oh-my-opencode 4.13.0 → 4.14.1

package/packages/omo-codex/plugin/skills/ultimate-browsing/scripts/tests/test_extract_cookies.py

@@ -1,245 +0,0 @@
-#!/usr/bin/env python3
-"""Synthetic-fixture tests for cross-platform cookie extraction (no live browser)."""
-from __future__ import annotations
-
-import shutil
-import sqlite3
-import sys
-import tempfile
-import unittest
-from pathlib import Path
-from typing import Callable
-from unittest.mock import patch
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-from cookie_crypto import decrypt_chromium_value, derive_key  # noqa: E402
-from cookie_paths import UnsupportedPlatform, resolve_cookie_db  # noqa: E402
-from extract_cookies import extract_cookies, inject_cookies, write_cookie_file  # noqa: E402
-
-
-def _make_chromium_db(path: Path, name: str, encrypted_value: bytes, host: str) -> None:
-    conn = sqlite3.connect(str(path))
-    conn.execute(
-        "CREATE TABLE cookies (name TEXT, encrypted_value BLOB, host_key TEXT, path TEXT, "
-        "expires_utc INTEGER, is_secure INTEGER, is_httponly INTEGER, samesite INTEGER)"
-    )
-    conn.execute(
-        "INSERT INTO cookies VALUES (?,?,?,?,?,?,?,?)",
-        (name, encrypted_value, host, "/", 13_300_000_000_000_000, 1, 1, 1),
-    )
-    conn.commit()
-    conn.close()
-
-
-def _make_firefox_db(path: Path, name: str, value: str, host: str) -> None:
-    conn = sqlite3.connect(str(path))
-    conn.execute(
-        "CREATE TABLE moz_cookies (name TEXT, value TEXT, host TEXT, path TEXT, "
-        "expiry INTEGER, isSecure INTEGER, isHttpOnly INTEGER, sameSite INTEGER)"
-    )
-    conn.execute("INSERT INTO moz_cookies VALUES (?,?,?,?,?,?,?,?)", (name, value, host, "/", 9999999999, 1, 1, 1))
-    conn.commit()
-    conn.close()
-
-
-def _encrypt_cbc_v10(key: bytes, plaintext: str) -> bytes:
-    from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
-
-    data = plaintext.encode()
-    pad = 16 - (len(data) % 16)
-    padded = data + bytes([pad]) * pad
-    encryptor = Cipher(algorithms.AES128(key), modes.CBC(b" " * 16)).encryptor()
-    return b"v10" + encryptor.update(padded) + encryptor.finalize()
-
-
-def _encrypt_gcm_v10(key: bytes, plaintext: str) -> bytes:
-    from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
-
-    nonce = b"n" * 12
-    encryptor = Cipher(algorithms.AES(key), modes.GCM(nonce)).encryptor()
-    ciphertext = encryptor.update(plaintext.encode()) + encryptor.finalize()
-    return b"v10" + nonce + ciphertext + encryptor.tag
-
-
-class PathResolution(unittest.TestCase):
-    def test_macos_chromium_path(self) -> None:
-        base = Path(self.tmp())
-        target = base / "Google/Chrome/Default/Cookies"
-        target.parent.mkdir(parents=True)
-        target.write_bytes(b"")
-        self.assertEqual(resolve_cookie_db("chrome", "darwin", base_override=base), target)
-
-    def test_linux_chromium_network_path(self) -> None:
-        base = Path(self.tmp())
-        target = base / "google-chrome/Default/Network/Cookies"
-        target.parent.mkdir(parents=True)
-        target.write_bytes(b"")
-        self.assertEqual(resolve_cookie_db("chrome", "linux", base_override=base), target)
-
-    def test_windows_chromium_path(self) -> None:
-        base = Path(self.tmp())
-        target = base / "Google/Chrome/User Data/Default/Cookies"
-        target.parent.mkdir(parents=True)
-        target.write_bytes(b"")
-        self.assertEqual(resolve_cookie_db("chrome", "win32", base_override=base), target)
-
-    def test_unsupported_platform_raises(self) -> None:
-        with self.assertRaises(UnsupportedPlatform):
-            resolve_cookie_db("chrome", "sunos")
-
