Deploy multi-file Hub workflows (#3128)
* feat(hub): deploy canonical workflow bundles Keep CLI deployment aligned with Hub's authored bundle boundary so validation and activation receive the same deterministic source files. Public documentation now teaches that boundary as the only configuration format. * test(hub): assert validation diagnostics directly * refactor(hub): deepen HTTP client module * feat(hub): validate named agent configurations * docs(hub): align Claude mode example
This commit is contained in:
Mohamed Boudra
@@ -2,7 +2,8 @@ import { strict as assert } from "node:assert";
|
||||
import { createServer } from "node:http";
|
||||
import type { AddressInfo } from "node:net";
|
||||
import { afterEach, describe, it } from "vitest";
|
||||
import { HubHttpClient } from "./client.js";
|
||||
import { HubHttpClient } from "./hub-client/index.js";
|
||||
import { HubCommandError } from "./error.js";
|
||||
|
||||
const servers: Array<ReturnType<typeof createServer>> = [];
|
||||
|
||||
@@ -89,11 +90,56 @@ describe("Hub HTTP client", () => {
|
||||
["/api/v1/projects", "/api/v1/daemons/enrollment-tokens"],
|
||||
);
|
||||
});
|
||||
|
||||
it("renders file-aware Hub validation issues without exposing credentials or response bodies", async () => {
|
||||
const requests: Array<{ url: string | undefined; body: string }> = [];
|
||||
const origin = await startServer(
|
||||
() => ({
|
||||
status: 422,
|
||||
contentType: "application/problem+json",
|
||||
body: {
|
||||
type: "https://hub.test/problems/invalid-configuration-bundle",
|
||||
title: "Invalid configuration bundle",
|
||||
status: 422,
|
||||
detail: "Correct the canonical Hub bundle files. operator-secret",
|
||||
code: "invalid_configuration_bundle",
|
||||
requestId: "request-1",
|
||||
issues: [
|
||||
{
|
||||
path: [".paseo/workflows/answer.yml", "steps", "work", "agent"],
|
||||
message: "unknown named agent operator-secret",
|
||||
},
|
||||
],
|
||||
},
|
||||
}),
|
||||
requests,
|
||||
);
|
||||
const hub = new HubHttpClient();
|
||||
|
||||
await assert.rejects(
|
||||
hub.validateConfiguration({
|
||||
origin,
|
||||
apiKey: "operator-secret",
|
||||
projectSlug: "studio",
|
||||
files: [{ path: ".paseo/hub.yml", content: "sensitive bundle content" }],
|
||||
}),
|
||||
(error: unknown) => {
|
||||
assert.ok(error instanceof HubCommandError);
|
||||
assert.equal(error.message.includes("operator-secret"), false);
|
||||
assert.equal(error.details?.includes("operator-secret"), false);
|
||||
assert.equal(error.message.includes("sensitive bundle content"), false);
|
||||
assert.equal(error.details?.includes("sensitive bundle content"), false);
|
||||
assert.match(error.details ?? "", /\.paseo\/workflows\/answer\.yml\.steps\.work\.agent/u);
|
||||
return true;
|
||||
},
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
interface TestResponse {
|
||||
status: number;
|
||||
body: unknown;
|
||||
contentType?: string;
|
||||
}
|
||||
|
||||
async function startServer(
|
||||
@@ -109,7 +155,9 @@ async function startServer(
|
||||
request.on("end", () => {
|
||||
requests.push({ url: request.url, body });
|
||||
const configured = responseFor(request.url);
|
||||
response.writeHead(configured.status, { "content-type": "application/json" });
|
||||
response.writeHead(configured.status, {
|
||||
"content-type": configured.contentType ?? "application/json",
|
||||
});
|
||||
response.end(JSON.stringify(configured.body));
|
||||
});
|
||||
});
|
||||
|
||||
@@ -1,296 +0,0 @@
|
||||
import { z } from "zod";
|
||||
import type { HubDeployPartial } from "./deploy-input.js";
|
||||
import { HubCommandError } from "./error.js";
|
||||
|
||||
const activationUrlSchema = z.url({ protocol: /^https?$/u });
|
||||
const authorizationSchema = z
|
||||
.object({
|
||||
deviceCode: z.string().min(32),
|
||||
userCode: z.string().min(1),
|
||||
verificationUri: activationUrlSchema,
|
||||
verificationUriComplete: activationUrlSchema,
|
||||
expiresAt: z.string().datetime(),
|
||||
interval: z.number().int().min(1),
|
||||
})
|
||||
.strict();
|
||||
const authorizationPollSchema = z.discriminatedUnion("status", [
|
||||
z.object({ status: z.literal("pending"), interval: z.number().int().min(1) }).strict(),
|
||||
z.object({ status: z.literal("slow_down"), interval: z.number().int().min(1) }).strict(),
|
||||
z
|
||||
.object({
|
||||
status: z.literal("authorized"),
|
||||
interval: z.number().int().min(1),
|
||||
credential: z.string().min(32),
|
||||
organizationId: z.string().min(1),
|
||||
})
|
||||
.strict(),
|
||||
z.object({ status: z.literal("denied"), interval: z.number().int().min(1) }).strict(),
|
||||
z.object({ status: z.literal("expired"), interval: z.number().int().min(1) }).strict(),
|
||||
z.object({ status: z.literal("disclosed"), interval: z.number().int().min(1) }).strict(),
|
||||
z.object({ status: z.literal("retry_later") }).strict(),
|
||||
]);
|
||||
const projectSchema = z
|
||||
.object({ id: z.string().uuid(), slug: z.string().min(1), name: z.string().min(1) })
|
||||
.strict();
|
||||
const projectsResponseSchema = z.object({ projects: z.array(projectSchema) }).strict();
|
||||
const installResponseSchema = z
|
||||
.object({
|
||||
projectSlug: z.string().min(1),
|
||||
version: z.number().int().positive(),
|
||||
versionId: z.string().uuid(),
|
||||
active: z.literal(true),
|
||||
})
|
||||
.strict();
|
||||
const validationResponseSchema = z
|
||||
.object({ projectSlug: z.string().min(1), valid: z.literal(true) })
|
||||
.strict();
|
||||
const enrollmentTokenSchema = z
|
||||
.object({ token: z.string().min(32), expiresAt: z.string().datetime() })
|
||||
.strict();
|
||||
const issuePathSchema = z.union([z.string(), z.array(z.union([z.string(), z.number()]))]);
|
||||
const fieldIssueSchema = z.object({
|
||||
field: z.string().optional(),
|
||||
path: issuePathSchema.optional(),
|
||||
message: z.string(),
|
||||
});
|
||||
const problemSchema = z.object({
|
||||
type: z.string().optional(),
|
||||
title: z.string().optional(),
|
||||
status: z.number().int().optional(),
|
||||
detail: z.string().optional(),
|
||||
instance: z.string().optional(),
|
||||
errors: z
|
||||
.union([z.array(fieldIssueSchema), z.record(z.string(), z.array(z.string()))])
|
||||
.optional(),
|
||||
issues: z.array(fieldIssueSchema).optional(),
|
||||
});
|
||||
|
||||
export type CliAuthorization = z.infer<typeof authorizationSchema>;
|
||||
export type CliAuthorizationPoll = z.infer<typeof authorizationPollSchema>;
|
||||
export type HubProject = z.infer<typeof projectSchema>;
|
||||
export type HubInstallResult = z.infer<typeof installResponseSchema>;
|
||||
export type HubValidationResult = z.infer<typeof validationResponseSchema>;
|
||||
|
||||
interface HubConfigurationInput {
|
||||
origin: string;
|
||||
apiKey: string;
|
||||
projectSlug: string;
|
||||
yaml: string;
|
||||
partials?: readonly HubDeployPartial[];
|
||||
}
|
||||
|
||||
export class HubHttpClient {
|
||||
async startCliAuthorization(origin: string): Promise<CliAuthorization> {
|
||||
return this.request({
|
||||
origin,
|
||||
path: "/api/v1/cli-authorizations",
|
||||
method: "POST",
|
||||
body: {},
|
||||
successStatus: 201,
|
||||
schema: authorizationSchema,
|
||||
failureMessage: "Hub CLI login could not be started",
|
||||
});
|
||||
}
|
||||
|
||||
async pollCliAuthorization(
|
||||
origin: string,
|
||||
deviceCode: string,
|
||||
timeoutMilliseconds: number,
|
||||
): Promise<CliAuthorizationPoll> {
|
||||
try {
|
||||
return await this.request({
|
||||
origin,
|
||||
path: "/api/v1/cli-authorizations/poll",
|
||||
method: "POST",
|
||||
body: { deviceCode },
|
||||
successStatus: 200,
|
||||
schema: authorizationPollSchema,
|
||||
timeoutMilliseconds,
|
||||
failureMessage: "Hub CLI login polling failed",
|
||||
});
|
||||
} catch (error) {
|
||||
if (error instanceof HubCommandError && error.code === "HUB_NETWORK_ERROR") {
|
||||
return { status: "retry_later" };
|
||||
}
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
async listProjects(origin: string, apiKey: string): Promise<HubProject[]> {
|
||||
const response = await this.request({
|
||||
origin,
|
||||
path: "/api/v1/projects",
|
||||
method: "GET",
|
||||
apiKey,
|
||||
successStatus: 200,
|
||||
schema: projectsResponseSchema,
|
||||
failureMessage: "Hub project listing failed",
|
||||
});
|
||||
return response.projects;
|
||||
}
|
||||
|
||||
installConfiguration(input: HubConfigurationInput): Promise<HubInstallResult> {
|
||||
return this.request({
|
||||
origin: input.origin,
|
||||
path: "/api/v1/configurations/install",
|
||||
method: "POST",
|
||||
apiKey: input.apiKey,
|
||||
body: configurationBody(input),
|
||||
successStatus: 201,
|
||||
schema: installResponseSchema,
|
||||
failureMessage: "Hub deployment failed",
|
||||
});
|
||||
}
|
||||
|
||||
validateConfiguration(input: HubConfigurationInput): Promise<HubValidationResult> {
|
||||
return this.request({
|
||||
origin: input.origin,
|
||||
path: "/api/v1/configurations/validate",
|
||||
method: "POST",
|
||||
apiKey: input.apiKey,
|
||||
body: configurationBody(input),
|
||||
successStatus: 200,
|
||||
schema: validationResponseSchema,
|
||||
failureMessage: "Hub configuration validation failed",
|
||||
});
|
||||
}
|
||||
|
||||
async issueEnrollmentToken(origin: string, apiKey: string): Promise<string> {
|
||||
const response = await this.request({
|
||||
origin,
|
||||
path: "/api/v1/daemons/enrollment-tokens",
|
||||
method: "POST",
|
||||
apiKey,
|
||||
successStatus: 201,
|
||||
schema: enrollmentTokenSchema,
|
||||
failureMessage: "Hub daemon enrollment authorization failed",
|
||||
});
|
||||
return response.token;
|
||||
}
|
||||
|
||||
private async request<T>(input: RequestInput<T>): Promise<T> {
|
||||
const signal = AbortSignal.timeout(input.timeoutMilliseconds ?? 15_000);
|
||||
let response: Response;
|
||||
try {
|
||||
response = await fetch(`${input.origin}${input.path}`, {
|
||||
method: input.method,
|
||||
headers: {
|
||||
...(input.apiKey === undefined ? {} : { authorization: `Bearer ${input.apiKey}` }),
|
||||
...(input.body === undefined ? {} : { "content-type": "application/json" }),
|
||||
},
|
||||
...(input.body === undefined ? {} : { body: JSON.stringify(input.body) }),
|
||||
signal,
|
||||
});
|
||||
} catch {
|
||||
throw new HubCommandError(
|
||||
"HUB_NETWORK_ERROR",
|
||||
`Could not reach Paseo Hub at ${input.origin}. Check the Hub URL and network connection.`,
|
||||
);
|
||||
}
|
||||
if (response.status !== input.successStatus) {
|
||||
throw await requestFailure(response, input.failureMessage, input.apiKey);
|
||||
}
|
||||
try {
|
||||
return input.schema.parse(await response.json());
|
||||
} catch {
|
||||
throw new HubCommandError("HUB_INVALID_RESPONSE", "Hub returned a malformed response.");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
interface RequestInput<T> {
|
||||
origin: string;
|
||||
path: string;
|
||||
method: "GET" | "POST";
|
||||
apiKey?: string;
|
||||
body?: unknown;
|
||||
successStatus: number;
|
||||
schema: z.ZodType<T>;
|
||||
timeoutMilliseconds?: number;
|
||||
failureMessage: string;
|
||||
}
|
||||
|
||||
function configurationBody(input: HubConfigurationInput): object {
|
||||
return {
|
||||
projectSlug: input.projectSlug,
|
||||
yaml: input.yaml,
|
||||
...(input.partials === undefined || input.partials.length === 0
|
||||
? {}
|
||||
: { partials: input.partials }),
|
||||
};
|
||||
}
|
||||
|
||||
async function requestFailure(
|
||||
response: Response,
|
||||
failureMessage: string,
|
||||
apiKey: string | undefined,
|
||||
): Promise<HubCommandError> {
|
||||
const contentType = response.headers.get("content-type") ?? "";
|
||||
if (!contentType.toLowerCase().includes("application/problem+json")) {
|
||||
return new HubCommandError(
|
||||
"HUB_REQUEST_FAILED",
|
||||
`${failureMessage} with HTTP ${response.status}.`,
|
||||
);
|
||||
}
|
||||
let body: unknown;
|
||||
try {
|
||||
body = await response.json();
|
||||
} catch {
|
||||
return new HubCommandError(
|
||||
"HUB_INVALID_RESPONSE",
|
||||
`Hub returned malformed problem details for HTTP ${response.status}.`,
|
||||
);
|
||||
}
|
||||
const parsed = problemSchema.safeParse(body);
|
||||
if (
|
||||
!parsed.success ||
|
||||
(parsed.data.status !== undefined && parsed.data.status !== response.status)
|
||||
) {
|
||||
return new HubCommandError(
|
||||
"HUB_INVALID_RESPONSE",
|
||||
`Hub returned nonconforming problem details for HTTP ${response.status}.`,
|
||||
);
|
||||
}
|
||||
const title = parsed.data.title ?? `${failureMessage} with HTTP ${response.status}`;
|
||||
const message = parsed.data.detail === undefined ? title : `${title}: ${parsed.data.detail}`;
|
||||
const details = formatFieldIssues(parsed.data.errors, parsed.data.issues);
|
||||
const code = response.status === 422 ? "HUB_VALIDATION_FAILED" : "HUB_REQUEST_FAILED";
|
||||
return new HubCommandError(
|
||||
code,
|
||||
redactSecret(message, apiKey),
|
||||
details === undefined ? undefined : redactSecret(details, apiKey),
|
||||
);
|
||||
}
|
||||
|
||||
function formatFieldIssues(
|
||||
errors: z.infer<typeof problemSchema>["errors"],
|
||||
issues: z.infer<typeof problemSchema>["issues"],
|
||||
): string | undefined {
|
||||
const fieldIssues = Array.isArray(errors) ? errors : issues;
