runwork 0.10.1 → 0.10.2

package/dist/commands/__tests__/clone-args.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/__tests__/clone-args.test.js

@@ -0,0 +1,44 @@
+import { describe, it, expect } from 'vitest';
+import { normalizeCloneArgs } from '../clone.js';
+describe('normalizeCloneArgs', () => {
+    it('passes through both args unchanged when --app is not provided', () => {
+        expect(normalizeCloneArgs('app-id', 'C:/dir', undefined)).toEqual({
+            appId: 'app-id',
+            directory: 'C:/dir',
+        });
+        expect(normalizeCloneArgs('app-id', 'C:/dir', {})).toEqual({
+            appId: 'app-id',
+            directory: 'C:/dir',
+        });
+    });
+    it('passes through both args unchanged when --app is set but directory is also explicit', () => {
+        expect(normalizeCloneArgs('app-id', 'C:/dir', { app: 'foo' })).toEqual({ appId: 'app-id', directory: 'C:/dir' });
+    });
+    it('shifts the first positional to directory when --app is set and only one positional arg is present', () => {
+        // The reproducer from the field:
+        //   runwork clone --app academic-grade-conversion C:\Users\Oytun\Desktop\agc-test
+        // commander binds rawAppId = "C:\Users\..." and rawDirectory = undefined.
+        expect(normalizeCloneArgs('C:\\Users\\Oytun\\Desktop\\agc-test', undefined, {
+            app: 'academic-grade-conversion',
+        })).toEqual({
+            appId: undefined,
+            directory: 'C:\\Users\\Oytun\\Desktop\\agc-test',
+        });
+    });
+    it('does not shift when --app is set and no positional args are provided', () => {
+        expect(normalizeCloneArgs(undefined, undefined, { app: 'foo' })).toEqual({
+            appId: undefined,
+            directory: undefined,
+        });
+    });
+    it('does not shift when --app is set with only the directory positional (rawAppId already undefined)', () => {
+        // commander binds positional arguments left-to-right; if only one is
+        // given, it's always rawAppId. So this case shouldn't arise in practice
+        // -- but if a future commander upgrade changes that, we should leave
+        // already-correct args alone.
+        expect(normalizeCloneArgs(undefined, 'C:/dir', { app: 'foo' })).toEqual({
+            appId: undefined,
+            directory: 'C:/dir',
+        });
+    });
+});

package/dist/commands/clone.d.ts

@@ -10,4 +10,18 @@ export interface CloneResult {
     workspaceName: string;
 }
 export declare function execClone(client: ApiClient, app: AppInfo, directory?: string, creds?: Credentials | null): Promise<CloneResult>;
+/**
+ * Reconcile positional args with --app. When --app is provided, the first
+ * positional argument is intended as the *directory* -- not another appId
+ * -- because the app is already disambiguated by the option. Without this,
+ * `runwork clone --app foo C:\path\to\dir` ends up parsing `C:\path\to\dir`
+ * as `appId` (which is then ignored because `--app` wins), leaving
+ * `directory` undefined and silently cloning into the slug under cwd.
+ */
+export declare function normalizeCloneArgs(appId: string | undefined, directory: string | undefined, options: {
+    app?: string;
+} | undefined): {
+    appId: string | undefined;
+    directory: string | undefined;
+};
 export declare const cloneCommand: Command;

