test(cli): sequenceDiagram fixture, fingerprint coverage, and review labels

- Update the sequenceDiagram RPC integration fixture for the new action
  labels.
- Add handler-level fingerprint tests (a real-fixture Fingerprinter test
  and a FingerprintDirectoryCommand.execute() test).
- Annotate two security-relevant boundaries with @Label
  (security.deserialization on pruneWithFilter, security.path-resolution
  on resolveAppmapPath) for behavioral review.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: kgilpin

packages/cli/src/cmds/prune/pruneAppMap.ts

@@ -22,6 +22,10 @@ export const pruneAppMap = (appMap: AppMap, size: number): PruneResult => {
   return { appmap };
 };
 
+// Deserializes an untrusted serialized filter (the CLI accepts it as a
+// base64url-encoded string) into an AppMapFilter and applies it to the map.
+// Labeled so appmap-review interprets changes to this deserialization boundary.
+// @label security.deserialization
 export const pruneWithFilter = (appMap: AppMap, serializedFilter: string): PruneResult => {
   // TODO: update type for AppMap
   const fullMap = buildAppMap().source(appMap).normalize().build() as any;

packages/cli/src/cmds/query/lib/recordingId.ts

@@ -34,6 +34,7 @@ import type { AppmapInfo } from '../queries/tree';
 // shapes silently collide in real corpora (multiple recordings share
 // the same basename or name), and the resulting wrong-recording
 // resolution is harder to debug than an explicit error.
+// @label security.path-resolution
 export function resolveAppmapPath(db: sqlite3.Database, ref: unknown): AppmapInfo {
   const s = String(ref);
   if (looksLikeDisplayLabel(s)) {

packages/cli/tests/integration/fixtures/sequenceDiagram/diagram.json

@@ -88,6 +88,9 @@
       "elapsed": 0.038045,
       "eventIds": [
         1
+      ],
+      "labels": [
+        "security"
       ]
     },
     {
@@ -250,6 +253,10 @@
           "elapsed": 0.150356,
           "eventIds": [
             8
+          ],
+          "labels": [
+            "provider.authenticate",
+            "security"
           ]
         },
         {
@@ -347,6 +354,9 @@
               "elapsed": 0.008962,
               "eventIds": [
                 29
+              ],
+              "labels": [
+                "security"
               ]
             }
           ],
@@ -431,6 +441,10 @@
           "elapsed": 0.005355,
           "eventIds": [
             40
+          ],
+          "labels": [
+            "provider.authenticate",
+            "security"
           ]
         },
         {
@@ -456,6 +470,10 @@
           "elapsed": 0.00005,
           "eventIds": [
             46
+          ],
+          "labels": [
+            "json",
+            "serialization"
           ]
         }
       ],

packages/cli/tests/unit/fingerprint/fingerprintDirectoryCommand.spec.ts

@@ -1,25 +1,53 @@
 import { dir } from 'tmp';
 import FingerprintDirectoryCommand from '../../../src/fingerprint/fingerprintDirectoryCommand';
 import { promisify } from 'util';
-import { writeFile, rm } from 'node:fs/promises';
+import { writeFile, rm, cp, readdir } from 'node:fs/promises';
 import { join } from 'path';
 
 const mkTmpDir = promisify(dir);
 
 describe('index command', () => {
-  let appMapDir: string;
-  let appMapPath: string;
+  describe('identifying AppMaps', () => {
+    let appMapDir: string;
+    let appMapPath: string;
 
-  beforeEach(async () => {
-    appMapDir = await mkTmpDir();
-    appMapPath = join(appMapDir, 'example.appmap.json');
-    await writeFile(appMapPath, '{}');
+    beforeEach(async () => {
+      appMapDir = await mkTmpDir();
+      appMapPath = join(appMapDir, 'example.appmap.json');
+      await writeFile(appMapPath, '{}');
+    });
+
+    afterEach(() => rm(appMapDir, { recursive: true, force: true }));
+
+    it('identifies AppMaps for indexing', () => {
+      const subject = new FingerprintDirectoryCommand(appMapDir);
+      return expect(subject.files(() => {})).resolves.toEqual([appMapPath]);
+    });
   });
 
-  afterEach(() => rm(appMapDir, { recursive: true, force: true }));
+  describe('fingerprinting a directory', () => {
+    let appMapDir: string;
+
+    beforeEach(async () => {
+      appMapDir = await mkTmpDir();
+      // A real recording so execute() exercises the full fingerprint pipeline
+      // (canonicalization, hashing, index-file emission), not just globbing.
+      await cp(
+        join(__dirname, '..', 'fixtures', 'ruby', 'revoke_api_key.appmap.json'),
+        join(appMapDir, 'revoke_api_key.appmap.json')
+      );
+    });
+
+    afterEach(() => rm(appMapDir, { recursive: true, force: true }));
 
-  it('identifies AppMaps for indexing', () => {
-    const subject = new FingerprintDirectoryCommand(appMapDir);
-    return expect(subject.files(() => {})).resolves.toEqual([appMapPath]);
+    it('fingerprints AppMaps and writes an index', async () => {
+      const subject = new FingerprintDirectoryCommand(appMapDir);
+      const count = await subject.execute();
+      expect(count).toBe(1);
+      // The index is written into a directory named after the AppMap.
+      const indexDir = join(appMapDir, 'revoke_api_key');
+      const indexFiles = await readdir(indexDir);
+      expect(indexFiles).toContain('metadata.json');
+    });
   });
 });

packages/cli/tests/unit/fingerprint/fingerprinter.spec.ts

@@ -1,4 +1,4 @@
-import { mkdtemp, open, rm, writeFile } from 'fs/promises';
+import { cp, mkdtemp, open, readdir, rm, writeFile } from 'fs/promises';
 import path from 'node:path';
 import { tmpdir } from 'os';
 import FileTooLargeError from '../../../src/fingerprint/fileTooLargeError';
@@ -18,6 +18,25 @@ function withTempDir<T>(closure: (dir: string) => Promise<T>): () => Promise<T>
 }
 
 describe(Fingerprinter, () => {
+  it(
+    'fingerprints a recording and writes the on-disk index',
+    withTempDir(async (dir) => {
+      const filePath = path.join(dir, 'revoke_api_key.appmap.json');
+      await cp(
+        path.join(__dirname, '..', 'fixtures', 'ruby', 'revoke_api_key.appmap.json'),
+        filePath
+      );
+
+      await new Fingerprinter().fingerprint(filePath);
+
+      // The legacy per-file index is written into a directory named after the
+      // AppMap (classMap, metadata, canonicalized forms).
+      const indexFiles = await readdir(path.join(dir, 'revoke_api_key'));
+      expect(indexFiles).toContain('metadata.json');
+      expect(indexFiles).toContain('classMap.json');
+    })
+  );
+
   it(
     'rejects appmaps that are too large',
     withTempDir(async (dir) => {