testeiya 0.2.1 → 0.3.1-0.1

package/src/api/skills.ts

@@ -1,58 +0,0 @@
-import {
-  loadBundledSkills,
-  loadCustomSkills,
-  ensureCustomSkillsDir,
-  dedupeSkillsByName,
-  type CategorizedSkill,
-} from "../skills.js";
-import { getSession } from "../session-store.js";
-
-/**
- * Lists the skills available to the agent, from two sources:
- *   1. prebuilt skills vendored from GitHub into `cli/skills` (per `skills.yaml`),
- *   2. the user's custom skills (`~/.testeiya/skills`, `<cwd>/.testeiya/skills`).
- * Pass `?session=<id>` to also include the workspace's per-project skills. Each
- * entry carries its `source` and its `category` for grouping — bundled skills get
- * it from their `cli/skills/<category>/` folder, custom skills from the folder.
- */
-export function skillsList(req: Request): Response {
-  const sessionId = new URL(req.url).searchParams.get("session");
-  const session = sessionId ? getSession(sessionId) : null;
-  const all: CategorizedSkill[] = [
-    ...loadBundledSkills(),
-    ...loadCustomSkills(session?.cwd),
-  ];
-  const skills = dedupeSkillsByName(all).map((s) => ({
-    name: s.name,
-    description: s.description,
-    source: s.source,
-    category: categoryFor(s),
-  }));
-  return Response.json({ skills });
-}
-
-/**
- * Opens the global custom-skills folder in the OS file manager so the user can
- * drop or symlink skills into it. Mirrors `open-external`: only the desktop
- * runtime can reveal a native folder, so web mode returns `opened: false` and
- * the client shows the path instead.
- */
-export async function skillsOpen(): Promise<Response> {
-  const path = ensureCustomSkillsDir();
-  if (process.env.TESTEIYA_RUNTIME !== "desktop") {
-    return Response.json({ opened: false, path });
-  }
-  try {
-    const { Utils } = await import("electrobun/bun");
-    Utils.openPath(path);
-    return Response.json({ opened: true, path });
-  } catch {
-    return Response.json({ opened: false, path });
-  }
-}
-
-function categoryFor(skill: CategorizedSkill): string {
-  if (skill.category) return skill.category;
-  if (skill.source === "custom") return "Custom";
-  return "Other";
-}

package/src/api/testomatio-attachment.ts

@@ -1,89 +0,0 @@
-import { getSession } from "../session-store.js";
-import { resolveTestomatioTarget } from "./testomatio-proxy.js";
-import { loggedServerFetch } from "../debug-bus.js";
-
-/*
- * Upload a file as an attachment on a Testomat.io entity:
- *
- *   POST /api/testomatio/attachment?session=<sid>&testrun_id=<id>[&...]  (multipart "file")
- *
- * Upstream call: `${baseUrl}/api/{project_slug}/attachments?<context>` with the
- * file as multipart/form-data field `file` and `Authorization: Bearer <token>`.
- * The client-upload endpoint here backs the "from screen" / "upload image"
- * sources; the controlled-browser source reuses `uploadAttachmentToTestomatio`
- * after capturing the PNG server-side (see playwright-cli.ts).
