deepdebug-local-agent 1.0.22 → 1.1.0

package/test/capabilities-access.test.js

@@ -0,0 +1,47 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { isAuthorized, publicCapabilities, fullCapabilities } from '../src/siblings/capabilities.js';
+
+const MANIFEST = {
+    mode: 'SPLIT_PLANE', reason: 'partial local capability',
+    source_available: false, toolchains: ['git', 'python3'],
+    container_runtime: 'docker', docker_sock: false, egress: { gateway: true },
+    build_capable: false, test_capable: false, runtimes: [],
+};
+const STATUS = { contract_ok: false, contract_preflight: { ok: false, reason: 'missing_internal_token' }, stats: {} };
+
+const SENSITIVE = ['toolchains', 'container_runtime', 'docker_sock', 'egress', 'source_available'];
+
+test('unauthenticated view exposes health only, no topology inventory', () => {
+    const v = publicCapabilities(MANIFEST, STATUS, 42);
+    assert.equal(v.authenticated, false);
+    assert.equal(v.mode, 'SPLIT_PLANE');
+    assert.equal(v.contract.ok, false);
+    assert.equal(v.contract.preflight_reason, 'missing_internal_token'); // the C1 signal
+    assert.equal(v.uptime_s, 42);
+    for (const k of SENSITIVE) assert.ok(!(k in v), `${k} must be redacted when unauthenticated`);
+});
+
+test('authenticated view adds the client-infra inventory', () => {
+    const v = fullCapabilities(MANIFEST, STATUS, 42);
+    assert.equal(v.authenticated, true);
+    for (const k of SENSITIVE) assert.ok(k in v, `${k} must be present when authenticated`);
+    assert.deepEqual(v.toolchains, ['git', 'python3']);
+    assert.equal(v.container_runtime, 'docker');
+    // health still present
+    assert.equal(v.mode, 'SPLIT_PLANE');
+    assert.equal(v.contract.ok, false);
+});
+
+test('isAuthorized: correct bearer passes, wrong/absent fails', () => {
+    const tok = 'AGENT_API_KEY_123';
+    assert.equal(isAuthorized({ headers: { authorization: `Bearer ${tok}` } }, tok), true);
+    assert.equal(isAuthorized({ headers: { authorization: 'Bearer wrong' } }, tok), false);
+    assert.equal(isAuthorized({ headers: {} }, tok), false);
+    assert.equal(isAuthorized({ headers: { authorization: tok } }, tok), false); // missing "Bearer "
+});
+
+test('isAuthorized fails closed when no token is configured', () => {
+    assert.equal(isAuthorized({ headers: { authorization: 'Bearer anything' } }, null), false);
+    assert.equal(isAuthorized({ headers: { authorization: 'Bearer anything' } }, ''), false);
+});

package/test/capabilities.test.js

@@ -0,0 +1,87 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { buildManifest, deriveMode, computeCapabilityManifest } from '../src/siblings/capabilities.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const loadFixture = (name) =>
+    JSON.parse(fs.readFileSync(path.join(__dirname, 'fixtures', 'capabilities', name), 'utf-8'));
+
+test('pull-only Docker host derives SPLIT_PLANE, not FULL_LOCAL', () => {
+    const fx = loadFixture('pull-only-docker.json');
+    const m = buildManifest(fx);
+
+    assert.equal(m.mode, 'SPLIT_PLANE');
+    assert.notEqual(m.mode, 'FULL_LOCAL');
+    // Evidence the fixture was interpreted as intended:
+    assert.equal(m.source_available, false);
+    assert.equal(m.build_capable, false);
+    assert.equal(m.test_capable, false);
+    assert.deepEqual(m.toolchains.sort(), ['git', 'python3']);
+    assert.match(m.reason, /no source working tree/);
+});
+
+test('full toolchain + source on disk derives FULL_LOCAL', () => {
+    const m = buildManifest({
+        diag: { tools: {
+            git: { installed: true }, java: { installed: true }, maven: { installed: true },
+            node: { installed: true }, npm: { installed: true },
+        } },
+        sourceAvailable: true,
+        egress: { gateway: true },
+        conclusive: true,
+    });
+    assert.equal(m.mode, 'FULL_LOCAL');
+    assert.equal(m.build_capable, true);
+    assert.equal(m.test_capable, true);
+});
+
+test('inconclusive detection NEVER defaults to FULL_LOCAL', () => {
+    const m = buildManifest({
+        diag: { tools: { java: { installed: true }, maven: { installed: true }, git: { installed: true } } },
+        sourceAvailable: true, // even with "everything", inconclusive must degrade
+        egress: { gateway: true },
+        conclusive: false,
+    });
+    assert.equal(m.mode, 'DETECT_ONLY');
+    assert.match(m.reason, /inconclusive/);
+});
+
+test('no source, no toolchain, no git/egress derives DETECT_ONLY', () => {
+    const { mode } = deriveMode({
+        source_available: false, build_capable: false, test_capable: false,
+        hasGit: false, egress: {}, conclusive: true,
+    });
+    assert.equal(mode, 'DETECT_ONLY');
+});
+
+test('computeCapabilityManifest degrades to DETECT_ONLY when diagnostics throw', async () => {
+    const throwingDiagnostics = { diagnose: async () => { throw new Error('boom'); } };
+    const m = await computeCapabilityManifest({
+        diagnostics: throwingDiagnostics,
+        runtimeRegistry: { runtimes: new Map() },
+        probes: { sourceAvailable: true, dockerSock: false, containerRuntime: 'docker', egress: { gateway: true } },
+    });
+    assert.equal(m.mode, 'DETECT_ONLY');
+    assert.match(m.reason, /inconclusive/);
+});
+
+test('computeCapabilityManifest honours injected probes + diagnostics (pull-only)', async () => {
+    const fx = loadFixture('pull-only-docker.json');
+    const diagnostics = { diagnose: async () => fx.diag };
+    const m = await computeCapabilityManifest({
+        diagnostics,
+        runtimeRegistry: { runtimes: new Map() },
+        probes: {
+            sourceAvailable: fx.sourceAvailable,
+            dockerSock: fx.dockerSock,
+            containerRuntime: fx.containerRuntime,
+            egress: fx.egress,
+        },
+    });
+    assert.equal(m.mode, 'SPLIT_PLANE');
+    assert.equal(m.container_runtime, 'docker');
+    assert.equal(m.docker_sock, false);
+});

