swallowkit 1.0.0-beta.54 → 1.0.0-beta.56

package/src/__tests__/bff-swa-auth.test.ts

@@ -0,0 +1,275 @@
+import ts from "typescript";
+import {
+  generateBFFCallFunctionWithMultipleAuth,
+  generateBFFCallFunctionWithSwaAuth,
+} from "../core/scaffold/auth-generator";
+
+type GeneratedModule = {
+  callFunction(config: { method: "GET"; path: string }): Promise<unknown>;
+};
+
+type FetchCall = {
+  url: string;
+  init: RequestInit | undefined;
+};
+
+const originalFetch = global.fetch;
+const originalBaseUrl = process.env.BACKEND_FUNCTIONS_BASE_URL;
+const originalFunctionsKey = process.env.BACKEND_FUNCTIONS_KEY;
+
+function encodePrincipal(value: unknown): string {
+  return Buffer.from(JSON.stringify(value), "utf8").toString("base64");
+}
+
+function decodeForwardedPrincipal(call: FetchCall): Record<string, unknown> | undefined {
+  const value = (call.init?.headers as Record<string, string>)["x-ms-client-principal"];
+  return value
+    ? JSON.parse(Buffer.from(value, "base64").toString("utf8"))
+    : undefined;
+}
+
+function loadGeneratedModule(
+  code: string,
+  requestHeaders: Record<string, string>,
+): GeneratedModule {
+  const output = ts.transpileModule(code, {
+    compilerOptions: {
+      esModuleInterop: true,
+      module: ts.ModuleKind.CommonJS,
+      target: ts.ScriptTarget.ES2020,
+    },
+    reportDiagnostics: true,
+  });
+  expect(output.diagnostics).toEqual([]);
+
+  class MockNextResponse {
+    static json(body: unknown, init?: { status?: number }) {
+      return { body, status: init?.status ?? 200 };
+    }
+
+    constructor(
+      public body: unknown,
+      public init?: { status?: number },
+    ) {}
+  }
+
+  const generatedModule = { exports: {} as GeneratedModule };
+  const mockRequire = (id: string): unknown => {
+    if (id === "next/server") return { NextResponse: MockNextResponse };
+    if (id === "next/headers") {
+      return { headers: async () => new Headers(requestHeaders) };
+    }
+    if (id === "zod/v4") return require("zod/v4");
+    throw new Error(`Unexpected generated import: ${id}`);
+  };
+
+  new Function("require", "module", "exports", output.outputText)(
+    mockRequire,
+    generatedModule,
+    generatedModule.exports,
+  );
+  return generatedModule.exports;
+}
+
+async function runGeneratedCall(options: {
+  code: string;
+  requestHeaders: Record<string, string>;
+  mePrincipal?: unknown;
+  functionsBaseUrl?: string;
+}): Promise<FetchCall[]> {
+  process.env.BACKEND_FUNCTIONS_BASE_URL =
+    options.functionsBaseUrl ?? "https://functions.example.test";
+  process.env.BACKEND_FUNCTIONS_KEY = "functions-key-secret";
+
+  const calls: FetchCall[] = [];
+  global.fetch = jest.fn(async (input: string | URL | Request, init?: RequestInit) => {
+    const url = input.toString();
+    calls.push({ url, init });
+    if (url.endsWith("/.auth/me")) {
+      return {
+        ok: true,
+        status: 200,
+        json: async () => ({ clientPrincipal: options.mePrincipal }),
+      } as Response;
+    }
+    return {
+      ok: true,
+      status: 200,
+      json: async () => ({ ok: true }),
+      text: async () => "",
+    } as Response;
+  }) as typeof fetch;
+
+  const generated = loadGeneratedModule(options.code, options.requestHeaders);
