mirror of
https://github.com/callstack/agent-device.git
synced 2026-09-14 20:06:34 +08:00
05a1d76f2e
* test: gate daemon RPC wire compatibility against the last released tag (#1432) ADR 0006 fixes exactly when DAEMON_RPC_PROTOCOL_VERSION must be bumped, and nothing checked that it was. The runtime guard (readRemoteDaemonHealth) refuses a mismatched peer, but only fires when someone remembered the bump — a wire change that skipped it left both sides advertising protocol 2 while parsing different payloads, which is the failure ADR 0006 exists to prevent. Local daemons cannot skew (isReusableDaemonInfo takes over on any package version mismatch). Cross-machine is skewed by design — proxy, cloud/limrun, a remote macOS host — and ADR 0006 explicitly rules package version out as the compatibility gate there, so the one boundary where skew is intended was the one boundary with no gate. test/wire-compat/surface.ts declares the wire surface grouped by the ADR bullet each group serves, quoting it, with an `uncovered` note where a bullet is only partly digestible (the /health and /rpc literals inside http-server.ts stay reviewer-owned: a moved route 404s at connect time rather than misparsing). ledger.json records what each declaration hashes to, at which protocol version. Two gates, split for the same reason the replay-compat corpus splits: - unit-core holds the ledger to its source and prints the digest to paste; - Released-Surface Compatibility reads the ledger at the last RELEASED tag and requires the drift since then to carry a bump or a compatibleChanges ack. From one commit a bumped ledger and an unbumped one are both just an edited file, so only a released baseline can tell them apart. Acks are keyed by the digest they cover, so one "added an optional field" cannot launder later changes. Digests ignore comments and formatting; the manifest's closure is derived from the AST, so a field typed by an unlisted sibling fails rather than sitting outside the gate. CI cost: one added job (checkout + toolchain + two node scripts, ~1 min), mirroring the existing full-history replay-compat job. * test: close wire-surface overclaim and make the closure fail closed (#1432) Addresses both review P1s on #1717. P1 — the manifest materially overclaimed ADR 0006 coverage. It quoted all four bullets while digesting only the payload TYPES, so the producer and consumer seams could break a skewed peer without moving a listed digest. Now listed on both sides of every boundary: JSON-RPC method sets and the projections that turn each method's params into a DaemonRequest, createRpcError/sendJson/ writeRpcResponseEnvelope, resolveToken and the auth-hook types, upload preflight/finalize/308 handlers and the resumable ticket shape, artifact route and download/inventory framing, REST error mapping, and the client's own payload builder, lease-method mapping, response parser and error projection. 57 -> 117 declarations. What stays out is now named rather than implied: createDaemonHttpServer's dispatch wiring and the /health and /rpc literals inside it. Everything it dispatches WITH is digested individually, and a moved route 404s at connect time rather than misparsing — the loud failure, not the silent one. P1 — imported and re-exported payload shapes escaped the closure. declarationHomes() scanned only the manifest's own files and the walk continued silently when a name could not be placed, so a listed type could gain foo?: ImportedShape from a new module and stay green. Resolution is now explicit and fails closed: relative imports, workspace specifiers (through the owning package's own exports map, so a re-pointed export cannot drop a type), and facade re-export chains. Every referenced name must land on a listed declaration, a waiver with a written reason, a declared external module, or the TS/Node global set. Fixed two extractor blind spots the walk exposed: a declaration's own generic parameters and `as const` were being reported as references. Planted-red proofs (wire-mutations.test.ts): 13 cases independently mutate method naming, response serialization, response parsing, auth projection, upload ticket shape, 308 framing, artifact framing, REST error mapping, and progress framing, each asserting the digest moves; 3 probes prove the closure really reaches across a package boundary, a facade re-export, and a plain relative import. Mutations apply inside the declaration's own span — a whole-file replace silently hit a sibling sharing the substring, which is how the first draft of one case passed vacuously. The largest waiver pair (InternalRequestOptions, CommandFlags) rests on ADR 0006's own additive rule: they reach the peer inside DaemonRequest's untyped flags/input bags, and the decision says a new flag needs no bump. Digesting them would fire the gate on every new CLI flag and train reviewers to rubber-stamp acks. * test: list the consumer half of the auxiliary HTTP boundaries (#1432) Addresses the remaining review P1 on #1717. The manifest claimed both sides of response/upload/artifact framing while