- */
-
-const ATTACH_CONTEXT_PARAMS = [
-  "testrun_id",
-  "test_id",
-  "suite_id",
-  "run_id",
-  "requirement_id",
-];
-
-export async function testomatioAttachUpload(req: Request): Promise<Response> {
-  const url = new URL(req.url);
-  const sessionId = url.searchParams.get("session");
-  if (!sessionId) {
-    return Response.json({ error: "session required" }, { status: 400 });
-  }
-  const session = getSession(sessionId);
-  if (!session) {
-    return Response.json({ error: "session not found" }, { status: 404 });
-  }
-  const target = resolveTestomatioTarget(session);
-  if ("error" in target) {
-    return Response.json({ error: target.error }, { status: 400 });
-  }
-
-  const form = await req.formData();
-  const file = form.get("file");
-  if (!(file instanceof Blob)) {
-    return Response.json({ error: "file required" }, { status: 400 });
-  }
-  const filename = file instanceof File ? file.name : "attachment.png";
-  return uploadAttachmentToTestomatio(target, url.searchParams, file, filename);
-}
-
-export async function uploadAttachmentToTestomatio(
-  target: { baseUrl: string; projectSlug: string; token: string },
-  context: URLSearchParams,
-  file: Blob,
-  filename: string
-): Promise<Response> {
-  const upstream = new URL(
-    `/api/${encodeURIComponent(target.projectSlug)}/attachments`,
-    target.baseUrl
-  );
-  for (const key of ATTACH_CONTEXT_PARAMS) {
-    const v = context.get(key);
-    if (v) upstream.searchParams.set(key, v);
-  }
-
-  const body = new FormData();
-  body.append("file", file, filename);
-
-  const { res, text } = await loggedServerFetch(
-    upstream.toString(),
-    {
-      method: "POST",
-      headers: { Authorization: `Bearer ${target.token}`, Accept: "application/json" },
-      body,
-    },
-    `[multipart] ${filename}`
-  );
-  if (!res.ok) {
-    return Response.json(
-      { error: text || `attachment upload failed (HTTP ${res.status})` },
-      { status: res.status }
-    );
-  }
-  let data: unknown = text;
-  try {
-    data = text ? JSON.parse(text) : null;
-  } catch {
-    data = text;
-  }
-  return Response.json({ ok: true, attachment: data });
-}

package/src/api/testomatio-auth.ts

@@ -1,284 +0,0 @@
-// HTTP API for the in-app Testomat.io login flow.
-//
-//   GET    /api/auth/testomatio          → connection status + project list
-//   POST   /api/auth/testomatio          → connect with a pasted JWT
-//   DELETE /api/auth/testomatio          → log out (forget the stored token)
-//   POST   /api/auth/testomatio/session  → create a session for a chosen project
-//
-// The token never leaves the server — the client only ever sees whether a
-// connection exists and the (id, title, framework) of accessible projects.
-
-import fs from "node:fs";
-import {
-  loadStoredAuth,
-  saveStoredAuth,
-  clearStoredAuth,
-  fetchProjects,
-  getCachedProjects,
-  signInUrl,
-  normalizeBaseUrl,
-  maskToken,
-  UnauthorizedError,
-  type Project,
-} from "../testomatio-auth.js";
-import { createProjectSession, projectWorkspaceDir } from "./agent-start.js";
-import { getSession } from "../session-store.js";
-import { loadConfig, saveTestomatioHost } from "../config.js";
-
-/** Public, token-free view of a project for the client. */
-function publicProject(p: Project) {
-  return { id: p.id, title: p.title, framework: p.framework, testsCount: p.testsCount };
-}
-
-export async function testomatioAuthGet(): Promise<Response> {
-  const stored = loadStoredAuth();
-  // Base URL precedence: the in-app Settings host (config.json) wins, then
-  // TESTOMATIO_URL (.env), then the app.testomat.io default — see normalizeBaseUrl.
-  const baseUrl = normalizeBaseUrl(loadConfig().testomatioHost);
-
-  if (!stored?.token) {
-    console.log(`[tio-auth] status: not connected (base ${baseUrl})`);
-    return Response.json({
-      connected: false,
-      baseUrl,
-      signInUrl: signInUrl(baseUrl),
-    });
-  }
-
-  // A token authorized on one host is meaningless on another (the other
-  // instance may even accept it and return an empty project list) — treat a
-  // host switch as "re-authorize against the new host".
