pi-harness-runtime 1.1.445 → 1.1.447

package/scripts/run-node-tests.mjs

@@ -1,196 +0,0 @@
-#!/usr/bin/env node
-/**
- * Run the test files that can run under node.
- *
- * The root suite (`npm test`) runs every test file under bun, one file per
- * process. That is the authoritative suite: the harness sources are
- * TypeScript and import each other with the ".js" specifier convention, and
- * bun maps such a specifier to the TypeScript source. Node resolves the
- * specifier to a real file, so it needs the compiled artifacts.
- *
- * This suite is the other half of the promise: it proves that the code a
- * consumer receives still runs under node, the runtime that pi itself uses.
- * Only a part of the root suite can do that, because some files cannot be
- * loaded by node at all:
- *
- *   - one imports `bun:test`, which node's ESM loader rejects outright,
- *   - one reads a source that uses a TypeScript parameter property, which
- *     node's strip-only mode cannot transform,
- *   - the rest reach a root-level or harness module whose internal
- *     specifiers use the compiled ".js" convention. Bun maps such a
- *     specifier to the TypeScript source; node resolves it to a real file.
- *     The published package ships the root sources as TypeScript, so those
- *     files are meant to run under bun.
- *
- * The npm script used to run `node --test` over every test file, which
- * failed on exactly those files. A script that always fails is worse than
- * no script: it looks like a failing test and hides the files that really
- * do run under node.
- *
- * The excluded files are listed by name and reason on every run, so nobody
- * can mistake "not run here" for "passed here". The root suite still runs
- * all of them.
- */
-import { spawnSync } from "node:child_process";
-import { existsSync, readdirSync } from "node:fs";
-import { join, sep } from "node:path";
-
-/**
- * Files that node cannot load, and why. Each entry names a real reason; a
- * file that starts working under node has to be taken out of this list, not
- * left in it.
- */
-const NOT_NODE_COMPATIBLE = new Map([
-	[
-		"test/console-guard.test.mjs",
-		"imports bun:test, which node's ESM loader rejects",
-	],
-	[
-		"test/skill-remote-source.test.mjs",
-		"the source uses a TypeScript parameter property, which node's strip-only mode cannot transform",
-	],
-	[
-		"test/loop-runtime.test.mjs",
-		"reaches a harness module that imports siblings with the compiled '.js' convention, and the repository does not compile the harness",
-	],
-	[
-		"test/quota-status.test.mjs",
-		"reaches a harness module that imports siblings with the compiled '.js' convention, and the repository does not compile the harness",
-	],
-	[
-		"test/mirror.test.mjs",
-		"reaches a root-level module that imports siblings with the compiled '.js' convention, and the published package ships the root sources as TypeScript",
-	],
-	[
-		"test/renderer.test.mjs",
-		"reaches a root-level module that imports siblings with the compiled '.js' convention, and the published package ships the root sources as TypeScript",
-	],
-	[
-		"test/repair-engine.test.mjs",
-		"reaches a root-level module that imports siblings with the compiled '.js' convention, and the published package ships the root sources as TypeScript",
-	],
-	[
-		"test/tracker.test.mjs",
-		"reaches a root-level module that imports siblings with the compiled '.js' convention, and the published package ships the root sources as TypeScript",
-	],
-]);
-
-/** The directories that hold test files. */
-const SUITE_DIRS = ["test", join("packages", "clipboard", "test")];
-
-/** Directories below a suite root that hold helpers, not suites. */
-const NON_SUITE_DIRS = new Set(["helpers", "fixtures"]);
-
-/**
- * The per-test timeout. A few of these files pack the whole application or
- * start a shell script, and node's default of five seconds is enough on a
- * fast machine and not enough on a slow one.
