runtime-package-acquisition.test.ts

import { createHash } from "node:crypto";
import { spawnSync } from "node:child_process";
import {
    chmodSync,
    copyFileSync,
    existsSync,
    mkdirSync,
    mkdtempSync,
    readFileSync,
    rmSync,
    statSync,
    writeFileSync,
} from "node:fs";
import { tmpdir } from "node:os";
import { basename, join } from "node:path";
import { c as createTar } from "tar";
import { afterEach, describe, expect, it, vi } from "vitest";
import {
    acquireRuntimePackages,
    getSourceRuntimePackageName,
    parseArguments,
    validateRuntimePackageRoot,
} from "../scripts/runtime-package-acquisition.js";
import { RUNTIME_PLATFORMS } from "../src/runtimeArtifacts.js";

const roots: string[] = [];
const runtimeVersion = "1.0.83-5.unstable.123.gabcdef0";
const runtimeSha = "abcdef0123456789abcdef0123456789abcdef01";

function temporaryRoot(prefix: string): string {
    const root = mkdtempSync(join(tmpdir(), prefix));
    roots.push(root);
    return root;
}

afterEach(() => {
    for (const root of roots.splice(0)) {
        rmSync(root, { recursive: true, force: true });
    }
});

async function createRuntimePackage(root: string, platform: string): Promise<string> {
    const packageRoot = join(root, platform, "package");
    const windows = platform.startsWith("win32");
    const [osName, cpu] = platform.replace("linuxmusl", "linux").split("-");
    mkdirSync(join(packageRoot, "prebuilds", platform), { recursive: true });
    mkdirSync(join(packageRoot, "copilot-sdk"), { recursive: true });
    mkdirSync(join(packageRoot, "preloads"), { recursive: true });
    writeFileSync(
        join(packageRoot, "package.json"),
        JSON.stringify({
            name: getSourceRuntimePackageName(platform),
            version: runtimeVersion,
            repository: "https://github.com/github/copilot-agent-runtime.git",
            os: [osName],
            cpu: [cpu],
            ...(platform.startsWith("linux")
                ? { libc: [platform.startsWith("linuxmusl") ? "musl" : "glibc"] }
                : {}),
            copilotRuntime: {
                sourceRepository: "github/copilot-agent-runtime",
                sourceSha: runtimeSha,
            },
        })
    );
    const executablePaths = new Set([
        windows ? "copilot.exe" : "copilot",
        join("prebuilds", platform, windows ? "copilot-runtime.exe" : "copilot-runtime"),
    ]);
    for (const path of [
        "LICENSE.md",
        ...executablePaths,
        join("prebuilds", platform, "runtime.node"),
        join("copilot-sdk", "extension.js"),
        join("preloads", "extension_bootstrap.mjs"),
    ]) {
        const destination = join(packageRoot, path);
        writeFileSync(destination, path);
        if (executablePaths.has(path)) {
            chmodSync(destination, 0o755);
        }
    }
    const archive = join(root, `${platform}.tgz`);
    await createTar({ cwd: join(root, platform), file: archive, gzip: true }, ["package"]);
    return archive;
}

describe("runtime npm package acquisition", () => {
    it("requires exactly one non-empty value for every CLI option", () => {
        const valid = [
            "--version",
            runtimeVersion,
            "--sha",
            runtimeSha,
            "--output",
            "runtime-packages",
        ];
        expect(parseArguments(valid)).toEqual({
            outputDirectory: "runtime-packages",
            runtimeSha,
            runtimeVersion,
        });
        for (const invalid of [
            valid.slice(0, -2),
            [...valid.slice(0, -2), "--outpt", "runtime-packages"],
            [...valid.slice(0, -2), "--sha", runtimeSha],
            [...valid.slice(0, -1), ""],
            [...valid.slice(0, -1), "--unknown"],
        ]) {
            expect(() => parseArguments(invalid)).toThrow();
        }
    });

