create-harness-vibe-coding 0.8.17 → 0.8.19

package/src/wf-ui-server/__tests__/peer-capsule.test.mjs

@@ -0,0 +1,268 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+
+import {
+  createPeerCapsule,
+  writePeerEvent,
+  writePeerResult,
+  blockPeer,
+  getPeerCapsule,
+} from '../peer-capsule.mjs';
+
+/**
+ * Create a temporary project root with a Harness/tasks structure for testing.
+ */
+function makeTempProject() {
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'peer-capsule-test-'));
+  // Create the expected structure
+  fs.mkdirSync(path.join(tmpDir, 'Harness', 'tasks'), { recursive: true });
+  return tmpDir;
+}
+
+test('createPeerCapsule writes REQUEST.json with correct taskId/peerId/runtime', () => {
+  const projectRoot = makeTempProject();
+  try {
+    const request = {
+      runtime: 'claude',
+      taskId: 'task-test-123',
+      peerId: 'worker-001',
+      command: 'say hello',
+    };
+
+    const result = createPeerCapsule(projectRoot, 'task-test-123', 'worker-001', request);
+
+    // Check returned structure — request gets createdAt added by createPeerCapsule
+    assert.ok(result.capsuleDir);
+    assert.ok(result.capsuleDir.endsWith(path.join('task-test-123', 'peers', 'worker-001')));
+    assert.equal(result.request.taskId, request.taskId);
+    assert.equal(result.request.peerId, request.peerId);
+    assert.equal(result.request.runtime, request.runtime);
+    assert.equal(result.request.command, request.command);
+    assert.ok(result.request.createdAt);
+
+    // Check file on disk
+    const requestPath = path.join(result.capsuleDir, 'REQUEST.json');
+    assert.ok(fs.existsSync(requestPath));
+    const parsed = JSON.parse(fs.readFileSync(requestPath, 'utf-8'));
+    assert.equal(parsed.taskId, 'task-test-123');
+    assert.equal(parsed.peerId, 'worker-001');
+    assert.equal(parsed.runtime, 'claude');
+    assert.equal(parsed.command, 'say hello');
+    // createdAt is added by createPeerCapsule
+    assert.ok(parsed.createdAt);
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});
+
+test('createPeerCapsule writes STATE.json with status starting', () => {
+  const projectRoot = makeTempProject();
+  try {
+    const result = createPeerCapsule(projectRoot, 'task-test-123', 'worker-001', {
+      runtime: 'claude',
+      taskId: 'task-test-123',
+      peerId: 'worker-001',
+    });
+
+    const statePath = path.join(result.capsuleDir, 'STATE.json');
+    assert.ok(fs.existsSync(statePath));
+    const state = JSON.parse(fs.readFileSync(statePath, 'utf-8'));
+    assert.equal(state.status, 'starting');
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});
+
+test('writePeerEvent appends line to events.jsonl', () => {
+  const projectRoot = makeTempProject();
+  try {
+    createPeerCapsule(projectRoot, 'task-test-123', 'worker-001', {
+      runtime: 'claude',
+      taskId: 'task-test-123',
+      peerId: 'worker-001',
+    });
+
+    writePeerEvent(projectRoot, 'task-test-123', 'worker-001', { type: 'data', text: 'hello' });
+    writePeerEvent(projectRoot, 'task-test-123', 'worker-001', { type: 'data', text: 'world' });
+
+    const eventsPath = path.join(projectRoot, 'Harness', 'tasks', 'task-test-123', 'peers', 'worker-001', 'events.jsonl');
+    assert.ok(fs.existsSync(eventsPath));
+    const lines = fs.readFileSync(eventsPath, 'utf-8').trim().split('\n');
+    assert.equal(lines.length, 2);
+    assert.equal(JSON.parse(lines[0]).text, 'hello');
+    assert.equal(JSON.parse(lines[1]).text, 'world');
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});
+
+test('writePeerResult writes RESULT.json', () => {
+  const projectRoot = makeTempProject();
+  try {
+    createPeerCapsule(projectRoot, 'task-test-123', 'worker-001', {
+      runtime: 'claude',
+      taskId: 'task-test-123',
+      peerId: 'worker-001',
+    });
+
+    const result = { status: 'completed', output: 'done' };
+    writePeerResult(projectRoot, 'task-test-123', 'worker-001', result);
+
+    const resultPath = path.join(projectRoot, 'Harness', 'tasks', 'task-test-123', 'peers', 'worker-001', 'RESULT.json');
+    assert.ok(fs.existsSync(resultPath));
+    const parsed = JSON.parse(fs.readFileSync(resultPath, 'utf-8'));
+    assert.equal(parsed.status, result.status);
+    assert.equal(parsed.output, result.output);
+    assert.ok(parsed.completedAt);
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});
+
+test('blockPeer updates STATE.status to blocked', () => {
+  const projectRoot = makeTempProject();
+  try {
+    createPeerCapsule(projectRoot, 'task-test-123', 'worker-001', {
+      runtime: 'claude',
+      taskId: 'task-test-123',