listing nothing from upload-client.ts, daemon-artifacts.ts, or the health consumer in daemon-client-transport.ts, so those parsers could narrow without moving a listed digest or protocol 2. Now listed (117 -> 141 declarations): - /health consumer: RemoteDaemonHealth, readHealthPayload, readDaemonHttpHealth, readRemoteDaemonHealth. This is the sharpest of the three — narrowing the reader or the comparison disables the very refusal ADR 0006 exists to guarantee, and nothing else in the repo would notice. - /upload consumer: UploadResponse, UploadPreflightResponse, UploadPreflightResult, parseUploadPreflightResult, requestUploadPreflight, uploadDirectArtifact, tryDirectUploadWithResume, shouldRetryDirectUpload, finalizeDirectUpload, uploadLegacyArtifact, ARTIFACT_HASH_ALGORITHM, isStringRecord, and PreparedUploadArtifact — whose sha256/sizeBytes/fileName/artifactType/ contentType fields ARE the preflight body the daemon parses. - /artifacts/* consumer: DaemonArtifactEndpoint, buildDaemonArtifactUrl, isRemoteDaemon, DownloadRemoteArtifactParams, downloadRemoteArtifact, materializeRemoteArtifacts, resolveMaterializedArtifactPath. Running the closure fail-closed over the new files surfaced three more stops, each decided rather than skipped: PreparedUploadArtifact listed (it is payload), UploadProgressSink waived (client-local rendering, never leaves the process), and src/daemon/types.ts#DaemonArtifact waived as a re-export alias of the listed kernel type, matching its DaemonRequest/DaemonResponse siblings. 10 more planted-red mutations cover the new seams: health version-read and mismatch-refusal defeated, RemoteDaemonHealth field dropped, preflight parser narrowed, preflight/legacy response shapes narrowed, finalize body key renamed, ticket field renamed, artifact tenant header dropped, artifact URL moved. A fourth closure probe proves the upload-consumer files are genuinely reached by the walk rather than merely listed. 22 -> 33 tests. The README now states the coverage as a producer/consumer table per boundary, so the claim is checkable at a glance instead of asserted in prose. * test: list the client half of the resumable 308 contract (#1432) Addresses the third review P1 on #1717. Listing the daemon's handleResumableUpload proved it still PRODUCES 308; nothing proved the client still CONSUMES the released one. src/remote/upload-stream.ts owns that half and was entirely outside the manifest, so a newer client could stop accepting `upload-offset`, change how it reads `Range: bytes=0-N`, or emit a different resumed `Content-Range` without moving one of the 141 listed digests. Now listed (141 -> 151): UploadStreamResponse, streamFileToHttpRequest, streamFileToHttpRequestAttempt, buildUploadRequestHeaders, isUploadResumeStatus, isUploadRedirectStatus, parseUploadResumeOffset, parseNonNegativeIntegerHeader, firstHeaderValue, MAX_UPLOAD_REDIRECTS. streamFileToHttpRequestAttempt is listed despite its size, unlike createDaemonHttpServer which stays in `uncovered`. The distinction is stated at the declaration: the HTTP server only dispatches to handlers that are each digested, while the attempt loop IS the resume state machine — it decides whether a 308 continues the upload and what the next request carries, so its sequencing alone can break a released daemon while every helper keeps its digest. 6 new planted-red mutations prove the client half moves the ledger: a dropped `upload-offset` fallback, narrowed Range parsing, a changed resumed Content-Range, 308 no longer treated as continue, a narrowed UploadStreamResponse, and dropped header-value coercion. 33 -> 39 tests. Closure fail-closed surfaced two more stops: UploadStreamProgressOptions waived (local byte-progress rendering) and URL/URLSearchParams added to the global set. README now carries a `/upload` resume row in the producer/consumer table, and names the pattern behind three rounds of review: the coverage sentence kept getting written ahead of the coverage, so the table and the `uncovered` notes are the claims to trust — they are checkable against surface.ts, prose is not. --------- Co-authored-by: Claude <noreply@anthropic.com>
217 lines
8.3 KiB
TypeScript
217 lines
8.3 KiB
TypeScript
/**
|
|
* Where does a type name a wire declaration references actually come from?
|
|
* (#1432, review P1: imported payload shapes escaped the closure.)
|
|
*
|
|
* The first version of the closure check only scanned the manifest's own files
|
|
* and silently skipped any name it could not place. That made the claim hollow
|
|
* in exactly the case that matters: a listed type could grow
|
|
* `foo?: ImportedShape` from a module nobody had listed, and the declaration
|
|
* deciding what the peer parses stayed ungated while every test passed.
|
|
*
|
|
* So resolution is explicit and FAILS CLOSED. A referenced name is acceptable
|
|
* only when it lands in one of three places, each of which someone had to
|
|
* write down: a repo file (then it must be listed or waived), a module the
|
|
* manifest declares external, or the TypeScript global set.
