enya-agent 0.1.0

package/crates/enact-config/test-env-vars.sh

@@ -0,0 +1,34 @@
+#!/bin/bash
+# Quick test script for ENACT_* environment variable support
+
+echo "=== Testing ENACT_* Environment Variable Support ==="
+echo ""
+
+# Test 1: Run unit tests
+echo "1. Running unit tests..."
+cargo test -p enact-config keychain::tests --lib
+echo ""
+
+# Test 2: Test with environment variable set inline
+echo "2. Testing with inline environment variable..."
+ENACT_PROVIDERS_AZURE_APIKEY=test-key-from-env cargo test -p enact-config keychain::tests::test_get_from_env_var --lib -- --nocapture
+echo ""
+
+# Test 3: Test the example program
+echo "3. Running example program (without env vars)..."
+cargo run --example test-env-vars 2>/dev/null || echo "  (This will show env vars are not set)"
+echo ""
+
+echo "4. Running example program (with env vars)..."
+ENACT_PROVIDERS_AZURE_APIKEY=my-azure-key \
+ENACT_PROVIDERS_ANTHROPIC_APIKEY=my-anthropic-key \
+ENACT_PROVIDERS_OPENAI_APIKEY=my-openai-key \
+cargo run --example test-env-vars
+echo ""
+
+echo "=== Test Complete ==="
+echo ""
+echo "To test manually:"
+echo "  export ENACT_PROVIDERS_AZURE_APIKEY=your-key"
+echo "  cargo run --example test-env-vars"
+

package/crates/enact-config/tests/README.md

@@ -0,0 +1,99 @@
+# Config Management Tests
+
+This directory contains comprehensive tests for the config management system.
+
+## Test Structure
+
+### Unit Tests (in `src/`)
+- `lib.rs` - Basic config manager tests
+- `keychain.rs` - Keychain operation tests
+- `encrypted_store.rs` - Encryption/decryption tests
+
+### Integration Tests (in `tests/`)
+- `config_integration_test.rs` - End-to-end config lifecycle tests
+- `security_test.rs` - Security and encryption tests
+
+## Running Tests
+
+### All Tests
+```bash
+cd crates/enact-config
+cargo test
+```
+
+### Specific Test Suite
+```bash
+# Integration tests only
+cargo test --test config_integration_test
+
+# Security tests only
+cargo test --test security_test
+
+# With output
+cargo test -- --nocapture
+```
+
+### Test Coverage
+```bash
+# Install cargo-tarpaulin if not already installed
+cargo install cargo-tarpaulin
+
+# Run with coverage
+cargo tarpaulin --out Html
+```
+
+## Test Categories
+
+### 1. Config Lifecycle Tests
+- Default config creation
+- Save and load operations
+- Config persistence across restarts
+- Runtime mode transitions
+
+### 2. Secret Management Tests
+- Secret storage in keychain
+- Secret retrieval
+- Secret deletion
+- Secret isolation (not in config file)
+
+### 3. Storage Backend Tests
+- Event store configuration
+- State store configuration
+- Vector store configuration (SQLite/Qdrant)
+- Artifact store configuration
+
+### 4. Tools Configuration Tests
+- PDF engine selection
+- OCR engine selection
+- Embeddings engine selection
+- Language configuration
+
+### 5. Air-Gapped Mode Tests
+- Sync disabled in air-gapped mode
+- Network blocking enforcement
+- Local-only feature availability
+
+### 6. Security Tests
+- Encryption verification (no plaintext in files)
+- Secret isolation (secrets not in config file)
+- Multiple secrets isolation
+- Encryption key management
+
+### 7. Sync Tests
+- Sync status computation
+- Sync enabled/disabled logic
+- Air-gapped mode sync blocking
+
+## Test Environment
+
+Tests use `tempfile` for isolated test directories and don't require:
+- Real keychain access (uses test keychain)
+- Network connectivity
+- Database connections
+
+## Known Limitations
+
+- Keychain tests may require user interaction on some platforms
+- Some tests may need to be run with appropriate permissions
+- Integration tests with cloud sync require mock HTTP server
+

