@agentmeshhq/agent 0.1.11 → 0.1.13

package/src/__tests__/sandbox.test.ts

@@ -0,0 +1,435 @@
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { DockerSandbox, type SandboxConfig, type SandboxMountPolicy } from "../core/sandbox.js";
+
+// Mock child_process
+vi.mock("node:child_process", () => ({
+  execSync: vi.fn(),
+  spawn: vi.fn(() => ({
+    on: vi.fn(),
+    unref: vi.fn(),
+    pid: 12345,
+  })),
+  spawnSync: vi.fn(() => ({
+    status: 0,
+    stdout: "mock-container-id\n",
+    stderr: "",
+  })),
+}));
+
+// Mock fs
+vi.mock("node:fs", () => ({
+  default: {
+    existsSync: vi.fn(() => true),
+  },
+}));
+
+describe("DockerSandbox", () => {
+  const defaultConfig: SandboxConfig = {
+    agentName: "test-agent",
+    image: "agentmesh/agent-sandbox:latest",
+    workspacePath: "/tmp/workspace",
+  };
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe("constructor", () => {
+    it("should create sandbox with default values", () => {
+      const sandbox = new DockerSandbox(defaultConfig);
+
+      expect(sandbox.getContainerName()).toMatch(/^agentmesh-sandbox-test-agent-[a-f0-9]{8}$/);
+    });
+
+    it("should merge config with defaults", () => {
+      const config: SandboxConfig = {
+        ...defaultConfig,
+        cpuLimit: "0.5",
+        memoryLimit: "1g",
+      };
+
+      const sandbox = new DockerSandbox(config);
+      expect(sandbox).toBeDefined();
+    });
+  });
+
+  describe("validateMountPolicy", () => {
+    it("should deny sensitive paths by default", () => {
+      const sandbox = new DockerSandbox({
+        ...defaultConfig,
+        workspacePath: path.join(os.homedir(), ".ssh"),
+      });
+
+      expect(() => sandbox.validateMountPolicy()).toThrow(/Mount denied.*\.ssh/);
+    });
+
+    it("should deny ~/.gnupg", () => {
+      const sandbox = new DockerSandbox({
+        ...defaultConfig,
+        workspacePath: path.join(os.homedir(), ".gnupg"),
+      });
+
+      expect(() => sandbox.validateMountPolicy()).toThrow(/Mount denied.*\.gnupg/);
+    });
+
+    it("should deny ~/.aws", () => {
+      const sandbox = new DockerSandbox({
+        ...defaultConfig,
+        workspacePath: path.join(os.homedir(), ".aws"),
+      });
+
+      expect(() => sandbox.validateMountPolicy()).toThrow(/Mount denied.*\.aws/);
+    });
+
+    it("should deny ~/.config/gcloud", () => {
+      const sandbox = new DockerSandbox({
+        ...defaultConfig,
+        workspacePath: path.join(os.homedir(), ".config/gcloud"),
+      });
+
+      expect(() => sandbox.validateMountPolicy()).toThrow(/Mount denied.*gcloud/);
+    });
+
+    it("should deny ~/.kube", () => {
+      const sandbox = new DockerSandbox({
+        ...defaultConfig,
+        workspacePath: path.join(os.homedir(), ".kube"),
+      });
+
+      expect(() => sandbox.validateMountPolicy()).toThrow(/Mount denied.*\.kube/);
+    });
+
+    it("should deny ~/.docker", () => {
+      const sandbox = new DockerSandbox({
+        ...defaultConfig,
+        workspacePath: path.join(os.homedir(), ".docker"),
+      });
+
+      expect(() => sandbox.validateMountPolicy()).toThrow(/Mount denied.*\.docker/);
+    });
+
+    it("should deny /var/run/docker.sock", () => {
+      const sandbox = new DockerSandbox({
+        ...defaultConfig,
+        workspacePath: "/var/run/docker.sock",
+      });
+
+      expect(() => sandbox.validateMountPolicy()).toThrow(/Mount denied.*docker\.sock/);
+    });
+
+    it("should allow regular workspace paths", () => {
+      const sandbox = new DockerSandbox({
+        ...defaultConfig,
+        workspacePath: "/tmp/workspace",
+      });
+
+      expect(() => sandbox.validateMountPolicy()).not.toThrow();
+    });
+
+    it("should enforce custom allowed paths when specified", () => {
+      const sandbox = new DockerSandbox({
+        ...defaultConfig,
+        workspacePath: "/home/user/random",
+      });
+
+      const policy: SandboxMountPolicy = {
+        allowedPaths: ["/home/user/allowed-only"],
+        deniedPaths: [],
+      };
+
+      expect(() => sandbox.validateMountPolicy(policy)).toThrow(/not in allowed paths/);
+    });