-    def test_unsupported_browser_raises(self) -> None:
-        with self.assertRaises(UnsupportedPlatform):
-            resolve_cookie_db("nonexistent", "darwin")
-
-    def tmp(self) -> str:
-        import tempfile
-
-        d = tempfile.mkdtemp()
-        self.addCleanup(lambda: __import__("shutil").rmtree(d, ignore_errors=True))
-        return d
-
-
-class KeyDerivation(unittest.TestCase):
-    def test_macos_iters_differ_from_linux(self) -> None:
-        secret = b"some-keychain-secret"
-        self.assertNotEqual(derive_key("darwin", secret), derive_key("linux", secret))
-        self.assertEqual(len(derive_key("darwin", secret)), 16)
-
-    def test_windows_passthrough_32_bytes(self) -> None:
-        key = b"k" * 32
-        self.assertEqual(derive_key("win32", key), key)
-
-    def test_windows_rejects_wrong_length(self) -> None:
-        with self.assertRaises(ValueError):
-            derive_key("win32", b"short")
-
-    def test_unsupported_platform_raises(self) -> None:
-        with self.assertRaises(UnsupportedPlatform):
-            derive_key("sunos", b"x")
-
-
-class Decryption(unittest.TestCase):
-    def test_macos_cbc_roundtrip(self) -> None:
-        key = derive_key("darwin", b"secret")
-        blob = _encrypt_cbc_v10(key, "session-token-123")
-        self.assertEqual(decrypt_chromium_value("darwin", key, blob), "session-token-123")
-
-    def test_windows_gcm_roundtrip(self) -> None:
-        key = b"k" * 32
-        blob = _encrypt_gcm_v10(key, "win-token-xyz")
-        self.assertEqual(decrypt_chromium_value("win32", key, blob), "win-token-xyz")
-
-
-class EndToEnd(unittest.TestCase):
-    def _base_with_db(self, rel: str, make: Callable[[Path], None]) -> Path:
-        base = Path(tempfile.mkdtemp())
-        self.addCleanup(lambda: shutil.rmtree(str(base), ignore_errors=True))
-        db = base / rel
-        db.parent.mkdir(parents=True)
-        make(db)
-        return base
-
-    def test_chromium_extract_with_injected_keyring(self) -> None:
-        key = derive_key("darwin", b"secret")
-        blob = _encrypt_cbc_v10(key, "logged-in")
-        base = self._base_with_db(
-            "Google/Chrome/Default/Cookies",
-            lambda p: _make_chromium_db(p, "SID", blob, ".youtube.com"),
-        )
-        cookies = extract_cookies(
-            "chrome", ["youtube.com"], platform="darwin",
-            keyring_reader=lambda _s: b"secret", base_override=base,
-        )
-        self.assertEqual(len(cookies), 1)
-        self.assertEqual(cookies[0]["value"], "logged-in")
-        self.assertEqual(cookies[0]["name"], "SID")
-
-    def test_firefox_extract_unencrypted(self) -> None:
-        base = self._base_with_db(
-            "Firefox/Profiles/abc.default/cookies.sqlite",
-            lambda p: _make_firefox_db(p, "auth", "plain-value", ".example.com"),
-        )
-        cookies = extract_cookies("firefox", ["example.com"], platform="darwin", base_override=base)
-        self.assertEqual(len(cookies), 1)
-        self.assertEqual(cookies[0]["value"], "plain-value")
-
-
-class SecretHandling(unittest.TestCase):
-    def test_cookie_output_file_is_owner_only(self) -> None:
-        base = Path(tempfile.mkdtemp())
-        self.addCleanup(lambda: shutil.rmtree(str(base), ignore_errors=True))
-        output = base / "cookies.json"
-
-        write_cookie_file(output, [{"name": "SID", "value": "secret"}])
-
-        self.assertEqual(output.stat().st_mode & 0o777, 0o600)
-        self.assertIn("secret", output.read_text())
-
-    def test_cookie_output_replaces_existing_file_only_after_private_temp_write(self) -> None:
-        base = Path(tempfile.mkdtemp())
