direxio-deployer 0.1.0

package/tests/domain_authoritative_dns_test.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+fakebin="$tmp/bin"
+mkdir -p "$fakebin"
+cat > "$fakebin/dig" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ "${1:-}" = "+short" ] && [ "${2:-}" = "A" ] && [ "${3:-}" = "app.example.test" ]; then
+  printf '203.0.113.88\n'
+  exit 0
+fi
+
+if [ "${1:-}" = "+short" ] && [ "${2:-}" = "NS" ] && [ "${3:-}" = "app.example.test" ]; then
+  exit 0
+fi
+
+if [ "${1:-}" = "+short" ] && [ "${2:-}" = "NS" ] && [ "${3:-}" = "example.test" ]; then
+  printf 'ns1.example.test.\n'
+  exit 0
+fi
+
+if [ "${1:-}" = "+short" ] && [ "${2:-}" = "@ns1.example.test" ] && [ "${3:-}" = "A" ] && [ "${4:-}" = "app.example.test" ]; then
+  printf '%s\n' "${AUTHORITATIVE_A:-198.51.100.10}"
+  exit 0
+fi
+
+echo "unexpected dig call: $*" >&2
+exit 1
+EOF
+chmod 700 "$fakebin/dig"
+
+PATH="$fakebin:$PATH"
+# shellcheck disable=SC1091
+source "$ROOT/scripts/lib/domain.sh"
+
+if AUTHORITATIVE_A=198.51.100.10 domain_resolves_to_ip app.example.test 203.0.113.88; then
+  echo "recursive DNS alone must not pass when authoritative DNS still points at a different IP" >&2
+  exit 1
+fi
+
+AUTHORITATIVE_A=203.0.113.88 domain_resolves_to_ip app.example.test 203.0.113.88
+
+echo "domain authoritative dns ok"

package/tests/mcp_doctor_runtime_check_test.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+export HOME="$tmp/home"
+mkdir -p "$HOME"
+
+fakebin="$tmp/bin"
+mkdir -p "$fakebin"
+cat > "$fakebin/direxio-mcp" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+
+[ "${1:-}" = "doctor" ]
+[ "${2:-}" = "--json" ]
+[ "${DIREXIO_CREDENTIALS_FILE:-}" = "${EXPECTED_CREDENTIALS_FILE:-}" ]
+
+cat <<JSON
+{
+  "ok": true,
+  "domain": "mcp-check.example.test",
+  "agent_room_id": "!agent:mcp-check.example.test",
+  "token": "redacted"
+}
+JSON
+EOF
+chmod 700 "$fakebin/direxio-mcp"
+
+service_dir="$HOME/.direxio/nodes/mcp-check.example.test"
+mkdir -p "$service_dir"
+credentials="$service_dir/credentials.json"
+: > "$credentials"
+expected_credentials="$credentials"
+if command -v cygpath >/dev/null 2>&1; then
+  expected_credentials=$(cygpath -m "$expected_credentials")
+fi
+state="$service_dir/state.json"
+jq -n \
+  --arg service_dir "$service_dir" \
+  --arg credentials "$credentials" \
+  '{
+    run_id: "mcp-doctor-test",
+    region: "ap-northeast-1",
+    domain_mode: "user",
+    domain: "mcp-check.example.test",
+    agent_service_id: "mcp-check.example.test",
+    agent_service_dir: $service_dir,
+    agent_credentials_file: $credentials,
+    mcp_credentials_file: $credentials,
+    mcp_command: "direxio-mcp",
+    phase: "S7_VERIFY_E2E",
+    phases: {
+      S0_PREREQ_AWS: {status: "done"},
+      S1_PREFLIGHT: {status: "done"},
+      S2_DOMAIN: {status: "done"},
+      S3_PROVISION: {status: "done"},
+      S4_BOOTSTRAP_STACK: {status: "done"},
+      S5_INIT_TOKENS: {status: "done"},
+      S6_WIRE_LOCAL: {status: "done"},
+      S7_VERIFY_E2E: {status: "done"}
+    },
+    resources: {}
+  }' > "$state"
+
+verify_output=$(P2P_WORKDIR="$service_dir" PATH="$fakebin:$PATH" EXPECTED_CREDENTIALS_FILE="$expected_credentials" bash "$ROOT/scripts/orchestrate.sh" verify mcp_doctor)
