subrouter-cli 0.0.0-stage → 0.1.0

package/test/toolpreview.test.ts

@@ -0,0 +1,51 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { toolPreview } from '../src/toolpreview.ts';
+
+test('pending code updates as JSON argument chunks arrive, without waiting for the closing quote', () => {
+  assert.deepEqual(toolPreview('write_file', String.raw`{"path":"x.ts","content":"const n = 1;\n`), {
+    title: 'Write(x.ts) · +2 lines', lines: ['+ const n = 1;', '+ '],
+  });
+  assert.deepEqual(toolPreview('write_file', String.raw`{"path":"x.ts","content":"const n = 1;\nconsole.log(n);`), {
+    title: 'Write(x.ts) · +2 lines', lines: ['+ const n = 1;', '+ console.log(n);'],
+  });
+});
+
+test('partial escape sequences wait for complete characters and decode JSON strings faithfully', () => {
+  const value = 'quote " · backslash \\ · \n · π';
+  const json = JSON.stringify({ path: 'x.ts', content: value });
+  assert.deepEqual(toolPreview('write_file', json)?.lines, value.split('\n').map((line) => '+ ' + line));
+  assert.deepEqual(toolPreview('write_file', String.raw`{"content":"x\u03` )?.lines, ['+ x']);
+  assert.deepEqual(toolPreview('write_file', String.raw`{"content":"xπ` )?.lines, ['+ xπ']);
+  assert.deepEqual(toolPreview('write_file', '{"content":"x\\')?.lines, ['+ x']);
+});
+
+test('terminal previews never expose raw arguments or command output before approval', () => {
+  const secret = 'synthetic-protected-key';
+  const preview = toolPreview('run_command', JSON.stringify({ command: `printf ${secret}\\u001b[2J`, cwd: 'src' }));
+  assert.equal(preview?.title, 'Terminal command');
+  assert.ok(!JSON.stringify(preview).includes(secret));
+  assert.match(preview!.lines[0], /separate approval/);
+  assert.match(preview!.lines[0], /auto or absolute mode/);
+});
+
+test('filesystem operation cards show paths, recovery and overwrite policy as arguments stream', () => {
+  assert.deepEqual(toolPreview('copy_path', '{"source":"assets","destination":"new/ass'), {
+    title: 'Copy(assets)', lines: ['from assets', 'to   new/ass', 'existing destinations are never overwritten'],
+  });
+  assert.match(toolPreview('move_path', '{"source":"old","destination":"new"}')!.title, /Move\(old\)/);
+  assert.match(toolPreview('remove_path', '{"path":"old"}')!.lines[0], /restored/);
+  assert.match(toolPreview('make_dir', '{"path":"src"}')!.title, /Create directory\(src\)/);
+  assert.deepEqual(toolPreview('restore_file', '{"recovery_id":"id"}')!.lines, ['to original path', 'existing destinations are never overwritten']);
+  for (const name of ['find_files', 'file_info', 'read_files', 'list_removed']) assert.equal(toolPreview(name, '{}'), undefined);
+});
+
+test('edits show removed and added code, large previews stay bounded, read-only tools do not create code cards', () => {
+  assert.deepEqual(toolPreview('edit_file', JSON.stringify({ path: 'x', old_string: 'before', new_string: 'after' })), {
+    title: 'Update(x) · +1 −1 lines', lines: ['− before', '+ after'],
+  });
+  const preview = toolPreview('write_file', JSON.stringify({ path: 'x', content: Array.from({ length: 100 }, (_, i) => 'line ' + i).join('\n') }));
+  assert.equal(preview?.lines.length, 6);
+  assert.equal(preview?.lines.at(-1), '+ line 99');
+  assert.equal(toolPreview('read_file', '{"path":"x"}'), undefined);
+});

package/test/tools.test.ts

@@ -0,0 +1,227 @@
+// tools.ts tests — path confinement matrix, caps, and the original file tools.
