mirror of
https://github.com/garrytan/gstack.git
synced 2026-06-27 12:10:00 +02:00
9fd03fae9e
* fix(gbrain): stop forcing GBRAIN_PREPARE on transaction-mode poolers (#1965) buildGbrainEnv auto-set GBRAIN_PREPARE=true whenever DATABASE_URL targeted port 6543, and the /sync-gbrain capability check exported it for the rest of the skill run. Both had the semantics inverted: gbrain auto-disables prepared statements on transaction-mode poolers because they break every write there ("prepared statement does not exist"); GBRAIN_PREPARE=true is gbrain's documented override for SESSION-mode poolers on 6543, not a requirement for transaction mode. The #1435 search symptom the auto-set worked around was fixed gbrain-side. Remove both force-sets. A caller-set GBRAIN_PREPARE (either value) still passes through untouched, preserving the session-mode-on-6543 escape hatch. isTransactionModePooler stays exported. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(gbrain): classify probe timeout as its own status; sync proceeds instead of skipping (#1964) The 5s engine probe misclassified healthy-but-slow engines (cold Supabase pooler connections measured at 6.9-10.7s) as broken-config, so /sync-gbrain silently skipped code+memory and told the user their config was malformed. - New "timeout" status: probe killed at the deadline with no recognized stderr pattern. Default deadline is now 15s, overridable via GSTACK_GBRAIN_PROBE_TIMEOUT_MS (tests set 300ms against a fake that sleeps 2s). - Sync stages PROCEED on timeout with a stderr warning naming the env knob; a genuinely-dead engine surfaces its real error at the first operation instead of a false config diagnosis. - Consistency everywhere "ok" gated behavior: gstack-gbrain-detect --is-ok exits 0 on timeout, and gen-skill-docs' detection gate accepts it, so a slow engine no longer silently suppresses brain-aware features. - Status cache: key now includes the effective probe timeout (raising it invalidates a cached timeout) and GBRAIN_HOME; config detection honors GBRAIN_HOME so relocated-home users stop being misclassified as missing-config. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(bins): cygpath-normalize SCRIPT_DIR for bun imports; surface learnings-log errors (#1950) Under Windows git-bash, pwd yields a POSIX path (/c/Users/...) that Bun on Windows cannot resolve as an ES module specifier. gstack-learnings-log interpolates SCRIPT_DIR into a bun -e import, so every invocation died with "Cannot find module" — and 2>/dev/null swallowed the error, silently dropping every AI-logged learning for Windows users. - 3-line cygpath -m guard in gstack-learnings-log and gstack-question-log (which gains the same import shape in the next commit). Matches the duplicated IS_WINDOWS convention in setup; no shared shell lib exists. - learnings-log adopts question-log's set +e / TMPERR capture pattern wholesale: validation errors now print to stderr. The old `if [ $? -ne 0 ]` check was dead code under set -euo pipefail — the script exited at the failing assignment before reaching it. - New test/bin-windows-bun-import-paths.test.ts: static invariant (any bash bin interpolating $SCRIPT_DIR into a bun -e import must carry the guard) + behavioral end-to-end run invoked via `bash <bin>` — added to the windows-free-tests workflow list so the conversion is proven on the only platform where the bug exists. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(question-log): dedupe INJECTION_PATTERNS via lib/jsonl-store (#1934) bin/gstack-question-log carried a local copy of the injection-pattern list, so pattern fixes to lib/jsonl-store.ts never propagated — including the /override[:\s]/i false-positive fix arriving via community PR #1940. Import the shared hasInjection instead (enabled by the previous commit's cygpath guard). question-log also gets the lib's stricter superset (human:, disregard, from-now-on, approve-all patterns). Tests pin the contract in a #1940-order-independent way: an "Override: ignore all previous instructions" header is rejected, "prose overrides the deterministic table" is accepted, and a static invariant keeps local INJECTION_PATTERNS duplicates out of the bin. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(security): community-pulse + both dashboards never report fake zeros (#1947) The security-signaling surface failed open at three layers — every failure mode read as a reassuring "0 attacks" / "0 installs": - community-pulse edge function: supabase-js returns {data,error} without throwing, and all five queries discarded `error` — a DB outage produced real-looking zeros via the SUCCESS path, and the catch (also returning zeros with HTTP 200) was unreachable for query failures. Every query now destructures and throws; the catch serves the stale cache (marked "stale": true) when one exists, else 503 {"error":"pulse_unavailable"}. Success responses carry "status":"ok" so clients can distinguish authoritative data from legacy backends. NOTE: the edge function deploys out-of-band (supabase functions deploy community-pulse). - gstack-security-dashboard: captures the HTTP status; non-200 / network failure / error body / missing section → "unknown — backend error"; jq missing → "unknown — install jq" (the lossy grep fallback broke on nested arrays and under-reported attacks as zero — removed); a 200 without the new marker shows figures with an "unverified (legacy backend)" note. Also fixes a latent display bug: the TOTAL grep matched the digit 7 inside "attacks_last_7_days" and misreported every count. - gstack-community-dashboard: same class — curl || echo "{}" plus grep || echo "0" printed "Weekly active installs: 0" on any failure. Now "unknown — backend error (HTTP N)". test/security-dashboard-fallback.test.ts pins the matrix (200+marker, 200-legacy, 503, network failure) x (jq present, jq absent) for both bins: "unknown" states never render as 0. