mirror of
https://github.com/deepseek-ai/deepseek-harness
synced 2026-08-15 21:04:50 +00:00
69d8621e2e
The layered-env reader gained an unreadable-layer path, a default reporter, and two absent-layer arms with no cases; the credential store gained two error paths that must not be mistaken for an absent file. The platform arms and the `linePos` guard cannot be reached from a POSIX test run — the first is covered by the native Windows job, the second only satisfies an optional type that `prettyErrors` always fills — so both carry a v8 ignore naming why.
421 lines
19 KiB
TypeScript
421 lines
19 KiB
TypeScript
import { afterEach, describe, expect, it, vi } from 'vitest'
|
|
import { Context } from 'cordis'
|
|
import { mkdir, mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises'
|
|
import { tmpdir } from 'node:os'
|
|
import { join, resolve } from 'node:path'
|
|
import { credentialRef } from '@deepseek-ai/dsh-credentials'
|
|
import { createEnvironmentSnapshot, DSH_ENVIRONMENT_KEY } from '@deepseek-ai/dsh-environment'
|
|
import type { CredentialRef } from '@deepseek-ai/dsh-credentials'
|
|
import { CredentialsLocal, resolveSpec } from '../src/index.ts'
|
|
|
|
/** Credential documents are seeded owner-only, exactly as the provider creates them. */
|
|
function writeCredentials(file: string, text: string): Promise<void> {
|
|
return writeFile(file, text, { mode: 0o600 })
|
|
}
|
|
|
|
const KEY = credentialRef('DSH_CRED_TEST')
|
|
const OTHER = credentialRef('DSH_CRED_OTHER')
|
|
|
|
const cleanups: Array<() => Promise<void>> = []
|
|
|
|
afterEach(async () => {
|
|
vi.unstubAllEnvs()
|
|
while (cleanups.length > 0) await cleanups.pop()!()
|
|
})
|
|
|
|
async function tempDir(): Promise<string> {
|
|
const dir = await mkdtemp(join(tmpdir(), 'dsh-credentials-local-'))
|
|
cleanups.push(() => rm(dir, { recursive: true, force: true }))
|
|
return dir
|
|
}
|
|
|
|
async function boot(config: ConstructorParameters<typeof CredentialsLocal>[1]): Promise<Context> {
|
|
const ctx = new Context()
|
|
const fiber = ctx.plugin(CredentialsLocal, config)
|
|
cleanups.push(async () => {
|
|
await fiber.dispose()
|
|
})
|
|
await fiber
|
|
return ctx
|
|
}
|
|
|
|
function updates(ctx: Context): CredentialRef[] {
|
|
const seen: CredentialRef[] = []
|
|
ctx.on('credentials/updated', (ref) => {
|
|
seen.push(ref)
|
|
})
|
|
return seen
|
|
}
|
|
|
|
describe('resolveSpec', () => {
|
|
it('defaults to .credentials.yaml under the harness home with watching on', () => {
|
|
const spec = resolveSpec({ dshHome: '/custom/home' })
|
|
expect(spec).toEqual({ filename: resolve('/custom/home/.credentials.yaml'), watch: true, debounceMs: 100 })
|
|
})
|
|
|
|
it('lets an explicit path win over the home', () => {
|
|
const spec = resolveSpec({ path: '/etc/dsh/creds.yaml', dshHome: '/ignored', watch: false, debounceMs: 5 })
|
|
expect(spec).toEqual({ filename: resolve('/etc/dsh/creds.yaml'), watch: false, debounceMs: 5 })
|
|
})
|
|
})
|
|
|
|
describe('layering and reads', () => {
|
|
it('treats an absent file as an empty writable store', async () => {
|
|
const dir = await tempDir()
|
|
const ctx = await boot({ path: join(dir, '.credentials.yaml'), watch: false })
|
|
expect(await ctx.credentials.resolve(KEY)).toBeUndefined()
|
|