+  await generated.callFunction({ method: "GET", path: "/api/resource" });
+  return calls;
+}
+
+function functionsCall(calls: FetchCall[]): FetchCall {
+  const call = calls.find(({ url }) => url.endsWith("/api/resource"));
+  expect(call).toBeDefined();
+  return call!;
+}
+
+afterEach(() => {
+  global.fetch = originalFetch;
+  if (originalBaseUrl === undefined) delete process.env.BACKEND_FUNCTIONS_BASE_URL;
+  else process.env.BACKEND_FUNCTIONS_BASE_URL = originalBaseUrl;
+  if (originalFunctionsKey === undefined) delete process.env.BACKEND_FUNCTIONS_KEY;
+  else process.env.BACKEND_FUNCTIONS_KEY = originalFunctionsKey;
+  jest.restoreAllMocks();
+});
+
+describe("generated BFF SWA credential forwarding", () => {
+  const validPrincipal = {
+    identityProvider: "github",
+    userId: "user-123",
+    userDetails: "octocat",
+    userRoles: ["anonymous", "authenticated", 123],
+    untrustedExtra: "must-not-be-forwarded",
+  };
+
+  it("normalizes an incoming principal and does not call /.auth/me", async () => {
+    const calls = await runGeneratedCall({
+      code: generateBFFCallFunctionWithSwaAuth(),
+      requestHeaders: {
+        cookie: "session=cookie-secret",
+        host: "app.example.test",
+        "x-ms-client-principal": encodePrincipal(validPrincipal),
+      },
+    });
+
+    expect(calls.map(({ url }) => url)).not.toContain("https://app.example.test/.auth/me");
+    expect(decodeForwardedPrincipal(functionsCall(calls))).toEqual({
+      identityProvider: "github",
+      userId: "user-123",
+      userDetails: "octocat",
+      userRoles: ["anonymous", "authenticated"],
+    });
+    expect(
+      (functionsCall(calls).init?.headers as Record<string, string>)[
+        "x-functions-key"
+      ],
+    ).toBe("functions-key-secret");
+  });
+
+  it("uses x-forwarded-host for the /.auth/me fallback", async () => {
+    const calls = await runGeneratedCall({
+      code: generateBFFCallFunctionWithSwaAuth(),
+      requestHeaders: {
+        cookie: "session=valid",
+        host: "internal.example.test",
+        "x-forwarded-host": "public.example.test",
+      },
+      mePrincipal: validPrincipal,
+    });
+
+    expect(calls[0].url).toBe("https://public.example.test/.auth/me");
+    expect(decodeForwardedPrincipal(functionsCall(calls))).toEqual({
+      identityProvider: "github",
+      userId: "user-123",
+      userDetails: "octocat",
+      userRoles: ["anonymous", "authenticated"],
+    });
+  });
+
+  it("falls back to host when x-forwarded-host is absent", async () => {
+    const calls = await runGeneratedCall({
+      code: generateBFFCallFunctionWithSwaAuth(),
+      requestHeaders: { cookie: "session=valid", host: "app.example.test" },
+      mePrincipal: validPrincipal,
+    });
+
+    expect(calls[0].url).toBe("https://app.example.test/.auth/me");
+  });
+
+  it("uses the first comma-separated forwarded host and protocol", async () => {
+    const calls = await runGeneratedCall({
+      code: generateBFFCallFunctionWithSwaAuth(),
+      requestHeaders: {
+        cookie: "session=valid",
+        host: "internal.example.test",
+        "x-forwarded-host": "public.example.test, proxy.example.test",
+        "x-forwarded-proto": "http, https",
