direxio-deployer 0.1.0 → 0.1.2

package/scripts/phases/s3_provision.sh

@@ -253,12 +253,7 @@ _route53_existing_a_value() {
   local zone_id=$1 domain=$2 records name
   name="${domain}."
   records=$(aws route53 list-resource-record-sets --hosted-zone-id "$zone_id" --output json 2>/dev/null) || return 0
-  printf '%s\n' "$records" | jq -r --arg name "$name" '
-    .ResourceRecordSets[]?
-    | select(.Name == $name and .Type == "A")
-    | [.ResourceRecords[]?.Value]
-    | join(",")
-  ' | sed -n '1p'
+  printf '%s\n' "$records" | json_stdin_route53_a_values "$name" | sed -n '1p'
 }
 
 _guard_route53_a_overwrite() {
@@ -342,7 +337,7 @@ _find_route53_zone() {
         fi
         ;;
     esac
-  done < <(printf '%s\n' "$zones_json" | jq -r '.HostedZones[] | [.Id, .Name] | @tsv')
+  done < <(printf '%s\n' "$zones_json" | json_stdin_tsv HostedZones Id Name)
   [ -n "$best_id" ] || return 1
   printf '%s\t%s\n' "$best_id" "$best_name"
 }
@@ -355,9 +350,9 @@ _create_route53_zone() {
     --name "$zone_name" \
     --caller-reference "$caller" \
     --output json) || return 1
-  zone_id=$(printf '%s\n' "$created" | jq -r '.HostedZone.Id // empty' | sed 's#^/hostedzone/##')
-  returned_name=$(printf '%s\n' "$created" | jq -r '.HostedZone.Name // empty')
-  name_servers=$(printf '%s\n' "$created" | jq -r '(.DelegationSet.NameServers // []) | join(",")')
+  zone_id=$(printf '%s\n' "$created" | json_stdin_get HostedZone.Id | sed 's#^/hostedzone/##')
+  returned_name=$(printf '%s\n' "$created" | json_stdin_get HostedZone.Name)
+  name_servers=$(printf '%s\n' "$created" | json_stdin_join DelegationSet.NameServers ",")
   [ -n "$zone_id" ] && [ -n "$returned_name" ] || return 1
 
   _record_route53_zone "$zone_id" "${returned_name%.}" true "$name_servers"

package/scripts/phases/s5_init_tokens.sh

@@ -38,8 +38,8 @@ run_phase() {
     phase_set S5_INIT_TOKENS failed "bootstrap.json missing password/access/agent credentials"
     fail "bootstrap.json must contain password as an eight-digit initialization-code string plus access_token and agent_token."
   fi
-  asurl=$(jq -r --arg domain "$domain" '.as_url // ("https://" + $domain)' "$out")
-  agent_room_id=$(jq -r '.agent_room_id // empty' "$out")
+  asurl=$(json_get "$out" as_url "https://$domain")
+  agent_room_id=$(json_get "$out" agent_room_id)
   if [ -z "$agent_room_id" ] || [[ "$agent_room_id" == \!agent:* ]]; then
     phase_set S5_INIT_TOKENS failed "bootstrap.json missing real agent_room_id"
     fail "bootstrap.json must contain a real Matrix agent_room_id; legacy !agent:<domain> ids are not supported."
@@ -59,9 +59,10 @@ run_phase() {
 
 _extract_output_tokens() {
   local out=$1 password token access_token
-  password=$(jq -r 'if (.password | type) == "string" then .password else empty end' "$out")
-  token=$(jq -r '.agent_token // empty' "$out")
-  access_token=$(jq -r '.access_token // empty' "$out")
+  [ "$(json_type "$out" password)" = "string" ] || return 1
+  password=$(json_get "$out" password)
+  token=$(json_get "$out" agent_token)
+  access_token=$(json_get "$out" access_token)
   [ -n "$password" ] && [ -n "$token" ] && [ -n "$access_token" ] || return 1
   printf '%s' "$password" | grep -Eq '^[0-9]{8}$' || return 1
   printf '%s\t%s\t%s\n' "$password" "$token" "$access_token"
@@ -91,18 +92,7 @@ _normalize_bootstrap_output() {
   local domain=$1 src=$2 out=$3
   local tmp
   tmp=$(mktemp)
-  if ! jq --arg domain "$domain" --arg asurl "https://$domain" '
-    . + {
-      domain: (.domain // $domain),
-      as_url: (.as_url // $asurl),
-      p2p_url: (.p2p_url // $asurl),
-      user_id: (.user_id // .owner_user_id // ""),
-      bot_mxid: (.bot_mxid // .owner_user_id // .user_id // ("@owner:" + $domain)),
-      access_token: (.access_token // ""),
-      agent_token: (.agent_token // ""),
-      agent_room_id: (.agent_room_id // "")
-    }
-  ' "$src" > "$tmp"; then
+  if ! json_build bootstrap-normalized "$src" "$domain" > "$tmp"; then
     rm -f "$tmp"
     return 1
   fi