-        self.addCleanup(lambda: shutil.rmtree(str(base), ignore_errors=True))
-        output = base / "cookies.json"
-        output.write_text("old\n")
-        output.chmod(0o644)
-
-        def _dump(_cookies, f, indent: int) -> None:
-            self.assertEqual(output.read_text(), "old\n")
-            self.assertEqual(output.stat().st_mode & 0o777, 0o644)
-            temp_files = list(base.glob(".cookies.json.*.tmp"))
-            self.assertEqual(len(temp_files), 1)
-            self.assertEqual(temp_files[0].stat().st_mode & 0o777, 0o600)
-            f.write('[{"name": "SID", "value": "secret"}]')
-
-        with patch("extract_cookies.json.dump", side_effect=_dump):
-            write_cookie_file(output, [{"name": "SID", "value": "secret"}])
-
-        self.assertEqual(output.stat().st_mode & 0o777, 0o600)
-        self.assertIn("secret", output.read_text())
-
-    def test_cookie_output_refuses_symlinks(self) -> None:
-        base = Path(tempfile.mkdtemp())
-        self.addCleanup(lambda: shutil.rmtree(str(base), ignore_errors=True))
-        target = base / "target.json"
-        target.write_text("{}")
-        link = base / "cookies.json"
-        link.symlink_to(target)
-
-        with self.assertRaises(ValueError):
-            write_cookie_file(link, [{"name": "SID", "value": "secret"}])
-
-    def test_cookie_output_refuses_dangling_symlinks(self) -> None:
-        base = Path(tempfile.mkdtemp())
-        self.addCleanup(lambda: shutil.rmtree(str(base), ignore_errors=True))
-        link = base / "cookies.json"
-        link.symlink_to(base / "missing.json")
-
-        with self.assertRaises(ValueError):
-            write_cookie_file(link, [{"name": "SID", "value": "secret"}])
-
-    def test_inject_cookies_sends_values_over_stdin_not_argv(self) -> None:
-        cookie = {
-            "name": "SID",
-            "value": "secret-token",
-            "domain": ".youtube.com",
-            "path": "/",
-            "expires": 9999999999,
-            "secure": True,
-            "httpOnly": True,
-            "sameSite": "Lax",
-        }
-
-        with patch("extract_cookies.subprocess.run") as run:
-            run.return_value.returncode = 0
-            run.return_value.stdout = "1"
-            run.return_value.stderr = ""
-
-            inject_cookies([cookie], 9242)
-
-        command = run.call_args.args[0]
-        self.assertNotIn("secret-token", command)
-        self.assertIn("secret-token", run.call_args.kwargs["input"])
-
-
-if __name__ == "__main__":
-    unittest.main(verbosity=2)

package/packages/omo-codex/plugin/test/ultraresearch-skill-contract.test.mjs

@@ -1,204 +0,0 @@
-import assert from "node:assert/strict";
-import { readFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-import { sharedSkillsRootPath } from "@oh-my-opencode/shared-skills";
-
-const root = dirname(dirname(fileURLToPath(import.meta.url)));
-
-async function readUltraresearchCopies() {
-	const sharedPath = join(sharedSkillsRootPath(), "ultraresearch", "SKILL.md");
-	const packagedPath = join(root, "skills", "ultraresearch", "SKILL.md");
-	return [
-		{ label: "shared", path: sharedPath, content: await readFile(sharedPath, "utf8") },
-		{ label: "packaged", path: packagedPath, content: await readFile(packagedPath, "utf8") },
-	];
-}
-
-function frontmatterDescription(content) {
-	const match = content.match(/^---\r?\n[\s\S]*?\bdescription:\s*"([\s\S]*?)"\r?\n[\s\S]*?---/);
-	assert.notEqual(match, null, "SKILL.md frontmatter description not found");
-	return match[1];
-}
-
-test("#given ultraresearch skill #when scanned for non-English content #then it contains no Hangul", async () => {
-	for (const copy of await readUltraresearchCopies()) {