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(telemetry): redact error_message spans before they leave the machine (#1947) error_message was uploaded with only quote/newline escaping — stack traces and failed-API errors can embed credentials, private paths, and hostnames, and the sync path strips only _repo_slug/_branch. New lib/redact-engine.ts export redactFindingSpans(): replaces EVERY finding's span with <REDACTED-{id}> regardless of tier (applyRedactions is the interactive PII-only path and exits nonzero on credential findings, so it can't serve machine egress). Returns null when a span can't be located — callers drop the whole payload rather than risk a leak. gstack-telemetry-log pipes error_message through it at LOG time, so the local JSONL at rest is clean too; surrounding text survives for crash triage. FAIL CLOSED: bun missing, engine error, or non-JSON-string output all null the field. Tests pin: embedded ghp_ token → <REDACTED-github.pat> with context intact; redactor unavailable → null; raw bytes on disk never contain the token. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(redact): prepush guard fails closed on git failure; /ship owns hook install (#1946) Two gaps closed: 1. Fail closed. The git() helper returned "" on ANY non-zero exit or maxBuffer overflow (status null), addedLinesFor produced an empty string, and the push sailed through unscanned — fail-open on exactly the oversized-diff case where a large secret-bearing blob is most likely. The diff call now uses a strict variant that throws; main blocks with a clear message naming the GSTACK_REDACT_PREPUSH=skip escape valve. Probe calls (symbolic-ref, rev-parse, merge-base) keep the permissive helper — their failures are normal control flow. 2. Install path. The hook was installed by nothing ("opt-in, installed by nothing" was the issue's words). ./setup runs in the gstack checkout — the wrong repo for a per-project hook — so it gets a one-line hint only. /ship owns per-repo install: config redact_prepush_hook=true + hook missing → silent install (consent already given); config unset + no ~/.gstack/.redact-prepush-prompted marker → one-time machine-wide AskUserQuestion offer, answer persisted. ship/SKILL.md regenerated in this same commit (check-freshness bisect discipline). Tests: unscannable diff (bogus SHAs) → exit 1 + valve named; empty-but- successful diff → exit 0; static asserts pin setup as hint-only and the ship template as the installer surface. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(redact): six new credential patterns — GitLab, HuggingFace, npm, DigitalOcean, Bearer, GCP SA (#1946) Coverage gaps from the #1946 security review, including token types for tooling gstack itself drives (glab): HIGH (block): gitlab.token (glpat-/glptt-/gldt-), huggingface.token (hf_), npm.token (npm_), digitalocean.token (dop_v1_), gcp.service_account (the JSON-escaped "private_key" form that dodges pem.private_key's literal-block match when minified, confirmed by "private_key_id" proximity). MEDIUM (warn): auth.bearer — the most FP-prone shape in the set (docs are full of "Authorization: Bearer <token>"), so it requires header-context proximity and the same entropy>=3.0 + placeholder validator recipe as env.kv. "Bearer YOUR_TOKEN_HERE" never fires; calibration over coverage, per the cries-wolf principle. All shapes are linear-time; test/redact-pattern-lint.test.ts covers them automatically. Engine tests add positive + placeholder-negative cases per pattern. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: coverage-audit additions for the fix wave Ship Step 7 gap-fill (all passing, 248 tests across the touched suites): memory + dream stage probe-timeout proceeds, gbrain-detect override paths, stale-flag passthrough, 200-body-missing-.security fail-closed case, telemetry redaction edges, and credential-pattern edge cases. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: pre-landing review fixes Review army findings (1 critical, auto-fixed with regression tests): - CRITICAL (security specialist, verified live): redactFindingSpans spliced only the regex capture span, and pem.private_key / gcp.service_account capture just the BEGIN-header — the key body survived "redaction" and shipped via telemetry. Marker-only patterns now drop the whole payload (null, fail closed). Overlapping spans (Bearer+JWT on the same bytes) are coalesced before splicing so stale offsets can't leave partial secret bytes behind. - gitStrict: drop the dead `|| r.status === null` disjunct (null !== 0 already covers it); add the signal-kill/null-status regression test the docstring promised. - security-dashboard human mode flags stale snapshots ("figures may be out of date") instead of presenting frozen counts as current. - community-dashboard marker check uses jq when available — the grep-only variant misclassified whitespaced/reserialized bodies as legacy. - telemetry fail-closed test now shadows bun with a failing stub (deterministic on any host layout); stale "five status cases" describe title renamed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: adversarial review fixes (Claude + Codex cross-model passes) Both adversarial passes ran against the wave; every FIXABLE finding landed with a regression test: - probeTimeoutMs clamps to >=1ms: a fractional override floored to 0, and execFileSync treats timeout:0 as NO timeout — the probe that exists to bound hangs could hang forever (found by both models independently). - /ship silent hook install now requires the hooks dir to live inside .git: with core.hooksPath (husky's COMMITTED .husky/), the chaining installer would have renamed the team's committed pre-push and written a machine-local wrapper into the working tree (found by both models). - gstack-config gbrain-refresh accepts the "timeout" status — the last consumer still gating on literal "ok" (Codex); gstack-gbrain-detect's config-derived fields honor GBRAIN_HOME so the detection JSON can't report status ok alongside config_exists false (Codex). - prepush: a remote sha absent locally (shallow clone / stale fetch) falls back to the merge-base/empty-tree range — scans MORE, never blocks a legitimate push into training users toward --no-verify. - dashboards: curl's own 000 no longer doubles to "HTTP 000000"; the community dashboard flags stale snapshots like the security one; array sections parse via jq (the sed/grep loops truncated at the first ']'); the no-jq marker grep tolerates whitespace. - telemetry: multi-line redactor output nulls the field instead of corrupting the JSONL record; setup's hint fires only when the config key is genuinely unset (an explicit false is a recorded decline); the /ship prompt marker honors GSTACK_HOME. Kept as designed (cross-model tension noted): Bearer stays MEDIUM in the prepush gate — a HIGH Bearer would block every docs example; the entropy validator can't eliminate that FP class, and MEDIUM warns visibly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore: bump version and changelog (v1.57.11.0) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: P1 TODO — eval harness live progress + incremental persistence Root-caused during this ship: a killed eval run was indistinguishable from a healthy one for hours (per-file output buffering across mega test files, no incremental eval-store writes, no honest liveness signal). Full context and starting points in the entry. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: fix operational-learning E2E fixture — copy lib/jsonl-store.ts Pre-existing breakage, proven on main: gstack-learnings-log has imported lib/jsonl-store.ts (shared injection patterns) since v1.57.5.0 / #1910, but the fixture copies only the bin scripts — the bin exits 1 before writing anything, on main silently (stderr swallowed) and on this branch loudly (the #1950 error-surfacing made the four-day-old failure visible). A real install always ships bin/ and lib/ together; the fixture now does too. Verified: the fixture-shaped invocation writes the learning (exit 0) with lib present, exits 1 on both main and this branch without it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ios-qa): isolate E2E tests under --concurrent (3 real races) The ios-qa E2E file failed intermittently under `bun test --concurrent` (the eval harness default). Three distinct shared-state races, all fixed: 1. Shared pidfile: a module-level `workDir` reassigned in beforeEach was clobbered by parallel tests, so concurrent daemons collided on the same pidfile and the loser returned `already_running`. Each test now gets its own dir via makeWorkDir(). 2. process.env path globals: tests set GSTACK_IOS_AUDIT_PATH / _ATTEMPTS_PATH / _ALLOWLIST_PATH on the shared process env; concurrent tests stomped each other's audit/attempts destinations. Threaded auditPath/attemptsPath/allowlistPath through DaemonOptions (and mintForCaller) as explicit args — env is no longer load-bearing. 3. afterEach cleanup race: the per-test cleanup drained a shared dir array, so the first test to finish deleted still-running tests' workDirs mid-assertion. Moved to afterAll (cleans once, after all settle). Verified: 5/5 clean full-suite runs at --max-concurrency 15 (was intermittent); daemon unit suite 91/91; daemon source compiles. The paths default to the env-derived locations when options are omitted, so the production CLI path is unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(pty): pin spawned claude to EVALS model chain (default claude-sonnet-4-6) launchClaudePty spawned the interactive `claude` TUI with no --model flag, so the child inherited the operator's ~/.claude/settings.json model. On a slow-thinking model that meant 5+ min of extended thinking on empty plan-mode context, timing out the plan-mode smoke tests regardless of contention. Pin the model via opts.model ?? EVALS_MODEL ?? 'claude-sonnet-4-6' — byte-identical to session-runner.ts:144, so PTY and `claude -p` evals always agree. Pushed before extraArgs (last flag wins, so a per-test --model still overrides). Placement leaves the spawn region byte-stable for a clean merge with the in-flight hermetic-env branch. Plumbed model through the three plan-skill wrappers. Static-grep tripwires guard the pin, its fallback chain, the before-extraArgs ordering, and all three wrapper forwards. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(pty): detect markdown bold-bullet prose AUQs (fixes office-hours smoke) office-hours auto-mode renders its mode question as `- **Building a startup**` markdown bullets (office-hours/SKILL.md.tmpl:102) with no letter/number marker. isProseAUQVisible only matched `A)`-style lettered or `1.`-style numbered options, so the question went undetected: the model surfaced it at ~2m19s (well under the 300s budget) but the harness kept scoring the run "working" off the spinner glyphs and timed out — a false timeout on a question that was already on screen. Add Pattern 3: when an interrogative line ('?') is present AND 3+ bold-bullet markers (`- **`) appear in the 4KB tail, classify as a prose AUQ. Bold is the discriminator vs incidental prose bullets; the line anchor is dropped (stripAnsi can collapse option lines) and the existing `❯ 1.` cursor gate still defers to a live native list. Wires through the existing classifyVisible 'asked' path and the timeout high-water-mark, so office-hours now classifies 'asked' instead of 'timeout'. Five unit cases: the office-hours render passes; no-'?', <3-bullet, plain-bullet, and native-cursor cases stay false. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(pty): detect stripAnsi-collapsed prose AUQs + judge spinner-precedence The plan-eng/plan-design plan-mode + finding-floor smokes timed out even when the skill HAD rendered a complete prose AskUserQuestion and was waiting: the PTY strips cursor-positioning escapes, collapsing the option newlines/spaces so "A) ..." arrives as "A(recommended)" / "-B:" and "Reply with A, B, or C" as "ReplywithA,B,orC". Every line-anchored detector (Patterns 1-3) returns false on those bytes, so proseAUQEverObserved never latched and the run timed out on a question that was already on screen. Add Pattern 4/5: a two-signal collapsed-form detector — a reply/recommendation marker (space-insensitive "reply with [A-D]", "Recommendation:", or "(recommended)") AND 2+ distinct A-D letters each punctuated by ) : or (. The conjunction is what separates a real AUQ from incidental report prose; verified true on the verbatim failing-run buffers where Patterns 1-3 return false. Also fix the Haiku judge spinner bias: of 614 verdicts, 569 were 'working' and 95 of those noted a question was visible — Claude Code keeps the spinner animating at an idle prose decision, so the judge coin-flipped. Add a precedence override: when an option list AND a Recommendation/Reply instruction are both visible, classify WAITING even with spinner glyphs. Kept the strict dual-signal gate (never option-list-alone) so auto-decide-preserved doesn't flip. 5 unit tests pin the two-signal contract (2 true on real collapsed bytes, 3 false guards). 90 -> 95 pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(plan-review): ask-first scope gate for plan-eng + plan-design review On an empty/cold invocation, plan-eng-review and plan-design-review would dive straight into repo exploration (plan-eng) or a 7-pass mockup+audit (plan-design) and only ask the user much later, if at all. plan-ceo-review already asks first via an unconditional Step-0 gate and behaves well; these two did not. Add a hard-STOP scope gate as the FIRST operational instruction in each skill (above the design-doc check / pre-review audit / mockup defaults it explicitly overrides): the first tool call must be AskUserQuestion confirming the review target, before any git/Read/Grep/Glob/Bash or mockup generation. Under --disallowedTools the options render as plain column-0 lettered prose with a Recommendation + "Reply with A, B, or C" line so the answer is detectable. This is correct cold-start UX (confirm what to review before grinding a full review on nothing) and it is the product half of the plan-mode smoke fix; the harness collapsed-form detector is the deterministic half that catches the ask however it renders. Templates + regenerated SKILL.md (default variant). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(tiers): reclassify stochastic plan-eng/plan-design ask-first smokes as periodic plan-eng-review and plan-design-review run a long explore/audit before their first AskUserQuestion, so whether the plan-mode + finding-floor smokes reach a terminal outcome within the 300s/600s budget depends on stochastic ask-first compliance (measured ~50-67%/run even with the hardened gate). Per the "non-deterministic -> periodic" tiering rule, move the four affected smokes (plan-eng/plan-design review-plan-mode + finding-floor) to periodic. The deterministic harness fix (collapsed-form detector + judge precedence) and the ask-first gate lift these from always-failing to mostly-passing and are the real product+harness improvements; periodic monitoring tracks the rate weekly without blocking PRs on an LLM coin-flip. plan-ceo/plan-devex ask-first reliably and stay gate-tier. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci(evals): gate the deterministic PTY plan-mode smokes in CI The real-PTY plan-mode smokes never ran in CI — the gate was local-only. Add an e2e-pty-plan-smoke matrix suite running the two deterministically-reliable ones (office-hours-auto-mode, plan-mode-no-op) so a regression there blocks PRs. The stochastic plan-eng/plan-design ask-first smokes stay periodic (touchfiles E2E_TIERS) and are not CI-gated. A fresh CI container has no ~/.claude.json, so the spawned interactive `claude` would wedge on the onboarding + API-key-approval dialog. Add a scoped seed step (hasCompletedOnboarding + key approval, its own ANTHROPIC_API_KEY env) before the run — mirrors what the hermetic E2E child env seeds. Per-suite timeout override (35 min) via matrix.suite.timeout so the PTY suite has headroom for --retry 2 without bumping the other 12 suites. Report runner count 12 -> 13. Validate via workflow_dispatch before relying on the gate (PTY-in-CI is new). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci(evals): install gstack skill registry for the PTY smoke suite The first dry-run of e2e-pty-plan-smoke failed: the spawned interactive `claude` printed "Unknown command: /plan-ceo-review". .claude/skills is gitignored, so a fresh CI checkout has no gstack skill registry and the TUI can't resolve /office-hours or /plan-ceo-review. Add a Register step (scoped to the suite, after Seed, before Run) that mirrors setup's --no-prefix user-scoped registry minimally: $HOME/.claude/skills/gstack -> repo (resolves the preambles' absolute ~/.claude/skills/gstack/bin/* and <skill>/sections/* paths) + per-skill SKILL.md/sections symlinks for the two skills these tests invoke. HOME is /github/home in this container and the runner adds no HOME/CLAUDE_CONFIG_DIR override (no hermetic mode), so $HOME is the right anchor — the Seed step already proved claude reads it. No ./setup (binary build + Chromium + fonts + /dev/tty prompt); SKILL.md + bin/ + sections/ are committed. Self-validating: fails the step loudly on a dangling symlink or missing `name:` frontmatter, so a moved target surfaces here instead of as a silent 35-min "Unknown command" timeout. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: bump version and changelog (v1.58.4.0) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
435 lines
15 KiB
TypeScript
435 lines
15 KiB
TypeScript
/**
|
|
* Unit tests for lib/gbrain-local-status.ts.
|
|
*
|
|
* Per the eng-review D6 (gate-tier = mocked, codex #9): no real gbrain CLI, no
|
|
* real PGLite, no real Postgres. Each case builds a fake `gbrain` shell script
|
|
* on PATH that emits canned exit codes + stderr matching the patterns the
|
|
* classifier looks for.
