direxio-deployer 0.1.0 → 0.1.2

package/tests/mcp_tools_runtime_check_test.sh

@@ -1,123 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT=$(cd "$(dirname "$0")/.." && pwd)
-tmp=$(mktemp -d "$ROOT/.tmp-mcp-tools.XXXXXX")
-trap 'rm -rf "$tmp"' EXIT
-
-export HOME="$tmp/home"
-mkdir -p "$HOME"
-
-fakebin="$tmp/bin"
-mkdir -p "$fakebin"
-
-windows_path() {
-  local path=$1 drive rest
-  case "$path" in
-    /mnt/[A-Za-z]/*)
-      drive=${path#/mnt/}
-      drive=${drive%%/*}
-      rest=${path#/mnt/$drive/}
-      printf '%s:\\%s\n' "$(printf '%s' "$drive" | tr '[:lower:]' '[:upper:]')" "$(printf '%s' "$rest" | sed 's#/#\\#g')"
-      ;;
-    /[A-Za-z]/*)
-      drive=${path#/}
-      drive=${drive%%/*}
-      rest=${path#/$drive/}
-      printf '%s:\\%s\n' "$(printf '%s' "$drive" | tr '[:lower:]' '[:upper:]')" "$(printf '%s' "$rest" | sed 's#/#\\#g')"
-      ;;
-    *) printf '%s\n' "$path" ;;
-  esac
-}
-
-cat > "$fakebin/direxio-mcp" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-if [ "${DIREXIO_CREDENTIALS_FILE:-}" != "${EXPECTED_CREDENTIALS_FILE:-}" ]; then
-  echo "wrong DIREXIO_CREDENTIALS_FILE" >&2
-  exit 1
-fi
-
-printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{"tools":{}},"serverInfo":{"name":"fake-direxio-mcp","version":"0.0.0"}}}'
-printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"search_rooms","description":"Search rooms"},{"name":"send_message","description":"Send message"},{"name":"list_messages","description":"List messages"}]}}'
-EOF
-chmod 700 "$fakebin/direxio-mcp"
-
-cat > "$tmp/fake-mcp.ps1" <<'EOF'
-if ($env:DIREXIO_CREDENTIALS_FILE -ne $env:EXPECTED_CREDENTIALS_FILE) {
-  [Console]::Error.WriteLine("wrong DIREXIO_CREDENTIALS_FILE")
-  exit 1
-}
-
-[Console]::Out.WriteLine('{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{"tools":{}},"serverInfo":{"name":"fake-direxio-mcp","version":"0.0.0"}}}')
-[Console]::Out.WriteLine('{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"search_rooms","description":"Search rooms"},{"name":"send_message","description":"Send message"},{"name":"list_messages","description":"List messages"}]}}')
-EOF
-
-mcp_command=direxio-mcp
-case "$(uname -s)" in
-  MINGW*|MSYS*|CYGWIN*) use_windows_mcp=1 ;;
-  *) use_windows_mcp=0 ;;
-esac
-if { [ "$use_windows_mcp" = "1" ] || ! command -v node >/dev/null 2>&1; } && command -v node.exe >/dev/null 2>&1; then
-  fake_mcp_ps1=$(windows_path "$tmp/fake-mcp.ps1")
-  mcp_command="powershell.exe -NoProfile -ExecutionPolicy Bypass -File \"$fake_mcp_ps1\""
-fi
-
-service_dir="$HOME/.direxio/nodes/mcp-tools.example.test"
-mkdir -p "$service_dir"
-credentials="$service_dir/credentials.json"
-: > "$credentials"
-expected_credentials="$credentials"
-if command -v cygpath >/dev/null 2>&1; then
-  expected_credentials=$(cygpath -m "$expected_credentials")
-fi
-state="$service_dir/state.json"
-jq -n \
-  --arg service_dir "$service_dir" \
-  --arg credentials "$credentials" \
-  --arg mcp_command "$mcp_command" \
-  '{
-    run_id: "mcp-tools-test",
-    region: "ap-northeast-1",
-    domain_mode: "user",
-    domain: "mcp-tools.example.test",
-    agent_service_id: "mcp-tools.example.test",
-    agent_service_dir: $service_dir,
-    agent_credentials_file: $credentials,
-    mcp_credentials_file: $credentials,
-    mcp_command: $mcp_command,
-    phase: "S7_VERIFY_E2E",
-    phases: {
-      S0_PREREQ_AWS: {status: "done"},
-      S1_PREFLIGHT: {status: "done"},
-      S2_DOMAIN: {status: "done"},
-      S3_PROVISION: {status: "done"},