package/scripts/phases/s6_wire_local.sh

@@ -572,15 +572,21 @@ _openclaw_acp_args_toml() {
   url=${DIREXIO_OPENCLAW_ACP_URL:-}
   token_file=${DIREXIO_OPENCLAW_ACP_TOKEN_FILE:-}
   session=${DIREXIO_OPENCLAW_ACP_SESSION:-}
-  [ -n "$url" ] || missing="${missing} DIREXIO_OPENCLAW_ACP_URL"
-  [ -n "$token_file" ] || missing="${missing} DIREXIO_OPENCLAW_ACP_TOKEN_FILE"
-  [ -n "$session" ] || missing="${missing} DIREXIO_OPENCLAW_ACP_SESSION"
-  if [ -n "$missing" ]; then
-    fail "OpenClaw ACP requires real Gateway settings:${missing}. Set them from the current OpenClaw runtime, or provide DIREXIO_OPENCLAW_ACP_ARGS_TOML with the complete args array."
+  if [ -n "$url" ] && [ -n "$token_file" ] && [ -n "$session" ]; then
+    token_file=$(_local_connect_path "$token_file")
+    _toml_array acp --url "$url" --token-file "$token_file" --session "$session"
+    return 0
+  fi
+  if [ -n "$url" ] || [ -n "$token_file" ]; then
+    [ -n "$url" ] || missing="${missing} DIREXIO_OPENCLAW_ACP_URL"
+    [ -n "$token_file" ] || missing="${missing} DIREXIO_OPENCLAW_ACP_TOKEN_FILE"
+    [ -n "$session" ] || missing="${missing} DIREXIO_OPENCLAW_ACP_SESSION"
+    fail "OpenClaw ACP explicit Gateway settings are incomplete:${missing}. Set all of DIREXIO_OPENCLAW_ACP_URL, DIREXIO_OPENCLAW_ACP_TOKEN_FILE, and DIREXIO_OPENCLAW_ACP_SESSION; otherwise leave URL/token-file unset so openclaw acp can auto-detect from its config."
     return 1
   fi
-  token_file=$(_local_connect_path "$token_file")
-  _toml_array acp --url "$url" --token-file "$token_file" --session "$session"
+  # Fallback: OpenClaw acp auto-discovers gateway from ~/.openclaw/openclaw.json.
+  warn "OpenClaw ACP: Gateway URL/token-file not set; using session '${session:-agent:main:main}' and letting openclaw acp auto-detect the Gateway from its config."
+  _toml_array acp --session "${session:-agent:main:main}"
 }
 
 _hermes_acp_args_toml() {
@@ -768,22 +774,7 @@ _write_mcp_json_config() {
   local path=$1 server_name=$2 command=$3 credentials_file=$4 node_id=${5:-}
   mkdir -p "$(dirname "$path")"
   umask 077
-  jq -n \
-    --arg server_name "$server_name" \
-    --arg command "$command" \
-    --arg credentials_file "$credentials_file" \
-    --arg node_id "$node_id" \
-    '{
-      mcpServers: {
-        ($server_name): {
-          command: $command,
-          env: {
-            DIREXIO_CREDENTIALS_FILE: $credentials_file,
-            DIREXIO_AGENT_NODE_ID: $node_id
-          }
-        }
-      }
-    }' > "$path"
+  json_build mcp-json-config "$server_name" "$command" "$credentials_file" "$node_id" > "$path"
   chmod 600 "$path" 2>/dev/null || true
 }
 
@@ -791,17 +782,7 @@ _write_mcp_openclaw_server_config() {
   local path=$1 command=$2 credentials_file=$3 node_id=${4:-}
   mkdir -p "$(dirname "$path")"
   umask 077
-  jq -n \
-    --arg command "$command" \
-    --arg credentials_file "$credentials_file" \
-    --arg node_id "$node_id" \
-    '{
-      command: $command,
-      env: {
-        DIREXIO_CREDENTIALS_FILE: $credentials_file,
-        DIREXIO_AGENT_NODE_ID: $node_id
-      }
-    }' > "$path"
+  json_build mcp-openclaw-server-config "$command" "$credentials_file" "$node_id" > "$path"
   chmod 600 "$path" 2>/dev/null || true
 }
 
