mirror of
https://github.com/affaan-m/ECC.git
synced 2026-09-20 16:47:59 +02:00
Juan Garibay
3c31747016
The guard added in9cdc40e6was incomplete. `git ls-files` reports paths as they are indexed and does not follow symlinks, so a repository that commits `.venv` as a symlink to its own root alongside a tracked `bin/python` gets asked about `.venv/bin/python` -- a path git has never heard of -- and the answer is "untracked". The interpreter then runs. Measured on that shape: the planted executable logged two invocations against9cdc40e6and none against this commit. `repo_ships_interpreter` now resolves the bin directory with `cd -P`/`pwd -P`, resolves the worktree root the same way, and asks git about the resolved path relative to it. The three cases that matter all hold: a plainly committed venv is still refused, the symlink shape is now refused, and a developer's own untracked venv still resolves and runs. `cd -P`/`pwd -P` rather than `realpath` or `readlink -f`, because neither is portable to a stock macOS.
1159 lines
42 KiB
JavaScript
1159 lines
42 KiB
JavaScript
/**
|
|
* Tests for Codex shell helpers.
|
|
*/
|
|
|
|
const assert = require('assert');
|
|
const fs = require('fs');
|
|
const os = require('os');
|
|
const path = require('path');
|
|
const { spawnSync } = require('child_process');
|
|
const TOML = require('@iarna/toml');
|
|
|
|
const repoRoot = path.join(__dirname, '..', '..');
|
|
const installScript = path.join(repoRoot, 'scripts', 'codex', 'install-global-git-hooks.sh');
|
|
const prePushHook = path.join(repoRoot, 'scripts', 'codex-git-hooks', 'pre-push');
|
|
const pluginCacheCheckScript = path.join(repoRoot, 'scripts', 'codex', 'check-plugin-cache.js');
|
|
const mergeCodexConfigScript = path.join(repoRoot, 'scripts', 'codex', 'merge-codex-config.js');
|
|
const mergeMcpConfigScript = path.join(repoRoot, 'scripts', 'codex', 'merge-mcp-config.js');
|
|
const syncScript = path.join(repoRoot, 'scripts', 'sync-ecc-to-codex.sh');
|
|
const packageJson = JSON.parse(fs.readFileSync(path.join(repoRoot, 'package.json'), 'utf8'));
|
|
const packageVersion = packageJson.version;
|
|
const deterministicPackageEnv = {
|
|
CLAUDE_PACKAGE_MANAGER: 'npm',
|
|
CLAUDE_CODE_PACKAGE_MANAGER: 'npm',
|
|
};
|
|
|
|
function test(name, fn) {
|
|
try {
|
|
fn();
|
|
console.log(` ✓ ${name}`);
|
|
return true;
|
|
} catch (error) {
|
|
console.log(` ✗ ${name}`);
|
|
console.log(` Error: ${error.message}`);
|
|
return false;
|
|
}
|
|
}
|
|
|
|
function createTempDir(prefix) {
|
|
return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
|
|
}
|
|
|
|
function cleanup(dirPath) {
|
|
fs.rmSync(dirPath, { recursive: true, force: true });
|
|
}
|
|
|
|
function resolveBashExecutable(env = process.env) {
|
|
return env.BASH_PATH
|
|
|| (process.platform === 'win32' && fs.existsSync('C:\\Program Files\\Git\\bin\\bash.exe')
|
|
? 'C:\\Program Files\\Git\\bin\\bash.exe'
|
|
: fs.existsSync('/bin/bash')
|
|
? '/bin/bash'
|
|
: 'bash');
|
|
}
|
|
|
|
function runBash(
|
|
scriptPath,
|
|
{ args = [], env = {}, cwd = repoRoot, input = undefined, preservePath = true } = {},
|
|
) {
|
|
const effectiveEnv = {
|
|
...(preservePath ? process.env : {}),
|
|
...env,
|
|
};
|
|
const bash = resolveBashExecutable(effectiveEnv);
|
|
return spawnSync(bash, [scriptPath, ...args], {
|
|
cwd,
|
|
env: effectiveEnv,
|
|
encoding: 'utf8',
|
|
input,
|
|
stdio: ['pipe', 'pipe', 'pipe'],
|
|
});
|
|
}
|
|
|
|
function toBashPath(filePath) {
|
|
return process.platform === 'win32'
|
|
? `/${filePath[0].toLowerCase()}${filePath.slice(2).replaceAll('\\', '/')}`
|
|
: filePath;
|
|
}
|
|
|
|
function runNode(scriptPath, args = [], env = {}, cwd = repoRoot) {
|
|
return spawnSync('node', [scriptPath, ...args], {
|
|
cwd,
|
|
env: {
|
|
...process.env,
|
|
...env,
|
|
},
|
|
encoding: 'utf8',
|
|
stdio: ['pipe', 'pipe', 'pipe'],
|
|
});
|
|
}
|
|
|
|
function makeHermeticCodexEnv(homeDir, codexDir, extraEnv = {}) {
|
|
const agentsHome = path.join(homeDir, '.agents');
|
|
const hooksDir = path.join(codexDir, 'git-hooks');
|
|
return {
|
|
HOME: homeDir,
|
|
USERPROFILE: homeDir,
|
|
XDG_CONFIG_HOME: path.join(homeDir, '.config'),
|
|
GIT_CONFIG_GLOBAL: path.join(homeDir, '.gitconfig'),
|
|
CODEX_HOME: codexDir,
|
|
AGENTS_HOME: agentsHome,
|
|
ECC_GLOBAL_HOOKS_DIR: hooksDir,
|
|
CLAUDE_PACKAGE_MANAGER: 'npm',
|
|
CLAUDE_CODE_PACKAGE_MANAGER: 'npm',
|
|
LANG: 'C.UTF-8',
|
|
LC_ALL: 'C.UTF-8',
|
|
...extraEnv,
|
|
};
|
|
}
|
|
|
|
function writeJson(filePath, value) {
|
|
fs.mkdirSync(path.dirname(filePath), { recursive: true });
|
|
fs.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`);
|
|
}
|
|
|
|
function seedPluginCache(codexDir, manifest, files = []) {
|
|
const cacheDir = path.join(codexDir, 'plugins', 'cache', 'ecc', 'ecc', packageVersion);
|
|
writeJson(path.join(cacheDir, '.codex-plugin', 'plugin.json'), manifest);
|
|
fs.writeFileSync(path.join(cacheDir, 'README.md'), '# cached plugin\n');
|
|
for (const [relativePath, content] of files) {
|
|
const target = path.join(cacheDir, relativePath);
|
|
fs.mkdirSync(path.dirname(target), { recursive: true });
|
|
fs.writeFileSync(target, content);
|
|
}
|
|
return cacheDir;
|
|
}
|
|
|
|
const cacheManifestWithLocalRefs = {
|
|
name: 'ecc',
|
|
version: packageVersion,
|
|
skills: './skills/',
|
|
mcpServers: './.mcp.json',
|
|
interface: {
|
|
composerIcon: './assets/ecc-icon.svg',
|
|
logo: './assets/hero.png',
|
|
},
|
|
};
|
|
|
|
let passed = 0;
|
|
let failed = 0;
|
|
|
|
if (
|
|
test('shell test runner honors an explicit BASH_PATH override', () => {
|
|