-      S4_BOOTSTRAP_STACK: {status: "done"},
-      S5_INIT_TOKENS: {status: "done"},
-      S6_WIRE_LOCAL: {status: "done"},
-      S7_VERIFY_E2E: {status: "done"}
-    },
-    resources: {}
-  }' > "$state"
-
-verify_output=$(P2P_WORKDIR="$service_dir" PATH="$fakebin:$PATH" EXPECTED_CREDENTIALS_FILE="$expected_credentials" bash "$ROOT/scripts/orchestrate.sh" verify mcp_tools)
-printf '%s\n' "$verify_output" | grep -q 'verified runtime check: mcp_tools'
-
-jq -e '
-  .runtime_checks.mcp_tools.status == "passed"
-  and .runtime_checks.mcp_tools.tool_count == 3
-  and (.runtime_checks.mcp_tools.tools | index("search_rooms") != null)
-  and (.runtime_checks.mcp_tools.tools | index("send_message") != null)
-  and (.runtime_checks.mcp_tools.tools | index("list_messages") != null)
-  and (.user_confirmations.agent_mcp_runtime | not)
-' "$state" >/dev/null
-
-report_output=$(P2P_WORKDIR="$service_dir" bash "$ROOT/scripts/orchestrate.sh" report new_deploy)
-report_path=$(printf '%s\n' "$report_output" | sed -nE 's/^operation report: //p' | tail -n 1)
-jq -e '
-  .runtime_checks.mcp_tools.status == "passed"
-  and .runtime_checks.mcp_tools.tool_count == 3
-  and .gates.user_confirmation.agent_mcp_runtime == "pending_runtime_confirmation"
-' "$report_path" >/dev/null
-
-echo "mcp tools runtime check ok"

package/tests/npm_skill_distribution_test.sh

@@ -1,95 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT=$(cd "$(dirname "$0")/.." && pwd)
-cd "$ROOT"
-
-assert_file_exists() {
-  [ -f "$1" ] || {
-    echo "missing expected file: $1" >&2
-    exit 1
-  }
-}
-
-assert_contains() {
-  local path=$1 pattern=$2
-  grep -q "$pattern" "$path" || {
-    echo "expected $path to contain: $pattern" >&2
-    exit 1
-  }
-}
-
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-NODE_BIN=${NODE:-node}
-
-"$NODE_BIN" -e '
-const pkg = require("./package.json");
-if (pkg.name !== "direxio-deployer") throw new Error("unexpected package name");
-if (!pkg.bin || pkg.bin["direxio-deployer"] !== "bin/direxio-deployer.mjs") {
-  throw new Error("missing direxio-deployer bin");
-}
-'
-
-project="$tmp/project"
-mkdir -p "$project"
-
-"$NODE_BIN" bin/direxio-deployer.mjs skill install --agent codex --scope project --project "$project" > "$tmp/install.out"
-target="$project/.codex/skills/direxio-deployer"
-assert_file_exists "$target/SKILL.md"
-assert_file_exists "$target/references/agent-targets.md"
-assert_file_exists "$target/scripts/orchestrate.sh"
-assert_file_exists "$target/.direxio-skill-install.json"
-assert_contains "$target/.direxio-skill-install.json" '"agent": "codex"'
-assert_contains "$target/.direxio-skill-install.json" '"scope": "project"'
-
-printf 'stale\n' > "$target/STALE.txt"
-"$NODE_BIN" bin/direxio-deployer.mjs skill update --agent codex --scope project --project "$project" > "$tmp/update.out"
-if [ -f "$target/STALE.txt" ]; then
-  echo "managed update should replace stale target contents" >&2
-  exit 1
-fi
-
-unmanaged_project="$tmp/unmanaged"
-mkdir -p "$unmanaged_project/.codex/skills/direxio-deployer"
-printf 'manual\n' > "$unmanaged_project/.codex/skills/direxio-deployer/manual.txt"
-if "$NODE_BIN" bin/direxio-deployer.mjs skill install --agent codex --scope project --project "$unmanaged_project" >"$tmp/unmanaged.out" 2>"$tmp/unmanaged.err"; then
-  echo "unmanaged install should require --force" >&2
-  exit 1
-fi
-assert_contains "$tmp/unmanaged.err" 'refusing to overwrite unmanaged target'
-
-"$NODE_BIN" bin/direxio-deployer.mjs skill install --agent codex --scope project --project "$unmanaged_project" --force > "$tmp/force.out"
