mirror of
https://github.com/Jeuners/ECC.git
synced 2026-09-09 15:02:30 +02:00
feat: connect ECC to canonical Ito compute CLI (#2558)
This commit is contained in:
Affaan Mustafa
GitHub
parent
9d54ee222d
commit
bc774282e6
32 changed files with 1043 additions and 1275 deletions
|
|
@ -39,6 +39,7 @@ function run(args = [], options = {}) {
|
|||
env,
|
||||
encoding: 'utf8',
|
||||
stdio: ['pipe', 'pipe', 'pipe'],
|
||||
maxBuffer: 4 * 1024 * 1024,
|
||||
timeout: options.timeout || DEFAULT_INSTALL_APPLY_TIMEOUT_MS,
|
||||
});
|
||||
|
||||
|
|
|
|||
293
tests/scripts/ito-cli-bridge.test.js
Normal file
293
tests/scripts/ito-cli-bridge.test.js
Normal file
|
|
@ -0,0 +1,293 @@
|
|||
/**
|
||||
* End-to-end contract tests for ECC's real local Itô CLI bridge.
|
||||
*
|
||||
* The executable used here is a process-boundary probe. It never contacts an
|
||||
* Itô API, submits an RFQ, opens a browser, or reaches a GPU node.
|
||||
*/
|
||||
|
||||
const assert = require("assert");
|
||||
const fs = require("fs");
|
||||
const os = require("os");
|
||||
const path = require("path");
|
||||
const { spawnSync } = require("child_process");
|
||||
|
||||
const REPO_ROOT = path.join(__dirname, "..", "..");
|
||||
const ECC_SCRIPT = path.join(REPO_ROOT, "scripts", "ecc.js");
|
||||
const CANONICAL_PACKAGE = "Ito-Markets/ito-cloud-runtime/cli/ito-compute-cli";
|
||||
|
||||
function runCli(args, environment = {}) {
|
||||
return spawnSync(process.execPath, [ECC_SCRIPT, ...args], {
|
||||
cwd: REPO_ROOT,
|
||||
encoding: "utf8",
|
||||
env: {
|
||||
...process.env,
|
||||
NODE_ENV: "test",
|
||||
...environment,
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
function makeItoProbe(exitCode = 0) {
|
||||
const directory = fs.mkdtempSync(path.join(os.tmpdir(), "ecc-ito-cli-"));
|
||||
const log = path.join(directory, "invocation.json");
|
||||
const script = path.join(directory, "ito-probe.js");
|
||||
const executable = script;
|
||||
fs.writeFileSync(
|
||||
script,
|
||||
[
|
||||
`#!${process.execPath}`,
|
||||
'"use strict";',
|
||||
'const fs = require("fs");',
|
||||
`fs.writeFileSync(${JSON.stringify(log)}, JSON.stringify({ argv: process.argv.slice(2), env: process.env }));`,
|
||||
'process.stdout.write(`ito-probe:${process.argv.slice(2).join("|")}\\n`);',
|
||||
'process.stderr.write("ito-probe-stderr\\n");',
|
||||
`process.exit(${exitCode});`,
|
||||
"",
|
||||
].join("\n")
|
||||
);
|
||||
if (process.platform !== "win32") {
|
||||
fs.chmodSync(script, 0o755);
|
||||
}
|
||||
return Object.freeze({ directory, executable, log });
|
||||
}
|
||||
|
||||
function readInvocation(probe) {
|
||||
return JSON.parse(fs.readFileSync(probe.log, "utf8"));
|
||||
}
|
||||
|
||||
function runTest(name, fn) {
|
||||
try {
|
||||
fn();
|
||||
console.log(` ✓ ${name}`);
|
||||
return true;
|
||||
} catch (error) {
|
||||
console.log(` ✗ ${name}`);
|
||||
console.error(` ${error.message}`);
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
function main() {
|
||||
console.log("\n=== Testing ECC × Itô real CLI bridge ===\n");
|
||||
|
||||
const tests = [
|
||||
["forwards only auth, find, and status to an explicit local executable", () => {
|
||||
for (const command of ["auth", "find", "status"]) {
|
||||
const probe = makeItoProbe();
|
||||
try {
|
||||
const result = runCli(["ito", command], {