assert.strictEqual(
|
|
resolveBashExecutable({ BASH_PATH: '/custom/git/bin/bash' }),
|
|
'/custom/git/bin/bash',
|
|
);
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('shell test runner honors a per-invocation BASH_PATH override', () => {
|
|
const tempDir = createTempDir('ecc-missing-bash-');
|
|
try {
|
|
const missingBash = path.join(tempDir, 'bash');
|
|
const result = runBash(prePushHook, { env: { BASH_PATH: missingBash } });
|
|
assert.strictEqual(result.error?.code, 'ENOENT');
|
|
} finally {
|
|
cleanup(tempDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
function runHermeticPrePush({
|
|
failScript = null,
|
|
includeCorepack = true,
|
|
includePnpm = false,
|
|
audit = false,
|
|
} = {}) {
|
|
const tempDir = createTempDir('codex-pre-push-');
|
|
const binDir = path.join(tempDir, 'bin');
|
|
const projectDir = path.join(tempDir, 'project');
|
|
const callsPath = path.join(tempDir, 'calls.txt');
|
|
const bashEnv = path.join(tempDir, 'bash-env');
|
|
fs.mkdirSync(binDir);
|
|
fs.mkdirSync(projectDir);
|
|
const functionStub = (name, corepack) => `${name}() {
|
|
${corepack ? 'node -e \'const p=require("./package.json"); process.exit(p.packageManager === "pnpm@11.9.0" ? 0 : 1)\' || return 97' : ':'}
|
|
printf '%s\\n' "${corepack ? '' : 'pnpm '}$*" >> "${toBashPath(callsPath)}"
|
|
${corepack ? 'shift' : ':'}
|
|
shift
|
|
test "$1" != "${failScript || '__never__'}"
|
|
}`;
|
|
fs.writeFileSync(
|
|
bashEnv,
|
|
`git() { return 0; }
|
|
node() { "${toBashPath(process.execPath)}" "$@"; }
|
|
${includeCorepack ? functionStub('corepack', true) : ''}
|
|
${includePnpm ? functionStub('pnpm', false) : ''}
|
|
`,
|
|
);
|
|
fs.writeFileSync(path.join(projectDir, 'pnpm-lock.yaml'), 'lockfileVersion: 9\n');
|
|
const initialized = spawnSync('git', ['init', '--quiet'], { cwd: projectDir });
|
|
assert.strictEqual(initialized.status, 0, initialized.stderr?.toString());
|
|
writeJson(path.join(projectDir, 'package.json'), {
|
|
packageManager: 'pnpm@11.9.0',
|
|
scripts: { lint: 'x', typecheck: 'x', test: 'x', build: 'x' },
|
|
});
|
|
const result = runBash(prePushHook, {
|
|
env: {
|
|
PATH: toBashPath(binDir),
|
|
BASH_ENV: toBashPath(bashEnv),
|
|
ECC_PREPUSH_AUDIT: audit ? '1' : '0',
|
|
ECC_SKIP_GIT_HOOKS: '0',
|
|
ECC_SKIP_PREPUSH: '0',
|
|
MSYS_NO_PATHCONV: '1',
|
|
},
|
|
cwd: projectDir,
|
|
input: Buffer.from('refs/heads/main 1111111111111111111111111111111111111111 refs/heads/main 0000000000000000000000000000000000000000\n'),
|
|
preservePath: false,
|
|
});
|
|
const calls = fs.existsSync(callsPath)
|
|
? fs.readFileSync(callsPath, 'utf8').trim().split(/\r?\n/)
|
|
: [];
|
|
cleanup(tempDir);
|
|
return { result, calls };
|
|
}
|
|
|
|
if (
|
|
test('pre-push uses Corepack pinned pnpm and runs every required verification script', () => {
|
|
const { result, calls } = runHermeticPrePush();
|
|
assert.strictEqual(result.status, 0, JSON.stringify(result, null, 2));
|
|
assert.deepStrictEqual(calls, [
|
|
'pnpm run lint',
|
|
'pnpm run typecheck',
|
|
'pnpm run test',
|
|
'pnpm run build',
|
|
], JSON.stringify(result, null, 2));
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('pre-push falls back to direct pnpm when Corepack is absent', () => {
|
|
const { result, calls } = runHermeticPrePush({
|
|
includeCorepack: false,
|
|
includePnpm: true,
|
|
});
|
|
assert.strictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.deepStrictEqual(calls, [
|
|
'pnpm run lint',
|
|
'pnpm run typecheck',
|
|
'pnpm run test',
|
|
'pnpm run build',
|
|
]);
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('pre-push fails closed when pnpm and Corepack cannot resolve', () => {
|
|
const { result } = runHermeticPrePush({ includeCorepack: false });
|
|
assert.notStrictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.match(result.stderr, /pnpm.*(?:resolve|found)/i);
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('pre-push stops immediately when a required verification script fails', () => {
|
|
const { result, calls } = runHermeticPrePush({ failScript: 'typecheck' });
|
|
assert.notStrictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.deepStrictEqual(calls, ['pnpm run lint', 'pnpm run typecheck']);
|
|
assert.match(result.stderr, /typecheck failed/);
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('pre-push runs the production audit through Corepack pnpm', () => {
|
|
const { result, calls } = runHermeticPrePush({ audit: true });
|
|
assert.strictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.deepStrictEqual(calls, [
|
|
'pnpm run lint',
|
|
'pnpm run typecheck',
|
|
'pnpm run test',
|
|
'pnpm run build',
|
|
'pnpm audit --prod',
|
|
]);
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('pre-push fails closed when the production audit fails', () => {
|
|
const { result, calls } = runHermeticPrePush({ audit: true, failScript: '--prod' });
|
|
assert.notStrictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.deepStrictEqual(calls, [
|
|
'pnpm run lint',
|
|
'pnpm run typecheck',
|
|
'pnpm run test',
|
|
'pnpm run build',
|
|
'pnpm audit --prod',
|
|
]);
|
|
assert.match(result.stderr, /pnpm audit failed/);
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
function writeExecutable(filePath, body) {
|
|
fs.mkdirSync(path.dirname(filePath), { recursive: true });
|
|
fs.writeFileSync(filePath, body);
|
|
fs.chmodSync(filePath, 0o755);
|
|
}
|
|
|
|
// The Python arm of the hook, exercised without a real interpreter: the stubs
|
|
// record the argv they were handed, which is what the virtualenv-path regression
|
|
// is actually about.