+
+    it("should allow path within custom allowed paths", () => {
+      const sandbox = new DockerSandbox({
+        ...defaultConfig,
+        workspacePath: "/home/user/projects/myrepo",
+      });
+
+      const policy: SandboxMountPolicy = {
+        allowedPaths: ["/home/user/projects"],
+        deniedPaths: [],
+      };
+
+      expect(() => sandbox.validateMountPolicy(policy)).not.toThrow();
+    });
+  });
+
+  describe("checkDockerAvailable", () => {
+    it("should return true when docker is available", async () => {
+      const { spawnSync } = await import("node:child_process");
+      vi.mocked(spawnSync).mockReturnValueOnce({
+        status: 0,
+        stdout: "Docker version 24.0.0",
+        stderr: "",
+        pid: 1,
+        output: [],
+        signal: null,
+      });
+
+      expect(DockerSandbox.checkDockerAvailable()).toBe(true);
+    });
+
+    it("should return false when docker is not available", async () => {
+      const { spawnSync } = await import("node:child_process");
+      vi.mocked(spawnSync).mockReturnValueOnce({
+        status: 1,
+        stdout: "",
+        stderr: "docker: command not found",
+        pid: 1,
+        output: [],
+        signal: null,
+      });
+
+      expect(DockerSandbox.checkDockerAvailable()).toBe(false);
+    });
+  });
+
+  describe("listAll", () => {
+    it("should parse docker ps output correctly", async () => {
+      const { spawnSync } = await import("node:child_process");
+      vi.mocked(spawnSync).mockReturnValueOnce({
+        status: 0,
+        stdout:
+          "abc123|agentmesh-sandbox-agent1-12345678|Up 5 minutes|agentmesh/agent-sandbox:latest\ndef456|agentmesh-sandbox-agent2-87654321|Exited (0)|agentmesh/agent-sandbox:latest",
+        stderr: "",
+        pid: 1,
+        output: [],
+        signal: null,
+      });
+
+      const containers = DockerSandbox.listAll();
+
+      expect(containers).toHaveLength(2);
+      expect(containers[0]).toEqual({
+        id: "abc123",
+        name: "agentmesh-sandbox-agent1-12345678",
+        status: "Up 5 minutes",
+        image: "agentmesh/agent-sandbox:latest",
+      });
+    });
+
+    it("should return empty array when no containers found", async () => {
+      const { spawnSync } = await import("node:child_process");
+      vi.mocked(spawnSync).mockReturnValueOnce({
+        status: 0,
+        stdout: "",
+        stderr: "",
+        pid: 1,
+        output: [],
+        signal: null,
+      });
+
+      const containers = DockerSandbox.listAll();
+      expect(containers).toEqual([]);
+    });
+  });
+
+  describe("findExisting", () => {
+    it("should find existing container for agent", async () => {
+      const { spawnSync } = await import("node:child_process");
+      vi.mocked(spawnSync).mockReturnValueOnce({
+        status: 0,
+        stdout: "abc123def456\n",
+        stderr: "",
+        pid: 1,
+        output: [],
+        signal: null,
+      });
+
+      const containerId = DockerSandbox.findExisting("test-agent");
+      expect(containerId).toBe("abc123def456");
+    });
+
+    it("should return null when no container exists", async () => {
+      const { spawnSync } = await import("node:child_process");
+      vi.mocked(spawnSync).mockReturnValueOnce({
+        status: 0,
+        stdout: "\n",
+        stderr: "",
+        pid: 1,
+        output: [],
+        signal: null,
+      });
+
+      const containerId = DockerSandbox.findExisting("nonexistent");
+      expect(containerId).toBeNull();
+    });
+  });
+
+  describe("container lifecycle", () => {
+    it("should build correct docker run arguments", async () => {
+      const { spawnSync } = await import("node:child_process");
+      const mockSpawnSync = vi.mocked(spawnSync);
+
+      // Mock image inspect (image exists)
+      mockSpawnSync.mockReturnValueOnce({
+        status: 0,
+        stdout: "{}",
+        stderr: "",
+        pid: 1,
+        output: [],
+        signal: null,
+      });
+
+      // Mock docker run
+      mockSpawnSync.mockReturnValueOnce({
+        status: 0,
+        stdout: "container-id-12345\n",
