/test/patch/patch.test.ts

@@ -0,0 +1,384 @@
+import { describe, test, expect, beforeEach, afterEach } from "bun:test"
+import { LayerNode } from "@ac/core/effect/layer-node"
+import { Effect } from "effect"
+import * as fs from "fs/promises"
+import * as path from "path"
+import { tmpdir } from "os"
+import { Patch } from "../../src/patch"
+import { FSUtil } from "@ac/core/fs-util"
+import { testEffect } from "../lib/effect"
+
+const it = testEffect(LayerNode.compile(FSUtil.node))
+
+describe("Patch namespace", () => {
+  let tempDir: string
+
+  beforeEach(async () => {
+    tempDir = await fs.mkdtemp(path.join(tmpdir(), "patch-test-"))
+  })
+
+  afterEach(async () => {
+    // Clean up temp directory
+    await fs.rm(tempDir, { recursive: true, force: true })
+  })
+
+  describe("parsePatch", () => {
+    test("should parse simple add file patch", () => {
+      const patchText = `*** Begin Patch
+*** Add File: test.txt
++Hello World
+*** End Patch`
+
+      const result = Patch.parsePatch(patchText)
+      expect(result.hunks).toHaveLength(1)
+      expect(result.hunks[0]).toEqual({
+        type: "add",
+        path: "test.txt",
+        contents: "Hello World",
+      })
+    })
+
+    test("should parse delete file patch", () => {
+      const patchText = `*** Begin Patch
+*** Delete File: old.txt
+*** End Patch`
+
+      const result = Patch.parsePatch(patchText)
+      expect(result.hunks).toHaveLength(1)
+      const hunk = result.hunks[0]
+      expect(hunk.type).toBe("delete")
+      expect(hunk.path).toBe("old.txt")
+    })
+
+    test("should parse patch with multiple hunks", () => {
+      const patchText = `*** Begin Patch
+*** Add File: new.txt
++This is a new file
+*** Update File: existing.txt
+@@
+ old line
+-new line
++updated line
+*** End Patch`
+
+      const result = Patch.parsePatch(patchText)
+      expect(result.hunks).toHaveLength(2)
+      expect(result.hunks[0].type).toBe("add")
+      expect(result.hunks[1].type).toBe("update")
+    })
+
+    test("should parse file move operation", () => {
+      const patchText = `*** Begin Patch
+*** Update File: old-name.txt
+*** Move to: new-name.txt
+@@
+-Old content
++New content
+*** End Patch`
+
+      const result = Patch.parsePatch(patchText)
+      expect(result.hunks).toHaveLength(1)
+      const hunk = result.hunks[0]
+      expect(hunk.type).toBe("update")
+      expect(hunk.path).toBe("old-name.txt")
+      if (hunk.type === "update") {
+        expect(hunk.move_path).toBe("new-name.txt")
+      }
+    })
+
+    test("should throw error for invalid patch format", () => {
+      const invalidPatch = `This is not a valid patch`
+
+      expect(() => Patch.parsePatch(invalidPatch)).toThrow("Invalid patch format")
+    })
+  })
+
+  describe("maybeParseApplyPatch", () => {
+    test("should parse direct apply_patch command", () => {
+      const patchText = `*** Begin Patch
+*** Add File: test.txt
++Content
+*** End Patch`
+
+      const result = Patch.maybeParseApplyPatch(["apply_patch", patchText])
+      expect(result.type).toBe(Patch.MaybeApplyPatch.Body)
+      if (result.type === Patch.MaybeApplyPatch.Body) {
+        expect(result.args.patch).toBe(patchText)
+        expect(result.args.hunks).toHaveLength(1)
+      }
+    })
+
+    test("should parse applypatch command", () => {
+      const patchText = `*** Begin Patch
+*** Add File: test.txt
++Content
+*** End Patch`
+
+      const result = Patch.maybeParseApplyPatch(["applypatch", patchText])
+      expect(result.type).toBe(Patch.MaybeApplyPatch.Body)
+    })
+
+    test("should handle bash heredoc format", () => {
+      const script = `apply_patch <<'PATCH'
+*** Begin Patch
+*** Add File: test.txt
++Content
+*** End Patch
+PATCH`
+
+      const result = Patch.maybeParseApplyPatch(["bash", "-lc", script])
+      expect(result.type).toBe(Patch.MaybeApplyPatch.Body)
+      if (result.type === Patch.MaybeApplyPatch.Body) {
+        expect(result.args.hunks).toHaveLength(1)
+      }
+    })
+
+    test("should return NotApplyPatch for non-patch commands", () => {
+      const result = Patch.maybeParseApplyPatch(["echo", "hello"])
+      expect(result.type).toBe(Patch.MaybeApplyPatch.NotApplyPatch)
+    })
+  })
+
+  describe("applyPatch", () => {
+    it.live("should add a new file", () =>
+      Effect.gen(function* () {
+        const patchText = `*** Begin Patch
