-Verified upstream in Intelligence Flow on Ubuntu and macOS.
+Verified upstream in Intelligence Flow on Ubuntu, macOS, and Windows.
One language-neutral boundary for Claude Code, Cursor, Codex, Gemini, OpenCode, and compatible runtimes. diff --git a/labs/15-pitot/tests/e2e_unified_runner.sh b/labs/15-pitot/tests/e2e_unified_runner.sh index 20f2dcf8a..ce0575ed6 100755 --- a/labs/15-pitot/tests/e2e_unified_runner.sh +++ b/labs/15-pitot/tests/e2e_unified_runner.sh @@ -12,7 +12,11 @@ echo "===> [E2E] Starting $HOST + Pitot Hook Integration Test" # 1. Compile the local Go 'pitot' binary echo "===> Compiling pitot binary..." -go build -o labs/15-pitot/tests/pitot labs/15-pitot/pitot/cmd/pitot/main.go +PITOT_BINARY="labs/15-pitot/tests/pitot" +if [ "${RUNNER_OS:-}" = "Windows" ]; then + PITOT_BINARY="${PITOT_BINARY}.exe" +fi +go build -o "$PITOT_BINARY" labs/15-pitot/pitot/cmd/pitot/main.go # 2. Host-specific setup and mocking SERVER_PID="" @@ -24,7 +28,7 @@ cleanup() { if [ -n "$SERVER_PID" ]; then kill "$SERVER_PID" 2>/dev/null || true fi - rm -f labs/15-pitot/tests/pitot + rm -f "$PITOT_BINARY" if [ -n "${MOCK_HOME:-}" ]; then rm -rf "$MOCK_HOME" fi @@ -44,8 +48,11 @@ fi CODEX_PATH="" # Codex CLI path placeholder -# Get absolute path of the compiled pitot binary -PITOT_ABS_PATH=$(pwd)/labs/15-pitot/tests/pitot +# Get an absolute path that the host process can execute on each runner OS. +PITOT_ABS_PATH="$(pwd)/$PITOT_BINARY" +if [ "${RUNNER_OS:-}" = "Windows" ] && command -v cygpath &>/dev/null; then + PITOT_ABS_PATH="$(cygpath -m "$PITOT_ABS_PATH")" +fi # Spin up mock API server on port 8080 for all tests echo "===> Starting local mock API server..." diff --git a/labs/15-pitot/tests/run_e2e_report.py b/labs/15-pitot/tests/run_e2e_report.py index 86364735d..157d7901b 100644 --- a/labs/15-pitot/tests/run_e2e_report.py +++ b/labs/15-pitot/tests/run_e2e_report.py @@ -13,7 +13,7 @@ AGENTS = {"claude", "cursor", "codex", "gemini", "opencode"} -PLATFORMS = {"ubuntu", "macos"} +PLATFORMS = {"ubuntu", "macos", "windows"} RESULT_PATTERN = re.compile(r"^PITOT_E2E_RESULT mode=(real_cli|hook_subprocess)$", re.MULTILINE) @@ -66,8 +66,15 @@ def main() -> int: if not command: parser.error("a command is required after --") - completed = subprocess.run(command, text=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT) - sys.stdout.write(completed.stdout) + completed = subprocess.run( + command, + text=True, + encoding="utf-8", + errors="replace", + stdout=subprocess.PIPE, + stderr=subprocess.STDOUT, + ) + sys.stdout.buffer.write(completed.stdout.encode("utf-8", errors="replace")) result = result_for(args.agent, args.platform, completed.returncode, completed.stdout) args.output.parent.mkdir(parents=True, exist_ok=True) args.output.write_text(json.dumps(result, indent=2, sort_keys=True) + "\n", encoding="utf-8") diff --git a/labs/15-pitot/tests/test_e2e_reporting.py b/labs/15-pitot/tests/test_e2e_reporting.py index 5ece87435..f64d204b0 100644 --- a/labs/15-pitot/tests/test_e2e_reporting.py +++ b/labs/15-pitot/tests/test_e2e_reporting.py @@ -3,7 +3,10 @@ import importlib.util from pathlib import Path import subprocess +import sys +import tempfile import unittest +import urllib.request ROOT = Path(__file__).resolve().parents[3] @@ -59,6 +62,11 @@ def test_hook_marker_passes(self): self.assertEqual(result["status"], "pass") self.assertEqual(result["verification_mode"], "hook_subprocess") + def test_windows_result_is_supported(self): + result = runner.result_for("opencode", "windows", 0, "PITOT_E2E_RESULT mode=hook_subprocess\n") + self.assertEqual(result["platform"], "windows") + self.assertEqual(result["status"], "pass") + def test_missing_or_duplicate_marker_fails(self): self.assertEqual(runner.result_for("codex", "ubuntu", 0, "ok\n")["status"], "fail") duplicate = "PITOT_E2E_RESULT mode=real_cli\n" * 2 @@ -69,8 +77,66 @@ def test_nonzero_command_fails_even_with_marker(self): self.assertEqual(result["status"], "fail") self.assertIsNone(result["verification_mode"]) + def