@@ -905,7 +886,7 @@ EOF
 
 _create_cc_connect_matrix_session() {
   local asurl=$1 access_token=$2 device_id=$3 out=$4 body code http_body
-  body=$(jq -n --arg device_id "$device_id" '{action:"agent.matrix_session.create",params:{device_id:$device_id}}')
+  body=$(json_build matrix-session-create "$device_id")
   http_body=$(mktemp)
   code=$(curl -sk -o "$http_body" -w '%{http_code}' -X POST "$asurl/_p2p/command" \
     -H 'Content-Type: application/json' \
@@ -916,7 +897,7 @@ _create_cc_connect_matrix_session() {
     rm -f "$http_body"
     return 1
   fi
-  if ! jq -e '.access_token and .device_id and .user_id and .homeserver' "$http_body" >/dev/null; then
+  if ! json_assert "$http_body" matrix-session >/dev/null; then
     warn "agent.matrix_session.create response is missing Matrix session fields: $(head -c 200 "$http_body" 2>/dev/null)"
     rm -f "$http_body"
     return 1
@@ -1221,8 +1202,7 @@ _agent_node_id_matches_host() {
 _write_credentials_file() {
   local cred=$1 domain=$2 asurl=$3 token=$4 password=$5 access_token=$6 agent_room_id=$7 node_id=$8
   mkdir -p "$(dirname "$cred")"
-  jq -n --arg domain "$domain" --arg url "$asurl" --arg tok "$token" --arg password "$password" --arg access "$access_token" --arg room "$agent_room_id" --arg node_id "$node_id" \
-    '{profiles:{default:{domain:$domain,password:$password,access_token:$access,agent_room_id:$room,direxio_domain:$url,direxio_agent_token:$tok,direxio_agent_room_id:$room,direxio_agent_node_id:$node_id}}}' > "$cred"
+  json_build credentials-profile "$domain" "$asurl" "$token" "$password" "$access_token" "$agent_room_id" "$node_id" > "$cred"
   chmod 600 "$cred"
 }
 
@@ -1358,10 +1338,10 @@ run_phase() {
     phase_set S6_WIRE_LOCAL failed "agent Matrix session creation failed"
     fail "failed to create cc-connect Matrix session via agent.matrix_session.create."
   fi
-  matrix_token=$(jq -r '.access_token' "$cc_session")
-  matrix_user=$(jq -r '.user_id' "$cc_session")
-  matrix_device=$(jq -r '.device_id' "$cc_session")
-  matrix_homeserver=$(jq -r '.homeserver' "$cc_session")
+  matrix_token=$(json_get "$cc_session" access_token)
+  matrix_user=$(json_get "$cc_session" user_id)
+  matrix_device=$(json_get "$cc_session" device_id)
+  matrix_homeserver=$(json_get "$cc_session" homeserver)
   if [ "$matrix_user" = "@owner:$domain" ]; then
     phase_set S6_WIRE_LOCAL failed "agent Matrix session returned owner user"
     fail "agent.matrix_session.create returned owner Matrix user; deploy a message-server build with agent Matrix session support."

package/scripts/phases/s7_verify_e2e.sh

@@ -45,8 +45,8 @@ _check_p2p_agent_auth() {
     -X POST "https://$domain/_p2p/query" \
     -H 'Content-Type: application/json' \
     -H "Authorization: Bearer $token" \
-    -d "{\"action\":\"mcp.messages.list\",\"params\":{\"room_id\":\"$room_id\",\"limit\":1}}" 2>/dev/null)
-  if [ "$code" = "200" ] && jq -e '(.messages | type == "array") and (.room_id | type == "string")' "$body" >/dev/null 2>&1; then
+    -d "$(json_build mcp-messages-list "$room_id")" 2>/dev/null)
+  if [ "$code" = "200" ] && json_assert "$body" messages-response >/dev/null 2>&1; then
     rm -f "$body"
     ok "  ✓ _p2p/query mcp.messages.list (agent token)"
     return 0
@@ -61,7 +61,7 @@ _p2p_access_token() {
   local args=()
   while IFS= read -r arg; do args+=("$arg"); done < <(curl_resolve_args "$domain")
   at=$(curl -sk "${args[@]}" -X POST "https://$domain/_p2p/command" -H 'Content-Type: application/json' \
-        -d "{\"action\":\"portal.auth\",\"params\":{\"password\":\"$password\"}}" 2>/dev/null | jq -r '.access_token // empty')
+        -d "{\"action\":\"portal.auth\",\"params\":{\"password\":\"$password\"}}" 2>/dev/null | json_stdin_get access_token)
   printf '%s' "$at"
 }
 
