cue-ai 0.5.0 → 0.7.0

package/src/lib/credentials-sync.test.ts

@@ -0,0 +1,208 @@
+import { describe, expect, test, beforeEach, afterEach } from "bun:test";
+import { mkdtemp, mkdir, writeFile, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { findFreshestCredentials, syncFreshestToSource } from "./credentials-sync";
+
+let root: string;
+beforeEach(async () => { root = await mkdtemp(join(tmpdir(), "cue-credsync-")); });
+afterEach(async () => { await rm(root, { recursive: true, force: true }); });
+
+const UUID_A = "aaaaaaaa-1111-2222-3333-444444444444";
+const UUID_B = "bbbbbbbb-5555-6666-7777-888888888888";
+
+interface Creds {
+  accessToken?: string;
+  refreshToken: string;
+  expiresAt: number;
+}
+
+async function writeAccountDir(dir: string, uuid: string | undefined, creds: Creds | undefined): Promise<void> {
+  await mkdir(dir, { recursive: true });
+  if (uuid) {
+    await writeFile(
+      join(dir, ".claude.json"),
+      JSON.stringify({ oauthAccount: { accountUuid: uuid, emailAddress: "u@example.com" } }),
+    );
+  }
+  if (creds) {
+    await writeFile(
+      join(dir, ".credentials.json"),
+      JSON.stringify({ claudeAiOauth: { accessToken: "at-" + creds.refreshToken, ...creds } }),
+    );
+  }
+}
+
+describe("findFreshestCredentials", () => {
+  test("returns undefined when no credentials exist anywhere", async () => {
+    const sourceDir = join(root, "source");
+    await mkdir(sourceDir, { recursive: true });
+    const out = await findFreshestCredentials(sourceDir, join(root, "runtime"));
+    expect(out).toBeUndefined();
+  });
+
+  test("returns source when source has the highest expiresAt", async () => {
+    const sourceDir = join(root, "source");
+    await writeAccountDir(sourceDir, UUID_A, { refreshToken: "rt-source", expiresAt: 9999 });
+
+    await writeAccountDir(
+      join(root, "runtime", "old", "claude"),
+      UUID_A,
+      { refreshToken: "rt-old", expiresAt: 1000 },
+    );
+
+    const out = await findFreshestCredentials(sourceDir, join(root, "runtime"));
+    expect(out).toBeDefined();
+    expect(out!.path).toBe(join(sourceDir, ".credentials.json"));
+    expect(out!.expiresAt).toBe(9999);
+  });
+
+  test("returns sibling runtime when it has a higher expiresAt than source", async () => {
+    const sourceDir = join(root, "source");
+    await writeAccountDir(sourceDir, UUID_A, { refreshToken: "rt-stale", expiresAt: 1000 });
+
+    const freshRuntime = join(root, "runtime", "core", "claude");
+    await writeAccountDir(freshRuntime, UUID_A, { refreshToken: "rt-fresh", expiresAt: 5000 });
+
+    const out = await findFreshestCredentials(sourceDir, join(root, "runtime"));
+    expect(out).toBeDefined();
+    expect(out!.path).toBe(join(freshRuntime, ".credentials.json"));
+    expect(out!.refreshToken).toBe("rt-fresh");
+  });
+
+  test("ignores runtime profiles with a different accountUuid", async () => {
+    const sourceDir = join(root, "source");
+    await writeAccountDir(sourceDir, UUID_A, { refreshToken: "rt-source", expiresAt: 1000 });
+
+    // Different account — must NOT be picked even though it has a higher expiresAt.
+    await writeAccountDir(
+      join(root, "runtime", "other-acct", "claude"),
+      UUID_B,
+      { refreshToken: "rt-other-account", expiresAt: 9999 },
+    );
+
+    // Same account — should be picked.