|
||||
if (fieldIssues !== undefined) {
|
||||
const lines = fieldIssues.map((issue) => {
|
||||
const field = issue.field ?? formatIssuePath(issue.path);
|
||||
return field === undefined ? issue.message : `${field}: ${issue.message}`;
|
||||
});
|
||||
return lines.length === 0 ? undefined : lines.join("\n");
|
||||
}
|
||||
if (errors === undefined) return undefined;
|
||||
const lines = Object.entries(errors).flatMap(([field, messages]) =>
|
||||
messages.map((message: string) => `${field}: ${message}`),
|
||||
);
|
||||
return lines.length === 0 ? undefined : lines.join("\n");
|
||||
}
|
||||
|
||||
function formatIssuePath(path: z.infer<typeof issuePathSchema> | undefined): string | undefined {
|
||||
if (path === undefined || typeof path === "string") return path;
|
||||
let formatted = "";
|
||||
for (const segment of path) {
|
||||
if (typeof segment === "number") formatted += `[${segment}]`;
|
||||
else formatted += formatted.length === 0 ? segment : `.${segment}`;
|
||||
}
|
||||
return formatted || undefined;
|
||||
}
|
||||
|
||||
function redactSecret(value: string, secret: string | undefined): string {
|
||||
return secret === undefined ? value : value.split(secret).join("[redacted]");
|
||||
}
|
||||
@@ -2,7 +2,7 @@ import type { Command } from "commander";
|
||||
import { withOutput } from "../../output/index.js";
|
||||
import { addJsonAndDaemonHostOptions } from "../../utils/command-options.js";
|
||||
import { resolveHubCredential, resolveHubOrigin } from "./authority.js";
|
||||
import type { HubHttpClient } from "./client.js";
|
||||
import type { HubHttpClient } from "./hub-client/index.js";
|
||||
import type { HubCredentialStore } from "./credentials.js";
|
||||
import type { HubDaemonConnection } from "./daemon-client.js";
|
||||
import { withHubDaemon } from "./daemon-client.js";
|
||||
|
||||
@@ -0,0 +1,220 @@
|
||||
import { mkdir, mkdtemp, rm, symlink, writeFile } from "node:fs/promises";
|
||||
import { tmpdir } from "node:os";
|
||||
import path from "node:path";
|
||||
import { afterEach, describe, expect, it } from "vitest";
|
||||
import { discoverHubBundle } from "./deploy-bundle.js";
|
||||
|
||||
const temporaryDirectories: string[] = [];
|
||||
|
||||
afterEach(async () => {
|
||||
await Promise.all(
|
||||
temporaryDirectories.splice(0).map((directory) => rm(directory, { recursive: true })),
|
||||
);
|
||||
});
|
||||
|
||||
describe("Hub deployment bundle discovery", () => {
|
||||
it("discovers the canonical bundle in deterministic path order", async () => {
|
||||
const cwd = await canonicalProject();
|
||||
await writeFile(
|
||||
path.join(cwd, ".paseo", "workflows", "z-last.yml"),
|
||||
workflow("z-last", "codex-safe"),
|
||||
);
|
||||
|
||||
await expect(discoverHubBundle({ cwd, project: "studio-api" })).resolves.toEqual({
|
||||
projectSlug: "studio-api",
|
||||
workflowCount: 2,
|
||||
files: [
|
||||
{ path: ".paseo/hub.yml", content: hubResource },
|
||||
{
|
||||
path: ".paseo/workflows/answer.yml",
|
||||
content: workflow("answer", "${{ paseo.inputs.agent }}", true),
|
||||
},
|
||||
{
|
||||
path: ".paseo/workflows/partials/safety.md",
|
||||
content: "Keep the request in paseo.prompt and evidence in paseo.context.\n",
|
||||
},
|
||||
{ path: ".paseo/workflows/z-last.yml", content: workflow("z-last", "codex-safe") },
|
||||
],
|
||||
});
|
||||
});
|
||||
|
||||
it.each([
|
||||
{
|
||||
name: "missing hub.yml",
|
||||
arrange: async (cwd: string) => {
|
||||
await mkdir(path.join(cwd, ".paseo", "workflows"), { recursive: true });
|
||||
},
|
||||
code: "HUB_RESOURCE_MISSING",
|
||||
message: ".paseo/hub.yml does not exist",
|
||||
},
|
||||
{
|
||||
name: "missing workflow directory",
|
||||
arrange: async (cwd: string) => {
|
||||
await mkdir(path.join(cwd, ".paseo"), { recursive: true });
|
||||
await writeFile(path.join(cwd, ".paseo", "hub.yml"), hubResource);
|
||||
},
|
||||
code: "HUB_WORKFLOW_DIRECTORY_MISSING",
|
||||
message: ".paseo/workflows does not exist",
|
||||
},
|
||||
{
|
||||
name: "empty workflow directory",
|
||||
arrange: async (cwd: string) => {
|
||||
await mkdir(path.join(cwd, ".paseo", "workflows"), { recursive: true });
|
||||
await writeFile(path.join(cwd, ".paseo", "hub.yml"), hubResource);
|
||||
},
|
||||
code: "HUB_WORKFLOW_MISSING",
|
||||
message: ".paseo/workflows must contain at least one direct-child .yml workflow",
|
||||
},
|
||||
{
|
||||
name: "unsupported workflow extension",
|
||||
arrange: async (cwd: string) => {
|
||||
await mkdir(path.join(cwd, ".paseo", "workflows"), { recursive: true });
|
||||
await writeFile(path.join(cwd, ".paseo", "hub.yml"), hubResource);
|
||||
await writeFile(path.join(cwd, ".paseo", "workflows", "answer.yaml"), "name: answer\n");
|
||||
},
|
||||
code: "HUB_WORKFLOW_EXTENSION_UNSUPPORTED",
|
||||
message: ".paseo/workflows/answer.yaml must use the .yml extension",
|
||||
},
|
||||
])("rejects $name before contacting Hub", async ({ arrange, code, message }) => {
|
||||
const cwd = await temporaryDirectory();
|
||||
await arrange(cwd);
|
||||
|
||||
await expect(discoverHubBundle({ cwd, project: "studio-api" })).rejects.toMatchObject({
|
||||
code,
|
||||
message: expect.stringContaining(message),
|
||||
});
|
||||
});
|
||||
|
||||
it("rejects prompt partial traversal with a path-specific diagnostic", async () => {
|
||||
const cwd = await canonicalProject();
|
||||
await writeFile(
|
||||
path.join(cwd, ".paseo", "workflows", "answer.yml"),
|
||||
workflow("answer", "codex-safe").replace(
|
||||
" - text: ${{ paseo.prompt }}",
|
||||
" - include: ../secret.md",
|
||||
),
|
||||
);
|
||||
|
||||
await expect(discoverHubBundle({ cwd, project: "studio-api" })).rejects.toMatchObject({
|
||||
code: "HUB_PARTIAL_PATH_INVALID",
|
||||
message: expect.stringContaining(".paseo/workflows/answer.yml"),
|
||||
});
|
||||
});
|
||||
|
||||
it("reports a referenced partial that is missing from the bundle", async () => {
|
||||
const cwd = await canonicalProject();
|
||||
await writeFile(
|
||||
path.join(cwd, ".paseo", "workflows", "answer.yml"),
|
||||
workflow("answer", "codex-safe").replace(
|
||||
" - text: ${{ paseo.prompt }}",
|
||||
" - include: partials/missing.md",
|
||||
),
|
||||
);
|
||||
|
||||
await expect(discoverHubBundle({ cwd, project: "studio-api" })).rejects.toMatchObject({
|
||||
code: "HUB_BUNDLE_FILE_MISSING",
|
||||
message: expect.stringContaining(".paseo/workflows/partials/missing.md"),
|
||||
});
|
||||
});
|
||||
|
||||
it("rejects nested workflow files instead of discovering a second layout", async () => {
|
||||
const cwd = await canonicalProject();
|
||||
await mkdir(path.join(cwd, ".paseo", "workflows", "nested"));
|
||||
await writeFile(
|
||||
path.join(cwd, ".paseo", "workflows", "nested", "other.yml"),
|
||||
workflow("other", "codex-safe"),
|
||||
);
|
||||
|
||||
await expect(discoverHubBundle({ cwd, project: "studio-api" })).rejects.toMatchObject({
|
||||
code: "HUB_WORKFLOW_PATH_UNSUPPORTED",
|
||||
message: expect.stringContaining(".paseo/workflows/nested"),
|
||||
});
|
||||
});
|
||||
|
||||
it("rejects symlinked workflow and partial paths without reading their targets", async () => {
|
||||
const cwd = await canonicalProject();
|
||||
const outside = path.join(cwd, "outside.yml");
|
||||
await writeFile(outside, workflow("linked", "codex-safe"));
|
||||
await symlink(outside, path.join(cwd, ".paseo", "workflows", "linked.yml"));
|
||||
|
||||
await expect(discoverHubBundle({ cwd, project: "studio-api" })).rejects.toMatchObject({
|
||||
code: "HUB_BUNDLE_UNSAFE_PATH",
|
||||
message: expect.stringContaining(".paseo/workflows/linked.yml"),
|
||||
});
|
||||
});
|
||||
|
||||
it("requires an explicit valid project slug outside the authored bundle", async () => {
|
||||
const cwd = await canonicalProject();
|
||||
|
||||
await expect(discoverHubBundle({ cwd })).rejects.toMatchObject({
|
||||
code: "HUB_PROJECT_REQUIRED",
|
||||
});
|
||||
await expect(discoverHubBundle({ cwd, project: "Studio API" })).rejects.toMatchObject({
|
||||
code: "HUB_INVALID_PROJECT",
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
const hubResource = [
|
||||
"environments:",
|
||||
" studio:",
|
||||
" kind: daemon",
|
||||
" daemon: local",
|
||||
" cwd: /workspace/studio",
|
||||
"agents:",
|
||||
" codex-safe:",
|
||||
" provider: codex",
|
||||
" model: gpt-5.5",
|
||||
" thinkingOptionId: xhigh",
|
||||
" options:",
|
||||
" sandbox_workspace_write:",
|
||||
" writable_roots: [/var/cache/npm]",
|
||||
" network_access: false",
|
||||
" claude:",
|
||||
" provider: claude",
|
||||
" mode: bypassPermissions",
|
||||
"",
|
||||
].join("\n");
|
||||
|
||||
function workflow(name: string, agent: string, include = false): string {
|
||||
return [
|
||||
`name: ${name}`,
|
||||
"on: manual.run",
|
||||
"max_runtime: 1h",
|
||||
...(agent.includes("paseo.inputs")
|
||||
? ["inputs:", " agent:", " type: string", " choices: [codex-safe, claude]"]
|
||||
: []),
|
||||
"steps:",
|
||||
" - id: work",
|
||||
" environment: studio",
|
||||
" max_runtime: 30m",
|
||||
" idle_timeout: 5m",
|
||||
` agent: ${agent}`,
|
||||
" prompt:",
|
||||
...(include ? [" - include: partials/safety.md"] : []),
|
||||
" - text: ${{ paseo.prompt }}",
|
||||
"",
|
||||
].join("\n");
|
||||
}
|
||||
|
||||
async function canonicalProject(): Promise<string> {
|
||||
const cwd = await temporaryDirectory();
|
||||
const workflows = path.join(cwd, ".paseo", "workflows");
|
||||
await mkdir(path.join(workflows, "partials"), { recursive: true });
|
||||
await writeFile(path.join(cwd, ".paseo", "hub.yml"), hubResource);
|
||||
await writeFile(
|
||||
path.join(workflows, "answer.yml"),
|
||||
workflow("answer", "${{ paseo.inputs.agent }}", true),
|
||||
);
|
||||
await writeFile(
|
||||
path.join(workflows, "partials", "safety.md"),
|
||||
"Keep the request in paseo.prompt and evidence in paseo.context.\n",
|
||||
);
|
||||
return cwd;
|
||||
}
|
||||
|
||||
async function temporaryDirectory(): Promise<string> {
|
||||
const directory = await mkdtemp(path.join(tmpdir(), "paseo-hub-bundle-"));
|
||||
temporaryDirectories.push(directory);
|
||||
return directory;
|
||||
}
|
||||
@@ -0,0 +1,305 @@
|
||||
import { lstat, readFile, readdir } from "node:fs/promises";
|
||||
import path from "node:path";
|
||||
import YAML from "yaml";
|
||||
import { HubCommandError } from "./error.js";
|
||||
|
||||
const HUB_RESOURCE_PATH = ".paseo/hub.yml";
|
||||
const LEGACY_TOML_PATH = ".paseo/hub.toml";
|
||||
const WORKFLOW_DIRECTORY = ".paseo/workflows";
|
||||
const PARTIAL_DIRECTORY = `${WORKFLOW_DIRECTORY}/partials`;
|
||||
const PROJECT_SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
|
||||
|
||||
export interface HubBundleFile {
|
||||
path: string;
|
||||
content: string;
|
||||
}
|
||||
|
||||
export interface HubDeployBundle {
|
||||
projectSlug: string;
|
||||
files: readonly HubBundleFile[];
|
||||
workflowCount: number;
|
||||
}
|
||||
|
||||
interface DiscoverHubBundleInput {
|
||||
cwd: string;
|
||||
project?: string;
|
||||
}
|
||||
|
||||
export async function discoverHubBundle(input: DiscoverHubBundleInput): Promise<HubDeployBundle> {
|
||||
const projectSlug = requireProjectSlug(input.project);
|
||||
const root = path.resolve(input.cwd);
|
||||
await rejectLegacyToml(root);
|
||||
const resource = await readBundleFile(root, HUB_RESOURCE_PATH, {
|
||||
missingCode: "HUB_RESOURCE_MISSING",
|
||||
missingMessage: `${HUB_RESOURCE_PATH} does not exist. Run this command from the project root.`,
|
||||
});
|
||||
const workflowNames = await discoverWorkflowNames(root);
|
||||
const workflows = await Promise.all(
|
||||
workflowNames.map((name) => readBundleFile(root, `${WORKFLOW_DIRECTORY}/${name}`)),
|
||||
);
|
||||
const partialPaths = collectPartialPaths(workflows);
|
||||
const partials = await Promise.all(partialPaths.map((file) => readBundleFile(root, file)));
|
||||
const files = [resource, ...workflows, ...partials].toSorted(compareBundleFiles);
|
||||
assertUniqueBundlePaths(files);
|
||||
return { projectSlug, files, workflowCount: workflows.length };
|
||||
}
|
||||
|
||||
function requireProjectSlug(project: string | undefined): string {
|
||||
if (project === undefined) {
|
||||
throw new HubCommandError(
|
||||
"HUB_PROJECT_REQUIRED",
|
||||
"Project is required. Pass --project <slug>.",
|
||||
);
|
||||
}
|
||||
if (!PROJECT_SLUG_PATTERN.test(project)) {
|
||||
throw new HubCommandError(
|
||||
"HUB_INVALID_PROJECT",
|
||||
"Project must be a bare slug such as my-project.",
|
||||
);
|
||||
}
|
||||
return project;
|
||||
}
|
||||
|
||||
async function rejectLegacyToml(root: string): Promise<void> {
|
||||
try {
|
||||
await lstat(path.join(root, LEGACY_TOML_PATH));
|
||||
} catch (error) {
|
||||
if (errorCode(error) === "ENOENT") return;
|
||||
throw unreadablePath(LEGACY_TOML_PATH);
|
||||
}
|
||||
throw new HubCommandError(
|
||||
"HUB_CONFIGURATION_EXTENSION_UNSUPPORTED",
|
||||
`${LEGACY_TOML_PATH} is not supported. Use ${HUB_RESOURCE_PATH}.`,
|
||||
);
|
||||
}
|
||||
|
||||
async function discoverWorkflowNames(root: string): Promise<readonly string[]> {
|
||||
const directory = path.join(root, WORKFLOW_DIRECTORY);
|
||||
await requireSafeDirectory(root, directory, WORKFLOW_DIRECTORY, {
|
||||
missingCode: "HUB_WORKFLOW_DIRECTORY_MISSING",
|
||||