-  if (stored.baseUrl && normalizeBaseUrl(stored.baseUrl) !== baseUrl) {
-    console.warn(
-      `[tio-auth] status: stored token is for ${stored.baseUrl} but host is ${baseUrl} — re-authorize`
-    );
-    return Response.json({
-      connected: false,
-      rejected: true,
-      baseUrl,
-      signInUrl: signInUrl(baseUrl),
-    });
-  }
-
-  try {
-    const projects = await fetchProjects(stored.token, baseUrl);
-    const selectedProjectId =
-      stored.projectId && projects.some((p) => p.id === stored.projectId)
-        ? stored.projectId
-        : undefined;
-    console.log(
-      `[tio-auth] status: connected, ${projects.length} project(s)` +
-        (selectedProjectId ? `, selected ${selectedProjectId}` : "")
-    );
-    return Response.json({
-      connected: true,
-      baseUrl,
-      signInUrl: signInUrl(baseUrl),
-      selectedProjectId,
-      projects: projects.map(publicProject),
-    });
-  } catch (err) {
-    if (err instanceof UnauthorizedError) {
-      // The stored token is no longer valid — surface as disconnected so the
-      // UI re-prompts (it tells the user the previous token was rejected).
-      console.warn(`[tio-auth] status: stored token rejected by ${baseUrl}`);
-      return Response.json({
-        connected: false,
-        rejected: true,
-        baseUrl,
-        signInUrl: signInUrl(baseUrl),
-      });
-    }
-    const message = err instanceof Error ? err.message : String(err);
-    console.error(`[tio-auth] status check failed: ${message}`);
-    return Response.json({ error: message }, { status: 502 });
-  }
-}
-
-export async function testomatioAuthPost(request: Request): Promise<Response> {
-  let body: { token?: string };
-  try {
-    body = await request.json();
-  } catch {
-    return Response.json({ error: "invalid JSON body" }, { status: 400 });
-  }
-
-  const token = body.token?.trim();
-  if (!token) {
-    console.warn("[tio-auth] connect rejected: empty token");
-    return Response.json({ error: "token is required" }, { status: 400 });
-  }
-  if (!token.startsWith("eyJ")) {
-    console.warn(`[tio-auth] connect rejected: token ${maskToken(token)} is not a JWT`);
-    return Response.json(
-      { error: "That doesn't look like a JWT (expected to start with 'eyJ')." },
-      { status: 400 }
-    );
-  }
-
-  // Settings host (config.json) → TESTOMATIO_URL → app.testomat.io default.
-  const baseUrl = normalizeBaseUrl(loadConfig().testomatioHost);
-  console.log(`[tio-auth] connect: validating token ${maskToken(token)} against ${baseUrl}`);
-
-  let projects: Project[];
-  try {
-    projects = await fetchProjects(token, baseUrl);
-  } catch (err) {
-    if (err instanceof UnauthorizedError) {
-      console.warn(`[tio-auth] connect: token ${maskToken(token)} rejected by ${baseUrl}`);
-      return Response.json(
-        { error: "Testomat.io rejected this token. Generate a fresh one and try again." },
-        { status: 401 }
-      );
-    }
-    const message = err instanceof Error ? err.message : String(err);
-    console.error(`[tio-auth] connect failed: ${message}`);
-    return Response.json({ error: message }, { status: 502 });
-  }
-
-  // Preserve a still-valid project selection across reconnects.
-  const previous = loadStoredAuth();
-  const projectId =
-    previous?.projectId && projects.some((p) => p.id === previous.projectId)
-      ? previous.projectId
-      : undefined;
-  saveStoredAuth({ token, baseUrl, projectId });
-  console.log(
-    `[tio-auth] connected: ${projects.length} project(s) available` +
-      (projectId ? `, remembered selection ${projectId}` : "")
-  );
-
-  return Response.json({
-    connected: true,
-    baseUrl,
-    selectedProjectId: projectId,
-    projects: projects.map(publicProject),
-  });
-}
-
-export async function testomatioAuthDelete(): Promise<Response> {
-  console.log("[tio-auth] logout: cleared stored token");
-  clearStoredAuth();
-  return Response.json({ connected: false });
-}
-
-/**
- * Persist the Testomat.io host chosen in Settings. An empty host clears the
- * override (falls back to TESTOMATIO_URL / the default). Returns the resolved
- * base URL + sign-in URL so the client can update its connection state.