+    await writeAccountDir(
+      join(root, "runtime", "same-acct", "claude"),
+      UUID_A,
+      { refreshToken: "rt-same-account", expiresAt: 5000 },
+    );
+
+    const out = await findFreshestCredentials(sourceDir, join(root, "runtime"));
+    expect(out).toBeDefined();
+    expect(out!.refreshToken).toBe("rt-same-account");
+  });
+
+  test("skips runtime files with empty refresh tokens", async () => {
+    const sourceDir = join(root, "source");
+    await writeAccountDir(sourceDir, UUID_A, { refreshToken: "rt-source", expiresAt: 1000 });
+
+    // Higher expiresAt but empty refreshToken — must be skipped.
+    await writeAccountDir(
+      join(root, "runtime", "broken", "claude"),
+      UUID_A,
+      { refreshToken: "", expiresAt: 9999 },
+    );
+
+    const out = await findFreshestCredentials(sourceDir, join(root, "runtime"));
+    expect(out!.path).toBe(join(sourceDir, ".credentials.json"));
+  });
+
+  // Regression: runtime dirs whose `.credentials.json` is a symlink into a
+  // *different* account's source (cue used to symlink shared state) and which
+  // therefore have no local `.claude.json` to identify the account. Without a
+  // strict uuid match we'd cross-contaminate (account1's source got account2's
+  // tokens during the v1 heal — this test pins the fix).
+  test("skips candidates with no .claude.json even if they have credentials", async () => {
+    const sourceDir = join(root, "source");
+    await writeAccountDir(sourceDir, UUID_A, { refreshToken: "rt-A", expiresAt: 1000 });
+
+    // Runtime dir without a .claude.json but with .credentials.json that
+    // happens to belong to account B (e.g. a symlink into account B's storage).
+    const dangerous = join(root, "runtime", "no-uuid", "claude");
+    await writeAccountDir(dangerous, undefined, { refreshToken: "rt-B-stolen", expiresAt: 9999 });
+
+    const out = await findFreshestCredentials(sourceDir, join(root, "runtime"));
+    expect(out!.path).toBe(join(sourceDir, ".credentials.json"));
+    expect(out!.refreshToken).toBe("rt-A");
+  });
+
+  test("returns source-only when source has no .claude.json (unknown target uuid)", async () => {
+    const sourceDir = join(root, "source");
+    // No .claude.json — uuid is unknown.
+    await writeAccountDir(sourceDir, undefined, { refreshToken: "rt-source", expiresAt: 1000 });
+
+    // Runtime has fresher creds for some account, but we shouldn't trust them
+    // when we can't verify the source's identity.
+    await writeAccountDir(
+      join(root, "runtime", "any", "claude"),
+      UUID_A,
+      { refreshToken: "rt-runtime", expiresAt: 9999 },
+    );
+
+    const out = await findFreshestCredentials(sourceDir, join(root, "runtime"));
+    expect(out!.path).toBe(join(sourceDir, ".credentials.json"));
+    expect(out!.refreshToken).toBe("rt-source");
+  });
+});
+
+describe("syncFreshestToSource", () => {
+  test("copies freshest sibling into source when source is stale", async () => {
+    const sourceDir = join(root, "source");
+    await writeAccountDir(sourceDir, UUID_A, { refreshToken: "rt-stale", expiresAt: 1000 });
+
+    await writeAccountDir(
+      join(root, "runtime", "core", "claude"),
+      UUID_A,
+      { refreshToken: "rt-fresh", expiresAt: 5000 },
+    );
+
+    const result = await syncFreshestToSource(sourceDir, join(root, "runtime"));
+    expect(result.synced).toBe(true);
+
+    const after = JSON.parse(await readFile(join(sourceDir, ".credentials.json"), "utf8"));
+    expect(after.claudeAiOauth.refreshToken).toBe("rt-fresh");
+    expect(after.claudeAiOauth.expiresAt).toBe(5000);