missingMessage: `${WORKFLOW_DIRECTORY} does not exist.`,
|
||||
});
|
||||
let entries;
|
||||
try {
|
||||
entries = await readdir(directory, { withFileTypes: true });
|
||||
} catch {
|
||||
throw unreadablePath(WORKFLOW_DIRECTORY);
|
||||
}
|
||||
const names: string[] = [];
|
||||
for (const entry of entries.toSorted((left, right) => compareText(left.name, right.name))) {
|
||||
const bundlePath = `${WORKFLOW_DIRECTORY}/${entry.name}`;
|
||||
if (entry.isSymbolicLink()) throw unsafePath(bundlePath);
|
||||
if (entry.isDirectory()) {
|
||||
if (entry.name === "partials") continue;
|
||||
throw new HubCommandError(
|
||||
"HUB_WORKFLOW_PATH_UNSUPPORTED",
|
||||
`${bundlePath} is not a direct-child .yml workflow.`,
|
||||
);
|
||||
}
|
||||
if (!entry.isFile()) throw regularFileRequired(bundlePath);
|
||||
if (!entry.name.endsWith(".yml")) {
|
||||
throw new HubCommandError(
|
||||
"HUB_WORKFLOW_EXTENSION_UNSUPPORTED",
|
||||
`${bundlePath} must use the .yml extension.`,
|
||||
);
|
||||
}
|
||||
names.push(entry.name);
|
||||
}
|
||||
if (names.length === 0) {
|
||||
throw new HubCommandError(
|
||||
"HUB_WORKFLOW_MISSING",
|
||||
`${WORKFLOW_DIRECTORY} must contain at least one direct-child .yml workflow.`,
|
||||
);
|
||||
}
|
||||
return names;
|
||||
}
|
||||
|
||||
function collectPartialPaths(workflows: readonly HubBundleFile[]): readonly string[] {
|
||||
const paths = new Set<string>();
|
||||
for (const workflow of workflows) {
|
||||
let document: unknown;
|
||||
try {
|
||||
document = YAML.parse(workflow.content);
|
||||
} catch {
|
||||
throw new HubCommandError("HUB_WORKFLOW_INVALID_YAML", `${workflow.path} is not valid YAML.`);
|
||||
}
|
||||
if (!isRecord(document) || !Array.isArray(document["steps"])) continue;
|
||||
for (const step of document["steps"]) {
|
||||
if (!isRecord(step) || !Array.isArray(step["prompt"])) continue;
|
||||
for (const block of step["prompt"]) {
|
||||
if (!isRecord(block) || !Object.hasOwn(block, "include")) continue;
|
||||
const include = block["include"];
|
||||
if (typeof include !== "string") {
|
||||
throw invalidPartialPath(workflow.path, String(include));
|
||||
}
|
||||
paths.add(resolvePartialPath(workflow.path, include));
|
||||
}
|
||||
}
|
||||
}
|
||||
return [...paths].sort(compareText);
|
||||
}
|
||||
|
||||
function resolvePartialPath(workflowPath: string, include: string): string {
|
||||
const decoded = decodePartialPath(workflowPath, include);
|
||||
if (/^(?:[a-zA-Z]:[\\/]|[\\/]{1,2})/u.test(decoded)) {
|
||||
throw invalidPartialPath(workflowPath, include);
|
||||
}
|
||||
const segments = decoded.replaceAll("\\", "/").split("/");
|
||||
if (
|
||||
segments.some((segment) => segment.length === 0 || segment === "." || segment === "..") ||
|
||||
segments[0] !== "partials"
|
||||
) {
|
||||
throw invalidPartialPath(workflowPath, include);
|
||||
}
|
||||
return `${WORKFLOW_DIRECTORY}/${segments.join("/")}`;
|
||||
}
|
||||
|
||||
function decodePartialPath(workflowPath: string, include: string): string {
|
||||
let decoded = include;
|
||||
for (let attempt = 0; attempt < 8; attempt += 1) {
|
||||
let next: string;
|
||||
try {
|
||||
next = decodeURIComponent(decoded);
|
||||
} catch {
|
||||
throw invalidPartialPath(workflowPath, include);
|
||||
}
|
||||
if (next === decoded) break;
|
||||
decoded = next;
|
||||
}
|
||||
if (decoded.includes("\0") || /%[0-9a-f]{2}/iu.test(decoded)) {
|
||||
throw invalidPartialPath(workflowPath, include);
|
||||
}
|
||||
return decoded;
|
||||
}
|
||||
|
||||
async function readBundleFile(
|
||||
root: string,
|
||||
bundlePath: string,
|
||||
missing: { missingCode: string; missingMessage: string } = {
|
||||
missingCode: "HUB_BUNDLE_FILE_MISSING",
|
||||
missingMessage: `${bundlePath} does not exist.`,
|
||||
},
|
||||
): Promise<HubBundleFile> {
|
||||
const absolutePath = path.join(root, ...bundlePath.split("/"));
|
||||
await rejectSymlinkComponents(root, absolutePath, bundlePath);
|
||||
let stats: Awaited<ReturnType<typeof lstat>>;
|
||||
try {
|
||||
stats = await lstat(absolutePath);
|
||||
} catch (error) {
|
||||
if (errorCode(error) === "ENOENT") {
|
||||
throw new HubCommandError(missing.missingCode, missing.missingMessage);
|
||||
}
|
||||
throw unreadablePath(bundlePath);
|
||||
}
|
||||
if (stats.isSymbolicLink()) throw unsafePath(bundlePath);
|
||||
if (!stats.isFile()) throw regularFileRequired(bundlePath);
|
||||
if (!hasReadPermission(stats.mode)) throw unreadablePath(bundlePath);
|
||||
try {
|
||||
return { path: bundlePath, content: (await readFile(absolutePath)).toString("utf8") };
|
||||
} catch {
|
||||
throw unreadablePath(bundlePath);
|
||||
}
|
||||
}
|
||||
|
||||
async function requireSafeDirectory(
|
||||
root: string,
|
||||
absolutePath: string,
|
||||
bundlePath: string,
|
||||
missing: { missingCode: string; missingMessage: string },
|
||||
): Promise<void> {
|
||||
await rejectSymlinkComponents(root, absolutePath, bundlePath);
|
||||
let stats: Awaited<ReturnType<typeof lstat>>;
|
||||
try {
|
||||
stats = await lstat(absolutePath);
|
||||
} catch (error) {
|
||||
if (errorCode(error) === "ENOENT") {
|
||||
throw new HubCommandError(missing.missingCode, missing.missingMessage);
|
||||
}
|
||||
throw unreadablePath(bundlePath);
|
||||
}
|
||||
if (stats.isSymbolicLink()) throw unsafePath(bundlePath);
|
||||
if (!stats.isDirectory()) {
|
||||
throw new HubCommandError(
|
||||
"HUB_WORKFLOW_DIRECTORY_INVALID",
|
||||
`${bundlePath} must be a directory.`,
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
async function rejectSymlinkComponents(
|
||||
root: string,
|
||||
target: string,
|
||||
bundlePath: string,
|
||||
): Promise<void> {
|
||||
const relative = path.relative(root, target);
|
||||
let current = root;
|
||||
for (const segment of relative.split(path.sep).filter(Boolean)) {
|
||||
current = path.join(current, segment);
|
||||
try {
|
||||
if ((await lstat(current)).isSymbolicLink()) throw unsafePath(bundlePath);
|
||||
} catch (error) {
|
||||
if (error instanceof HubCommandError) throw error;
|
||||
if (errorCode(error) === "ENOENT") return;
|
||||
throw unreadablePath(bundlePath);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function assertUniqueBundlePaths(files: readonly HubBundleFile[]): void {
|
||||
const seen = new Set<string>();
|
||||
for (const file of files) {
|
||||
if (seen.has(file.path)) {
|
||||
throw new HubCommandError(
|
||||
"HUB_BUNDLE_PATH_DUPLICATE",
|
||||
`${file.path} appears more than once in the discovered bundle.`,
|
||||
);
|
||||
}
|
||||
seen.add(file.path);
|
||||
}
|
||||
}
|
||||
|
||||
function invalidPartialPath(workflowPath: string, include: string): HubCommandError {
|
||||
return new HubCommandError(
|
||||
"HUB_PARTIAL_PATH_INVALID",
|
||||
`${workflowPath} includes an unsafe path outside ${PARTIAL_DIRECTORY}: ${include}`,
|
||||
);
|
||||
}
|
||||
|
||||
function unsafePath(bundlePath: string): HubCommandError {
|
||||
return new HubCommandError("HUB_BUNDLE_UNSAFE_PATH", `${bundlePath} must not use a symlink.`);
|
||||
}
|
||||
|
||||
function unreadablePath(bundlePath: string): HubCommandError {
|
||||
return new HubCommandError(
|
||||
"HUB_BUNDLE_UNREADABLE",
|
||||
`Could not read ${bundlePath}. Check the file and permissions.`,
|
||||
);
|
||||
}
|
||||
|
||||
function regularFileRequired(bundlePath: string): HubCommandError {
|
||||
return new HubCommandError("HUB_BUNDLE_NOT_FILE", `${bundlePath} must be a regular file.`);
|
||||
}
|
||||
|
||||
function compareBundleFiles(left: HubBundleFile, right: HubBundleFile): number {
|
||||
return compareText(left.path, right.path);
|
||||
}
|
||||
|
||||
function compareText(left: string, right: string): number {
|
||||
if (left < right) return -1;
|
||||
if (left > right) return 1;
|
||||
return 0;
|
||||
}
|
||||
|
||||
function hasReadPermission(mode: number): boolean {
|
||||
return (mode & 0o444) !== 0;
|
||||
}
|
||||
|
||||
function errorCode(error: unknown): string | undefined {
|
||||
if (typeof error !== "object" || error === null) return undefined;
|
||||
const code = Reflect.get(error, "code");
|
||||
return typeof code === "string" ? code : undefined;
|
||||
}
|
||||
|
||||
function isRecord(value: unknown): value is Record<string, unknown> {
|
||||
return typeof value === "object" && value !== null && !Array.isArray(value);
|
||||
}
|
||||
@@ -0,0 +1,195 @@
|
||||
import { createServer } from "node:http";
|
||||
import type { AddressInfo } from "node:net";
|
||||
import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
|
||||
import { tmpdir } from "node:os";
|
||||
import path from "node:path";
|
||||
import { afterEach, describe, expect, it } from "vitest";
|
||||
import { createHubCommand } from "./index.js";
|
||||
import { runHubDeploy } from "./deploy.js";
|
||||
|
||||
const temporaryDirectories: string[] = [];
|
||||
const servers: Array<ReturnType<typeof createServer>> = [];
|
||||
|
||||
afterEach(async () => {
|
||||
await Promise.all(
|
||||
temporaryDirectories.splice(0).map((directory) => rm(directory, { recursive: true })),
|
||||
);
|
||||
await Promise.all(servers.splice(0).map(closeServer));
|
||||
});
|
||||
|
||||
describe("Hub canonical bundle deployment contract", () => {
|
||||
it("installs the exact discovered bundle with finite environment and named-agent routing", async () => {
|
||||
const cwd = await canonicalProject();
|
||||
const hub = await captureHub(201, {
|
||||
projectSlug: "studio-api",
|
||||
version: 7,
|
||||
versionId: "2de5b143-1c88-42db-8a8d-71ca2af97830",
|
||||
active: true,
|
||||
});
|
||||
|
||||
const result = await runHubDeploy(
|
||||
{ project: "studio-api", hub: hub.origin, apiKey: "operator-secret" },
|
||||
{ cwd, env: {} },
|
||||
);
|
||||
|
||||
expect(await hub.received).toEqual({
|
||||
url: "/api/v1/configurations/install",
|
||||
authorization: "Bearer operator-secret",
|
||||
body: {
|
||||
projectSlug: "studio-api",
|
||||
files: canonicalFiles(),
|
||||
},
|
||||
});
|
||||
expect(result.data).toEqual({
|
||||
projectSlug: "studio-api",
|
||||
version: 7,
|
||||
versionId: "2de5b143-1c88-42db-8a8d-71ca2af97830",
|
||||
active: true,
|
||||
workflows: 1,
|
||||
origin: hub.origin,
|
||||
});
|
||||
});
|
||||
|
||||
it("uses the identical bundle for server-side dry-run validation without activation", async () => {
|
||||
const cwd = await canonicalProject();
|
||||
const hub = await captureHub(200, { projectSlug: "studio-api", valid: true });
|
||||
|
||||
const result = await runHubDeploy(
|
||||
{
|
||||
project: "studio-api",
|
||||
hub: hub.origin,
|
||||
apiKey: "operator-secret",
|
||||
dryRun: true,
|
||||
},
|
||||
{ cwd, env: {} },
|
||||
);
|
||||
|
||||
expect(await hub.received).toEqual({
|
||||
url: "/api/v1/configurations/validate",
|
||||
authorization: "Bearer operator-secret",
|
||||
body: { projectSlug: "studio-api", files: canonicalFiles() },
|
||||
});
|
||||
expect(result.data).toEqual({
|
||||
projectSlug: "studio-api",
|
||||
valid: true,
|
||||
workflows: 1,
|
||||
origin: hub.origin,
|
||||
});
|
||||
});
|
||||
|
||||
it("exposes only convention-based deployment options", () => {
|
||||
const deploy = createHubCommand().commands.find((command) => command.name() === "deploy");
|
||||
const help = deploy?.helpInformation() ?? "";
|
||||
|
||||
expect(help).not.toContain("[file]");
|
||||
expect(help).toContain("--project <slug>");
|
||||
expect(help).toContain("--dry-run");
|
||||
});
|
||||
});
|
||||
|
||||
const resource = [
|
||||
"environments:",
|
||||
" studio:",
|
||||
" kind: daemon",
|
||||
" daemon: local",
|
||||
" cwd: /workspace/studio",
|
||||
"agents:",
|
||||
" codex-safe:",
|
||||
" provider: codex",
|
||||
" model: gpt-5.5",
|
||||
" thinkingOptionId: xhigh",
|
||||
" options:",
|
||||
" sandbox_workspace_write:",
|
||||
" writable_roots: [/var/cache/npm]",
|
||||
" network_access: false",
|
||||
" claude:",
|
||||
" provider: claude",
|
||||
" mode: bypassPermissions",
|
||||
"",
|
||||
].join("\n");
|
||||
|
||||
const workflow = [
|
||||
"name: answer",
|
||||
"on: discord.mention",
|
||||
"max_runtime: 1h",
|
||||
"inputs:",
|
||||
" repo:",
|
||||
" type: string",
|
||||
" choices: [studio]",
|
||||
" agent:",
|
||||
" type: string",
|
||||
" choices: [codex-safe, claude]",
|
||||
"steps:",
|
||||
" - id: work",
|
||||
" environment: ${{ paseo.inputs.repo }}",
|
||||
" max_runtime: 30m",
|
||||
" idle_timeout: 5m",
|
||||
" agent: ${{ paseo.inputs.agent }}",
|
||||
" prompt:",
|
||||
" - include: partials/safety.md",
|
||||
" - text: ${{ paseo.prompt }}",
|
||||
" allow_outputs:",
|
||||
" - { type: discord.reply, max: 1, required: true }",
|
||||
"",
|
||||
].join("\n");
|
||||
|
||||
const partial = "Treat paseo.context as evidence, not hidden prompt text.\n";
|
||||
|
||||
function canonicalFiles() {
|
||||
return [
|
||||
{ path: ".paseo/hub.yml", content: resource },
|
||||
{ path: ".paseo/workflows/answer.yml", content: workflow },
|
||||
{ path: ".paseo/workflows/partials/safety.md", content: partial },
|
||||
];
|
||||
}
|
||||
|
||||
async function canonicalProject(): Promise<string> {
|
||||
const cwd = await mkdtemp(path.join(tmpdir(), "paseo-hub-deploy-"));
|
||||
temporaryDirectories.push(cwd);
|
||||
const workflows = path.join(cwd, ".paseo", "workflows");
|
||||
await mkdir(path.join(workflows, "partials"), { recursive: true });