expect(await ctx.credentials.describe(KEY)).toEqual({ configured: false, writable: true })
|
|
})
|
|
|
|
it('serves file entries alongside comments and quoted values', async () => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, '.credentials.yaml')
|
|
await writeCredentials(path, '# notes\nDSH_CRED_TEST: plain\nDSH_CRED_OTHER: "with space"\n')
|
|
const ctx = await boot({ path, watch: false })
|
|
expect(await ctx.credentials.resolve(KEY)).toEqual({ value: 'plain', source: 'file' })
|
|
expect(await ctx.credentials.resolve(OTHER)).toEqual({ value: 'with space', source: 'file' })
|
|
expect(await ctx.credentials.describe(KEY)).toEqual({ configured: true, source: 'file', writable: true })
|
|
})
|
|
|
|
it('lets a non-empty process environment win read-only over the file', async () => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, '.credentials.yaml')
|
|
await writeCredentials(path, 'DSH_CRED_TEST: from-file\n')
|
|
const ctx = await boot({ path, watch: false })
|
|
vi.stubEnv('DSH_CRED_TEST', 'from-env')
|
|
expect(await ctx.credentials.resolve(KEY)).toEqual({ value: 'from-env', source: 'env' })
|
|
expect(await ctx.credentials.describe(KEY)).toEqual({ configured: true, source: 'env', writable: false })
|
|
})
|
|
|
|
it('treats an empty environment value as absent, falling through to the file', async () => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, '.credentials.yaml')
|
|
await writeCredentials(path, 'DSH_CRED_TEST: stored\n')
|
|
const ctx = await boot({ path, watch: false })
|
|
vi.stubEnv('DSH_CRED_TEST', '')
|
|
expect(await ctx.credentials.resolve(KEY)).toEqual({ value: 'stored', source: 'file' })
|
|
expect(await ctx.credentials.describe(KEY)).toEqual({ configured: true, source: 'file', writable: true })
|
|
})
|
|
|
|
it('fails boot loud when the document exists but cannot be read', async () => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, 'occupied')
|
|
await mkdir(path)
|
|
const ctx = new Context()
|
|
await expect(ctx.plugin(CredentialsLocal, { path, watch: false })).rejects.toThrow()
|
|
})
|
|
})
|
|
|
|
describe('layer ladder', () => {
|
|
// inherited process env > .credentials.yaml > $DSH_HOME/.env, and the
|
|
// invoking directory's .env supplies no credential at all.
|
|
async function bootLayered(
|
|
path: string,
|
|
layers: Parameters<typeof createEnvironmentSnapshot>[0],
|
|
): Promise<Context> {
|
|
const ctx = new Context()
|
|
ctx.provide(DSH_ENVIRONMENT_KEY, createEnvironmentSnapshot(layers))
|
|
const fiber = ctx.plugin(CredentialsLocal, { path, watch: false })
|
|
cleanups.push(async () => { await fiber.dispose() })
|
|
await fiber
|
|
return ctx
|
|
}
|
|
|
|
it('lets the stored value beat the user .env, so a UI write takes effect immediately', async () => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, '.credentials.yaml')
|
|
await writeCredentials(path, 'DSH_CRED_TEST: stored\n')
|
|
const ctx = await bootLayered(path, [
|
|
{ source: 'process', values: {} },
|
|
{ source: 'user-env', path: '/home/.dsh/.env', values: { DSH_CRED_TEST: 'older-user-env' } },
|
|
])
|
|
expect(await ctx.credentials.resolve(KEY)).toEqual({ value: 'stored', source: 'file' })
|
|
// The old dead end is gone: a key sitting in the user's .env no longer
|
|
// makes the stored one unwritable.
