tests/setup.test.mjs

import assert from "node:assert/strict";
import { spawnSync } from "node:child_process";
import { mkdtemp, rm, stat, writeFile } from "node:fs/promises";
import os from "node:os";
import path from "node:path";
import test from "node:test";
import { fileURLToPath } from "node:url";

import { verifyResponses } from "../skills/setup/scripts/verify-responses.mjs";

const script = fileURLToPath(new URL("../skills/setup/scripts/verify-responses.mjs", import.meta.url));
const environmentKey = "sk-proj-synthetic-environment-key";
const environment = { OPENAI_API_KEY: environmentKey };
const fileKey = "sk-proj-synthetic-file-key";
const haiku = "Quiet tokens bloom\nAn app finds its voice in code\nNew ideas take flight";
const unexpectedFetch = () => assert.fail("key check attempted an API request");

function response(body, init) {
  return new Response(JSON.stringify(body), init);
}

function completedResponse(text = haiku) {
  return response({
    status: "completed",
    output: [{ type: "message", content: [{ type: "output_text", text }] }],
  });
}

test("sends the onboarding request and preserves multiline API text while redacting secrets", async () => {
  let request;
  const result = await verifyResponses({
    environment,
    fetchImpl: async (url, options) => {
      request = { url, options };
      return completedResponse(`${haiku} ${environmentKey}`);
    },
  });

  assert.equal(request.url, "https://api.openai.com/v1/responses");
  assert.equal(request.options.method, "POST");
  assert.equal(request.options.headers.Authorization, `Bearer ${environmentKey}`);
  assert.equal(request.options.redirect, "error");
  assert.deepEqual(JSON.parse(request.options.body), {
    model: "gpt-6-luna",
    input: "write me a haiku about building an app with the OpenAI API",
    reasoning: { effort: "none" },
    max_output_tokens: 128,
    store: false,
  });
  assert.deepEqual(result, { status: "ok", model: "gpt-6-luna", output_text: `${haiku} [redacted]` });
});

test("a selected env file takes precedence and its contents are never executed", async (t) => {
  const directory = await mkdtemp(path.join(os.tmpdir(), "developers-setup-test-"));
  t.after(() => rm(directory, { recursive: true, force: true }));
  const envFile = path.join(directory, ".env.local");
  await writeFile(envFile, `export OPENAI_API_KEY="${fileKey}" # selected key\n`);
  let authorization;
  const result = await verifyResponses({
    environment,
    envFile,
    fetchImpl: async (_url, options) => {
      authorization = options.headers.Authorization;
      return completedResponse();
    },
  });
  assert.equal(authorization, `Bearer ${fileKey}`);
  assert.equal(result.status, "ok");
  assert.equal(JSON.stringify(result).includes(fileKey), false);

  const marker = path.join(directory, "executed");
  await writeFile(envFile, `OPENAI_API_KEY=$(touch "${marker}")\n`);
  assert.deepEqual(await verifyResponses({ environment: {}, envFile, check: true, fetchImpl: unexpectedFetch }), { status: "key_missing" });
  await assert.rejects(stat(marker), { code: "ENOENT" });
});

test("key checks avoid API requests and expose only status", async () => {
  assert.deepEqual(await verifyResponses({ environment, check: true, fetchImpl: unexpectedFetch }), { status: "key_present" });
  const cli = spawnSync(process.execPath, [script, "--check"], {
    encoding: "utf8",
    env: environment,
  });
  assert.equal(cli.status, 0);
  assert.equal(cli.stdout.trim(), '{"status":"key_present"}');
  assert.equal(cli.stderr, "");
});

test("reports actionable API failures without leaking the key", async () => {
  const result = await verifyResponses({
    environment,
    fetchImpl: async () => response({
      error: { code: "insufficient_quota", type: "insufficient_quota", message: `Rejected ${environmentKey}` },
    }, { status: 429, headers: { "retry-after": "12" } }),
  });
  assert.deepEqual(result, {
    status: "api_error",
    http_status: 429,
    code: "insufficient_quota",
    type: "insufficient_quota",
    message: "Rejected [redacted]",
    retry_after_seconds: 12,
  });
});

test("preserves HTTP status and retry guidance for non-JSON errors", async () => {
  const result = await verifyResponses({
    environment,
    fetchImpl: async () => new Response("Service unavailable", {
      status: 503,
      headers: { "retry-after": "12" },
    }),
  });
  assert.equal(result.status, "api_error");
  assert.equal(result.http_status, 503);
  assert.equal(result.retry_after_seconds, 12);
});

test("does not report success for incomplete or empty responses", async () => {
  const incomplete = await verifyResponses({
    environment,
    fetchImpl: async () => response({
      status: "incomplete",
      incomplete_details: { reason: "max_output_tokens" },
      output: [{ type: "message", content: [{ type: "output_text", text: "partial" }] }],
    }),
  });
  assert.deepEqual(incomplete, { status: "no_text", response_status: "incomplete", reason: "max_output_tokens" });
  const empty = await verifyResponses({
    environment,
    fetchImpl: async () => response({ status: "completed", output: [] }),
  });
  assert.equal(empty.status, "no_text");
});

test("classifies network failures", async () => {
  const failure = await verifyResponses({
    environment,
    fetchImpl: async () => { throw new Error("fetch failed", { cause: { code: "ENOTFOUND" } }); },
  });
  assert.deepEqual(failure, { status: "network_error", code: "ENOTFOUND" });
});