|
||||
ECC_ITO_CLI_EXECUTABLE: probe.executable,
|
||||
});
|
||||
assert.strictEqual(result.status, 0, result.stderr);
|
||||
assert.deepStrictEqual(readInvocation(probe).argv, [command]);
|
||||
assert.match(result.stdout, new RegExp(`ito-probe:${command}`));
|
||||
} finally {
|
||||
fs.rmSync(probe.directory, { recursive: true, force: true });
|
||||
}
|
||||
}
|
||||
}],
|
||||
["normalizes JSON and forwards every RFQ constraint without interpretation", () => {
|
||||
const probe = makeItoProbe();
|
||||
try {
|
||||
const args = [
|
||||
"ito",
|
||||
"find",
|
||||
"--gpu", "h200",
|
||||
"--count", "8",
|
||||
"--nodes", "1",
|
||||
"--gpus-per-node", "8",
|
||||
"--days", "30",
|
||||
"--storage-tb", "1",
|
||||
"--start-window", "2099-08-15",
|
||||
"--max-rate", "3.00",
|
||||
"--form-factor", "bare_metal",
|
||||
"--contract-type", "reservation",
|
||||
"--fabric", "infiniband",
|
||||
"--region", "us-east-1",
|
||||
"--json",
|
||||
];
|
||||
const result = runCli(args, {
|
||||
ECC_ITO_CLI_EXECUTABLE: probe.executable,
|
||||
});
|
||||
assert.strictEqual(result.status, 0, result.stderr);
|
||||
assert.deepStrictEqual(readInvocation(probe).argv, [
|
||||
"--json",
|
||||
...args.slice(1, -1),
|
||||
]);
|
||||
} finally {
|
||||
fs.rmSync(probe.directory, { recursive: true, force: true });
|
||||
}
|
||||
}],
|
||||
["passes only the required Itô runtime settings across the process boundary", () => {
|
||||
const probe = makeItoProbe();
|
||||
try {
|
||||
const result = runCli(["ito", "auth"], {
|
||||
ECC_ITO_CLI_EXECUTABLE: probe.executable,
|
||||
ITO_API_KEY: "ito_test_key",
|
||||
ITO_API_URL: "https://compute.example.test",
|
||||
ITO_INVENTORY_URL: "https://edge.example.test",
|
||||
AWS_SECRET_ACCESS_KEY: "must-not-cross",
|
||||
OPENAI_API_KEY: "must-not-cross",
|
||||
TEST_PASSWORD: "must-not-cross",
|
||||
});
|
||||
assert.strictEqual(result.status, 0, result.stderr);
|
||||
const childEnvironment = readInvocation(probe).env;
|
||||
assert.strictEqual(childEnvironment.ITO_API_KEY, "ito_test_key");
|
||||
assert.strictEqual(childEnvironment.ITO_API_URL, "https://compute.example.test");
|
||||
assert.strictEqual(childEnvironment.ITO_INVENTORY_URL, "https://edge.example.test");
|
||||
assert.strictEqual(childEnvironment.AWS_SECRET_ACCESS_KEY, undefined);
|
||||
assert.strictEqual(childEnvironment.OPENAI_API_KEY, undefined);
|
||||
assert.strictEqual(childEnvironment.TEST_PASSWORD, undefined);
|
||||
assert.strictEqual(childEnvironment.ECC_ITO_CLI_EXECUTABLE, undefined);
|
||||
} finally {
|
||||
fs.rmSync(probe.directory, { recursive: true, force: true });
|
||||
}
|
||||
}],
|
||||
["rejects unsupported, browser, simulated, and node operations before spawning", () => {
|
||||
for (const command of ["rent", "lock", "run", "inference", "evals", "mcp"]) {
|
||||
const probe = makeItoProbe();
|
||||
try {
|
||||
const result = runCli(["ito", command], {
|
||||
ECC_ITO_CLI_EXECUTABLE: probe.executable,
|
||||
});
|
||||
assert.notStrictEqual(result.status, 0, command);
|
||||
assert.match(result.stderr, /only auth, find, and status/i);
|
||||
assert.ok(!fs.existsSync(probe.log), `${command} must not spawn the Itô CLI`);
|
||||
} finally {
|
||||
fs.rmSync(probe.directory, { recursive: true, force: true });
|
||||
}
|
||||
}
|
||||
}],
|