+// All offline, all inside os.tmpdir() sandboxes.
+
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { afterEach, beforeEach, describe, it } from 'node:test';
+import {
+  MAX_GREP_RESULTS,
+  MAX_LIST_ENTRIES,
+  MAX_READ_BYTES,
+  MAX_WRITE_BYTES,
+  TOOL_DEFINITIONS,
+  confined,
+  executeTool,
+} from '../src/tools.ts';
+import type { ToolCall } from '../src/types.ts';
+
+let cwd: string;
+let outside: string;
+
+beforeEach(async () => {
+  const base = await fs.mkdtemp(path.join(os.tmpdir(), 'sub-tools-'));
+  cwd = path.join(base, 'cwd');
+  outside = path.join(base, 'outside');
+  await fs.mkdir(cwd, { recursive: true });
+  await fs.mkdir(outside, { recursive: true });
+  await fs.writeFile(path.join(cwd, 'a.txt'), 'hello world');
+  await fs.writeFile(path.join(outside, 'secret.txt'), 'shhh');
+});
+
+afterEach(async () => {
+  await fs.rm(path.dirname(cwd), { recursive: true, force: true });
+});
+
+function call(name: string, args: Record<string, unknown>, id = 'call_1'): ToolCall {
+  return { id, name, arguments: args, argumentsJson: JSON.stringify(args) };
+}
+
+describe('confined', () => {
+  it('rejects absolute, ~, and non-string paths', async () => {
+    await assert.rejects(() => confined(cwd, '/etc/passwd'));
+    await assert.rejects(() => confined(cwd, '~/.ssh/id_rsa'));
+    await assert.rejects(() => confined(cwd, 42));
+    await assert.rejects(() => confined(cwd, '  '));
+  });
+
+  it('rejects .. escapes', async () => {
+    await assert.rejects(() => confined(cwd, '../outside/secret.txt'));
+    await assert.rejects(() => confined(cwd, 'a/../../outside'));
+  });
+
+  it('rejects symlink escapes, files and mid-path', async () => {
+    await fs.symlink(outside, path.join(cwd, 'link'));
+    await assert.rejects(() => confined(cwd, 'link'));
+    await assert.rejects(() => confined(cwd, 'link/secret.txt'));
+  });
+
+  it('allows paths inside the working directory', async () => {
+    const realCwd = await fs.realpath(cwd);
+    assert.equal(await confined(cwd, 'a.txt'), path.join(realCwd, 'a.txt'));
+    assert.equal(await confined(cwd, '.'), realCwd);
+    assert.equal(await confined(cwd, 'sub/new/deep'), path.join(realCwd, 'sub/new/deep'));
+  });
+
+  it('allows a symlink that stays inside', async () => {
+    await fs.mkdir(path.join(cwd, 'real'));
+    await fs.symlink(path.join(cwd, 'real'), path.join(cwd, 'inlink'));
+    const realCwd = await fs.realpath(cwd);
+    assert.equal(await confined(cwd, 'inlink/x.txt'), path.join(realCwd, 'inlink/x.txt'));
+  });
+});
+
+describe('read_file', () => {
+  it('reads a file', async () => {
+    const r = await executeTool(call('read_file', { path: 'a.txt' }), cwd);
+    assert.equal(r.isError, undefined);
+    assert.equal(r.content, 'hello world');
+    assert.equal(r.toolCallId, 'call_1');
+  });
+
+  it('errors on missing files and directories', async () => {
+    const missing = await executeTool(call('read_file', { path: 'nope.txt' }), cwd);
+    assert.equal(missing.isError, true);
+    const dir = await executeTool(call('read_file', { path: '.' }), cwd);
+    assert.equal(dir.isError, true);
+  });
+
+  it('refuses files over the 256 KB cap', async () => {
+    await fs.writeFile(path.join(cwd, 'big.txt'), 'x'.repeat(MAX_READ_BYTES + 1));
+    const r = await executeTool(call('read_file', { path: 'big.txt' }), cwd);