|
|
*
|
|
* Six status cases:
|
|
* 1. no-cli — gbrain absent from PATH
|
|
* 2. missing-config — gbrain present, config.json absent (honors GBRAIN_HOME)
|
|
* 3. broken-config — gbrain present, config exists, stderr contains "config.json"
|
|
* 4. broken-db — gbrain present, config exists, stderr contains "Cannot connect to database"
|
|
* 5. timeout — probe exceeds GSTACK_GBRAIN_PROBE_TIMEOUT_MS with no recognized error (#1964)
|
|
* 6. ok — gbrain present, config exists, sources list returns valid JSON
|
|
*
|
|
* Plus cache behavior: hit, TTL expiry, invariant invalidation (HOME change,
|
|
* probe-timeout change), --no-cache bypass. Timeout tests keep runtime sane by
|
|
* setting GSTACK_GBRAIN_PROBE_TIMEOUT_MS=300 against a fake gbrain that sleeps 2s.
|
|
*/
|
|
|
|
import { describe, it, expect, beforeEach, afterEach } from "bun:test";
|
|
import {
|
|
mkdtempSync,
|
|
writeFileSync,
|
|
readFileSync,
|
|
mkdirSync,
|
|
rmSync,
|
|
chmodSync,
|
|
existsSync,
|
|
utimesSync,
|
|
} from "fs";
|
|
import { tmpdir } from "os";
|
|
import { join } from "path";
|
|
|
|
import { spawnSync } from "child_process";
|
|
|
|
import {
|
|
localEngineStatus,
|
|
cacheFilePath,
|
|
probeTimeoutMs,
|
|
CACHE_TTL_MS,
|
|
DEFAULT_PROBE_TIMEOUT_MS,
|
|
type LocalEngineStatus,
|
|
} from "../lib/gbrain-local-status";
|
|
|
|
interface FakeEnv {
|
|
tmp: string;
|
|
bindir: string;
|
|
home: string;
|
|
gstackHome: string;
|
|
configPath: string;
|
|
cleanup: () => void;
|
|
}
|
|
|
|
/**
|
|
* Build a tmp HOME + GSTACK_HOME + optional fake `gbrain` on PATH.
|
|
*
|
|
* The classifier reads HOME via os.homedir() which reads process.env.HOME, so
|
|
* we mutate process.env ambiently in each test (restored in afterEach).
|
|
*/
|
|
function makeEnv(opts: {
|
|
withGbrain?: boolean;
|
|
gbrainBehavior?: "ok" | "broken-db" | "broken-config" | "throws" | "slow";
|
|
withConfig?: boolean;
|
|
}): FakeEnv {
|
|
const tmp = mkdtempSync(join(tmpdir(), "gbrain-local-status-test-"));
|
|
const bindir = join(tmp, "bin");
|
|
const home = join(tmp, "home");
|
|
const gstackHome = join(home, ".gstack");
|
|
const configDir = join(home, ".gbrain");
|
|
const configPath = join(configDir, "config.json");
|
|
|
|
mkdirSync(bindir, { recursive: true });
|
|
mkdirSync(home, { recursive: true });
|
|
mkdirSync(gstackHome, { recursive: true });
|
|
mkdirSync(configDir, { recursive: true });
|
|
|
|
if (opts.withConfig) {
|
|
writeFileSync(
|
|
configPath,
|
|
JSON.stringify({ engine: "pglite", database_url: "pglite:///fake" }),
|
|
);
|
|
}
|
|
|
|
if (opts.withGbrain) {
|
|
const behavior = opts.gbrainBehavior || "ok";
|
|
const fake = makeFakeGbrainScript(behavior);
|
|
const gbrainPath = join(bindir, "gbrain");
|
|
writeFileSync(gbrainPath, fake);
|
|
chmodSync(gbrainPath, 0o755);
|
|
}
|
|
|
|
return {
|
|
tmp,
|
|
bindir,
|
|
home,
|
|
gstackHome,
|
|
configPath,
|
|
cleanup: () => rmSync(tmp, { recursive: true, force: true }),
|
|
};
|
|
}
|
|
|
|
function makeFakeGbrainScript(
|
|
behavior: "ok" | "broken-db" | "broken-config" | "throws" | "slow",
|
|
): string {
|
|
// "slow": healthy engine on a cold pooler connection (#1964) — sleeps past
|
|
// the (test-lowered) probe timeout, then would answer fine.
|
|
if (behavior === "slow") {
|
|
return `#!/bin/sh
|
|
if [ "$1" = "--version" ]; then
|
|
echo "gbrain 0.33.1.0"
|
|
exit 0
|
|
fi
|
|
if [ "$1 $2" = "sources list" ]; then
|
|
sleep 2
|
|
echo '{"sources":[]}'
|
|
exit 0
|
|
fi
|
|
exit 0
|
|
`;
|
|
}
|
|
const stderrLine =
|
|
behavior === "broken-db"
|
|
? 'echo "Cannot connect to database: . Fix: Check your connection URL in ~/.gbrain/config.json" >&2'
|
|
: behavior === "broken-config"
|
|
? 'echo "Error: malformed config.json at ~/.gbrain/config.json" >&2'
|
|
: behavior === "throws"
|
|
? 'echo "unexpected gbrain failure" >&2'
|
|
: "";
|
|
const exitCode = behavior === "ok" ? 0 : 1;
|
|
return `#!/bin/sh
|
|
if [ "$1" = "--version" ]; then
|
|
echo "gbrain 0.33.1.0"
|
|
exit 0
|
|
fi
|
|
if [ "$1 $2" = "sources list" ]; then
|
|
if [ ${exitCode} -eq 0 ]; then
|
|
echo '{"sources":[]}'
|
|
exit 0
|
|
fi
|
|
${stderrLine}
|
|
exit ${exitCode}
|
|
fi
|
|
exit 0
|
|
`;
|
|
}
|
|
|
|
/**
|
|
* Apply a FakeEnv to process.env. Returns a function that restores previous values.