|
|
function runHermeticPythonPrePush({
|
|
venvName = null,
|
|
venvExit = 0,
|
|
trackVenv = false,
|
|
trackedSymlinkVenv = false,
|
|
pytestCmd = null,
|
|
overrideStub = false,
|
|
pathPytestVersionLine = null,
|
|
} = {}) {
|
|
const tempDir = createTempDir('codex-pre-push-py-');
|
|
const projectDir = path.join(tempDir, 'project');
|
|
const callsPath = path.join(tempDir, 'calls.txt');
|
|
fs.mkdirSync(projectDir);
|
|
fs.writeFileSync(path.join(projectDir, 'pyproject.toml'), '[project]\nname = "demo"\n');
|
|
const initialized = spawnSync('git', ['init', '--quiet'], { cwd: projectDir });
|
|
assert.strictEqual(initialized.status, 0, initialized.stderr?.toString());
|
|
|
|
// Every stub records the argv it was handed. That record is the assertion: it is
|
|
// how a test tells a preserved path from a split one, and a command that was run
|
|
// once from one the hook probed first.
|
|
const record = `printf '%s\\n' "$0|$*" >> "${toBashPath(callsPath)}"`;
|
|
|
|
// A tracked venv has to live inside the repository to be trackable at all, and is
|
|
// found by directory-name discovery rather than by VIRTUAL_ENV.
|
|
const venvDir = venvName === null ? null : path.join(trackVenv ? projectDir : tempDir, venvName);
|
|
const venvPython = venvDir === null ? null : path.join(venvDir, 'bin', 'python');
|
|
if (venvPython !== null) {
|
|
writeExecutable(venvPython, `#!/bin/sh\n${record}\nif [ "$1" = "-c" ]; then exit 0; fi\nexit ${venvExit}\n`);
|
|
if (trackVenv) {
|
|
// Staged, not committed: `git ls-files` reads the index, so this is enough to
|
|
// make the file repository-controlled without needing a committer identity.
|
|
const added = spawnSync('git', ['add', '-f', '--', venvPython], { cwd: projectDir });
|
|
assert.strictEqual(added.status, 0, added.stderr?.toString());
|
|
}
|
|
}
|
|
|
|
// The shape that defeats a naive `git ls-files -- .venv/bin/python` check: the
|
|
// repository commits `.venv` as a symlink to its own root plus a tracked
|
|
// `bin/python`, so git is asked about a path it has never indexed.
|
|
if (trackedSymlinkVenv) {
|
|
writeExecutable(path.join(projectDir, 'bin', 'python'), `#!/bin/sh\n${record}\nexit 0\n`);
|
|
fs.symlinkSync('.', path.join(projectDir, '.venv'));
|
|
const added = spawnSync('git', ['add', '-f', '--', 'bin/python', '.venv'], { cwd: projectDir });
|
|
assert.strictEqual(added.status, 0, added.stderr?.toString());
|
|
}
|
|
|
|
// Deliberately does NOT special-case --version: an operator's wrapper would not
|
|
// either, and the recorded calls are what prove the hook never probed it.
|
|
const overrideStubPath = overrideStub ? path.join(tempDir, 'bin', 'wrapper') : null;
|
|
if (overrideStubPath !== null) {
|
|
writeExecutable(overrideStubPath, `#!/bin/sh\n${record}\nexit 0\n`);
|
|
}
|
|
|
|
const pathBin = pathPytestVersionLine === null ? null : path.join(tempDir, 'pathbin');
|
|
if (pathBin !== null) {
|
|
writeExecutable(
|
|
path.join(pathBin, 'pytest'),
|
|
`#!/bin/sh\nif [ "$1" = "--version" ]; then printf '%s\\n' '${pathPytestVersionLine}'; exit 0; fi\n${record}\nexit 0\n`,
|
|
);
|
|
}
|
|
|
|
const override = overrideStubPath === null ? pytestCmd : toBashPath(overrideStubPath);
|
|
// Built from nothing rather than from process.env. The hook reads VIRTUAL_ENV and
|
|
// ECC_PYTEST_CMD from the ambient environment, so a developer running this suite
|
|
// inside an activated virtualenv, or with ECC_PYTEST_CMD exported, would resolve a
|
|
// pytest the fixture never created. Omitted, not blanked: now that a variable set
|
|
// to nothing is itself an override, blanking it here would make every one of these
|
|
// tests take that branch.