+      },
+      mePrincipal: validPrincipal,
+    });
+
+    expect(calls[0].url).toBe("http://public.example.test/.auth/me");
+  });
+
+  it.each([
+    ["a missing userId", { ...validPrincipal, userId: undefined }],
+    ["a missing authenticated role", { ...validPrincipal, userRoles: ["anonymous"] }],
+    ["a missing identityProvider", { ...validPrincipal, identityProvider: "" }],
+  ])("does not forward a principal with %s", async (_case, principal) => {
+    const calls = await runGeneratedCall({
+      code: generateBFFCallFunctionWithSwaAuth(),
+      requestHeaders: { "x-ms-client-principal": encodePrincipal(principal) },
+    });
+
+    expect(decodeForwardedPrincipal(functionsCall(calls))).toBeUndefined();
+  });
+
+  it.each([
+    "not-base64!",
+    `${encodePrincipal(validPrincipal)}!`,
+    Buffer.from("not-json", "utf8").toString("base64"),
+  ])(
+    "fails closed without logging credentials for malformed principal %s",
+    async (principal) => {
+      const error = jest.spyOn(console, "error").mockImplementation(() => undefined);
+      const cookie = "session=highly-sensitive-cookie";
+      const calls = await runGeneratedCall({
+        code: generateBFFCallFunctionWithSwaAuth(),
+        requestHeaders: { cookie, "x-ms-client-principal": principal },
+      });
+
+      expect(decodeForwardedPrincipal(functionsCall(calls))).toBeUndefined();
+      const logged = JSON.stringify(error.mock.calls);
+      expect(logged).not.toContain(cookie);
+      expect(logged).not.toContain(principal);
+    },
+  );
+
+  it("preserves Bearer and applies the same SWA rules for multiple auth", async () => {
+    const calls = await runGeneratedCall({
+      code: generateBFFCallFunctionWithMultipleAuth(),
+      requestHeaders: {
+        authorization: "Bearer line-token-secret",
+        "x-ms-client-principal": encodePrincipal(validPrincipal),
+      },
+    });
+    const headers = functionsCall(calls).init?.headers as Record<string, string>;
+
+    expect(headers.Authorization).toBe("Bearer line-token-secret");
+    expect(decodeForwardedPrincipal(functionsCall(calls))?.userId).toBe("user-123");
+  });
+
+  it("does not add Bearer forwarding to the SWA-only variant", async () => {
+    const code = generateBFFCallFunctionWithSwaAuth();
+    const calls = await runGeneratedCall({
+      code,
+      requestHeaders: {
+        authorization: "Bearer must-not-be-forwarded",
+        "x-ms-client-principal": encodePrincipal(validPrincipal),
+      },
+    });
+    const headers = functionsCall(calls).init?.headers as Record<string, string>;
+
+    expect(headers.Authorization).toBeUndefined();
+    expect(code).not.toContain("reqHeaders.get('authorization')");
+    expect(decodeForwardedPrincipal(functionsCall(calls))?.userId).toBe("user-123");
+  });
+
+  it("defaults /.auth/me to http for local Functions development", async () => {
+    const calls = await runGeneratedCall({
+      code: generateBFFCallFunctionWithSwaAuth(),
+      requestHeaders: { cookie: "session=valid", host: "localhost:3000" },
+      mePrincipal: validPrincipal,
+      functionsBaseUrl: "http://localhost:7071",
+    });
+
+    expect(calls[0].url).toBe("http://localhost:3000/.auth/me");
+  });
+});