+  });
+
+  test("does not write when source is already freshest", async () => {
+    const sourceDir = join(root, "source");
+    await writeAccountDir(sourceDir, UUID_A, { refreshToken: "rt-source", expiresAt: 9999 });
+    await writeAccountDir(
+      join(root, "runtime", "old", "claude"),
+      UUID_A,
+      { refreshToken: "rt-old", expiresAt: 1000 },
+    );
+
+    const result = await syncFreshestToSource(sourceDir, join(root, "runtime"));
+    expect(result.synced).toBe(false);
+
+    const after = JSON.parse(await readFile(join(sourceDir, ".credentials.json"), "utf8"));
+    expect(after.claudeAiOauth.refreshToken).toBe("rt-source");
+  });
+
+  test("does nothing when no credentials exist at all", async () => {
+    const sourceDir = join(root, "source");
+    await mkdir(sourceDir, { recursive: true });
+    const result = await syncFreshestToSource(sourceDir, join(root, "runtime"));
+    expect(result.synced).toBe(false);
+  });
+
+  test("does not cross-contaminate across accountUuids", async () => {
+    const sourceDir = join(root, "source");
+    await writeAccountDir(sourceDir, UUID_A, { refreshToken: "rt-A", expiresAt: 1000 });
+    // Different account, much fresher — must NOT overwrite source.
+    await writeAccountDir(
+      join(root, "runtime", "other", "claude"),
+      UUID_B,
+      { refreshToken: "rt-B", expiresAt: 9999 },
+    );
+
+    const result = await syncFreshestToSource(sourceDir, join(root, "runtime"));
+    expect(result.synced).toBe(false);
+
+    const after = JSON.parse(await readFile(join(sourceDir, ".credentials.json"), "utf8"));
+    expect(after.claudeAiOauth.refreshToken).toBe("rt-A");
+  });
+});

package/src/lib/credentials-sync.ts

@@ -0,0 +1,205 @@
+/**
+ * credentials-sync — heal OAuth refresh-token rotation desync between an
+ * authmux account snapshot (`~/.claude-accounts/<name>/.credentials.json`)
+ * and the per-profile cue runtimes (`~/.config/cue/runtime/<profile>/claude/`).
+ *
+ * The problem
+ * -----------
+ * Anthropic's OAuth rotates the refresh token on every refresh. cue
+ * materializes a separate `.credentials.json` per profile (so concurrent
+ * sessions don't clobber each other's session state). When profile A
+ * refreshes mid-session, the previous refresh token is revoked — meaning
+ * every other profile's copy (and the source snapshot) now holds a dead
+ * refresh token. Spinning up a new profile from that stale source forces
+ * the user to re-login.
+ *
+ * The fix
+ * -------
+ * Before materialization, scan the source dir + every existing runtime
+ * `<profile>/claude/.credentials.json` belonging to the same `accountUuid`,
+ * pick the one with the highest `expiresAt`, and copy it back to the source
+ * so the materializer's overlay step sees fresh tokens.
+ *
+ * Pure surface — caller injects fs-rooted paths so this is testable without
+ * touching `~/`.
+ */
+
+import { readFile, readdir, copyFile, stat } from "node:fs/promises";
+import { join } from "node:path";
+
+interface CredentialsBlob {
+  claudeAiOauth?: {
+    accessToken?: string;
+    refreshToken?: string;
+    expiresAt?: number;
+    scopes?: string[];
+  };
+}
+
+interface ClaudeJsonBlob {
+  oauthAccount?: {
+    accountUuid?: string;
+    emailAddress?: string;
+  };
+}
+
+export interface FreshestCandidate {
+  path: string;
+  expiresAt: number;
+  refreshToken: string;
+  accountUuid: string | undefined;
+}
+
+/**
+ * Read the `accountUuid` recorded in `<dir>/.claude.json`. Returns undefined
+ * if the file is missing or doesn't have the OAuth metadata.