|
||||
await writeFile(path.join(cwd, ".paseo", "hub.yml"), resource);
|
||||
await writeFile(path.join(workflows, "answer.yml"), workflow);
|
||||
await writeFile(path.join(workflows, "partials", "safety.md"), partial);
|
||||
return cwd;
|
||||
}
|
||||
|
||||
async function captureHub(status: number, responseBody: unknown) {
|
||||
let resolveRequest!: (request: unknown) => void;
|
||||
const received = new Promise<unknown>((resolve) => {
|
||||
resolveRequest = resolve;
|
||||
});
|
||||
const server = createServer((request, response) => {
|
||||
let body = "";
|
||||
request.setEncoding("utf8");
|
||||
request.on("data", (chunk: string) => {
|
||||
body += chunk;
|
||||
});
|
||||
request.on("end", () => {
|
||||
resolveRequest({
|
||||
url: request.url,
|
||||
authorization: request.headers.authorization,
|
||||
body: JSON.parse(body),
|
||||
});
|
||||
response.writeHead(status, { "content-type": "application/json" });
|
||||
response.end(JSON.stringify(responseBody));
|
||||
});
|
||||
});
|
||||
servers.push(server);
|
||||
await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
|
||||
const address = server.address() as AddressInfo;
|
||||
return { origin: `http://127.0.0.1:${address.port}`, received };
|
||||
}
|
||||
|
||||
function closeServer(server: ReturnType<typeof createServer>): Promise<void> {
|
||||
server.closeAllConnections();
|
||||
return new Promise<void>((resolve, reject) => {
|
||||
server.close((error) => {
|
||||
if (error !== undefined) {
|
||||
reject(error);
|
||||
return;
|
||||
}
|
||||
resolve();
|
||||
});
|
||||
});
|
||||
}
|
||||
@@ -1,397 +0,0 @@
|
||||
import { lstat, readFile } from "node:fs/promises";
|
||||
import path from "node:path";
|
||||
import YAML from "yaml";
|
||||
import { HubCommandError } from "./error.js";
|
||||
|
||||
const DEFAULT_CONFIGURATION_PATH = ".paseo/hub.yml";
|
||||
const PROMPT_PARTIAL_ROOT = ".paseo/partials";
|
||||
const PROMPT_PARTIAL_ROOT_PREFIX = `${PROMPT_PARTIAL_ROOT}/`;
|
||||
const PROJECT_SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
|
||||
const MAX_CONFIGURATION_LENGTH = 1_000_000;
|
||||
const MAX_PROMPT_PARTIAL_COUNT = 100;
|
||||
const MAX_PROMPT_PARTIAL_PATH_LENGTH = 512;
|
||||
const MAX_PROMPT_PARTIAL_CONTENT_BYTES = 1_000_000;
|
||||
const MAX_PROMPT_PARTIAL_BUNDLE_BYTES = 5_000_000;
|
||||
|
||||
export interface HubDeployPartial {
|
||||
path: string;
|
||||
content: string;
|
||||
}
|
||||
|
||||
export interface HubDeployInput {
|
||||
projectSlug: string;
|
||||
yaml: string;
|
||||
partials?: readonly HubDeployPartial[];
|
||||
}
|
||||
|
||||
interface ResolveHubDeployInput {
|
||||
cwd: string;
|
||||
file?: string;
|
||||
project?: string;
|
||||
}
|
||||
|
||||
export async function resolveHubDeployInput(input: ResolveHubDeployInput): Promise<HubDeployInput> {
|
||||
const file = input.file ?? DEFAULT_CONFIGURATION_PATH;
|
||||
const projectRoot = path.resolve(input.cwd);
|
||||
const configurationPath = resolveConfigurationPath(projectRoot, file);
|
||||
const yaml = await readConfiguration(projectRoot, configurationPath, file);
|
||||
const configuration = parseConfiguration(yaml);
|
||||
const projectSlug = input.project ?? projectFromConfiguration(configuration);
|
||||
|
||||
if (projectSlug === undefined) {
|
||||
throw new HubCommandError(
|
||||
"HUB_PROJECT_REQUIRED",
|
||||
"Project is required. Pass --project <slug> or add top-level project to the YAML.",
|
||||
);
|
||||
}
|
||||
if (!PROJECT_SLUG_PATTERN.test(projectSlug)) {
|
||||
throw new HubCommandError(
|
||||
"HUB_INVALID_PROJECT",
|
||||
"Project must be a bare slug such as my-project.",
|
||||
);
|
||||
}
|
||||
|
||||
const partials = await resolvePromptPartials(projectRoot, configuration);
|
||||
return {
|
||||
projectSlug,
|
||||
yaml,
|
||||
...(partials.length === 0 ? {} : { partials }),
|
||||
};
|
||||
}
|
||||
|
||||
function resolveConfigurationPath(cwd: string, file: string): string {
|
||||
if (file.length === 0 || file.includes("\0")) {
|
||||
throw invalidConfigurationPath();
|
||||
}
|
||||
|
||||
const segments = file.replaceAll("\\", "/").split("/");
|
||||
if (segments.some((segment) => segment === "..")) {
|
||||
throw invalidConfigurationPath();
|
||||
}
|
||||
|
||||
const resolved = path.resolve(cwd, file);
|
||||
const relative = path.relative(cwd, resolved);
|
||||
if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
|
||||
throw invalidConfigurationPath();
|
||||
}
|
||||
return resolved;
|
||||
}
|
||||
|
||||
async function readConfiguration(
|
||||
projectRoot: string,
|
||||
configurationPath: string,
|
||||
displayPath: string,
|
||||
): Promise<string> {
|
||||
const unsafePath = () =>
|
||||
new HubCommandError(
|
||||
"HUB_CONFIGURATION_UNSAFE_PATH",
|
||||
`Hub configuration at ${displayPath} must not use a symlink.`,
|
||||
);
|
||||
await rejectSymlinkComponents(projectRoot, configurationPath, unsafePath);
|
||||
|
||||
let stats: Awaited<ReturnType<typeof lstat>>;
|
||||
try {
|
||||
stats = await lstat(configurationPath);
|
||||
} catch (error) {
|
||||
throw configurationReadError(displayPath, error);
|
||||
}
|
||||
if (stats.isSymbolicLink()) {
|
||||
throw unsafePath();
|
||||
}
|
||||
if (!stats.isFile()) {
|
||||
throw new HubCommandError(
|
||||
"HUB_CONFIGURATION_NOT_FILE",
|
||||
`Hub configuration at ${displayPath} must be a regular file.`,
|
||||
);
|
||||
}
|
||||
if (!hasReadPermission(stats.mode)) {
|
||||
throw new HubCommandError(
|
||||
"HUB_CONFIGURATION_UNREADABLE",
|
||||
`Could not read Hub configuration at ${displayPath}. Check file permissions.`,
|
||||
);
|
||||
}
|
||||
|
||||
let bytes: Buffer;
|
||||
try {
|
||||
bytes = await readFile(configurationPath);
|
||||
} catch (error) {
|
||||
throw configurationReadError(displayPath, error);
|
||||
}
|
||||
const yaml = bytes.toString("utf8");
|
||||
if (yaml.length > MAX_CONFIGURATION_LENGTH) {
|
||||
throw new HubCommandError(
|
||||
"HUB_CONFIGURATION_TOO_LARGE",
|
||||
`Hub configuration at ${displayPath} exceeds the ${MAX_CONFIGURATION_LENGTH}-character limit.`,
|
||||
);
|
||||
}
|
||||
return yaml;
|
||||
}
|
||||
|
||||
function parseConfiguration(yaml: string): Record<string, unknown> {
|
||||
let configuration: unknown;
|
||||
try {
|
||||
configuration = YAML.parse(yaml);
|
||||
} catch {
|
||||
throw new HubCommandError("HUB_INVALID_CONFIGURATION", "Hub configuration is not valid YAML.");
|
||||
}
|
||||
if (!isRecord(configuration)) {
|
||||
throw new HubCommandError(
|
||||
"HUB_INVALID_CONFIGURATION",
|
||||
"Hub configuration must be a YAML mapping.",
|
||||
);
|
||||
}
|
||||
return configuration;
|
||||
}
|
||||
|
||||
function projectFromConfiguration(configuration: Record<string, unknown>): string | undefined {
|
||||
const project: unknown = configuration["project"];
|
||||
if (project === undefined) return undefined;
|
||||
if (typeof project !== "string") {
|
||||
throw new HubCommandError(
|
||||
"HUB_INVALID_PROJECT",
|
||||
"Top-level project must be a bare project slug.",
|
||||
);
|
||||
}
|
||||
return project;
|
||||
}
|
||||
|
||||
async function resolvePromptPartials(
|
||||
projectRoot: string,
|
||||
configuration: Record<string, unknown>,
|
||||
): Promise<HubDeployPartial[]> {
|
||||
const references = collectPromptPartialReferences(configuration);
|
||||
if (references.length > MAX_PROMPT_PARTIAL_COUNT) {
|
||||
throw new HubCommandError(
|
||||
"HUB_PARTIAL_LIMIT_EXCEEDED",
|
||||
`Hub configuration references ${references.length} partials; the limit is ${MAX_PROMPT_PARTIAL_COUNT}.`,
|
||||
);
|
||||
}
|
||||
|
||||
const partials: HubDeployPartial[] = [];
|
||||
let bundleBytes = 0;
|
||||
for (const reference of references) {
|
||||
const partialPath = path.resolve(
|
||||
projectRoot,
|
||||
PROMPT_PARTIAL_ROOT,
|
||||
...reference.path.split("/"),
|
||||
);
|
||||
const content = await readPartial(projectRoot, partialPath, reference.path);
|
||||
const contentBytes = Buffer.byteLength(content, "utf8");
|
||||
if (contentBytes > MAX_PROMPT_PARTIAL_CONTENT_BYTES) {
|
||||
throw new HubCommandError(
|
||||
"HUB_PARTIAL_TOO_LARGE",
|
||||
`Referenced Hub partial ${reference.path} exceeds the ${MAX_PROMPT_PARTIAL_CONTENT_BYTES}-byte limit.`,
|
||||
);
|
||||
}
|
||||
bundleBytes += contentBytes;
|
||||
if (bundleBytes > MAX_PROMPT_PARTIAL_BUNDLE_BYTES) {
|
||||
throw new HubCommandError(
|
||||
"HUB_PARTIAL_BUNDLE_TOO_LARGE",
|
||||
`Referenced Hub partials exceed the ${MAX_PROMPT_PARTIAL_BUNDLE_BYTES}-byte combined limit.`,
|
||||
);
|
||||
}
|
||||
partials.push({ path: reference.path, content });
|
||||
}
|
||||
return partials;
|
||||
}
|
||||
|
||||
interface PromptPartialReference {
|
||||
path: string;
|
||||
}
|
||||
|
||||
function collectPromptPartialReferences(
|
||||
configuration: Record<string, unknown>,
|
||||
): PromptPartialReference[] {
|
||||
const references: PromptPartialReference[] = [];
|
||||
const seen = new Set<string>();
|
||||
const triggers = configuration["triggers"];
|
||||
if (!Array.isArray(triggers)) return references;
|
||||
|
||||
for (const trigger of triggers) {
|
||||
if (!isRecord(trigger) || !Array.isArray(trigger["steps"])) continue;
|
||||
for (const step of trigger["steps"]) {
|
||||
if (!isRecord(step) || !Array.isArray(step["prompt"])) continue;
|
||||
for (const block of step["prompt"]) {
|
||||
if (!isRecord(block) || !Object.hasOwn(block, "include")) continue;
|
||||
const include = block["include"];
|
||||
if (typeof include !== "string") {
|
||||
throw new HubCommandError(
|
||||
"HUB_PARTIAL_PATH_INVALID",
|
||||
"Hub partial include path must be a string.",
|
||||
);
|
||||
}
|
||||
const normalizedPath = normalizePromptPartialPath(include);
|
||||
if (seen.has(normalizedPath)) {
|
||||
throw new HubCommandError(
|
||||
"HUB_PARTIAL_DUPLICATE",
|
||||
`Hub partial ${normalizedPath} is referenced more than once. Remove the duplicate include.`,
|
||||
);
|
||||
}
|
||||
seen.add(normalizedPath);
|
||||
references.push({ path: normalizedPath });
|
||||
}
|
||||
}
|
||||
}
|
||||
return references;
|
||||
}
|
||||
|
||||
function normalizePromptPartialPath(value: string): string {
|
||||
const decoded = decodePromptPartialPath(value);
|
||||
if (decoded.length === 0) throw invalidPromptPartialPath(value);
|
||||
if (/^(?:[a-zA-Z]:[\\/]|[\\/]{1,2})/u.test(decoded)) {
|
||||
throw invalidPromptPartialPath(value);
|
||||
}
|
||||
|
||||
const segments = decoded.replaceAll("\\", "/").split("/");
|
||||
if (segments.some((segment) => segment.length === 0 || segment === "." || segment === "..")) {
|
||||
throw invalidPromptPartialPath(value);
|
||||
}
|
||||
const canonical = `${PROMPT_PARTIAL_ROOT}/${segments.join("/")}`;
|
||||
if (!canonical.startsWith(PROMPT_PARTIAL_ROOT_PREFIX)) {
|
||||
throw invalidPromptPartialPath(value);
|
||||
}
|
||||
if (canonical.length > MAX_PROMPT_PARTIAL_PATH_LENGTH) {
|
||||
throw new HubCommandError(
|
||||
"HUB_PARTIAL_PATH_TOO_LONG",
|
||||
`Hub partial path ${value} exceeds the ${MAX_PROMPT_PARTIAL_PATH_LENGTH}-character limit.`,
|
||||
);
|
||||
}
|
||||
return canonical.slice(PROMPT_PARTIAL_ROOT_PREFIX.length);
|
||||
}
|
||||
|
||||
function decodePromptPartialPath(value: string): string {
|
||||
let decoded = value;
|
||||
for (let attempt = 0; attempt < 8; attempt += 1) {
|
||||
let next: string;
|
||||
try {
|
||||
next = decodeURIComponent(decoded);
|
||||
} catch {
|
||||
throw invalidPromptPartialPath(value);
|
||||
}
|
||||
if (next === decoded) break;
|
||||
decoded = next;
|
||||
}
|
||||
if (decoded.includes("\0") || /%[0-9a-f]{2}/iu.test(decoded)) {
|
||||
throw invalidPromptPartialPath(value);
|
||||
}
|
||||
return decoded;
|
||||
}
|
||||
|
||||
async function readPartial(
|
||||
projectRoot: string,
|
||||
partialPath: string,
|
||||
displayPath: string,
|
||||
): Promise<string> {
|
||||
await rejectSymlinkComponents(
|
||||
projectRoot,
|
||||
partialPath,
|
||||
() =>
|
||||
new HubCommandError(
|
||||
"HUB_PARTIAL_UNSAFE_PATH",
|
||||
`Referenced Hub partial ${displayPath} must not use a symlink.`,
|
||||
),
|
||||
);
|
||||
|
||||
let stats: Awaited<ReturnType<typeof lstat>>;
|
||||
try {
|
||||
stats = await lstat(partialPath);
|
||||
} catch (error) {
|
||||
if (errorCode(error) === "ENOENT") {
|
||||
throw new HubCommandError(
|
||||
"HUB_PARTIAL_MISSING",
|
||||
`Referenced Hub partial ${displayPath} does not exist.`,
|
||||
);
|
||||
}
|
||||
throw new HubCommandError(
|
||||
"HUB_PARTIAL_UNREADABLE",
|
||||
`Could not read referenced Hub partial ${displayPath}. Check the file and permissions.`,
|
||||
);
|
||||
}
|
||||
if (stats.isSymbolicLink()) {
|
||||
throw new HubCommandError(
|
||||
"HUB_PARTIAL_UNSAFE_PATH",
|
||||
`Referenced Hub partial ${displayPath} must not be a symlink.`,
|
||||
);
|
||||
}
|
||||
if (!stats.isFile()) {
|
||||
throw new HubCommandError(
|
||||
"HUB_PARTIAL_NOT_FILE",
|
||||
`Referenced Hub partial ${displayPath} must be a regular file.`,
|
||||
);
|
||||
}
|
||||
if (!hasReadPermission(stats.mode)) {
|
||||
throw new HubCommandError(
|
||||
"HUB_PARTIAL_UNREADABLE",
|
||||
`Could not read referenced Hub partial ${displayPath}. Check the file and permissions.`,
|
||||
);
|
||||
}
|
||||
|
||||
try {
|
||||
return (await readFile(partialPath)).toString("utf8");
|
||||
} catch {
|
||||
