muonroi-cli 1.2.0

package/src/ee/__tests__/pipeline.integration.test.ts

@@ -0,0 +1,193 @@
+/**
+ * End-to-end pipeline integration test (ROUTE-12).
+ *
+ * Verifies all 5 events fire for a single tool invocation:
+ *   PreToolUse (intercept) -> PostToolUse (posttool) -> Judge -> Feedback -> Touch
+ *
+ * Uses real modules + stub HTTP server — no vi.mock.
+ * Anti-patterns avoided:
+ *   - No HTTP call ordering by array index (fire-and-forget lands non-deterministically)
+ *   - resetEEClientState() in beforeEach (circuit breaker + cache contamination)
+ *   - resetHookState() in beforeEach (_lastWarningResponse contamination between tests)
+ *   - No vi.mock — integration test uses real modules + stub
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { type StubHandle, startStubEEServer } from "../../__test-stubs__/ee-server.js";
+import { createEEClient, resetEEClientState } from "../client.js";
+import { setDefaultEEClient } from "../intercept.js";
+import { executeEventHooks, resetHookState } from "../../hooks/index.js";
+import type { InterceptMatch } from "../types.js";
+
+const sampleMatch: InterceptMatch = {
+  principle_uuid: "P1",
+  confidence: 0.9,
+  why: "test match",
+  message: "warning: test principle",
+  embedding_model_version: "v1",
+  scope_label: "global",
+  last_matched_at: new Date().toISOString(),
+};
+
+describe("EE full pipeline integration (ROUTE-12)", () => {
+  let stub: StubHandle;
+
+  beforeEach(async () => {
+    resetEEClientState();
+    resetHookState();
+  });
+
+  afterEach(async () => {
+    if (stub) await stub.stop();
+    resetEEClientState();
+    resetHookState();
+  });
+
+  it("fires all 5 events for a single tool invocation (intercept -> posttool -> judge -> feedback -> touch)", async () => {
+    stub = await startStubEEServer({
+      intercept: () => ({
+        decision: "allow",
+        matches: [sampleMatch],
+      }),
+    });
+
+    const client = createEEClient({
+      baseUrl: `http://127.0.0.1:${stub.port}`,
+      timeoutMs: 2000,
+    });
+    setDefaultEEClient(client);
+
+    // Event 1: PreToolUse — fires intercept, stores warning in _lastWarningResponse
+    await executeEventHooks(
+      {
+        hook_event_name: "PreToolUse",
+        tool_name: "Edit",
+        tool_input: { path: "/tmp/x.ts" },
+        cwd: process.cwd(),
+      },
+      process.cwd(),
+    );
+
+    // Event 2: PostToolUse — fires posttool + (judge -> feedback + touch via judgeCtx)
+    await executeEventHooks(
+      {
+        hook_event_name: "PostToolUse",
+        tool_name: "Edit",
+        tool_input: { path: "/tmp/x.ts" },
+        tool_output: { result: "ok" },
+        cwd: process.cwd(),
+      },
+      process.cwd(),
+    );
+
+    // Allow fire-and-forget HTTP calls (feedback + touch) to settle
+    await new Promise((r) => setTimeout(r, 500));
+
+    // Assert all 5 pipeline stages fired
+    expect(stub.calls.intercept).toHaveLength(1);   // Stage 1: PreToolUse
+    expect(stub.calls.posttool).toHaveLength(1);    // Stage 2: PostToolUse
+    expect(stub.calls.feedback.length).toBeGreaterThanOrEqual(1);    // Stage 3+4: Judge FOLLOWED -> Feedback
+    expect(stub.calls.touch.length).toBeGreaterThanOrEqual(1);     // Stage 5: Touch (FOLLOWED path)
+
+    // Verify feedback classification
+    expect(stub.calls.feedback[0]).toMatchObject({
+      principle_uuid: "P1",
+      classification: "FOLLOWED",
+      tool_name: "Edit",
+    });
+  });
+
+  it("auto-judge classifies IRRELEVANT when no matches — feedback and touch not called", async () => {
+    stub = await startStubEEServer({
+      intercept: () => ({
+        decision: "allow",
+        matches: [], // empty matches => IRRELEVANT
+      }),
+    });
+
+    const client = createEEClient({
+      baseUrl: `http://127.0.0.1:${stub.port}`,
+      timeoutMs: 2000,
+    });
+    setDefaultEEClient(client);
+
+    await executeEventHooks(
+      {
+        hook_event_name: "PreToolUse",
+        tool_name: "Edit",
+        tool_input: { path: "/tmp/y.ts" },
+        cwd: process.cwd(),
+      },
+      process.cwd(),
+    );
+
+    await executeEventHooks(
+      {
+        hook_event_name: "PostToolUse",
+        tool_name: "Edit",
+        tool_input: { path: "/tmp/y.ts" },
+        tool_output: { result: "ok" },
+        cwd: process.cwd(),
+      },
+      process.cwd(),
+    );
+
+    await new Promise((r) => setTimeout(r, 150));
+
