@akira-tl/forgerelay 0.8.8 → 0.8.10

package/scripts/debug/relay-accept/support.mjs

@@ -0,0 +1,135 @@
+import assert from "node:assert/strict";
+import { spawn, spawnSync } from "node:child_process";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { once } from "node:events";
+import { connect } from "node:net";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { join, resolve } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { debugRoot, repoRoot } from "../runtime.mjs";
+
+export function relayAcceptanceTopology() {
+  const gatewayPort = 7677;
+  const executionPort = 7678;
+  const gatewayBaseUrl = `http://127.0.0.1:${gatewayPort}`;
+  const gatewayMcpUrl = `${gatewayBaseUrl}/mcp`;
+  const executionBaseUrl = `http://127.0.0.1:${executionPort}`;
+  const acceptanceRoot = resolve(debugRoot, "relay-acceptance");
+  const gatewayConfigDir = join(acceptanceRoot, "gateway", "config");
+  const gatewayStateDir = join(acceptanceRoot, "gateway", "state");
+  const gatewayWorktreeRoot = join(acceptanceRoot, "gateway", "worktrees");
+  const gatewayProjects = join(acceptanceRoot, "gateway-projects");
+  const gatewayLocalProject = join(gatewayProjects, "local");
+  const executionConfigDir = join(acceptanceRoot, "execution", "config");
+  const executionStateDir = join(acceptanceRoot, "execution", "state");
+  const executionWorktreeRoot = join(acceptanceRoot, "execution", "worktrees");
+  const executionProjects = join(acceptanceRoot, "execution-projects");
+  const executionCheckout = join(executionProjects, "checkout");
+  const executionWorktreeSource = join(executionProjects, "worktree-source");
+  const bootstrapSecret = "RELAY_ACCEPTANCE_BOOTSTRAP_SECRET";
+  const checkoutTaskBody = "RELAY_ACCEPTANCE_EXECUTION_TASK_BODY";
+  const worktreeTaskBody = "RELAY_ACCEPTANCE_WORKTREE_TASK_BODY";
+  const compositeMemberTaskBody = "RELAY_ACCEPTANCE_COMPOSITE_MEMBER_TASK_BODY";
+  const compositeTaskBody = "RELAY_ACCEPTANCE_COMPOSITE_OWN_TASK_BODY";
+  return {
+    gatewayPort, executionPort, gatewayBaseUrl, gatewayMcpUrl, executionBaseUrl,
+    acceptanceRoot, gatewayConfigDir, gatewayStateDir, gatewayWorktreeRoot,
+    gatewayProjects, gatewayLocalProject, executionConfigDir, executionStateDir,
+    executionWorktreeRoot, executionProjects, executionCheckout, executionWorktreeSource,
+    bootstrapSecret, checkoutTaskBody, worktreeTaskBody, compositeMemberTaskBody, compositeTaskBody,
+  };
+}
+
+export async function assertPortsFree(ports) {
+  for (const port of ports) {
+    const occupied = await new Promise((resolvePromise) => {
+      const socket = connect({ host: "127.0.0.1", port });
+      socket.once("connect", () => {
+        socket.destroy();
+        resolvePromise(true);
+      });
+      socket.once("error", () => resolvePromise(false));
+    });
+    assert.equal(occupied, false, `reserved debug port ${port} is already in use; refusing to touch the existing process`);
+  }
+}
+
+export function setupGitProject(root) {
+  mkdirSync(root, { recursive: true });
+  writeFileSync(join(root, "README.md"), "Relay managed worktree acceptance\n");
+  runGit(root, ["init"]);
+  runGit(root, ["config", "user.email", "forgerelay-debug@example.com"]);
+  runGit(root, ["config", "user.name", "ForgeRelay Debug"]);
+  runGit(root, ["add", "."]);
+  runGit(root, ["commit", "-m", "Initial Relay acceptance commit"]);
+}
+
+export function runGit(cwd, args) {
+  const result = spawnSync("git", args, { cwd, encoding: "utf8" });
+  if (result.status !== 0) {
+    throw new Error(`git ${args.join(" ")} failed: ${result.stderr.trim() || result.stdout.trim()}`);
+  }
+}
+
+export function taskStateFiles(stateDir) {
+  const workspacesDir = join(stateDir, "workspaces");
+  if (!existsSync(workspacesDir)) return [];
+  const files = [];
+  for (const entry of readdirSync(workspacesDir, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const candidate = join(workspacesDir, entry.name, "tasks.json");
+    if (existsSync(candidate)) files.push(candidate);
+  }
+  return files;
+}
+
+export function findTaskStateFile(stateDir, needle) {
+  return taskStateFiles(stateDir).find((path) => readFileSync(path, "utf8").includes(needle));
+}
+
+export function assertTaskBodyAbsentFromGateway(gatewayStateDir, body) {
+  const leaked = taskStateFiles(gatewayStateDir).filter((path) => readFileSync(path, "utf8").includes(body));
+  assert.deepEqual(leaked, [], `Gateway stored an Execution-owned Task body in: ${leaked.join(", ")}`);
+}
+
+export function assertSafeRelayInspection(result, { executionWorkspaceId, executionBaseUrl, executionPort, executionOwnerToken, bootstrapSecret, remoteRecord, taskBodies }) {
+  const json = JSON.stringify(result);
+  for (const forbidden of [
+    executionWorkspaceId,
+    executionBaseUrl,
+    `127.0.0.1:${executionPort}`,
+    executionOwnerToken,
+    remoteRecord.accessToken,
+    remoteRecord.refreshToken,
+    bootstrapSecret,
+    "remoteInstanceId",
+    "remoteWorkspaceId",
+    "sshRoute",
+    ...taskBodies,
+  ]) {
+    assert.equal(json.includes(forbidden), false, `Relay inspection leaked ${forbidden}`);
+  }
+  assert.doesNotMatch(json, /"ws_[0-9a-f]{10}"/);
+}
+
+export function assertToolOk(result, label) {
+  assert.equal(result.isError, undefined, `${label}: ${toolText(result)}`);
+}
+
+export function toolText(result) {
+  return (result.content ?? [])
+    .filter((entry) => entry.type === "text")
+    .map((entry) => entry.text)
+    .join("\n");
+}
+
+export function pass(label, detail) {
+  console.log(`PASS ${label}: ${detail}`);
+}