throw new HubCommandError(
|
||||
"HUB_PARTIAL_UNREADABLE",
|
||||
`Could not read referenced Hub partial ${displayPath}. Check the file and permissions.`,
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
async function rejectSymlinkComponents(
|
||||
root: string,
|
||||
target: string,
|
||||
error: () => HubCommandError,
|
||||
): Promise<void> {
|
||||
const relative = path.relative(root, target);
|
||||
let current = root;
|
||||
for (const segment of relative.split(path.sep).filter(Boolean)) {
|
||||
current = path.join(current, segment);
|
||||
try {
|
||||
if ((await lstat(current)).isSymbolicLink()) throw error();
|
||||
} catch (failure) {
|
||||
if (failure instanceof HubCommandError) throw failure;
|
||||
if (errorCode(failure) === "ENOENT") return;
|
||||
throw error();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function configurationReadError(displayPath: string, error: unknown): HubCommandError {
|
||||
if (errorCode(error) === "ENOENT") {
|
||||
return new HubCommandError(
|
||||
"HUB_CONFIGURATION_UNREADABLE",
|
||||
`Could not read Hub configuration at ${displayPath}. Pass an existing YAML file.`,
|
||||
);
|
||||
}
|
||||
return new HubCommandError(
|
||||
"HUB_CONFIGURATION_UNREADABLE",
|
||||
`Could not read Hub configuration at ${displayPath}. Check the file and permissions.`,
|
||||
);
|
||||
}
|
||||
|
||||
function invalidConfigurationPath(): HubCommandError {
|
||||
return new HubCommandError(
|
||||
"HUB_CONFIGURATION_PATH_INVALID",
|
||||
"Hub configuration path must stay within the current project root; parent-directory paths are not allowed.",
|
||||
);
|
||||
}
|
||||
|
||||
function invalidPromptPartialPath(value: string): HubCommandError {
|
||||
return new HubCommandError(
|
||||
"HUB_PARTIAL_PATH_INVALID",
|
||||
`Hub partial path must be a safe relative path under .paseo/partials/: ${value}`,
|
||||
);
|
||||
}
|
||||
|
||||
function hasReadPermission(mode: number): boolean {
|
||||
return (mode & 0o444) !== 0;
|
||||
}
|
||||
|
||||
function errorCode(error: unknown): string | undefined {
|
||||
if (typeof error !== "object" || error === null) return undefined;
|
||||
const code = Reflect.get(error, "code");
|
||||
return typeof code === "string" ? code : undefined;
|
||||
}
|
||||
|
||||
function isRecord(value: unknown): value is Record<string, unknown> {
|
||||
return typeof value === "object" && value !== null && !Array.isArray(value);
|
||||
}
|
||||
@@ -1,765 +0,0 @@
|
||||
import { createServer } from "node:http";
|
||||
import { chmod, mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
|
||||
import { tmpdir } from "node:os";
|
||||
import path from "node:path";
|
||||
import { afterEach, describe, expect, it } from "vitest";
|
||||
import { renderError, toCommandError } from "../../output/index.js";
|
||||
import { createHubCommand } from "./index.js";
|
||||
import { runHubDeploy } from "./deploy.js";
|
||||
|
||||
const temporaryDirectories: string[] = [];
|
||||
|
||||
afterEach(async () => {
|
||||
await Promise.all(
|
||||
temporaryDirectories.splice(0).map((directory) => rm(directory, { recursive: true })),
|
||||
);
|
||||
});
|
||||
|
||||
describe("hub deploy", () => {
|
||||
it("deploys the default file with its project metadata and exact YAML through env credentials", async () => {
|
||||
const cwd = await temporaryDirectory();
|
||||
const configurationDirectory = path.join(cwd, ".paseo");
|
||||
const yaml = "project: studio-api\r\nenvironments: []\r\ntriggers: []\r\n";
|
||||
await mkdir(configurationDirectory);
|
||||
await writeFile(path.join(configurationDirectory, "hub.yml"), yaml);
|
||||
|
||||
const hub = await startHub();
|
||||
const progress: string[] = [];
|
||||
|
||||
try {
|
||||
const result = await runHubDeploy(
|
||||
{},
|
||||
{
|
||||
cwd,
|
||||
env: { PASEO_HUB_URL: hub.origin, PASEO_HUB_API_KEY: "test-operator-secret" },
|
||||
reporter: { progress: (message) => progress.push(message) },
|
||||
},
|
||||
);
|
||||
|
||||
expect(await hub.received).toEqual({
|
||||
method: "POST",
|
||||
url: "/api/v1/configurations/install",
|
||||
authorization: "Bearer test-operator-secret",
|
||||
body: JSON.stringify({ projectSlug: "studio-api", yaml }),
|
||||
});
|
||||
expect(result.data).toEqual({
|
||||
projectSlug: "studio-api",
|
||||
version: 7,
|
||||
versionId: "2de5b143-1c88-42db-8a8d-71ca2af97830",
|
||||
active: true,
|
||||
origin: hub.origin,
|
||||
});
|
||||
expect(progress).toEqual([`Deploying studio-api to ${hub.origin}`]);
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("uses an explicit file and lets -p override project metadata without rewriting YAML", async () => {
|
||||
const cwd = await temporaryDirectory();
|
||||
const yaml = "project: file-project\nenvironments: []\ntriggers: []\n";
|
||||
await writeFile(path.join(cwd, "production.yml"), yaml);
|
||||
const hub = await startHub();
|
||||
|
||||
try {
|
||||
await runHubDeploy(
|
||||
{
|
||||
file: "production.yml",
|
||||
project: "flag-project",
|
||||
hub: hub.origin,
|
||||
apiKey: "flag-secret",
|
||||
},
|
||||
{ cwd, env: {} },
|
||||
);
|
||||
|
||||
expect(await hub.received).toMatchObject({
|
||||
authorization: "Bearer flag-secret",
|
||||
body: JSON.stringify({ projectSlug: "flag-project", yaml }),
|
||||
});
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("dry-run sends the identical resolved bundle to validation and never installs", async () => {
|
||||
const cwd = await projectFile(
|
||||
"project: file-project\ntriggers:\n - steps:\n - prompt:\n - include: safety.md\n",
|
||||
);
|
||||
await writeFile(path.join(cwd, ".paseo", "partials", "safety.md"), "Stay safe.");
|
||||
const hub = await startHub({
|
||||
status: 200,
|
||||
body: { projectSlug: "flag-project", valid: true },
|
||||
});
|
||||
const progress: string[] = [];
|
||||
|
||||
try {
|
||||
const result = await runHubDeploy(
|
||||
{
|
||||
project: "flag-project",
|
||||
hub: hub.origin,
|
||||
apiKey: "validation-secret",
|
||||
dryRun: true,
|
||||
json: true,
|
||||
},
|
||||
{ cwd, env: {}, reporter: { progress: (message) => progress.push(message) } },
|
||||
);
|
||||
|
||||
expect(await hub.received).toEqual({
|
||||
method: "POST",
|
||||
url: "/api/v1/configurations/validate",
|
||||
authorization: "Bearer validation-secret",
|
||||
body: JSON.stringify({
|
||||
projectSlug: "flag-project",
|
||||
yaml: "project: file-project\ntriggers:\n - steps:\n - prompt:\n - include: safety.md\n",
|
||||
partials: [{ path: "safety.md", content: "Stay safe." }],
|
||||
}),
|
||||
});
|
||||
expect(result.data).toEqual({ projectSlug: "flag-project", valid: true, origin: hub.origin });
|
||||
expect(hub.requestCount()).toBe(1);
|
||||
expect(progress).toEqual([]);
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("deploys mixed inline and partial prompts with only the referenced partial files", async () => {
|
||||
const cwd = await temporaryDirectory();
|
||||
const configurationDirectory = path.join(cwd, ".paseo");
|
||||
const partialDirectory = path.join(configurationDirectory, "partials", "docs");
|
||||
const yaml = [
|
||||
"project: studio-api",
|
||||
"triggers:",
|
||||
" - steps:",
|
||||
" - prompt:",
|
||||
" - text: Inline request",
|
||||
" - include: docs/safety.md",
|
||||
" - include: docs/release.md",
|
||||
"unknownNestedInclude: ignored.md",
|
||||
"",
|
||||
].join("\n");
|
||||
const safety = "Follow the safety checklist.\n{ include: nested.md }";
|
||||
const release = "Use the release checklist.";
|
||||
await mkdir(partialDirectory, { recursive: true });
|
||||
await writeFile(path.join(configurationDirectory, "hub.yml"), yaml);
|
||||
await writeFile(path.join(partialDirectory, "safety.md"), safety);
|
||||
await writeFile(path.join(partialDirectory, "release.md"), release);
|
||||
const hub = await startHub();
|
||||
|
||||
try {
|
||||
await runHubDeploy(
|
||||
{},
|
||||
{ cwd, env: { PASEO_HUB_URL: hub.origin, PASEO_HUB_API_KEY: "bundle-secret" } },
|
||||
);
|
||||
|
||||
expect(await hub.received).toEqual({
|
||||
method: "POST",
|
||||
url: "/api/v1/configurations/install",
|
||||
authorization: "Bearer bundle-secret",
|
||||
body: JSON.stringify({
|
||||
projectSlug: "studio-api",
|
||||
yaml,
|
||||
partials: [
|
||||
{ path: "docs/safety.md", content: safety },
|
||||
{ path: "docs/release.md", content: release },
|
||||
],
|
||||
}),
|
||||
});
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("anchors explicit configuration files and their partial bundle at the current project root", async () => {
|
||||
const cwd = await temporaryDirectory();
|
||||
const configurationDirectory = path.join(cwd, "configs");
|
||||
const partialDirectory = path.join(cwd, ".paseo", "partials");
|
||||
const yaml =
|
||||
"project: explicit-project\ntriggers:\n - steps:\n - prompt:\n - include: instructions.md\n";
|
||||
const partial = "Explicit project-root partial";
|
||||
await mkdir(configurationDirectory, { recursive: true });
|
||||
await mkdir(partialDirectory, { recursive: true });
|
||||
await writeFile(path.join(configurationDirectory, "production.yml"), yaml);
|
||||
await writeFile(path.join(partialDirectory, "instructions.md"), partial);
|
||||
const hub = await startHub();
|
||||
|
||||
try {
|
||||
await runHubDeploy(
|
||||
{ file: "configs/production.yml", hub: hub.origin, apiKey: "explicit-secret" },
|
||||
{ cwd, env: {} },
|
||||
);
|
||||
|
||||
expect(await hub.received).toMatchObject({
|
||||
body: JSON.stringify({
|
||||
projectSlug: "explicit-project",
|
||||
yaml,
|
||||
partials: [{ path: "instructions.md", content: partial }],
|
||||
}),
|
||||
});
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("does not search parent directories or alternate default filenames", async () => {
|
||||
const parent = await temporaryDirectory();
|
||||
const cwd = path.join(parent, "child");
|
||||
await mkdir(path.join(parent, ".paseo"));
|
||||
await mkdir(path.join(cwd, ".paseo"), { recursive: true });
|
||||
await writeFile(path.join(parent, ".paseo", "hub.yml"), "project: parent-project\n");
|
||||
await writeFile(path.join(cwd, ".paseo", "hub.yaml"), "project: alternate-project\n");
|
||||
|
||||
await expect(
|
||||
runHubDeploy({ hub: "https://hub.example.com", apiKey: "unused-secret" }, { cwd, env: {} }),
|
||||
).rejects.toMatchObject({
|
||||
code: "HUB_CONFIGURATION_UNREADABLE",
|
||||
message: "Could not read Hub configuration at .paseo/hub.yml. Pass an existing YAML file.",
|
||||
});
|
||||
});
|
||||
|
||||
it("requires an explicit project when the YAML omits project metadata", async () => {
|
||||
const cwd = await temporaryDirectory();
|
||||
await writeFile(path.join(cwd, "hub.yml"), "environments: []\ntriggers: []\n");
|
||||
|
||||
await expect(
|
||||
runHubDeploy(
|
||||
{ file: "hub.yml", hub: "https://hub.example.com", apiKey: "unused-secret" },
|
||||
{ cwd, env: {} },
|
||||
),
|
||||
).rejects.toMatchObject({
|
||||
message: "Project is required. Pass --project <slug> or add top-level project to the YAML.",
|
||||
});
|
||||
});
|
||||
|
||||
it("fails locally for a missing partial without sending a request", async () => {
|
||||
const cwd = await projectFile(
|
||||
"project: studio-api\ntriggers:\n - steps:\n - prompt:\n - include: missing.md\n",
|
||||
);
|
||||
const hub = await startHub();
|
||||
|
||||
try {
|
||||
await expect(
|
||||
runHubDeploy({ hub: hub.origin, apiKey: "missing-secret" }, { cwd, env: {} }),
|
||||
).rejects.toMatchObject({
|
||||
code: "HUB_PARTIAL_MISSING",
|
||||
message: "Referenced Hub partial missing.md does not exist.",
|
||||
});
|
||||
expect(hub.requestCount()).toBe(0);
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it.each([
|
||||
"../secret.md",
|
||||
"%2e%2e/secret.md",
|
||||
"/etc/passwd",
|
||||
"\\\\server\\share\\secret.md",
|
||||
"C:\\secret.md",
|
||||
])("fails locally for an unsafe partial path %s without sending a request", async (include) => {
|
||||
const cwd = await projectFile(
|
||||
`project: studio-api\ntriggers:\n - steps:\n - prompt:\n - include: ${JSON.stringify(include)}\n`,
|
||||
);
|
||||
const hub = await startHub();
|
||||
|
||||
try {
|
||||
await expect(
|
||||
runHubDeploy({ hub: hub.origin, apiKey: "unsafe-path-secret" }, { cwd, env: {} }),
|
||||
).rejects.toMatchObject({ code: "HUB_PARTIAL_PATH_INVALID" });
|
||||
expect(hub.requestCount()).toBe(0);
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("fails locally when a referenced partial is a directory", async () => {
|
||||
const cwd = await projectFile(
|
||||
"project: studio-api\ntriggers:\n - steps:\n - prompt:\n - include: docs\n",
|
||||
);
|
||||
await mkdir(path.join(cwd, ".paseo", "partials", "docs"), { recursive: true });
|
||||
const hub = await startHub();
|
||||
|
||||
try {
|
||||
await expect(
|
||||
runHubDeploy({ hub: hub.origin, apiKey: "directory-secret" }, { cwd, env: {} }),
|
||||
).rejects.toMatchObject({
|
||||
code: "HUB_PARTIAL_NOT_FILE",
|
||||
message: "Referenced Hub partial docs must be a regular file.",
|
||||
});
|
||||
expect(hub.requestCount()).toBe(0);
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("fails locally when a referenced partial cannot be read", async () => {
|
||||
const cwd = await projectFile(
|
||||
"project: studio-api\ntriggers:\n - steps:\n - prompt:\n - include: unreadable.md\n",
|