+    assert.equal(r.isError, true);
+    assert.match(r.content, /grep/);
+  });
+
+  it('refuses escaping paths with an error result, not a throw', async () => {
+    const r = await executeTool(call('read_file', { path: '../outside/secret.txt' }), cwd);
+    assert.equal(r.isError, true);
+  });
+});
+
+describe('write_file', () => {
+  it('writes a file and creates parent directories', async () => {
+    const r = await executeTool(call('write_file', { path: 'deep/nested/x.txt', content: 'fresh' }), cwd);
+    assert.equal(r.isError, undefined);
+    assert.equal(await fs.readFile(path.join(cwd, 'deep/nested/x.txt'), 'utf8'), 'fresh');
+  });
+
+  it('overwrites existing files', async () => {
+    await executeTool(call('write_file', { path: 'a.txt', content: 'replaced' }), cwd);
+    assert.equal(await fs.readFile(path.join(cwd, 'a.txt'), 'utf8'), 'replaced');
+  });
+
+  it('refuses content over the 1 MB cap', async () => {
+    const r = await executeTool(call('write_file', { path: 'big.txt', content: 'x'.repeat(MAX_WRITE_BYTES + 1) }), cwd);
+    assert.equal(r.isError, true);
+    await assert.rejects(() => fs.stat(path.join(cwd, 'big.txt')));
+  });
+});
+
+describe('edit_file', () => {
+  it('replaces a unique exact match', async () => {
+    const r = await executeTool(call('edit_file', { path: 'a.txt', old_string: 'world', new_string: 'there' }), cwd);
+    assert.equal(r.isError, undefined);
+    assert.equal(await fs.readFile(path.join(cwd, 'a.txt'), 'utf8'), 'hello there');
+  });
+
+  it('errors on zero or multiple matches without writing', async () => {
+    const zero = await executeTool(call('edit_file', { path: 'a.txt', old_string: 'absent', new_string: 'x' }), cwd);
+    assert.equal(zero.isError, true);
+    await fs.writeFile(path.join(cwd, 'dup.txt'), 'ab ab ab');
+    const multi = await executeTool(call('edit_file', { path: 'dup.txt', old_string: 'ab', new_string: 'z' }), cwd);
+    assert.equal(multi.isError, true);
+    assert.equal(await fs.readFile(path.join(cwd, 'dup.txt'), 'utf8'), 'ab ab ab');
+  });
+});
+
+describe('list_dir', () => {
+  it('lists sorted entries with / on directories', async () => {
+    await fs.mkdir(path.join(cwd, 'beta-dir'));
+    const r = await executeTool(call('list_dir', { path: '.' }), cwd);
+    assert.equal(r.isError, undefined);
+    assert.equal(r.content, 'a.txt\nbeta-dir/');
+  });
+
+  it('errors on missing directories', async () => {
+    const r = await executeTool(call('list_dir', { path: 'nope' }), cwd);
+    assert.equal(r.isError, true);
+  });
+
+  it('caps at 500 entries with an ellipsis line', async () => {
+    await Promise.all(
+      Array.from({ length: MAX_LIST_ENTRIES + 1 }, (_, i) =>
+        fs.writeFile(path.join(cwd, `f${String(i).padStart(4, '0')}`), ''),
+      ),
+    );
+    const r = await executeTool(call('list_dir', { path: '.' }), cwd);
+    const lines = r.content.split('\n');
+    assert.equal(lines.length, MAX_LIST_ENTRIES + 1); // 500 entries + 1 ellipsis line
+    assert.ok(lines.includes('a.txt')); // the fixture file made the cut, pre-sort
+    assert.match(lines.at(-1) ?? '', /more entries/);
+  });
+});
+
+describe('grep', () => {
+  it('finds literal matches with file:line output', async () => {
+    await fs.writeFile(path.join(cwd, 'b.txt'), 'one\nneedle here\ntwo');