||||
["fails closed rather than simulating a dry-run RFQ", () => {
|
||||
const probe = makeItoProbe();
|
||||
try {
|
||||
const result = runCli(["--dry-run", "ito", "find"], {
|
||||
ECC_ITO_CLI_EXECUTABLE: probe.executable,
|
||||
});
|
||||
assert.notStrictEqual(result.status, 0);
|
||||
assert.match(result.stderr, /no paper or dry-run success mode/i);
|
||||
assert.ok(!fs.existsSync(probe.log));
|
||||
} finally {
|
||||
fs.rmSync(probe.directory, { recursive: true, force: true });
|
||||
}
|
||||
}],
|
||||
["fails closed with exact local install guidance when the explicit CLI is absent", () => {
|
||||
const emptyPath = fs.mkdtempSync(path.join(os.tmpdir(), "ecc-empty-path-"));
|
||||
try {
|
||||
const result = runCli(["ito", "status"], {
|
||||
ECC_ITO_CLI_EXECUTABLE: "",
|
||||
PATH: emptyPath,
|
||||
});
|
||||
assert.notStrictEqual(result.status, 0);
|
||||
assert.match(result.stderr, /canonical ito-compute-cli is unpublished/i);
|
||||
assert.match(result.stderr, new RegExp(CANONICAL_PACKAGE.replaceAll("/", "\\/")));
|
||||
assert.match(result.stderr, /npm run check/);
|
||||
assert.match(result.stderr, /ECC_ITO_CLI_EXECUTABLE/);
|
||||
assert.match(result.stderr, /explicit absolute/i);
|
||||
assert.match(result.stderr, /unpublished/i);
|
||||
assert.doesNotMatch(result.stderr, /npx|npm exec|npm link|install -g/i);
|
||||
} finally {
|
||||
fs.rmSync(emptyPath, { recursive: true, force: true });
|
||||
}
|
||||
}],
|
||||
["never forwards Itô credentials to an unverified PATH collision", () => {
|
||||
const collisionDirectory = fs.mkdtempSync(
|
||||
path.join(os.tmpdir(), "ecc-hostile-ito-path-")
|
||||
);
|
||||
const stolenEnvironment = path.join(collisionDirectory, "stolen.json");
|
||||
const executable = path.join(
|
||||
collisionDirectory,
|
||||
process.platform === "win32" ? "ito.exe" : "ito"
|
||||
);
|
||||
try {
|
||||
fs.writeFileSync(
|
||||
executable,
|
||||
[
|
||||
`#!${process.execPath}`,
|
||||
'"use strict";',
|
||||
'const fs = require("fs");',
|
||||
`fs.writeFileSync(${JSON.stringify(stolenEnvironment)}, JSON.stringify(process.env));`,
|
||||
"",
|
||||
].join("\n")
|
||||
);
|
||||
if (process.platform !== "win32") {
|
||||
fs.chmodSync(executable, 0o755);
|
||||
}
|
||||
|
||||
const result = runCli(["ito", "auth"], {
|
||||
ECC_ITO_CLI_EXECUTABLE: "",
|
||||
ITO_API_KEY: "must-never-reach-path-collision",
|
||||
PATH: collisionDirectory,
|
||||
});
|
||||
|
||||
assert.notStrictEqual(result.status, 0);
|
||||
assert.match(result.stderr, /explicit absolute|ECC_ITO_CLI_EXECUTABLE/i);
|
||||
assert.ok(
|
||||
!fs.existsSync(stolenEnvironment),
|
||||
"an unverified PATH executable must never receive the Itô credential"
|
||||
);
|
||||
} finally {
|
||||
fs.rmSync(collisionDirectory, { recursive: true, force: true });
|
||||
}
|
||||
}],
|
||||
["rejects a relative executable override instead of searching or guessing", () => {
|
||||
const result = runCli(["ito", "status"], {
|
||||
ECC_ITO_CLI_EXECUTABLE: "ito",
|
||||
});
|
||||
assert.notStrictEqual(result.status, 0);
|
||||
assert.match(result.stderr, /must be an absolute path/i);
|
||||
}],
|
||||
["preserves the real CLI exit code and output without a success wrapper", () => {
|
||||
const probe = makeItoProbe(7);
|
||||
try {
|
||||
const result = runCli(["ito", "status"], {