package/dist/commands/clone.js

@@ -109,13 +109,28 @@ export async function execClone(client, app, directory, creds) {
         workspaceName: app.workspaceName,
     };
 }
+/**
+ * Reconcile positional args with --app. When --app is provided, the first
+ * positional argument is intended as the *directory* -- not another appId
+ * -- because the app is already disambiguated by the option. Without this,
+ * `runwork clone --app foo C:\path\to\dir` ends up parsing `C:\path\to\dir`
+ * as `appId` (which is then ignored because `--app` wins), leaving
+ * `directory` undefined and silently cloning into the slug under cwd.
+ */
+export function normalizeCloneArgs(appId, directory, options) {
+    if (options?.app && appId && !directory) {
+        return { appId: undefined, directory: appId };
+    }
+    return { appId, directory };
+}
 export const cloneCommand = new Command('clone')
     .description('Clone a Runwork app to local development')
     .argument('[appId]', 'App ID to clone (interactive if omitted)')
     .argument('[directory]', 'Target directory')
     .option('--app <name-or-id>', 'App name or ID (skips interactive selection)')
-    .action(async (appId, directory, options) => {
+    .action(async (rawAppId, rawDirectory, options) => {
     requireGit('clone');
+    const { appId, directory } = normalizeCloneArgs(rawAppId, rawDirectory, options);
     const creds = requireAuth();
     const client = new ApiClient(creds);
     const useJson = shouldOutputJson(undefined);
@@ -151,7 +166,10 @@ export const cloneCommand = new Command('clone')
         jsonOut(response);
         return;
     }
-    console.log(`\nApp "${cloneResult.appName}" cloned to ${cloneResult.directory}/`);
+    // No trailing separator: cloneResult.directory is already an absolute
+    // path. Appending '/' here mixed with Windows '\' separators produced
+    // confusing output like `C:\Users\...\app/` on Windows.
+    console.log(`\nApp "${cloneResult.appName}" cloned to ${cloneResult.directory}`);
     console.log(`Remote: ${client.getGitRemoteUrl(cloneResult.workspaceId, cloneResult.appId)}`);
     await runAgentWizard(cloneResult.directory);
     console.log(`Next: cd ${cloneResult.slug} && runwork dev`);

package/dist/generated/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.10.1";
+export declare const VERSION = "0.10.2";

package/dist/generated/version.js

@@ -1,2 +1,2 @@
 // Auto-generated by scripts/embed-types.ts -- do not edit
-export const VERSION = "0.10.1";
+export const VERSION = "0.10.2";

package/dist/git/__tests__/credential-helper-e2e.test.d.ts

@@ -0,0 +1,21 @@
+/**
+ * End-to-end auth test.
+ *
+ * Spins up a tiny HTTP server that mimics the runwork.ai git endpoint's
+ * auth contract (HTTP Basic, any username, password = API key) and runs a
+ * real `git ls-remote` against it through a credential-helper script. This
+ * verifies the entire chain we depend on:
+ *
+ *   git -> credential.<origin>.helper -> our helper script -> our helper's
+ *   protocol output -> git constructs Basic auth -> server accepts it.
+ *
+ * Catches the class of bugs we've burned hours on (Pass 1's PATH issues,
+ * Pass 2's "logged in but no helper registered") *before* a user hits them.
+ *
+ * Note: this test exercises the contract our credential helper depends on,
+ * not the helper function itself -- credentials.test.ts already covers
+ * `handleGitCredentialRequest()` in isolation. Together they prove that
+ * (a) the helper produces the right protocol output and (b) git+server
+ * accept that output as Basic auth.
+ */
+export {};