@@ -97,7 +97,7 @@ _check_matrix_server_wellknown() {
   local args=()
   while IFS= read -r arg; do args+=("$arg"); done < <(curl_resolve_args "$domain")
   body=$(curl -sk "${args[@]}" "https://$domain/.well-known/matrix/server" 2>/dev/null)
-  if printf '%s' "$body" | jq -e --arg want "$domain:443" '.["m.server"] == $want' >/dev/null 2>&1; then
+  if printf '%s' "$body" | json_stdin_assert well-known-server "$domain:443" >/dev/null 2>&1; then
     ok "  ✓ matrix federation well-known ($domain:443)"; return 0
   fi
   warn "  x matrix federation well-known invalid:$(printf '%s' "$body" | head -c 120)"; return 1
@@ -128,7 +128,7 @@ _check_turn() {
   if [ -z "$at" ]; then warn "  x TURN (failed to exchange access_token; cannot verify turnServer)"; return 1; fi
   turn=$(curl -sk "${args[@]}" "https://$domain/_matrix/client/v3/voip/turnServer" \
           -H "Authorization: Bearer $at" 2>/dev/null)
-  if printf '%s' "$turn" | jq -e '(.uris|type=="array" and length>0) and (any(.uris[]; test("^turns?:"))) and (.username|tostring|length>0) and (.password|tostring|length>0) and (.ttl>0)' >/dev/null 2>&1; then
+  if printf '%s' "$turn" | json_stdin_assert turn-credentials >/dev/null 2>&1; then
     ok "  ✓ TURN turnServer non-empty and valid"; return 0
   else
     warn "  x TURN turnServer invalid/empty:$(printf '%s' "$turn" | head -c 120)"; return 1

package/scripts/pricing-estimate.sh

@@ -2,6 +2,10 @@
 # pricing-estimate.sh - estimate monthly AWS costs for a Direxio EC2 node.
 set -euo pipefail
 
+HERE=$(cd "$(dirname "$0")" && pwd)
+# shellcheck disable=SC1090
+source "$HERE/lib/json.sh"
+
 usage() {
   cat >&2 <<'EOF'
 Usage:
@@ -38,13 +42,7 @@ price_from_get_products() {
     --filters "Type=TERM_MATCH,Field=location,Value=$location" "$@" \
     --max-results 1 \
     --output json 2>/dev/null) || return 1
-  printf '%s\n' "$json" | jq -r '
-    .PriceList[0]
-    | fromjson
-    | .terms.OnDemand
-    | to_entries[0].value.priceDimensions
-    | to_entries[0].value.pricePerUnit.USD
-  ' 2>/dev/null
+  printf '%s\n' "$json" | json_stdin_price_usd 2>/dev/null
 }
 
 numeric_or_empty() {
@@ -98,7 +96,7 @@ build_estimate() {
 
   if [ -z "$location" ]; then
     status=fallback
-    warnings_json=$(jq -cn --arg w "Region is not mapped to an AWS Pricing location; using conservative fallback estimates" '$ARGS.named | [.w]')
+    warnings_json='["Region is not mapped to an AWS Pricing location; using conservative fallback estimates"]'
   fi
 
   if [ "$status" = "queried" ] && ec2_hourly=$(lookup_ec2_hourly "$location" "$instance_type"); then
@@ -126,7 +124,11 @@ build_estimate() {
   fi
 
   if [ "$status" = "fallback" ]; then
-    warnings_json=$(printf '%s\n' "$warnings_json" | jq '. + ["AWS Pricing API unavailable; using conservative fallback estimates"] | unique')
+    case "$warnings_json" in
+      *"AWS Pricing API unavailable; using conservative fallback estimates"*) ;;
+      "[]") warnings_json='["AWS Pricing API unavailable; using conservative fallback estimates"]' ;;
+      *) warnings_json=${warnings_json%]}; warnings_json="$warnings_json,\"AWS Pricing API unavailable; using conservative fallback estimates\"]" ;;
+    esac
   fi
 
   if [ "$domain_mode" = "route53" ]; then
@@ -135,71 +137,25 @@ build_estimate() {
     route53_monthly=0
   fi
 
