Publish harness and TUI open-source

initial sync from the monorepo

crates/codegen/xai-grok-telemetry/tests/external_otlp_guard.rs

@@ -0,0 +1,72 @@
+//! Wire test for the **no-double-send invariant** (the credential-leak guard).
+//!
+//! If the internal trace firehose resolved its endpoint/headers from the
+//! deprecated `OTEL_EXPORTER_OTLP_*` fallback, the shell sets
+//! `internal_pipeline_consumed_otel_vars = true`, and `external::init` MUST
+//! refuse to activate — otherwise the same standard vars could point both the
+//! internally-authed firehose and the customer collector at one endpoint,
+//! leaking xAI credentials. Here we prove the refusal end-to-end: even with a
+//! fully valid double opt-in pointed at a live collector, nothing is exported.
+
+mod otlp_collector;
+
+use otlp_collector as col;
+use xai_grok_telemetry::external;
+
+#[test]
+fn refuses_to_activate_when_internal_consumed_standard_vars() {
+    let collected = col::Collected::default();
+    let endpoint = col::start_collector(collected.clone());
+
+    let mut cfg = external::ExternalOtelConfig::resolve_with(
+        |name| match name {
+            "GROK_EXTERNAL_OTEL" => Some("1".into()),
+            "OTEL_LOGS_EXPORTER" | "OTEL_METRICS_EXPORTER" => Some("otlp".into()),
+            "OTEL_EXPORTER_OTLP_ENDPOINT" => Some(endpoint.clone()),
+            "OTEL_METRIC_EXPORT_INTERVAL" => Some("100".into()),
+            "OTEL_BLRP_SCHEDULE_DELAY" => Some("100".into()),
+            _ => None,
+        },
+        None,
+    )
+    .expect("config resolves (the refusal happens at init, not resolution)");
+    cfg.client = external::config::ExternalClientInfo {
+        service_version: "0.0.0-test".into(),
+        client_version: "0.0.0-test".into(),
+        app_entrypoint: "cli".into(),
+    };
+    // The flag the shell sets when the internal firehose consumed the standard
+    // OTEL_* vars via the deprecated fallback.
+    cfg.internal_pipeline_consumed_otel_vars = true;
+
+    external::init(Some(cfg));
+    assert!(
+        !external::is_active(),
+        "external stream MUST refuse to activate to prevent credential leakage"
+    );
+
+    // Emit through the real funnel; with the stream inert this must be a no-op.
+    xai_grok_telemetry::log_event(xai_grok_telemetry::events::SessionNew {
+        session_id: "sess-guard".into(),
+        client_identifier: None,
+        client_version: None,
+        is_git_repo: true,
+        permission_mode: xai_grok_telemetry::enums::PermissionMode::Ask,
+    });
+    external::flush();
+
+    // Give any (erroneously constructed) exporter ample time to phone home.
+    std::thread::sleep(std::time::Duration::from_millis(600));
+    assert_eq!(
+        collected.logs_len(),
+        0,
+        "no logs may be exported when refused"
+    );
+    assert_eq!(
+        collected.metrics_len(),
+        0,
+        "no metrics may be exported when refused"
+    );
+
+    external::shutdown();
+}