+    // intercept + posttool fire, but no feedback or touch (IRRELEVANT has no matches to report)
+    expect(stub.calls.intercept).toHaveLength(1);
+    expect(stub.calls.posttool).toHaveLength(1);
+    expect(stub.calls.feedback).toHaveLength(0); // IRRELEVANT: judge.ts line 33 — no feedback for empty matches
+    expect(stub.calls.touch).toHaveLength(0);
+  });
+
+  it("auto-judge classifies IGNORED when outcome fails — feedback called, touch not called", async () => {
+    stub = await startStubEEServer({
+      intercept: () => ({
+        decision: "allow",
+        matches: [sampleMatch],
+      }),
+    });
+
+    const client = createEEClient({
+      baseUrl: `http://127.0.0.1:${stub.port}`,
+      timeoutMs: 2000,
+    });
+    setDefaultEEClient(client);
+
+    // PreToolUse to populate _lastWarningResponse with matches
+    await executeEventHooks(
+      {
+        hook_event_name: "PreToolUse",
+        tool_name: "Bash",
+        tool_input: { command: "exit 1" },
+        cwd: process.cwd(),
+      },
+      process.cwd(),
+    );
+
+    // PostToolUseFailure — outcome.success=false => IGNORED classification
+    await executeEventHooks(
+      {
+        hook_event_name: "PostToolUseFailure",
+        tool_name: "Bash",
+        tool_input: { command: "exit 1" },
+        error: "exit code 1",
+        cwd: process.cwd(),
+      },
+      process.cwd(),
+    );
+
+    await new Promise((r) => setTimeout(r, 150));
+
+    expect(stub.calls.intercept).toHaveLength(1);
+    expect(stub.calls.posttool).toHaveLength(1);
+    expect(stub.calls.feedback).toHaveLength(1); // IGNORED: feedback fires
+    expect(stub.calls.touch).toHaveLength(0);    // IGNORED: touch does NOT fire
+
+    expect(stub.calls.feedback[0]).toMatchObject({
+      principle_uuid: "P1",
+      classification: "IGNORED",
+    });
+  });
+});

package/src/ee/auth.test.ts

@@ -0,0 +1,76 @@
+import { promises as fs } from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import { getEmbeddingModelVersion, loadEEAuthToken, refreshAuthToken } from "./auth.js";
+
+describe("loadEEAuthToken", () => {
+  let tmpHome: string;
+
+  beforeEach(async () => {
+    tmpHome = await fs.mkdtemp(path.join(os.tmpdir(), "ee-auth-test-"));
+  });
+
+  afterEach(async () => {
+    await fs.rm(tmpHome, { recursive: true, force: true }).catch(() => {});
+  });
+
+  it("returns token when ~/.experience/config.json exists", async () => {
+    const dir = path.join(tmpHome, ".experience");
+    await fs.mkdir(dir, { recursive: true });
+    await fs.writeFile(
+      path.join(dir, "config.json"),
+      JSON.stringify({
+        authToken: "test-token-abc123",
+        embeddingModelVersion: "nomic-embed-text-v1.5",
+      }),
+    );
+    const token = await loadEEAuthToken({ home: tmpHome });
+    expect(token).toBe("test-token-abc123");
+  });
+
+  it("returns null when ~/.experience/config.json is absent (no throw)", async () => {
+    const token = await loadEEAuthToken({ home: tmpHome });
+    expect(token).toBeNull();
+  });
+
+  it("sets embeddingModelVersion from config", async () => {
+    const dir = path.join(tmpHome, ".experience");
+    await fs.mkdir(dir, { recursive: true });
+    await fs.writeFile(
+      path.join(dir, "config.json"),
+      JSON.stringify({
+        authToken: "tok",
+        embeddingModelVersion: "custom-v2",
+      }),
+    );
+    await loadEEAuthToken({ home: tmpHome });
+    expect(getEmbeddingModelVersion()).toBe("custom-v2");
+  });
+});
+
+describe("refreshAuthToken", () => {
+  let tmpHome: string;
+
+  beforeEach(async () => {
+    tmpHome = await fs.mkdtemp(path.join(os.tmpdir(), "ee-auth-ref-"));
+  });
+
+  afterEach(async () => {
+    await fs.rm(tmpHome, { recursive: true, force: true }).catch(() => {});
+  });
+
+  it("re-reads config.json and updates the cached value", async () => {
+    const dir = path.join(tmpHome, ".experience");
+    await fs.mkdir(dir, { recursive: true });
+    await fs.writeFile(path.join(dir, "config.json"), JSON.stringify({ authToken: "old-token" }));
+    const first = await loadEEAuthToken({ home: tmpHome });
+    expect(first).toBe("old-token");
+
+    // Write new token
+    await fs.writeFile(path.join(dir, "config.json"), JSON.stringify({ authToken: "new-token" }));
+    const second = await refreshAuthToken({ home: tmpHome });
+    expect(second).toBe("new-token");
+  });
+});

package/src/ee/auth.ts

@@ -0,0 +1,59 @@
+/**
+ * EE auth token loader — reads ~/.experience/config.json at startup.