+*** Add File: ${tempDir}/new-file.txt
++Hello World
++This is a new file
+*** End Patch`
+
+        const result = yield* Patch.applyPatch(patchText)
+        expect(result.added).toHaveLength(1)
+        expect(result.modified).toHaveLength(0)
+        expect(result.deleted).toHaveLength(0)
+
+        const content = yield* Effect.promise(() => fs.readFile(result.added[0], "utf-8"))
+        expect(content).toBe("Hello World\nThis is a new file")
+      }),
+    )
+
+    it.live("should delete an existing file", () =>
+      Effect.gen(function* () {
+        const filePath = path.join(tempDir, "to-delete.txt")
+        yield* Effect.promise(() => fs.writeFile(filePath, "This file will be deleted"))
+
+        const patchText = `*** Begin Patch
+*** Delete File: ${filePath}
+*** End Patch`
+
+        const result = yield* Patch.applyPatch(patchText)
+        expect(result.deleted).toHaveLength(1)
+        expect(result.deleted[0]).toBe(filePath)
+
+        const exists = yield* Effect.promise(() =>
+          fs
+            .access(filePath)
+            .then(() => true)
+            .catch(() => false),
+        )
+        expect(exists).toBe(false)
+      }),
+    )
+
+    it.live("should update an existing file", () =>
+      Effect.gen(function* () {
+        const filePath = path.join(tempDir, "to-update.txt")
+        yield* Effect.promise(() => fs.writeFile(filePath, "line 1\nline 2\nline 3\n"))
+
+        const patchText = `*** Begin Patch
+*** Update File: ${filePath}
+@@
+ line 1
+-line 2
++line 2 updated
+ line 3
+*** End Patch`
+
+        const result = yield* Patch.applyPatch(patchText)
+        expect(result.modified).toHaveLength(1)
+        expect(result.modified[0]).toBe(filePath)
+
+        const content = yield* Effect.promise(() => fs.readFile(filePath, "utf-8"))
+        expect(content).toBe("line 1\nline 2 updated\nline 3\n")
+      }),
+    )
+
+    it.live("should move and update a file", () =>
+      Effect.gen(function* () {
+        const oldPath = path.join(tempDir, "old-name.txt")
+        const newPath = path.join(tempDir, "new-name.txt")
+        yield* Effect.promise(() => fs.writeFile(oldPath, "old content\n"))
+
+        const patchText = `*** Begin Patch
+*** Update File: ${oldPath}
+*** Move to: ${newPath}
+@@
+-old content
++new content
+*** End Patch`
+
+        const result = yield* Patch.applyPatch(patchText)
+        expect(result.modified).toHaveLength(1)
+        expect(result.modified[0]).toBe(newPath)
+
+        const oldExists = yield* Effect.promise(() =>
+          fs
+            .access(oldPath)
+            .then(() => true)
+            .catch(() => false),
+        )
+        expect(oldExists).toBe(false)
+
+        const newContent = yield* Effect.promise(() => fs.readFile(newPath, "utf-8"))
+        expect(newContent).toBe("new content\n")
+      }),
+    )
+
+    it.live("should handle multiple operations in one patch", () =>
+      Effect.gen(function* () {
+        const file1 = path.join(tempDir, "file1.txt")
+        const file2 = path.join(tempDir, "file2.txt")
+        const file3 = path.join(tempDir, "file3.txt")
+
+        yield* Effect.promise(() => fs.writeFile(file1, "content 1"))
+        yield* Effect.promise(() => fs.writeFile(file2, "content 2"))
+
+        const patchText = `*** Begin Patch
+*** Add File: ${file3}
++new file content
+*** Update File: ${file1}
+@@
+-content 1
++updated content 1
+*** Delete File: ${file2}
+*** End Patch`
+
+        const result = yield* Patch.applyPatch(patchText)
+        expect(result.added).toHaveLength(1)
+        expect(result.modified).toHaveLength(1)
+        expect(result.deleted).toHaveLength(1)
+      }),
+    )
+
+    it.live("should create parent directories when adding files", () =>
+      Effect.gen(function* () {
+        const nestedPath = path.join(tempDir, "deep", "nested", "file.txt")
+
+        const patchText = `*** Begin Patch
+*** Add File: ${nestedPath}
++Deep nested content
+*** End Patch`
+
+        const result = yield* Patch.applyPatch(patchText)
+        expect(result.added).toHaveLength(1)
+        expect(result.added[0]).toBe(nestedPath)
+
+        const exists = yield* Effect.promise(() =>
+          fs
+            .access(nestedPath)
+            .then(() => true)
+            .catch(() => false),
+        )
+        expect(exists).toBe(true)