|
|
*
|
|
* PATH is REPLACED (not prepended) so a real `gbrain` on the inherited PATH
|
|
* can't shadow the test's fake-or-absent binary. /usr/bin:/bin is kept so `sh`
|
|
* and `command` work.
|
|
*/
|
|
function applyEnv(env: FakeEnv): () => void {
|
|
const prev = {
|
|
HOME: process.env.HOME,
|
|
PATH: process.env.PATH,
|
|
GSTACK_HOME: process.env.GSTACK_HOME,
|
|
GBRAIN_HOME: process.env.GBRAIN_HOME,
|
|
GSTACK_GBRAIN_PROBE_TIMEOUT_MS: process.env.GSTACK_GBRAIN_PROBE_TIMEOUT_MS,
|
|
};
|
|
process.env.HOME = env.home;
|
|
process.env.PATH = `${env.bindir}:/usr/bin:/bin`;
|
|
process.env.GSTACK_HOME = env.gstackHome;
|
|
delete process.env.GBRAIN_HOME;
|
|
delete process.env.GSTACK_GBRAIN_PROBE_TIMEOUT_MS;
|
|
return () => {
|
|
for (const [k, v] of Object.entries(prev)) {
|
|
if (v === undefined) delete process.env[k];
|
|
else process.env[k] = v;
|
|
}
|
|
};
|
|
}
|
|
|
|
describe("lib/gbrain-local-status — status classification", () => {
|
|
let env: FakeEnv | null = null;
|
|
let restoreEnv: (() => void) | null = null;
|
|
|
|
afterEach(() => {
|
|
if (restoreEnv) restoreEnv();
|
|
if (env) env.cleanup();
|
|
env = null;
|
|
restoreEnv = null;
|
|
});
|
|
|
|
it("probes the gbrain executable directly instead of shelling through command -v", () => {
|
|
const source = readFileSync(
|
|
join(import.meta.dir, "..", "lib", "gbrain-local-status.ts"),
|
|
"utf-8",
|
|
);
|
|
|
|
expect(source).not.toContain('command -v gbrain');
|
|
expect(source).toContain('execFileSync("gbrain", ["--version"]');
|
|
});
|
|
|
|
it("returns 'no-cli' when gbrain is not on PATH", () => {
|
|
env = makeEnv({ withGbrain: false });
|
|
restoreEnv = applyEnv(env);
|
|
expect(localEngineStatus({ noCache: true })).toBe("no-cli");
|
|
});
|
|
|
|
it("returns 'missing-config' when CLI is present but ~/.gbrain/config.json absent", () => {
|
|
env = makeEnv({ withGbrain: true, gbrainBehavior: "ok", withConfig: false });
|
|
restoreEnv = applyEnv(env);
|
|
expect(localEngineStatus({ noCache: true })).toBe("missing-config");
|
|
});
|
|
|
|
it("returns 'broken-db' when sources list emits 'Cannot connect to database'", () => {
|
|
env = makeEnv({ withGbrain: true, gbrainBehavior: "broken-db", withConfig: true });
|
|
restoreEnv = applyEnv(env);
|
|
expect(localEngineStatus({ noCache: true })).toBe("broken-db");
|
|
});
|
|
|
|
it("returns 'broken-config' when sources list emits config.json error", () => {
|
|
env = makeEnv({ withGbrain: true, gbrainBehavior: "broken-config", withConfig: true });
|
|
restoreEnv = applyEnv(env);
|
|
expect(localEngineStatus({ noCache: true })).toBe("broken-config");
|
|
});
|
|
|
|
it("returns 'broken-config' defensively when stderr matches neither pattern", () => {
|
|
env = makeEnv({ withGbrain: true, gbrainBehavior: "throws", withConfig: true });
|
|
restoreEnv = applyEnv(env);
|
|
expect(localEngineStatus({ noCache: true })).toBe("broken-config");
|
|
});
|
|
|
|
it("returns 'ok' when sources list succeeds", () => {
|
|
env = makeEnv({ withGbrain: true, gbrainBehavior: "ok", withConfig: true });
|
|
restoreEnv = applyEnv(env);
|
|
expect(localEngineStatus({ noCache: true })).toBe("ok");
|
|
});
|
|
|
|
it("returns 'timeout' (not broken-config) when the probe exceeds the deadline (#1964)", () => {
|
|
env = makeEnv({ withGbrain: true, gbrainBehavior: "slow", withConfig: true });
|
|
restoreEnv = applyEnv(env);
|
|
process.env.GSTACK_GBRAIN_PROBE_TIMEOUT_MS = "300";
|
|
expect(localEngineStatus({ noCache: true })).toBe("timeout");
|
|
});
|
|
|
|
it("honors GBRAIN_HOME for config detection (codex D11)", () => {
|
|
// Config lives ONLY at the alternate GBRAIN_HOME; ~/.gbrain has none.