package/crates/enact-config/tests/config_integration_test.rs

@@ -0,0 +1,202 @@
+//! Integration tests for config management
+
+use enact_config::{Config, ConfigManager, RuntimeMode, SyncManager, SyncStatus};
+use std::sync::Once;
+use tempfile::TempDir;
+
+fn use_mock_secrets() {
+    static INIT: Once = Once::new();
+    INIT.call_once(|| {
+        std::env::set_var("ENACT_USE_MOCK_SECRET_STORE", "1");
+    });
+}
+
+#[tokio::test]
+async fn test_config_lifecycle() {
+    use_mock_secrets();
+    let temp_dir = TempDir::new().unwrap();
+    let config_path = temp_dir.path().join("test_config.encrypted");
+    let manager = ConfigManager::new(&config_path).await.unwrap();
+
+    // Test default config
+    let config = manager.load().await.unwrap();
+    assert_eq!(config.runtime.mode, RuntimeMode::Local);
+    assert_eq!(config.runtime.max_concurrent_executions, 10);
+    assert!(config.runtime.enable_telemetry);
+
+    // Test save and load
+    let mut config = Config::default();
+    config.runtime.mode = RuntimeMode::AirGapped;
+    config.runtime.allow_network = false;
+    config.storage.vector_store.r#type = "qdrant".to_string();
+    manager.save(&config).await.unwrap();
+
+    let loaded = manager.load().await.unwrap();
+    assert_eq!(loaded.runtime.mode, RuntimeMode::AirGapped);
+    assert!(!loaded.runtime.allow_network);
+    assert_eq!(loaded.storage.vector_store.r#type, "qdrant");
+}
+
+#[tokio::test]
+async fn test_secret_management() {
+    use_mock_secrets();
+    let temp_dir = TempDir::new().unwrap();
+    let config_path = temp_dir.path().join("test_config.encrypted");
+    let manager = ConfigManager::new(&config_path).await.unwrap();
+
+    // Test set and get secret
+    manager
+        .set_secret("providers.azure.apiKey", "test-key-123")
+        .await
+        .unwrap();
+    let value = manager.get_secret("providers.azure.apiKey").await.unwrap();
+    assert_eq!(value, Some("test-key-123".to_string()));
+
+    // Test delete
+    manager
+        .delete_secret("providers.azure.apiKey")
+        .await
+        .unwrap();
+    let value = manager.get_secret("providers.azure.apiKey").await.unwrap();
+    assert_eq!(value, None);
+}
+
+#[tokio::test]
+async fn test_airgapped_mode_sync_disabled() {
+    use_mock_secrets();
+    let temp_dir = TempDir::new().unwrap();
+    let config_path = temp_dir.path().join("test_config.encrypted");
+    let manager = ConfigManager::with_sync(
+        &config_path,
+        Some("https://api.example.com".to_string()),
+        Some("tenant-123".to_string()),
+        true,                   // auto_sync enabled
+        RuntimeMode::AirGapped, // but air-gapped mode
+    )
+    .await
+    .unwrap();
+
+    // Sync should be disabled in air-gapped mode
+    assert_eq!(manager.sync_status(), SyncStatus::Disabled);
+
+    let config = manager.load().await.unwrap();
+    assert_eq!(config.runtime.mode, RuntimeMode::AirGapped);
+
+    // Attempting sync should return None (disabled)
+    let result = manager.sync_to_cloud(&config).await.unwrap();
+    assert_eq!(result, None);
+}
+
+#[tokio::test]
+async fn test_storage_config_persistence() {
+    use_mock_secrets();
+    let temp_dir = TempDir::new().unwrap();
+    let config_path = temp_dir.path().join("test_config.encrypted");
+    let manager = ConfigManager::new(&config_path).await.unwrap();
+
+    let mut config = manager.load().await.unwrap();
+
+    // Set storage backends
+    config.storage.event_store.r#type = "postgres".to_string();
+    config.storage.event_store.dsn = Some("postgres://localhost/enact".to_string());