|
|
const env = {
|
|
PATH: pathBin === null
|
|
? process.env.PATH
|
|
: `${toBashPath(pathBin)}${path.delimiter}${process.env.PATH}`,
|
|
HOME: process.env.HOME ?? '',
|
|
ECC_SKIP_GIT_HOOKS: '0',
|
|
ECC_SKIP_PREPUSH: '0',
|
|
MSYS_NO_PATHCONV: '1',
|
|
...(venvDir === null || trackVenv ? {} : { VIRTUAL_ENV: toBashPath(venvDir) }),
|
|
...(override === null ? {} : { ECC_PYTEST_CMD: override }),
|
|
};
|
|
|
|
const result = runBash(prePushHook, {
|
|
env,
|
|
cwd: projectDir,
|
|
preservePath: false,
|
|
input: Buffer.from('refs/heads/main 1111111111111111111111111111111111111111 refs/heads/main 0000000000000000000000000000000000000000\n'),
|
|
});
|
|
const calls = fs.existsSync(callsPath)
|
|
? fs.readFileSync(callsPath, 'utf8').trim().split(/\r?\n/).filter(Boolean)
|
|
: [];
|
|
cleanup(tempDir);
|
|
return { result, calls, venvPython, overrideStubPath };
|
|
}
|
|
|
|
if (
|
|
test('pre-push runs pytest from a virtualenv whose path contains spaces', () => {
|
|
const { result, calls, venvPython } = runHermeticPythonPrePush({ venvName: 'my venv' });
|
|
const python = toBashPath(venvPython);
|
|
assert.strictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.deepStrictEqual(calls, [
|
|
`${python}|-c import pytest`,
|
|
`${python}|-m pytest -q`,
|
|
], JSON.stringify({ calls, python, stdout: result.stdout, stderr: result.stderr }, null, 2));
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('pre-push refuses to run a virtualenv python that the repository tracks', () => {
|
|
const { result, calls } = runHermeticPythonPrePush({ venvName: '.venv', trackVenv: true });
|
|
assert.strictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.deepStrictEqual(calls, [], JSON.stringify(calls));
|
|
assert.match(result.stdout, /the repository ships it/);
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('pre-push refuses a tracked interpreter reached through a committed symlink', () => {
|
|
const { result, calls } = runHermeticPythonPrePush({ trackedSymlinkVenv: true });
|
|
assert.strictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.deepStrictEqual(calls, [], JSON.stringify(calls));
|
|
assert.match(result.stdout, /the repository ships it/);
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('pre-push blocks the push when the resolved pytest fails', () => {
|
|
const { result } = runHermeticPythonPrePush({ venvName: 'venv-red', venvExit: 1 });
|
|
assert.notStrictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.match(result.stderr, /pytest failed \(exit 1\)/);
|
|
assert.doesNotMatch(result.stdout, /Verification checks passed/);
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('pre-push does not block when pytest collected no tests (exit 5)', () => {
|
|
const { result } = runHermeticPythonPrePush({ venvName: 'venv-empty', venvExit: 5 });
|
|
assert.strictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.match(result.stdout, /collected no tests \(exit 5\)/);
|
|
assert.match(result.stdout, /rootdir, testpaths, and conftest\.py/);
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('pre-push runs an ECC_PYTEST_CMD override exactly once, without probing it', () => {
|
|
const { result, calls, overrideStubPath } = runHermeticPythonPrePush({ overrideStub: true });
|
|
assert.strictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.deepStrictEqual(calls, [`${toBashPath(overrideStubPath)}|-q`], JSON.stringify(calls));
|
|
// The override is not verified to be pytest, so it must at least be loud.
|
|
assert.match(result.stdout, /via ECC_PYTEST_CMD/);
|
|
assert.match(result.stdout, /does\n?.*not check that it is pytest/s);
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
// Both blank forms, because they used to disagree: an unquoted empty value fell
|
|
// through to discovery while whitespace failed the push. A venv is present so a
|
|
// fall-through would be visible as a pass rather than as an absence.
|
|
for (const [label, blank] of [['empty', ''], ['whitespace', ' ']]) {
|
|
if (
|
|
test(`pre-push fails closed when ECC_PYTEST_CMD is set to ${label}`, () => {
|
|
const { result, calls } = runHermeticPythonPrePush({
|
|
venvName: 'venv-blank',
|
|
pytestCmd: blank,
|
|
});
|
|
assert.notStrictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.match(result.stderr, /ECC_PYTEST_CMD is set but names no command/);
|
|
assert.deepStrictEqual(calls, [], JSON.stringify(calls));
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
}
|
|
|
|
if (
|
|
test('pre-push rejects a PATH pytest that does not identify itself as pytest', () => {
|
|
const { result, calls } = runHermeticPythonPrePush({
|
|
pathPytestVersionLine: 'true (GNU coreutils) 9.0',
|
|
});
|
|
assert.strictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.match(result.stdout, /no pytest found/);
|
|
assert.deepStrictEqual(calls, []);
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('pre-push accepts a PATH pytest that reports a pytest version', () => {
|
|
const { result, calls } = runHermeticPythonPrePush({ pathPytestVersionLine: 'pytest 8.0.0' });
|
|
assert.strictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.strictEqual(calls.length, 1, JSON.stringify(calls));
|
|
assert.match(calls[0], /\|-q$/);
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
|
|
if (
|
|
test('check-plugin-cache fails when the installed cache is missing manifest-referenced files', () => {
|
|
const homeDir = createTempDir('codex-plugin-cache-home-');
|
|
const codexDir = path.join(homeDir, '.codex');
|
|
|
|
try {
|
|
seedPluginCache(codexDir, cacheManifestWithLocalRefs);
|
|
const result = runNode(pluginCacheCheckScript, [], makeHermeticCodexEnv(homeDir, codexDir));
|
|
|
|
assert.strictEqual(result.status, 1, `${result.stdout}\n${result.stderr}`);
|
|
assert.match(result.stdout, /Plugin cache:/);
|
|
assert.match(result.stdout, /\[FAIL\] skills missing/);
|
|
assert.match(result.stdout, /\[FAIL\] mcpServers missing/);
|
|
assert.match(result.stdout, /codex plugin list only confirms marketplace registration/);
|
|
assert.match(result.stdout, /sync-ecc-to-codex\.sh/);