-		assert.doesNotMatch(
-			copy.content,
-			/[ᄀ-ᇿ㄰-㆏가-힣]/,
-			`${copy.label} copy contains Hangul characters`,
-		);
-	}
-});
-
-test("#given ultraresearch description #when activation policy is inspected #then it gates on explicit research demands only", async () => {
-	for (const copy of await readUltraresearchCopies()) {
-		const description = frontmatterDescription(copy.content);
-		assert.match(description, /explicit/i, `${copy.label}: description must gate activation on explicit demand`);
-		assert.match(
-			description,
-			/ultra-precise investigation/i,
-			`${copy.label}: description must name the ultra-precise investigation trigger`,
-		);
-		assert.match(description, /\bresearch\b/i, `${copy.label}: description must name the research trigger`);
-	}
-});
-
-test("#given ultraresearch body #when authority is inspected #then it takes precedence over exploration-bounding instructions", async () => {
-	for (const copy of await readUltraresearchCopies()) {
-		assert.match(
-			copy.content,
-			/exploration-bounding|exploration (?:caps|budgets|limits)/i,
-			`${copy.label}: body must name the exploration-bounding instructions it overrides`,
-		);
-		assert.match(
-			copy.content,
-			/supersede|override|do(?:es)? not (?:bind|apply)/i,
-			`${copy.label}: body must state precedence while the mode is active`,
-		);
-	}
-});
-
-test("#given ultraresearch worker protocol #when EXPAND flow is inspected #then markers travel as message text and workers never write files", async () => {
-	for (const copy of await readUltraresearchCopies()) {
-		assert.match(copy.content, /EXPAND/, `${copy.label}: body must keep the EXPAND marker protocol`);
-		assert.match(
-			copy.content,
-			/(?:reply|message|response) text|end (?:its|the|your) (?:reply|response|final message)/i,
-			`${copy.label}: EXPAND markers must be returned as message text`,
-		);
-		assert.match(
-			copy.content,
-			/read-only|cannot write files|never ask (?:a )?worker(?:s)? to write/i,
-			`${copy.label}: body must state the read-only worker constraint`,
-		);
-		assert.doesNotMatch(
-			copy.content,
-			/APPEND (?:your )?findings to \$SESSION_DIR/i,
-			`${copy.label}: workers must not be instructed to append session-dir files`,
-		);
-	}
-});
-
-test("#given ultraresearch journaling #when ownership is inspected #then the orchestrator owns the session journal", async () => {
-	for (const copy of await readUltraresearchCopies()) {
-		assert.match(
-			copy.content,
-			/orchestrator[\s\S]{0,200}journal|journal[\s\S]{0,200}orchestrator/i,
-			`${copy.label}: body must assign session-journal writes to the orchestrator`,
-		);
-		assert.match(copy.content, /SESSION_DIR/, `${copy.label}: body must keep the session directory protocol`);
-	}
-});
-
-test("#given ultraresearch expansion loop #when stop rules are inspected #then convergence rules and a depth cap are stated", async () => {
-	for (const copy of await readUltraresearchCopies()) {
-		assert.match(copy.content, /converg/i, `${copy.label}: body must define convergence`);
-		assert.match(copy.content, /depth/i, `${copy.label}: body must define an expansion depth cap`);
-		assert.match(
-			copy.content,
-			/minimum (?:of )?(?:2|two) expansion waves|at least (?:2|two) expansion waves/i,
-			`${copy.label}: body must require a minimum of two expansion waves before convergence`,
-		);
-	}
-});
-
-test("#given ultraresearch under ultrawork #when coexistence is inspected #then marker and done-definition conflicts are resolved", async () => {
-	for (const copy of await readUltraresearchCopies()) {
-		assert.match(copy.content, /ultrawork|\bulw\b/i, `${copy.label}: body must address ultrawork coexistence`);