package/dist/git/__tests__/credential-helper-e2e.test.js

@@ -0,0 +1,195 @@
+/**
+ * End-to-end auth test.
+ *
+ * Spins up a tiny HTTP server that mimics the runwork.ai git endpoint's
+ * auth contract (HTTP Basic, any username, password = API key) and runs a
+ * real `git ls-remote` against it through a credential-helper script. This
+ * verifies the entire chain we depend on:
+ *
+ *   git -> credential.<origin>.helper -> our helper script -> our helper's
+ *   protocol output -> git constructs Basic auth -> server accepts it.
+ *
+ * Catches the class of bugs we've burned hours on (Pass 1's PATH issues,
+ * Pass 2's "logged in but no helper registered") *before* a user hits them.
+ *
+ * Note: this test exercises the contract our credential helper depends on,
+ * not the helper function itself -- credentials.test.ts already covers
+ * `handleGitCredentialRequest()` in isolation. Together they prove that
+ * (a) the helper produces the right protocol output and (b) git+server
+ * accept that output as Basic auth.
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+import { mkdtempSync, writeFileSync, rmSync, chmodSync, existsSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { createServer } from 'http';
+import { probeGit } from '../preflight.js';
+const execFileAsync = promisify(execFile);
+const EXPECTED_API_KEY = 'test-api-key-abcd1234';
+/**
+ * Minimal HTTP server that:
+ *   - Returns 401 + WWW-Authenticate when no Basic auth is supplied
+ *   - Returns 401 when password (the API key) is wrong; username is ignored
+ *   - Returns 200 + a valid empty-refs pkt-line response when auth is correct
+ *
+ * The pkt-line response is the smallest valid output for `info/refs?
+ * service=git-upload-pack` -- the service announcement plus a flush packet.
+ * That's enough for `git ls-remote` to terminate successfully.
+ */
+function createBasicAuthGitServer(attempts) {
+    return new Promise((resolve) => {
+        const server = createServer((req, res) => {
+            const authHeader = req.headers['authorization'];
+            if (!authHeader || !authHeader.startsWith('Basic ')) {
+                attempts.push({ hasAuthHeader: false });
+                res.writeHead(401, {
+                    'WWW-Authenticate': 'Basic realm="Test"',
+                    'Content-Type': 'text/plain',
+                });
+                res.end('Authentication required');
+                return;
+            }
+            const decoded = Buffer.from(authHeader.slice(6), 'base64').toString('utf-8');
+            const colonIdx = decoded.indexOf(':');
+            const username = colonIdx >= 0 ? decoded.slice(0, colonIdx) : decoded;
+            const password = colonIdx >= 0 ? decoded.slice(colonIdx + 1) : '';
+            attempts.push({ hasAuthHeader: true, username, password });
+            if (password !== EXPECTED_API_KEY) {
+                res.writeHead(401, {
+                    'WWW-Authenticate': 'Basic realm="Test"',
+                    'Content-Type': 'text/plain',
+                });
+                res.end('Invalid API key');
+                return;
+            }
+            // Minimal valid info/refs response for git-upload-pack with no refs.
+            // Shape:
+            //   001e# service=git-upload-pack\n
+            //   0000
+            //   0000   (no refs)
+            const service = '# service=git-upload-pack\n';
+            const pktServiceLength = (service.length + 4).toString(16).padStart(4, '0');
+            const flush = '0000';
+            const body = `${pktServiceLength}${service}${flush}${flush}`;
+            res.writeHead(200, {
+                'Content-Type': 'application/x-git-upload-pack-advertisement',
+                'Cache-Control': 'no-cache',
+            });
+            res.end(body);
+        });
+        server.listen(0, '127.0.0.1', () => resolve(server));
+    });
+}
+/**
+ * Write a credential helper script into `dir` and return its path. The
+ * script ignores stdin (test fixtures don't need to honour git's
+ * action/host inputs) and prints the test's API key. Bash on macOS/Linux
+ * and Git Bash on Windows both run the resulting `!"<path>"` invocation
+ * the same way.
+ */
+function writeHelperScript(dir, apiKey) {
+    const scriptPath = join(dir, 'fake-helper.sh');
+    const body = [
+        '#!/usr/bin/env bash',
+        '# Test fixture: emits the git credential helper "get" protocol output',
+        '# with a hardcoded API key. The "get" arg is the only one git invokes',
+        '# during a fetch; "store"/"erase" are no-ops.',