+printf '%s\n' "$verify_output" | grep -q 'verified runtime check: mcp_doctor'
+
+jq -e '
+  .runtime_checks.mcp_doctor.status == "passed"
+  and .runtime_checks.mcp_doctor.domain == "mcp-check.example.test"
+  and .runtime_checks.mcp_doctor.agent_room_id == "!agent:mcp-check.example.test"
+  and .runtime_checks.mcp_doctor.token == "redacted"
+  and (.user_confirmations.agent_mcp_runtime | not)
+' "$state" >/dev/null
+
+report_output=$(P2P_WORKDIR="$service_dir" bash "$ROOT/scripts/orchestrate.sh" report new_deploy)
+report_path=$(printf '%s\n' "$report_output" | sed -nE 's/^operation report: //p' | tail -n 1)
+jq -e '
+  .runtime_checks.mcp_doctor.status == "passed"
+  and .gates.user_confirmation.agent_mcp_runtime == "pending_runtime_confirmation"
+' "$report_path" >/dev/null
+
+echo "mcp doctor runtime check ok"

package/tests/mcp_smoke_runtime_check_test.sh

@@ -0,0 +1,121 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+export HOME="$tmp/home"
+mkdir -p "$HOME"
+
+fakebin="$tmp/bin"
+mkdir -p "$fakebin"
+cat > "$fakebin/curl" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+
+printf '%s\n' "$*" >> "$CURL_CALLS"
+
+want_url="https://mcp-smoke.example.test/_p2p/query"
+case " $* " in
+  *" $want_url "*|*" $want_url")
+    ;;
+  *)
+    echo "unexpected curl URL: $*" >&2
+    exit 1
+    ;;
+esac
+
+case " $* " in
+  *"Authorization: Bearer AGENT_TOKEN_SMOKE"*) ;;
+  *)
+    echo "missing or wrong Authorization header: $*" >&2
+    exit 1
+    ;;
+esac
+
+case " $* " in
+  *'"action":"mcp.messages.list"'*'"room_id":"!agent:mcp-smoke.example.test"'*) ;;
+  *)
+    echo "wrong smoke request body: $*" >&2
+    exit 1
+    ;;
+esac
+
+body_path=""
+write_code=0
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    -o)
+      body_path=$2
+      shift 2
+      ;;
+    -w)
+      write_code=1
+      shift 2
+      ;;
+    *)
+      shift
+      ;;
+  esac
+done
+
+payload='{"room_id":"!agent:mcp-smoke.example.test","messages":[]}'
+if [ -n "$body_path" ]; then
+  printf '%s\n' "$payload" > "$body_path"
+else
+  printf '%s\n' "$payload"
+fi
+[ "$write_code" -eq 1 ] && printf '200'
+EOF
+chmod 700 "$fakebin/curl"
+
+service_dir="$HOME/.direxio/nodes/mcp-smoke.example.test"
+mkdir -p "$service_dir"
+state="$service_dir/state.json"
+jq -n \
+  --arg service_dir "$service_dir" \
+  '{
+    run_id: "mcp-smoke-test",
+    region: "ap-northeast-1",
+    domain_mode: "user",
+    domain: "mcp-smoke.example.test",
+    as_url: "https://mcp-smoke.example.test",
+    agent_service_id: "mcp-smoke.example.test",
+    agent_service_dir: $service_dir,
+    agent_token: "AGENT_TOKEN_SMOKE",
+    agent_room_id: "!agent:mcp-smoke.example.test",
+    phase: "S7_VERIFY_E2E",
+    phases: {
+      S0_PREREQ_AWS: {status: "done"},
+      S1_PREFLIGHT: {status: "done"},
+      S2_DOMAIN: {status: "done"},
+      S3_PROVISION: {status: "done"},
+      S4_BOOTSTRAP_STACK: {status: "done"},
+      S5_INIT_TOKENS: {status: "done"},
+      S6_WIRE_LOCAL: {status: "done"},
+      S7_VERIFY_E2E: {status: "done"}
+    },
+    resources: {}
+  }' > "$state"
+
+calls="$tmp/curl.calls"