|
|
expect(await ctx.credentials.describe(KEY)).toEqual({ configured: true, source: 'file', writable: true })
|
|
await expect(ctx.credentials.set(KEY, 'rotated')).resolves.toBeUndefined()
|
|
expect(await ctx.credentials.resolve(KEY)).toEqual({ value: 'rotated', source: 'file' })
|
|
})
|
|
|
|
it('serves the user .env only when nothing is stored', async () => {
|
|
const dir = await tempDir()
|
|
const ctx = await bootLayered(join(dir, '.credentials.yaml'), [
|
|
{ source: 'process', values: {} },
|
|
{ source: 'user-env', path: '/home/.dsh/.env', values: { DSH_CRED_TEST: 'from-user-env' } },
|
|
])
|
|
expect(await ctx.credentials.resolve(KEY)).toEqual({ value: 'from-user-env', source: 'user-env' })
|
|
// Writable: storing a key replaces it as the effective one.
|
|
expect(await ctx.credentials.describe(KEY)).toEqual({ configured: true, source: 'user-env', writable: true })
|
|
})
|
|
|
|
it('serves the invoking project .env over the user one, but never over the store', async () => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, '.credentials.yaml')
|
|
// The product trusts the project it is launched in, so a checkout may
|
|
// carry its own key — ranked above the user's home file (more specific
|
|
// wins) and below the managed store, which a stored key must never lose to.
|
|
const layers = [
|
|
{ source: 'process' as const, values: {} },
|
|
{ source: 'project-env' as const, path: '/work/.env', values: { DSH_CRED_TEST: 'from-project' } },
|
|
{ source: 'user-env' as const, path: '/home/.dsh/.env', values: { DSH_CRED_TEST: 'from-user' } },
|
|
]
|
|
const bare = await bootLayered(path, layers)
|
|
expect(await bare.credentials.resolve(KEY)).toEqual({ value: 'from-project', source: 'project-env' })
|
|
expect(await bare.credentials.describe(KEY)).toEqual({ configured: true, source: 'project-env', writable: true })
|
|
|
|
await writeCredentials(path, 'DSH_CRED_TEST: stored\n')
|
|
const stored = await bootLayered(path, layers)
|
|
expect(await stored.credentials.resolve(KEY)).toEqual({ value: 'stored', source: 'file' })
|
|
})
|
|
|
|
it('refuses a document other OS users can read', async () => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, '.credentials.yaml')
|
|
await writeFile(path, 'DSH_CRED_TEST: leaked\n', { mode: 0o644 })
|
|
const ctx = new Context()
|
|
// Before the contents are read at all: serving secrets out of a
|
|
// world-readable file would make the 0600 the provider writes meaningless.
|
|
await expect(ctx.plugin(CredentialsLocal, { path, watch: false }))
|
|
.rejects.toThrow(/readable beyond its owner \(mode 644\)/)
|
|
})
|
|
|
|
it('propagates a permission check that fails for a reason other than absence', async () => {
|
|
const dir = await tempDir()
|
|
const notADirectory = join(dir, 'occupied')
|
|
await writeFile(notADirectory, 'a regular file\n')
|
|
// An absent document is an empty store, but a path that cannot be
|
|
// reached at all is a misconfiguration: the parent is a file, so the
|
|
// check fails with ENOTDIR rather than concluding "no credentials yet".
|
|
const ctx = new Context()
|
|
await expect(ctx.plugin(CredentialsLocal, { path: join(notADirectory, '.credentials.yaml'), watch: false }))
|
|
.rejects.toThrow(/ENOTDIR/)
|
|
})
|
|
|
|
it('propagates a read that fails for a reason other than absence', async () => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, '.credentials.yaml')
|
|
// Owner-only, so the permission check passes, and unreadable as a file:
|
|
// the store is present but cannot be parsed, which must fail the launch
|
|
// rather than silently serve nothing.