-assert_file_exists "$unmanaged_project/.codex/skills/direxio-deployer/SKILL.md"
-if [ -f "$unmanaged_project/.codex/skills/direxio-deployer/manual.txt" ]; then
-  echo "forced install should replace unmanaged contents" >&2
-  exit 1
-fi
-
-"$NODE_BIN" bin/direxio-deployer.mjs skill install --agent gemini --scope global --home "$tmp/home" --dry-run > "$tmp/dry-run.out"
-assert_contains "$tmp/dry-run.out" '"dryRun": true'
-assert_contains "$tmp/dry-run.out" '.gemini'
-if [ -e "$tmp/home/.gemini" ]; then
-  echo "dry-run should not create global target directories" >&2
-  exit 1
-fi
-
-PI_CODING_AGENT_DIR="$tmp/pi-agent-root" "$NODE_BIN" bin/direxio-deployer.mjs skill install --agent pi --scope global --dry-run > "$tmp/pi-global.out"
-assert_contains "$tmp/pi-global.out" 'pi-agent-root'
-assert_contains "$tmp/pi-global.out" 'skills'
-if grep -q 'pi-agent-root.*/agent/skills' "$tmp/pi-global.out"; then
-  echo "PI_CODING_AGENT_DIR already points at the agent root and must not append another agent segment" >&2
-  exit 1
-fi
-
-custom_target="$tmp/custom target/skill"
-"$NODE_BIN" bin/direxio-deployer.mjs skill install --agent codex --target "$custom_target" > "$tmp/custom-target.out"
-assert_file_exists "$custom_target/SKILL.md"
-assert_file_exists "$custom_target/.direxio-skill-install.json"
-
-"$NODE_BIN" bin/direxio-deployer.mjs skill refresh --agent codex --scope project --project "$project" --dry-run > "$tmp/refresh.out"
-assert_contains "$tmp/refresh.out" '"command": "refresh"'
-assert_contains "$tmp/refresh.out" '"target"'
-
-echo "npm skill distribution ok"

package/tests/operation_report_test.sh

@@ -1,258 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT=$(cd "$(dirname "$0")/.." && pwd)
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-export HOME="$tmp/home"
-mkdir -p "$HOME"
-
-assert_file_exists() {
-  [ -s "$1" ] || {
-    echo "expected non-empty file: $1" >&2
-    exit 1
-  }
-}
-
-assert_not_contains_secret() {
-  local path=$1
-  if grep -E '12345678|87654321|ACCESS_SECRET|AGENT_SECRET|AWS_SECRET' "$path" >/dev/null; then
-    echo "operation report leaked a secret: $path" >&2
-    cat "$path" >&2
-    exit 1
-  fi
-}
-
-service_dir="$HOME/.direxio/nodes/report.example.test"
-mkdir -p "$service_dir"
-state="$service_dir/state.json"
-jq -n \
-  --arg service_dir "$service_dir" \
-  '{
-    run_id: "report-test",
-    region: "ap-northeast-1",
-    domain_mode: "route53",
-    domain: "report.example.test",
-    as_url: "https://report.example.test",
-    instance_type: "t3.small",
-    password: "12345678",
-    access_token: "ACCESS_SECRET",
-    agent_token: "AGENT_SECRET",
-    agent_room_id: "!room:report.example.test",
-    agent_node_id: "node-report",
-    agent_service_id: "report.example.test",
-    agent_service_dir: $service_dir,
-    agent_credentials_file: ($service_dir + "/credentials.json"),
-    cc_connect_config: ($service_dir + "/cc-connect/config.toml"),
-    cc_connect_agent: "acp",
-    cc_connect_npm_package: "direxio-connent@latest",
-    mcp_npm_package: "direxio-mcp@latest",
-    mcp_server_name: "direxio-report-example-test",
-    mcp_config_dir: ($service_dir + "/mcp"),
-    mcp_codex_config: ($service_dir + "/mcp/codex.toml"),
-    mcp_openclaw_config: ($service_dir + "/mcp/openclaw.md"),
-    mcp_hermes_config: ($service_dir + "/mcp/hermes.mcp.json"),
-    mcp_doctor_command: "DIREXIO_CREDENTIALS_FILE=<redacted> direxio-mcp doctor --json",
-    phase: "S7_VERIFY_E2E",
-    phases: {