package/scripts/debug/relay-accept.mjs

@@ -14,31 +14,17 @@ import {
 import { join, resolve } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 import { debugRoot, repoRoot } from "./runtime.mjs";
-
-const gatewayPort = 7677;
-const executionPort = 7678;
-const gatewayBaseUrl = `http://127.0.0.1:${gatewayPort}`;
-const gatewayMcpUrl = `${gatewayBaseUrl}/mcp`;
-const executionBaseUrl = `http://127.0.0.1:${executionPort}`;
-const acceptanceRoot = resolve(debugRoot, "relay-acceptance");
-const gatewayConfigDir = join(acceptanceRoot, "gateway", "config");
-const gatewayStateDir = join(acceptanceRoot, "gateway", "state");
-const gatewayWorktreeRoot = join(acceptanceRoot, "gateway", "worktrees");
-const gatewayProjects = join(acceptanceRoot, "gateway-projects");
-const gatewayLocalProject = join(gatewayProjects, "local");
-const executionConfigDir = join(acceptanceRoot, "execution", "config");
-const executionStateDir = join(acceptanceRoot, "execution", "state");
-const executionWorktreeRoot = join(acceptanceRoot, "execution", "worktrees");
-const executionProjects = join(acceptanceRoot, "execution-projects");
-const executionCheckout = join(executionProjects, "checkout");
-const executionWorktreeSource = join(executionProjects, "worktree-source");
+import { relayAcceptanceTopology, assertPortsFree, setupGitProject, runGit, taskStateFiles, findTaskStateFile, assertTaskBodyAbsentFromGateway, assertSafeRelayInspection, assertToolOk, toolText, pass } from "./relay-accept/support.mjs";
+
+const {
+  gatewayPort, executionPort, gatewayBaseUrl, gatewayMcpUrl, executionBaseUrl,
+  acceptanceRoot, gatewayConfigDir, gatewayStateDir, gatewayWorktreeRoot,
+  gatewayProjects, gatewayLocalProject, executionConfigDir, executionStateDir,
+  executionWorktreeRoot, executionProjects, executionCheckout, executionWorktreeSource,
+  bootstrapSecret, checkoutTaskBody, worktreeTaskBody, compositeMemberTaskBody, compositeTaskBody,
+} = relayAcceptanceTopology();
 const gatewayOwnerToken = randomBytes(32).toString("base64url");
 const executionOwnerToken = randomBytes(32).toString("base64url");
-const bootstrapSecret = "RELAY_ACCEPTANCE_BOOTSTRAP_SECRET";
-const checkoutTaskBody = "RELAY_ACCEPTANCE_EXECUTION_TASK_BODY";
-const worktreeTaskBody = "RELAY_ACCEPTANCE_WORKTREE_TASK_BODY";
-const compositeMemberTaskBody = "RELAY_ACCEPTANCE_COMPOSITE_MEMBER_TASK_BODY";
-const compositeTaskBody = "RELAY_ACCEPTANCE_COMPOSITE_OWN_TASK_BODY";
 