+verify_output=$(P2P_WORKDIR="$service_dir" PATH="$fakebin:$PATH" CURL_CALLS="$calls" bash "$ROOT/scripts/orchestrate.sh" verify mcp_smoke)
+printf '%s\n' "$verify_output" | grep -q 'verified runtime check: mcp_smoke'
+
+jq -e '
+  .runtime_checks.mcp_smoke.status == "passed"
+  and .runtime_checks.mcp_smoke.action == "mcp.messages.list"
+  and .runtime_checks.mcp_smoke.room_id == "!agent:mcp-smoke.example.test"
+  and .runtime_checks.mcp_smoke.response_messages_type == "array"
+  and (.user_confirmations.agent_mcp_runtime | not)
+' "$state" >/dev/null
+
+report_output=$(P2P_WORKDIR="$service_dir" bash "$ROOT/scripts/orchestrate.sh" report new_deploy)
+report_path=$(printf '%s\n' "$report_output" | sed -nE 's/^operation report: //p' | tail -n 1)
+jq -e '
+  .runtime_checks.mcp_smoke.status == "passed"
+  and .gates.user_confirmation.agent_mcp_runtime == "pending_runtime_confirmation"
+' "$report_path" >/dev/null
+
+echo "mcp smoke runtime check ok"

package/tests/mcp_tools_runtime_check_test.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+tmp=$(mktemp -d "$ROOT/.tmp-mcp-tools.XXXXXX")
+trap 'rm -rf "$tmp"' EXIT
+
+export HOME="$tmp/home"
+mkdir -p "$HOME"
+
+fakebin="$tmp/bin"
+mkdir -p "$fakebin"
+
+windows_path() {
+  local path=$1 drive rest
+  case "$path" in
+    /mnt/[A-Za-z]/*)
+      drive=${path#/mnt/}
+      drive=${drive%%/*}
+      rest=${path#/mnt/$drive/}
+      printf '%s:\\%s\n' "$(printf '%s' "$drive" | tr '[:lower:]' '[:upper:]')" "$(printf '%s' "$rest" | sed 's#/#\\#g')"
+      ;;
+    /[A-Za-z]/*)
+      drive=${path#/}
+      drive=${drive%%/*}
+      rest=${path#/$drive/}
+      printf '%s:\\%s\n' "$(printf '%s' "$drive" | tr '[:lower:]' '[:upper:]')" "$(printf '%s' "$rest" | sed 's#/#\\#g')"
+      ;;
+    *) printf '%s\n' "$path" ;;
+  esac
+}
+
+cat > "$fakebin/direxio-mcp" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+if [ "${DIREXIO_CREDENTIALS_FILE:-}" != "${EXPECTED_CREDENTIALS_FILE:-}" ]; then
+  echo "wrong DIREXIO_CREDENTIALS_FILE" >&2
+  exit 1
+fi
+
+printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{"tools":{}},"serverInfo":{"name":"fake-direxio-mcp","version":"0.0.0"}}}'
+printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"search_rooms","description":"Search rooms"},{"name":"send_message","description":"Send message"},{"name":"list_messages","description":"List messages"}]}}'
+EOF
+chmod 700 "$fakebin/direxio-mcp"
+
+cat > "$tmp/fake-mcp.ps1" <<'EOF'
+if ($env:DIREXIO_CREDENTIALS_FILE -ne $env:EXPECTED_CREDENTIALS_FILE) {
+  [Console]::Error.WriteLine("wrong DIREXIO_CREDENTIALS_FILE")
+  exit 1
+}
+
+[Console]::Out.WriteLine('{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{"tools":{}},"serverInfo":{"name":"fake-direxio-mcp","version":"0.0.0"}}}')
+[Console]::Out.WriteLine('{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"search_rooms","description":"Search rooms"},{"name":"send_message","description":"Send message"},{"name":"list_messages","description":"List messages"}]}}')
+EOF
+
+mcp_command=direxio-mcp
+case "$(uname -s)" in
+  MINGW*|MSYS*|CYGWIN*) use_windows_mcp=1 ;;
+  *) use_windows_mcp=0 ;;
+esac
