@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.11

package/out/test/sandbox-scope.test.js

@@ -0,0 +1,449 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Sandbox scope + stream demux.
+ *
+ *  Three defects are pinned here, in the order they bite:
+ *   - streamed events carried no run id, so two turns on one sandbox wrote into each other's
+ *     transcript. Deterministic, not a race — the old dispatch broadcast every event.
+ *   - `sandboxFor` checked the map and then awaited twice before writing it back, so two turns
+ *     arriving together each built a sandbox. The loser stayed LIVE and unreachable: destroy,
+ *     revoke and TTL all missed it.
+ *   - one sandbox may now hold several of a user's sessions, and they must stay distinct inside
+ *     it (the run frame's sessionId) while destroy/revoke still work when named by either key.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const node_stream_1 = require("node:stream");
+const sandboxRunner_1 = require("../sandbox/sandboxRunner");
+const remoteEngine_1 = require("../runner/remoteEngine");
+const protocol_1 = require("../runner/protocol");
+const host_1 = require("../runner/host");
+const RUNTIME = { logger: { info() { }, warn() { }, error() { }, debug() { } } };
+/** Collects text deltas so a turn's own output can be told from its neighbour's. */
+function collector() {
+    const text_ = [];
+    return {
+        text_,
+        async thinking() { }, async text(d) { text_.push(d); },
+        async toolStart() { }, async toolEnd() { }, async progress() { },
+        async question() { return { selected: [], freeText: null, declined: true }; },
+        async error() { }, async done() { },
+    };
+}
+const tick = () => new Promise((r) => setTimeout(r, 5));
+async function waitFor(cond, what, ms = 2000) {
+    const deadline = Date.now() + ms;
+    while (!cond()) {
+        if (Date.now() > deadline) {
+            throw new Error(`timed out waiting for ${what}`);
+        }
+        await tick();
+    }
+}
+suite('runner protocol — tagged streamed events', () => {
+    test('a tagged event round-trips and is recognised as tagged', () => {
+        const line = (0, protocol_1.encodeRunnerFrame)({ id: 'r7', event: { type: 'text', delta: 'hi' } });
+        const parsed = (0, protocol_1.parseRunnerFrame)(line);
+        assert.ok(parsed && (0, protocol_1.isTaggedEvent)(parsed), 'must parse back as a tagged event');
+        assert.strictEqual(parsed.id, 'r7');
+        assert.deepStrictEqual(parsed.event, { type: 'text', delta: 'hi' });
+    });
+    test('an UNTAGGED event still parses — a pinned older image keeps working', () => {
+        const parsed = (0, protocol_1.parseRunnerFrame)(JSON.stringify({ type: 'text', delta: 'legacy' }));
+        assert.ok(parsed && !(0, protocol_1.isTaggedEvent)(parsed), 'legacy events stay untagged, not rejected');
+    });
+    test('an envelope whose inner event is not a real event type is rejected', () => {
+        // Accepting it would hand applyParsedRunnerEvent something its switch ignores, and the turn
+        // would look like it streamed nothing at all.