|
||||
ECC_ITO_CLI_EXECUTABLE: probe.executable,
|
||||
});
|
||||
assert.strictEqual(result.status, 7);
|
||||
assert.match(result.stdout, /ito-probe:status/);
|
||||
assert.match(result.stderr, /ito-probe-stderr/);
|
||||
assert.doesNotMatch(result.stdout, /manual_handoff|simulated|paper/i);
|
||||
} finally {
|
||||
fs.rmSync(probe.directory, { recursive: true, force: true });
|
||||
}
|
||||
}],
|
||||
["help exposes the truthful CLI and MCP surface without a browser path", () => {
|
||||
const probe = makeItoProbe();
|
||||
try {
|
||||
const result = runCli(["ito", "--help"], {
|
||||
ECC_ITO_CLI_EXECUTABLE: probe.executable,
|
||||
});
|
||||
assert.strictEqual(result.status, 0, result.stderr);
|
||||
assert.match(result.stdout, /ecc ito auth/);
|
||||
assert.match(result.stdout, /ecc ito find/);
|
||||
assert.match(result.stdout, /ecc ito status/);
|
||||
assert.match(result.stdout, /ito_auth/);
|
||||
assert.match(result.stdout, /ito_find/);
|
||||
assert.match(result.stdout, /ito_status/);
|
||||
assert.match(result.stdout, new RegExp(CANONICAL_PACKAGE.replaceAll("/", "\\/")));
|
||||
assert.match(result.stdout, /unpublished/i);
|
||||
assert.match(result.stdout, /never discovers[^\n]*through PATH/i);
|
||||
assert.doesNotMatch(
|
||||
result.stdout,
|
||||
/manual copy|open(?:s)? (?:a )?browser|ito_lock|ito_run|npm link|paper|simulat/i
|
||||
);
|
||||
assert.ok(!fs.existsSync(probe.log));
|
||||
} finally {
|
||||
fs.rmSync(probe.directory, { recursive: true, force: true });
|
||||
}
|
||||
}],
|
||||
];
|
||||
|
||||
let passed = 0;
|
||||
let failed = 0;
|
||||
for (const [name, fn] of tests) {
|
||||
if (runTest(name, fn)) passed += 1;
|
||||
else failed += 1;
|
||||
}
|
||||
|
||||
console.log(`\nPassed: ${passed}`);
|
||||
console.log(`Failed: ${failed}`);
|
||||
process.exit(failed > 0 ? 1 : 0);
|
||||
}
|
||||
|
||||
main();
|
||||
|
|
@ -61,7 +61,13 @@ function assertHonestComputeCopy(content) {
|
|||
assert.match(content, /preferred compute sponsor/i);
|
||||
assert.match(content, /run or self-host any open-source model/i);
|
||||
assert.match(content, /any GPU provider/i);
|
||||
assert.match(content, /sponsorship link is passive/i);
|
||||
assert.match(content, /ecc ito find/i);
|
||||
assert.match(content, /explicitly configured canonical Itô CLI/i);
|
||||
assert.match(content, /submits a live authenticated RFQ/i);
|
||||
assert.match(content, /does not reserve capacity/i);
|
||||
assert.match(content, /managed inference[^\n.]*not live/i);
|
||||
assert.doesNotMatch(content, /ECC only (?:links|provides this link)/i);
|
||||
}
|
||||
|
||||
function main() {
|
||||
|
|
@ -90,7 +96,7 @@ function main() {
|
|||
assertHonestComputeCopy(readme);
|
||||
assert.match(
|
||||
readme,
|
||||
/custom API endpoint or model gateway[\s\S]*Run or self-host any open-source model behind that gateway[\s\S]*ECC only links to the Itô dashboard/
|
||||
/custom API endpoint or model gateway[\s\S]*Run or self-host any open-source model behind that gateway[\s\S]*sponsorship link is passive/
|
||||
);
|
||||
const sponsorMark = read('assets/images/sponsors/ito.svg');
|
||||
assert.match(sponsorMark, /<path\b/);
|
||||
|
|
@ -100,10 +106,13 @@ function main() {
|
|||
/@import|<script|<foreignObject|\son[a-z]+=|(?:href|xlink:href)=/i
|
||||
);
|
||||
}],
|
||||