package/src/__tests__/file-session.test.ts

@@ -0,0 +1,98 @@
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import {
+  FileOperationSession,
+  hashContent,
+  runWithFileSession,
+  getActiveFileSession,
+} from "../core/operations/file-session";
+
+describe("FileOperationSession", () => {
+  let tempDir: string;
+
+  beforeEach(() => {
+    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "swallowkit-session-"));
+  });
+
+  afterEach(() => {
+    fs.rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it("writes files to disk in commit mode and records create operations", () => {
+    const session = new FileOperationSession("commit", tempDir);
+    const target = path.join(tempDir, "nested", "dir", "file.ts");
+
+    const op = session.writeFile(target, "export const a = 1;\n", {
+      ownership: "managed",
+      generator: "scaffold",
+      sourceModel: "Todo",
+    });
+
+    expect(fs.readFileSync(target, "utf-8")).toBe("export const a = 1;\n");
+    expect(op.action).toBe("create");
+    expect(op.path).toBe("nested/dir/file.ts");
+    expect(op.previousHash).toBeNull();
+    expect(op.newHash).toBe(hashContent("export const a = 1;\n"));
+  });
+
+  it("does not touch the disk in collect mode", () => {
+    const session = new FileOperationSession("collect", tempDir);
+    const target = path.join(tempDir, "virtual.ts");
+
+    session.writeFile(target, "content", { ownership: "managed", generator: "scaffold" });
+
+    expect(fs.existsSync(target)).toBe(false);
+    expect(session.operations).toHaveLength(1);
+    expect(session.operations[0].action).toBe("create");
+    // overlay read-back
+    expect(session.readFile(target)).toBe("content");
+    expect(session.fileExists(target)).toBe(true);
+  });
+
+  it("records skip when content is unchanged", () => {
+    const target = path.join(tempDir, "same.ts");
+    fs.writeFileSync(target, "unchanged\n", "utf-8");
+
+    const session = new FileOperationSession("commit", tempDir);
+    const op = session.writeFile(target, "unchanged\n", { ownership: "managed", generator: "scaffold" });
+
+    expect(op.action).toBe("skip");
+  });
+
+  it("records append for extension-point modifications and modify for managed", () => {
+    const extensionTarget = path.join(tempDir, "ext.ts");
+    const managedTarget = path.join(tempDir, "managed.ts");
+    fs.writeFileSync(extensionTarget, "base\n", "utf-8");
+    fs.writeFileSync(managedTarget, "base\n", "utf-8");
+
+    const session = new FileOperationSession("commit", tempDir);
+    const appendOp = session.writeFile(extensionTarget, "base\nmore\n", {
+      ownership: "extension-point",
+      generator: "scaffold",
+    });
+    const modifyOp = session.writeFile(managedTarget, "regenerated\n", {
+      ownership: "managed",
+      generator: "scaffold",
+    });
+
+    expect(appendOp.action).toBe("append");
+    expect(modifyOp.action).toBe("modify");
+    expect(modifyOp.previousHash).toBe(hashContent("base\n"));
+  });
+
+  it("normalizes CRLF for hashing", () => {
+    expect(hashContent("a\r\nb\r\n")).toBe(hashContent("a\nb\n"));
+  });
+
+  it("scopes the active session with runWithFileSession", async () => {
+    expect(getActiveFileSession()).toBeNull();
+    const session = new FileOperationSession("collect", tempDir);
+
+    await runWithFileSession(session, async () => {
+      expect(getActiveFileSession()).toBe(session);
+    });
+
+    expect(getActiveFileSession()).toBeNull();
+  });
+});

package/src/__tests__/init.test.ts

@@ -16,6 +16,7 @@ import {
   getGitHubFunctionsWorkflow,
   injectSwallowKitNextConfig,
   parseIgnoredBuilds,
+  approveBuildsViaWorkspaceYaml,
   buildCosmosDbFreeTierBicepSource,
   buildFunctionsHostKeyBicepExpression,
   buildStaticWebAppConfigBicepSource,
@@ -236,6 +237,55 @@ describe("parseIgnoredBuilds", () => {
   });
 });
 