    it("downloads all platforms and creates a compact executable-preserving handoff", async () => {
        const root = temporaryRoot("copilot-runtime-acquisition-");
        const output = join(root, "runtime-packages");
        const archives = new Map<string, { integrity: string; path: string }>();
        for (const platform of RUNTIME_PLATFORMS) {
            const path = await createRuntimePackage(root, platform);
            archives.set(platform, {
                path,
                integrity: `sha512-${createHash("sha512")
                    .update(readFileSync(path))
                    .digest("base64")}`,
            });
        }
        const runner = vi.fn(async (_command: string, args: string[]) => {
            const spec = args[1];
            const platform = RUNTIME_PLATFORMS.find((candidate) =>
                spec.startsWith(`${getSourceRuntimePackageName(candidate)}@`)
            );
            expect(platform).toBeDefined();
            const archive = archives.get(platform!)!;
            if (args[0] === "view") {
                return { status: 0, stdout: JSON.stringify(archive.integrity), stderr: "" };
            }
            const destination = args[args.indexOf("--pack-destination") + 1];
            const filename = basename(archive.path);
            mkdirSync(destination, { recursive: true });
            copyFileSync(archive.path, join(destination, filename));
            return {
                status: 0,
                stdout: JSON.stringify([{ filename, integrity: archive.integrity }]),
                stderr: "",
            };
        });

        await acquireRuntimePackages(
            {
                outputDirectory: output,
                runtimeSha,
                runtimeVersion,
            },
            runner
        );

        expect(runner).toHaveBeenCalledTimes(16);
        const acquisition = JSON.parse(readFileSync(join(output, "runtime-packages.json"), "utf8"));
        expect(acquisition.packages).toHaveLength(8);
        for (const platform of RUNTIME_PLATFORMS) {
            validateRuntimePackageRoot(
                join(output, platform),
                platform,
                runtimeVersion,
                runtimeSha
            );
        }

        const archive = join(root, "runtime-packages.tar.gz");
        const archived = spawnSync(
            "tar",
            [
                "-czf",
                basename(archive),
                "--exclude",
                "runtime-packages/tarballs",
                "runtime-packages",
            ],
            { cwd: root, encoding: "utf8" }
        );
        expect(archived.status, archived.stderr).toBe(0);

        const extractedRoot = join(root, "extracted");
        mkdirSync(extractedRoot);
        const extracted = spawnSync("tar", ["-xzf", basename(archive), "-C", "extracted"], {
            cwd: root,
            encoding: "utf8",
        });
        expect(extracted.status, extracted.stderr).toBe(0);
        const handoffRoot = join(extractedRoot, "runtime-packages");
        expect(existsSync(join(handoffRoot, "runtime-packages.json"))).toBe(true);
        expect(existsSync(join(handoffRoot, "tarballs"))).toBe(false);
        for (const platform of RUNTIME_PLATFORMS) {
            validateRuntimePackageRoot(
                join(handoffRoot, platform),
                platform,
                runtimeVersion,
                runtimeSha
            );
        }
        if (process.platform !== "win32") {
            expect(statSync(join(handoffRoot, "linux-x64", "copilot")).mode & 0o111).not.toBe(0);
        }
    });

    it("requires strict GitHub Packages registry integrity", async () => {
        const root = temporaryRoot("copilot-runtime-registry-");
        const runner = vi
            .fn()
            .mockResolvedValue({ status: 0, stdout: JSON.stringify("sha1-invalid"), stderr: "" });
        await expect(
            acquireRuntimePackages(
                {
                    outputDirectory: join(root, "output"),
                    runtimeSha,
                    runtimeVersion,
                },
                runner
            )
        ).rejects.toThrow("Invalid registry integrity");
        expect(runner.mock.calls[0][1]).toContain("https://npm.pkg.github.com");
    });

    it("rejects mismatched source identity metadata", async () => {
        const root = temporaryRoot("copilot-runtime-identity-");
        await createRuntimePackage(root, "linux-x64");
        const packageRoot = join(root, "linux-x64", "package");
        const manifestPath = join(packageRoot, "package.json");
        const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
        manifest.copilotRuntime.sourceSha = "0".repeat(40);
        writeFileSync(manifestPath, JSON.stringify(manifest));

        expect(() =>
            validateRuntimePackageRoot(packageRoot, "linux-x64", runtimeVersion, runtimeSha)
        ).toThrow();
    });
});