|
|
env = makeEnv({ withGbrain: true, gbrainBehavior: "ok", withConfig: false });
|
|
restoreEnv = applyEnv(env);
|
|
const altHome = join(env.tmp, "alt-gbrain");
|
|
mkdirSync(altHome, { recursive: true });
|
|
writeFileSync(
|
|
join(altHome, "config.json"),
|
|
JSON.stringify({ engine: "pglite", database_url: "pglite:///fake" }),
|
|
);
|
|
// Without GBRAIN_HOME: misclassified as missing-config.
|
|
expect(localEngineStatus({ noCache: true })).toBe("missing-config");
|
|
// With GBRAIN_HOME: the relocated config is found.
|
|
process.env.GBRAIN_HOME = altHome;
|
|
expect(localEngineStatus({ noCache: true })).toBe("ok");
|
|
});
|
|
});
|
|
|
|
describe("gstack-gbrain-detect --is-ok — timeout is usable (eng review D1)", () => {
|
|
it("exits 0 when the engine probe times out (slow-but-healthy must not suppress brain features)", () => {
|
|
const env = makeEnv({ withGbrain: true, gbrainBehavior: "slow", withConfig: true });
|
|
try {
|
|
const detect = join(import.meta.dir, "..", "bin", "gstack-gbrain-detect");
|
|
const r = spawnSync(process.execPath, [detect, "--is-ok"], {
|
|
encoding: "utf-8",
|
|
timeout: 20_000,
|
|
env: {
|
|
...process.env,
|
|
HOME: env.home,
|
|
GSTACK_HOME: env.gstackHome,
|
|
PATH: `${env.bindir}:/usr/bin:/bin`,
|
|
GSTACK_GBRAIN_PROBE_TIMEOUT_MS: "300",
|
|
GSTACK_DETECT_NO_CACHE: "1",
|
|
GBRAIN_HOME: "",
|
|
},
|
|
});
|
|
expect(r.status).toBe(0);
|
|
} finally {
|
|
env.cleanup();
|
|
}
|
|
});
|
|
});
|
|
|
|
describe("probeTimeoutMs — env override parsing", () => {
|
|
it("defaults to 15s when unset", () => {
|
|
expect(probeTimeoutMs({})).toBe(DEFAULT_PROBE_TIMEOUT_MS);
|
|
expect(DEFAULT_PROBE_TIMEOUT_MS).toBe(15_000);
|
|
});
|
|
|
|
it("parses a numeric override", () => {
|
|
expect(probeTimeoutMs({ GSTACK_GBRAIN_PROBE_TIMEOUT_MS: "300" })).toBe(300);
|
|
});
|
|
|
|
it("falls back to the default on non-numeric, empty, and non-positive values", () => {
|
|
expect(probeTimeoutMs({ GSTACK_GBRAIN_PROBE_TIMEOUT_MS: "fast" })).toBe(DEFAULT_PROBE_TIMEOUT_MS);
|
|
expect(probeTimeoutMs({ GSTACK_GBRAIN_PROBE_TIMEOUT_MS: "" })).toBe(DEFAULT_PROBE_TIMEOUT_MS);
|
|
expect(probeTimeoutMs({ GSTACK_GBRAIN_PROBE_TIMEOUT_MS: "0" })).toBe(DEFAULT_PROBE_TIMEOUT_MS);
|
|
expect(probeTimeoutMs({ GSTACK_GBRAIN_PROBE_TIMEOUT_MS: "-5" })).toBe(DEFAULT_PROBE_TIMEOUT_MS);
|
|
});
|
|
|
|
it("never returns 0 for fractional sub-millisecond values (0 = NO timeout in execFileSync)", () => {
|
|
expect(probeTimeoutMs({ GSTACK_GBRAIN_PROBE_TIMEOUT_MS: "0.5" })).toBe(1);
|
|
expect(probeTimeoutMs({ GSTACK_GBRAIN_PROBE_TIMEOUT_MS: "0.0001" })).toBe(1);
|
|
});
|
|
});
|
|
|
|
describe("lib/gbrain-local-status — cache behavior", () => {
|
|
let env: FakeEnv | null = null;
|
|
let restoreEnv: (() => void) | null = null;
|
|
|
|
afterEach(() => {
|
|
if (restoreEnv) restoreEnv();
|
|
if (env) env.cleanup();
|
|
env = null;
|
|
restoreEnv = null;
|
|
});
|
|
|
|
it("writes a cache entry on first call", () => {
|
|
env = makeEnv({ withGbrain: true, gbrainBehavior: "ok", withConfig: true });
|
|
restoreEnv = applyEnv(env);
|
|
localEngineStatus({ noCache: false });
|
|
expect(existsSync(cacheFilePath())).toBe(true);
|
|
});
|
|
|
|
it("returns cached value within TTL even if underlying state would change", () => {
|
|
env = makeEnv({ withGbrain: true, gbrainBehavior: "ok", withConfig: true });
|
|
restoreEnv = applyEnv(env);
|
|
const first = localEngineStatus({ noCache: false });
|
|
expect(first).toBe("ok");
|
|
|
|
// Make the fake gbrain emit broken-db now. Cache should still say ok.