package/test/child-env.test.js

@@ -0,0 +1,23 @@
+// test/child-env.test.js — model-authored commands must not see the agent's secrets.
+import { test, describe } from 'node:test';
+import assert from 'node:assert/strict';
+import { sanitizedChildEnv, isSecretEnvName } from '../src/utils/child-env.js';
+
+describe('sanitizedChildEnv', () => {
+  test('strips token/secret/password/key variables, keeps the rest and extras', () => {
+    const env = {
+      PATH: '/usr/bin', HOME: '/home/x', JAVA_HOME: '/opt/java',
+      AUTH_TOKEN: 'a', DEEPDEBUG_API_KEY: 'b', AGENT_SHARED_SECRET: 'c', LOCAL_AGENT_TOKEN: 'd',
+      GITHUB_TOKEN: 'e', DB_PASSWORD: 'f', AWS_SECRET_ACCESS_KEY: 'g', LOCAL_AGENT_SIGNING_KEY: 'h',
+      GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: 'echo', UNDEFINED: undefined,
+    };
+    const out = sanitizedChildEnv(env, { FORCE_COLOR: '0' });
+    assert.deepEqual(out, { PATH: '/usr/bin', HOME: '/home/x', JAVA_HOME: '/opt/java', GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: 'echo', FORCE_COLOR: '0' });
+  });
+  test('isSecretEnvName', () => {
+    assert.equal(isSecretEnvName('NPM_TOKEN'), true);
+    assert.equal(isSecretEnvName('npm_config_registry'), false);
+    assert.equal(isSecretEnvName('GIT_SSH_COMMAND'), false);
+    assert.equal(isSecretEnvName('MAVEN_OPTS'), false);
+  });
+});

package/test/env-compat.test.js

@@ -0,0 +1,71 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { applyEnvCompat, LEGACY_MAP } = require('../src/siblings/env-compat.cjs');
+
+test('legacy fallback works when canonical is unset', () => {
+    const env = { DEEPDEBUG_API_URL: 'https://gw' };
+    const warnings = [];
+    const mapped = applyEnvCompat(env, (m) => warnings.push(m));
+    assert.equal(env.GATEWAY_URL, 'https://gw');
+    assert.deepEqual(mapped, ['GATEWAY_URL']);
+});
+
+test('canonical wins when both are set (no mapping, no warning)', () => {
+    const env = { GATEWAY_URL: 'https://canonical', DEEPDEBUG_API_URL: 'https://legacy' };
+    const warnings = [];
+    const mapped = applyEnvCompat(env, (m) => warnings.push(m));
+    assert.equal(env.GATEWAY_URL, 'https://canonical');
+    assert.equal(mapped.length, 0);
+    assert.equal(warnings.length, 0);
+});
+
+test('warning is emitted exactly once per mapped legacy var, naming it', () => {
+    const env = { DEEPDEBUG_API_URL: 'https://gw' };
+    const warnings = [];
+    applyEnvCompat(env, (m) => warnings.push(m));
+    assert.equal(warnings.length, 1);
+    assert.match(warnings[0], /DEEPDEBUG_API_URL/);
+    assert.match(warnings[0], /GATEWAY_URL/);
+    assert.match(warnings[0], /DEPRECATION/);
+});
+
+test('neither set is handled (no mapping, no warning)', () => {
+    const env = {};
+    const warnings = [];
+    const mapped = applyEnvCompat(env, (m) => warnings.push(m));
+    assert.equal(mapped.length, 0);
+    assert.equal(warnings.length, 0);
+    assert.equal(env.GATEWAY_URL, undefined);
+});
+
+test('empty-string canonical is treated as unset (legacy fills it)', () => {
+    const env = { TENANT_ID: '', DEEPDEBUG_TENANT_ID: 't-123' };
+    applyEnvCompat(env, () => {});
+    assert.equal(env.TENANT_ID, 't-123');
+});
+
+test('all three mappings apply independently, one warning each', () => {
+    const env = {
+        DEEPDEBUG_API_URL: 'https://gw',
+        DEEPDEBUG_TENANT_ID: 't-1',
+        DEEPDEBUG_WORKSPACE_PATH: '/workspace',
+    };
+    const warnings = [];
+    const mapped = applyEnvCompat(env, (m) => warnings.push(m));
+    assert.deepEqual(mapped.sort(), ['GATEWAY_URL', 'TENANT_ID', 'WORKSPACE_ROOT']);
+    assert.equal(warnings.length, 3);
+    assert.equal(env.GATEWAY_URL, 'https://gw');
+    assert.equal(env.TENANT_ID, 't-1');
+    assert.equal(env.WORKSPACE_ROOT, '/workspace');
+});
+
+test('LEGACY_MAP is the canonical 3-pair mapping', () => {
+    assert.deepEqual(LEGACY_MAP, [
+        ['DEEPDEBUG_API_URL', 'GATEWAY_URL'],
+        ['DEEPDEBUG_TENANT_ID', 'TENANT_ID'],
+        ['DEEPDEBUG_WORKSPACE_PATH', 'WORKSPACE_ROOT'],
+    ]);
+});