test_runner_replaces_non_utf8_command_output(self): + with tempfile.TemporaryDirectory() as temp: + output = Path(temp) / "result.json" + completed = subprocess.run( + [ + sys.executable, + str(ROOT / "labs/15-pitot/tests/run_e2e_report.py"), + "--agent", "claude", + "--platform", "windows", + "--output", str(output), + "--", + sys.executable, + "-c", "import sys; sys.stdout.buffer.write(b'\\x96')", + ], + stdout=subprocess.PIPE, + stderr=subprocess.STDOUT, + ) + self.assertNotEqual(completed.returncode, 0) + self.assertTrue(output.is_file()) + class ReporterContractTests(unittest.TestCase): + def test_artifact_redirect_strips_cross_host_credentials(self): + request = urllib.request.Request( + "https://api.github.com/repos/operatorstack/intelligence-flow/actions/artifacts/1/zip", + headers={"Authorization": "Bearer secret"}, + ) + redirected = reporter.ArtifactRedirectHandler().redirect_request( + request, + None, + 302, + "Found", + {}, + "https://artifact.example.test/signed.zip", + ) + self.assertIsNotNone(redirected) + self.assertIsNone(redirected.get_header("Authorization")) + + def test_artifact_redirect_rejects_http_downgrade(self): + request = urllib.request.Request("https://api.github.com/artifact") + with self.assertRaisesRegex(ValueError, "must use HTTPS"): + reporter.ArtifactRedirectHandler().redirect_request( + request, + None, + 302, + "Found", + {}, + "http://artifact.example.test/signed.zip", + ) + + def test_workflow_matrix_covers_every_reported_platform(self): + workflow = (ROOT / ".github/workflows/pitot-e2e-agent.yml").read_text() + runners = {"ubuntu": "ubuntu-latest", "macos": "macos-latest", "windows": "windows-latest"} + self.assertEqual(set(reporter.PLATFORMS), set(runner.PLATFORMS)) + for platform, image in runners.items(): + self.assertIn(f"runner: {image}\n platform: {platform}", workflow) + self.assertIn('bash_path="$(cygpath -m "$bash_path")"', workflow) + self.assertIn('-- "$PITOT_BASH"', workflow) + self.assertNotIn('-- bash "labs/15-pitot/tests/e2e_', workflow) + def test_validates_exact_artifact_schema(self): value = _result() self.assertIs(reporter.validate_result(value, agent="claude", platform="ubuntu"), value) @@ -99,13 +165,24 @@ def test_rejects_untrusted_commit_and_run_url(self): with self.assertRaises(ValueError): reporter.validate_result(value, agent="claude", platform="ubuntu") - def test_aggregate_requires_both_platforms(self): + def test_aggregate_requires_all_platforms(self): self.assertEqual(reporter.aggregate({"ubuntu": _result(), "macos": None}), "pending") self.assertEqual( reporter.aggregate( { "ubuntu": _result(), "macos": _result(platform="macos", mode="hook_subprocess"), + "windows": None, + } + ), + "pending", + ) + self.assertEqual( + reporter.aggregate( + { + "ubuntu": _result(), + "macos": _result(platform="macos", mode="hook_subprocess"), + "windows": _result(platform="windows", mode="hook_subprocess"), } ), "passing", @@ -115,6 +192,7 @@ def test_aggregate_requires_both_platforms(self): { "ubuntu": _result(), "macos": _result(platform="macos", status="fail", mode=None), + "windows": _result(platform="windows", mode="hook_subprocess"), } ), "failing", @@ -122,16 +200,20 @@ def test_aggregate_requires_both_platforms(self): def test_rendered_comment_is_sticky_and_shows_modes(self): results = { - agent: {"ubuntu": None, "macos": None} for agent in reporter.WORKFLOWS + agent: {platform: None for platform in reporter.PLATFORMS} + for agent in reporter.WORKFLOWS } results["claude"] = { "ubuntu": _result(), "macos": _result(platform="macos", mode="hook_subprocess"), + "windows": _result(platform="windows", mode="hook_subprocess"), } body = reporter.render_comment(results, {"claude": "https://example.test/run"}, "b" * 40) self.assertIn(reporter.MARKER, body) self.assertIn("Pass · real CLI", body) self.assertIn("Pass · hook verified", body) + self.assertIn("Windows", body) + self.assertIn("All platforms are required", body) self.assertIn("OpenCode", body)