+        assert.strictEqual((0, protocol_1.parseRunnerFrame)(JSON.stringify({ id: 'r1', event: { type: 'nope' } })), undefined);
+        assert.strictEqual((0, protocol_1.parseRunnerFrame)(JSON.stringify({ id: 'r1', event: 'text' })), undefined);
+    });
+    test('the demux capability rides `ready`, and its absence is not an error', () => {
+        assert.deepStrictEqual((0, protocol_1.parseRunnerFrame)(JSON.stringify({ type: 'ready', demux: true })), { type: 'ready', demux: true });
+        assert.deepStrictEqual((0, protocol_1.parseRunnerFrame)(JSON.stringify({ type: 'ready' })), { type: 'ready' });
+    });
+    test('terminal frames are still terminal, and a tagged event is not', () => {
+        const result = (0, protocol_1.parseRunnerFrame)(JSON.stringify({ type: 'result', id: 'r1' }));
+        const event = (0, protocol_1.parseRunnerFrame)(JSON.stringify({ id: 'r1', event: { type: 'done' } }));
+        assert.ok(result && (0, protocol_1.isTerminalFrame)(result));
+        assert.ok(event && !(0, protocol_1.isTerminalFrame)(event), 'a streamed event must never settle a turn');
+    });
+});
+/** A channel whose runner side is driven frame by frame from the test. */
+function scriptedChannel() {
+    const toServe = new node_stream_1.PassThrough();
+    const toRunner = new node_stream_1.PassThrough();
+    const sent = [];
+    let buffer = '';
+    toRunner.on('data', (chunk) => {
+        buffer += chunk.toString('utf8');
+        const lines = buffer.split('\n');
+        buffer = lines.pop() ?? '';
+        for (const line of lines) {
+            if (line.trim()) {
+                sent.push(JSON.parse(line));
+            }
+        }
+    });
+    return {
+        sent,
+        channel: {
+            input: toServe,
+            output: { write: (c) => toRunner.write(c) },
+            closed: new Promise(() => undefined),
+        },
+        emit: (frame) => { toServe.write(`${JSON.stringify(frame)}\n`); },
+    };
+}
+suite('RemoteEngine — one turn\'s output reaches only that turn', () => {
+    test('tagged events route to their own turn; neither transcript sees the other', async () => {
+        const { channel, emit } = scriptedChannel();
+        const engine = new remoteEngine_1.RemoteEngine({ id: 's', displayName: 'S', channel });
+        const a = collector();
+        const b = collector();
+        // Run ids are assigned in order: r1, r2. `pending` is populated synchronously by stream().
+        const pa = engine.stream('a', { sessionId: 's1' }, a, RUNTIME);
+        const pb = engine.stream('b', { sessionId: 's2' }, b, RUNTIME);
+        emit({ id: 'r1', event: { type: 'text', delta: 'A1' } });
+        emit({ id: 'r2', event: { type: 'text', delta: 'B1' } });
+        emit({ id: 'r1', event: { type: 'text', delta: 'A2' } });
+        emit({ type: 'result', id: 'r1' });
+        emit({ type: 'result', id: 'r2' });
+        await Promise.all([pa, pb]);
+        assert.deepStrictEqual(a.text_, ['A1', 'A2'], 'turn A sees only its own deltas');
+        assert.deepStrictEqual(b.text_, ['B1'], 'turn B sees only its own deltas');
+    });
+    test('an UNTAGGED event still broadcasts — the legacy peer contract is unchanged', async () => {
+        const { channel, emit } = scriptedChannel();
+        const engine = new remoteEngine_1.RemoteEngine({ id: 's', displayName: 'S', channel });
+        const a = collector();
+        const b = collector();
+        const pa = engine.stream('a', {}, a, RUNTIME);
+        const pb = engine.stream('b', {}, b, RUNTIME);
+        emit({ type: 'text', delta: 'shared' });
+        emit({ type: 'result', id: 'r1' });
+        emit({ type: 'result', id: 'r2' });
+        await Promise.all([pa, pb]);
+        // This is exactly why an untagged peer must be given one turn at a time.