+    const r = await executeTool(call('grep', { pattern: 'needle' }), cwd);
+    assert.equal(r.isError, undefined);
+    assert.equal(r.content, 'b.txt:2:needle here');
+  });
+
+  it('skips .git, node_modules, and .DS_Store', async () => {
+    await fs.mkdir(path.join(cwd, 'node_modules/pkg'), { recursive: true });
+    await fs.mkdir(path.join(cwd, '.git'), { recursive: true });
+    await fs.writeFile(path.join(cwd, 'node_modules/pkg/index.js'), 'needle');
+    await fs.writeFile(path.join(cwd, '.git/config'), 'needle');
+    await fs.writeFile(path.join(cwd, '.DS_Store'), 'needle');
+    await fs.writeFile(path.join(cwd, 'real.ts'), 'needle real');
+    const r = await executeTool(call('grep', { pattern: 'needle' }), cwd);
+    assert.equal(r.content, 'real.ts:1:needle real');
+  });
+
+  it('filters by include substring and caps results', async () => {
+    await fs.writeFile(path.join(cwd, 'keep.ts'), 'needle 1\nneedle 2');
+    await fs.writeFile(path.join(cwd, 'skip.ts'), 'needle 3');
+    const filtered = await executeTool(call('grep', { pattern: 'needle', include: 'keep' }), cwd);
+    assert.equal(filtered.content, 'keep.ts:1:needle 1\nkeep.ts:2:needle 2');
+
+    await fs.writeFile(path.join(cwd, 'many.ts'), Array.from({ length: MAX_GREP_RESULTS + 10 }, () => 'needle').join('\n'));
+    const capped = await executeTool(call('grep', { pattern: 'needle', include: 'many' }), cwd);
+    const lines = capped.content.split('\n');
+    assert.equal(lines.length, MAX_GREP_RESULTS + 1);
+    assert.match(lines.at(-1) ?? '', /capped/);
+  });
+
+  it('errors on a missing search root', async () => {
+    const r = await executeTool(call('grep', { pattern: 'x', path: 'nope' }), cwd);
+    assert.equal(r.isError, true);
+  });
+});
+
+describe('dispatch', () => {
+  it('errors on unknown tools and invalid arguments', async () => {
+    const unknown = await executeTool(call('bash', { command: 'rm -rf /' }), cwd);
+    assert.equal(unknown.isError, true);
+    const invalid: ToolCall = { id: 'call_1', name: 'read_file', arguments: {}, argumentsJson: 'not json', argumentsInvalid: true };
+    const bad = await executeTool(invalid, cwd);
+    assert.equal(bad.isError, true);
+  });
+});
+
+describe('TOOL_DEFINITIONS', () => {
+  it('declares the filesystem tools with the right approval flags', () => {
+    const names = TOOL_DEFINITIONS.map((t) => t.name).sort();
+    assert.deepEqual(names, ['copy_path', 'edit_file', 'file_info', 'find_files', 'grep', 'list_dir', 'list_removed', 'make_dir', 'move_path', 'read_file', 'read_files', 'remove_path', 'restore_file', 'run_command', 'write_file']);
+    const mutations = new Set(['write_file', 'edit_file', 'make_dir', 'copy_path', 'move_path', 'remove_path', 'restore_file', 'run_command']);
+    for (const tool of TOOL_DEFINITIONS) assert.equal(tool.requiresApproval, mutations.has(tool.name), tool.name);
+    const byName = new Map(TOOL_DEFINITIONS.map((t) => [t.name, t]));
+    assert.equal(byName.get('read_file')?.requiresApproval, false);
+    assert.equal(byName.get('grep')?.requiresApproval, false);
+    assert.equal(byName.get('list_dir')?.requiresApproval, false);
+    assert.equal(byName.get('write_file')?.requiresApproval, true);
+    assert.equal(byName.get('edit_file')?.requiresApproval, true);
+  });
+});