+if { [ "$use_windows_mcp" = "1" ] || ! command -v node >/dev/null 2>&1; } && command -v node.exe >/dev/null 2>&1; then
+  fake_mcp_ps1=$(windows_path "$tmp/fake-mcp.ps1")
+  mcp_command="powershell.exe -NoProfile -ExecutionPolicy Bypass -File \"$fake_mcp_ps1\""
+fi
+
+service_dir="$HOME/.direxio/nodes/mcp-tools.example.test"
+mkdir -p "$service_dir"
+credentials="$service_dir/credentials.json"
+: > "$credentials"
+expected_credentials="$credentials"
+if command -v cygpath >/dev/null 2>&1; then
+  expected_credentials=$(cygpath -m "$expected_credentials")
+fi
+state="$service_dir/state.json"
+jq -n \
+  --arg service_dir "$service_dir" \
+  --arg credentials "$credentials" \
+  --arg mcp_command "$mcp_command" \
+  '{
+    run_id: "mcp-tools-test",
+    region: "ap-northeast-1",
+    domain_mode: "user",
+    domain: "mcp-tools.example.test",
+    agent_service_id: "mcp-tools.example.test",
+    agent_service_dir: $service_dir,
+    agent_credentials_file: $credentials,
+    mcp_credentials_file: $credentials,
+    mcp_command: $mcp_command,
+    phase: "S7_VERIFY_E2E",
+    phases: {
+      S0_PREREQ_AWS: {status: "done"},
+      S1_PREFLIGHT: {status: "done"},
+      S2_DOMAIN: {status: "done"},
+      S3_PROVISION: {status: "done"},
+      S4_BOOTSTRAP_STACK: {status: "done"},
+      S5_INIT_TOKENS: {status: "done"},
+      S6_WIRE_LOCAL: {status: "done"},
+      S7_VERIFY_E2E: {status: "done"}
+    },
+    resources: {}
+  }' > "$state"
+
+verify_output=$(P2P_WORKDIR="$service_dir" PATH="$fakebin:$PATH" EXPECTED_CREDENTIALS_FILE="$expected_credentials" bash "$ROOT/scripts/orchestrate.sh" verify mcp_tools)
+printf '%s\n' "$verify_output" | grep -q 'verified runtime check: mcp_tools'
+
+jq -e '
+  .runtime_checks.mcp_tools.status == "passed"
+  and .runtime_checks.mcp_tools.tool_count == 3
+  and (.runtime_checks.mcp_tools.tools | index("search_rooms") != null)
+  and (.runtime_checks.mcp_tools.tools | index("send_message") != null)
+  and (.runtime_checks.mcp_tools.tools | index("list_messages") != null)
+  and (.user_confirmations.agent_mcp_runtime | not)
+' "$state" >/dev/null
+
+report_output=$(P2P_WORKDIR="$service_dir" bash "$ROOT/scripts/orchestrate.sh" report new_deploy)
+report_path=$(printf '%s\n' "$report_output" | sed -nE 's/^operation report: //p' | tail -n 1)
+jq -e '
+  .runtime_checks.mcp_tools.status == "passed"
+  and .runtime_checks.mcp_tools.tool_count == 3
+  and .gates.user_confirmation.agent_mcp_runtime == "pending_runtime_confirmation"
+' "$report_path" >/dev/null
+
+echo "mcp tools runtime check ok"

package/tests/npm_skill_distribution_test.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+cd "$ROOT"
+
+assert_file_exists() {
+  [ -f "$1" ] || {
+    echo "missing expected file: $1" >&2
+    exit 1
+  }
+}
+
+assert_contains() {
+  local path=$1 pattern=$2
+  grep -q "$pattern" "$path" || {
+    echo "expected $path to contain: $pattern" >&2
+    exit 1
+  }
+}
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+NODE_BIN=${NODE:-node}
+
+"$NODE_BIN" -e '
+const pkg = require("./package.json");
+if (pkg.name !== "direxio-deployer") throw new Error("unexpected package name");
+if (!pkg.bin || pkg.bin["direxio-deployer"] !== "bin/direxio-deployer.mjs") {