-  jq -n \
-    --arg pricing_status "$status" \
-    --arg region "$region" \
-    --arg location "$location" \
-    --arg instance_type "$instance_type" \
-    --arg domain_mode "$domain_mode" \
-    --arg ec2_source "$ec2_source" \
-    --arg gp3_source "$gp3_source" \
-    --arg ipv4_source "$ipv4_source" \
-    --argjson warnings "$warnings_json" \
-    --argjson hours "$hours" \
-    --argjson disk_gb "$disk_gb" \
-    --argjson ec2_hourly "$ec2_hourly" \
-    --argjson ec2_monthly "$(round2 "$(awk -v h="$ec2_hourly" -v m="$hours" 'BEGIN { print h*m }')")" \
-    --argjson gp3_rate "$gp3_rate" \
-    --argjson gp3_monthly "$(round2 "$(awk -v r="$gp3_rate" -v gb="$disk_gb" 'BEGIN { print r*gb }')")" \
-    --argjson ipv4_hourly "$public_ipv4_hourly" \
-    --argjson ipv4_monthly "$(round2 "$(awk -v h="$public_ipv4_hourly" -v m="$hours" 'BEGIN { print h*m }')")" \
-    --argjson route53_monthly "$route53_monthly" '
-      def total:
-        (.components.ec2_instance.monthly_usd
-        + .components.ebs_gp3.monthly_usd
-        + .components.public_ipv4.monthly_usd
-        + .components.route53_hosted_zone.monthly_usd);
-      {
-        pricing_status: $pricing_status,
-        region: $region,
-        location: $location,
-        hours_per_month: $hours,
-        warnings: $warnings,
-        components: {
-          ec2_instance: {
-            instance_type: $instance_type,
-            hourly_usd: $ec2_hourly,
-            monthly_usd: $ec2_monthly,
-            source: $ec2_source
-          },
-          ebs_gp3: {
-            storage_gb: $disk_gb,
-            gb_month_usd: $gp3_rate,
-            monthly_usd: $gp3_monthly,
-            source: $gp3_source
-          },
-          public_ipv4: {
-            hourly_usd: $ipv4_hourly,
-            monthly_usd: $ipv4_monthly,
-            billed_even_when_attached: true,
-            source: $ipv4_source
-          },
-          route53_hosted_zone: {
-            monthly_usd: $route53_monthly,
-            included: ($domain_mode == "route53")
-          }
-        },
-        notes: [
-          "Estimate excludes data transfer, TURN relay traffic, domain registration, taxes, and AWS credit eligibility.",
-          "Public IPv4 is billed hourly by AWS even when attached to a running instance.",
-          "AWS credits may reduce charges only when the account, plan, region, and service usage are eligible; verify in AWS Billing Console."
-        ],
-        recommendations: [
-          "Set an AWS Budget or billing alert before leaving the node running.",
-          "Review AWS Billing Console after deployment and after destroy to confirm actual charges and remaining credits."
-        ]
-      } | .total_monthly_usd = ((total * 100 | round) / 100)
-    '
+  json_build pricing-estimate \
+    "$status" \
+    "$region" \
+    "$location" \
+    "$instance_type" \
+    "$domain_mode" \
+    "$ec2_source" \
+    "$gp3_source" \
+    "$ipv4_source" \
+    "$warnings_json" \
+    "$hours" \
+    "$disk_gb" \
+    "$ec2_hourly" \
+    "$(round2 "$(awk -v h="$ec2_hourly" -v m="$hours" 'BEGIN { print h*m }')")" \
+    "$gp3_rate" \
+    "$(round2 "$(awk -v r="$gp3_rate" -v gb="$disk_gb" 'BEGIN { print r*gb }')")" \
+    "$public_ipv4_hourly" \
+    "$(round2 "$(awk -v h="$public_ipv4_hourly" -v m="$hours" 'BEGIN { print h*m }')")" \
+    "$route53_monthly"
 }
 
