WEBDIENSTE/ECC
1
0
Fork 0
mirror of https://github.com/affaan-m/ECC.git synced 2026-09-06 17:57:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(ecc2): preserve harness evidence and legacy IDs

Browse Source
This commit is contained in:
Affaan Mustafa
2026-08-05 16:52:50 -04:00
parent 23bca4f3b7
commit 1f0d590da0
13 changed files with 1551 additions and 289 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/scripts/ito-cli-bridge.test.js
+87 -24
View File
@@ -9,7 +9,7 @@ const assert = require("assert");
const fs = require("fs");
const os = require("os");
const path = require("path");
const { spawnSync } = require("child_process");
const { spawn, spawnSync } = require("child_process");
const REPO_ROOT = path.join(__dirname, "..", "..");
const ECC_SCRIPT = path.join(REPO_ROOT, "scripts", "ecc.js");
@@ -36,6 +36,34 @@ function runCli(args, environment = {}) {
});
}
function runCliAndObserveFirstOutput(args, environment = {}) {
return new Promise((resolve, reject) => {
const child = spawn(process.execPath, [ECC_SCRIPT, ...args], {
cwd: REPO_ROOT,
env: { ...process.env, NODE_ENV: "test", ...environment },
stdio: ["ignore", "pipe", "pipe"],
});
let stdout = "";
let stderr = "";
let firstOutputAt;
const startedAt = Date.now();
child.stdout.on("data", (chunk) => {
if (firstOutputAt === undefined) firstOutputAt = Date.now();
stdout += chunk;
});
child.stderr.on("data", (chunk) => { stderr += chunk; });
child.once("error", reject);
child.once("close", (status) => resolve({
status,
stdout,
stderr,
startedAt,
firstOutputAt,
closedAt: Date.now(),
}));
});
}
function makeItoProbe(exitCode = 0) {
const directory = fs.mkdtempSync(path.join(os.tmpdir(), "ecc-ito-cli-"));
const log = path.join(directory, "invocation.json");
@@ -73,9 +101,9 @@ function readInvocation(probe) {
return JSON.parse(fs.readFileSync(probe.log, "utf8"));
}
function runTest(name, fn) {
async function runTest(name, fn) {
try {
fn();
await fn();
console.log(` ✓ ${name}`);
return true;
} catch (error) {
@@ -85,12 +113,12 @@ function runTest(name, fn) {
}
}
function main() {
async function main() {
console.log("\n=== Testing ECC × Itô real CLI bridge ===\n");
const tests = [
["forwards only the reviewed RFQ CLI surface to an explicit local executable", () => {
for (const command of ["auth", "find", "status"]) {
for (const command of ["login", "auth", "find", "status"]) {
const probe = makeItoProbe();
try {
const result = runCli(["ito", command], {
@@ -104,14 +132,27 @@ function main() {
}
}
}],
["forwards the canonical auth browser opt-out without performing browser automation", () => {
["forwards the canonical login browser opt-out without performing browser automation", () => {
const probe = makeItoProbe();
try {
const result = runCli(["ito", "login", "--no-browser"], {
ECC_ITO_CLI_EXECUTABLE: probe.executable,
});
assert.strictEqual(result.status, 0, result.stderr);
assert.deepStrictEqual(readInvocation(probe).argv, ["login", "--no-browser"]);
} finally {
fs.rmSync(probe.directory, { recursive: true, force: true });
}
}],
["rejects --no-browser on validation-only auth before spawning", () => {
const probe = makeItoProbe();
try {
const result = runCli(["ito", "auth", "--no-browser"], {
ECC_ITO_CLI_EXECUTABLE: probe.executable,
});
assert.strictEqual(result.status, 0, result.stderr);
assert.deepStrictEqual(readInvocation(probe).argv, ["auth", "--no-browser"]);
assert.notStrictEqual(result.status, 0);
assert.match(result.stderr, /--no-browser.*only.*login/i);
assert.ok(!fs.existsSync(probe.log));
} finally {
fs.rmSync(probe.directory, { recursive: true, force: true });
}
@@ -148,10 +189,10 @@ function main() {
fs.rmSync(probe.directory, { recursive: true, force: true });
}
}],
["passes only the required device-auth runtime settings across the process boundary", () => {
["login never inherits ITO_API_KEY but preserves secure token settings", () => {