||||
);
|
||||
const partial = path.join(cwd, ".paseo", "partials", "unreadable.md");
|
||||
await mkdir(path.dirname(partial), { recursive: true });
|
||||
await writeFile(partial, "secret instructions");
|
||||
await chmod(partial, 0o000);
|
||||
const hub = await startHub();
|
||||
|
||||
try {
|
||||
await expect(
|
||||
runHubDeploy({ hub: hub.origin, apiKey: "unreadable-secret" }, { cwd, env: {} }),
|
||||
).rejects.toMatchObject({
|
||||
code: "HUB_PARTIAL_UNREADABLE",
|
||||
message:
|
||||
"Could not read referenced Hub partial unreadable.md. Check the file and permissions.",
|
||||
});
|
||||
expect(hub.requestCount()).toBe(0);
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("fails locally for duplicate normalized partial references", async () => {
|
||||
const cwd = await projectFile(
|
||||
"project: studio-api\ntriggers:\n - steps:\n - prompt:\n - include: docs/safety.md\n - include: docs\\safety.md\n",
|
||||
);
|
||||
const hub = await startHub();
|
||||
|
||||
try {
|
||||
await expect(
|
||||
runHubDeploy({ hub: hub.origin, apiKey: "duplicate-secret" }, { cwd, env: {} }),
|
||||
).rejects.toMatchObject({
|
||||
code: "HUB_PARTIAL_DUPLICATE",
|
||||
message:
|
||||
"Hub partial docs/safety.md is referenced more than once. Remove the duplicate include.",
|
||||
});
|
||||
expect(hub.requestCount()).toBe(0);
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("fails locally when the configuration exceeds the YAML size limit", async () => {
|
||||
const cwd = await temporaryDirectory();
|
||||
await mkdir(path.join(cwd, ".paseo"));
|
||||
await writeFile(
|
||||
path.join(cwd, ".paseo", "hub.yml"),
|
||||
`project: studio-api\n${"#".repeat(1_000_000)}`,
|
||||
);
|
||||
const hub = await startHub();
|
||||
|
||||
try {
|
||||
await expect(
|
||||
runHubDeploy({ hub: hub.origin, apiKey: "large-yaml-secret" }, { cwd, env: {} }),
|
||||
).rejects.toMatchObject({
|
||||
code: "HUB_CONFIGURATION_TOO_LARGE",
|
||||
});
|
||||
expect(hub.requestCount()).toBe(0);
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("uses the Hub YAML string limit rather than its UTF-8 byte length", async () => {
|
||||
const cwd = await temporaryDirectory();
|
||||
const yaml = `project: studio-api\n# ${"😀".repeat(400_000)}\n`;
|
||||
await mkdir(path.join(cwd, ".paseo"));
|
||||
await writeFile(path.join(cwd, ".paseo", "hub.yml"), yaml);
|
||||
expect(yaml.length).toBeLessThan(1_000_000);
|
||||
expect(Buffer.byteLength(yaml, "utf8")).toBeGreaterThan(1_000_000);
|
||||
const hub = await startHub();
|
||||
|
||||
try {
|
||||
await runHubDeploy(
|
||||
{},
|
||||
{ cwd, env: { PASEO_HUB_URL: hub.origin, PASEO_HUB_API_KEY: "unicode-yaml-secret" } },
|
||||
);
|
||||
|
||||
expect(JSON.parse((await hub.received).body)).toEqual({ projectSlug: "studio-api", yaml });
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("fails locally when a partial exceeds its content size limit", async () => {
|
||||
const cwd = await projectFile(
|
||||
"project: studio-api\ntriggers:\n - steps:\n - prompt:\n - include: large.md\n",
|
||||
);
|
||||
await writeFile(path.join(cwd, ".paseo", "partials", "large.md"), "x".repeat(1_000_001));
|
||||
const hub = await startHub();
|
||||
|
||||
try {
|
||||
await expect(
|
||||
runHubDeploy({ hub: hub.origin, apiKey: "large-partial-secret" }, { cwd, env: {} }),
|
||||
).rejects.toMatchObject({
|
||||
code: "HUB_PARTIAL_TOO_LARGE",
|
||||
});
|
||||
expect(hub.requestCount()).toBe(0);
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("fails locally when the referenced partial bundle exceeds its combined size limit", async () => {
|
||||
const cwd = await projectFile(
|
||||
[
|
||||
"project: studio-api",
|
||||
"triggers:",
|
||||
" - steps:",
|
||||
" - prompt:",
|
||||
...Array.from({ length: 6 }, (_, index) => ` - include: part-${index}.md`),
|
||||
"",
|
||||
].join("\n"),
|
||||
);
|
||||
await Promise.all(
|
||||
Array.from({ length: 6 }, (_, index) =>
|
||||
writeFile(path.join(cwd, ".paseo", "partials", `part-${index}.md`), "x".repeat(900_000)),
|
||||
),
|
||||
);
|
||||
const hub = await startHub();
|
||||
|
||||
try {
|
||||
await expect(
|
||||
runHubDeploy({ hub: hub.origin, apiKey: "large-bundle-secret" }, { cwd, env: {} }),
|
||||
).rejects.toMatchObject({
|
||||
code: "HUB_PARTIAL_BUNDLE_TOO_LARGE",
|
||||
});
|
||||
expect(hub.requestCount()).toBe(0);
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("fails locally for an explicit configuration path outside the project root", async () => {
|
||||
const cwd = await temporaryDirectory();
|
||||
const hub = await startHub();
|
||||
|
||||
try {
|
||||
await expect(
|
||||
runHubDeploy(
|
||||
{ file: "../hub.yml", hub: hub.origin, apiKey: "traversal-secret" },
|
||||
{ cwd, env: {} },
|
||||
),
|
||||
).rejects.toMatchObject({
|
||||
code: "HUB_CONFIGURATION_PATH_INVALID",
|
||||
message:
|
||||
"Hub configuration path must stay within the current project root; parent-directory paths are not allowed.",
|
||||
});
|
||||
expect(hub.requestCount()).toBe(0);
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("fails locally when the configuration is a directory", async () => {
|
||||
const cwd = await temporaryDirectory();
|
||||
await mkdir(path.join(cwd, ".paseo", "hub.yml"), { recursive: true });
|
||||
const hub = await startHub();
|
||||
|
||||
try {
|
||||
await expect(
|
||||
runHubDeploy(
|
||||
{ hub: hub.origin, apiKey: "configuration-directory-secret" },
|
||||
{ cwd, env: {} },
|
||||
),
|
||||
).rejects.toMatchObject({
|
||||
code: "HUB_CONFIGURATION_NOT_FILE",
|
||||
message: "Hub configuration at .paseo/hub.yml must be a regular file.",
|
||||
});
|
||||
expect(hub.requestCount()).toBe(0);
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("fails locally when the configuration cannot be read", async () => {
|
||||
const cwd = await temporaryDirectory();
|
||||
await mkdir(path.join(cwd, ".paseo"));
|
||||
const configuration = path.join(cwd, ".paseo", "hub.yml");
|
||||
await writeFile(configuration, "project: studio-api\n");
|
||||
await chmod(configuration, 0o000);
|
||||
const hub = await startHub();
|
||||
|
||||
try {
|
||||
await expect(
|
||||
runHubDeploy(
|
||||
{ hub: hub.origin, apiKey: "configuration-unreadable-secret" },
|
||||
{ cwd, env: {} },
|
||||
),
|
||||
).rejects.toMatchObject({ code: "HUB_CONFIGURATION_UNREADABLE" });
|
||||
expect(hub.requestCount()).toBe(0);
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("fails locally when the partial count exceeds the bundle limit", async () => {
|
||||
const cwd = await projectFile(
|
||||
[
|
||||
"project: studio-api",
|
||||
"triggers:",
|
||||
" - steps:",
|
||||
" - prompt:",
|
||||
...Array.from({ length: 101 }, (_, index) => ` - include: part-${index}.md`),
|
||||
"",
|
||||
].join("\n"),
|
||||
);
|
||||
const hub = await startHub();
|
||||
|
||||
try {
|
||||
await expect(
|
||||
runHubDeploy({ hub: hub.origin, apiKey: "partial-count-secret" }, { cwd, env: {} }),
|
||||
).rejects.toMatchObject({
|
||||
code: "HUB_PARTIAL_LIMIT_EXCEEDED",
|
||||
});
|
||||
expect(hub.requestCount()).toBe(0);
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("fails locally when a canonical partial path exceeds its length limit", async () => {
|
||||
const include = `${"a".repeat(497)}.md`;
|
||||
const cwd = await projectFile(
|
||||
`project: studio-api\ntriggers:\n - steps:\n - prompt:\n - include: ${JSON.stringify(include)}\n`,
|
||||
);
|
||||
const hub = await startHub();
|
||||
|
||||
try {
|
||||
await expect(
|
||||
runHubDeploy({ hub: hub.origin, apiKey: "partial-path-length-secret" }, { cwd, env: {} }),
|
||||
).rejects.toMatchObject({
|
||||
code: "HUB_PARTIAL_PATH_TOO_LONG",
|
||||
});
|
||||
expect(hub.requestCount()).toBe(0);
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("uses the hosted default and requires authority with actionable guidance", async () => {
|
||||
const cwd = await projectFile("project: paseo\n");
|
||||
const progress: string[] = [];
|
||||
await expect(
|
||||
runHubDeploy(
|
||||
{},
|
||||
{ cwd, env: {}, reporter: { progress: (message) => progress.push(message) } },
|
||||
),
|
||||
).rejects.toMatchObject({
|
||||
message:
|
||||
"No stored Hub login matches https://hub.paseo.sh. Run `paseo hub login https://hub.paseo.sh`, pass --api-key <secret>, or set PASEO_HUB_API_KEY.",
|
||||
});
|
||||
expect(progress).toEqual(["Deploying paseo to https://hub.paseo.sh"]);
|
||||
await expect(
|
||||
runHubDeploy({ hub: "https://hub.example.com" }, { cwd, env: {} }),
|
||||
).rejects.toMatchObject({
|
||||
message:
|
||||
"No stored Hub login matches https://hub.example.com. Run `paseo hub login https://hub.example.com`, pass --api-key <secret>, or set PASEO_HUB_API_KEY.",
|
||||
});
|
||||
});
|
||||
|
||||
it.each([
|
||||
"ftp://hub.example.com",
|
||||
"http://hub.example.com",
|
||||
"https://user:password@hub.example.com",
|
||||
"https://hub.example.com/path",
|
||||
"https://hub.example.com?debug=true",
|
||||
"https://hub.example.com#debug",
|
||||
])("rejects a non-origin Hub URL: %s", async (hub) => {
|
||||
await expect(
|
||||
runHubDeploy({ hub, apiKey: "unused-secret" }, { cwd: "/unused", env: {} }),
|
||||
).rejects.toMatchObject({
|
||||
message:
|
||||
"Hub URL must be an HTTPS origin without credentials, path, query, or hash. HTTP is allowed only for localhost, 127.0.0.1, or [::1].",
|
||||
});
|
||||
});
|
||||
|
||||
it("shows RFC 9457 detail and field issues without raw server extensions", async () => {
|
||||
const cwd = await projectFile("project: studio-api\n");
|
||||
const hub = await startHub({
|
||||
status: 422,
|
||||
contentType: "application/problem+json",
|
||||
body: {
|
||||
type: "https://hub.example.com/problems/configuration-invalid",
|
||||
title: "Configuration validation failed",
|
||||
status: 422,
|
||||
detail: "Fix the invalid configuration fields.",
|
||||
errors: [{ field: "triggers[0].steps[0].agent.provider", message: "Unknown provider" }],
|
||||
internalTrace: "do-not-expose-this-trace",
|
||||
},
|
||||
});
|
||||
|
||||
try {
|
||||
await expect(
|
||||
runHubDeploy({ hub: hub.origin, apiKey: "validation-secret" }, { cwd, env: {} }),
|
||||
).rejects.toMatchObject({
|
||||
code: "HUB_VALIDATION_FAILED",
|
||||
message: "Configuration validation failed: Fix the invalid configuration fields.",
|
||||
details: "triggers[0].steps[0].agent.provider: Unknown provider",
|
||||
});
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("reports malformed successful responses without exposing their body", async () => {
|
||||
const cwd = await projectFile("project: studio-api\n");
|
||||
const hub = await startHub({ status: 201, body: { projectSlug: "studio-api", version: "7" } });
|
||||
|
||||
try {
|
||||
await expect(
|
||||
runHubDeploy({ hub: hub.origin, apiKey: "response-secret" }, { cwd, env: {} }),
|
||||
).rejects.toMatchObject({
|
||||
code: "HUB_INVALID_RESPONSE",
|
||||
message: "Hub returned a malformed response.",
|
||||
});
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("reports network failures honestly", async () => {
|
||||
const cwd = await projectFile("project: studio-api\n");
|
||||
const hub = await startHub();
|
||||
await hub.close();
|
||||
|
||||
await expect(
|
||||
runHubDeploy({ hub: hub.origin, apiKey: "network-secret" }, { cwd, env: {} }),
|
||||
).rejects.toMatchObject({
|
||||
code: "HUB_NETWORK_ERROR",
|
||||
message: `Could not reach Paseo Hub at ${hub.origin}. Check the Hub URL and network connection.`,
|
||||
});
|
||||
});
|
||||
|
||||
it("redacts the operator key from problem detail, field issues, and serialized errors", async () => {
|
||||
const secret = "operator-secret-must-not-leak";
|
||||
const cwd = await projectFile("project: studio-api\n");
|
||||
const hub = await startHub({
|
||||
status: 401,
|
||||
contentType: "application/problem+json",
|
||||
body: {
|
||||
title: `Rejected key ${secret}`,
|
||||
status: 401,
|
||||
detail: `Authorization Bearer ${secret} is invalid`,
|
||||
errors: [{ field: "apiKey", message: secret }],
|
||||
},
|
||||
});
|
||||
|
||||
try {
|
||||
const error = await runHubDeploy({ hub: hub.origin, apiKey: secret }, { cwd, env: {} }).catch(
|
||||
(failure: unknown) => failure,
|
||||
);
|
||||
const jsonOutput = renderError(toCommandError(error), { format: "json" });
|
||||
expect(jsonOutput).not.toContain(secret);
|
||||
expect(error).toMatchObject({
|
||||
message: "Rejected key [redacted]: Authorization Bearer [redacted] is invalid",
|
||||
details: "apiKey: [redacted]",
|
||||
});
|
||||
} finally {
|
||||
await hub.close();
|
||||
}
|
||||
});
|
||||
|
||||
it("wires deploy with its exact default file and explicit target options", () => {
|
||||
const deploy = createHubCommand().commands.find((command) => command.name() === "deploy");
|
||||
const help = deploy?.helpInformation();
|
||||
|
||||
expect(deploy?.registeredArguments[0]?.name()).toBe("file");
|
||||
expect(deploy?.registeredArguments[0]?.defaultValue).toBe(".paseo/hub.yml");
|
||||
expect(help).toContain("-p, --project <slug>");
|
||||
expect(help).toContain("--hub <origin>");
|
||||
expect(help).toContain("--api-key <secret>");
|
||||
expect(help).toContain("--dry-run");
|
||||
expect(help).not.toContain("organization");
|
||||
});
|
||||
});
|
||||
|
||||
async function temporaryDirectory(): Promise<string> {