+      peerId: 'worker-001',
+    });
+
+    blockPeer(projectRoot, 'task-test-123', 'worker-001', 'node-pty not installed');
+
+    const statePath = path.join(projectRoot, 'Harness', 'tasks', 'task-test-123', 'peers', 'worker-001', 'STATE.json');
+    const state = JSON.parse(fs.readFileSync(statePath, 'utf-8'));
+    assert.equal(state.status, 'blocked');
+    assert.equal(state.blockedReason, 'node-pty not installed');
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});
+
+test('blockPeer writes PROGRESS.md with reason', () => {
+  const projectRoot = makeTempProject();
+  try {
+    createPeerCapsule(projectRoot, 'task-test-123', 'worker-001', {
+      runtime: 'claude',
+      taskId: 'task-test-123',
+      peerId: 'worker-001',
+    });
+
+    blockPeer(projectRoot, 'task-test-123', 'worker-001', 'node-pty not installed');
+
+    const progressPath = path.join(projectRoot, 'Harness', 'tasks', 'task-test-123', 'peers', 'worker-001', 'PROGRESS.md');
+    assert.ok(fs.existsSync(progressPath));
+    const content = fs.readFileSync(progressPath, 'utf-8');
+    assert.ok(content.includes('node-pty not installed'));
+    assert.ok(content.includes('BLOCKED'));
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});
+
+test('getPeerCapsule reads all capsule files', () => {
+  const projectRoot = makeTempProject();
+  try {
+    createPeerCapsule(projectRoot, 'task-test-123', 'worker-001', {
+      runtime: 'claude',
+      taskId: 'task-test-123',
+      peerId: 'worker-001',
+    });
+
+    writePeerEvent(projectRoot, 'task-test-123', 'worker-001', { type: 'data', text: 'hello' });
+    writePeerResult(projectRoot, 'task-test-123', 'worker-001', { status: 'completed', output: 'done' });
+
+    const capsule = getPeerCapsule(projectRoot, 'task-test-123', 'worker-001');
+
+    assert.ok(capsule.request);
+    assert.equal(capsule.request.taskId, 'task-test-123');
+    assert.equal(capsule.request.peerId, 'worker-001');
+
+    assert.ok(capsule.state);
+    assert.equal(capsule.state.status, 'starting');
+
+    assert.ok(Array.isArray(capsule.events));
+    assert.equal(capsule.events.length, 1);
+    assert.equal(capsule.events[0].text, 'hello');
+
+    assert.ok(capsule.result);
+    assert.equal(capsule.result.status, 'completed');
+
+    assert.equal(capsule.progress, null); // no PROGRESS.md written
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});
+
+test('getPeerCapsule returns progress content when PROGRESS.md exists', () => {
+  const projectRoot = makeTempProject();
+  try {
+    createPeerCapsule(projectRoot, 'task-test-123', 'worker-001', {
+      runtime: 'claude',
+      taskId: 'task-test-123',
+      peerId: 'worker-001',
+    });
+
+    blockPeer(projectRoot, 'task-test-123', 'worker-001', 'block reason');
+    const capsule = getPeerCapsule(projectRoot, 'task-test-123', 'worker-001');
+
+    assert.ok(capsule.progress);
+    assert.ok(capsule.progress.includes('BLOCKED'));
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});
+
+test('getPeerCapsule for non-existent capsule returns null', () => {
+  const projectRoot = makeTempProject();
+  try {
+    const capsule = getPeerCapsule(projectRoot, 'task-nonexistent', 'no-one');
+    assert.equal(capsule, null);
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});
+
+test('path traversal in taskId is rejected', () => {
+  const projectRoot = makeTempProject();
+  try {
+    assert.throws(() => createPeerCapsule(projectRoot, '../evil', 'worker-001', {}), {
+      name: 'Error',
+    });
+    assert.throws(() => writePeerEvent(projectRoot, '../evil', 'worker-001', {}), {
+      name: 'Error',
+    });
+    assert.throws(() => getPeerCapsule(projectRoot, '../evil', 'worker-001'), {
+      name: 'Error',
+    });
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});
+
+test('path traversal in peerId is rejected', () => {
+  const projectRoot = makeTempProject();
+  try {
+    assert.throws(() => createPeerCapsule(projectRoot, 'task-valid', '../evil', {}), {
+      name: 'Error',
+    });
+    assert.throws(() => writePeerEvent(projectRoot, 'task-valid', '../evil', {}), {
+      name: 'Error',
+    });
+    assert.throws(() => getPeerCapsule(projectRoot, 'task-valid', '../evil'), {
+      name: 'Error',
+    });
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});
+
+test('validatePeerId rejects path traversal', async () => {
+  const { validatePeerId } = await import('../peer-capsule.mjs');
+  assert.equal(validatePeerId('../evil'), false);
+  assert.equal(validatePeerId('valid-peer-001'), true);
+  assert.equal(validatePeerId('peer/with/slash'), false);
+});