|
|
*/
|
|
|
|
import fs from 'node:fs';
|
|
import path from 'node:path';
|
|
import { parseSync } from 'oxc-parser';
|
|
|
|
export type ResolvedOrigin =
|
|
/** Declared or imported from a file inside this repository. */
|
|
| { kind: 'repo'; file: string; name: string }
|
|
/** Imported from a module the manifest lists as an external leaf. */
|
|
| { kind: 'external'; specifier: string; name: string }
|
|
/** A TypeScript global (`Record`, `Partial`, `ReturnType`, …). */
|
|
| { kind: 'global'; name: string }
|
|
/** Nothing could place it — the fail-closed case. */
|
|
| { kind: 'unresolved'; name: string };
|
|
|
|
/**
|
|
* Ambient TypeScript/ES types that have no declaration site in this repo. They
|
|
* shape a payload only through their arguments, and every argument is itself a
|
|
* reference the walk already visits (`Partial<DaemonRequest>` reports
|
|
* `DaemonRequest`), so treating the constructor as a leaf loses nothing.
|
|
*/
|
|
const TS_GLOBALS = new Set([
|
|
'Array',
|
|
'Awaited',
|
|
'Date',
|
|
'Error',
|
|
'Exclude',
|
|
'Extract',
|
|
'Map',
|
|
'NonNullable',
|
|
'Omit',
|
|
'Parameters',
|
|
'Partial',
|
|
'Pick',
|
|
'Promise',
|
|
'PromiseLike',
|
|
'Readonly',
|
|
'ReadonlyArray',
|
|
'Record',
|
|
'RegExp',
|
|
'Required',
|
|
'ReturnType',
|
|
'Set',
|
|
'URL',
|
|
'URLSearchParams',
|
|
'Uint8Array',
|
|
'WeakMap',
|
|
]);
|
|
|
|
/**
|
|
* Node globals that reach a declaration's types without an import. Same
|
|
* reasoning as TS_GLOBALS: no declaration site in this repo to digest.
|
|
*/
|
|
const NODE_GLOBALS = new Set(['Buffer', 'NodeJS']);
|
|
|
|
type ImportBinding = { specifier: string; importedName: string };
|
|
|
|
/** Name → module it is re-exported from, for one module's `export … from` list. */
|
|
function reExportBindings(file: string, source: string): Map<string, ImportBinding> {
|
|
const bindings = new Map<string, ImportBinding>();
|
|
const parsed = parseSync(file, source);
|
|
for (const staticExport of parsed.module.staticExports) {
|
|
for (const entry of staticExport.entries) {
|
|
const specifier = entry.moduleRequest?.value;
|
|
const exported = entry.exportName.kind === 'Name' ? entry.exportName.name : null;
|
|
if (!specifier || !exported) continue;
|
|
bindings.set(exported, {
|
|
specifier,
|
|
importedName:
|
|
entry.localName.kind === 'Name' ? (entry.localName.name ?? exported) : exported,
|
|
});
|
|
}
|
|
}
|
|
return bindings;
|
|
}
|
|
|
|
/** Local name → where it was imported from, for one module. */
|
|
function importBindings(file: string, source: string): Map<string, ImportBinding> {
|
|
const bindings = new Map<string, ImportBinding>();
|
|
const parsed = parseSync(file, source);
|
|
for (const staticImport of parsed.module.staticImports) {
|
|
const specifier = staticImport.moduleRequest.value;
|
|
for (const entry of staticImport.entries) {
|
|
const importedName =
|
|
entry.importName.kind === 'Name' ? (entry.importName.name ?? '') : entry.localName.value;
|
|
bindings.set(entry.localName.value, { specifier, importedName });
|
|
}
|
|
}
|
|
return bindings;
|
|
}
|
|
|
|
// Two forms reach repo code: relative specifiers carry their `.ts` extension
|
|
// here, so they resolve by path; workspace specifiers go through exports maps.
|
|
function resolveRelative(repoRoot: string, fromFile: string, specifier: string): string | null {
|
|
const resolved = path.resolve(path.dirname(path.join(repoRoot, fromFile)), specifier);
|
|
return fs.existsSync(resolved) ? path.relative(repoRoot, resolved) : null;
|
|
}
|
|
|
|
/**
|
|
* Resolves through the owning package's own `exports` map rather than guessing
|
|
* `packages/<name>/src/<sub>.ts`: the map is where the package declares which
|
|
* file backs a subpath, so a re-pointed export cannot silently drop a type out
|
|
* of the closure.