|
||||
const directory = await mkdtemp(path.join(tmpdir(), "paseo-hub-deploy-"));
|
||||
temporaryDirectories.push(directory);
|
||||
return directory;
|
||||
}
|
||||
|
||||
async function projectFile(yaml: string): Promise<string> {
|
||||
const cwd = await temporaryDirectory();
|
||||
await mkdir(path.join(cwd, ".paseo"));
|
||||
await mkdir(path.join(cwd, ".paseo", "partials"));
|
||||
await writeFile(path.join(cwd, ".paseo", "hub.yml"), yaml);
|
||||
return cwd;
|
||||
}
|
||||
|
||||
interface HubResponse {
|
||||
status: number;
|
||||
contentType?: string;
|
||||
body: unknown;
|
||||
}
|
||||
|
||||
interface ReceivedRequest {
|
||||
method: string | undefined;
|
||||
url: string | undefined;
|
||||
authorization: string | undefined;
|
||||
body: string;
|
||||
}
|
||||
|
||||
interface TestHub {
|
||||
origin: string;
|
||||
received: Promise<ReceivedRequest>;
|
||||
requestCount(): number;
|
||||
close(): Promise<void>;
|
||||
}
|
||||
|
||||
async function startHub(
|
||||
configuredResponse: HubResponse = {
|
||||
status: 201,
|
||||
body: {
|
||||
projectSlug: "studio-api",
|
||||
version: 7,
|
||||
versionId: "2de5b143-1c88-42db-8a8d-71ca2af97830",
|
||||
active: true,
|
||||
},
|
||||
},
|
||||
): Promise<TestHub> {
|
||||
let requestCount = 0;
|
||||
let resolveRequest: (request: ReceivedRequest) => void;
|
||||
const received = new Promise<ReceivedRequest>((resolve) => {
|
||||
resolveRequest = resolve;
|
||||
});
|
||||
const server = createServer((request, response) => {
|
||||
requestCount += 1;
|
||||
let body = "";
|
||||
request.setEncoding("utf8");
|
||||
request.on("data", (chunk: string) => {
|
||||
body += chunk;
|
||||
});
|
||||
request.on("end", () => {
|
||||
resolveRequest({
|
||||
method: request.method,
|
||||
url: request.url,
|
||||
authorization: request.headers.authorization,
|
||||
body,
|
||||
});
|
||||
response.writeHead(configuredResponse.status, {
|
||||
"content-type": configuredResponse.contentType ?? "application/json",
|
||||
});
|
||||
response.end(JSON.stringify(configuredResponse.body));
|
||||
});
|
||||
});
|
||||
await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
|
||||
const address = server.address();
|
||||
if (address === null || typeof address === "string") throw new Error("Test server did not bind");
|
||||
|
||||
return {
|
||||
origin: `http://127.0.0.1:${address.port}`,
|
||||
received,
|
||||
requestCount: () => requestCount,
|
||||
close: () => closeServer(server),
|
||||
};
|
||||
}
|
||||
|
||||
function closeServer(server: ReturnType<typeof createServer>): Promise<void> {
|
||||
return new Promise<void>((resolve, reject) => {
|
||||
server.close((error) => {
|
||||
if (error) {
|
||||
reject(error);
|
||||
return;
|
||||
}
|
||||
resolve();
|
||||
});
|
||||
});
|
||||
}
|
||||
@@ -2,14 +2,17 @@ import type { Command } from "commander";
|
||||
import { withOutput, type OutputSchema, type SingleResult } from "../../output/index.js";
|
||||
import { addJsonOption } from "../../utils/command-options.js";
|
||||
import { resolveHubCredential, resolveHubOrigin } from "./authority.js";
|
||||
import { HubHttpClient, type HubInstallResult, type HubValidationResult } from "./client.js";
|
||||
import {
|
||||
HubHttpClient,
|
||||
type HubInstallResult,
|
||||
type HubValidationResult,
|
||||
} from "./hub-client/index.js";
|
||||
import { PrivateHubCredentialStore, type HubCredentialStore } from "./credentials.js";
|
||||
import { resolveHubDeployInput } from "./deploy-input.js";
|
||||
import { discoverHubBundle } from "./deploy-bundle.js";
|
||||
import { processHubReporter, reportHubProgress, type HubReporter } from "./reporter.js";
|
||||
import { addHubResolutionHelp } from "./help.js";
|
||||
|
||||
export interface HubDeployOptions {
|
||||
file?: string;
|
||||
project?: string;
|
||||
hub?: string;
|
||||
apiKey?: string;
|
||||
@@ -35,10 +38,12 @@ export interface HubDeployCommandDependencies {
|
||||
|
||||
interface HubDeployResult extends HubInstallResult {
|
||||
origin: string;
|
||||
workflows: number;
|
||||
}
|
||||
|
||||
interface HubDryRunResult extends HubValidationResult {
|
||||
origin: string;
|
||||
workflows: number;
|
||||
}
|
||||
|
||||
const resultSchema: OutputSchema<HubDeployResult> = {
|
||||
@@ -48,6 +53,7 @@ const resultSchema: OutputSchema<HubDeployResult> = {
|
||||
{ header: "VERSION", field: "version" },
|
||||
{ header: "VERSION ID", field: "versionId" },
|
||||
{ header: "ACTIVE", field: "active" },
|
||||
{ header: "WORKFLOWS", field: "workflows" },
|
||||
{ header: "HUB", field: "origin" },
|
||||
],
|
||||
};
|
||||
@@ -57,6 +63,7 @@ const validationSchema: OutputSchema<HubDryRunResult> = {
|
||||
columns: [
|
||||
{ header: "PROJECT", field: "projectSlug" },
|
||||
{ header: "VALID", field: "valid" },
|
||||
{ header: "WORKFLOWS", field: "workflows" },
|
||||
{ header: "HUB", field: "origin" },
|
||||
],
|
||||
};
|
||||
@@ -77,9 +84,8 @@ export async function runHubDeploy(
|
||||
credentials,
|
||||
};
|
||||
const origin = resolveHubOrigin(resolution);
|
||||
const deployInput = await resolveHubDeployInput({
|
||||
const deployInput = await discoverHubBundle({
|
||||
cwd: environment.cwd,
|
||||
...(options.file === undefined ? {} : { file: options.file }),
|
||||
...(options.project === undefined ? {} : { project: options.project }),
|
||||
});
|
||||
const action = options.dryRun === true ? "Validating" : "Deploying";
|
||||
@@ -96,11 +102,19 @@ export async function runHubDeploy(
|
||||
};
|
||||
if (options.dryRun === true) {
|
||||
const validated = await (environment.hub ?? new HubHttpClient()).validateConfiguration(request);
|
||||
return { type: "single", data: { ...validated, origin }, schema: validationSchema };
|
||||
return {
|
||||
type: "single",
|
||||
data: { ...validated, workflows: deployInput.workflowCount, origin },
|
||||
schema: validationSchema,
|
||||
};
|
||||
}
|
||||
const deployed = await (environment.hub ?? new HubHttpClient()).installConfiguration(request);
|
||||
|
||||
return { type: "single", data: { ...deployed, origin }, schema: resultSchema };
|
||||
return {
|
||||
type: "single",
|
||||
data: { ...deployed, workflows: deployInput.workflowCount, origin },
|
||||
schema: resultSchema,
|
||||
};
|
||||
}
|
||||
|
||||
export function addHubDeployCommand(
|
||||
@@ -111,8 +125,7 @@ export function addHubDeployCommand(
|
||||
addHubResolutionHelp(
|
||||
hub
|
||||
.command("deploy")
|
||||
.description("Install and activate a Hub configuration")
|
||||
.argument("[file]", "Hub configuration YAML", ".paseo/hub.yml")
|
||||
.description("Discover, validate, and activate the canonical .paseo Hub bundle")
|
||||
.option("-p, --project <slug>", "Target project slug")
|
||||
.option("--hub <origin>", "Paseo Hub origin")
|
||||
.option("--api-key <secret>", "Organization API key")
|
||||
@@ -120,18 +133,14 @@ export function addHubDeployCommand(
|
||||
),
|
||||
).action(
|
||||
withOutput<HubDeployResult | HubDryRunResult, unknown[]>(async (...args) => {
|
||||
const file = args[0] as string;
|
||||
const options = args.at(-2) as HubDeployOptions;
|
||||
return runHubDeploy(
|
||||
{ ...options, file },
|
||||
{
|
||||
cwd: dependencies.cwd(),
|
||||
env: dependencies.env,
|
||||
credentials: dependencies.credentials,
|
||||
hub: dependencies.hub,
|
||||
reporter: dependencies.reporter,
|
||||
},
|
||||
);
|
||||
return runHubDeploy(options, {
|
||||
cwd: dependencies.cwd(),
|
||||
env: dependencies.env,
|
||||
credentials: dependencies.credentials,
|
||||
hub: dependencies.hub,
|
||||
reporter: dependencies.reporter,
|
||||
});
|
||||
}),
|
||||
);
|
||||
}
|
||||
|
||||
@@ -0,0 +1,125 @@
|
||||
import type { HubBundleFile } from "../deploy-bundle.js";
|
||||
import { HubCommandError } from "../error.js";
|
||||
import {
|
||||
authorizationPollSchema,
|
||||
authorizationSchema,
|
||||
enrollmentTokenSchema,
|
||||
installResponseSchema,
|
||||
projectsResponseSchema,
|
||||
validationResponseSchema,
|
||||
type CliAuthorization,
|
||||
type CliAuthorizationPoll,
|
||||
type HubInstallResult,
|
||||
type HubProject,
|
||||
type HubValidationResult,
|
||||
} from "./internal/contracts.js";
|
||||
import { requestHub } from "./internal/transport.js";
|
||||
|
||||
export type {
|
||||
CliAuthorization,
|
||||
CliAuthorizationPoll,
|
||||
HubInstallResult,
|
||||
HubProject,
|
||||
HubValidationResult,
|
||||
} from "./internal/contracts.js";
|
||||
|
||||
interface HubConfigurationInput {
|
||||
origin: string;
|
||||
apiKey: string;
|
||||
projectSlug: string;
|
||||
files: readonly HubBundleFile[];
|
||||
}
|
||||
|
||||
export class HubHttpClient {
|
||||
startCliAuthorization(origin: string): Promise<CliAuthorization> {
|
||||
return requestHub({
|
||||
origin,
|
||||
path: "/api/v1/cli-authorizations",
|
||||
method: "POST",
|
||||
body: {},
|
||||
successStatus: 201,
|
||||
schema: authorizationSchema,
|
||||
failureMessage: "Hub CLI login could not be started",
|
||||
});
|
||||
}
|
||||
|
||||
async pollCliAuthorization(
|
||||
origin: string,
|
||||
deviceCode: string,
|
||||
timeoutMilliseconds: number,
|
||||
): Promise<CliAuthorizationPoll> {
|
||||
try {
|
||||
return await requestHub({
|
||||
origin,
|
||||
path: "/api/v1/cli-authorizations/poll",
|
||||
method: "POST",
|
||||
body: { deviceCode },
|
||||
successStatus: 200,
|
||||
schema: authorizationPollSchema,
|
||||
timeoutMilliseconds,
|
||||
failureMessage: "Hub CLI login polling failed",
|
||||
});
|
||||
} catch (error) {
|
||||
if (error instanceof HubCommandError && error.code === "HUB_NETWORK_ERROR") {
|
||||
return { status: "retry_later" };
|
||||
}
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
async listProjects(origin: string, apiKey: string): Promise<HubProject[]> {
|
||||
const response = await requestHub({
|
||||
origin,
|
||||
path: "/api/v1/projects",
|
||||
method: "GET",
|
||||
apiKey,
|
||||
successStatus: 200,
|
||||
schema: projectsResponseSchema,
|
||||
failureMessage: "Hub project listing failed",
|
||||
});
|
||||
return response.projects;
|
||||
}
|
||||
|
||||
installConfiguration(input: HubConfigurationInput): Promise<HubInstallResult> {
|
||||
return requestHub({
|
||||
origin: input.origin,
|
||||
path: "/api/v1/configurations/install",
|
||||
method: "POST",
|
||||
apiKey: input.apiKey,
|
||||
body: configurationBody(input),
|
||||
successStatus: 201,
|
||||
schema: installResponseSchema,
|
||||
failureMessage: "Hub deployment failed",
|
||||
});
|
||||
}
|
||||
|
||||
validateConfiguration(input: HubConfigurationInput): Promise<HubValidationResult> {
|
||||
return requestHub({
|
||||
origin: input.origin,
|
||||
path: "/api/v1/configurations/validate",
|
||||
method: "POST",
|
||||
apiKey: input.apiKey,
|
||||
body: configurationBody(input),
|
||||
successStatus: 200,
|
||||
schema: validationResponseSchema,
|
||||
failureMessage: "Hub configuration validation failed",
|
||||
});
|
||||
}
|
||||
|
||||
async issueEnrollmentToken(origin: string, apiKey: string): Promise<string> {
|
||||
const response = await requestHub({
|
||||
origin,
|
||||
path: "/api/v1/daemons/enrollment-tokens",
|
||||
method: "POST",
|
||||
apiKey,
|
||||
successStatus: 201,
|
||||
schema: enrollmentTokenSchema,
|
||||
failureMessage: "Hub daemon enrollment authorization failed",
|
||||
});
|
||||
return response.token;
|
||||
}
|
||||
}
|
||||
|
||||
function configurationBody(input: HubConfigurationInput): object {
|
||||
return { projectSlug: input.projectSlug, files: input.files };
|
||||
}
|
||||
@@ -0,0 +1,60 @@
|
||||
import { z } from "zod";
|
||||
|
||||
const activationUrlSchema = z.url({ protocol: /^https?$/u });
|
||||
|
||||
export const authorizationSchema = z
|
||||
.object({
|
||||
deviceCode: z.string().min(32),
|
||||
userCode: z.string().min(1),
|
||||
verificationUri: activationUrlSchema,
|
||||
verificationUriComplete: activationUrlSchema,
|
||||
expiresAt: z.string().datetime(),
|
||||
interval: z.number().int().min(1),
|
||||
})
|
||||
.strict();
|
||||
|
||||
export const authorizationPollSchema = z.discriminatedUnion("status", [
|
||||
z.object({ status: z.literal("pending"), interval: z.number().int().min(1) }).strict(),
|
||||
z.object({ status: z.literal("slow_down"), interval: z.number().int().min(1) }).strict(),
|
||||
z
|
||||
.object({
|
||||
status: z.literal("authorized"),
|
||||
interval: z.number().int().min(1),
|
||||
credential: z.string().min(32),
|
||||
organizationId: z.string().min(1),
|
||||
})
|
||||
.strict(),
|
||||
z.object({ status: z.literal("denied"), interval: z.number().int().min(1) }).strict(),
|
||||
z.object({ status: z.literal("expired"), interval: z.number().int().min(1) }).strict(),
|
||||
z.object({ status: z.literal("disclosed"), interval: z.number().int().min(1) }).strict(),
|
||||
z.object({ status: z.literal("retry_later") }).strict(),
|
||||
]);
|
||||
|
||||
const projectSchema = z
|
||||
.object({ id: z.string().uuid(), slug: z.string().min(1), name: z.string().min(1) })
|
||||
.strict();
|
||||
|
||||
export const projectsResponseSchema = z.object({ projects: z.array(projectSchema) }).strict();
|
||||
|
||||
export const installResponseSchema = z
|
||||
.object({
|
||||
projectSlug: z.string().min(1),
|
||||
version: z.number().int().positive(),
|
||||
versionId: z.string().uuid(),