|
|
await mkdir(path, { mode: 0o700 })
|
|
const ctx = new Context()
|
|
await expect(ctx.plugin(CredentialsLocal, { path, watch: false })).rejects.toThrow(/EISDIR/)
|
|
})
|
|
|
|
it('lets only the inherited environment shadow the store, read-only', async () => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, '.credentials.yaml')
|
|
await writeCredentials(path, 'DSH_CRED_TEST: stored\n')
|
|
const ctx = await bootLayered(path, [
|
|
{ source: 'process', values: { DSH_CRED_TEST: 'from-shell' } },
|
|
{ source: 'user-env', path: '/home/.dsh/.env', values: { DSH_CRED_TEST: 'from-user-env' } },
|
|
])
|
|
expect(await ctx.credentials.resolve(KEY)).toEqual({ value: 'from-shell', source: 'env' })
|
|
expect(await ctx.credentials.describe(KEY)).toEqual({ configured: true, source: 'env', writable: false })
|
|
await expect(ctx.credentials.set(KEY, 'next')).rejects.toThrow(/launching environment/)
|
|
})
|
|
})
|
|
|
|
describe('document validation', () => {
|
|
// Every rejection below is a boot failure rather than a skipped entry: this
|
|
// document holds nothing but credentials, so an ignored key would read as
|
|
// "the secret I stored has no effect".
|
|
it.each([
|
|
['a non-mapping root', 'just a string\n', /must be a mapping/],
|
|
['a sequence root', '- DSH_CRED_TEST\n', /must be a mapping/],
|
|
['a key that is not a POSIX identifier', 'not-a-ref: value\n', /credential ref/],
|
|
['a non-string value', 'DSH_CRED_TEST: 123\n', /must be a string/],
|
|
['an empty value', 'DSH_CRED_TEST: ""\n', /is empty/],
|
|
['duplicate keys', 'DSH_CRED_TEST: one\nDSH_CRED_TEST: two\n', /invalid document/],
|
|
['malformed yaml', 'DSH_CRED_TEST: "unterminated\n', /invalid document/],
|
|
])('fails boot on %s', async (_case, text, message) => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, '.credentials.yaml')
|
|
await writeCredentials(path, text)
|
|
const ctx = new Context()
|
|
await expect(ctx.plugin(CredentialsLocal, { path, watch: false })).rejects.toThrow(message)
|
|
})
|
|
|
|
it('never puts a credential value in a diagnostic', async () => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, '.credentials.yaml')
|
|
const secret = 'sk-live-DO-NOT-LOG-abcdef123456'
|
|
// The yaml parser's own message quotes the offending source line, which in
|
|
// this document is the secret itself. Boot stderr and the watcher's logger
|
|
// both receive whatever this throws.
|
|
await writeCredentials(path, `DSH_CRED_TEST: "${secret}\n`)
|
|
let failure: unknown
|
|
try {
|
|
await new Context().plugin(CredentialsLocal, { path, watch: false })
|
|
} catch (error) {
|
|
failure = error
|
|
}
|
|
expect(String(failure)).toMatch(/invalid document/)
|
|
// The position survives; the line's contents do not.
|
|
expect(String(failure)).toMatch(/line 2, column 1/)
|
|
expect(String(failure)).not.toContain(secret)
|
|
expect((failure as Error).stack ?? '').not.toContain(secret)
|
|
})
|
|
|
|
it('reads an empty document as an empty store', async () => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, '.credentials.yaml')
|
|
await writeCredentials(path, '# nothing stored yet\n')
|
|
const ctx = await boot({ path, watch: false })
|
|
expect(await ctx.credentials.resolve(KEY)).toBeUndefined()
|
|
})
|
|
})
|
|
|
|
describe('document writes', () => {
|
|
it('adds a missing key to a fresh 0600 document and emits the commit', async () => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, '.credentials.yaml')
|
|
const ctx = await boot({ path, watch: false })
|
|
const seen = updates(ctx)
|
|
await ctx.credentials.set(KEY, 'sk-fresh')
|
|
expect(await readFile(path, 'utf8')).toBe('DSH_CRED_TEST: sk-fresh\n')
|
|
expect((await stat(path)).mode & 0o777).toBe(0o600)
|
|
expect(await ctx.credentials.resolve(KEY)).toEqual({ value: 'sk-fresh', source: 'file' })
|
|
expect(seen).toEqual([KEY])
|
|
})
|
|
|
|
it('patches one entry, preserving comments and every untouched entry', async () => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, '.credentials.yaml')
|
|
await writeCredentials(path, '# deployment notes\nDSH_CRED_OTHER: keep\n\n# the one under edit\nDSH_CRED_TEST: old\n')
|
|
const ctx = await boot({ path, watch: false })
|
|
await ctx.credentials.set(KEY, 'new value!')