+        assert.deepStrictEqual(a.text_, ['shared']);
+        assert.deepStrictEqual(b.text_, ['shared']);
+    });
+    test('demux is assumed OFF until the peer proves otherwise', async () => {
+        const { channel, emit } = scriptedChannel();
+        const engine = new remoteEngine_1.RemoteEngine({ id: 's', displayName: 'S', channel });
+        assert.strictEqual(engine.supportsDemux(), false, 'a run frame can be sent before `ready` arrives');
+        const p = engine.stream('a', {}, collector(), RUNTIME);
+        emit({ type: 'ready', demux: true });
+        await waitFor(() => engine.supportsDemux(), 'the ready handshake');
+        emit({ type: 'result', id: 'r1' });
+        await p;
+    });
+    test('a legacy `ready` leaves demux off', async () => {
+        const { channel, emit } = scriptedChannel();
+        const engine = new remoteEngine_1.RemoteEngine({ id: 's', displayName: 'S', channel });
+        const p = engine.stream('a', {}, collector(), RUNTIME);
+        emit({ type: 'ready' });
+        await tick();
+        assert.strictEqual(engine.supportsDemux(), false);
+        emit({ type: 'result', id: 'r1' });
+        await p;
+    });
+    test('an event arriving after its turn settled is dropped, not thrown', async () => {
+        const { channel, emit } = scriptedChannel();
+        const engine = new remoteEngine_1.RemoteEngine({ id: 's', displayName: 'S', channel });
+        const a = collector();
+        const p = engine.stream('a', {}, a, RUNTIME);
+        emit({ type: 'result', id: 'r1' });
+        await p;
+        emit({ id: 'r1', event: { type: 'text', delta: 'late' } });
+        await tick();
+        assert.deepStrictEqual(a.text_, [], 'a late event names a turn that no longer exists');
+    });
+});
+/** Driver over real runner hosts, with a create that can be held open to force a race. */
+function raceableDriver(engineFor, opts = {}) {
+    const created = [];
+    const destroyed = [];
+    let seq = 0;
+    const driver = {
+        kind: 'process', tier: 0,
+        async create(spec) {
+            created.push(spec);
+            if (opts.createDelayMs) {
+                await new Promise((r) => setTimeout(r, opts.createDelayMs));
+            }
+            const id = `sandbox-${++seq}`;
+            const toRunner = new node_stream_1.PassThrough();
+            const toServe = new node_stream_1.PassThrough();
+            (0, host_1.startRunnerHost)({
+                engine: engineFor(), runtime: RUNTIME, input: toRunner,
+                output: { write: (c) => toServe.write(c) },
+                maintenanceIntervalMs: 60_000,
+            });
+            return {
+                id, tier: 0, endpoint: 'stdio',
+                connect: () => ({
+                    input: toServe,
+                    output: { write: (c) => toRunner.write(c) },
+                    closed: new Promise(() => undefined),
+                }),
+            };
+        },
+        async revoke() { },
+        async destroy(handle) { destroyed.push(handle.id); },
+    };
+    return { driver, created, destroyed };
+}
+const base = (driver) => ({
+    driver, image: `img@sha256:${'a'.repeat(64)}`, tier: 0, routes: [], runtime: RUNTIME,
+});
+/** Records the sessionId each turn arrived with, and how many ran at once. */
+function recordingEngine(state) {
+    return {
+        id: 'r', displayName: 'R',
+        async stream(message, options, emitter) {
+            state.seen.push(options.sessionId ?? '<none>');
+            state.active++;
+            state.max = Math.max(state.max, state.active);
+            if (state.hold) {
+                await state.hold;
+            }
+            await emitter.text(`T:${message}`);
+            state.active--;
+        },
+        onMaintenance() { }, dispose() { },
+    };
+}
+suite('sandbox creation is single-flight', () => {
+    test('two turns arriving together build ONE sandbox, not two', async () => {
+        const state = { seen: [], active: 0, max: 0 };
+        const { driver, created } = raceableDriver(() => recordingEngine(state), { createDelayMs: 25 });
+        const runner = (0, sandboxRunner_1.createSandboxRunner)(base(driver));
+        // Both miss the map, and creation spans two awaits — the window the single-flight closes.