+        'if [ "$1" != "get" ]; then exit 0; fi',
+        '# Drain stdin so git\'s pipe doesn\'t stall.',
+        'cat > /dev/null',
+        'echo "username=runwork"',
+        `echo "password=${apiKey}"`,
+        '',
+    ].join('\n');
+    writeFileSync(scriptPath, body, { mode: 0o755 });
+    // chmod is no-op on Windows but won't error.
+    chmodSync(scriptPath, 0o755);
+    return scriptPath;
+}
+describe('git credential helper e2e (Basic auth contract)', () => {
+    const gitProbe = probeGit();
+    const skipReason = !gitProbe.installed ? 'git not installed' : null;
+    let tmpDir;
+    let homeDir;
+    let xdgConfigHome;
+    let scriptPath;
+    let server;
+    let serverUrl;
+    let attempts = [];
+    beforeAll(async () => {
+        if (skipReason)
+            return;
+        tmpDir = mkdtempSync(join(tmpdir(), 'runwork-helper-e2e-'));
+        homeDir = join(tmpDir, 'home');
+        xdgConfigHome = join(homeDir, '.config');
+        // git -c gc.auto=0 needs ~/.gitconfig to exist when GIT_CONFIG_GLOBAL is
+        // pointed at a path that doesn't yet exist; pre-create the dir and
+        // empty file.
+        const gitConfigGlobal = join(homeDir, '.gitconfig');
+        require('fs').mkdirSync(homeDir, { recursive: true });
+        writeFileSync(gitConfigGlobal, '');
+        scriptPath = writeHelperScript(tmpDir, EXPECTED_API_KEY);
+        server = await createBasicAuthGitServer(attempts);
+        const addr = server.address();
+        serverUrl = `http://127.0.0.1:${addr.port}`;
+        // Register the credential helper globally in the isolated git config.
+        // We use the unscoped `credential.helper` (not `credential.<url>.helper`)
+        // because (a) the test config is fully isolated so we don't risk
+        // bleeding into other host auth flows and (b) git's URL matching for
+        // scoped helpers has subtleties that aren't what we're testing here --
+        // we're testing the helper *contract*, not git's URL matcher.
+        const gitBin = gitProbe.path ?? 'git';
+        await execFileAsync(gitBin, [
+            'config', '--file', gitConfigGlobal,
+            'credential.helper', `!"${scriptPath}"`,
+        ]);
+    });
+    afterAll(() => {
+        if (server)
+            server.close();
+        if (tmpDir && existsSync(tmpDir))
+            rmSync(tmpDir, { recursive: true, force: true });
+    });
+    it.skipIf(skipReason)('git ls-remote authenticates via the credential helper end-to-end', async () => {
+        const gitBin = gitProbe.path ?? 'git';
+        // Use GIT_CONFIG_GLOBAL to isolate from the user's real ~/.gitconfig
+        // (which may have an auth helper registered for some other host).
+        const env = {
+            ...process.env,
+            GIT_CONFIG_GLOBAL: join(homeDir, '.gitconfig'),
+            GIT_CONFIG_SYSTEM: '/dev/null',
+            XDG_CONFIG_HOME: xdgConfigHome,
+            HOME: homeDir,
+            // Force git to never prompt -- if the helper fails, we want the
+            // command to exit non-zero, not hang.
+            GIT_TERMINAL_PROMPT: '0',
+        };
+        const path = '/test-workspace/test-app';
+        const url = `${serverUrl}${path}`;
+        // ls-remote against the fake server. Should exit 0 (server accepted
+        // auth and returned a valid -- empty -- ref advertisement).
+        const result = await execFileAsync(gitBin, ['ls-remote', url], { env });
+        expect(result.stdout).toBe('');
+        // No refs in the test response, so stdout is empty.
+        // Verify the server actually saw a Basic-auth attempt with our key.
+        const successAttempt = attempts.find((a) => a.hasAuthHeader && a.password === EXPECTED_API_KEY);
+        expect(successAttempt).toBeDefined();
+        expect(successAttempt.username).toBe('runwork');
+    }, 20_000);
+    it.skipIf(skipReason)('server rejects requests with no auth (sanity: contract is enforced)', async () => {
+        // Direct fetch with no Authorization header should 401.
+        const response = await fetch(`${serverUrl}/whatever`);
+        expect(response.status).toBe(401);
+        expect(response.headers.get('www-authenticate')).toContain('Basic');
+    });
+    it.skipIf(skipReason)('server rejects requests with the wrong API key (sanity: contract is enforced)', async () => {
+        const response = await fetch(`${serverUrl}/whatever`, {
+            headers: {
+                authorization: `Basic ${Buffer.from('runwork:wrong-key').toString('base64')}`,
+            },
+        });
+        expect(response.status).toBe(401);
+    });
+});

