pneumo

M2: Dev client CLI for e2e tests, gates and staging smoke (ENG-256) #20

Merged

demi.dev 1w ago

targeting main from stoopkidddd/eng-256-m2-dev-client-cli-for-e2e-tests-gates-and-staging-smoke

Merged opened by and assigned to

demi.dev 1w ago targeting main from stoopkidddd/eng-256-m2-dev-client-cli-for-e2e-tests-gates-and-staging-smoke

Linear: https://linear.app/engineereddev/issue/ENG-256

What's in this PR:

scripts/pneumo-dev.ts + scripts/pneumo-dev/**, run as pnpm dev-client <cmd> (tsx), built only on @pneumo/protocol and @pneumo/crypto: setup, login, pair-uri, claim, send note|link|file, listen, wait-for, download, smoke.
Session files are written atomically with mode 600; nothing prints the token or MK except pair-uri's documented URI. Files stream encrypted and decrypted.
smoke: setup or login → pair + claim → note → link → 2 MB file byte-equal → delete/push_deleted → revoke/4401, with PASS/FAIL per step.
mise run e2e:server now also runs the smoke against the built server + MinIO in direct and proxy modes; check:server also checks, type-checks and tests the dev client.
Root package.json: dev-client script.

Verify (lead, rebased on 62b77a1):

pnpm install --frozen-lockfile → exit 0
mise run check:server → exit 0 (server Tests 229 passed; dev-client Tests 54 passed)
mise run e2e:server → exit 0 (Tests 17 passed, including both smoke modes)
Implementer's live check against mise run dev: listen printed decrypted note, link and file; wait-for matched (exit 0) and timed out (exit 1); pair-uri printed only the URI.
No pneumo-e2e-* containers left.

Deviations:

smoke --setup-token uses a documented fixed fake passphrase unless --passphrase is given.
mise.toml [env] gains pnpm_config_loglevel = "silent" so pnpm doesn't echo credential-bearing script arguments. This applies to every mise task.

🤖 Generated with Claude Code

Commits 2

M2: Scope dev-client silence and share CI checks (ENG-256)

+26 -30

M2: Add encrypted dev client CLI and smoke gates (ENG-256)

+2153 -5

Comments

v0 1w ago

demi.dev 1w ago

pneumo-reviewer: round 1, REQUEST_CHANGES #

The dev client works: check:server and e2e:server pass (smoke green in direct and proxy modes). A probe against a built server confirmed that listen/wait-for answer pings with pongs, exit cleanly on Ctrl-C, use the right exit codes, and stop with exit 1 on a 4401 revoke. Nothing secret is printed, and packages/** and apps/server/src are unchanged. Two mise.toml changes must go before merge.

Findings #

FIX (often 5 × bad 3 = 15), mise.toml:10-11: the global [env] pnpm_config_loglevel = "silent" applies to every mise task and mise exec in every lane and worktree. Tested: a frozen-lockfile mismatch and a missing script both exit 1 with no output; pnpm errors and warnings vanish. The narrower pnpm --silent dev-client … already works (the smoke e2e uses it). Fix: drop the [env] line, document pnpm --silent dev-client, and make output.test.ts call pnpm --silent dev-client (it currently passes only because of the global variable).
FIX (often 3 × bad 2 = 6), mise.toml:21-29: the dev-client biome/tsc/vitest commands live only in the mise task, not in scripts/ci/check.sh, so Tangled CI (ts.yml) never runs the dev-client typecheck or its 54 tests. This contradicts docs/agents/tangled.md and §16.4. Fix: move them into the server) case of scripts/ci/check.sh and restore run = "bash scripts/ci/check.sh server".
FILE (4), smoke.ts:10,28: smoke --setup-token without --passphrase initializes with a public fake passphrase. The staging smoke must pass a secret one.
FILE (4), pneumo-dev.ts:86-105, socket.ts:158-168: wait-for/listen give no "connected" signal, so a push sent before hello completes is missed.
FILE (4), socket.ts:158-211: the pushes() generator (reconnect/backoff, per-push cursor, resync, dedupe, 4401/4400 stop) has no automated test.

FILE items are recorded on ENG-275; code left alone.

Spec checks #

§17 OK. §7 OK (setup device cli, login via params with a keyCheck check, claim deletes itself on mismatch). §8 OK (bearer only on same-origin proxy URLs, never on presigned S3 URLs). §9 OK (cursor per push, resync dedupe, pong, 135 s watchdog, backoff 1/2/5/10/30/60 with jitter, 1012 retry, 4401/4400 stop). §6, §5.2 OK. §16.4: deviation, finding 2.

DoD checks #

Unit tests (args, session mode 600, output redaction, download tamper), smoke e2e in both modes, and redaction assertions (token, MK, passphrase, setup token, S3 secret absent from client and server output): present. Scope: the [env] edit to the hot mise.toml is out of scope (finding 1).

Tests run by the reviewer: mise run check:server exit 0 (229 + 54 tests); mise run e2e:server exit 0 (17 tests); mise run check:infra exit 0; probes as above. → omp round 2 for findings 1–2.

v1 1w ago

demi.dev 1w ago

pneumo-reviewer: round 2, APPROVE #

Round 2 (3ce86c9) fixes both FIX findings and changes nothing else.

Findings #

Round 1 FIX (score 15), global pnpm_config_loglevel: resolved. The [env] line is gone, mise exec -- pnpm run nosuch-script prints ERR_PNPM_NO_SCRIPT again, the README documents pnpm --silent dev-client, and output.test.ts calls pnpm --silent dev-client and passes without mise's env.
Round 1 FIX (score 6), CI coverage: resolved. The dev-client biome/tsc/vitest commands are in the server) case of scripts/ci/check.sh, and check:server is back to the wrapper. mise.toml differs from main only in the e2e:server description. A CI-like env -i run of bash scripts/ci/check.sh server passes (229 + 54 tests). The Nixery image needs nothing new (root devDependencies + pnpm from PATH).
Round 1 FILE findings (fixed fake passphrase default, wait-for readiness, pushes() test): unchanged, recorded on ENG-275.

Spec / DoD #

§17, §7, §8, §9, §6 and §5.2 OK; the §16.4 deviation is resolved (same lane check locally and in CI). Smoke is green in both upload modes. Scope resolved; packages/** and apps/server/src untouched.

Tests run by the reviewer on 3ce86c9: mise run check:server exit 0; CI-like wrapper run exit 0; mise run check:infra exit 0; mise run e2e:server exit 0 (17 tests). Pipeline for 3ce86c9: 3/3 green.

Versions

pneumo-reviewer: round 1, REQUEST_CHANGES #

Findings #

Spec checks #

DoD checks #

pneumo-reviewer: round 2, APPROVE #

Findings #

Spec / DoD #