package/src/wf-ui-server/__tests__/pty-adapter.test.mjs

@@ -0,0 +1,70 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import { resolvePtyCommand, spawnPty } from '../pty-adapter.mjs';
+
+test('spawnPty validates runtime before any PTY operation', async () => {
+  await assert.rejects(
+    () => spawnPty({
+      runtime: 'unknown-runtime',
+      taskId: 'task-test',
+      peerId: 'unknown-001',
+      projectRoot: process.cwd(),
+      cols: 120,
+      rows: 32,
+      onData: () => {},
+      onExit: () => {},
+    }),
+    { name: 'Error' }
+  );
+});
+
+test('spawnPty with runtime fake-agent throws', async () => {
+  await assert.rejects(
+    () => spawnPty({
+      runtime: 'fake-agent',
+      taskId: 'task-test',
+      peerId: 'fake-001',
+      projectRoot: process.cwd(),
+      cols: 120,
+      rows: 32,
+      onData: () => {},
+      onExit: () => {},
+    }),
+    { name: 'Error', message: /Invalid runtime.*fake-agent/ }
+  );
+});
+
+test('spawnPty reports blocked when command path cannot be spawned', async () => {
+  const missingCommand = path.join(process.cwd(), 'missing-runtime-command.exe');
+  const result = await spawnPty({
+    runtime: 'claude',
+    taskId: 'task-test',
+    peerId: 'claude-001',
+    projectRoot: process.cwd(),
+    command: missingCommand,
+    cols: 120,
+    rows: 32,
+    onData: () => {},
+    onExit: () => {},
+  });
+
+  assert.equal(result.blocked, true);
+  assert.ok(result.reason === 'runtime-spawn-failed' || result.reason === 'pty-adapter-missing');
+  assert.ok(result.hint);
+});
+
+test('resolvePtyCommand uses split cmd call for Windows command wrappers', () => {
+  const commandPath = 'C:\\Program Files\\Harness Agents\\agent.cmd';
+  const args = ['--model', 'two words'];
+  const resolved = resolvePtyCommand(commandPath, args);
+
+  if (process.platform !== 'win32') {
+    assert.deepEqual(resolved, { executable: commandPath, args });
+    return;
+  }
+
+  assert.equal(resolved.executable, 'cmd.exe');
+  assert.deepEqual(resolved.args, ['/d', '/c', 'call', commandPath, ...args]);
+  assert.doesNotMatch(resolved.args.join('\n'), /\\"/);
+});