|
|
*/
|
|
function resolveWorkspace(repoRoot: string, specifier: string): string | null {
|
|
const workspace = /^@agent-device\/([^/]+)(?:\/(.+))?$/.exec(specifier);
|
|
if (!workspace) return null;
|
|
|
|
const packageDir = path.join('packages', workspace[1]!);
|
|
const manifestPath = path.join(repoRoot, packageDir, 'package.json');
|
|
if (!fs.existsSync(manifestPath)) return null;
|
|
|
|
const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8')) as {
|
|
exports?: Record<string, { types?: string; default?: string }>;
|
|
};
|
|
const subpath = workspace[2] ? `./${workspace[2]}` : '.';
|
|
const target = manifest.exports?.[subpath] ?? {};
|
|
const entry = target.types ?? target.default;
|
|
if (!entry) return null;
|
|
|
|
const relative = path.join(packageDir, entry);
|
|
return fs.existsSync(path.join(repoRoot, relative)) ? relative : null;
|
|
}
|
|
|
|
/** Repo-relative file a specifier points at, or null when it leaves the repo. */
|
|
function resolveModuleFile(repoRoot: string, fromFile: string, specifier: string): string | null {
|
|
return specifier.startsWith('.')
|
|
? resolveRelative(repoRoot, fromFile, specifier)
|
|
: resolveWorkspace(repoRoot, specifier);
|
|
}
|
|
|
|
export type OriginResolver = (file: string, name: string) => ResolvedOrigin;
|
|
|
|
/**
|
|
* Builds a resolver that answers, for a name referenced inside `file`, where
|
|
* its declaration lives. `declaresLocally` reports whether a file declares a
|
|
* top-level name, and `externalSpecifier` decides whether a specifier the
|
|
* manifest could not follow is an accepted external leaf.
|
|
*/
|
|
export function createOriginResolver(options: {
|
|
repoRoot: string;
|
|
readSource: (file: string) => string;
|
|
declaresLocally: (file: string, name: string) => boolean;
|
|
isExternalSpecifier: (specifier: string) => boolean;
|
|
}): OriginResolver {
|
|
const { repoRoot, readSource, declaresLocally, isExternalSpecifier } = options;
|
|
const importsByFile = new Map<string, Map<string, ImportBinding>>();
|
|
const reExportsByFile = new Map<string, Map<string, ImportBinding>>();
|
|
|
|
function cached(
|
|
cache: Map<string, Map<string, ImportBinding>>,
|
|
file: string,
|
|
read: (file: string, source: string) => Map<string, ImportBinding>,
|
|
): Map<string, ImportBinding> {
|
|
let bindings = cache.get(file);
|
|
if (!bindings) {
|
|
bindings = read(file, readSource(file));
|
|
cache.set(file, bindings);
|
|
}
|
|
return bindings;
|
|
}
|
|
|
|
/**
|
|
* Follows `export { X } from './y.ts'` chains. A façade re-exporting a wire
|
|
* type must land on the file that DECLARES it, or the closure would key on
|
|
* the façade — which declares nothing — and report the real declaration as
|
|
* missing while the façade itself can never be digested.
|
|
*/
|
|
function throughReExports(file: string, name: string, depth = 0): ResolvedOrigin {
|
|
if (declaresLocally(file, name)) return { kind: 'repo', file, name };
|
|
if (depth > 8) return { kind: 'unresolved', name };
|
|
|
|
const binding = cached(reExportsByFile, file, reExportBindings).get(name);
|
|
if (!binding) return { kind: 'repo', file, name };
|
|
|
|
const resolved = resolveModuleFile(repoRoot, file, binding.specifier);
|
|
if (resolved) return throughReExports(resolved, binding.importedName, depth + 1);
|
|
if (isExternalSpecifier(binding.specifier)) {
|
|
return { kind: 'external', specifier: binding.specifier, name: binding.importedName };
|
|
}
|
|
return { kind: 'unresolved', name };
|
|
}
|
|
|
|
return (file, name) => {
|
|
if (declaresLocally(file, name)) return { kind: 'repo', file, name };
|
|
|
|
const binding = cached(importsByFile, file, importBindings).get(name);
|
|
if (!binding) {
|
|
return TS_GLOBALS.has(name) || NODE_GLOBALS.has(name)
|
|
? { kind: 'global', name }
|
|
: { kind: 'unresolved', name };
|
|
}
|
|
|
|
const resolved = resolveModuleFile(repoRoot, file, binding.specifier);
|
|
if (resolved) return throughReExports(resolved, binding.importedName);
|
|
if (isExternalSpecifier(binding.specifier)) {
|
|
return { kind: 'external', specifier: binding.specifier, name: binding.importedName };
|
|
}
|
|
return { kind: 'unresolved', name };
|
|
};
|
|
}
|