+        await Promise.all([
+            runner.run({ engineId: 'e', modelId: 'm', message: 'a', workspaceRoot: '/w', sessionId: 's1', sandboxKey: 'u1' }),
+            runner.run({ engineId: 'e', modelId: 'm', message: 'b', workspaceRoot: '/w', sessionId: 's2', sandboxKey: 'u1' }),
+        ]);
+        assert.strictEqual(created.length, 1, 'the loser of the race used to stay live and unreachable');
+        assert.strictEqual(runner.sandboxes().length, 1);
+    });
+    test('a failed creation is not cached — the next turn retries', async () => {
+        const state = { seen: [], active: 0, max: 0 };
+        const { driver } = raceableDriver(() => recordingEngine(state));
+        let allow = false;
+        const runner = (0, sandboxRunner_1.createSandboxRunner)({
+            ...base(driver),
+            admit: () => { if (!allow) {
+                throw new Error('lease revoked');
+            } },
+        });
+        const denied = await runner.run({ engineId: 'e', modelId: 'm', message: 'a', workspaceRoot: '/w', sessionId: 's1' });
+        assert.strictEqual(denied.success, false);
+        assert.match(denied.error ?? '', /lease revoked/);
+        allow = true;
+        const ok = await runner.run({ engineId: 'e', modelId: 'm', message: 'b', workspaceRoot: '/w', sessionId: 's1' });
+        assert.strictEqual(ok.success, true, 'a cached rejected promise would refuse this forever');
+    });
+    test('admission sees the session that triggered the creation, not just the sandbox key', async () => {
+        const state = { seen: [], active: 0, max: 0 };
+        const { driver } = raceableDriver(() => recordingEngine(state));
+        const admitted = [];
+        const runner = (0, sandboxRunner_1.createSandboxRunner)({ ...base(driver), admit: (ctx) => { admitted.push(ctx); } });
+        await runner.run({ engineId: 'e', modelId: 'm', message: 'a', workspaceRoot: '/w', sessionId: 's1', sandboxKey: 'u1' });
+        // A deny rule can name a SESSION; under user scope the sandbox key names the user instead.
+        assert.deepStrictEqual(admitted, [{ sandboxKey: 'u1', sessionKey: 's1' }]);
+    });
+});
+suite('one sandbox, several of a user\'s sessions', () => {
+    test('sessions sharing a sandbox stay distinct on the wire', async () => {
+        const state = { seen: [], active: 0, max: 0 };
+        const { driver, created } = raceableDriver(() => recordingEngine(state));
+        const runner = (0, sandboxRunner_1.createSandboxRunner)(base(driver));
+        await runner.run({ engineId: 'e', modelId: 'm', message: 'a', workspaceRoot: '/w', sessionId: 'u1--s1', sandboxKey: 'u1' });
+        await runner.run({ engineId: 'e', modelId: 'm', message: 'b', workspaceRoot: '/w', sessionId: 'u1--s2', sandboxKey: 'u1' });
+        assert.strictEqual(created.length, 1, 'one user, one sandbox');
+        // The whole mechanism: the frame still carries sessionId, so the in-sandbox runner keys
+        // engine state per conversation even though the container is shared.
+        assert.deepStrictEqual(state.seen, ['u1--s1', 'u1--s2']);
+    });
+    test('the sandbox key, not the session key, names the state directory and mounts', async () => {
+        const state = { seen: [], active: 0, max: 0 };
+        const { driver, created } = raceableDriver(() => recordingEngine(state));
+        const runner = (0, sandboxRunner_1.createSandboxRunner)({
+            ...base(driver),
+            stateDirFor: (key) => `/state/${key}`,
+            fsFor: async (key) => ({ readonly: [], writable: [`/ws/${key}:/state/workspace`] }),
+        });
+        await runner.run({ engineId: 'e', modelId: 'm', message: 'a', workspaceRoot: '/w', sessionId: 'u1--s1', sandboxKey: 'u1' });
+        assert.strictEqual(created[0].stateDir, '/state/u1');
+        assert.deepStrictEqual(created[0].fs.writable, ['/ws/u1:/state/workspace']);
+        assert.strictEqual(created[0].sandboxKey, 'u1');
+    });
+    test('sandboxes() reports every session on a sandbox', async () => {
+        const state = { seen: [], active: 0, max: 0 };
+        const { driver } = raceableDriver(() => recordingEngine(state));
+        const runner = (0, sandboxRunner_1.createSandboxRunner)(base(driver));
+        await runner.run({ engineId: 'e', modelId: 'm', message: 'a', workspaceRoot: '/w', sessionId: 's1', sandboxKey: 'u1' });
+        await runner.run({ engineId: 'e', modelId: 'm', message: 'b', workspaceRoot: '/w', sessionId: 's2', sandboxKey: 'u1' });
+        const live = runner.sandboxes();
+        assert.strictEqual(live.length, 1);
+        assert.strictEqual(live[0].sandboxKey, 'u1');
+        // The governor matches deny rules per session, so it needs all of them.
