|
| 1 | +import assert from 'node:assert/strict'; |
| 2 | +import { spawnSync } from 'node:child_process'; |
| 3 | +import { mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs'; |
| 4 | +import os from 'node:os'; |
| 5 | +import path from 'node:path'; |
| 6 | +import test from 'node:test'; |
| 7 | +import { fileURLToPath } from 'node:url'; |
| 8 | + |
| 9 | +const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'); |
| 10 | + |
| 11 | +test('离线 npm 包贯通编辑任务与原生复检，未批准时不关闭', () => { |
| 12 | + const binary = process.env.CODEGUARD_WASM_BIN; |
| 13 | + assert.ok(binary, 'CODEGUARD_WASM_BIN is required'); |
| 14 | + const packed = spawnSync(process.execPath, [ |
| 15 | + path.join(root, 'scripts', 'pack-npm-local.mjs'), '--require-wasm', binary, |
| 16 | + ], { cwd: root, encoding: 'utf8', timeout: 120_000 }); |
| 17 | + assert.equal(packed.status, 0, packed.stderr); |
| 18 | + const tarball = packed.stdout.trim(); |
| 19 | + assert.ok(tarball.endsWith('.tgz')); |
| 20 | + const scratch = realpathSync(mkdtempSync(path.join(os.tmpdir(), 'codeguard-npm-repair-'))); |
| 21 | + try { |
| 22 | + const file = path.join(scratch, 'app.zig'); |
| 23 | + const bad = 'pub fn main( void {\n'; |
| 24 | + const good = 'pub fn main() void {}\n'; |
| 25 | + writeFileSync(file, bad); |
| 26 | + function invoke(args, input) { |
| 27 | + const result = spawnSync('npm', [ |
| 28 | + 'exec', '--offline', '--yes', '--ignore-scripts', '--cache', path.join(scratch, 'npm-cache'), |
| 29 | + '--package', tarball, '--', 'codeguard', ...args, '--format=json', |
| 30 | + ], { |
| 31 | + cwd: scratch, input: input === undefined ? undefined : JSON.stringify(input), |
| 32 | + encoding: 'utf8', timeout: 120_000, maxBuffer: 1024 * 1024, |
| 33 | + env: { ...process.env, npm_config_audit: 'false', npm_config_fund: 'false' }, |
| 34 | + }); |
| 35 | + assert.equal(result.error, undefined, result.error?.message); |
| 36 | + assert.equal(result.signal, null); |
| 37 | + let value; |
| 38 | + try { value = JSON.parse(result.stdout); } catch { |
| 39 | + assert.fail(`npm launcher did not return JSON: ${result.stderr}`); |
| 40 | + } |
| 41 | + return { exit: result.status, value }; |
| 42 | + } |
| 43 | + const initialized = invoke(['init', scratch, '--apply']); |
| 44 | + assert.equal(initialized.exit, 3); |
| 45 | + const changed = { |
| 46 | + schema_version: '1.0.0', report_type: 'hook_trigger_request', |
| 47 | + input: { |
| 48 | + event: 'file_changed', changed_paths: ['app.zig'], task_id: null, |
| 49 | + write_outcome: 'confirmed', host_claims_blocking: false, |
| 50 | + }, |
| 51 | + }; |
| 52 | + const edit = () => invoke(['hook', 'execute', scratch, '--timeout=30s'], changed); |
| 53 | + const first = edit(); |
| 54 | + assert.equal(first.exit, 3); |
| 55 | + assert.equal(first.value.delivery_decision, 'not_evaluated'); |
| 56 | + assert.ok(first.value.local_feedback?.syntax_tasks, |
| 57 | + 'installed package must connect edit feedback to syntax tasks'); |
| 58 | + const tasks = first.value.local_feedback.syntax_tasks; |
| 59 | + assert.equal(tasks?.status, 'synced_partial', 'installed package must persist syntax tasks'); |
| 60 | + const id = tasks.tasks[0].task_id; |
| 61 | + assert.match(id, /^CG-B-[a-f0-9]+$/); |
| 62 | + const repeated = edit(); |
| 63 | + assert.equal(repeated.exit, 3); |
| 64 | + assert.equal(repeated.value.local_feedback.syntax_tasks.tasks[0].task_id, id); |
| 65 | + |
| 66 | + const conversation = invoke([ |
| 67 | + 'hook', 'claude', 'post-tool-use', scratch, '--timeout=30s', |
| 68 | + ], { |
| 69 | + hook_event_name: 'PostToolUse', cwd: scratch, tool_name: 'Edit', |
| 70 | + tool_input: { |
| 71 | + file_path: file, old_string: 'old', new_string: 'HOST_SOURCE_MUST_NOT_BE_ECHOED', |
