chore: integrate v0.1 secret tooling

src/selftest/cases/40-secret-render.ts

@@ -0,0 +1,48 @@
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+import assert from "node:assert/strict";
+import { renderCodexProviderSecretPlan } from "../../../scripts/src/secret-render.js";
+import { AgentRunError } from "../../common/errors.js";
+import type { SelfTestCase } from "../harness.js";
+
+const selfTest: SelfTestCase = async (context) => {
+  const secretPlan = await renderCodexProviderSecretPlan({ codexHome: context.codexHome, dryRun: true });
+  assert.equal(secretPlan.namespace, "agentrun-v01");
+  assert.equal(secretPlan.secretName, "agentrun-v01-provider-codex");
+  assert.deepEqual(secretPlan.keys, ["auth.json", "config.toml"]);
+  assert.equal(secretPlan.writeAttempted, false);
+  assert.equal(secretPlan.totalBytes, Buffer.byteLength(JSON.stringify({ token: "test-token-material" }), "utf8") + Buffer.byteLength("model = \"gpt-test\"\n", "utf8"));
+  assert.match(String(secretPlan.sha256), /^[a-f0-9]{64}$/u);
+  const renderedSecretJson = JSON.stringify(secretPlan);
+  assert.equal(renderedSecretJson.includes("test-token-material"), false);
+  assert.equal(renderedSecretJson.includes("gpt-test"), false);
+  assert.equal(renderedSecretJson.includes("model ="), false);
+
+  await assert.rejects(
+    () => renderCodexProviderSecretPlan({ codexHome: path.join(context.tmp, "missing-codex-home"), dryRun: true }),
+    (error) => error instanceof AgentRunError && error.failureKind === "secret-unavailable",
+  );
+  const invalidCodexHome = path.join(context.tmp, "invalid-codex-home");
+  await mkdir(invalidCodexHome, { recursive: true });
+  await writeFile(path.join(invalidCodexHome, "auth.json"), "not-json");
+  await writeFile(path.join(invalidCodexHome, "config.toml"), "model = \"gpt-test\"\n");
+  await assert.rejects(
+    () => renderCodexProviderSecretPlan({ codexHome: invalidCodexHome, dryRun: true }),
+    (error) => error instanceof AgentRunError && error.failureKind === "schema-invalid",
+  );
+  await writeFile(path.join(invalidCodexHome, "auth.json"), JSON.stringify({ token: "" }));
+  await assert.rejects(
+    () => renderCodexProviderSecretPlan({ codexHome: invalidCodexHome, dryRun: true }),
+    (error) => error instanceof AgentRunError && error.failureKind === "secret-unavailable",
+  );
+  await writeFile(path.join(invalidCodexHome, "auth.json"), JSON.stringify({ token: "test-token-material" }));
+  await writeFile(path.join(invalidCodexHome, "config.toml"), "model =");
+  await assert.rejects(
+    () => renderCodexProviderSecretPlan({ codexHome: invalidCodexHome, dryRun: true }),
+    (error) => error instanceof AgentRunError && error.failureKind === "schema-invalid",
+  );
+
+  return { name: "secret-render", tests: ["codex-secret-dry-run"] };
+};
+
+export default selfTest;