 await assertPortsFree([gatewayPort, executionPort]);
 rmSync(acceptanceRoot, { recursive: true, force: true });
@@ -152,7 +138,7 @@ try {
   assert.ok(checkoutTaskFile, "Execution Task state file was not found");
   const checkoutExecutionWorkspaceId = checkoutTaskFile.split("/").at(-2);
   assert.match(checkoutExecutionWorkspaceId, /^ws_[0-9a-f]{10}$/);
-  assertTaskBodyAbsentFromGateway(checkoutTaskBody);
+  assertTaskBodyAbsentFromGateway(gatewayStateDir, checkoutTaskBody);
   pass("Execution-owned Task truth", `${checkoutExecutionWorkspaceId} owns the Task state; Gateway has no shadow copy`);
 
   for (let index = 0; index < 2; index += 1) {
@@ -188,6 +174,10 @@ try {
   assert.equal(inspectedCheckout.structuredContent.inspection.taskSummary.lists[0].unfinishedTaskCount, 1);
   assertSafeRelayInspection(inspectedCheckout, {
     executionWorkspaceId: checkoutExecutionWorkspaceId,
+    executionBaseUrl,
+    executionPort,
+    executionOwnerToken,
+    bootstrapSecret,
     remoteRecord,
     taskBodies: [checkoutTaskBody],
   });
@@ -269,7 +259,7 @@ try {
   const worktreeTaskFile = findTaskStateFile(executionStateDir, worktreeTaskBody);
   assert.ok(worktreeTaskFile, "Execution managed-worktree Task state file was not found");
   const worktreeExecutionWorkspaceId = worktreeTaskFile.split("/").at(-2);
-  assertTaskBodyAbsentFromGateway(worktreeTaskBody);
+  assertTaskBodyAbsentFromGateway(gatewayStateDir, worktreeTaskBody);
 
   const worktreeWrite = callTool(gatewayMcpUrl, oauth.accessToken, sessionA, nextId(), "write", {
     workspaceId: worktreeRelayId,
@@ -298,6 +288,10 @@ try {
   assert.equal(inspectedWorktree.structuredContent.inspection.rootValid, false);
   assertSafeRelayInspection(inspectedWorktree, {
     executionWorkspaceId: worktreeExecutionWorkspaceId,
+    executionBaseUrl,
+    executionPort,
+    executionOwnerToken,
+    bootstrapSecret,
     remoteRecord,
     taskBodies: [worktreeTaskBody],
   });
@@ -364,7 +358,7 @@ try {
   const memberTaskFile = findTaskStateFile(executionStateDir, compositeMemberTaskBody);
   assert.ok(memberTaskFile, "Execution Composite-member Task state file was not found");
   const memberExecutionWorkspaceId = memberTaskFile.split("/").at(-2);
-  assertTaskBodyAbsentFromGateway(compositeMemberTaskBody);
+  assertTaskBodyAbsentFromGateway(gatewayStateDir, compositeMemberTaskBody);
 