+      }),
+    )
+  })
+
+  describe("error handling", () => {
+    it.live("should fail when updating non-existent file", () =>
+      Effect.gen(function* () {
+        const nonExistent = path.join(tempDir, "does-not-exist.txt")
+
+        const patchText = `*** Begin Patch
+*** Update File: ${nonExistent}
+@@
+-old line
++new line
+*** End Patch`
+
+        const exit = yield* Effect.exit(Patch.applyPatch(patchText))
+        expect(exit._tag).toBe("Failure")
+      }),
+    )
+
+    it.live("should fail when deleting non-existent file", () =>
+      Effect.gen(function* () {
+        const nonExistent = path.join(tempDir, "does-not-exist.txt")
+
+        const patchText = `*** Begin Patch
+*** Delete File: ${nonExistent}
+*** End Patch`
+
+        const exit = yield* Effect.exit(Patch.applyPatch(patchText))
+        expect(exit._tag).toBe("Failure")
+      }),
+    )
+  })
+
+  describe("edge cases", () => {
+    it.live("should handle empty files", () =>
+      Effect.gen(function* () {
+        const emptyFile = path.join(tempDir, "empty.txt")
+        yield* Effect.promise(() => fs.writeFile(emptyFile, ""))
+
+        const patchText = `*** Begin Patch
+*** Update File: ${emptyFile}
+@@
++First line
+*** End Patch`
+
+        const result = yield* Patch.applyPatch(patchText)
+        expect(result.modified).toHaveLength(1)
+
+        const content = yield* Effect.promise(() => fs.readFile(emptyFile, "utf-8"))
+        expect(content).toBe("First line\n")
+      }),
+    )
+
+    it.live("should handle files with no trailing newline", () =>
+      Effect.gen(function* () {
+        const filePath = path.join(tempDir, "no-newline.txt")
+        yield* Effect.promise(() => fs.writeFile(filePath, "no newline"))
+
+        const patchText = `*** Begin Patch
+*** Update File: ${filePath}
+@@
+-no newline
++has newline now
+*** End Patch`
+
+        const result = yield* Patch.applyPatch(patchText)
+        expect(result.modified).toHaveLength(1)
+
+        const content = yield* Effect.promise(() => fs.readFile(filePath, "utf-8"))
+        expect(content).toBe("has newline now\n")
+      }),
+    )
+
+    it.live("should handle multiple update chunks in single file", () =>
+      Effect.gen(function* () {
+        const filePath = path.join(tempDir, "multi-chunk.txt")
+        yield* Effect.promise(() => fs.writeFile(filePath, "line 1\nline 2\nline 3\nline 4\n"))
+
+        const patchText = `*** Begin Patch
+*** Update File: ${filePath}
+@@
+ line 1
+-line 2
++LINE 2
+@@
+ line 3
+-line 4
++LINE 4
+*** End Patch`
+
+        const result = yield* Patch.applyPatch(patchText)
+        expect(result.modified).toHaveLength(1)
+
+        const content = yield* Effect.promise(() => fs.readFile(filePath, "utf-8"))
+        expect(content).toBe("line 1\nLINE 2\nline 3\nLINE 4\n")
+      }),
+    )
+  })
+})

package/test/permission/arity.test.ts

@@ -0,0 +1,33 @@
+import { test, expect } from "bun:test"
+import { BashArity } from "../../src/permission/arity"
+
+test("arity 1 - unknown commands default to first token", () => {
+  expect(BashArity.prefix(["unknown", "command", "subcommand"])).toEqual(["unknown"])
+  expect(BashArity.prefix(["touch", "foo.txt"])).toEqual(["touch"])
+})
+
+test("arity 2 - two token commands", () => {
+  expect(BashArity.prefix(["git", "checkout", "main"])).toEqual(["git", "checkout"])
+  expect(BashArity.prefix(["docker", "run", "nginx"])).toEqual(["docker", "run"])
+})
+
+test("arity 3 - three token commands", () => {
+  expect(BashArity.prefix(["aws", "s3", "ls", "my-bucket"])).toEqual(["aws", "s3", "ls"])
+  expect(BashArity.prefix(["npm", "run", "dev", "script"])).toEqual(["npm", "run", "dev"])
+})
+
+test("longest match wins - nested prefixes", () => {
+  expect(BashArity.prefix(["docker", "compose", "up", "service"])).toEqual(["docker", "compose", "up"])
+  expect(BashArity.prefix(["consul", "kv", "get", "config"])).toEqual(["consul", "kv", "get"])
+})
+
+test("exact length matches", () => {
+  expect(BashArity.prefix(["git", "checkout"])).toEqual(["git", "checkout"])
+  expect(BashArity.prefix(["npm", "run", "dev"])).toEqual(["npm", "run", "dev"])
+})
+
+test("edge cases", () => {
+  expect(BashArity.prefix([])).toEqual([])
+  expect(BashArity.prefix(["single"])).toEqual(["single"])
+  expect(BashArity.prefix(["git"])).toEqual(["git"])
+})