- */
-export async function testomatioHostPost(request: Request): Promise<Response> {
-  let body: { host?: string };
-  try {
-    body = await request.json();
-  } catch {
-    return Response.json({ error: "invalid JSON body" }, { status: 400 });
-  }
-
-  const host = body.host?.trim();
-  const baseUrl = normalizeBaseUrl(host);
-  saveTestomatioHost(host ? baseUrl : "");
-  console.log(`[tio-auth] host ${host ? `set to ${baseUrl}` : "cleared (using default)"}`);
-  return Response.json({ baseUrl, signInUrl: signInUrl(baseUrl) });
-}
-
-/**
- * Create an agent session for a chosen project. Resolves the project from the
- * stored JWT, persists the selection, then reuses `createProjectSession` to
- * pull tests + wire the Testomat.io MCP server — yielding a `sessionId` the UI
- * connects to exactly like an external `/api/agent/start` caller would.
- */
-export async function testomatioAuthSession(request: Request): Promise<Response> {
-  let body: { projectId?: string; fromSession?: string };
-  try {
-    body = await request.json();
-  } catch {
-    body = {};
-  }
-
-  const stored = loadStoredAuth();
-  if (!stored?.token) {
-    return Response.json(
-      { error: "Not connected to Testomat.io." },
-      { status: 401 }
-    );
-  }
-
-  const baseUrl = normalizeBaseUrl(loadConfig().testomatioHost);
-
-  // Resolve the project from the precache so opening never blocks on the slow
-  // /api/projects download. Only fall back to the network when nothing is
-  // cached (e.g. the very first launch). When we do use the cache, refresh it
-  // in the background so api_key rotations are eventually picked up.
-  let projects = getCachedProjects(stored.token, baseUrl);
-  if (projects) {
-    console.log(`[tio-auth] session: resolved project from cache (${projects.length})`);
-    void fetchProjects(stored.token, baseUrl, { force: true }).catch(() => {});
-  } else {
-    try {
-      projects = await fetchProjects(stored.token, baseUrl);
-    } catch (err) {
-      if (err instanceof UnauthorizedError) {
-        clearStoredAuth();
-        return Response.json(
-          { error: "Testomat.io token was rejected. Please reconnect." },
-          { status: 401 }
-        );
-      }
-      const message = err instanceof Error ? err.message : String(err);
-      return Response.json({ error: message }, { status: 502 });
-    }
-  }
-
-  const wantedId = body.projectId || stored.projectId;
-  const project =
-    (wantedId && projects.find((p) => p.id === wantedId)) ||
-    (projects.length === 1 ? projects[0] : undefined);
-
-  if (!project) {
-    console.warn(
-      `[tio-auth] session: no project resolved (wanted ${wantedId ?? "—"}, ${projects.length} available)`
-    );
-    return Response.json(
-      { error: "projectId is required (multiple projects available)." },
-      { status: 400 }
-    );
-  }
-
-  saveStoredAuth({ ...stored, baseUrl, projectId: project.id });
-
-  // Where the project's tests land:
-  //  - The user opened this workspace themselves — a folder they picked or the
-  //    `TESTEIYA_WORKSPACE` env dir (both `trusted`): stay there and overlay
-  //    tests into `.testeiya/manual-tests`. Connecting a project must never move
-  //    the user out of a directory they chose.
-  //  - Otherwise (empty: no current workspace, or a managed / pulled one) use a
-  //    dedicated, reusable per-project workspace so a known project opens
-  //    instantly from the same dir.