+ *
+ * EE-07: auth token from config; 401 triggers refreshAuthToken() + retry-once.
+ */
+import { promises as fs } from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { redactor } from "../utils/redactor.js";
+
+export interface ExperienceConfig {
+  authToken?: string;
+  embeddingModelVersion?: string;
+  serverBaseUrl?: string;
+  serverAuthToken?: string;
+  server?: { port?: number; authToken?: string };
+}
+
+function configPath(homeOverride?: string): string {
+  return path.join(homeOverride ?? os.homedir(), ".experience", "config.json");
+}
+
+let _token: string | null = null;
+let _embeddingModelVersion: string | null = null;
+let _serverBaseUrl: string | null = null;
+
+export async function loadEEAuthToken(opts: { home?: string } = {}): Promise<string | null> {
+  try {
+    const txt = await fs.readFile(configPath(opts.home), "utf8");
+    const cfg = JSON.parse(txt) as ExperienceConfig;
+    const token = cfg.serverAuthToken ?? cfg.server?.authToken ?? cfg.authToken;
+    if (token) {
+      redactor.enrollSecret(token);
+      _token = token;
+    }
+    if (cfg.embeddingModelVersion) _embeddingModelVersion = cfg.embeddingModelVersion;
+    if (cfg.serverBaseUrl) _serverBaseUrl = cfg.serverBaseUrl;
+    return _token;
+  } catch {
+    return null;
+  }
+}
+
+export async function refreshAuthToken(opts: { home?: string } = {}): Promise<string | null> {
+  _token = null;
+  return await loadEEAuthToken(opts);
+}
+
+export function getCachedAuthToken(): string | null {
+  return _token;
+}
+
+export function getEmbeddingModelVersion(): string {
+  return _embeddingModelVersion ?? "nomic-embed-text-v1.5";
+}
+
+export function getCachedServerBaseUrl(): string | null {
+  return _serverBaseUrl;
+}

package/src/ee/bridge.test.ts

@@ -0,0 +1,290 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+// ─── Hoisted mocks (must be at module top-level for vi.mock hoisting) ──────────
+
+const mockCore = vi.hoisted(() => ({
+  classifyViaBrain: vi.fn().mockResolvedValue("generate"),
+  searchCollection: vi.fn().mockResolvedValue([{ id: "p1", score: 0.9, payload: { text: "test" } }]),
+  routeModel: vi.fn().mockResolvedValue({
+    tier: "balanced",
+    model: "claude-sonnet-4-6",
+    confidence: 0.8,
+    source: "brain",
+    reason: "test",
+    taskHash: "abc123",
+  }),
+  routeFeedback: vi.fn().mockResolvedValue(true),
+  getEmbeddingRaw: vi.fn().mockResolvedValue([0.1, 0.2, 0.3]),
+}));
+
+const mockRequire = vi.hoisted(() => vi.fn().mockReturnValue(mockCore));
+const mockAccess = vi.hoisted(() => vi.fn().mockResolvedValue(undefined));
+
+vi.mock("node:module", () => ({
+  createRequire: vi.fn().mockReturnValue(mockRequire),
+}));
+
+vi.mock("node:fs", () => ({
+  promises: { access: mockAccess },
+}));
+
+// ─── Import module under test (after mocks) ────────────────────────────────────
+
+import {
+  classifyViaBrain,
+  getEmbeddingRaw,
+  resetBridge,
+  routeFeedback,
+  routeModel,
+  searchCollection,
+} from "./bridge.js";
+
+// ─── Tests ─────────────────────────────────────────────────────────────────────
+
+describe("bridge — loaded core", () => {
+  beforeEach(() => {
+    resetBridge();
+    mockAccess.mockResolvedValue(undefined);
+    mockRequire.mockReturnValue(mockCore);
+    vi.clearAllMocks();
+    mockAccess.mockResolvedValue(undefined);
+    mockRequire.mockReturnValue(mockCore);
+    mockCore.classifyViaBrain.mockResolvedValue("generate");
+    mockCore.searchCollection.mockResolvedValue([{ id: "p1", score: 0.9, payload: { text: "test" } }]);
+    mockCore.routeModel.mockResolvedValue({
+      tier: "balanced",
+      model: "claude-sonnet-4-6",
+      confidence: 0.8,
+      source: "brain",
+      reason: "test",
+      taskHash: "abc123",
+    });
+    mockCore.routeFeedback.mockResolvedValue(true);
+    mockCore.getEmbeddingRaw.mockResolvedValue([0.1, 0.2, 0.3]);
+  });
+
+  afterEach(() => {
+    resetBridge();
+  });
+
+  it("Test 1: classifyViaBrain returns classification string when core loaded", async () => {