-      S0_PREREQ_AWS: {status: "done"},
-      S1_PREFLIGHT: {status: "done"},
-      S2_DOMAIN: {status: "done"},
-      S3_PROVISION: {status: "done"},
-      S4_BOOTSTRAP_STACK: {status: "done"},
-      S5_INIT_TOKENS: {status: "done"},
-      S6_WIRE_LOCAL: {status: "done"},
-      S7_VERIFY_E2E: {status: "done"}
-    },
-    user_confirmations: {
-      app_initialization: {
-        status: "confirmed",
-        ts: "2026-06-28T01:02:03Z",
-        evidence: "user completed app initialization with code 12345678; old screenshot showed code 87654321"
-      },
-      real_chat: {
-        status: "confirmed",
-        ts: "2026-06-28T01:03:04Z",
-        evidence: "user saw the agent reply; token ACCESS_SECRET stayed local"
-      },
-      agent_mcp_runtime: {
-        status: "confirmed",
-        ts: "2026-06-28T01:04:05Z",
-        evidence: "runtime channel probe confirmed with agent token AGENT_SECRET",
-        runtime_summary_status: "passed",
-        runtime_probe_confirmed: true
-      }
-    },
-    resources: {
-      instance_id: "i-report",
-      root_volume_id: "vol-report-root",
-      public_ip: "203.0.113.42",
-      eip_id: "eipalloc-report",
-      route53_zone_id: "ZREPORT",
-      route53_zone_name: "report.example.test",
-      route53_zone_created_by_deployer: "true",
-      route53_existing_a_value: "198.51.100.20",
-      route53_pending_a_value: "203.0.113.42",
-      route53_overwrite_confirmed: "true",
-      sg_id: "sg-report",
-      key_name: "direxio-report"
-    }
-  }' > "$state"
-
-report_output=$(P2P_WORKDIR="$service_dir" bash "$ROOT/scripts/orchestrate.sh" report new_deploy)
-report_path=$(printf '%s\n' "$report_output" | sed -nE 's/^operation report: //p' | tail -n 1)
-assert_file_exists "$report_path"
-assert_not_contains_secret "$report_path"
-
-jq -e '
-  .operation_type == "new_deploy"
-  and .status == "automated_gates_complete_user_confirmation_pending"
-  and .domain == "report.example.test"
-  and .delivery.app_domain == "report.example.test"
-  and (.delivery | has("service_url") | not)
-  and .delivery.init_code_status == "available_in_state_password_field_redacted"
-  and .delivery.init_code_secret_redacted == true
-  and .delivery.product_completion_status == "automated_gates_complete_user_confirmation_pending"
-  and .agent.node_id == "node-report"
-  and .agent.room_id == "!room:report.example.test"
-  and .agent.runtime == "unknown"
-  and .gates.automated.S7_VERIFY_E2E == "done"
-  and .gates.user_confirmation.app_initialization == "confirmed"
-  and .gates.user_confirmation.real_chat == "confirmed"
-  and .gates.user_confirmation.agent_mcp_runtime == "confirmed"
-  and .gates.user_confirmation_details.app_initialization.status == "confirmed"
-  and .gates.user_confirmation_details.app_initialization.ts == "2026-06-28T01:02:03Z"
-  and .gates.user_confirmation_details.app_initialization.evidence == "user completed app initialization with code <redacted>; old screenshot showed code <redacted>"
-  and .gates.user_confirmation_details.real_chat.evidence == "user saw the agent reply; token <redacted> stayed local"
-  and .gates.user_confirmation_details.agent_mcp_runtime.evidence == "runtime channel probe confirmed with agent token <redacted>"
-  and .gates.user_confirmation_details.agent_mcp_runtime.runtime_summary_status == "passed"
-  and .gates.user_confirmation_details.agent_mcp_runtime.runtime_probe_confirmed == true
-  and .credentials.values_redacted == true
-  and .security.secrets_included == false