-  let workspaceDir = projectWorkspaceDir(project.id);
-  let overlay = false;
-  const from = body.fromSession ? getSession(body.fromSession) : null;
-  if (from?.trusted && fs.existsSync(from.cwd)) {
-    workspaceDir = from.cwd;
-    overlay = true;
-  }
-  console.log(
-    `[tio-auth] session: opening project ${project.title} (${project.id}) at ${workspaceDir}${
-      overlay ? " (overlay)" : ""
-    }`
-  );
-
-  const result = await createProjectSession(
-    [{ slug: project.id, title: project.title, token: project.apiKey }],
-    { backendUrl: baseUrl, workspaceDir, background: true, overlay, trusted: overlay }
-  );
-
-  console.log(
-    `[tio-auth] session ${result.sessionId} created for ${project.id} at ${result.cwd}`
-  );
-
-  return Response.json({
-    ...result,
-    project: { id: project.id, title: project.title },
-  });
-}

package/src/api/testomatio-proxy.ts

@@ -1,197 +0,0 @@
-import { getSession, type StoredSession } from "../session-store.js";
-import { loggedServerFetch } from "../debug-bus.js";
-
-/*
- * Generic proxy for Testomat.io v2 REST.
- *
- *   GET /api/testomatio/{resource}?session=<sid>                 → list
- *   GET /api/testomatio/{resource}?session=<sid>&id=<id>         → detail
- *   GET /api/testomatio/{resource}?session=<sid>&<filter>=<val>  → filtered list
- *   PUT /api/testomatio/{resource}?session=<sid>&id=<id>         → update (writable only)
- *   POST /api/testomatio/{resource}?session=<sid>               → create (creatable only)
- *
- * Upstream call: `${session.backendUrl}/api/v2/{project_slug}/{resource}[/{id}]`
- * Auth: `Authorization: Bearer ${session.tokens[slug]}` (per v2 spec).
- * Only resources + filters on the whitelists reach upstream (SSRF guard);
- * updates are limited to WRITABLE_RESOURCES (always need an id), creates to
- * CREATABLE_RESOURCES (collection POST, no id).
- */
-
-const ALLOWED_RESOURCES = new Set([
-  "runs",
-  "tests",
-  "suites",
-  "plans",
-  "testruns",
-  "rungroups",
-  "issues", // backs the UI "Requirements" view
-  "info", // project configuration (subscription, features, framework, …)
-  "labels", // label definitions (title, color, visibility) for the config view
-]);
-
-const WRITABLE_RESOURCES = new Set(["testruns", "runs"]);
-
-const CREATABLE_RESOURCES = new Set(["runs"]);
-
-const COMMON_FILTERS = ["page", "per_page", "query"];
-
-const RESOURCE_FILTERS: Record<string, string[]> = {
-  tests: [
-    "search_text",
-    "suites[]",
-    "tags[]",
-    "user",
-    "labels[]",
-    "priority",
-    "state",
-    "sync_status",
-    "milestones[]",
-    "tql",
-    "wildcard_tag",
-  ],
-  suites: ["file_type", "tag", "labels", "search_text"],
-  plans: ["kind", "hidden", "labels[]", "search_text"],
-  runs: [
-    "with_rungroups",
-    "search",
-    "tql",
-    "groupId",
-    "jira_ids",
-    "filter[status]",
-    "filter[kind]",
-    "filter[user]",
-    "filter[created_by]",
-    "filter[env]",
-    "filter[unfinished]",
-    "filter[archived]",
-    "filter[in_group]",
-    "filter[milestone]",
-    "filter[labels][]",
-  ],
-  testruns: [
-    "run_id",
-    "test_ids",
-    "filter[status]",
-    "filter[kind]",
-    "filter[user]",
-    "filter[priority]",
-    "filter[substatus]",
-    "filter[search]",
-    "filter[message]",
-    "filter[link]",
-    "filter[finished_at_date_range]",
-    "tags",
-    "labels",
-    "envs",
-    "rungroups",
-    "defects",
-  ],
-  rungroups: [],
-  issues: ["test_id", "suite_id", "run_id", "testrun_id", "plan_id", "source"],