+    const result = await classifyViaBrain("write a function to sort an array");
+    expect(result).toBe("generate");
+    expect(mockCore.classifyViaBrain).toHaveBeenCalledWith("write a function to sort an array", 5000);
+  });
+
+  it("Test 2: searchCollection returns EEPoint[] when core loaded", async () => {
+    const vector = [0.1, 0.2, 0.3];
+    const result = await searchCollection("my-collection", vector, 5);
+    expect(result).toEqual([{ id: "p1", score: 0.9, payload: { text: "test" } }]);
+    expect(mockCore.searchCollection).toHaveBeenCalledWith("my-collection", vector, 5, undefined);
+  });
+
+  it("Test 3: routeModel returns EERouteResult when core loaded", async () => {
+    const result = await routeModel("code-generation", { cwd: "/home/user" }, "bun");
+    expect(result).toEqual({
+      tier: "balanced",
+      model: "claude-sonnet-4-6",
+      confidence: 0.8,
+      source: "brain",
+      reason: "test",
+      taskHash: "abc123",
+    });
+    expect(mockCore.routeModel).toHaveBeenCalledWith("code-generation", { cwd: "/home/user" }, "bun");
+  });
+
+  it("Test 4: routeFeedback returns true when core loaded", async () => {
+    const result = await routeFeedback("abc123", "balanced", "claude-sonnet-4-6", "success", 0, 1500);
+    expect(result).toBe(true);
+    expect(mockCore.routeFeedback).toHaveBeenCalledWith(
+      "abc123",
+      "balanced",
+      "claude-sonnet-4-6",
+      "success",
+      0,
+      1500,
+    );
+  });
+
+  it("Test 5: getEmbeddingRaw returns number[] when core loaded", async () => {
+    const result = await getEmbeddingRaw("hello world");
+    expect(result).toEqual([0.1, 0.2, 0.3]);
+    expect(mockCore.getEmbeddingRaw).toHaveBeenCalledWith("hello world", undefined);
+  });
+});
+
+describe("bridge — missing core (BRIDGE-02)", () => {
+  beforeEach(() => {
+    resetBridge();
+    vi.clearAllMocks();
+    // Simulate file not found
+    mockAccess.mockRejectedValue(new Error("ENOENT: no such file or directory"));
+  });
+
+  afterEach(() => {
+    resetBridge();
+  });
+
+  it("Test 6: classifyViaBrain returns null when core file missing", async () => {
+    const result = await classifyViaBrain("some prompt");
+    expect(result).toBeNull();
+  });
+
+  it("Test 7: searchCollection returns [] when core file missing", async () => {
+    const result = await searchCollection("col", [0.1], 3);
+    expect(result).toEqual([]);
+  });
+
+  it("Test 8: routeModel returns null when core file missing", async () => {
+    const result = await routeModel("task", {}, "bun");
+    expect(result).toBeNull();
+  });
+
+  it("Test 9: routeFeedback returns false when core file missing", async () => {
+    const result = await routeFeedback("hash", "tier", "model", "success", 0, null);
+    expect(result).toBe(false);
+  });
+
+  it("Test 10: getEmbeddingRaw returns null when core file missing", async () => {
+    const result = await getEmbeddingRaw("text");
+    expect(result).toBeNull();
+  });
+
+  it("Test 11: console.warn called with 'experience-core.js not found' message when file missing", async () => {
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+    await classifyViaBrain("prompt");
+    expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining("experience-core.js not found"));
+    warnSpy.mockRestore();
+  });
+});
+
+describe("bridge — require throws (BRIDGE-02)", () => {
+  beforeEach(() => {
+    resetBridge();
+    vi.clearAllMocks();
+    // File exists but require() throws
+    mockAccess.mockResolvedValue(undefined);
+    mockRequire.mockImplementation(() => {
+      throw new Error("corrupt module: unexpected token");
+    });
+  });
+
+  afterEach(() => {
+    resetBridge();
+    // Restore mockRequire to default behavior for subsequent test groups
+    mockRequire.mockReturnValue(mockCore);
+  });
+
+  it("Test 12: classifyViaBrain returns null when require throws", async () => {
+    const result = await classifyViaBrain("prompt");