+describe("approveBuildsViaWorkspaceYaml", () => {
+  let tempDir: string;
+
+  beforeEach(() => {
+    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "sk-allowbuilds-"));
+  });
+
+  afterEach(() => {
+    fs.rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  const yamlPath = () => path.join(tempDir, "pnpm-workspace.yaml");
+
+  it("appends an allowBuilds map to an existing workspace file", () => {
+    fs.writeFileSync(yamlPath(), "packages:\n  - shared\n  - functions\n", "utf-8");
+    approveBuildsViaWorkspaceYaml(tempDir, ["esbuild", "protobufjs"]);
+    const content = fs.readFileSync(yamlPath(), "utf-8");
+    expect(content).toContain("packages:");
+    expect(content).toContain("allowBuilds:\n  esbuild: true\n  protobufjs: true");
+  });
+
+  it("replaces pnpm's placeholder entries with true", () => {
+    fs.writeFileSync(
+      yamlPath(),
+      "packages:\n  - shared\nallowBuilds:\n  esbuild: set this to true or false\n",
+      "utf-8"
+    );
+    approveBuildsViaWorkspaceYaml(tempDir, ["esbuild", "protobufjs"]);
+    const content = fs.readFileSync(yamlPath(), "utf-8");
+    expect(content).toContain("esbuild: true");
+    expect(content).toContain("protobufjs: true");
+    expect(content).not.toContain("set this to true or false");
+  });
+
+  it("quotes scoped package names and creates the file when missing", () => {
+    approveBuildsViaWorkspaceYaml(tempDir, ["@scope/pkg"]);
+    const content = fs.readFileSync(yamlPath(), "utf-8");
+    expect(content).toContain("allowBuilds:\n  '@scope/pkg': true");
+  });
+
+  it("keeps existing entries untouched", () => {
+    fs.writeFileSync(yamlPath(), "allowBuilds:\n  core-js: false\n", "utf-8");
+    approveBuildsViaWorkspaceYaml(tempDir, ["esbuild"]);
+    const content = fs.readFileSync(yamlPath(), "utf-8");
+    expect(content).toContain("core-js: false");
+    expect(content).toContain("esbuild: true");
+  });
+});
+
 describe("buildCosmosDbFreeTierBicepSource", () => {
   it("keeps database-level shared throughput at 1000 RU/s for Free Tier", () => {
     const source = buildCosmosDbFreeTierBicepSource();

package/src/__tests__/mcp.test.ts

@@ -81,6 +81,110 @@ describe("SwallowKit MCP tool definitions", () => {
     expect(JSON.parse(result.content[0].text)).toEqual({ createdFiles: ["functions/src/todo.ts"] });
   });
 