+    config.storage.vector_store.r#type = "qdrant".to_string();
+    config.storage.vector_store.url = Some("http://localhost:6333".to_string());
+    config.storage.artifact_store.compression = "zstd".to_string();
+
+    manager.save(&config).await.unwrap();
+
+    // Reload and verify
+    let loaded = manager.load().await.unwrap();
+    assert_eq!(loaded.storage.event_store.r#type, "postgres");
+    assert_eq!(
+        loaded.storage.event_store.dsn,
+        Some("postgres://localhost/enact".to_string())
+    );
+    assert_eq!(loaded.storage.vector_store.r#type, "qdrant");
+    assert_eq!(
+        loaded.storage.vector_store.url,
+        Some("http://localhost:6333".to_string())
+    );
+    assert_eq!(loaded.storage.artifact_store.compression, "zstd");
+}
+
+#[tokio::test]
+async fn test_tools_config_persistence() {
+    use_mock_secrets();
+    let temp_dir = TempDir::new().unwrap();
+    let config_path = temp_dir.path().join("test_config.encrypted");
+    let manager = ConfigManager::new(&config_path).await.unwrap();
+
+    let mut config = manager.load().await.unwrap();
+
+    // Set ingestion tools
+    config.tools.ingestion.pdf.engine = "poppler".to_string();
+    config.tools.ingestion.ocr.engine = "paddle".to_string();
+    config.tools.ingestion.ocr.languages = vec!["eng".to_string(), "fra".to_string()];
+    config.tools.ingestion.embeddings.engine = "openai".to_string();
+    config.tools.ingestion.embeddings.model = Some("text-embedding-3-small".to_string());
+
+    manager.save(&config).await.unwrap();
+
+    // Reload and verify
+    let loaded = manager.load().await.unwrap();
+    assert_eq!(loaded.tools.ingestion.pdf.engine, "poppler");
+    assert_eq!(loaded.tools.ingestion.ocr.engine, "paddle");
+    assert_eq!(loaded.tools.ingestion.ocr.languages.len(), 2);
+    assert_eq!(loaded.tools.ingestion.embeddings.engine, "openai");
+    assert_eq!(
+        loaded.tools.ingestion.embeddings.model,
+        Some("text-embedding-3-small".to_string())
+    );
+}
+
+#[tokio::test]
+async fn test_runtime_mode_transitions() {
+    use_mock_secrets();
+    let temp_dir = TempDir::new().unwrap();
+    let config_path = temp_dir.path().join("test_config.encrypted");
+    let manager = ConfigManager::new(&config_path).await.unwrap();
+
+    // Test all runtime modes
+    for mode in [
+        RuntimeMode::Local,
+        RuntimeMode::AirGapped,
+        RuntimeMode::Cloud,
+    ] {
+        let mut config = manager.load().await.unwrap();
+        config.runtime.mode = mode;
+        manager.save(&config).await.unwrap();
+
+        let loaded = manager.load().await.unwrap();
+        assert_eq!(loaded.runtime.mode, mode);
+    }
+}
+
+#[tokio::test]
+async fn test_sync_manager_status() {
+    use_mock_secrets();
+    // Test sync enabled
+    let sync_enabled = SyncManager::new(
+        Some("https://api.example.com".to_string()),
+        Some("tenant-123".to_string()),
+        true,
+        RuntimeMode::Local,
+    );
+    assert!(sync_enabled.is_enabled());
+    assert_eq!(sync_enabled.status(), SyncStatus::Enabled);
+
+    // Test sync disabled - air-gapped
+    let sync_airgapped = SyncManager::new(
+        Some("https://api.example.com".to_string()),
+        Some("tenant-123".to_string()),
+        true,
+        RuntimeMode::AirGapped,
+    );
+    assert!(!sync_airgapped.is_enabled());
+    assert_eq!(sync_airgapped.status(), SyncStatus::Disabled);
+
+    // Test sync disabled - no auth
+    let sync_no_auth = SyncManager::new(None, None, true, RuntimeMode::Local);
+    assert!(!sync_no_auth.is_enabled());
+    assert_eq!(sync_no_auth.status(), SyncStatus::Disabled);
+}