|
|
} finally {
|
|
cleanup(homeDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('check-plugin-cache rejects manifest references that escape the cache boundary', () => {
|
|
const homeDir = createTempDir('codex-plugin-cache-manifest-traversal-home-');
|
|
const codexDir = path.join(homeDir, '.codex');
|
|
|
|
try {
|
|
seedPluginCache(codexDir, {
|
|
name: 'ecc',
|
|
version: packageVersion,
|
|
skills: '../../../../../etc/passwd',
|
|
mcpServers: '../../.mcp.json',
|
|
});
|
|
const result = runNode(pluginCacheCheckScript, [], makeHermeticCodexEnv(homeDir, codexDir));
|
|
|
|
assert.strictEqual(result.status, 1, `${result.stdout}\n${result.stderr}`);
|
|
assert.match(result.stdout, /\[FAIL\] skills escapes cache boundary/);
|
|
assert.match(result.stdout, /\[FAIL\] mcpServers escapes cache boundary/);
|
|
assert.doesNotMatch(result.stdout, /etc\/passwd/);
|
|
} finally {
|
|
cleanup(homeDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('check-plugin-cache passes when cached manifest references resolve inside the cache', () => {
|
|
const homeDir = createTempDir('codex-plugin-cache-ok-home-');
|
|
const codexDir = path.join(homeDir, '.codex');
|
|
|
|
try {
|
|
const cacheDir = seedPluginCache(codexDir, cacheManifestWithLocalRefs, [
|
|
['.mcp.json', '{"mcpServers":{}}\n'],
|
|
['assets/ecc-icon.svg', '<svg />\n'],
|
|
['assets/hero.png', 'png\n'],
|
|
]);
|
|
fs.mkdirSync(path.join(cacheDir, 'skills'), { recursive: true });
|
|
|
|
const result = runNode(pluginCacheCheckScript, [], makeHermeticCodexEnv(homeDir, codexDir));
|
|
|
|
assert.strictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.match(result.stdout, /\[OK\] skills/);
|
|
assert.match(result.stdout, /\[OK\] mcpServers/);
|
|
assert.match(result.stdout, /All cached manifest references resolve/);
|
|
} finally {
|
|
cleanup(homeDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('check-plugin-cache reports a missing installed cache clearly', () => {
|
|
const homeDir = createTempDir('codex-plugin-cache-missing-home-');
|
|
const codexDir = path.join(homeDir, '.codex');
|
|
|
|
try {
|
|
const result = runNode(pluginCacheCheckScript, [], makeHermeticCodexEnv(homeDir, codexDir));
|
|
|
|
assert.strictEqual(result.status, 1, `${result.stdout}\n${result.stderr}`);
|
|
assert.match(result.stdout, /Cached plugin manifest missing/);
|
|
assert.match(result.stdout, /codex plugin marketplace add affaan-m\/ECC/);
|
|
} finally {
|
|
cleanup(homeDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('check-plugin-cache rejects traversal in cache path segments', () => {
|
|
const homeDir = createTempDir('codex-plugin-cache-traversal-home-');
|
|
const codexDir = path.join(homeDir, '.codex');
|
|
|
|
try {
|
|
const result = runNode(
|
|
pluginCacheCheckScript,
|
|
['--marketplace', '../outside'],
|
|
makeHermeticCodexEnv(homeDir, codexDir)
|
|
);
|
|
|
|
assert.strictEqual(result.status, 1, `${result.stdout}\n${result.stderr}`);
|
|
assert.match(result.stderr, /Invalid --marketplace/);
|
|
} finally {
|
|
cleanup(homeDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('check-plugin-cache names custom missing cache entries in diagnostics', () => {
|
|
const homeDir = createTempDir('codex-plugin-cache-custom-home-');
|
|
const codexDir = path.join(homeDir, '.codex');
|
|
|
|
try {
|
|
const result = runNode(
|
|
pluginCacheCheckScript,
|
|
['--marketplace', 'custom-market', '--plugin', 'custom-plugin', '--version', '1.2.3'],
|
|
makeHermeticCodexEnv(homeDir, codexDir)
|
|
);
|
|
|
|
assert.strictEqual(result.status, 1, `${result.stdout}\n${result.stderr}`);
|
|
assert.match(result.stdout, /No installed cache entries found for custom-market\/custom-plugin/);
|
|
assert.match(result.stdout, /Install the requested plugin into the Codex plugin cache/);
|
|
} finally {
|
|
cleanup(homeDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
// Windows NTFS does not allow double-quote characters in file paths,
|
|
// so the quoted-path shell-injection test is only meaningful on Unix.
|
|
if (os.platform() === 'win32') {
|
|
console.log(' - install-global-git-hooks.sh quoted paths (skipped on Windows)');
|
|
} else if (
|
|
test('install-global-git-hooks.sh handles quoted hook paths without shell injection', () => {
|
|
const homeDir = createTempDir('codex-hooks-home-');
|
|
const weirdHooksDir = path.join(homeDir, 'git-hooks "quoted"');
|
|
|
|
try {
|
|
const result = runBash(installScript, {
|
|
env: {
|
|
HOME: homeDir,
|
|
ECC_GLOBAL_HOOKS_DIR: weirdHooksDir,
|
|
},
|
|
});
|
|
|
|
assert.strictEqual(result.status, 0, result.stderr || result.stdout);
|
|
assert.ok(fs.existsSync(path.join(weirdHooksDir, 'pre-commit')));
|
|
assert.ok(fs.existsSync(path.join(weirdHooksDir, 'pre-push')));
|
|
} finally {
|
|
cleanup(homeDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('merge-codex-config reports usage, missing files, and TOML parse failures', () => {
|
|
const tempDir = createTempDir('codex-merge-errors-');
|
|
|
|
try {
|
|
const noArgs = runNode(mergeCodexConfigScript);
|
|
assert.strictEqual(noArgs.status, 1);
|
|
assert.match(noArgs.stderr, /Usage: merge-codex-config\.js/);
|
|
|
|
const missingPath = path.join(tempDir, 'missing-config.toml');
|
|
const missing = runNode(mergeCodexConfigScript, [missingPath]);
|
|
assert.strictEqual(missing.status, 1);
|
|
assert.match(missing.stderr, /Config file not found/);
|
|
|
|
const invalidPath = path.join(tempDir, 'invalid-config.toml');
|
|
fs.writeFileSync(invalidPath, 'approval_policy = [\n');
|
|
const invalid = runNode(mergeCodexConfigScript, [invalidPath]);
|
|
assert.strictEqual(invalid.status, 1);
|
|
assert.match(invalid.stderr, /Failed to parse TOML/);
|
|
} finally {
|
|
cleanup(tempDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('merge-codex-config dry-run reports additions without mutating the target', () => {
|
|
const tempDir = createTempDir('codex-merge-dry-run-');
|
|
const configPath = path.join(tempDir, 'config.toml');
|
|
const original = '';
|
|
|
|
try {
|
|
fs.writeFileSync(configPath, original);
|
|