+        assert.deepStrictEqual([...live[0].sessionKeys].sort(), ['s1', 's2']);
+    });
+    test('destroy works when named by a session OR by the sandbox key', async () => {
+        const state = { seen: [], active: 0, max: 0 };
+        const { driver, destroyed } = raceableDriver(() => recordingEngine(state));
+        const runner = (0, sandboxRunner_1.createSandboxRunner)(base(driver));
+        await runner.run({ engineId: 'e', modelId: 'm', message: 'a', workspaceRoot: '/w', sessionId: 's1', sandboxKey: 'u1' });
+        await runner.run({ engineId: 'e', modelId: 'm', message: 'b', workspaceRoot: '/w', sessionId: 's2', sandboxKey: 'u1' });
+        // A cap breach or deny rule names a session; the sandbox it shares is what dies.
+        await runner.destroySession('s2');
+        assert.strictEqual(destroyed.length, 1);
+        assert.strictEqual(runner.sandboxes().length, 0);
+        await runner.run({ engineId: 'e', modelId: 'm', message: 'c', workspaceRoot: '/w', sessionId: 's1', sandboxKey: 'u1' });
+        // killAll names the sandbox itself.
+        await runner.destroySession('u1');
+        assert.strictEqual(destroyed.length, 2);
+        assert.strictEqual(runner.sandboxes().length, 0);
+    });
+    test('an unknown key destroys nothing', async () => {
+        const state = { seen: [], active: 0, max: 0 };
+        const { driver, destroyed } = raceableDriver(() => recordingEngine(state));
+        const runner = (0, sandboxRunner_1.createSandboxRunner)(base(driver));
+        await runner.run({ engineId: 'e', modelId: 'm', message: 'a', workspaceRoot: '/w', sessionId: 's1' });
+        await runner.destroySession('never-seen');
+        assert.strictEqual(destroyed.length, 0);
+        assert.strictEqual(runner.sandboxes().length, 1);
+    });
+    test('without a sandboxKey the behaviour is exactly one sandbox per session', async () => {
+        const state = { seen: [], active: 0, max: 0 };
+        const { driver, created } = raceableDriver(() => recordingEngine(state));
+        const runner = (0, sandboxRunner_1.createSandboxRunner)(base(driver));
+        await runner.run({ engineId: 'e', modelId: 'm', message: 'a', workspaceRoot: '/w', sessionId: 's1' });
+        await runner.run({ engineId: 'e', modelId: 'm', message: 'b', workspaceRoot: '/w', sessionId: 's2' });
+        assert.deepStrictEqual(created.map((c) => c.sandboxKey), ['s1', 's2']);
+    });
+});
+/** A pre-demux sandbox: `ready` without the flag, and streamed events with no run id. */
+function legacyHostDriver(state) {
+    const created = [];
+    let seq = 0;
+    const driver = {
+        kind: 'process', tier: 0,
+        async create(spec) {
+            created.push(spec);
+            const id = `sandbox-${++seq}`;
+            const toRunner = new node_stream_1.PassThrough();
+            const toServe = new node_stream_1.PassThrough();
+            const write = (o) => toServe.write(`${JSON.stringify(o)}\n`);
+            write({ type: 'ready' });
+            let buffer = '';
+            toRunner.on('data', (chunk) => {
+                buffer += chunk.toString('utf8');
+                const lines = buffer.split('\n');
+                buffer = lines.pop() ?? '';
+                for (const line of lines) {
+                    if (!line.trim()) {
+                        continue;
+                    }
+                    const frame = JSON.parse(line);
+                    if (frame.type !== 'run') {