+ */
+async function readAccountUuid(dir: string): Promise<string | undefined> {
+  try {
+    const raw = await readFile(join(dir, ".claude.json"), "utf8");
+    const parsed = JSON.parse(raw) as ClaudeJsonBlob;
+    return parsed?.oauthAccount?.accountUuid;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Read `<dir>/.credentials.json` and return the fields we care about.
+ * Returns undefined if the file is missing or unparseable.
+ */
+async function readCredentials(dir: string): Promise<FreshestCandidate | undefined> {
+  const path = join(dir, ".credentials.json");
+  try {
+    const raw = await readFile(path, "utf8");
+    const parsed = JSON.parse(raw) as CredentialsBlob;
+    const oauth = parsed?.claudeAiOauth;
+    if (!oauth) return undefined;
+    return {
+      path,
+      expiresAt: typeof oauth.expiresAt === "number" ? oauth.expiresAt : 0,
+      refreshToken: typeof oauth.refreshToken === "string" ? oauth.refreshToken : "",
+      accountUuid: await readAccountUuid(dir),
+    };
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Walk `<runtimeRoot>/<profile>/claude/` for every existing profile and
+ * collect candidates whose `accountUuid` matches `targetUuid`.
+ *
+ * Strictness rules (keep these — they prevent cross-account contamination):
+ *   1. If `targetUuid` is known, the candidate's accountUuid MUST match it.
+ *      A candidate with no `.claude.json` (undefined accountUuid) is skipped:
+ *      its `.credentials.json` could be a symlink pointing back into a
+ *      different account's source dir, and we have no way to verify it
+ *      belongs to the target account.
+ *   2. If `targetUuid` is unknown (the source dir has no `.claude.json` —
+ *      e.g. a fresh, empty profile), we conservatively return [] rather
+ *      than mixing tokens from random accounts. Caller falls back to source.
+ */
+async function collectRuntimeCandidates(
+  runtimeRoot: string,
+  targetUuid: string | undefined,
+): Promise<FreshestCandidate[]> {
+  if (!targetUuid) return [];
+
+  let dirs: string[];
+  try {
+    dirs = await readdir(runtimeRoot);
+  } catch {
+    return [];
+  }
+
+  const out: FreshestCandidate[] = [];
+  for (const profile of dirs) {
+    const claudeDir = join(runtimeRoot, profile, "claude");
+    try {
+      const st = await stat(claudeDir);
+      if (!st.isDirectory()) continue;
+    } catch {
+      continue;
+    }
+    const cand = await readCredentials(claudeDir);
+    if (!cand) continue;
+    // Strict uuid match — must equal the target. Undefined uuids are treated
+    // as "unknown account" and skipped because the credentials file may be
+    // a symlink pointing into a different account's storage.
+    if (cand.accountUuid !== targetUuid) continue;
+    if (cand.refreshToken.length === 0) continue;
+    out.push(cand);
+  }
+  return out;
+}
+
+/**
+ * Find the freshest `.credentials.json` for the account anchored at
+ * `sourceDir`. Looks in:
+ *   - sourceDir itself
+ *   - every `<runtimeRoot>/<profile>/claude/` whose `.claude.json` reports
+ *     the same accountUuid as sourceDir
+ *
+ * Returns the candidate with the highest `expiresAt`, or undefined if no
+ * usable candidates exist (no creds anywhere — caller falls back to source
+ * which the materializer already handles).
+ */
+export async function findFreshestCredentials(
+  sourceDir: string,
+  runtimeRoot: string,
+): Promise<FreshestCandidate | undefined> {
+  const targetUuid = await readAccountUuid(sourceDir);
+  const candidates: FreshestCandidate[] = [];
+
+  const sourceCand = await readCredentials(sourceDir);
+  if (sourceCand) candidates.push(sourceCand);
+
+  const runtimeCands = await collectRuntimeCandidates(runtimeRoot, targetUuid);
+  candidates.push(...runtimeCands);
+
+  if (candidates.length === 0) return undefined;
+
+  candidates.sort((a, b) => b.expiresAt - a.expiresAt);
+  return candidates[0];
+}
+
+/**
+ * If the freshest credential blob lives somewhere other than `sourceDir`,
+ * copy it back to source so the next materialize step picks up live tokens.