| 72 | + }, |
| 73 | + tool_response: { success: true }, |
| 74 | + }); |
| 75 | + assert.equal(conversation.exit, 0); |
| 76 | + assert.equal(conversation.value.hookSpecificOutput.hookEventName, 'PostToolUse'); |
| 77 | + const context = conversation.value.hookSpecificOutput.additionalContext; |
| 78 | + assert.ok(context.includes(id)); |
| 79 | + assert.ok(context.includes('codeguard task show')); |
| 80 | + assert.ok([...context].length <= 1200); |
| 81 | + assert.ok(!context.includes('HOST_SOURCE_MUST_NOT_BE_ECHOED')); |
| 82 | + |
| 83 | + // 受控工具只验证安装后编排；真实 Zig 验收另有独立用例。 |
| 84 | + const tool = path.join(scratch, 'zig-tool'); |
| 85 | + writeFileSync(tool, `#!/bin/sh |
| 86 | +if [ "$1" = version ]; then printf '0.16.0\\n'; exit 0; fi |
| 87 | +while IFS= read -r line; do |
| 88 | + case "$line" in *'main( void'*) printf '<stdin>:1:13: error: expected token\\n' >&2; exit 1;; esac |
| 89 | +done |
| 90 | +exit 0 |
| 91 | +`, { mode: 0o700 }); |
| 92 | + const verify = () => invoke([ |
| 93 | + 'task', 'verify', id, scratch, '--zig-tool', tool, '--timeout', '30s', |
| 94 | + ]); |
| 95 | + const present = verify(); |
| 96 | + assert.equal(present.exit, 3); |
| 97 | + assert.equal(present.value.event_persisted, true); |
| 98 | + assert.equal(present.value.observation, 'still_blocked'); |
| 99 | + assert.equal(present.value.native_scan.native.status, 'diagnostics_observed'); |
| 100 | + const next = invoke(['next', scratch]); |
| 101 | + assert.equal(next.value.repair_brief.disposition, 'actionable'); |
| 102 | + assert.equal(next.value.repair_brief.native_diagnostic_positions[0].column, 13); |
| 103 | + assert.equal(next.value.repair_brief.recheck_argv.at(-1), tool); |
| 104 | + assert.equal(next.value.repair_brief.native_confirmation_ref.run_id, |
| 105 | + present.value.native_scan.run_id); |
| 106 | + |
| 107 | + writeFileSync(file, good); |
| 108 | + const stale = invoke(['next', scratch]); |
| 109 | + assert.equal(stale.value.repair_brief.disposition, 'verification_required'); |
| 110 | + assert.deepEqual(stale.value.repair_brief.native_diagnostic_positions, []); |
| 111 | + const repaired = verify(); |
| 112 | + assert.equal(repaired.exit, 3); |
| 113 | + assert.equal(repaired.value.event_persisted, true); |
| 114 | + assert.equal(repaired.value.observation, 'candidate_absent_unverified_policy'); |
| 115 | + assert.equal(repaired.value.native_scan.native.status, 'completed'); |
| 116 | + const factPath = path.join(scratch, '.codeguard', 'findings', id, 'finding.json'); |
| 117 | + assert.equal(JSON.parse(readFileSync(factPath)).state, 'open'); |
| 118 | + const cleanCandidate = edit(); |
| 119 | + assert.equal(cleanCandidate.value.local_feedback.candidate_recovery_count, 0); |
| 120 | + assert.equal(JSON.parse(readFileSync(factPath)).state, 'open'); |
| 121 | + |
| 122 | + writeFileSync(file, bad); |
| 123 | + const again = edit(); |
| 124 | + assert.equal(again.value.local_feedback.syntax_tasks.tasks[0].task_id, id); |
| 125 | + assert.equal(verify().value.observation, 'still_blocked'); |
| 126 | + assert.equal(JSON.parse(readFileSync(factPath)).state, 'open'); |
| 127 | + if (process.env.CODEGUARD_NPM_REPAIR_ARTIFACT) { |
| 128 | + writeFileSync(process.env.CODEGUARD_NPM_REPAIR_ARTIFACT, JSON.stringify({ |
| 129 | + initialized: initialized.value, edit: first.value, repeated: repeated.value, |
| 130 | + conversation: conversation.value, present: present.value, next: next.value, |
| 131 | + stale: stale.value, repaired: repaired.value, clean_candidate: cleanCandidate.value, |
| 132 | + repeated_problem: again.value, |
| 133 | + }, null, 2)); |
| 134 | + } |
| 135 | + } finally { |
| 136 | + rmSync(scratch, { recursive: true, force: true }); |
| 137 | + } |
| 138 | +}); |
0 commit comments