+                        continue;
+                    }
+                    void (async () => {
+                        state.active++;
+                        state.max = Math.max(state.max, state.active);
+                        if (state.hold) {
+                            await state.hold;
+                        }
+                        write({ type: 'text', delta: `T:${frame.message}` });
+                        state.active--;
+                        write({ type: 'result', id: frame.id });
+                    })();
+                }
+            });
+            return {
+                id, tier: 0, endpoint: 'stdio',
+                connect: () => ({
+                    input: toServe,
+                    output: { write: (c) => toRunner.write(c) },
+                    closed: new Promise(() => undefined),
+                }),
+            };
+        },
+        async revoke() { },
+        async destroy() { },
+    };
+    return { driver, created };
+}
+suite('turns serialize when the peer cannot tag its events', () => {
+    test('a legacy sandbox runs one turn at a time', async () => {
+        const state = { active: 0, max: 0 };
+        const { driver, created } = legacyHostDriver(state);
+        const runner = (0, sandboxRunner_1.createSandboxRunner)(base(driver));
+        // Warm up so the `ready` handshake has certainly been seen before the concurrent pair.
+        await runner.run({ engineId: 'e', modelId: 'm', message: 'w', workspaceRoot: '/w', sessionId: 's0', sandboxKey: 'u1' });
+        const results = await Promise.all([
+            runner.run({ engineId: 'e', modelId: 'm', message: 'a', workspaceRoot: '/w', sessionId: 's1', sandboxKey: 'u1' }),
+            runner.run({ engineId: 'e', modelId: 'm', message: 'b', workspaceRoot: '/w', sessionId: 's2', sandboxKey: 'u1' }),
+        ]);
+        assert.strictEqual(created.length, 1);
+        assert.strictEqual(state.max, 1, 'overlapping turns on an untagged peer would cross-talk');
+        // Serialized, so each turn still gets exactly its own output despite the broadcast.
+        assert.deepStrictEqual(results.map((r) => r.text), ['T:a', 'T:b']);
+    });
+    test('a demux-capable sandbox runs them concurrently', async () => {
+        let release;
+        const hold = new Promise((r) => { release = r; });
+        const state = { seen: [], active: 0, max: 0, hold: undefined };
+        const { driver } = raceableDriver(() => recordingEngine(state));
+        const runner = (0, sandboxRunner_1.createSandboxRunner)(base(driver));
+        await runner.run({ engineId: 'e', modelId: 'm', message: 'w', workspaceRoot: '/w', sessionId: 's0', sandboxKey: 'u1' });
+        state.hold = hold;
+        const pair = Promise.all([
+            runner.run({ engineId: 'e', modelId: 'm', message: 'a', workspaceRoot: '/w', sessionId: 's1', sandboxKey: 'u1' }),
+            runner.run({ engineId: 'e', modelId: 'm', message: 'b', workspaceRoot: '/w', sessionId: 's2', sandboxKey: 'u1' }),
+        ]);
+        await waitFor(() => state.max >= 2, 'both turns to be in flight at once');
+        release();
+        const results = await pair;
+        assert.strictEqual(state.max, 2, 'demux is what buys the concurrency');
+        // And with both in flight, neither transcript picked up the other's text.
+        assert.deepStrictEqual(results.map((r) => r.text), ['T:a', 'T:b']);
+    });
+});