package/crates/enact-config/tests/security_test.rs

@@ -0,0 +1,140 @@
+//! Security tests for config management
+
+use enact_config::{ConfigManager, RuntimeMode};
+use std::sync::Once;
+use tempfile::TempDir;
+
+fn use_mock_secrets() {
+    static INIT: Once = Once::new();
+    INIT.call_once(|| {
+        std::env::set_var("ENACT_USE_MOCK_SECRET_STORE", "1");
+    });
+}
+
+#[tokio::test]
+async fn test_encryption_persistence() {
+    use_mock_secrets();
+    let temp_dir = TempDir::new().unwrap();
+    let config_path = temp_dir.path().join("test_config.encrypted");
+    let manager = ConfigManager::new(&config_path).await.unwrap();
+
+    let mut config = manager.load().await.unwrap();
+    config.runtime.mode = RuntimeMode::AirGapped;
+    config.storage.vector_store.r#type = "qdrant".to_string();
+    manager.save(&config).await.unwrap();
+
+    // Verify file is encrypted (should not contain plaintext)
+    let file_contents = std::fs::read_to_string(manager.config_path()).unwrap();
+    assert!(!file_contents.contains("airgapped"));
+    assert!(!file_contents.contains("qdrant"));
+    assert!(file_contents.contains("nonce") || file_contents.contains("ciphertext"));
+}
+
+#[tokio::test]
+async fn test_secret_isolation() {
+    use_mock_secrets();
+    let temp_dir = TempDir::new().unwrap();
+    let config_path = temp_dir.path().join("test_config.encrypted");
+    let manager = ConfigManager::new(&config_path).await.unwrap();
+
+    // Set a secret
+    let secret_value = "super-secret-api-key-12345";
+    manager
+        .set_secret("providers.azure.apiKey", secret_value)
+        .await
+        .unwrap();
+
+    // Verify secret is NOT in the encrypted config file
+    let config = manager.load().await.unwrap();
+    let config_json = serde_json::to_string(&config).unwrap();
+    assert!(!config_json.contains(secret_value));
+
+    // Verify we can still retrieve it from keychain
+    let retrieved = manager.get_secret("providers.azure.apiKey").await.unwrap();
+    assert_eq!(retrieved, Some(secret_value.to_string()));
+}
+
+#[tokio::test]
+async fn test_airgapped_network_blocking() {
+    use_mock_secrets();
+    let temp_dir = TempDir::new().unwrap();
+    let config_path = temp_dir.path().join("test_config.encrypted");
+
+    // Create manager with sync enabled but air-gapped mode
+    let manager = ConfigManager::with_sync(
+        &config_path,
+        Some("https://api.example.com".to_string()),
+        Some("tenant-123".to_string()),
+        true,
+        RuntimeMode::AirGapped,
+    )
+    .await
+    .unwrap();
+
+    let config = manager.load().await.unwrap();
+    assert_eq!(config.runtime.mode, RuntimeMode::AirGapped);
+    assert!(!config.runtime.allow_network);
+
+    // Sync should be disabled
+    assert_eq!(manager.sync_status(), enact_config::SyncStatus::Disabled);
+
+    // Attempting sync should not make network calls
+    let result = manager.sync_to_cloud(&config).await.unwrap();
+    assert_eq!(result, None);
+}
+
+#[tokio::test]
+async fn test_multiple_secrets_isolation() {
+    use_mock_secrets();
+    let temp_dir = TempDir::new().unwrap();
+    let config_path = temp_dir.path().join("test_config.encrypted");
+    let manager = ConfigManager::new(&config_path).await.unwrap();
+
+    // Set multiple secrets
+    manager
+        .set_secret("providers.azure.apiKey", "azure-key-123")
+        .await
+        .unwrap();
+    manager
+        .set_secret("providers.anthropic.apiKey", "anthropic-key-456")
+        .await
+        .unwrap();
+    manager
+        .set_secret("providers.openai.apiKey", "openai-key-789")
+        .await
+        .unwrap();
+
+    // Verify each secret is isolated
+    assert_eq!(
+        manager.get_secret("providers.azure.apiKey").await.unwrap(),
+        Some("azure-key-123".to_string())
+    );
+    assert_eq!(
+        manager
+            .get_secret("providers.anthropic.apiKey")
+            .await
+            .unwrap(),
+        Some("anthropic-key-456".to_string())
+    );
+    assert_eq!(
+        manager.get_secret("providers.openai.apiKey").await.unwrap(),
+        Some("openai-key-789".to_string())
+    );
+
+    // Delete one and verify others remain
+    manager
+        .delete_secret("providers.azure.apiKey")
+        .await
+        .unwrap();
+    assert_eq!(
+        manager.get_secret("providers.azure.apiKey").await.unwrap(),
+        None
+    );
+    assert_eq!(
+        manager
+            .get_secret("providers.anthropic.apiKey")
+            .await
+            .unwrap(),
+        Some("anthropic-key-456".to_string())
+    );
+}

package/crates/enact-context/Cargo.toml

@@ -0,0 +1,41 @@
+[package]
+name = "enact-context"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+description = "Context window management and compaction for Enact"
+repository.workspace = true
+homepage.workspace = true
+keywords = ["context", "token", "compaction", "window"]
+categories.workspace = true
+
+[dependencies]
+# Core dependencies
+enact-core = { workspace = true }
+
+# Async runtime
+tokio.workspace = true
+async-trait.workspace = true
+
+# Serialization
+serde.workspace = true
+serde_json.workspace = true
+
+# Token counting
+tiktoken-rs.workspace = true
+
+# Error handling
+thiserror.workspace = true
+anyhow.workspace = true
+
+# Tracing
+tracing.workspace = true
+
+# Time
+chrono.workspace = true
+
+# UUID
+uuid.workspace = true
+
+[dev-dependencies]
+tokio = { workspace = true, features = ["test-util"] }