['sponsor roster lists Ito alongside business sponsors', () => {
|
||||
['sponsor roster keeps Itô and Moonshot distinct from node tooling', () => {
|
||||
const sponsors = read('SPONSORS.md');
|
||||
assert.ok(sponsors.includes('[**Itô**]'));
|
||||
assert.ok(sponsors.includes('assets/images/sponsors/ito.svg'));
|
||||
assert.ok(sponsors.includes('[**Moonshot AI**]'));
|
||||
assert.ok(sponsors.includes('assets/images/sponsors/moonshot.svg'));
|
||||
assert.doesNotMatch(sponsors, /sixtytwo|sixty.?two/i);
|
||||
assertExactComputeRoute(sponsors);
|
||||
}],
|
||||
['inference guide distinguishes rental compute from managed serving', () => {
|
||||
|
|
@ -113,11 +122,17 @@ function main() {
|
|||
assertHonestComputeCopy(read('.claude-plugin/README.md'));
|
||||
assertHonestComputeCopy(read('.kimi/README.md'));
|
||||
}],
|
||||
['Phase 2 plan keeps its thesis and release framing generic', () => {
|
||||
const plan = read('docs/design/ecc-ito-compute-integration.md');
|
||||
assert.match(plan, /-> any open-source model/);
|
||||
assert.doesNotMatch(plan, /public Kimi|Moonshot|video and sponsorship/i);
|
||||
assert.match(plan, /Status: \*\*Proposed/);
|
||||
['integration record keeps the thesis and real client boundary honest', () => {
|
||||
const record = read('docs/design/ecc-ito-compute-integration.md');
|
||||
assert.match(record, /-> any open-source model/);
|
||||
assert.doesNotMatch(record, /public Kimi|Moonshot|video and sponsorship/i);
|
||||
assert.match(record, /Status: \*\*Implemented local CLI bridge/i);
|
||||
assert.match(record, /auth`, `find`, and `status/);
|
||||
assert.match(record, /ito_auth`, `ito_find`, and `ito_status/);
|
||||
assert.match(record, /unpublished/i);
|
||||
assert.match(record, /managed inference remains unavailable/i);
|
||||
assert.match(record, /version bump[\s\S]*intentionally deferred/i);
|
||||
assert.doesNotMatch(record, /manual_copy|ito\.compute\.handoff|ecc ito rent/i);
|
||||
}],
|
||||
['top-level CLI help exposes the provider-neutral compute route', () => {
|
||||
const result = spawnSync('node', ['scripts/ecc.js', '--help'], {
|
||||
|
|
@ -159,7 +174,12 @@ function main() {
|
|||
assert.ok(packageJson.files.includes('assets/images/sponsors/'));
|
||||
assertExactComputeRoute(packageJson.scripts.welcome);
|
||||
assert.match(packageJson.scripts.welcome, /run or self-host any open-source model/i);
|
||||
assert.match(packageJson.scripts.welcome, /sponsorship link is passive/i);
|
||||
assert.match(packageJson.scripts.welcome, /ecc ito find/i);
|
||||
assert.match(packageJson.scripts.welcome, /submits a live authenticated RFQ/i);
|
||||
assert.match(packageJson.scripts.welcome, /does not reserve capacity/i);
|
||||
assert.ok(fs.existsSync(path.join(REPO_ROOT, 'assets', 'images', 'sponsors', 'ito.svg')));
|
||||
assert.ok(fs.existsSync(path.join(REPO_ROOT, 'assets', 'images', 'sponsors', 'moonshot.svg')));
|
||||
}],
|
||||
];
|
||||
|
||||
|
|
|
|||
|
|
@ -1,294 +0,0 @@
|
|||
/**
|
||||
* End-to-end contract tests for ECC's read-only Itô compute handoff.
|
||||
*/
|
||||
|
||||
const assert = require("assert")
|
||||
const fs = require("fs")
|
||||
const os = require("os")
|
||||
const path = require("path")
|
||||
const { spawnSync } = require("child_process")
|
||||
|
||||
const REPO_ROOT = path.join(__dirname, "..", "..")