-  and .mcp.package == "direxio-mcp@latest"
-  and .resources.route53_zone_id == "ZREPORT"
-  and .resources.route53_zone_name == "report.example.test"
-  and .resources.route53_existing_a_value == "198.51.100.20"
-  and .resources.route53_pending_a_value == "203.0.113.42"
-  and .resources.route53_overwrite_confirmed == "true"
-  and .resources.root_volume_id == "vol-report-root"
-  and (.billing.recorded_billable_resources | index("EC2 i-report") != null)
-  and (.billing.recorded_billable_resources | index("EBS root volume vol-report-root") != null)
-  and (.billing.recorded_billable_resources | index("public IPv4 203.0.113.42") != null)
-  and (.billing.recorded_billable_resources | index("Route53 hosted zone ZREPORT") != null)
-  and .security.root_access_key_allowed == true
-  and .security.temporary_iam_cleanup_required == true
-  and (.security.temporary_iam_cleanup_action | contains("delete or disable"))
-' "$report_path" >/dev/null
-
-fakebin="$tmp/bin"
-mkdir -p "$fakebin"
-cat > "$fakebin/aws" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-case "${1:-} ${2:-}" in
-  "sts get-caller-identity")
-    case "$*" in
-      *"--query Arn"*) printf 'arn:aws:iam::123456789012:user/DirexioDeployer-Test\n' ;;
-      *"--query Account"*) printf '123456789012\n' ;;
-      *) printf '{"Account":"123456789012","Arn":"arn:aws:iam::123456789012:user/DirexioDeployer-Test"}\n' ;;
-    esac
-    ;;
-  "ec2 terminate-instances") exit 0 ;;
-  "ec2 wait") exit 0 ;;
-  "ec2 release-address") exit 0 ;;
-  "ec2 delete-security-group") exit 0 ;;
-  "ec2 delete-key-pair") exit 0 ;;
-  "ec2 describe-instances") printf 'terminated\n' ;;
-  "ec2 describe-addresses") exit 255 ;;
-  "ec2 describe-volumes") exit 255 ;;
-  "ec2 describe-security-groups") exit 255 ;;
-  "ec2 describe-key-pairs") exit 255 ;;
-  "route53 change-resource-record-sets") printf '{"ChangeInfo":{"Id":"/change/CDELETE","Status":"PENDING"}}\n' ;;
-  "route53 wait") exit 0 ;;
-  "route53 list-resource-record-sets") printf '{"ResourceRecordSets":[]}\n' ;;
-  "route53 delete-hosted-zone") exit 0 ;;
-  "route53 get-hosted-zone") exit 255 ;;
-  *) exit 0 ;;
-esac
-EOF
-chmod 700 "$fakebin/aws"
-
-cat > "$fakebin/direxio-connect" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-if [ "${1:-}" = "daemon" ] && [ "${2:-}" = "status" ]; then
-  cat <<STATUS
-cc-connect daemon status
-
-  Status:    Running
-  WorkDir:   ${STATUS_WORK_DIR:-}
-STATUS
-fi
-EOF
-chmod 700 "$fakebin/direxio-connect"
-
-mkdir -p "$service_dir/cc-connect"
-PATH="$fakebin:$PATH" STATUS_WORK_DIR="$service_dir/cc-connect" bash "$ROOT/scripts/destroy.sh" "$state" >/dev/null
-destroy_report="$HOME/.direxio/reports/report.example.test/operation-report.json"
-assert_file_exists "$destroy_report"
-assert_not_contains_secret "$destroy_report"
-
-jq -e '
-  .operation_type == "destroy"
-  and .status == "destroy_processed"
-  and .domain == "report.example.test"
-  and .resources.instance_id == "i-report"
-  and .resources.root_volume_id == "vol-report-root"
-  and .resources.eip_id == "eipalloc-report"
-  and .security.secrets_included == false
-  and .destroy.user_managed_dns_not_removed == true
-  and .destroy.purchased_domain_not_removed == true
-  and .destroy.evidence.ec2_instance.status == "terminated"
-  and .destroy.evidence.ebs_root_volume.status == "deleted"
-  and .destroy.evidence.elastic_ip.status == "released"
-  and .destroy.evidence.security_group.status == "deleted"
-  and .destroy.evidence.key_pair.status == "deleted"