- */
-const TEST_TIMEOUT_MS = 120_000;
-
-const root = join(import.meta.dirname, "..");
-
-/** The same path with POSIX separators, so the list compares across systems. */
-function toPosixPath(file) {
-	return file.split(sep).join("/");
-}
-
-/** Every test file below a suite root. */
-function findTestFiles(dir) {
-	const abs = join(root, dir);
-	if (!existsSync(abs)) return [];
-	const found = [];
-	for (const name of readdirSync(abs, { recursive: true })) {
-		if (!name.endsWith(".test.mjs")) continue;
-		const relativePath = toPosixPath(join(dir, name));
-		if (relativePath.split("/").some((segment) => NON_SUITE_DIRS.has(segment))) continue;
-		found.push(relativePath);
-	}
-	return found.sort();
-}
-
-const allFiles = SUITE_DIRS.flatMap(findTestFiles).sort();
-
-if (allFiles.length === 0) {
-	// The published package ships the scripts but not the test files, so an
-	// installed copy has nothing to run. A missing suite in the repository is
-	// a regression, though - never let it pass silently.
-	const isInstalledCopy =
-		process.env.PI_HARNESS_INSTALLED === "1" || root.split(sep).includes("node_modules");
-	if (isInstalledCopy) {
-		console.log("node tests: no test files in this installation - nothing to run");
-		process.exit(0);
-	}
-	console.error("node tests: the test suite is missing - no *.test.mjs files found");
-	process.exit(1);
-}
-
-const excluded = [];
-const selected = [];
-for (const file of allFiles) {
-	const reason = NOT_NODE_COMPATIBLE.get(file);
-	if (reason) {
-		excluded.push({ file, reason });
-	} else {
-		selected.push(file);
-	}
-}
-
-// An exclusion that names a file that does not exist is a stale list, and a
-// stale list hides a file that could run.
-for (const { file } of excluded) {
-	if (!allFiles.includes(file)) {
-		console.error(`node tests: the exclusion list names "${file}", which does not exist`);
-		process.exit(1);
-	}
-}
-
-/**
- * An excluded file has to be excluded for a reason that still holds: the
- * suite runs a file with `node --test`, so a file that passes under node
- * belongs in the suite. If it passes, the exclusion is stale and it is
- * quietly keeping a file out of the suite that would have run.
- */
-for (const { file, reason } of excluded) {
-	const probe = spawnSync(
-		process.execPath,
-		["--test", `--test-timeout=${TEST_TIMEOUT_MS}`, file],
-		{ cwd: root, encoding: "utf8", timeout: 5 * 60_000, maxBuffer: 16 * 1024 * 1024 },
-	);
-	if (probe.status === 0) {
-		console.error(
-			`node tests: "${file}" is excluded but passes under node in this tree - either the exclusion is stale, or this tree has compiled artifacts that a clean checkout does not have`,
-		);
-		process.exit(1);
-	}
-	console.log(`node tests: confirmed ${file} does not run under node (${reason})`);
-}
-
-console.log(`node tests: ${selected.length} file(s) selected, ${excluded.length} skipped`);
-for (const { file, reason } of excluded) {
-	console.log(`node tests: skipped ${file} - ${reason}`);
-}
-if (selected.length === 0) {
-	console.error("node tests: no file can run under node");
-	process.exit(1);
-}
-
-const result = spawnSync(
-	process.execPath,
-	["--test", `--test-timeout=${TEST_TIMEOUT_MS}`, ...selected],
-	{ cwd: root, encoding: "utf8", timeout: 30 * 60_000, maxBuffer: 64 * 1024 * 1024 },
-);
-
-// node writes the report to stdout; the exit code carries the verdict.
-process.stdout.write(result.stdout ?? "");
-if (result.stderr) process.stderr.write(result.stderr);
-
-if (result.error) {
-	console.error(`node tests: ${result.error.message}`);
-	process.exit(1);
-}
-if (result.status !== 0) {
-	console.error(`node tests: FAILED (exit ${result.status})`);
-	process.exit(result.status ?? 1);
-}
-console.log(`node tests: ${selected.length} file(s) passed under node`);

package/scripts/run-root-tests.mjs

@@ -1,207 +0,0 @@
-#!/usr/bin/env node
-/**
- * Run the root test suite one file per process, with bun as the runtime.
- *
- * Why bun and not `node --test`:
- *
- * The harness sources are TypeScript and import each other with the
- * ".js" specifier convention (`import { x } from "./loop-runtime.js"`).