+ *
+ * Returns:
+ *   - { synced: true,  from } when source was healed
+ *   - { synced: false } when source was already freshest (or no candidates)
+ *
+ * Failures are swallowed and reported as `synced: false` — this is a
+ * best-effort heal. Materialization will still proceed.
+ */
+export async function syncFreshestToSource(
+  sourceDir: string,
+  runtimeRoot: string,
+): Promise<{ synced: false } | { synced: true; from: string; expiresAt: number }> {
+  const freshest = await findFreshestCredentials(sourceDir, runtimeRoot);
+  if (!freshest) return { synced: false };
+
+  const sourcePath = join(sourceDir, ".credentials.json");
+  if (freshest.path === sourcePath) return { synced: false };
+
+  // Only copy if the freshest candidate is *strictly* newer than source.
+  // Equal expiresAt → keep source untouched (no benefit, avoids needless writes).
+  let sourceExpiresAt = 0;
+  try {
+    const raw = await readFile(sourcePath, "utf8");
+    const parsed = JSON.parse(raw) as CredentialsBlob;
+    sourceExpiresAt = parsed?.claudeAiOauth?.expiresAt ?? 0;
+  } catch { /* missing — anything is better */ }
+
+  if (freshest.expiresAt <= sourceExpiresAt) return { synced: false };
+
+  try {
+    await copyFile(freshest.path, sourcePath);
+    return { synced: true, from: freshest.path, expiresAt: freshest.expiresAt };
+  } catch {
+    return { synced: false };
+  }
+}

package/src/lib/mcp-materializer.test.ts

@@ -115,7 +115,7 @@ function makeProfile(
 // ---------------------------------------------------------------------------
 
 beforeEach(async () => {
-  configsRoot = await mkdtemp(join(tmpdir(), "soul-mcp-mat-"));
+  configsRoot = await mkdtemp(join(tmpdir(), "cue-mcp-mat-"));
   await mkdir(configsRoot, { recursive: true });
   await writeFixtures(configsRoot);
 });

package/src/lib/persona-playbooks.test.ts

@@ -0,0 +1,111 @@
+/**
+ * Tests for the Phase 1+2 schema extensions (persona, playbooks, qualityGates, evals).
+ * Verifies profile-loader merge semantics and runtime-materializer output without
+ * needing real npx skills or live MCP servers.
+ */
+
+import { describe, expect, test, beforeEach, afterEach } from "bun:test";
+import { mkdtempSync, rmSync, readFileSync, readlinkSync, existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { materializeRuntime } from "./runtime-materializer";
+import type { ResolvedProfile } from "../../profiles/_types";
+
+let root: string;
+beforeEach(async () => { root = mkdtempSync(join(tmpdir(), "cue-persona-")); });
+afterEach(async () => { try { rmSync(root, { recursive: true, force: true }); } catch {} });
+
+const base: ResolvedProfile = {
+  name: "test-persona", description: "test profile",
+  agents: ["claude-code"], inheritanceChain: ["test-persona"],
+  skills: { local: [], npx: [] },
+  mcps: [], plugins: [], env: {},
+  rules: [], commands: [], hooks: [],
+  persona: "", playbooks: [], qualityGates: [], evals: [],
+};
+
+describe("Phase 1: persona injection", () => {
+  test("when persona is set, it appears as '## Your Expertise' above '## Your Role' in CLAUDE.md", async () => {
+    const profile: ResolvedProfile = {
+      ...base,
+      persona: "You're a senior Rust engineer. You default to safety.",
+    };
+    const out = await materializeRuntime({
+      profile, agent: "claude-code", runtimeRoot: join(root, "runtime"),