-  info: [],
-  labels: [],
-};
-
-export async function testomatioProxy(
-  req: Request,
-  resource: string
-): Promise<Response> {
-  if (!ALLOWED_RESOURCES.has(resource)) {
-    return Response.json({ error: "bad resource" }, { status: 400 });
-  }
-
-  const url = new URL(req.url);
-  const sessionId = url.searchParams.get("session");
-  const id = url.searchParams.get("id");
-  const slug = url.searchParams.get("slug");
-
-  if (!sessionId) {
-    return Response.json({ error: "session required" }, { status: 400 });
-  }
-
-  const session = getSession(sessionId);
-  if (!session) {
-    return Response.json({ error: "session not found" }, { status: 404 });
-  }
-
-  const target = resolveTestomatioTarget(session, slug);
-  if ("error" in target) {
-    return Response.json({ error: target.error }, { status: 400 });
-  }
-  const { baseUrl, projectSlug, token } = target;
-
-  const method = req.method.toUpperCase();
-  const path = id
-    ? `/api/v2/${encodeURIComponent(projectSlug)}/${resource}/${encodeURIComponent(id)}`
-    : `/api/v2/${encodeURIComponent(projectSlug)}/${resource}`;
-  const upstream = new URL(path, baseUrl);
-
-  const headers: Record<string, string> = {
-    Authorization: `Bearer ${token}`,
-    Accept: "application/json",
-  };
-  const init: RequestInit = { headers, cache: "no-store" };
-  let requestBody: string | null = null;
-
-  if (method === "POST") {
-    if (!CREATABLE_RESOURCES.has(resource)) {
-      return Response.json({ error: "resource not creatable" }, { status: 400 });
-    }
-    headers["Content-Type"] = "application/json";
-    init.method = "POST";
-    requestBody = await req.text();
-    init.body = requestBody;
-  }
-
-  if (method === "PUT") {
-    if (!WRITABLE_RESOURCES.has(resource)) {
-      return Response.json({ error: "resource not writable" }, { status: 400 });
-    }
-    if (!id) {
-      return Response.json({ error: "id required" }, { status: 400 });
-    }
-    headers["Content-Type"] = "application/json";
-    init.method = "PUT";
-    requestBody = await req.text();
-    init.body = requestBody;
-  }
-
-  if (method === "GET") {
-    for (const [k, v] of url.searchParams) {
-      if (v && isAllowedFilter(resource, k)) upstream.searchParams.append(k, v);
-    }
-  }
-
-  const { res, text: body } = await loggedServerFetch(
-    upstream.toString(),
-    init,
-    requestBody
-  );
-  return new Response(body, {
-    status: res.status,
-    headers: { "content-type": "application/json" },
-  });
-}
-
-/**
- * Resolve a session to its Testomat.io call target: the project slug (explicit
- * or the session's first project), that project's bearer token, and the base
- * URL (trailing slash stripped). Shared by the proxy and the attachment upload.
- */
-export function resolveTestomatioTarget(
-  session: StoredSession,
-  slug?: string | null
-): { baseUrl: string; projectSlug: string; token: string } | { error: string } {
-  const projectSlug = slug ?? session.projects[0]?.slug;
-  const token = projectSlug ? session.tokens?.[projectSlug] : undefined;
-  const baseUrl = session.backendUrl;
-  if (!projectSlug || !token || !baseUrl) {
-    return { error: "session missing project slug, token, or backendUrl" };
-  }
-  return { baseUrl: baseUrl.replace(/\/$/, ""), projectSlug, token };
-}
-
-function isAllowedFilter(resource: string, key: string): boolean {
-  if (COMMON_FILTERS.includes(key)) return true;
-  return RESOURCE_FILTERS[resource]?.includes(key) ?? false;
-}