+        stderr: "",
+        pid: 1,
+        output: [],
+        signal: null,
+      });
+
+      const sandbox = new DockerSandbox({
+        agentName: "test",
+        image: "agentmesh/agent-sandbox:latest",
+        workspacePath: "/tmp/workspace",
+        cpuLimit: "2",
+        memoryLimit: "4g",
+        env: {
+          AGENT_TOKEN: "test-token",
+        },
+      });
+
+      await sandbox.pullImage();
+      await sandbox.start();
+
+      // Find the docker run call
+      const runCall = mockSpawnSync.mock.calls.find(
+        (call) => call[0] === "docker" && call[1]?.[0] === "run",
+      );
+
+      expect(runCall).toBeDefined();
+      const args = runCall![1] as string[];
+
+      // Check key arguments
+      expect(args).toContain("-d");
+      expect(args).toContain("--cpus");
+      expect(args).toContain("2");
+      expect(args).toContain("--memory");
+      expect(args).toContain("4g");
+      expect(args).toContain("--user");
+      expect(args).toContain("1000:1000");
+      expect(args).toContain("-e");
+      expect(args).toContain("AGENT_TOKEN=test-token");
+    });
+
+    it("should get container status", async () => {
+      const { spawnSync } = await import("node:child_process");
+      vi.mocked(spawnSync).mockReturnValueOnce({
+        status: 0,
+        stdout: "true|running|healthy",
+        stderr: "",
+        pid: 1,
+        output: [],
+        signal: null,
+      });
+
+      const sandbox = new DockerSandbox(defaultConfig);
+      // @ts-expect-error - accessing private property for testing
+      sandbox.containerId = "test-container";
+
+      const status = sandbox.getStatus();
+
+      expect(status).toEqual({
+        running: true,
+        status: "running",
+        health: "healthy",
+      });
+    });
+
+    it("should return not found status when container not started", async () => {
+      const { spawnSync } = await import("node:child_process");
+      vi.mocked(spawnSync).mockReturnValueOnce({
+        status: 1, // docker inspect fails for non-existent container
+        stdout: "",
+        stderr: "Error: No such container",
+        pid: 1,
+        output: [],
+        signal: null,
+      });
+
+      const sandbox = new DockerSandbox(defaultConfig);
+      const status = sandbox.getStatus();
+
+      expect(status).toEqual({
+        running: false,
+        status: "not found",
+      });
+    });
+  });
+
+  describe("resource limits", () => {
+    it("should apply default CPU limit of 1", () => {
+      const sandbox = new DockerSandbox(defaultConfig);
+      // The default is applied in constructor
+      expect(sandbox).toBeDefined();
+    });
+
+    it("should apply default memory limit of 2g", () => {
+      const sandbox = new DockerSandbox(defaultConfig);
+      expect(sandbox).toBeDefined();
+    });
+
+    it("should allow custom resource limits", () => {
+      const sandbox = new DockerSandbox({
+        ...defaultConfig,
+        cpuLimit: "0.5",
+        memoryLimit: "512m",
+      });
+      expect(sandbox).toBeDefined();
+    });
+  });
+
+  describe("serve mode", () => {
+    it("should configure serve mode with port", async () => {
+      const { spawnSync } = await import("node:child_process");
+      const mockSpawnSync = vi.mocked(spawnSync);
+
+      // Mock image inspect
+      mockSpawnSync.mockReturnValueOnce({
+        status: 0,
+        stdout: "{}",
+        stderr: "",
+        pid: 1,
+        output: [],
+        signal: null,
+      });
+
+      // Mock docker run
+      mockSpawnSync.mockReturnValueOnce({
+        status: 0,
+        stdout: "container-id\n",
+        stderr: "",
+        pid: 1,
+        output: [],
+        signal: null,
+      });
+
+      const sandbox = new DockerSandbox({
+        ...defaultConfig,
+        serveMode: true,
+        servePort: 3001,
+      });
+
+      await sandbox.pullImage();
+      await sandbox.start();
+
+      const runCall = mockSpawnSync.mock.calls.find(
+        (call) => call[0] === "docker" && call[1]?.[0] === "run",
+      );
+
+      expect(runCall).toBeDefined();
+      const args = runCall![1] as string[];