package/src/wf-ui-server/__tests__/runtime-config.test.mjs

@@ -0,0 +1,43 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { readRuntimeConfig, writeRuntimeConfig } from '../runtime-config.mjs';
+
+test('writeRuntimeConfig writes project JSON model fields', () => {
+  const projectRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'runtime-config-'));
+  try {
+    const result = writeRuntimeConfig(projectRoot, 'opencode', {
+      scope: 'project',
+      values: { model: 'anthropic/claude-sonnet-4' },
+    });
+    assert.equal(result.path, 'opencode.json');
+    const configPath = path.join(projectRoot, 'opencode.json');
+    assert.equal(JSON.parse(fs.readFileSync(configPath, 'utf8')).model, 'anthropic/claude-sonnet-4');
+    const readback = readRuntimeConfig(projectRoot, 'opencode');
+    assert.equal(readback.files.find(file => file.scope === 'project').values.model, 'anthropic/claude-sonnet-4');
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});
+
+test('writeRuntimeConfig writes project TOML fields and backs up existing file', () => {
+  const projectRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'runtime-config-'));
+  try {
+    const configPath = path.join(projectRoot, '.codex', 'config.toml');
+    fs.mkdirSync(path.dirname(configPath), { recursive: true });
+    fs.writeFileSync(configPath, 'model = "old-model"\n', 'utf8');
+    const result = writeRuntimeConfig(projectRoot, 'codex', {
+      scope: 'project',
+      values: { model: 'gpt-5', provider: 'openai' },
+    });
+    assert.ok(result.backupPath);
+    assert.ok(fs.existsSync(result.backupPath));
+    const text = fs.readFileSync(configPath, 'utf8');
+    assert.match(text, /model = "gpt-5"/);
+    assert.match(text, /model_provider = "openai"/);
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});

package/src/wf-ui-server/__tests__/runtime-detector.test.mjs

@@ -0,0 +1,90 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  detectRuntimes,
+  resolveRuntimeCommand,
+  resolveRuntimeLaunchArgs,
+  resolveRuntimeResumeArgs,
+  isRuntimeLaunchable,
+  RUNTIME_DEFINITIONS,
+} from '../runtime-detector.mjs';
+
+function fakeRunner(command, args) {
+  if (command === 'where.exe' || command === 'which') {
+    const found = new Set(['claude', 'cc', 'codex', 'opencode', 'openclaw', 'pi', 'deepseek-tui']);
+    const name = args[0];
+    return found.has(name)
+      ? { status: 0, stdout: `/bin/${name}\n`, stderr: '' }
+      : { status: 1, stdout: '', stderr: '' };
+  }
+  return { status: 0, stdout: `${command} 1.2.3\n`, stderr: '' };
+}
+
+test('detectRuntimes returns detected CLI runtime entries by default', () => {
+  const runtimes = detectRuntimes({ runner: fakeRunner });
+  assert.deepEqual(runtimes.map(r => r.id), ['claude', 'cc', 'codex', 'opencode', 'deepseek', 'pi', 'openclaw']);
+});
+
+test('detectRuntimes includeMissing returns the full candidate registry', () => {
+  const runtimes = detectRuntimes({ runner: () => ({ status: 1, stdout: '', stderr: '' }), includeMissing: true });
+  assert.deepEqual(runtimes.map(r => r.id), RUNTIME_DEFINITIONS.map(r => r.id));
+});
+
+test('detected terminal agents are launchable when executable exists', () => {
+  const byId = new Map(detectRuntimes({ runner: fakeRunner }).map(r => [r.id, r]));
+  for (const id of ['claude', 'cc', 'codex', 'opencode', 'openclaw', 'pi', 'deepseek']) {
+    assert.equal(byId.get(id).status, 'available');
+    assert.equal(byId.get(id).launchable, true);
+    assert.ok(byId.get(id).path);
+  }
+});
+
+test('multi-command runtime keeps the detected command', () => {
+  const byId = new Map(detectRuntimes({ runner: fakeRunner }).map(r => [r.id, r]));
+  assert.equal(byId.get('deepseek').command, 'deepseek-tui');
+});
+
+test('detectRuntimes skips version commands unless requested', () => {
+  const versionCommands = [];
+  const runner = (command, args) => {
+    if (command === 'where.exe' || command === 'which') {
+      return args[0] === 'claude'
+        ? { status: 0, stdout: '/bin/claude\n', stderr: '' }
+        : { status: 1, stdout: '', stderr: '' };
+    }
+    versionCommands.push([command, ...args].join(' '));
+    return { status: 0, stdout: `${command} 1.2.3\n`, stderr: '' };
+  };
+
+  const withoutVersion = detectRuntimes({ runner });
+  assert.equal(withoutVersion.find(runtime => runtime.id === 'claude').version, null);
+  assert.deepEqual(versionCommands, []);
+
+  const withVersion = detectRuntimes({ runner, readVersion: true });
+  assert.equal(withVersion.find(runtime => runtime.id === 'claude').version, 'claude 1.2.3');
+  assert.deepEqual(versionCommands, ['claude --version']);
+});
+
+test('missing executable returns missing status', () => {
+  const missingRunner = () => ({ status: 1, stdout: '', stderr: '' });
+  const byId = new Map(detectRuntimes({ runner: missingRunner, includeMissing: true }).map(r => [r.id, r]));
+  assert.equal(byId.get('codex').status, 'missing');
+  assert.equal(byId.get('codex').blockedReason, 'executable-not-found');
+});
+
+test('runtime launch policy is separate from command detection', () => {
+  assert.equal(isRuntimeLaunchable('codex'), true);
+  assert.equal(isRuntimeLaunchable('openclaw'), true);
+  assert.equal(resolveRuntimeCommand('cc'), 'cc');
+  assert.deepEqual(resolveRuntimeLaunchArgs('codex', { model: 'gpt-5' }), ['--model', 'gpt-5']);
+});
+
+test('resume args match installed CLI resume command shapes', () => {
+  assert.deepEqual(resolveRuntimeResumeArgs('claude', { agentSessionId: 'abc-123' }), ['--resume', 'abc-123']);
+  assert.deepEqual(resolveRuntimeResumeArgs('claude'), ['--continue']);
+  assert.deepEqual(resolveRuntimeResumeArgs('codex', { agentSessionId: 'abc-123' }), ['resume', 'abc-123']);
+  assert.deepEqual(resolveRuntimeResumeArgs('codex'), ['resume', '--last']);
+  assert.deepEqual(resolveRuntimeResumeArgs('opencode', { agentSessionId: 'abc-123' }), ['--session', 'abc-123']);
+  assert.deepEqual(resolveRuntimeResumeArgs('opencode'), ['--continue']);
+  assert.deepEqual(resolveRuntimeResumeArgs('openclaw'), []);
+});