const result = runNode(mergeCodexConfigScript, [configPath, '--dry-run']);
|
|
|
|
assert.strictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.match(result.stdout, /\[add-root\]/);
|
|
assert.match(result.stdout, /\[add-table\] \[features\]/);
|
|
assert.match(result.stdout, /Dry run/);
|
|
assert.strictEqual(fs.readFileSync(configPath, 'utf8'), original);
|
|
} finally {
|
|
cleanup(tempDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('merge-codex-config preserves user root choices while adding missing baseline tables', () => {
|
|
const tempDir = createTempDir('codex-merge-add-only-');
|
|
const configPath = path.join(tempDir, 'config.toml');
|
|
|
|
try {
|
|
fs.writeFileSync(configPath, 'approval_policy = "never"\n');
|
|
const result = runNode(mergeCodexConfigScript, [configPath]);
|
|
|
|
assert.strictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.match(result.stdout, /Done\. Baseline Codex settings merged\./);
|
|
|
|
const merged = fs.readFileSync(configPath, 'utf8');
|
|
const parsed = TOML.parse(merged);
|
|
assert.strictEqual(parsed.approval_policy, 'never');
|
|
assert.strictEqual(parsed.sandbox_mode, 'workspace-write');
|
|
assert.strictEqual(parsed.web_search, 'live');
|
|
assert.strictEqual(parsed.features.multi_agent, true);
|
|
assert.strictEqual(parsed.profiles.strict.approval_policy, 'on-request');
|
|
assert.strictEqual(parsed.profiles.yolo.approval_policy, 'never');
|
|
assert.strictEqual(parsed.agents.max_threads, 6);
|
|
assert.strictEqual(parsed.agents.explorer.config_file, 'agents/explorer.toml');
|
|
} finally {
|
|
cleanup(tempDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('merge-codex-config no-ops when the Codex baseline is already present', () => {
|
|
const tempDir = createTempDir('codex-merge-noop-');
|
|
const configPath = path.join(tempDir, 'config.toml');
|
|
const original = fs.readFileSync(path.join(repoRoot, '.codex', 'config.toml'), 'utf8');
|
|
|
|
try {
|
|
fs.writeFileSync(configPath, original);
|
|
const result = runNode(mergeCodexConfigScript, [configPath]);
|
|
|
|
assert.strictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.match(result.stdout, /All baseline Codex settings already present/);
|
|
assert.strictEqual(fs.readFileSync(configPath, 'utf8'), original);
|
|
} finally {
|
|
cleanup(tempDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('merge-codex-config warns when inline tables cannot be safely extended', () => {
|
|
const tempDir = createTempDir('codex-merge-inline-warn-');
|
|
const configPath = path.join(tempDir, 'config.toml');
|
|
const original = 'agents = { explorer = { description = "custom explorer" } }\n';
|
|
|
|
try {
|
|
fs.writeFileSync(configPath, original);
|
|
const result = runNode(mergeCodexConfigScript, [configPath, '--dry-run']);
|
|
|
|
assert.strictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.match(result.stderr, /WARNING: Skipping missing keys/);
|
|
assert.strictEqual(fs.readFileSync(configPath, 'utf8'), original);
|
|
} finally {
|
|
cleanup(tempDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('merge-mcp-config reports usage, missing files, and TOML parse failures', () => {
|
|
const tempDir = createTempDir('mcp-merge-errors-');
|
|
|
|
try {
|
|
const noArgs = runNode(mergeMcpConfigScript, [], deterministicPackageEnv);
|
|
assert.strictEqual(noArgs.status, 1);
|
|
assert.match(noArgs.stderr, /Usage: merge-mcp-config\.js/);
|
|
|
|
const missingPath = path.join(tempDir, 'missing-config.toml');
|
|
const missing = runNode(mergeMcpConfigScript, [missingPath], deterministicPackageEnv);
|
|
assert.strictEqual(missing.status, 1);
|
|
assert.match(missing.stderr, /Config file not found/);
|
|
|
|
const invalidPath = path.join(tempDir, 'invalid-config.toml');
|
|
fs.writeFileSync(invalidPath, '[mcp_servers.github\n');
|
|
const invalid = runNode(mergeMcpConfigScript, [invalidPath], deterministicPackageEnv);
|
|
assert.strictEqual(invalid.status, 1);
|
|
assert.match(invalid.stderr, /Failed to parse/);
|
|
} finally {
|
|
cleanup(tempDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('merge-mcp-config dry-run appends the current default set without mutating target', () => {
|
|
const tempDir = createTempDir('mcp-merge-dry-run-');
|
|
const configPath = path.join(tempDir, 'config.toml');
|
|
const original = '';
|
|
|
|
try {
|
|
fs.writeFileSync(configPath, original);
|
|
const result = runNode(mergeMcpConfigScript, [configPath, '--dry-run'], deterministicPackageEnv);
|
|
|
|
assert.strictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.match(result.stdout, /Package manager: npm \(exec: npx\)/);
|
|
assert.match(result.stdout, /\[add\] mcp_servers\.chrome-devtools/);
|
|
assert.match(result.stdout, /\[mcp_servers\.chrome-devtools\]/);
|
|
assert.match(result.stdout, /Dry run/);
|
|
// Retired defaults (June 2026 connector policy) must not be emitted.
|
|
assert.doesNotMatch(result.stdout, /mcp_servers\.(supabase|playwright|context7|exa|github|memory|sequential-thinking)\b/);
|
|
assert.doesNotMatch(result.stdout, /url = /);
|
|
assert.strictEqual(fs.readFileSync(configPath, 'utf8'), original);
|
|
} finally {
|
|
cleanup(tempDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('merge-mcp-config no-ops after all recommended servers are present', () => {
|
|
const tempDir = createTempDir('mcp-merge-noop-');
|
|
const configPath = path.join(tempDir, 'config.toml');
|
|
|
|
try {
|
|
fs.writeFileSync(configPath, '');
|
|
const first = runNode(mergeMcpConfigScript, [configPath], deterministicPackageEnv);
|
|
assert.strictEqual(first.status, 0, `${first.stdout}\n${first.stderr}`);
|
|
|
|
const merged = fs.readFileSync(configPath, 'utf8');
|
|
const parsed = TOML.parse(merged);
|
|
assert.strictEqual(parsed.mcp_servers['chrome-devtools'].command, 'npx');
|
|
assert.deepStrictEqual(parsed.mcp_servers['chrome-devtools'].args, ['chrome-devtools-mcp@latest']);
|
|
assert.strictEqual(parsed.mcp_servers['chrome-devtools'].startup_timeout_sec, 30);
|
|
// No retired server may be (re-)emitted — exa's url form broke Codex (#2224).