- * Node resolves that specifier to a real file, so it needs the compiled
- * artifacts - and those artifacts are gitignored build output
- * (`.gitignore` ignores `harness/*.js` and the compiled JavaScript in
- * `packages/<name>/src`). A clean checkout therefore cannot run the suite
- * under node: every import of a sibling module fails with
- * ERR_MODULE_NOT_FOUND.
- *
- * Bun maps a ".js" specifier to the TypeScript source when no JavaScript
- * file exists, which is exactly how the harness runs in production (pi
- * loads the extension with bun). Running the suite with bun therefore
- * tests the same module graph that ships.
- *
- * One file per process, because:
- *
- * 1. A file that calls `process.exit(0)` (the network diagnostics) would
- *    abort a whole directory run.
- * 2. Bun's exit code is only reliable per file: a directory run can end
- *    with 0 even when a file failed to load.
- *
- * A file that executes no test at all is a FAILURE, unless it is one of
- * the known diagnostics that deliberately exit before registering a test.
- * A green banner must mean that the assertions really ran.
- */
-import { execFileSync, spawnSync } from "node:child_process";
-import { existsSync, readdirSync } from "node:fs";
-import { join, sep } from "node:path";
-
-const PER_FILE_TIMEOUT_MS = 120_000;
-
-/** The directories that hold the root test files. */
-const SUITE_DIRS = ["test", join("packages", "clipboard", "test")];
-
-/** Directories below a suite root that hold helpers, not suites. */
-const NON_SUITE_DIRS = new Set(["helpers", "fixtures"]);
-
-/**
- * The only files that may exit without executing a test: they print a
- * SKIP banner and leave the process before they register a test. Every
- * other file that runs no test is a failure - that is what keeps a broken
- * runner from reporting a green suite.
- */
-const EXPECTED_NO_TESTS = new Set([
-	"test/chatgpt-api.test.mjs",
-	"test/chatgpt-cookies.test.mjs",
-	"test/zai-cookies.test.mjs",
-]);
-
-/** The same path with POSIX separators, so the allowlist works on Windows too. */
-function toPosixPath(file) {
-	return file.split(sep).join("/");
-}
-
-// bun is installed globally (not into node_modules/.bin), so use PATH.
-const bun = process.env.BUN_BIN ?? "bun";
-let bunVersion = "unknown";
-try {
-	bunVersion = execFileSync(bun, ["--version"], {
-		stdio: ["ignore", "pipe", "pipe"],
-		encoding: "utf8",
-	}).trim();
-} catch {
-	console.error(`root tests: "${bun}" is not executable - install bun or set BUN_BIN`);
-	process.exit(1);
-}
-console.log(`root tests: runtime ${bun} ${bunVersion}`);
-
-const root = join(import.meta.dirname, "..");
-
-/** Every *.test.mjs below a suite root (recursively). */
-function findTestFiles(dir) {
-	const abs = join(root, dir);
-	if (!existsSync(abs)) return [];
-	const found = [];
-	const excluded = [];
-	for (const name of readdirSync(abs, { recursive: true })) {
-		if (!name.endsWith(".test.mjs")) continue;
-		const relativePath = join(dir, name);
-		const segments = relativePath.split(sep);
-		if (segments.some((segment) => NON_SUITE_DIRS.has(segment))) {
-			excluded.push(relativePath);
-			continue;
-		}
-		found.push(relativePath);
-	}
-	if (excluded.length > 0) {
-		console.log(`root tests: ${excluded.length} helper file(s) excluded: ${excluded.join(", ")}`);
-	}
-	return found.sort();
-}
-
-const files = SUITE_DIRS.flatMap(findTestFiles);
-
-if (files.length === 0) {
-	// The published package ships the scripts but not the test files, so an
-	// installed copy has nothing to run. A missing suite in the repository
-	// is a regression, though - never let it pass silently.