package/src/wf-ui-server/__tests__/security.test.mjs

@@ -0,0 +1,59 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { canonicalizeProjectPath, safeResolve, validateTaskId } from '../security.mjs';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+test('canonicalizeProjectPath resolves a relative path to absolute', () => {
+  const abs = canonicalizeProjectPath('.');
+  assert.equal(typeof abs, 'string');
+  assert.ok(path.isAbsolute(abs));
+});
+
+test('canonicalizeProjectPath throws on null, undefined, and empty string', () => {
+  assert.throws(() => canonicalizeProjectPath(null), { name: 'TypeError' });
+  assert.throws(() => canonicalizeProjectPath(undefined), { name: 'TypeError' });
+  assert.throws(() => canonicalizeProjectPath(''), { name: 'Error' });
+});
+
+test('safeResolve resolves a valid relative path within base', () => {
+  const base = path.resolve('/tmp/test-base');
+  const resolved = safeResolve(base, 'sub/dir');
+  assert.equal(resolved, path.resolve(base, 'sub/dir'));
+});
+
+test('safeResolve throws on path traversal attempting to escape base', () => {
+  const base = path.resolve('/tmp/test-base');
+  assert.throws(() => safeResolve(base, '../etc/passwd'), { name: 'Error' });
+  assert.throws(() => safeResolve(base, 'sub/../../etc'), { name: 'Error' });
+});
+
+test('safeResolve throws on absolute path argument outside base', () => {
+  const base = path.resolve('/tmp/test-base');
+  assert.throws(() => safeResolve(base, '/etc/passwd'), { name: 'Error' });
+});
+
+test('safeResolve throws on null byte in path', () => {
+  const base = path.resolve('/tmp/test-base');
+  assert.throws(() => safeResolve(base, 'sub\0dir'), { name: 'Error' });
+});
+
+test('validateTaskId accepts a valid task ID', () => {
+  assert.equal(validateTaskId('task-wf-ui-control-0729'), true);
+});
+
+test('validateTaskId rejects path traversal sequences', () => {
+  assert.equal(validateTaskId('../'), false);
+  assert.equal(validateTaskId('..'), false);
+  assert.equal(validateTaskId('a/../b'), false);
+});
+
+test('validateTaskId rejects null byte in task ID', () => {
+  assert.equal(validateTaskId('task\0id'), false);
+});
+
+test('validateTaskId rejects empty string', () => {
+  assert.equal(validateTaskId(''), false);
+});