-  and .destroy.evidence.route53_a_record.status == "deleted"
-  and .destroy.evidence.route53_hosted_zone.status == "deleted"
-  and .billing.destroy_cleanup_status == "no_recorded_billable_resource_residue"
-  and (.billing.possible_remaining_billable_resources | length == 0)
-' "$destroy_report" >/dev/null
-
-residual_dir="$HOME/.direxio/nodes/residual.example.test"
-mkdir -p "$residual_dir"
-residual_state="$residual_dir/state.json"
-jq -n \
-  --arg residual_dir "$residual_dir" \
-  '{
-    domain: "residual.example.test",
-    agent_service_id: "residual.example.test",
-    agent_service_dir: $residual_dir,
-    resources: {
-      instance_id: "i-residual",
-      root_volume_id: "vol-residual",
-      eip_id: "eipalloc-residual",
-      route53_zone_id: "ZRESIDUAL"
-    },
-    destroy_evidence: {
-      ec2_instance: {status: "running"},
-      ebs_root_volume: {status: "available"},
-      elastic_ip: {status: "still_allocated"},
-      route53_hosted_zone: {status: "still_present"}
-    }
-  }' > "$residual_state"
-
-residual_report_output=$(P2P_WORKDIR="$residual_dir" bash "$ROOT/scripts/orchestrate.sh" report destroy)
-residual_report_path=$(printf '%s\n' "$residual_report_output" | sed -nE 's/^operation report: //p' | tail -n 1)
-assert_file_exists "$residual_report_path"
-jq -e '
-  .operation_type == "destroy"
-  and .billing.destroy_cleanup_status == "possible_billable_resource_residue"
-  and (.billing.possible_remaining_billable_resources | index("EC2 i-residual status=running") != null)
-  and (.billing.possible_remaining_billable_resources | index("EBS root volume vol-residual status=available") != null)
-  and (.billing.possible_remaining_billable_resources | index("Elastic IP eipalloc-residual status=still_allocated") != null)
-  and (.billing.possible_remaining_billable_resources | index("Route53 hosted zone ZRESIDUAL status=still_present") != null)
-' "$residual_report_path" >/dev/null
-
-echo "operation report ok"

package/tests/orchestrate_status_recovery_test.sh

@@ -1,91 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT=$(cd "$(dirname "$0")/.." && pwd)
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-export HOME="$tmp/home"
-mkdir -p "$HOME"
-
-assert_contains() {
-  local haystack=$1 needle=$2
-  if [[ "$haystack" != *"$needle"* ]]; then
-    echo "expected output to contain: $needle" >&2
-    echo "--- output ---" >&2
-    printf '%s\n' "$haystack" >&2
-    exit 1
-  fi
-}
-
-write_state() {
-  local workdir=$1 phase=$2 status=$3 resources_json=$4
-  mkdir -p "$workdir"
-  jq -n \
-    --arg run_id "status-test" \
-    --arg region "ap-northeast-1" \
-    --arg domain "status.example.test" \
-    --arg phase "$phase" \
-    --arg status "$status" \
-    --argjson resources "$resources_json" \
-    '{
-      run_id: $run_id,
-      region: $region,
-      domain_mode: "user",
-      domain: $domain,
-      instance_type: "t3.small",
-      dns_ready: false,
-      phase: $phase,
-      phases: {
-        S0_PREREQ_AWS: {status: (if $phase == "S0_PREREQ_AWS" then $status else "done" end)},
-        S1_PREFLIGHT: {status: (if $phase == "S0_PREREQ_AWS" then "pending" elif $phase == "S1_PREFLIGHT" then $status else "done" end)},
-        S2_DOMAIN: {status: (if ($phase == "S0_PREREQ_AWS" or $phase == "S1_PREFLIGHT") then "pending" elif $phase == "S2_DOMAIN" then $status else "done" end)},
-        S3_PROVISION: {status: (if ($phase == "S0_PREREQ_AWS" or $phase == "S1_PREFLIGHT" or $phase == "S2_DOMAIN") then "pending" elif $phase == "S3_PROVISION" then $status else "done" end)},