-	const isInstalledCopy =
-		process.env.PI_HARNESS_INSTALLED === "1" || root.split(sep).includes("node_modules");
-	if (isInstalledCopy) {
-		console.log("root tests: no test files in this installation - nothing to run");
-		process.exit(0);
-	}
-	console.error("root tests: the root test suite is missing - no *.test.mjs files found");
-	process.exit(1);
-}
-
-console.log(`root tests: ${files.length} files discovered`);
-
-const failed = [];
-const skipped = [];
-let passedFiles = 0;
-let passedTests = 0;
-
-for (const file of files) {
-	const started = Date.now();
-	// bun writes the test report to stderr, stdout only carries the banner,
-	// so both streams are needed for the summary. The path is relative to
-	// the repository root: bun treats an argument as a filter, and a
-	// relative path avoids the glob-like characters of an absolute one.
-	const result = spawnSync(bun, ["test", `./${file}`], {
-		cwd: root,
-		encoding: "utf8",
-		timeout: PER_FILE_TIMEOUT_MS,
-		maxBuffer: 32 * 1024 * 1024,
-	});
-	const output = `${result.stdout ?? ""}${result.stderr ?? ""}`;
-	const code = result.status ?? -1;
-	const killed = Boolean(result.signal) || result.error?.code === "ETIMEDOUT";
-	const seconds = ((Date.now() - started) / 1000).toFixed(1);
-	const summary = output
-		.split("\n")
-		.filter((line) => /pass|fail|skip|Ran /.test(line))
-		.slice(-4)
-		.join(" | ");
-
-	// Did the file really execute a test? The "N pass" line is the primary
-	// source: it counts exactly the tests that ran. The "Ran N tests" line
-	// includes the skipped ones on bun 1.3.14, so it is only a fallback.
-	const ran = output.match(/^Ran\s+(\d+)\s+tests?\b/m);
-	const passed = output.match(/^\s*(\d+)\s+pass\s*$/m);
-	const skippedTests = output.match(/^\s*(\d+)\s+skip\s*$/m);
-	const total = ran ? Number(ran[1]) : passed ? Number(passed[1]) : 0;
-	const skippedCount = skippedTests ? Number(skippedTests[1]) : 0;
-	// The "N pass" line counts exactly the tests that ran. The "Ran N tests"
-	// line includes the skipped ones on bun 1.3.14, so it is only a fallback.
-	const executed = passed ? Number(passed[1]) : Math.max(0, total - skippedCount);
-	const allSkipped = total > 0 && skippedTests !== null && skippedCount === total;
-
-	// A killed child is a failure, even when the exit code says 0.
-	if (killed) {
-		failed.push(file);
-		console.error(`FAIL ${file} (${seconds}s, killed, exit ${code}) ${summary.slice(0, 200)}`);
-		console.error(output.split("\n").slice(-40).join("\n").trim());
-		continue;
-	}
-
-	if (code === 0 && executed === 0) {
-		if (EXPECTED_NO_TESTS.has(toPosixPath(file))) {
-			skipped.push(file);
-			console.log(`skip ${file} (${seconds}s) no tests executed (known diagnostic)`);
-		} else if (allSkipped) {
-			// Every test in the file was explicitly skipped (an opt-in suite).
-			// That is a skip, not a pass and not a failure.
-			skipped.push(file);
-			console.log(`skip ${file} (${seconds}s) all ${total} test(s) skipped`);
-		} else {
-			failed.push(file);
-			console.error(`FAIL ${file} (${seconds}s) executed no test at all`);
-			console.error(output.split("\n").slice(-20).join("\n").trim());
-		}
-		continue;
-	}
-
-	if (code === 0) {
-		passedFiles++;
-		passedTests += executed;
-		console.log(`ok   ${file} (${seconds}s) ${summary.slice(0, 110)}`);
-		continue;
-	}
-
-	failed.push(file);
-	console.error(`FAIL ${file} (${seconds}s, exit ${code}) ${summary.slice(0, 200)}`);
-	console.error(output.split("\n").slice(-40).join("\n").trim());
-}
-
-console.log(
-	`root tests: ${passedFiles}/${files.length} files passed (${passedTests} tests), ${skipped.length} skipped, ${failed.length} failed`,
-);
-
-// A green run must have executed something.