|
|
expect(await readFile(path, 'utf8')).toBe(
|
|
'# deployment notes\nDSH_CRED_OTHER: keep\n\n# the one under edit\nDSH_CRED_TEST: new value!\n',
|
|
)
|
|
})
|
|
|
|
it('round-trips values no dotenv line could represent', async () => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, '.credentials.yaml')
|
|
const ctx = await boot({ path, watch: false })
|
|
const multiLine = 'line one\nline two'
|
|
const mixedQuotes = 'both \' and "'
|
|
await ctx.credentials.set(KEY, multiLine)
|
|
await ctx.credentials.set(OTHER, mixedQuotes)
|
|
const reread = await boot({ path, watch: false })
|
|
expect(await reread.credentials.resolve(KEY)).toEqual({ value: multiLine, source: 'file' })
|
|
expect(await reread.credentials.resolve(OTHER)).toEqual({ value: mixedQuotes, source: 'file' })
|
|
expect(await reread.credentials.describe(KEY)).toEqual({ configured: true, source: 'file', writable: true })
|
|
})
|
|
|
|
it('unsets only the owning entry, with its own annotation, and keeps an absent unset silent', async () => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, '.credentials.yaml')
|
|
// Comments above an entry are that entry's annotation and go with it when
|
|
// it is removed — including anything above the document's first entry.
|
|
// Every other entry keeps its own comments.
|
|
await writeCredentials(path, '# about the doomed one\nDSH_CRED_TEST: gone\n# about the survivor\nDSH_CRED_OTHER: stays\n')
|
|
const ctx = await boot({ path, watch: false })
|
|
const seen = updates(ctx)
|
|
await ctx.credentials.unset(KEY)
|
|
expect(await readFile(path, 'utf8')).toBe('# about the survivor\nDSH_CRED_OTHER: stays\n')
|
|
await ctx.credentials.unset(KEY)
|
|
expect(seen).toEqual([KEY])
|
|
})
|
|
|
|
it('rejects empty values and writes the environment would shadow', async () => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, '.credentials.yaml')
|
|
await writeCredentials(path, 'DSH_CRED_TEST: stored\n')
|
|
const ctx = await boot({ path, watch: false })
|
|
|
|
await expect(ctx.credentials.set(KEY, '')).rejects.toThrow(/empty value/)
|
|
|
|
vi.stubEnv('DSH_CRED_TEST', 'shadowing')
|
|
await expect(ctx.credentials.set(KEY, 'next')).rejects.toThrow(/shadowed/)
|
|
await expect(ctx.credentials.unset(KEY)).rejects.toThrow(/shadowed/)
|
|
})
|
|
|
|
it('leaves an empty mapping after unsetting the only entry', async () => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, '.credentials.yaml')
|
|
await writeCredentials(path, 'DSH_CRED_TEST: only\n')
|
|
const ctx = await boot({ path, watch: false })
|
|
await ctx.credentials.unset(KEY)
|
|
expect(await readFile(path, 'utf8')).toBe('{}\n')
|
|
// The emptied document still reloads as an empty store, not a parse error.