+      skillSourceLookup: async (id) => `/fake/${id}`,
+      mcpRegistry: {}, userClaudeMd: "",
+    });
+    const md = readFileSync(join(out.runtimeDir, "CLAUDE.md"), "utf8");
+    expect(md).toContain("## Your Expertise");
+    expect(md).toContain("senior Rust engineer");
+    // Ordering: persona before role
+    const expertiseIdx = md.indexOf("## Your Expertise");
+    const roleIdx = md.indexOf("## Your Role");
+    expect(expertiseIdx).toBeGreaterThan(0);
+    expect(roleIdx).toBeGreaterThan(expertiseIdx);
+  });
+
+  test("when persona is empty, '## Your Expertise' is omitted (backwards-compat)", async () => {
+    const out = await materializeRuntime({
+      profile: base, agent: "claude-code", runtimeRoot: join(root, "runtime"),
+      skillSourceLookup: async (id) => `/fake/${id}`,
+      mcpRegistry: {}, userClaudeMd: "",
+    });
+    const md = readFileSync(join(out.runtimeDir, "CLAUDE.md"), "utf8");
+    expect(md).not.toContain("## Your Expertise");
+    expect(md).toContain("## Your Role");
+  });
+});
+
+describe("Phase 2: playbooks symlink + index", () => {
+  test("playbook refs are symlinked into <runtime>/playbooks/ and indexed in CLAUDE.md", async () => {
+    const profile: ResolvedProfile = {
+      ...base,
+      playbooks: ["ship-feature", "triage-bug"],
+    };
+    const out = await materializeRuntime({
+      profile, agent: "claude-code", runtimeRoot: join(root, "runtime"),
+      skillSourceLookup: async (id) => `/fake/${id}`,
+      mcpRegistry: {}, userClaudeMd: "",
+    });
+    const link = readlinkSync(join(out.runtimeDir, "playbooks", "ship-feature.md"));
+    expect(link).toContain("resources/playbooks/ship-feature.md");
+    const md = readFileSync(join(out.runtimeDir, "CLAUDE.md"), "utf8");
+    expect(md).toContain("## Playbooks (2)");
+    expect(md).toContain("`playbooks/ship-feature.md`");
+    expect(md).toContain("`playbooks/triage-bug.md`");
+  });
+
+  test("missing playbook ref is non-fatal (skipped silently)", async () => {
+    const profile: ResolvedProfile = {
+      ...base, playbooks: ["definitely-not-a-real-playbook"],
+    };
+    const out = await materializeRuntime({
+      profile, agent: "claude-code", runtimeRoot: join(root, "runtime"),
+      skillSourceLookup: async (id) => `/fake/${id}`,
+      mcpRegistry: {}, userClaudeMd: "",
+    });
+    expect(out.rebuilt).toBe(true);
+    // dir gets created but with no symlinks
+    expect(existsSync(join(out.runtimeDir, "playbooks"))).toBe(true);
+  });
+});
+
+describe("Phase 3: quality gates symlink + CLAUDE.md mention", () => {
+  test("gate refs are symlinked and mentioned in '## Quality Gates' block", async () => {
+    const profile: ResolvedProfile = {
+      ...base, qualityGates: ["tests-pass.sh"],
+    };
+    const out = await materializeRuntime({
+      profile, agent: "claude-code", runtimeRoot: join(root, "runtime"),
+      skillSourceLookup: async (id) => `/fake/${id}`,
+      mcpRegistry: {}, userClaudeMd: "",
+    });
+    const link = readlinkSync(join(out.runtimeDir, "quality-gates", "tests-pass.sh"));
+    expect(link).toContain("resources/quality-gates/tests-pass.sh");
+    const md = readFileSync(join(out.runtimeDir, "CLAUDE.md"), "utf8");
+    expect(md).toContain("## Quality Gates");
+    expect(md).toContain("`tests-pass.sh`");
+  });
+});