 state=""
@@ -227,10 +183,11 @@ if [ -n "$state" ]; then
     echo "state.json not found: $state" >&2
     exit 1
   }
-  region=${region:-$(jq -r '.region // empty' "$state")}
-  instance_type=${instance_type:-$(jq -r '.instance_type // empty' "$state")}
-  domain_mode=${domain_mode:-$(jq -r '.domain_mode // "user"' "$state")}
-  disk_gb=${disk_gb:-$(jq -r '.resources.root_volume_gb // .root_volume_gb // "8"' "$state")}
+  region=${region:-$(json_get "$state" region)}
+  instance_type=${instance_type:-$(json_get "$state" instance_type)}
+  domain_mode=${domain_mode:-$(json_get "$state" domain_mode user)}
+  disk_gb=${disk_gb:-$(json_get "$state" resources.root_volume_gb)}
+  disk_gb=${disk_gb:-$(json_get "$state" root_volume_gb 8)}
 fi
 
 region=${region:-${AWS_DEFAULT_REGION:-${AWS_REGION:-}}}
@@ -249,8 +206,7 @@ if [ "$write_state" = "1" ]; then
     echo "--write-state requires --state" >&2
     exit 1
   }
-  tmp="$state.tmp.$$"
-  jq --argjson estimate "$estimate" '.cost_estimate = $estimate' "$state" > "$tmp" && mv "$tmp" "$state"
+  json_mutate "$state" set-json cost_estimate "$estimate"
 fi
 
 printf '%s\n' "$estimate"

package/tests/aws_credentials_test.sh

@@ -1,139 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT=$(cd "$(dirname "$0")/.." && pwd)
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-export HOME="$tmp/home"
-mkdir -p "$HOME"
-
-fakebin="$tmp/bin"
-mkdir -p "$fakebin"
-
-cat > "$fakebin/aws" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-printf 'aws' >> "$CALLS"
-printf ' %q' "$@" >> "$CALLS"
-printf '\n' >> "$CALLS"
-
-case "${1:-} ${2:-}" in
-  "configure get")
-    exit 1
-    ;;
-  "sts get-caller-identity")
-    profile=${AWS_PROFILE:-}
-    key=${AWS_ACCESS_KEY_ID:-}
-    if [ "$profile" = "root-profile" ] || [ "$key" = "AKIAROOTTEST" ]; then
-      arn="arn:aws:iam::123456789012:root"
-      account="123456789012"
-    else
-      arn="arn:aws:iam::123456789012:user/DirexioDeployer-20260628"
-      account="123456789012"
-    fi
-    case "$*" in
-      *"--query Arn"*) printf '%s\n' "$arn" ;;
-      *"--query Account"*) printf '%s\n' "$account" ;;
-      *) printf '{"Account":"%s","Arn":"%s"}\n' "$account" "$arn" ;;
-    esac
-    ;;
-  *)
-    echo "unexpected aws call: $*" >&2
-    exit 2
-    ;;
-esac
-EOF
-chmod 700 "$fakebin/aws"
-
-CALLS="$tmp/aws.calls"
-export CALLS
-export PATH="$fakebin:$PATH"
-export AWS_SHARED_CREDENTIALS_FILE="$tmp/aws/credentials"
-export AWS_CONFIG_FILE="$tmp/aws/config"
-
-file_mode() {
-  if stat -c '%a' "$1" >/dev/null 2>&1; then
-    stat -c '%a' "$1"
-  else
-    stat -f '%Lp' "$1"
-  fi
-}
-
-cat > "$tmp/direxio.csv" <<'CSV'
-User name,Access key ID,Secret access key
-DirexioDeployer-20260628,AKIADIREXIOTEST,SECRET_DIREXIO_VALUE
