Files
Julius Brussee 82864c8f4c feat: ship Caveman 2.0.0 — engine, proxy, SDKs, unified CLI
Single-commit port of the Caveman 2 tree onto the original repo history
(candidate caveman-2@88878a4 applied over main@3098342). No unrelated-history
merge; original history untouched.

Preserved v1 surfaces:
- skills/caveman/SKILL.md byte-for-byte, plus plugin mirror and caveman.skill zip
- legacy CI (Node 18/20/22 installer + Python 3.11 suites) alongside engine-ci
- cli/install.js compatibility shim forwarding to bin/install.js
- .codex/config.toml ships both hooks and codex_hooks for older Codex (#617)
- README Trendshift + Skills.sh badges and local star-history asset
- v1.10.0-pinned curl installs; benchmarks/tmp-starcharts ignore rules

Fixed for public same-repo release:
- SECURITY.md vulnerability reporting points at this repository
- release-binaries.yml publishes to this repo via job-scoped GITHUB_TOKEN
  (cross-repo PAT removed); binary-release environment still gates signing
- packages/cli/PUBLISHING.md rewritten for packages/ layout and same-repo flow
- profile-contract and provider-catalog lanes skip lane-scope gates on
  initial import so the launch PR can gate on their real validation steps
- ANNOUNCEMENT.md network claim corrected: compression is local; requests
  still go to the provider you configured

Caveman 2 stays opt-in: bin-v1.0.0 binaries and @caveman-ai/cli publish
separately after this lands and soaks.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BLvb5QniwYjmcawyssQNw9
2026-08-11 16:46:10 +02:00

67 lines
2.8 KiB
JavaScript

/**
* Runtime test: `cave providers verify <conn>` calls the real control-api verify
* endpoint and prints the actual status (not a hardcoded "active").
* Run with: node --test packages/cli/tests/providers-verify.runtime.mjs
* (Requires `tsc` build to dist first.)
*/
import { test } from "node:test";
import assert from "node:assert/strict";
import { spawn } from "node:child_process";
import { createServer } from "node:http";
import { mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join, dirname } from "node:path";
import { fileURLToPath } from "node:url";
const here = dirname(fileURLToPath(import.meta.url));
const cli = join(here, "..", "dist", "index.js");
test("providers verify hits the real endpoint and prints the real status", async () => {
let captured = null;
const server = createServer((req, res) => {
let body = "";
req.on("data", (c) => (body += c));
req.on("end", () => {
captured = { method: req.method, url: req.url, csrf: req.headers["x-cave-csrf"], auth: req.headers["authorization"] };
res.setHeader("content-type", "application/json");
// Deliberately NOT "active" — proves the CLI returns the server's value.
res.end(JSON.stringify({ status: "error", reason: "stub upstream unreachable" }));
});
});
await new Promise((r) => server.listen(0, r));
const port = server.address().port;
const home = mkdtempSync(join(tmpdir(), "cave-cli-"));
mkdirSync(join(home, ".caveman-cloud"));
writeFileSync(
join(home, ".caveman-cloud", "config.json"),
JSON.stringify({ baseURL: `http://127.0.0.1:${port}`, token: "test-token", projectId: "proj-123" }),
);
// Use async spawn (not spawnSync): spawnSync blocks the event loop, so the
// in-process server can never service the CLI's fetch — a deterministic
// deadlock. Async spawn keeps the loop alive to answer the request.
const out = await new Promise((resolve, reject) => {
const child = spawn("node", [cli, "providers", "verify", "conn-abc"], {
env: { ...process.env, HOME: home },
});
let stdout = "";
let stderr = "";
child.stdout.on("data", (c) => (stdout += c));
child.stderr.on("data", (c) => (stderr += c));
child.on("error", reject);
child.on("close", (status) => resolve({ status, stdout, stderr }));
});
server.close();
assert.equal(out.status, 0, `cli exited ${out.status}: ${out.stderr}`);
assert.ok(captured, "server should have been called");
assert.equal(captured.method, "POST");
assert.equal(captured.url, "/api/v1/projects/proj-123/providers/conn-abc/verify");
assert.equal(captured.csrf, "cli");
assert.equal(captured.auth, "Bearer test-token");
// The printed status must be the server's, not a hardcoded "active".
assert.match(out.stdout, /"status":\s*"error"/);
assert.doesNotMatch(out.stdout, /"status":\s*"active"/);
});