-if (passedFiles === 0 || passedTests === 0) {
-	console.error("root tests: no test was executed - the run is not meaningful");
-	process.exit(1);
-}
-
-if (failed.length > 0) {
-	console.error(`root tests: failing files: ${failed.join(", ")}`);
-	process.exit(1);
-}

package/scripts/scan-secrets.sh

@@ -1,68 +0,0 @@
-#!/bin/bash
-# scan-secrets.sh - Run secret scan on the repository
-# Usage: ./scripts/scan-secrets.sh [--fix]
-#
-# Requires: gitleaks (https://github.com/gitleaks/gitleaks)
-# Install: brew install gitleaks  or  go install github.com/gitleaks/gitleaks@latest
-
-set -e
-
-GITLEAKS="${GITLEAKS:-gitleaks}"
-
-echo "🔍 Scanning for secrets in $(pwd)"
-echo ""
-
-# Check if gitleaks is installed
-if ! command -v $GITLEAKS &> /dev/null; then
-    echo "❌ gitleaks not found!"
-    echo "   Install: brew install gitleaks"
-    echo "   Or:     go install github.com/gitleaks/gitleaks@latest"
-    exit 1
-fi
-
-GITLEAKS_VERSION=$($GITLEAKS version 2>/dev/null | head -1)
-echo "   Using: $GITLEAKS_VERSION"
-echo ""
-
-# Scan staged changes only (before commit)
-if [ "$1" = "--staged" ]; then
-    echo "📦 Scanning STAGED changes only..."
-    $GITLEAKS protect --staged --source . --verbose
-    echo "✅ Staged changes are clean!"
-    exit 0
-fi
-
-# Scan all files (full scan)
-if [ "$1" = "--full" ]; then
-    echo "📁 Scanning FULL repository (including git history)..."
-    $GITLEAKS detect --source . --verbose
-    echo "✅ Full scan complete!"
-    exit 0
-fi
-
-# Default: scan working directory (not git history)
-echo "📁 Scanning working directory..."
-echo "   Use --staged  to scan only staged changes"
-echo "   Use --full    to scan entire git history"
-echo ""
-
-RESULT=0
-$GITLEAKS protect --source . --verbose --no-git || RESULT=$?
-
-if [ $RESULT -eq 0 ]; then
-    echo ""
-    echo "✅ No secrets detected in working directory!"
-    echo ""
-    echo "⚠️  Note: .env and .npmrc contain real tokens but are in .gitignore"
-    echo "   This scan won't report them (good - they should stay ignored)"
-else
-    echo ""
-    echo "❌ Secrets detected!"
-    echo ""
-    echo "To review detected secrets:"
-    echo "   $GITLEAKS protect --source . --verbose"
-    echo ""
-    echo "If these are false positives, update .gitleaks.toml allowlist"
-fi
-
-exit $RESULT

package/scripts/sensitive-terms-selftest.sh

@@ -1,127 +0,0 @@
-#!/usr/bin/env bash
-#
-# The failing path of the sensitive-term guard, proved on demand.
-#
-# The guard is only worth something when it really fails. A scanner that
-# says "no term found" for a file that holds a term is worse than no
-# scanner at all, because it is trusted. This script puts a term in
-# front of the scanner and checks what the scanner does:
-#
-#   - it fails (exit 1) on a file that holds the term,
-#   - it fails (exit 1) on a tree that holds the term,
-#   - it fails (exit 1) on a commit message that holds the term,
-#   - it passes (exit 0) on a file that holds no term, so the failures
-#     above are caused by the term and not by the scanner,
-#   - it fails closed (exit 2) when there is no term list,
-#   - and it never prints the term in any of those runs.
-#
-# The term is built while the script runs. A term that is written in the
-# repository would be found by the guard that scans the repository, so
-# the literal string never enters the tree.
-#
-# The script needs no secret and no network. It runs the same scanner
-# that the workflow runs.
-
-set -uo pipefail
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-SCANNER="$ROOT/scripts/check-sensitive-terms.mjs"
-
-# The test term. The parts are kept apart so that the term itself is not
-# a string in this repository.