-CSV
-
-out=$(bash "$ROOT/scripts/aws-credentials.sh" import-csv "$tmp/direxio.csv" direxio-deployer ap-southeast-1)
-
-[[ "$out" == *"profile=direxio-deployer"* ]]
-[[ "$out" == *"arn:aws:iam::<account>:user/DirexioDeployer-20260628"* ]]
-if [[ "$out" == *"AKIADIREXIOTEST"* || "$out" == *"SECRET_DIREXIO_VALUE"* ]]; then
-  echo "aws-credentials output leaked credential values" >&2
-  printf '%s\n' "$out" >&2
-  exit 1
-fi
-
-grep -q '^\[direxio-deployer\]$' "$AWS_SHARED_CREDENTIALS_FILE"
-grep -q '^aws_access_key_id = AKIADIREXIOTEST$' "$AWS_SHARED_CREDENTIALS_FILE"
-grep -q '^aws_secret_access_key = SECRET_DIREXIO_VALUE$' "$AWS_SHARED_CREDENTIALS_FILE"
-grep -q '^\[profile direxio-deployer\]$' "$AWS_CONFIG_FILE"
-grep -q '^region = ap-southeast-1$' "$AWS_CONFIG_FILE"
-
-credential_perm=$(file_mode "$AWS_SHARED_CREDENTIALS_FILE")
-config_perm=$(file_mode "$AWS_CONFIG_FILE")
-case "$(uname -s)" in
-  MINGW*|MSYS*|CYGWIN*)
-    [[ "$credential_perm" == "600" || "$credential_perm" == "644" ]]
-    [[ "$config_perm" == "600" || "$config_perm" == "644" ]]
-    ;;
-  *)
-    [ "$credential_perm" = "600" ]
-    [ "$config_perm" = "600" ]
-    ;;
-esac
-
-verify_out=$(AWS_PROFILE=direxio-deployer bash "$ROOT/scripts/aws-credentials.sh" verify direxio-deployer)
-[[ "$verify_out" == *"profile=direxio-deployer"* ]]
-[[ "$verify_out" == *"root=false"* ]]
-
-cat > "$tmp/root.csv" <<'CSV'
-Access key ID,Secret access key
-AKIAROOTTEST,SECRET_ROOT_VALUE
-CSV
-
-root_out=$(bash "$ROOT/scripts/aws-credentials.sh" import-csv "$tmp/root.csv" root-profile us-east-1)
-[[ "$root_out" == *"profile=root-profile"* ]]
-[[ "$root_out" == *"root=true"* ]]
-if [[ "$root_out" == *"AKIAROOTTEST"* || "$root_out" == *"SECRET_ROOT_VALUE"* ]]; then
-  echo "aws-credentials root output leaked credential values" >&2
-  printf '%s\n' "$root_out" >&2
-  exit 1
-fi
-grep -q '^\[root-profile\]$' "$AWS_SHARED_CREDENTIALS_FILE"
-grep -q '^aws_access_key_id = AKIAROOTTEST$' "$AWS_SHARED_CREDENTIALS_FILE"
-grep -q '^aws_secret_access_key = SECRET_ROOT_VALUE$' "$AWS_SHARED_CREDENTIALS_FILE"
-
-root_verify_out=$(AWS_PROFILE=root-profile bash "$ROOT/scripts/aws-credentials.sh" verify root-profile)
-[[ "$root_verify_out" == *"profile=root-profile"* ]]
-[[ "$root_verify_out" == *"root=true"* ]]
-
-set +e
-s0_output=$(
-  P2P_WORKDIR="$tmp/state-root" AWS_PROFILE=root-profile bash -c '
-    set -uo pipefail
-    cd "$1"
-    source scripts/lib/state.sh
-    state_init >/dev/null 2>&1
-    source scripts/lib/aws.sh
-    source scripts/phases/s0_prereq_aws.sh
-    run_phase
-  ' _ "$ROOT" 2>&1
-)
-s0_rc=$?
-set -e
-[ "$s0_rc" -eq 0 ]
-[[ "$s0_output" == *"AWS credentials are valid"* ]]
-
-echo "aws credentials ok"