package/dist/git/__tests__/credentials.test.js

@@ -5,38 +5,51 @@ vi.mock('../../auth/store.js', () => ({
 }));
 const mockExecFileSync = (await import('child_process')).execFileSync;
 const { getCredentials: mockGetCredentials } = await import('../../auth/store.js');
-const { configureGitCredentials, removeGitCredentials, handleGitCredentialRequest, } = await import('../credentials.js');
+const { configureGitCredentials, removeGitCredentials, handleGitCredentialRequest, buildHelperValue, } = await import('../credentials.js');
 describe('git/credentials', () => {
     beforeEach(() => {
         vi.clearAllMocks();
     });
+    describe('buildHelperValue()', () => {
+        it('wraps the execPath in quotes and prefixes with !', () => {
+            expect(buildHelperValue('/usr/local/bin/runwork')).toBe('!"/usr/local/bin/runwork" git-credential-helper');
+        });
+        it('normalises Windows backslashes to forward slashes for .gitconfig safety', () => {
+            expect(buildHelperValue('C:\\Users\\test\\.runwork\\bin\\runwork.exe')).toBe('!"C:/Users/test/.runwork/bin/runwork.exe" git-credential-helper');
+        });
+        it('survives spaces in install paths via quoting', () => {
+            expect(buildHelperValue('C:\\Program Files\\Runwork\\runwork.exe')).toBe('!"C:/Program Files/Runwork/runwork.exe" git-credential-helper');
+        });
+    });
     describe('configureGitCredentials()', () => {
-        it('calls git config with correct args', async () => {
+        it('registers the helper using process.execPath, not bare "runwork"', async () => {
             await configureGitCredentials('https://runwork.ai/api/git/ws/app');
-            expect(mockExecFileSync).toHaveBeenCalledWith('git', [
-                'config',
-                '--global',
-                'credential.https://runwork.ai.helper',
-                '!runwork git-credential-helper',
-            ], { stdio: 'pipe' });
+            // Don't pin process.execPath itself (varies per machine), but
+            // assert the value follows the absolute-path shape so PATH-relative
+            // regressions are caught.
+            const call = mockExecFileSync.mock.calls.find((c) => c[0] === 'git' && c[1]?.includes('--global'));
+            expect(call).toBeDefined();
+            const args = call[1];
+            expect(args).toContain('config');
+            expect(args).toContain('--global');
+            expect(args).toContain('credential.https://runwork.ai.helper');
+            const helperValue = args[args.length - 1];
+            expect(helperValue).toMatch(/^!"[^"]+" git-credential-helper$/);
+            expect(helperValue).not.toBe('!runwork git-credential-helper');
+            // The path inside the quotes should be process.execPath, normalised.
+            expect(helperValue).toContain(process.execPath.replace(/\\/g, '/'));
         });
         it('extracts origin from full URL', async () => {
             await configureGitCredentials('https://custom.runwork.dev/api/git/ws-1/app-1');
-            expect(mockExecFileSync).toHaveBeenCalledWith('git', [
-                'config',
-                '--global',
-                'credential.https://custom.runwork.dev.helper',
-                '!runwork git-credential-helper',
-            ], { stdio: 'pipe' });
+            const call = mockExecFileSync.mock.calls[0];
+            const args = call[1];
+            expect(args[2]).toBe('credential.https://custom.runwork.dev.helper');
         });
         it('handles URL with port', async () => {
             await configureGitCredentials('https://localhost:8787/api/git/ws/app');
-            expect(mockExecFileSync).toHaveBeenCalledWith('git', [
-                'config',
-                '--global',
-                'credential.https://localhost:8787.helper',
-                '!runwork git-credential-helper',
-            ], { stdio: 'pipe' });
+            const call = mockExecFileSync.mock.calls[0];
+            const args = call[1];
+            expect(args[2]).toBe('credential.https://localhost:8787.helper');
         });
     });
     describe('removeGitCredentials()', () => {

package/dist/git/__tests__/preflight-resolution.test.d.ts

@@ -0,0 +1 @@
+export {};