+  throw new Error("missing direxio-deployer bin");
+}
+'
+
+project="$tmp/project"
+mkdir -p "$project"
+
+"$NODE_BIN" bin/direxio-deployer.mjs skill install --agent codex --scope project --project "$project" > "$tmp/install.out"
+target="$project/.codex/skills/direxio-deployer"
+assert_file_exists "$target/SKILL.md"
+assert_file_exists "$target/references/agent-targets.md"
+assert_file_exists "$target/scripts/orchestrate.sh"
+assert_file_exists "$target/.direxio-skill-install.json"
+assert_contains "$target/.direxio-skill-install.json" '"agent": "codex"'
+assert_contains "$target/.direxio-skill-install.json" '"scope": "project"'
+
+printf 'stale\n' > "$target/STALE.txt"
+"$NODE_BIN" bin/direxio-deployer.mjs skill update --agent codex --scope project --project "$project" > "$tmp/update.out"
+if [ -f "$target/STALE.txt" ]; then
+  echo "managed update should replace stale target contents" >&2
+  exit 1
+fi
+
+unmanaged_project="$tmp/unmanaged"
+mkdir -p "$unmanaged_project/.codex/skills/direxio-deployer"
+printf 'manual\n' > "$unmanaged_project/.codex/skills/direxio-deployer/manual.txt"
+if "$NODE_BIN" bin/direxio-deployer.mjs skill install --agent codex --scope project --project "$unmanaged_project" >"$tmp/unmanaged.out" 2>"$tmp/unmanaged.err"; then
+  echo "unmanaged install should require --force" >&2
+  exit 1
+fi
+assert_contains "$tmp/unmanaged.err" 'refusing to overwrite unmanaged target'
+
+"$NODE_BIN" bin/direxio-deployer.mjs skill install --agent codex --scope project --project "$unmanaged_project" --force > "$tmp/force.out"
+assert_file_exists "$unmanaged_project/.codex/skills/direxio-deployer/SKILL.md"
+if [ -f "$unmanaged_project/.codex/skills/direxio-deployer/manual.txt" ]; then
+  echo "forced install should replace unmanaged contents" >&2
+  exit 1
+fi
+
+"$NODE_BIN" bin/direxio-deployer.mjs skill install --agent gemini --scope global --home "$tmp/home" --dry-run > "$tmp/dry-run.out"
+assert_contains "$tmp/dry-run.out" '"dryRun": true'
+assert_contains "$tmp/dry-run.out" '.gemini'
+if [ -e "$tmp/home/.gemini" ]; then
+  echo "dry-run should not create global target directories" >&2
+  exit 1
+fi
+
+PI_CODING_AGENT_DIR="$tmp/pi-agent-root" "$NODE_BIN" bin/direxio-deployer.mjs skill install --agent pi --scope global --dry-run > "$tmp/pi-global.out"
+assert_contains "$tmp/pi-global.out" 'pi-agent-root'
+assert_contains "$tmp/pi-global.out" 'skills'
+if grep -q 'pi-agent-root.*/agent/skills' "$tmp/pi-global.out"; then
+  echo "PI_CODING_AGENT_DIR already points at the agent root and must not append another agent segment" >&2
+  exit 1
+fi
+
+custom_target="$tmp/custom target/skill"
+"$NODE_BIN" bin/direxio-deployer.mjs skill install --agent codex --target "$custom_target" > "$tmp/custom-target.out"
+assert_file_exists "$custom_target/SKILL.md"
+assert_file_exists "$custom_target/.direxio-skill-install.json"
+
+"$NODE_BIN" bin/direxio-deployer.mjs skill refresh --agent codex --scope project --project "$project" --dry-run > "$tmp/refresh.out"
+assert_contains "$tmp/refresh.out" '"command": "refresh"'
+assert_contains "$tmp/refresh.out" '"target"'
+
+echo "npm skill distribution ok"