+  it("exposes the agent-loop tools (plan/apply/artifacts/drift/verify/explain)", () => {
+    const names = buildSwallowKitToolDefinitions(jest.fn() as unknown as MachineCliRunner).map((tool) => tool.name);
+    expect(names).toEqual(
+      expect.arrayContaining([
+        "swallowkit_plan_scaffold",
+        "swallowkit_apply_scaffold",
+        "swallowkit_inspect_artifacts",
+        "swallowkit_inspect_drift",
+        "swallowkit_verify_project",
+        "swallowkit_explain_failure",
+      ])
+    );
+  });
+
+  it("delegates plan_scaffold and passes through status and nextActions", async () => {
+    const runner = jest.fn(async () => ({
+      stdout: JSON.stringify({
+        ok: true,
+        command: "plan-scaffold",
+        status: "requires-human",
+        nextActions: [{ command: "swallowkit machine apply scaffold --plan abc --approve", description: "Apply." }],
+        data: { planId: "abc", requiresApproval: true, operations: [] },
+      }),
+      stderr: "",
+      exitCode: 0,
+    }));
+
+    const tool = buildSwallowKitToolDefinitions(runner as MachineCliRunner).find(
+      (candidate) => candidate.name === "swallowkit_plan_scaffold"
+    );
+    const result = await tool!.handler({ model: "todo", apiOnly: true });
+
+    expect(runner).toHaveBeenCalledWith(["plan", "scaffold", "todo", "--api-only"]);
+    const parsed = JSON.parse(result.content[0].text);
+    expect(parsed.status).toBe("requires-human");
+    expect(parsed.planId).toBe("abc");
+    expect(parsed.nextActions).toHaveLength(1);
+  });
+
+  it("delegates apply_scaffold with plan and approve flags", async () => {
+    const runner = jest.fn(async () => ({
+      stdout: JSON.stringify({
+        ok: true,
+        command: "apply-scaffold",
+        status: "complete",
+        data: { createdFiles: [] },
+      }),
+      stderr: "",
+      exitCode: 0,
+    }));
+
+    const tool = buildSwallowKitToolDefinitions(runner as MachineCliRunner).find(
+      (candidate) => candidate.name === "swallowkit_apply_scaffold"
+    );
+    await tool!.handler({ planId: "abc", approve: true });
+
+    expect(runner).toHaveBeenCalledWith(["apply", "scaffold", "--plan", "abc", "--approve"]);
+  });
+
+  it("surfaces machine error code, status, and details to the agent", async () => {
+    const runner = jest.fn(async () => ({
+      stdout: JSON.stringify({
+        ok: false,
+        command: "apply-scaffold",
+        status: "blocked",
+        error: {
+          code: "stale-plan",
+          message: "Plan is stale.",
+          details: { changedFiles: ["shared/models/todo.ts"] },
+        },
+      }),
+      stderr: "",
+      exitCode: 1,
+    }));
+
+    const tool = buildSwallowKitToolDefinitions(runner as MachineCliRunner).find(
+      (candidate) => candidate.name === "swallowkit_apply_scaffold"
+    );
+
+    await expect(tool!.handler({ planId: "abc" })).rejects.toThrow(
+      /\[stale-plan\] Plan is stale\. \(status: blocked\)[\s\S]*changedFiles/
+    );
+  });
+
+  it("delegates verify_project with selected checks", async () => {
+    const runner = jest.fn(async () => ({
+      stdout: JSON.stringify({
+        ok: true,
+        command: "verify-project",
+        status: "complete",
+        data: { summary: { done: true } },
+      }),
+      stderr: "",
+      exitCode: 0,
+    }));
+
+    const tool = buildSwallowKitToolDefinitions(runner as MachineCliRunner).find(
+      (candidate) => candidate.name === "swallowkit_verify_project"
+    );
+    await tool!.handler({ checks: ["structure", "drift"] });
+
+    expect(runner).toHaveBeenCalledWith(["verify", "project", "--checks", "structure,drift"]);
+  });
+
   itWhenBuiltEntrypointExists("keeps the built MCP entrypoint alive long enough to complete the handshake", async () => {
     await new Promise<void>((resolve, reject) => {
       const child = spawn(process.execPath, [builtMcpEntrypoint], {
@@ -105,13 +209,17 @@ describe("SwallowKit MCP tool definitions", () => {
         }
       };
 
-      const timer = setTimeout(() => {
-        expectedShutdown = true;
-        child.kill();
-      }, 1000);
+      let timer: NodeJS.Timeout | undefined;
 
       child.stderr.on("data", (chunk) => {
         stderr += chunk.toString();
+        // Start the aliveness window once the entrypoint has actually booted.
+        if (!timer && /\[swallowkit-mcp\] version: /.test(stderr)) {
+          timer = setTimeout(() => {
+            expectedShutdown = true;
+            child.kill();
+          }, 1000);
+        }
       });
 
       child.on("error", (error) => {
@@ -135,7 +243,7 @@ describe("SwallowKit MCP tool definitions", () => {
         );
       });
     });
-  });
+  }, 20000);
 
   itWhenBuiltEntrypointExists("preserves a runtime dynamic execa import in the built MCP entrypoint", () => {
     const source = fs.readFileSync(builtMcpEntrypoint, "utf8");

package/src/__tests__/multi-auth.test.ts

@@ -81,7 +81,7 @@ describe("named authentication routers", () => {
 
   it("forwards both credential sources and the Functions host key", () => {
     const code = generateBFFCallFunctionWithMultipleAuth();
-    expect(code).toContain("fetchHeaders['Authorization']");
+    expect(code).toContain("fetchHeaders.Authorization");
     expect(code).toContain("fetchHeaders['x-ms-client-principal']");
     expect(code).toContain("'x-functions-key'");
     expect(code).not.toMatch(/console\.log\([^\n]*(authorization|principal|cookie)/i);