   const compositeOpened = callTool(gatewayMcpUrl, oauth.accessToken, sessionA, nextId(), "open_workspace", {
     kind: "composite",
@@ -445,6 +439,10 @@ try {
   assertToolOk(memberInspection, "inspect relayed Composite member");
   assertSafeRelayInspection(memberInspection, {
     executionWorkspaceId: memberExecutionWorkspaceId,
+    executionBaseUrl,
+    executionPort,
+    executionOwnerToken,
+    bootstrapSecret,
     remoteRecord,
     taskBodies: [compositeMemberTaskBody],
   });
@@ -489,7 +487,7 @@ try {
   }, conversationB);
   assertToolOk(restoredMemberTasks, "restore relayed Composite member Tasks");
   assert.equal(restoredMemberTasks.structuredContent.result.lists[0].tasks[0].subject, "Remote Composite member Task");
-  assertTaskBodyAbsentFromGateway(compositeMemberTaskBody);
+  assertTaskBodyAbsentFromGateway(gatewayStateDir, compositeMemberTaskBody);
   pass("Composite local + Relay member", "member execution/lifecycle/Task truth stayed with owning Workspace");
 
   const deleteComposite = callTool(gatewayMcpUrl, oauth.accessToken, sessionA, nextId(), "close_workspace", {
@@ -616,7 +614,7 @@ function authorizeHost(baseUrl, mcpUrl, ownerToken) {
       redirect_uri: redirectUri,
       code_challenge: challenge,
       code_challenge_method: "S256",
-      scope: "devspace",
+      scope: "forgerelay",
       resource: mcpUrl,
       state: "forgerelay-relay-acceptance",
       owner_token: ownerToken,
@@ -800,90 +798,3 @@ async function stopServer(child) {
     }),
   ]);
 }
-
-async function assertPortsFree(ports) {
-  for (const port of ports) {
-    const occupied = await new Promise((resolvePromise) => {
-      const socket = connect({ host: "127.0.0.1", port });
-      socket.once("connect", () => {
-        socket.destroy();
-        resolvePromise(true);
-      });
-      socket.once("error", () => resolvePromise(false));
-    });
-    assert.equal(occupied, false, `reserved debug port ${port} is already in use; refusing to touch the existing process`);
-  }
-}
-
-function setupGitProject(root) {
-  mkdirSync(root, { recursive: true });
-  writeFileSync(join(root, "README.md"), "Relay managed worktree acceptance\n");
-  runGit(root, ["init"]);
-  runGit(root, ["config", "user.email", "forgerelay-debug@example.com"]);
-  runGit(root, ["config", "user.name", "ForgeRelay Debug"]);
-  runGit(root, ["add", "."]);
-  runGit(root, ["commit", "-m", "Initial Relay acceptance commit"]);
-}
-
-function runGit(cwd, args) {
-  const result = spawnSync("git", args, { cwd, encoding: "utf8" });
-  if (result.status !== 0) {
-    throw new Error(`git ${args.join(" ")} failed: ${result.stderr.trim() || result.stdout.trim()}`);
-  }
-}
-
-function taskStateFiles(stateDir) {
-  const workspacesDir = join(stateDir, "workspaces");
-  if (!existsSync(workspacesDir)) return [];
-  const files = [];
-  for (const entry of readdirSync(workspacesDir, { withFileTypes: true })) {
-    if (!entry.isDirectory()) continue;
-    const candidate = join(workspacesDir, entry.name, "tasks.json");
-    if (existsSync(candidate)) files.push(candidate);
-  }
-  return files;
-}
-
-function findTaskStateFile(stateDir, needle) {
-  return taskStateFiles(stateDir).find((path) => readFileSync(path, "utf8").includes(needle));
-}
-
-function assertTaskBodyAbsentFromGateway(body) {
-  const leaked = taskStateFiles(gatewayStateDir).filter((path) => readFileSync(path, "utf8").includes(body));
-  assert.deepEqual(leaked, [], `Gateway stored an Execution-owned Task body in: ${leaked.join(", ")}`);
-}
-
-function assertSafeRelayInspection(result, { executionWorkspaceId, remoteRecord, taskBodies }) {
-  const json = JSON.stringify(result);
-  for (const forbidden of [
-    executionWorkspaceId,
-    executionBaseUrl,
-    `127.0.0.1:${executionPort}`,
-    executionOwnerToken,
-    remoteRecord.accessToken,
-    remoteRecord.refreshToken,
-    bootstrapSecret,
-    "remoteInstanceId",
-    "remoteWorkspaceId",
-    "sshRoute",
-    ...taskBodies,
-  ]) {
-    assert.equal(json.includes(forbidden), false, `Relay inspection leaked ${forbidden}`);
-  }
-  assert.doesNotMatch(json, /"ws_[0-9a-f]{10}"/);
-}
-
-function assertToolOk(result, label) {
-  assert.equal(result.isError, undefined, `${label}: ${toolText(result)}`);
-}
-
-function toolText(result) {
-  return (result.content ?? [])
-    .filter((entry) => entry.type === "text")
-    .map((entry) => entry.text)
-    .join("\n");
-}
-
-function pass(label, detail) {
-  console.log(`PASS ${label}: ${detail}`);
-}