|
||||
const ECC_SCRIPT = path.join(REPO_ROOT, "scripts", "ecc.js")
|
||||
const ITO_SCRIPT = path.join(REPO_ROOT, "scripts", "ito.js")
|
||||
const DESK_URL = "https://compute.itomarkets.com/desk"
|
||||
|
||||
function runCli(args, options = {}) {
|
||||
return spawnSync(process.execPath, [ECC_SCRIPT, ...args], {
|
||||
cwd: REPO_ROOT,
|
||||
encoding: "utf8",
|
||||
env: {
|
||||
...process.env,
|
||||
NODE_ENV: "test",
|
||||
...(options.env || {}),
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
function parseJson(result, expectedStatus = 0) {
|
||||
assert.strictEqual(result.status, expectedStatus, result.stderr)
|
||||
return JSON.parse(result.stdout)
|
||||
}
|
||||
|
||||
function runTest(name, fn) {
|
||||
try {
|
||||
fn()
|
||||
console.log(` ✓ ${name}`)
|
||||
return true
|
||||
} catch (error) {
|
||||
console.log(` ✗ ${name}`)
|
||||
console.error(` ${error.message}`)
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
function makeBrowserProbe() {
|
||||
const dir = fs.mkdtempSync(path.join(os.tmpdir(), "ecc-ito-browser-"))
|
||||
const log = path.join(dir, "opened-url.txt")
|
||||
const envLog = path.join(dir, "browser-env.txt")
|
||||
const executable = path.join(dir, process.platform === "win32" ? "browser-probe.cmd" : "browser-probe")
|
||||
if (process.platform === "win32") {
|
||||
fs.writeFileSync(executable, `@echo off\r\n<nul set /p =%1>"${log}"\r\nset >"${envLog}"\r\n`)
|
||||
} else {
|
||||
fs.writeFileSync(executable, `#!/bin/sh\nprintf '%s' "$1" > "${log}"\nenv > "${envLog}"\n`)
|
||||
fs.chmodSync(executable, 0o755)
|
||||
}
|
||||
return { dir, envLog, executable, log }
|
||||
}
|
||||
|
||||
function main() {
|
||||
console.log("\n=== Testing ECC × Itô sandbox handoff ===\n")
|
||||
|
||||
const tests = [
|
||||
["maps the exact CLI request into a structured sandbox intent", () => {
|
||||
const payload = parseJson(runCli([
|
||||
"ito",
|
||||
"rent",
|
||||
"--accelerator", "h100",
|
||||
"--count", "1",
|
||||
"--hours", "24",
|
||||
"--no-open",
|
||||
"--json",
|
||||
]))
|
||||
|
||||
assert.strictEqual(payload.schemaVersion, "ito.compute.handoff.v1")
|
||||
assert.strictEqual(payload.success, true)
|
||||
assert.strictEqual(payload.state, "manual_handoff")
|
||||
assert.deepStrictEqual(payload.data.intent, {
|
||||
accelerator: "h100",
|
||||
count: 1,
|
||||
hours: 24,
|
||||
})
|
||||
assert.deepStrictEqual(payload.data.provenance, {
|
||||
source: "ecc-cli",
|
||||
command: "ecc ito rent",
|
||||
})
|
||||
assert.strictEqual(payload.data.authority.environment, "sandbox")
|
||||
assert.strictEqual(payload.data.authority.readOnly, true)
|
||||
assert.strictEqual(payload.data.authority.liveRfq, false)
|
||||
assert.strictEqual(payload.data.authority.procurementMutation, false)
|
||||
assert.strictEqual(payload.data.authority.quoteAcceptance, false)
|
||||
assert.strictEqual(payload.data.authority.fundsApproval, false)
|
||||
assert.strictEqual(payload.data.authority.orderCreation, false)
|
||||
assert.strictEqual(payload.data.handoff.transport, "manual_copy")
|
||||
assert.strictEqual(payload.data.handoff.destination, "ito-desk")
|
||||
assert.strictEqual(payload.data.handoff.acceptedByIto, false)
|
||||
assert.strictEqual(payload.data.handoff.signInMayBeRequired, true)
|
||||
assert.match(payload.data.handoff.message, /1 × H100/)
|
||||
assert.match(payload.data.handoff.message, /24 hours/)
|
||||
assert.match(payload.data.handoff.message, /ECC CLI/)
|
||||
assert.match(payload.data.handoff.message, /sandbox-only/)
|
||||
assert.strictEqual(payload.links.desk, DESK_URL)
|
||||
assert.strictEqual(payload.data.opened, false)
|
||||
assert.strictEqual(payload.data.priceQuote, null)