|
|
assert.strictEqual(parsed.mcp_servers.exa, undefined);
|
|
assert.strictEqual(parsed.mcp_servers.github, undefined);
|
|
assert.strictEqual(parsed.mcp_servers.supabase, undefined);
|
|
|
|
const second = runNode(mergeMcpConfigScript, [configPath], deterministicPackageEnv);
|
|
assert.strictEqual(second.status, 0, `${second.stdout}\n${second.stderr}`);
|
|
assert.match(second.stdout, /\[ok\] mcp_servers\.chrome-devtools/);
|
|
assert.match(second.stdout, /All ECC MCP servers already present/);
|
|
assert.strictEqual(fs.readFileSync(configPath, 'utf8'), merged);
|
|
} finally {
|
|
cleanup(tempDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('merge-mcp-config repairs the invalid exa url entry from earlier ECC versions (#2224)', () => {
|
|
const tempDir = createTempDir('mcp-merge-exa-repair-');
|
|
const configPath = path.join(tempDir, 'config.toml');
|
|
const original = [
|
|
'[mcp_servers.github]',
|
|
'command = "npx"',
|
|
'args = ["-y", "@modelcontextprotocol/server-github"]',
|
|
'',
|
|
'[mcp_servers.exa]',
|
|
'url = "https://mcp.exa.ai/mcp"',
|
|
'',
|
|
].join('\n');
|
|
|
|
try {
|
|
fs.writeFileSync(configPath, original);
|
|
const result = runNode(mergeMcpConfigScript, [configPath], deterministicPackageEnv);
|
|
|
|
assert.strictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.match(result.stdout, /\[repair\] mcp_servers\.exa/);
|
|
|
|
const updated = fs.readFileSync(configPath, 'utf8');
|
|
const parsed = TOML.parse(updated);
|
|
assert.strictEqual(parsed.mcp_servers.exa, undefined, 'invalid exa url entry must be removed');
|
|
assert.doesNotMatch(updated, /url = "https:\/\/mcp\.exa\.ai\/mcp"/);
|
|
// User-managed servers are untouched; current default is added.
|
|
assert.strictEqual(parsed.mcp_servers.github.command, 'npx');
|
|
assert.strictEqual(parsed.mcp_servers['chrome-devtools'].command, 'npx');
|
|
|
|
// Re-running must not re-introduce the invalid entry.
|
|
const second = runNode(mergeMcpConfigScript, [configPath], deterministicPackageEnv);
|
|
assert.strictEqual(second.status, 0, `${second.stdout}\n${second.stderr}`);
|
|
assert.doesNotMatch(fs.readFileSync(configPath, 'utf8'), /mcp_servers\.exa/);
|
|
} finally {
|
|
cleanup(tempDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('merge-mcp-config leaves a user-managed stdio exa entry untouched', () => {
|
|
const tempDir = createTempDir('mcp-merge-exa-stdio-');
|
|
const configPath = path.join(tempDir, 'config.toml');
|
|
const original = [
|
|
'[mcp_servers.exa]',
|
|
'command = "npx"',
|
|
'args = ["-y", "mcp-remote", "https://mcp.exa.ai/mcp"]',
|
|
'startup_timeout_sec = 30',
|
|
'',
|
|
].join('\n');
|
|
|
|
try {
|
|
fs.writeFileSync(configPath, original);
|
|
const result = runNode(mergeMcpConfigScript, [configPath], deterministicPackageEnv);
|
|
|
|
assert.strictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.doesNotMatch(result.stdout, /\[repair\]/);
|
|
|
|
const parsed = TOML.parse(fs.readFileSync(configPath, 'utf8'));
|
|
assert.strictEqual(parsed.mcp_servers.exa.command, 'npx');
|
|
assert.deepStrictEqual(parsed.mcp_servers.exa.args, ['-y', 'mcp-remote', 'https://mcp.exa.ai/mcp']);
|
|
} finally {
|
|
cleanup(tempDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('merge-mcp-config update dry-run refreshes managed sections and leaves user servers alone', () => {
|
|
const tempDir = createTempDir('mcp-merge-update-dry-run-');
|
|
const configPath = path.join(tempDir, 'config.toml');
|
|
const original = [
|
|
'[mcp_servers.chrome-devtools]',
|
|
'command = "custom"',
|
|
'args = ["old"]',
|
|
'',
|
|
'[mcp_servers.context7]',
|
|
'command = "npx"',
|
|
'args = ["-y", "@upstash/context7-mcp@latest"]',
|
|
'',
|
|
].join('\n');
|
|
|
|
try {
|
|
fs.writeFileSync(configPath, original);
|
|
const result = runNode(mergeMcpConfigScript, [configPath, '--update-mcp', '--dry-run'], deterministicPackageEnv);
|
|
|
|
assert.strictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.match(result.stdout, /\[remove\] mcp_servers\.chrome-devtools/);
|
|
assert.match(result.stdout, /\[mcp_servers\.chrome-devtools\]/);
|
|
// Retired servers are no longer ECC-managed: never removed or re-added.