-        S4_BOOTSTRAP_STACK: {status: (if ($phase == "S0_PREREQ_AWS" or $phase == "S1_PREFLIGHT" or $phase == "S2_DOMAIN" or $phase == "S3_PROVISION") then "pending" elif $phase == "S4_BOOTSTRAP_STACK" then $status else "done" end)},
-        S5_INIT_TOKENS: {status: (if ($phase == "S0_PREREQ_AWS" or $phase == "S1_PREFLIGHT" or $phase == "S2_DOMAIN" or $phase == "S3_PROVISION" or $phase == "S4_BOOTSTRAP_STACK") then "pending" elif $phase == "S5_INIT_TOKENS" then $status else "done" end)},
-        S6_WIRE_LOCAL: {status: (if ($phase == "S0_PREREQ_AWS" or $phase == "S1_PREFLIGHT" or $phase == "S2_DOMAIN" or $phase == "S3_PROVISION" or $phase == "S4_BOOTSTRAP_STACK" or $phase == "S5_INIT_TOKENS") then "pending" elif $phase == "S6_WIRE_LOCAL" then $status else "done" end)},
-        S7_VERIFY_E2E: {status: (if $phase == "S7_VERIFY_E2E" then $status else "pending" end)}
-      },
-      resources: $resources
-    }' > "$workdir/state.json"
-}
-
-pre_resource_workdir="$tmp/pre-resource"
-write_state "$pre_resource_workdir" "S2_DOMAIN" "waiting_user" '{}'
-pre_resource_output=$(P2P_WORKDIR="$pre_resource_workdir" bash "$ROOT/scripts/orchestrate.sh" status)
-
-assert_contains "$pre_resource_output" "Recovery summary"
-assert_contains "$pre_resource_output" "Where it is blocked: S2_DOMAIN"
-assert_contains "$pre_resource_output" "Billing impact: no EC2, public IPv4, or EBS resource is recorded yet"
-assert_contains "$pre_resource_output" "Resume safety: safe to rerun the same command after the next action is complete"
-assert_contains "$pre_resource_output" "Next action: confirm the long-lived domain, DNS authority, and irreversible Matrix server_name binding"
-assert_contains "$pre_resource_output" "Stop-loss: no recorded cloud resources need destroy from this state"
-
-billable_workdir="$tmp/billable"
-write_state "$billable_workdir" "S4_BOOTSTRAP_STACK" "failed" '{"instance_id":"i-status","root_volume_id":"vol-status-root","public_ip":"203.0.113.10","eip_id":"eipalloc-status","route53_zone_id":"ZSTATUS"}'
-billable_output=$(P2P_WORKDIR="$billable_workdir" bash "$ROOT/scripts/orchestrate.sh" status)
-
-assert_contains "$billable_output" "Recovery summary"
-assert_contains "$billable_output" "Where it is blocked: S4_BOOTSTRAP_STACK"
-assert_contains "$billable_output" "Billing impact: recorded AWS resources may keep billing: EC2 i-status, EBS root volume vol-status-root, public IPv4 203.0.113.10, Elastic IP eipalloc-status, Route53 hosted zone ZSTATUS"
-assert_contains "$billable_output" "Resume safety: do not reset state; fix the issue and rerun with P2P_EXISTING_STATE_ACTION=continue"
-assert_contains "$billable_output" "Next action: inspect cloud-init, Docker, Caddy/TLS, and message-server logs over SSH"
-assert_contains "$billable_output" "Stop-loss: ask the agent to run destroy, or run:"
-assert_contains "$billable_output" "destroy.sh"
-
-refresh_workdir="$tmp/refresh-pending"
-write_state "$refresh_workdir" "S4_BOOTSTRAP_STACK" "pending" '{"instance_id":"i-refresh","root_volume_id":"vol-refresh-root","public_ip":"203.0.113.20"}'
-jq '
-  .agent_install_status = "refresh_pending"
-  | .agent_service_id = "status.example.test"
-  | .user_confirmations.app_initialization = {status:"confirmed", evidence:"old app proof"}
-  | .runtime_checks.summary = {status:"passed"}
-' "$refresh_workdir/state.json" > "$refresh_workdir/state.json.tmp"
-mv "$refresh_workdir/state.json.tmp" "$refresh_workdir/state.json"
-refresh_output=$(P2P_WORKDIR="$refresh_workdir" bash "$ROOT/scripts/orchestrate.sh" status)