|
|
const reread = await boot({ path, watch: false })
|
|
expect(await reread.credentials.resolve(KEY)).toBeUndefined()
|
|
})
|
|
|
|
it('fails a write loud when the on-disk document became invalid', async () => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, '.credentials.yaml')
|
|
const ctx = await boot({ path, watch: false })
|
|
// An external editor left the document unparsable: the read-modify-write
|
|
// must refuse rather than overwrite content it cannot understand.
|
|
await writeCredentials(path, 'DSH_CRED_TEST: "unterminated\n')
|
|
await expect(ctx.credentials.set(OTHER, 'lands')).rejects.toThrow(/invalid document/)
|
|
})
|
|
|
|
it('chains past a rejected write so one bad value cannot poison the queue', async () => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, '.credentials.yaml')
|
|
const ctx = await boot({ path, watch: false })
|
|
const bad = expect(ctx.credentials.set(KEY, '')).rejects.toThrow(/empty value/)
|
|
const good = ctx.credentials.set(OTHER, 'lands')
|
|
await bad
|
|
await good
|
|
expect(await readFile(path, 'utf8')).toBe('DSH_CRED_OTHER: lands\n')
|
|
})
|
|
|
|
it('serializes concurrent writes so both land in the one document', async () => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, '.credentials.yaml')
|
|
const ctx = await boot({ path, watch: false })
|
|
await Promise.all([
|
|
ctx.credentials.set(KEY, 'one'),
|
|
ctx.credentials.set(OTHER, 'two'),
|
|
])
|
|
expect(await readFile(path, 'utf8')).toBe('DSH_CRED_TEST: one\nDSH_CRED_OTHER: two\n')
|
|
})
|
|
|
|
it('refuses writes after disposal', async () => {
|
|
const dir = await tempDir()
|
|
const ctx = new Context()
|
|
const fiber = ctx.plugin(CredentialsLocal, { path: join(dir, '.credentials.yaml'), watch: false })
|
|
await fiber
|
|
// Capture the handle first: disposal also removes the ctx.credentials service.
|
|
const service = ctx.credentials
|
|
await fiber.dispose()
|
|
await expect(service.set(KEY, 'late')).rejects.toThrow(/disposed/)
|
|
})
|
|
})
|
|
|
|
describe('real hot reload', () => {
|
|
it('publishes external edits, replaces the snapshot wholesale, and suppresses self-writes', async () => {
|
|
const dir = await tempDir()
|
|
const path = join(dir, '.credentials.yaml')
|
|
// Watching starts on an existing document: creation racing watcher setup
|
|
// is a chokidar readiness gap, not the reload contract under test.
|
|
await writeCredentials(path, 'DSH_CRED_TEST: boot\n')
|
|
const ctx = await boot({ path, debounceMs: 10 })
|
|
const seen = updates(ctx)
|
|
|
|
await writeCredentials(path, 'DSH_CRED_TEST: live\nDSH_CRED_OTHER: extra\n')
|
|
await vi.waitFor(async () => {
|
|
expect(await ctx.credentials.resolve(KEY)).toEqual({ value: 'live', source: 'file' })
|
|
})
|
|
|
|
// Wholesale replacement: an entry deleted on disk never lingers in memory.
|
|
await writeCredentials(path, 'DSH_CRED_TEST: live\n')
|
|
await vi.waitFor(async () => {
|
|
expect(await ctx.credentials.resolve(OTHER)).toBeUndefined()
|
|
})
|
|
|
|
const before = seen.length
|
|
await ctx.credentials.set(KEY, 'self-written')
|
|
await new Promise(resolvePause => setTimeout(resolvePause, 200))
|
|
// Exactly the committed write's own event: the watcher echo of our own
|
|
// content is recognized by the text cache and publishes nothing extra.
|
|
expect(seen.length).toBe(before + 1)
|
|
expect(await ctx.credentials.resolve(KEY)).toEqual({ value: 'self-written', source: 'file' })
|
|
})
|
|
})
|