codex-chief-of-staff/test/config.test.ts

import assert from "node:assert/strict";
import test from "node:test";

import { DEFAULT_APP_SERVER_URL, loadConfig } from "../src/config.js";

test("configuration defaults to the localhost App Server", () => {
  assert.equal(loadConfig({}).url, DEFAULT_APP_SERVER_URL);
  assert.equal(loadConfig({}).authorizationHeader, null);
});

test("configuration accepts secure remote endpoints and token indirection", () => {
  const secret = "do-not-print-this-token";
  const config = loadConfig({
    CODEX_APP_SERVER_URL: "wss://codex.example.test:4500",
    CODEX_APP_SERVER_TOKEN_ENV: "PRIVATE_CODEX_TOKEN",
    PRIVATE_CODEX_TOKEN: secret,
  });
  assert.equal(config.authorizationHeader, `Bearer ${secret}`);
  assert.equal(config.tokenEnvironmentVariable, "PRIVATE_CODEX_TOKEN");
  assert.equal(JSON.stringify({ url: config.url, tokenEnvironmentVariable: config.tokenEnvironmentVariable }).includes(secret), false);
});

test("configuration rejects malformed and insecure endpoints", () => {
  for (const value of ["not a url", "https://localhost:4500", "ws://remote.example.test:4500", "ws://user:pass@localhost:4500"]) {
    assert.throws(() => loadConfig({ CODEX_APP_SERVER_URL: value }), /WebSocket|ws:\/\/|credentials/);
  }
});

test("configuration errors never include token values", () => {
  const secret = "super-secret-value";
  let message = "";
  try {
    loadConfig({
      CODEX_APP_SERVER_URL: "invalid",
      CODEX_APP_SERVER_TOKEN_ENV: "TOKEN",
      TOKEN: secret,
    });
  } catch (error) {
    message = error instanceof Error ? error.message : String(error);
  }
  assert.equal(message.includes(secret), false);
  assert.throws(
    () => loadConfig({ CODEX_APP_SERVER_TOKEN_ENV: "MISSING_TOKEN" }),
    /MISSING_TOKEN/,
  );
});