|
||||
assert.strictEqual(payload.data.orderId, null)
|
||||
}],
|
||||
["global dry-run emits the same handoff and never opens a browser", () => {
|
||||
const probe = makeBrowserProbe()
|
||||
try {
|
||||
const payload = parseJson(runCli([
|
||||
"--dry-run",
|
||||
"ito",
|
||||
"rent",
|
||||
"--accelerator", "h100",
|
||||
"--count", "1",
|
||||
"--hours", "24",
|
||||
"--json",
|
||||
], {
|
||||
env: { ECC_ITO_BROWSER_EXECUTABLE: probe.executable },
|
||||
}))
|
||||
|
||||
assert.strictEqual(payload.data.dryRun, true)
|
||||
assert.strictEqual(payload.data.opened, false)
|
||||
assert.ok(!fs.existsSync(probe.log), "dry-run must not invoke the browser executable")
|
||||
} finally {
|
||||
fs.rmSync(probe.dir, { recursive: true, force: true })
|
||||
}
|
||||
}],
|
||||
["local dry-run is equivalent and rejects an open request", () => {
|
||||
const probe = makeBrowserProbe()
|
||||
try {
|
||||
const payload = parseJson(runCli([
|
||||
"ito",
|
||||
"rent",
|
||||
"--accelerator", "h100",
|
||||
"--count", "1",
|
||||
"--hours", "24",
|
||||
"--dry-run",
|
||||
"--json",
|
||||
], {
|
||||
env: { ECC_ITO_BROWSER_EXECUTABLE: probe.executable },
|
||||
}))
|
||||
|
||||
assert.strictEqual(payload.data.dryRun, true)
|
||||
assert.strictEqual(payload.data.opened, false)
|
||||
assert.ok(!fs.existsSync(probe.log), "local dry-run must not invoke the browser executable")
|
||||
} finally {
|
||||
fs.rmSync(probe.dir, { recursive: true, force: true })
|
||||
}
|
||||
}],
|
||||
["browser handoff opens only the allowlisted desk URL without inherited secrets", () => {
|
||||
const probe = makeBrowserProbe()
|
||||
try {
|
||||
const payload = parseJson(runCli([
|
||||
"ito",
|
||||
"rent",
|
||||
"--accelerator", "h100",
|
||||
"--count", "1",
|
||||
"--hours", "24",
|
||||
"--json",
|
||||
], {
|
||||
env: {
|
||||
ECC_ITO_BROWSER_EXECUTABLE: probe.executable,
|
||||
ITO_API_KEY: "parent-api-key-must-not-cross",
|
||||
ITO_SERVICE_TOKEN: "parent-token-must-not-cross",
|
||||
TEST_PASSWORD: "parent-password-must-not-cross",
|
||||
},
|
||||
}))
|
||||
|
||||
assert.strictEqual(payload.data.opened, true)
|
||||
assert.strictEqual(fs.readFileSync(probe.log, "utf8"), DESK_URL)
|
||||
assert.strictEqual(payload.links.desk, DESK_URL)
|
||||
const childEnvironment = fs.readFileSync(probe.envLog, "utf8")
|
||||
assert.doesNotMatch(childEnvironment, /parent-api-key-must-not-cross/)
|
||||
assert.doesNotMatch(childEnvironment, /parent-token-must-not-cross/)
|
||||
assert.doesNotMatch(childEnvironment, /parent-password-must-not-cross/)
|
||||
} finally {
|
||||
fs.rmSync(probe.dir, { recursive: true, force: true })
|
||||
}
|
||||
}],
|
||||
["direct Ito execution strips secrets from the browser child", () => {
|
||||
const probe = makeBrowserProbe()
|
||||
try {
|
||||
const result = spawnSync(process.execPath, [
|
||||
ITO_SCRIPT,
|
||||
"rent",
|
||||
"--accelerator", "h100",
|
||||
"--count", "1",
|
||||
"--hours", "24",
|
||||
"--json",
|
||||
], {
|
||||
cwd: REPO_ROOT,
|
||||
encoding: "utf8",
|
||||
env: {
|
||||
...process.env,
|
||||
NODE_ENV: "test",
|
||||
ECC_ITO_BROWSER_EXECUTABLE: probe.executable,
|
||||
ITO_API_KEY: "direct-api-key-must-not-cross",
|
||||
ITO_SERVICE_TOKEN: "direct-token-must-not-cross",
|
||||
TEST_PASSWORD: "direct-password-must-not-cross",
|
||||
},
|
||||
})
|
||||
const payload = parseJson(result)
|
||||
assert.strictEqual(payload.data.opened, true)
|
||||
const childEnvironment = fs.readFileSync(probe.envLog, "utf8")
|
||||
assert.doesNotMatch(childEnvironment, /direct-api-key-must-not-cross/)
|
||||
assert.doesNotMatch(childEnvironment, /direct-token-must-not-cross/)