const probe = makeItoProbe();
try {
const result = runCli(["ito", "auth"], {
const result = runCli(["ito", "login"], {
ECC_ITO_CLI_EXECUTABLE: probe.executable,
ITO_API_KEY: "must-not-cross-without-legacy-mode",
ITO_AUTH_MODE: "device",
@@ -179,26 +220,46 @@ function main() {
fs.rmSync(probe.directory, { recursive: true, force: true });
}
}],
["forwards the legacy API key only with explicit legacy auth mode", () => {
for (const [mode, expectedKey] of [
[undefined, undefined],
["device", undefined],
["legacy", "ito_test_key"],
]) {
["forwards ITO_API_KEY directly to auth, find, and status without legacy mode", () => {
for (const command of ["auth", "find", "status"]) {
const probe = makeItoProbe();
try {
const result = runCli(["ito", "status"], {
const result = runCli(["ito", command], {
ECC_ITO_CLI_EXECUTABLE: probe.executable,
ITO_API_KEY: "ito_test_key",
...(mode ? { ITO_AUTH_MODE: mode } : {}),
});
assert.strictEqual(result.status, 0, result.stderr);
assert.strictEqual(readInvocation(probe).env.ITO_API_KEY, expectedKey);
assert.strictEqual(readInvocation(probe).env.ITO_API_KEY, "ito_test_key");
} finally {
fs.rmSync(probe.directory, { recursive: true, force: true });
}
}
}],
["streams device login output before completion and propagates its exit status", async () => {
const probe = makeItoProbe(7);
try {
fs.writeFileSync(
probe.executable,
[
'"use strict";',
'process.stdout.write("device-code-now\\n");',
'setTimeout(() => process.exit(7), 500);',
"",
].join("\n")
);
const result = await runCliAndObserveFirstOutput(["ito", "login"], {
ECC_ITO_CLI_EXECUTABLE: probe.executable,
});
assert.strictEqual(result.status, 7, result.stderr);
assert.match(result.stdout, /device-code-now/);
assert.ok(
result.closedAt - result.firstOutputAt >= 350,
"login output was buffered until process completion",
);
} finally {
fs.rmSync(probe.directory, { recursive: true, force: true });
}
}],
["isolates live node qualification from Itô and unrelated credentials", () => {
const probe = makeItoProbe();
try {
@@ -398,7 +459,7 @@ function main() {
ECC_ITO_CLI_EXECUTABLE: probe.executable,
});
assert.notStrictEqual(result.status, 0, command);
assert.match(result.stderr, /only auth, find, status, and evals/i);
assert.match(result.stderr, /only login, auth, find, status, and evals/i);
assert.ok(!fs.existsSync(probe.log), `${command} must not spawn the Itô CLI`);
} finally {
fs.rmSync(probe.directory, { recursive: true, force: true });
@@ -563,14 +624,15 @@ function main() {
fs.rmSync(probe.directory, { recursive: true, force: true });
}
}],
["help exposes canonical device auth without claiming ECC browser automation", () => {
["help separates device login from auth validation", () => {
const probe = makeItoProbe();
try {
const result = runCli(["ito", "--help"], {
ECC_ITO_CLI_EXECUTABLE: probe.executable,
});
assert.strictEqual(result.status, 0, result.stderr);
assert.match(result.stdout, /ecc ito auth \[--no-browser\]/);
assert.match(result.stdout, /ecc ito login \[--no-browser\]/);
assert.match(result.stdout, /ecc ito auth/);
assert.match(result.stdout, /ecc ito find/);
assert.match(result.stdout, /ecc ito status/);
assert.match(result.stdout, /ecc ito evals/);
@@ -585,7 +647,8 @@ function main() {
assert.match(result.stdout, /opens the Itô verification page by default/i);
assert.match(result.stdout, /macOS Keychain/i);
assert.match(result.stdout, /ECC itself performs no browser automation/i);
assert.match(result.stdout, /ITO_AUTH_MODE=legacy/);
assert.match(result.stdout, /auth.*validat/i);
assert.match(result.stdout, /ITO_AUTH_MODE=legacy is not\s+required/i);
assert.doesNotMatch(
result.stdout,
/manual copy|ito_lock|ito_run|npm link|paper|simulat/i
@@ -600,7 +663,7 @@ function main() {
let passed = 0;
let failed = 0;
for (const [name, fn] of tests) {
if (runTest(name, fn)) passed += 1;
if (await runTest(name, fn)) passed += 1;
else failed += 1;
}