+
+      expect(args).toContain("-p");
+      expect(args).toContain("3001:3001");
+      expect(args).toContain("opencode");
+      expect(args).toContain("serve");
+    });
+  });
+});

package/src/cli/build.ts

@@ -0,0 +1,137 @@
+import { spawnSync, execSync } from "node:child_process";
+import path from "node:path";
+import pc from "picocolors";
+
+function findProjectRoot(): string {
+  let dir = process.cwd();
+  for (let i = 0; i < 10; i++) {
+    const packageJson = path.join(dir, "package.json");
+    const pnpmWorkspace = path.join(dir, "pnpm-workspace.yaml");
+    try {
+      execSync(`test -f "${packageJson}" && test -f "${pnpmWorkspace}"`, { stdio: "ignore" });
+      return dir;
+    } catch {
+      dir = path.dirname(dir);
+    }
+  }
+  throw new Error("Could not find AgentMesh project root. Make sure you're in the agentmesh repository.");
+}
+
+export interface BuildOptions {
+  docker?: boolean;
+  package?: string;
+  clean?: boolean;
+}
+
+export async function build(options: BuildOptions = {}): Promise<void> {
+  const projectRoot = findProjectRoot();
+
+  if (options.docker) {
+    await buildDocker(projectRoot, options);
+  } else {
+    await buildPackages(projectRoot, options);
+  }
+}
+
+async function buildPackages(projectRoot: string, options: BuildOptions): Promise<void> {
+  console.log(pc.cyan("Building AgentMesh packages..."));
+  console.log();
+
+  const args = ["pnpm"];
+
+  if (options.package) {
+    args.push("--filter", options.package);
+  }
+
+  if (options.clean) {
+    console.log(pc.dim("Cleaning build artifacts..."));
+    const cleanResult = spawnSync("pnpm", ["-r", "exec", "rm", "-rf", "dist"], {
+      cwd: projectRoot,
+      stdio: "inherit",
+    });
+    if (cleanResult.status !== 0) {
+      console.warn(pc.yellow("Warning: Clean may have partially failed"));
+    }
+    console.log();
+  }
+
+  args.push("build");
+
+  const result = spawnSync(args[0], args.slice(1), {
+    cwd: projectRoot,
+    stdio: "inherit",
+  });
+
+  if (result.status !== 0) {
+    console.error(pc.red("Build failed"));
+    process.exit(1);
+  }
+
+  console.log();
+  console.log(pc.green("Build completed successfully!"));
+}
+
+async function buildDocker(projectRoot: string, options: BuildOptions): Promise<void> {
+  console.log(pc.cyan("Building Docker images..."));
+  console.log();
+
+  // Check if docker is available
+  try {
+    execSync("docker --version", { stdio: "ignore" });
+  } catch {
+    console.error(pc.red("Docker is not installed or not running"));
+    process.exit(1);
+  }
+
+  // Use docker buildx bake for multi-image builds
+  const dockerDir = path.join(projectRoot, "docker");
+  const dockerfilePath = path.join(dockerDir, "Dockerfile");
+
+  try {
+    execSync(`test -f "${dockerfilePath}"`, { stdio: "ignore" });
+  } catch {
+    console.error(pc.red("Dockerfile not found at docker/Dockerfile"));
+    process.exit(1);
+  }
+
+  // Build using docker compose to leverage the existing setup
+  const composePath = path.join(dockerDir, "docker-compose.local.yml");
+
+  const args = ["compose", "-f", composePath, "build"];
+  if (options.package) {
+    // Map package names to service names
+    const serviceMap: Record<string, string> = {
+      "@agentmesh/hub": "hub-api",
+      "@agentmesh/admin": "admin",
+      hub: "hub-api",
+      admin: "admin",
+    };
+    const service = serviceMap[options.package] || options.package;
+    args.push(service);
+  }
+
+  const result = spawnSync("docker", args, {
+    cwd: projectRoot,
+    stdio: "inherit",
+  });
+
+  if (result.status !== 0) {
+    console.error(pc.red("Docker build failed"));
+    process.exit(1);
+  }
+
+  console.log();
+  console.log(pc.green("Docker images built successfully!"));
+
+  // List built images
+  console.log();
+  console.log(pc.bold("Built images:"));
+  const listResult = spawnSync(
+    "docker",
+    ["images", "--filter", "reference=*agentmesh*", "--format", "{{.Repository}}:{{.Tag}}\t{{.Size}}"],
+    { encoding: "utf-8" }
+  );
+  if (listResult.stdout) {
+    console.log(pc.dim(listResult.stdout));
+  }
+}