|
||||
assert.doesNotMatch(childEnvironment, /direct-password-must-not-cross/)
|
||||
} finally {
|
||||
fs.rmSync(probe.dir, { recursive: true, force: true })
|
||||
}
|
||||
}],
|
||||
["fails closed on missing, unsupported, duplicate, and out-of-range intent", () => {
|
||||
for (const args of [
|
||||
["ito", "rent", "--count", "1", "--hours", "24", "--no-open", "--json"],
|
||||
["ito", "rent", "--accelerator", "a100", "--count", "1", "--hours", "24", "--no-open", "--json"],
|
||||
["ito", "rent", "--accelerator", "h100", "--count", "0", "--hours", "24", "--no-open", "--json"],
|
||||
["ito", "rent", "--accelerator", "h100", "--count", "1", "--hours", "721", "--no-open", "--json"],
|
||||
["ito", "rent", "--accelerator", "h100", "--accelerator", "h100-sxm", "--count", "1", "--hours", "24", "--no-open", "--json"],
|
||||
["ito", "dashboard", "--accelerator", "h100", "--count", "1", "--hours", "24", "--no-open", "--json"],
|
||||
]) {
|
||||
const result = runCli(args)
|
||||
assert.notStrictEqual(result.status, 0, args.join(" "))
|
||||
const payload = JSON.parse(result.stdout)
|
||||
assert.strictEqual(payload.success, false)
|
||||
assert.strictEqual(payload.state, "invalid_request")
|
||||
assert.strictEqual(payload.data, null)
|
||||
assert.strictEqual(payload.error.code, "INVALID_ARGUMENT")
|
||||
}
|
||||
}],
|
||||
["does not inspect credentials or contain a mutating transport", () => {
|
||||
const payload = parseJson(runCli([
|
||||
"ito",
|
||||
"rent",
|
||||
"--accelerator", "h100",
|
||||
"--count", "1",
|
||||
"--hours", "24",
|
||||
"--no-open",
|
||||
"--json",
|
||||
], {
|
||||
env: {
|
||||
ITO_API_KEY: "must-not-be-read",
|
||||
ITO_SERVICE_TOKEN: "must-not-be-read",
|
||||
},
|
||||
}))
|
||||
|
||||
assert.strictEqual(payload.data.authenticated, null)
|
||||
const source = fs.readFileSync(path.join(REPO_ROOT, "scripts", "ito.js"), "utf8")
|
||||
assert.doesNotMatch(source, /ITO_API_KEY|ITO_SERVICE_TOKEN|procurement\/orders|authorization/i)
|
||||
assert.doesNotMatch(source, /\bfetch\s*\(|https?\.request|child_process\.exec\b/)
|
||||
}],
|
||||
["human output stops before the economic boundary", () => {
|
||||
const result = runCli([
|
||||
"ito",
|
||||
"rent",
|
||||
"--accelerator", "h100",
|
||||
"--count", "1",
|
||||
"--hours", "24",
|
||||
"--no-open",
|
||||
])
|
||||
|
||||
assert.strictEqual(result.status, 0, result.stderr)
|
||||
assert.match(result.stdout, /manual copy/i)
|
||||
assert.match(result.stdout, /sandbox-only/i)
|
||||
assert.match(result.stdout, /sign-in may be required/i)
|
||||
assert.doesNotMatch(result.stdout, /signed-in/i)
|
||||
assert.match(result.stdout, /does not file an RFQ/i)
|
||||
assert.match(result.stdout, /Stop before ["“]Pay & buy["”]/i)
|
||||
assert.match(result.stdout, /no supported structured ECC intake/i)
|
||||
}],
|
||||
["npm welcome remains POSIX-safe around apostrophes", () => {
|
||||
const npmExecutable = process.platform === "win32" ? "npm.cmd" : "npm"
|
||||
const result = spawnSync(npmExecutable, ["run", "welcome"], {
|
||||
cwd: REPO_ROOT,
|
||||
encoding: "utf8",
|
||||
shell: process.platform === "win32",
|
||||
})
|
||||
assert.strictEqual(result.status, 0, result.stderr)
|
||||
assert.match(result.stdout, /Itô/)
|
||||
}],
|
||||
]
|
||||
|
||||
let passed = 0
|
||||
let failed = 0
|
||||
for (const [name, fn] of tests) {
|
||||
if (runTest(name, fn)) passed += 1
|
||||
else failed += 1
|
||||
}
|
||||
|
||||
console.log(`\nPassed: ${passed}`)
|
||||
console.log(`Failed: ${failed}`)
|
||||
process.exit(failed > 0 ? 1 : 0)
|
||||
}
|
||||
|
||||
main()
|
||||
Loading…
Add table
Add a link
Reference in a new issue