package/tests/connect_daemon_runtime_check_test.sh

@@ -1,120 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT=$(cd "$(dirname "$0")/.." && pwd)
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-export HOME="$tmp/home"
-mkdir -p "$HOME"
-
-fakebin="$tmp/bin"
-mkdir -p "$fakebin"
-cat > "$fakebin/direxio-connect" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-
-if [ "${1:-}" = "daemon" ] && [ "${2:-}" = "logs" ]; then
-  [ "${3:-}" = "--service-name" ]
-  [ "${4:-}" = "connect-check.example.test" ]
-  printf '%s\n' "${CONNECT_LOG_OUTPUT:-}"
-  exit 0
-fi
-
-[ "${1:-}" = "daemon" ]
-[ "${2:-}" = "status" ]
-[ "${3:-}" = "--service-name" ]
-[ "${4:-}" = "connect-check.example.test" ]
-
-cat <<STATUS
-cc-connect daemon status
-
-  Status:    ${CONNECT_STATUS:-Running}
-  Platform:  test
-  WorkDir:   ${CONNECT_WORK_DIR:-}
-STATUS
-EOF
-chmod 700 "$fakebin/direxio-connect"
-
-service_dir="$HOME/.direxio/nodes/connect-check.example.test"
-mkdir -p "$service_dir/cc-connect"
-config="$service_dir/cc-connect/config.toml"
-: > "$config"
-state="$service_dir/state.json"
-jq -n \
-  --arg service_dir "$service_dir" \
-  --arg config "$config" \
-  '{
-    run_id: "connect-daemon-test",
-    region: "ap-northeast-1",
-    domain_mode: "user",
-    domain: "connect-check.example.test",
-    agent_service_id: "connect-check.example.test",
-    agent_service_dir: $service_dir,
-    cc_connect_config: $config,
-    cc_connect_binary: "direxio-connect",
-    phase: "S7_VERIFY_E2E",
-    phases: {
-      S0_PREREQ_AWS: {status: "done"},
-      S1_PREFLIGHT: {status: "done"},
-      S2_DOMAIN: {status: "done"},
-      S3_PROVISION: {status: "done"},
-      S4_BOOTSTRAP_STACK: {status: "done"},
-      S5_INIT_TOKENS: {status: "done"},
-      S6_WIRE_LOCAL: {status: "done"},
-      S7_VERIFY_E2E: {status: "done"}
-    },
-    resources: {}
-  }' > "$state"
-
-verify_output=$(P2P_WORKDIR="$service_dir" PATH="$fakebin:$PATH" CONNECT_WORK_DIR="$service_dir/cc-connect" bash "$ROOT/scripts/orchestrate.sh" verify connect_daemon)
-printf '%s\n' "$verify_output" | grep -q 'verified runtime check: connect_daemon'
-
-expected_work_dir="$service_dir/cc-connect"
-if command -v cygpath >/dev/null 2>&1; then
-  expected_work_dir=$(cygpath -m "$expected_work_dir")
-fi
-
-jq -e '
-  .runtime_checks.connect_daemon.status == "passed"
-  and .runtime_checks.connect_daemon.service_name == "connect-check.example.test"
-  and .runtime_checks.connect_daemon.daemon_status == "Running"
-  and .runtime_checks.connect_daemon.work_dir == "'"$expected_work_dir"'"
-  and (.user_confirmations.agent_mcp_runtime | not)
-' "$state" >/dev/null
-
-set +e
-P2P_WORKDIR="$service_dir" PATH="$fakebin:$PATH" CONNECT_WORK_DIR="$service_dir/cc-connect" CONNECT_LOG_OUTPUT='ACP error (ACP_SESSION_INIT_FAILED): ACP metadata is missing for agent:main:acp:a18569b4-1f24-4f8a-aec6-f6a54530d50e. Recreate this ACP session with /acp spawn and rebind the thread.' bash "$ROOT/scripts/orchestrate.sh" verify connect_daemon > "$tmp/acp-error.out" 2>&1
-acp_rc=$?
-set -e
-[ "$acp_rc" -ne 0 ] || {
-  echo "connect daemon check must fail when daemon logs show ACP session init failure" >&2
-  exit 1
-}
-jq -e '
-  .runtime_checks.connect_daemon.status == "failed"
-  and (.runtime_checks.connect_daemon.evidence | contains("ACP session initialization failure"))
-  and (.runtime_checks.connect_daemon.agent_error | contains("ACP_SESSION_INIT_FAILED"))
-' "$state" >/dev/null
-
-report_output=$(P2P_WORKDIR="$service_dir" bash "$ROOT/scripts/orchestrate.sh" report new_deploy)
-report_path=$(printf '%s\n' "$report_output" | sed -nE 's/^operation report: //p' | tail -n 1)
-jq -e '
-  .runtime_checks.connect_daemon.status == "failed"
-  and .gates.user_confirmation.agent_mcp_runtime == "pending_runtime_confirmation"
-' "$report_path" >/dev/null
-
-set +e
-P2P_WORKDIR="$service_dir" PATH="$fakebin:$PATH" CONNECT_WORK_DIR="$HOME/.direxio/nodes/other.example.test/cc-connect" bash "$ROOT/scripts/orchestrate.sh" verify connect_daemon > "$tmp/wrong.out" 2>&1
-wrong_rc=$?
-set -e
-[ "$wrong_rc" -ne 0 ] || {
-  echo "connect daemon check must fail when daemon WorkDir belongs to another service" >&2
-  exit 1
-}
-jq -e '
-  .runtime_checks.connect_daemon.status == "failed"
-  and (.runtime_checks.connect_daemon.evidence | contains("different service"))
-' "$state" >/dev/null
-
-echo "connect daemon runtime check ok"