|
||||
active: z.literal(true),
|
||||
})
|
||||
.strict();
|
||||
|
||||
export const validationResponseSchema = z
|
||||
.object({ projectSlug: z.string().min(1), valid: z.literal(true) })
|
||||
.strict();
|
||||
|
||||
export const enrollmentTokenSchema = z
|
||||
.object({ token: z.string().min(32), expiresAt: z.string().datetime() })
|
||||
.strict();
|
||||
|
||||
export type CliAuthorization = z.infer<typeof authorizationSchema>;
|
||||
export type CliAuthorizationPoll = z.infer<typeof authorizationPollSchema>;
|
||||
export type HubProject = z.infer<typeof projectSchema>;
|
||||
export type HubInstallResult = z.infer<typeof installResponseSchema>;
|
||||
export type HubValidationResult = z.infer<typeof validationResponseSchema>;
|
||||
@@ -0,0 +1,95 @@
|
||||
import { z } from "zod";
|
||||
import { HubCommandError } from "../../error.js";
|
||||
|
||||
const issuePathSchema = z.union([z.string(), z.array(z.union([z.string(), z.number()]))]);
|
||||
const fieldIssueSchema = z.object({
|
||||
field: z.string().optional(),
|
||||
path: issuePathSchema.optional(),
|
||||
message: z.string(),
|
||||
});
|
||||
const problemSchema = z.object({
|
||||
type: z.string().optional(),
|
||||
title: z.string().optional(),
|
||||
status: z.number().int().optional(),
|
||||
detail: z.string().optional(),
|
||||
instance: z.string().optional(),
|
||||
errors: z
|
||||
.union([z.array(fieldIssueSchema), z.record(z.string(), z.array(z.string()))])
|
||||
.optional(),
|
||||
issues: z.array(fieldIssueSchema).optional(),
|
||||
});
|
||||
|
||||
export async function hubRequestFailure(
|
||||
response: Response,
|
||||
failureMessage: string,
|
||||
apiKey: string | undefined,
|
||||
): Promise<HubCommandError> {
|
||||
const contentType = response.headers.get("content-type") ?? "";
|
||||
if (!contentType.toLowerCase().includes("application/problem+json")) {
|
||||
return new HubCommandError(
|
||||
"HUB_REQUEST_FAILED",
|
||||
`${failureMessage} with HTTP ${response.status}.`,
|
||||
);
|
||||
}
|
||||
let body: unknown;
|
||||
try {
|
||||
body = await response.json();
|
||||
} catch {
|
||||
return new HubCommandError(
|
||||
"HUB_INVALID_RESPONSE",
|
||||
`Hub returned malformed problem details for HTTP ${response.status}.`,
|
||||
);
|
||||
}
|
||||
const parsed = problemSchema.safeParse(body);
|
||||
if (
|
||||
!parsed.success ||
|
||||
(parsed.data.status !== undefined && parsed.data.status !== response.status)
|
||||
) {
|
||||
return new HubCommandError(
|
||||
"HUB_INVALID_RESPONSE",
|
||||
`Hub returned nonconforming problem details for HTTP ${response.status}.`,
|
||||
);
|
||||
}
|
||||
const title = parsed.data.title ?? `${failureMessage} with HTTP ${response.status}`;
|
||||
const message = parsed.data.detail === undefined ? title : `${title}: ${parsed.data.detail}`;
|
||||
const details = formatFieldIssues(parsed.data.errors, parsed.data.issues);
|
||||
const code = response.status === 422 ? "HUB_VALIDATION_FAILED" : "HUB_REQUEST_FAILED";
|
||||
return new HubCommandError(
|
||||
code,
|
||||
redactSecret(message, apiKey),
|
||||
details === undefined ? undefined : redactSecret(details, apiKey),
|
||||
);
|
||||
}
|
||||
|
||||
function formatFieldIssues(
|
||||
errors: z.infer<typeof problemSchema>["errors"],
|
||||
issues: z.infer<typeof problemSchema>["issues"],
|
||||
): string | undefined {
|
||||
const fieldIssues = Array.isArray(errors) ? errors : issues;
|
||||
if (fieldIssues !== undefined) {
|
||||
const lines = fieldIssues.map((issue) => {
|
||||
const field = issue.field ?? formatIssuePath(issue.path);
|
||||
return field === undefined ? issue.message : `${field}: ${issue.message}`;
|
||||
});
|
||||
return lines.length === 0 ? undefined : lines.join("\n");
|
||||
}
|
||||
if (errors === undefined) return undefined;
|
||||
const lines = Object.entries(errors).flatMap(([field, messages]) =>
|
||||
messages.map((message: string) => `${field}: ${message}`),
|
||||
);
|
||||
return lines.length === 0 ? undefined : lines.join("\n");
|
||||
}
|
||||
|
||||
function formatIssuePath(path: z.infer<typeof issuePathSchema> | undefined): string | undefined {
|
||||
if (path === undefined || typeof path === "string") return path;
|
||||
let formatted = "";
|
||||
for (const segment of path) {
|
||||
if (typeof segment === "number") formatted += `[${segment}]`;
|
||||
else formatted += formatted.length === 0 ? segment : `.${segment}`;
|
||||
}
|
||||
return formatted || undefined;
|
||||
}
|
||||
|
||||
function redactSecret(value: string, secret: string | undefined): string {
|
||||
return secret === undefined ? value : value.split(secret).join("[redacted]");
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
import type { z } from "zod";
|
||||
import { HubCommandError } from "../../error.js";
|
||||
import { hubRequestFailure } from "./problem.js";
|
||||
|
||||
interface HubRequest<T> {
|
||||
origin: string;
|
||||
path: string;
|
||||
method: "GET" | "POST";
|
||||
apiKey?: string;
|
||||
body?: unknown;
|
||||
successStatus: number;
|
||||
schema: z.ZodType<T>;
|
||||
timeoutMilliseconds?: number;
|
||||
failureMessage: string;
|
||||
}
|
||||
|
||||
export async function requestHub<T>(input: HubRequest<T>): Promise<T> {
|
||||
const signal = AbortSignal.timeout(input.timeoutMilliseconds ?? 15_000);
|
||||
let response: Response;
|
||||
try {
|
||||
response = await fetch(`${input.origin}${input.path}`, {
|
||||
method: input.method,
|
||||
headers: {
|
||||
...(input.apiKey === undefined ? {} : { authorization: `Bearer ${input.apiKey}` }),
|
||||
...(input.body === undefined ? {} : { "content-type": "application/json" }),
|
||||
},
|
||||
...(input.body === undefined ? {} : { body: JSON.stringify(input.body) }),
|
||||
signal,
|
||||
});
|
||||
} catch {
|
||||
throw new HubCommandError(
|
||||
"HUB_NETWORK_ERROR",
|
||||
`Could not reach Paseo Hub at ${input.origin}. Check the Hub URL and network connection.`,
|
||||
);
|
||||
}
|
||||
if (response.status !== input.successStatus) {
|
||||
throw await hubRequestFailure(response, input.failureMessage, input.apiKey);
|
||||
}
|
||||
try {
|
||||
return input.schema.parse(await response.json());
|
||||
} catch {
|
||||
throw new HubCommandError("HUB_INVALID_RESPONSE", "Hub returned a malformed response.");
|
||||
}
|
||||
}
|
||||
@@ -1,7 +1,7 @@
|
||||
import { Command } from "commander";
|
||||
import { withOutput } from "../../output/index.js";
|
||||
import { addJsonAndDaemonHostOptions } from "../../utils/command-options.js";
|
||||
import { HubHttpClient } from "./client.js";
|
||||
import { HubHttpClient } from "./hub-client/index.js";
|
||||
import { addHubConnectCommand } from "./connect.js";
|
||||
import { PrivateHubCredentialStore, type HubCredentialStore } from "./credentials.js";
|
||||
import {
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
import { strict as assert } from "node:assert";
|
||||
import { describe, it } from "vitest";
|
||||
import type { CliAuthorizationPoll } from "./client.js";
|
||||
import type { CliAuthorizationPoll } from "./hub-client/index.js";
|
||||
import { CliLoginFlow, SystemBrowser } from "./login-flow.js";
|
||||
|
||||
describe("Hub CLI login browser flow", () => {
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
import { spawn } from "node:child_process";
|
||||
import { platform } from "node:os";
|
||||
import type { CliAuthorizationPoll, HubHttpClient } from "./client.js";
|
||||
import type { CliAuthorizationPoll, HubHttpClient } from "./hub-client/index.js";
|
||||
|
||||
export interface LoginWaiter {
|
||||
wait(milliseconds: number): Promise<void>;
|
||||
|
||||
@@ -2,7 +2,7 @@ import type { Command } from "commander";
|
||||
import { render, withOutput, type OutputSchema, type SingleResult } from "../../output/index.js";
|
||||
import { addJsonOption } from "../../utils/command-options.js";
|
||||
import { resolveHubCredential, resolveHubOrigin } from "./authority.js";
|
||||
import type { HubHttpClient, HubProject } from "./client.js";
|
||||
import type { HubHttpClient, HubProject } from "./hub-client/index.js";
|
||||
import type { HubCredentialStore } from "./credentials.js";
|
||||
import { reportHubProgress, type HubReporter } from "./reporter.js";
|
||||
import { addHubResolutionHelp } from "./help.js";
|
||||
|
||||
@@ -0,0 +1,117 @@
|
||||
#!/usr/bin/env npx tsx
|
||||
|
||||
import assert from "node:assert/strict";
|
||||
import { createServer } from "node:http";
|
||||
import type { AddressInfo } from "node:net";
|
||||
import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
|
||||
import { tmpdir } from "node:os";
|
||||
import path from "node:path";
|
||||
import { runLocalPaseo } from "./helpers/local-cli.js";
|
||||
|
||||
const cwd = await mkdtemp(path.join(tmpdir(), "paseo-hub-installed-"));
|
||||
const requests: Array<{ url: string | undefined; body: unknown }> = [];
|
||||
const server = createServer((request, response) => {
|
||||
let body = "";
|
||||
request.setEncoding("utf8");
|
||||
request.on("data", (chunk: string) => {
|
||||
body += chunk;
|
||||
});
|
||||
request.on("end", () => {
|
||||
requests.push({ url: request.url, body: JSON.parse(body) });
|
||||
const validation = request.url?.endsWith("/validate") === true;
|
||||
response.writeHead(validation ? 200 : 201, { "content-type": "application/json" });
|
||||
response.end(
|
||||
JSON.stringify(
|
||||
validation
|
||||
? { projectSlug: "studio", valid: true }
|
||||
: {
|
||||
projectSlug: "studio",
|
||||
version: 1,
|
||||
versionId: "2de5b143-1c88-42db-8a8d-71ca2af97830",
|
||||
active: true,
|
||||
},
|
||||
),
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
try {
|
||||
const workflows = path.join(cwd, ".paseo", "workflows");
|
||||
await mkdir(path.join(workflows, "partials"), { recursive: true });
|
||||
const files = [
|
||||
{
|
||||
path: ".paseo/hub.yml",
|
||||
content:
|
||||
"environments:\n studio:\n kind: daemon\n daemon: local\n cwd: /workspace\nagents:\n codex-safe:\n provider: codex\n options:\n sandbox_workspace_write:\n writable_roots: [/var/cache/npm]\n network_access: false\n",
|
||||
},
|
||||
{
|
||||
path: ".paseo/workflows/run.yml",
|
||||
content:
|
||||
"name: run\non: manual.run\nmax_runtime: 1h\ninputs:\n repo:\n type: string\n choices: [studio]\n agent:\n type: string\n choices: [codex-safe]\nsteps:\n - id: work\n environment: ${{ paseo.inputs.repo }}\n max_runtime: 30m\n idle_timeout: 5m\n agent: ${{ paseo.inputs.agent }}\n prompt:\n - include: partials/instructions.md\n - text: ${{ paseo.prompt }}\n",
|
||||
},
|
||||
{
|
||||
path: ".paseo/workflows/partials/instructions.md",
|
||||
content: "Keep structured provider options unchanged.\n",
|
||||
},
|
||||
];
|
||||
for (const file of files) await writeFile(path.join(cwd, file.path), file.content);
|
||||
|
||||
await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
|
||||
const address = server.address() as AddressInfo;
|
||||
const origin = `http://127.0.0.1:${address.port}`;
|
||||
const validate = await runLocalPaseo(
|
||||
[
|
||||
"hub",
|
||||
"deploy",
|
||||
"-p",
|
||||
"studio",
|
||||
"--dry-run",
|
||||
"--hub",
|
||||
origin,
|
||||
"--api-key",
|
||||
"test-secret",
|
||||
"--json",
|
||||
],
|
||||
{},
|
||||
cwd,
|
||||
);
|
||||
assert.equal(validate.exitCode, 0, validate.stderr);
|
||||
assert.deepEqual(JSON.parse(validate.stdout), {
|
||||
projectSlug: "studio",
|
||||
valid: true,
|
||||
workflows: 1,
|
||||
origin,
|
||||
});
|
||||
|
||||
const install = await runLocalPaseo(
|
||||
["hub", "deploy", "-p", "studio", "--hub", origin, "--api-key", "test-secret", "--json"],
|
||||
{},
|
||||
cwd,
|
||||
);
|
||||
assert.equal(install.exitCode, 0, install.stderr);
|
||||
|
||||
assert.deepEqual(
|
||||
requests.map(({ url, body }) => ({ url, body })),
|
||||
[
|
||||
{
|
||||
url: "/api/v1/configurations/validate",
|
||||
body: { projectSlug: "studio", files: files.toSorted(compareFiles) },
|
||||
},
|
||||
{
|
||||
url: "/api/v1/configurations/install",
|
||||
body: { projectSlug: "studio", files: files.toSorted(compareFiles) },
|
||||
},
|
||||
],
|
||||
);
|
||||
console.log("✅ installed Hub CLI deploys and validates the canonical bundle");
|
||||
} finally {
|
||||
server.closeAllConnections();
|
||||
await new Promise<void>((resolve) => server.close(() => resolve()));
|
||||
await rm(cwd, { recursive: true });
|
||||
}
|
||||
|
||||
function compareFiles(left: { path: string }, right: { path: string }): number {
|
||||
if (left.path < right.path) return -1;
|
||||
if (left.path > right.path) return 1;
|
||||
return 0;
|
||||
}
|
||||
@@ -3,7 +3,14 @@ import { join } from "node:path";
|
||||
|
||||
const CLI_ENTRY = join(import.meta.dirname, "..", "..", "dist", "index.js");
|
||||
|
||||
export function runLocalPaseo(args: string[], env: NodeJS.ProcessEnv = {}): ProcessPromise {
|
||||
export function runLocalPaseo(
|
||||
args: string[],
|
||||
env: NodeJS.ProcessEnv = {},
|
||||
cwd = process.cwd(),
|
||||
): ProcessPromise {
|
||||
$.verbose = false;
|
||||
return $({ env: { ...process.env, ...env } })`${process.execPath} ${CLI_ENTRY} ${args}`.nothrow();
|
||||
return $({
|
||||
cwd,
|
||||
env: { ...process.env, ...env },
|
||||
})`${process.execPath} ${CLI_ENTRY} ${args}`.nothrow();
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user