mirror of
https://github.com/boshu2/agentops.git
synced 2026-09-14 15:08:13 +08:00
Bo
23c0026500
## Summary Closes the findings from the v3.3.0 release-viability audit of main. **Surface truth (High):** `ao constraint`, `ao goals trace`, `ao session memory`, and `ao skills edit` are production tombstones but docs/cli-surface.md documented them as `public-tested`/`covered` (the test binary keeps constraint live, and the generated doc reflected the test build). Added `deprecated` allowlist rows, dropped the stale constraint-subcommand rows, regrouped constraint with its tombstone peers in the default spine, regenerated both surface projections, and added `TestCathedralCutTombstonesSurvivePruning` pinning the invariant that every Cathedral Cut verb keeps an executable tombstone. **Installer hardening (Medium):** `install-bd.sh` now fails closed when no published checksum exists for a release asset (explicit `--no-verify` overrides), and the curl|bash path verifies the fetched `installer-common.sh` against a pinned SHA-256 before sourcing it (drift-guarded by a new install-bd.bats test). **Docs (Medium/Low):** UPGRADING.md no longer links the MIGRATION-3.0.md file the Cathedral Cut deleted; CHANGELOG 3.3.0 `### Removed` now names `yield`, `constraint`, and the 3.2 `verify` front door and links the MIGRATION.md map. **Gate scripts (Low):** flywheel/provenance gate scripts build `ao` into `mktemp -d` scratch dirs instead of fixed world-known /tmp paths (symlink/TOCTOU on shared hosts). **Bonus (surfaced by the push gate):** `scripts/lib/preamble.sh` mis-resolved REPO_ROOT under git hook env (GIT_DIR without GIT_WORK_TREE), which made `go.cli-architecture` refuse every worktree-origin push touching `cli/cmd/ao/**`. Fixed by scrubbing the hook-injected discovery env around the rev-parse. ## Validation - `go build && go vet && go test ./...`: 5,085 tests green, golangci-lint clean - `ao gate check --fast`: 27/27 pass, including under simulated hook env - bats install-bd suite 6/6 incl. new pin drift test; shellcheck clean on all touched scripts - markdownlint clean; doc-release gate passes; tombstone exit codes verified on the built binary
68 lines
2.5 KiB
Bash
68 lines
2.5 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
# Lightweight smoke tests for scripts/install-bd.sh. Network-dependent paths
|
|
# (download, version-resolve from GitHub) are skipped here to keep CI offline-
|
|
# safe; the verify-existing-install short-circuit and the unsupported-platform
|
|
# branches are exercised.
|
|
|
|
setup() {
|
|
REPO_ROOT="$(cd "$BATS_TEST_DIRNAME/../.." && pwd)"
|
|
SCRIPT="$REPO_ROOT/scripts/install-bd.sh"
|
|
}
|
|
|
|
@test "script exists and is executable" {
|
|
[ -f "$SCRIPT" ]
|
|
[ -x "$SCRIPT" ]
|
|
}
|
|
|
|
@test "--help prints usage and exits 0" {
|
|
run "$SCRIPT" --help
|
|
[ "$status" -eq 0 ]
|
|
[[ "$output" == *"install the \`bd\`"* ]]
|
|
[[ "$output" == *"--version"* ]]
|
|
}
|
|
|
|
@test "rejects unknown flag" {
|
|
run "$SCRIPT" --bogus
|
|
[ "$status" -ne 0 ]
|
|
[[ "$output" == *"unknown flag"* ]]
|
|
}
|
|
|
|
@test "short-circuits when bd is already installed at the requested version" {
|
|
if ! command -v bd >/dev/null 2>&1; then
|
|
skip "bd not on PATH on this host"
|
|
fi
|
|
have="$(bd version 2>&1 | head -1 || true)"
|
|
# Pull the version number out of "bd version 1.0.3 (Homebrew)".
|
|
ver="$(printf '%s' "$have" | sed -n 's/.*version[[:space:]]\([0-9.][0-9.]*\).*/\1/p' | head -1)"
|
|
if [[ -z "$ver" ]]; then
|
|
skip "could not parse current bd version: $have"
|
|
fi
|
|
run "$SCRIPT" --version "v$ver"
|
|
[ "$status" -eq 0 ]
|
|
[[ "$output" == *"already installed"* ]] || [[ "$output" == *"skipping"* ]]
|
|
}
|
|
|
|
@test "bootstrap skill keeps bd install out of scope (install-bd.sh is the owner)" {
|
|
# Cathedral cut: bootstrap no longer installs runtimes; install-bd.sh owns beads.
|
|
run grep -q "install-bd.sh" "$REPO_ROOT/skills/bootstrap/SKILL.md"
|
|
[ "$status" -ne 0 ]
|
|
run grep -q "installing or invoking \`ao\`, \`br\`, \`bd\`" "$REPO_ROOT/skills/bootstrap/SKILL.md"
|
|
[ "$status" -eq 0 ]
|
|
[ -x "$SCRIPT" ]
|
|
}
|
|
|
|
@test "installer-common.sh pin in install-bd.sh matches the file on disk" {
|
|
# The curl|bash path of install-bd.sh sources installer-common.sh only
|
|
# after verifying it against INSTALLER_COMMON_SHA256. Any edit to
|
|
# installer-common.sh must bump that pin or remote installs fail closed.
|
|
pin="$(sed -n 's/^INSTALLER_COMMON_SHA256="\([0-9a-f]\{64\}\)"$/\1/p' "$SCRIPT")"
|
|
[ -n "$pin" ]
|
|
if command -v sha256sum >/dev/null 2>&1; then
|
|
actual="$(sha256sum "$REPO_ROOT/scripts/lib/installer-common.sh" | awk '{print $1}')"
|
|
else
|
|
actual="$(shasum -a 256 "$REPO_ROOT/scripts/lib/installer-common.sh" | awk '{print $1}')"
|
|
fi
|
|
[ "$pin" = "$actual" ]
|
|
}
|