+    expect(result).toBeNull();
+  });
+
+  it("Test 13: searchCollection returns [] when require throws", async () => {
+    const result = await searchCollection("col", [0.1], 3);
+    expect(result).toEqual([]);
+  });
+
+  it("Test 14: routeModel returns null when require throws", async () => {
+    const result = await routeModel("task", {}, "bun");
+    expect(result).toBeNull();
+  });
+
+  it("Test 15: routeFeedback returns false when require throws", async () => {
+    const result = await routeFeedback("hash", "tier", "model", "fail", 1, null);
+    expect(result).toBe(false);
+  });
+
+  it("Test 16: getEmbeddingRaw returns null when require throws", async () => {
+    const result = await getEmbeddingRaw("text");
+    expect(result).toBeNull();
+  });
+
+  it("Test 17: console.warn called with 'failed to load' message when require throws", async () => {
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+    await classifyViaBrain("prompt");
+    expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining("failed to load"));
+    warnSpy.mockRestore();
+  });
+});
+
+describe("bridge — lazy singleton", () => {
+  beforeEach(() => {
+    resetBridge();
+    vi.clearAllMocks();
+    mockAccess.mockResolvedValue(undefined);
+    mockRequire.mockReturnValue(mockCore);
+    mockCore.classifyViaBrain.mockResolvedValue("generate");
+  });
+
+  afterEach(() => {
+    resetBridge();
+  });
+
+  it("Test 18: second call to classifyViaBrain does NOT re-attempt load (lazy singleton)", async () => {
+    await classifyViaBrain("first call");
+    await classifyViaBrain("second call");
+    // mockRequire should only be called once (when loading the core)
+    expect(mockRequire).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe("bridge — resetBridge", () => {
+  beforeEach(() => {
+    resetBridge();
+    vi.clearAllMocks();
+    mockAccess.mockResolvedValue(undefined);
+    mockRequire.mockReturnValue(mockCore);
+    mockCore.classifyViaBrain.mockResolvedValue("generate");
+  });
+
+  afterEach(() => {
+    resetBridge();
+  });
+
+  it("Test 19: resetBridge allows re-attempt on next call", async () => {
+    // First call loads the core
+    await classifyViaBrain("first");
+    expect(mockRequire).toHaveBeenCalledTimes(1);
+
+    // Reset clears state
+    resetBridge();
+
+    // Second call after reset should re-attempt load
+    await classifyViaBrain("second");
+    expect(mockRequire).toHaveBeenCalledTimes(2);
+  });
+});
+
+describe("bridge — config isolation (BRIDGE-03)", () => {
+  it("Test 20: classifyViaBrain signature does NOT accept config args (type-level check)", async () => {
+    // This test verifies via TypeScript @ts-expect-error that config args are rejected
+    // If type check passes (no error here), the function signature correctly excludes config params
+
+    // Valid call — should compile
+    const _validCall = () => classifyViaBrain("prompt");
+    const _validCallWithTimeout = () => classifyViaBrain("prompt", 3000);
+
+    // These would cause @ts-expect-error if uncommented:
+    // @ts-expect-error — qdrantUrl is not a valid parameter
+    const _invalidCall = () => classifyViaBrain("prompt", 3000, "http://localhost:6333" as any);
+
+    expect(_validCall).toBeDefined();
+    expect(_validCallWithTimeout).toBeDefined();
+  });
+
+  it("Test 21: searchCollection signature does NOT accept qdrantUrl/ollamaUrl/brainModel", async () => {
+    // Valid signature
+    const _validCall = () => searchCollection("col", [0.1], 5);
+    const _validCallWithSignal = () => searchCollection("col", [0.1], 5, new AbortController().signal);
+
+    expect(_validCall).toBeDefined();
+    expect(_validCallWithSignal).toBeDefined();
+  });
+
+  it("Test 22: routeModel signature does NOT accept config params", async () => {
+    // Valid signature: (task, context, runtime)
+    const _validCall = () => routeModel("task", { key: "value" }, "bun");
+    expect(_validCall).toBeDefined();
+  });
+});