-TERM="zz"
-TERM="${TERM}placeholder"
-TERM="${TERM}name"
-
-# The term list of the environment must not decide the outcome of the
-# cases below: the case that proves the fail-closed behaviour needs a
-# run without any list.
-unset SENSITIVE_TERMS
-unset PI_SENSITIVE_TERMS_FILE
-
-WORK="$(mktemp -d)"
-trap 'rm -rf "$WORK"' EXIT
-
-fail() {
-	echo "self test failed: $1" >&2
-	exit 1
-}
-
-# Runs the scanner and checks what it did.
-#
-# $1 - the name of the case
-# $2 - the exit code the scanner has to give
-# $3 - the text the output has to hold
-# $4 - the directory the scanner runs in
-# $5... - the arguments of the scanner
-run_case() {
-	local name="$1"
-	local expect_code="$2"
-	local expect_text="$3"
-	local dir="$4"
-	shift 4
-	local output
-	local code
-	output="$(cd "$dir" && node "$SCANNER" "$@" 2>&1)"
-	code=$?
-	if [ "$code" != "$expect_code" ]; then
-		echo "$name: expected exit $expect_code, got $code" >&2
-		echo "$output" >&2
-		fail "$name"
-	fi
-	if [ -n "$expect_text" ] && ! printf '%s' "$output" | grep -qF -- "$expect_text"; then
-		echo "$name: the output does not hold the expected text" >&2
-		echo "$output" >&2
-		fail "$name"
-	fi
-	if printf '%s' "$output" | grep -qF -- "$TERM"; then
-		fail "$name printed the term"
-	fi
-	echo "ok: $name (exit $code, no term in the output)"
-}
-
-if [ ! -f "$SCANNER" ]; then
-	fail "the scanner is not at $SCANNER"
-fi
-
-# The list of terms the cases use.
-printf '%s\n' "$TERM" > "$WORK/terms.txt"
-
-# A file that holds the term, and one that does not.
-printf 'a line that holds %s\n' "$TERM" > "$WORK/sample.txt"
-printf 'a line that holds nothing\n' > "$WORK/clean.txt"
-
-run_case "a file that holds the term" 1 "sensitive list" "$WORK" \
-	--terms-file "$WORK/terms.txt" --file "$WORK/sample.txt"
-
-run_case "a file that holds no term" 0 "no sensitive term was found" "$WORK" \
-	--terms-file "$WORK/terms.txt" --file "$WORK/clean.txt"
-
-# A tree that holds the term. The push path of the workflow scans a
-# tree, so the tree mode has to fail as well.
-mkdir -p "$WORK/tree"
-printf 'a line that holds %s\n' "$TERM" > "$WORK/tree/sample.txt"
-run_case "a tree that holds the term" 1 "sensitive list" "$WORK" \
-	--terms-file "$WORK/terms.txt" --tree "$WORK/tree"
-
-# A commit message that holds the term. The push path of the workflow
-# scans the commit messages of the pushed commits.
-mkdir -p "$WORK/repo"
-git -C "$WORK/repo" init -q
-git -C "$WORK/repo" config user.email "selftest@example.com"
-git -C "$WORK/repo" config user.name "self test"
-printf 'hello\n' > "$WORK/repo/file.txt"
-git -C "$WORK/repo" add file.txt
-git -C "$WORK/repo" commit -q -m "the first commit"
-printf 'hello again\n' > "$WORK/repo/file.txt"
-git -C "$WORK/repo" add file.txt
-git -C "$WORK/repo" commit -q -m "a message that holds $TERM"
-run_case "a commit message that holds the term" 1 "sensitive list" \
-	"$WORK/repo" --terms-file "$WORK/terms.txt" --commits "HEAD~1..HEAD"
-
-# No term list at all. The check cannot run, so it says so instead of
-# reporting a clean result.
-run_case "no term list" 2 "no term list is configured" "$WORK" \
-	--file "$WORK/sample.txt"
-
-echo "the failing path of the guard is proven"