|
|
writeFileSync(
|
|
join(env.bindir, "gbrain"),
|
|
makeFakeGbrainScript("broken-db"),
|
|
);
|
|
chmodSync(join(env.bindir, "gbrain"), 0o755);
|
|
|
|
const second = localEngineStatus({ noCache: false });
|
|
expect(second).toBe("ok"); // cache hit
|
|
});
|
|
|
|
it("re-probes when --no-cache is passed", () => {
|
|
env = makeEnv({ withGbrain: true, gbrainBehavior: "ok", withConfig: true });
|
|
restoreEnv = applyEnv(env);
|
|
expect(localEngineStatus({ noCache: false })).toBe("ok");
|
|
|
|
writeFileSync(
|
|
join(env.bindir, "gbrain"),
|
|
makeFakeGbrainScript("broken-db"),
|
|
);
|
|
chmodSync(join(env.bindir, "gbrain"), 0o755);
|
|
|
|
expect(localEngineStatus({ noCache: true })).toBe("broken-db");
|
|
});
|
|
|
|
it("invalidates cache when config_mtime changes (key invariant)", () => {
|
|
env = makeEnv({ withGbrain: true, gbrainBehavior: "ok", withConfig: true });
|
|
restoreEnv = applyEnv(env);
|
|
expect(localEngineStatus({ noCache: false })).toBe("ok");
|
|
|
|
// Bump config mtime artificially (touch +10s) AND rewrite gbrain to broken-db.
|
|
const future = Math.floor(Date.now() / 1000) + 10;
|
|
utimesSync(env.configPath, future, future);
|
|
writeFileSync(
|
|
join(env.bindir, "gbrain"),
|
|
makeFakeGbrainScript("broken-db"),
|
|
);
|
|
chmodSync(join(env.bindir, "gbrain"), 0o755);
|
|
|
|
// Even with cache enabled, mtime mismatch forces re-probe.
|
|
expect(localEngineStatus({ noCache: false })).toBe("broken-db");
|
|
});
|
|
|
|
it("caches a 'timeout' result (sync probes 3x/run — uncached would cost 3 deadlines)", () => {
|
|
env = makeEnv({ withGbrain: true, gbrainBehavior: "slow", withConfig: true });
|
|
restoreEnv = applyEnv(env);
|
|
process.env.GSTACK_GBRAIN_PROBE_TIMEOUT_MS = "300";
|
|
expect(localEngineStatus({ noCache: false })).toBe("timeout");
|
|
|
|
// Swap the fake to a fast-ok binary; the cached timeout should still win
|
|
// within TTL (same key — proving the result was cached, not re-probed).
|
|
writeFileSync(join(env.bindir, "gbrain"), makeFakeGbrainScript("ok"));
|
|
chmodSync(join(env.bindir, "gbrain"), 0o755);
|
|
expect(localEngineStatus({ noCache: false })).toBe("timeout");
|
|
});
|
|
|
|
it("invalidates a cached 'timeout' when GSTACK_GBRAIN_PROBE_TIMEOUT_MS changes (key invariant, codex D13)", () => {
|
|
env = makeEnv({ withGbrain: true, gbrainBehavior: "slow", withConfig: true });
|
|
restoreEnv = applyEnv(env);
|
|
process.env.GSTACK_GBRAIN_PROBE_TIMEOUT_MS = "300";
|
|
expect(localEngineStatus({ noCache: false })).toBe("timeout");
|
|
|
|
// User raises the timeout past the fake's 2s sleep: cache key changes,
|
|
// re-probe succeeds.
|
|
process.env.GSTACK_GBRAIN_PROBE_TIMEOUT_MS = "5000";
|
|
expect(localEngineStatus({ noCache: false })).toBe("ok");
|
|
});
|
|
|
|
it("invalidates cache when GBRAIN_HOME changes (key invariant, codex D11)", () => {
|
|
env = makeEnv({ withGbrain: true, gbrainBehavior: "ok", withConfig: true });
|
|
restoreEnv = applyEnv(env);
|
|
expect(localEngineStatus({ noCache: false })).toBe("ok");
|
|
|
|
// Point GBRAIN_HOME at an empty dir: a stale cached "ok" must not win —
|
|
// gbrain_home is part of the cache key, so this re-probes and finds no
|
|
// config at the new location.
|
|
const altHome = join(env.tmp, "alt-gbrain-empty");
|
|
mkdirSync(altHome, { recursive: true });
|
|
process.env.GBRAIN_HOME = altHome;
|
|
expect(localEngineStatus({ noCache: false })).toBe("missing-config");
|
|
});
|
|
|
|
it("invalidates cache when HOME changes (key invariant)", () => {
|
|
env = makeEnv({ withGbrain: true, gbrainBehavior: "ok", withConfig: true });
|
|
restoreEnv = applyEnv(env);
|
|
expect(localEngineStatus({ noCache: false })).toBe("ok");
|
|
|
|
// Switch to a new HOME (different user). Same gstack home (shared cache file).
|
|
const env2 = makeEnv({
|
|
withGbrain: true,
|
|
gbrainBehavior: "broken-db",
|
|
withConfig: true,
|
|
});
|
|
process.env.HOME = env2.home;
|
|
process.env.PATH = `${env2.bindir}:/usr/bin:/bin`;
|
|
// GSTACK_HOME stays pointing at env.gstackHome (the original cache file).
|
|
|
|
try {
|
|
expect(localEngineStatus({ noCache: false })).toBe("broken-db");
|
|
} finally {
|
|
env2.cleanup();
|
|
}
|
|
});
|
|
});
|