-		assert.match(
-			copy.content,
-			/first(?:-| )line/i,
-			`${copy.label}: body must resolve the first-line activation marker conflict`,
-		);
-	}
-});
-
-test("#given ultraresearch worker sizing #when spawn guidance is inspected #then capable-model and high-effort routing is stated", async () => {
-	for (const copy of await readUltraresearchCopies()) {
-		assert.match(
-			copy.content,
-			/capable model|high(?:est)? (?:reasoning )?effort/i,
-			`${copy.label}: body must route research workers to a capable model or high effort`,
-		);
-	}
-});
-
-test("#given ultraresearch execution substrate #when team usage is inspected #then it prefers a cooperating team with harness-native team tools", async () => {
-	for (const copy of await readUltraresearchCopies()) {
-		assert.match(
-			copy.content,
-			/cooperating team/i,
-			`${copy.label}: body must encourage running the swarm as a cooperating team`,
-		);
-		assert.match(copy.content, /\bteammode\b/i, `${copy.label}: body must name the Codex teammode skill`);
-		assert.match(copy.content, /team_mode/i, `${copy.label}: body must name the OpenCode team_mode path`);
-	}
-});
-
-test("#given ultraresearch team composition #when member slicing is inspected #then members map to part/ownership/perspective, never job titles", async () => {
-	for (const copy of await readUltraresearchCopies()) {
-		assert.match(
-			copy.content,
-			/by part, ownership, or perspective/i,
-			`${copy.label}: body must compose members by part, ownership, or perspective`,
-		);
-		assert.match(
-			copy.content,
-			/never a job title|not (?:a |by )?job title/i,
-			`${copy.label}: body must forbid vague job-title members`,
-		);
-	}
-});
-
-test("#given ultraresearch team communication #when the raise law is inspected #then members broadcast every lead immediately rather than hoarding", async () => {
-	for (const copy of await readUltraresearchCopies()) {
-		assert.match(
-			copy.content,
-			/raise law|broadcast every lead/i,
-			`${copy.label}: body must state the raise/broadcast law`,
-		);
-		assert.match(copy.content, /over-communicate/i, `${copy.label}: body must demand over-communication`);
-		assert.match(
-			copy.content,
-			/the (?:moment|instant) it (?:surfaces|appears|lands)/i,
-			`${copy.label}: body must require raising leads the moment they surface`,
-		);
-		assert.match(
-			copy.content,
-			/hoard/i,
-			`${copy.label}: body must reject hoarding leads for a final dump`,
-		);
-	}
-});
-
-test("#given ultraresearch non-code verification #when the gate is inspected #then a claim ledger / verified-claims data-flow-lock exists", async () => {
-	for (const copy of await readUltraresearchCopies()) {
-		assert.match(
-			copy.content,
-			/claim ledger|verified-claims/i,
-			`${copy.label}: body must define the non-code claim-ledger verification gate`,
-		);
-	}
-});
-
-test("#given ultraresearch claim ledger #when ownership is inspected #then workers never write the ledger / verified-claims artifact", async () => {
-	for (const copy of await readUltraresearchCopies()) {
-		assert.doesNotMatch(
-			copy.content,
-			/worker[^.]*\b(?:write|append|create)s?\b[^.]*(?:ledger|verified-claims)/i,
-			`${copy.label}: workers must not be instructed to write/append/create the ledger or verified-claims`,
-		);
-	}
-});
-
-test("#given ultraresearch blocked sources #when escalation is inspected #then it routes through the ultimate-browsing skill", async () => {
-	for (const copy of await readUltraresearchCopies()) {
-		assert.match(
-			copy.content,
-			/ultimate-browsing/,
-			`${copy.label}: body must escalate blocked sources via the ultimate-browsing skill`,
-		);
-	}
-});