-
-assert_contains "$refresh_output" "Recovery summary"
-assert_contains "$refresh_output" "Local refresh: update/reset cleared old credentials, user confirmations, runtime checks, and bridge install proof"
-assert_contains "$refresh_output" "Next action: rerun the deployment workflow to refresh S4-S7, local credentials, MCP snippets, and runtime checks"
-
-echo "orchestrate status recovery ok"

package/tests/phase_timeout_test.sh

@@ -1,88 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT=$(cd "$(dirname "$0")/.." && pwd)
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-export HOME="$tmp/home"
-export DOMAIN="timeout.example.test"
-mkdir -p "$HOME" "$tmp/bin"
-
-cat > "$tmp/bin/curl" <<'EOF'
-#!/usr/bin/env bash
-printf '%s\n' "$*" >> "$CURL_LOG"
-exit 0
-EOF
-chmod 700 "$tmp/bin/curl"
-
-cat > "$tmp/bin/ssh" <<'EOF'
-#!/usr/bin/env bash
-printf '%s\n' "$*" >> "$SSH_LOG"
-case " $* " in
-  *" ConnectTimeout=6 "*" BatchMode=yes "*" ServerAliveInterval=4 "*" ServerAliveCountMax=3 "*) printf '{"password":"12345678","agent_token":"agent","access_token":"access"}'; exit 0 ;;
-  *) exit 2 ;;
-esac
-EOF
-chmod 700 "$tmp/bin/ssh"
-
-cat > "$tmp/bin/timeout" <<'EOF'
-#!/usr/bin/env bash
-printf '%s\n' "$1" >> "$TIMEOUT_LOG"
-shift
-exec "$@"
-EOF
-chmod 700 "$tmp/bin/timeout"
-
-export PATH="$tmp/bin:$PATH"
-export CURL_LOG="$tmp/curl.log"
-export SSH_LOG="$tmp/ssh.log"
-export TIMEOUT_LOG="$tmp/timeout.log"
-export HEALTH_CURL_CONNECT_TIMEOUT=7
-export HEALTH_CURL_MAX_TIME=11
-export SSH_CONNECT_TIMEOUT=6
-export SSH_SERVER_ALIVE_INTERVAL=4
-export SSH_SERVER_ALIVE_COUNT_MAX=3
-export SSH_COMMAND_TIMEOUT=19
-
-# shellcheck disable=SC1090
-source "$ROOT/scripts/lib/state.sh"
-state_init >/dev/null 2>&1
-res_set public_ip "203.0.113.10"
-
-# shellcheck disable=SC1090
-source "$ROOT/scripts/phases/s4_bootstrap_stack.sh"
-_healthz_ok "timeout.example.test"
-grep -q -- '--connect-timeout 7' "$CURL_LOG"
-grep -q -- '--max-time 11' "$CURL_LOG"
-grep -q -- '--resolve timeout.example.test:443:203.0.113.10' "$CURL_LOG"
-
-# shellcheck disable=SC1090
-source "$ROOT/scripts/phases/s5_init_tokens.sh"
-_read_remote_bootstrap "$tmp/key.pem" "203.0.113.10" "$tmp/bootstrap.json"
-grep -q 'ConnectTimeout=6' "$SSH_LOG"
-grep -q 'BatchMode=yes' "$SSH_LOG"
-grep -q 'ServerAliveInterval=4' "$SSH_LOG"
-grep -q 'ServerAliveCountMax=3' "$SSH_LOG"
-grep -q '^19$' "$TIMEOUT_LOG"
-jq -e '.password == "12345678" and .agent_token == "agent" and .access_token == "access"' "$tmp/bootstrap.json" >/dev/null
-
-printf '{"password":"01234567","agent_token":"agent","access_token":"access"}\n' > "$tmp/bootstrap-leading-zero.json"
-IFS=$'\t' read -r password token access_token < <(_extract_output_tokens "$tmp/bootstrap-leading-zero.json")
-[ "$password" = "01234567" ]
-[ "$token" = "agent" ]
-[ "$access_token" = "access" ]
-
-printf '{"password":"8848121","agent_token":"agent","access_token":"access"}\n' > "$tmp/bootstrap-short-code.json"
-if _extract_output_tokens "$tmp/bootstrap-short-code.json" >/dev/null; then
-  echo "S5 must reject initialization codes that are not exactly eight digits" >&2
-  exit 1
-fi
-
-printf '{"password":12345678,"agent_token":"agent","access_token":"access"}\n' > "$tmp/bootstrap-numeric-code.json"
-if _extract_output_tokens "$tmp/bootstrap-numeric-code.json" >/dev/null; then
-  echo "S5 must reject numeric initialization codes; they must stay JSON strings to preserve leading zeros" >&2
-  exit 1
-fi
-
-echo "phase timeout guards ok"