|
|
assert.doesNotMatch(result.stdout, /\[remove\] mcp_servers\.context7/);
|
|
assert.strictEqual(fs.readFileSync(configPath, 'utf8'), original);
|
|
} finally {
|
|
cleanup(tempDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('merge-mcp-config removes disabled servers without appending replacements', () => {
|
|
const tempDir = createTempDir('mcp-merge-disabled-');
|
|
const configPath = path.join(tempDir, 'config.toml');
|
|
const original = [
|
|
'[mcp_servers.chrome-devtools]',
|
|
'command = "npx"',
|
|
'args = ["chrome-devtools-mcp@latest"]',
|
|
'',
|
|
].join('\n');
|
|
|
|
try {
|
|
fs.writeFileSync(configPath, original);
|
|
const result = runNode(mergeMcpConfigScript, [configPath], {
|
|
...deterministicPackageEnv,
|
|
ECC_DISABLED_MCPS: 'chrome-devtools',
|
|
});
|
|
|
|
assert.strictEqual(result.status, 0, `${result.stdout}\n${result.stderr}`);
|
|
assert.match(result.stdout, /Disabled via ECC_DISABLED_MCPS/);
|
|
assert.match(result.stdout, /\[skip\] mcp_servers\.chrome-devtools \(disabled\)/);
|
|
assert.match(result.stdout, /\[update\] mcp_servers\.chrome-devtools \(disabled\)/);
|
|
assert.match(result.stdout, /Done\. Removed 1 server section\(s\)\./);
|
|
|
|
const updated = fs.readFileSync(configPath, 'utf8');
|
|
assert.doesNotMatch(updated, /chrome-devtools/);
|
|
} finally {
|
|
cleanup(tempDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('sync installs the missing Codex baseline and accepts the legacy context7 MCP section', () => {
|
|
const homeDir = createTempDir('codex-sync-home-');
|
|
const codexDir = path.join(homeDir, '.codex');
|
|
const configPath = path.join(codexDir, 'config.toml');
|
|
const agentsPath = path.join(codexDir, 'AGENTS.md');
|
|
const config = [
|
|
'persistent_instructions = ""',
|
|
'',
|
|
'[agents]',
|
|
'explorer = { description = "Read-only codebase explorer for gathering evidence before changes are proposed." }',
|
|
'',
|
|
'[mcp_servers.context7]',
|
|
'command = "npx"',
|
|
'args = ["-y", "@upstash/context7-mcp"]',
|
|
'',
|
|
'[mcp_servers.github]',
|
|
'command = "npx"',
|
|
'args = ["-y", "@modelcontextprotocol/server-github"]',
|
|
'',
|
|
'[mcp_servers.memory]',
|
|
'command = "npx"',
|
|
'args = ["-y", "@modelcontextprotocol/server-memory"]',
|
|
'',
|
|
'[mcp_servers.sequential-thinking]',
|
|
'command = "npx"',
|
|
'args = ["-y", "@modelcontextprotocol/server-sequential-thinking"]',
|
|
'',
|
|
].join('\n');
|
|
|
|
try {
|
|
fs.mkdirSync(codexDir, { recursive: true });
|
|
fs.writeFileSync(configPath, config);
|
|
|
|
const syncResult = runBash(syncScript, {
|
|
args: ['--update-mcp'],
|
|
env: makeHermeticCodexEnv(homeDir, codexDir),
|
|
});
|
|
assert.strictEqual(syncResult.status, 0, `${syncResult.stdout}\n${syncResult.stderr}`);
|
|
|
|
const syncedAgents = fs.readFileSync(agentsPath, 'utf8');
|
|
assert.match(syncedAgents, /^# Everything Claude Code \(ECC\) — Agent Instructions/m);
|
|
assert.match(syncedAgents, /^# Codex Supplement \(From ECC \.codex\/AGENTS\.md\)/m);
|
|
|
|
const syncedConfig = fs.readFileSync(configPath, 'utf8');
|
|
const parsedConfig = TOML.parse(syncedConfig);
|
|
assert.strictEqual(parsedConfig.approval_policy, 'on-request');
|
|
assert.strictEqual(parsedConfig.sandbox_mode, 'workspace-write');
|
|
assert.strictEqual(parsedConfig.web_search, 'live');
|
|
assert.ok(!Object.prototype.hasOwnProperty.call(parsedConfig, 'multi_agent'));
|
|
assert.ok(parsedConfig.features);
|
|
assert.strictEqual(parsedConfig.features.multi_agent, true);
|
|
assert.ok(parsedConfig.profiles);
|
|
assert.strictEqual(parsedConfig.profiles.strict.approval_policy, 'on-request');
|
|
assert.strictEqual(parsedConfig.profiles.yolo.approval_policy, 'never');
|
|
assert.ok(parsedConfig.agents);
|
|
assert.strictEqual(parsedConfig.agents.max_threads, 6);
|
|
assert.strictEqual(parsedConfig.agents.max_depth, 1);
|
|
assert.strictEqual(parsedConfig.agents.explorer.config_file, 'agents/explorer.toml');
|
|
assert.strictEqual(parsedConfig.agents.reviewer.config_file, 'agents/reviewer.toml');
|
|
assert.strictEqual(parsedConfig.agents.docs_researcher.config_file, 'agents/docs-researcher.toml');
|
|
// Current default connector is added; retired servers are not emitted,
|
|
// and pre-existing user-managed entries are preserved untouched.
|
|
assert.ok(parsedConfig.mcp_servers['chrome-devtools']);
|
|
assert.strictEqual(parsedConfig.mcp_servers.exa, undefined);
|
|
assert.ok(parsedConfig.mcp_servers.github);
|
|
assert.ok(parsedConfig.mcp_servers.memory);
|
|
assert.ok(parsedConfig.mcp_servers['sequential-thinking']);
|
|
assert.ok(parsedConfig.mcp_servers.context7);
|
|
|
|
for (const roleFile of ['explorer.toml', 'reviewer.toml', 'docs-researcher.toml']) {
|
|
assert.ok(fs.existsSync(path.join(codexDir, 'agents', roleFile)));
|
|
}
|
|
} finally {
|
|
cleanup(homeDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
if (
|
|
test('sync adds parent-table keys when the target only declares an implicit parent table', () => {
|
|
const homeDir = createTempDir('codex-sync-implicit-parent-home-');
|
|
const codexDir = path.join(homeDir, '.codex');
|
|
const configPath = path.join(codexDir, 'config.toml');
|
|
const config = [
|
|
'persistent_instructions = ""',
|
|
'',
|
|
'[agents.explorer]',
|
|
'description = "Read-only codebase explorer for gathering evidence before changes are proposed."',
|
|
'',
|
|
].join('\n');
|
|
|
|
try {
|
|
fs.mkdirSync(codexDir, { recursive: true });
|
|
fs.writeFileSync(configPath, config);
|
|
|
|
const syncResult = runBash(syncScript, {
|
|
env: makeHermeticCodexEnv(homeDir, codexDir),
|
|
});
|
|
assert.strictEqual(syncResult.status, 0, `${syncResult.stdout}\n${syncResult.stderr}`);
|
|
|
|
const parsedConfig = TOML.parse(fs.readFileSync(configPath, 'utf8'));
|
|
assert.strictEqual(parsedConfig.agents.max_threads, 6);
|
|
assert.strictEqual(parsedConfig.agents.max_depth, 1);
|
|
assert.strictEqual(parsedConfig.agents.explorer.config_file, 'agents/explorer.toml');
|
|
} finally {
|
|
cleanup(homeDir);
|
|
}
|
|
})
|
|
)
|
|
passed++;
|
|
else failed++;
|
|
|
|
console.log(`\nPassed: ${passed}`);
|
|
console.log(`Failed: ${failed}`);
|
|
process.exit(failed > 0 ? 1 : 0);
|