package/scripts/debug/traffic/support.mjs

@@ -0,0 +1,167 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { once } from "node:events";
+import { existsSync, readFileSync } from "node:fs";
+import { setTimeout as delay } from "node:timers/promises";
+import { repoRoot } from "../runtime.mjs";
+
+export function curlRequest({ method = "GET", url, headers = {}, body }) {
+  const marker = `__FORGERELAY_TRAFFIC_${randomUUID()}__`;
+  const args = [
+    "--silent",
+    "--show-error",
+    "--max-time",
+    "20",
+    "--request",
+    method,
+    "--dump-header",
+    "-",
+    "--output",
+    "-",
+    "--write-out",
+    `\n${marker}%{http_code}|%{size_upload}|%{size_download}|%{size_request}|%{size_header}`,
+  ];
+  for (const [name, value] of Object.entries(headers)) args.push("--header", `${name}: ${value}`);
+  if (body !== undefined) args.push("--data-binary", "@-");
+  args.push(url);
+
+  const result = spawnSync("curl", args, {
+    cwd: repoRoot,
+    input: body,
+    encoding: "utf8",
+    maxBuffer: 40 * 1024 * 1024,
+  });
+  if (result.status !== 0) {
+    throw new Error(`curl ${method} ${url} failed: ${result.stderr.trim() || `exit ${result.status}`}`);
+  }
+  const statusMarker = `\n${marker}`;
+  const markerIndex = result.stdout.lastIndexOf(statusMarker);
+  assert.notEqual(markerIndex, -1, `curl response did not contain status marker for ${url}`);
+  const rawResponse = result.stdout.slice(0, markerIndex);
+  const stats = result.stdout.slice(markerIndex + statusMarker.length).trim().split("|");
+  const [status, sizeUpload, sizeDownload, sizeRequest, sizeHeader] = stats.map(Number);
+  const separator = rawResponse.indexOf("\r\n\r\n") >= 0 ? "\r\n\r\n" : "\n\n";
+  const headerEnd = rawResponse.indexOf(separator);
+  assert.notEqual(headerEnd, -1, `curl response did not contain headers for ${url}`);
+  const headerBlock = rawResponse.slice(0, headerEnd);
+  const responseBody = rawResponse.slice(headerEnd + separator.length);
+  const responseHeaders = new Map();
+  for (const line of headerBlock.split(/\r?\n/).slice(1)) {
+    const colon = line.indexOf(":");
+    if (colon < 0) continue;
+    responseHeaders.set(line.slice(0, colon).trim().toLowerCase(), line.slice(colon + 1).trim());
+  }
+  return {
+    status,
+    headers: responseHeaders,
+    body: responseBody,
+    sizeUpload,
+    sizeDownload,
+    sizeRequest,
+    sizeHeader,
+  };
+}
+
+export function jsonLogEntries(path) {
+  if (!existsSync(path)) return [];
+  return readFileSync(path, "utf8")
+    .split(/\r?\n/)
+    .filter(Boolean)
+    .flatMap((line) => {
+      try {
+        return [JSON.parse(line)];
+      } catch {
+        return [];
+      }
+    });
+}
+
+export function requestLogEntries(path) {
+  return jsonLogEntries(path).filter((entry) => entry.event === "http_request");
+}
+
+export function requestBodiesForRpc(entries, rpcTarget) {
+  const requestIds = new Set(entries
+    .filter((entry) => entry.event === "mcp_request" && entry.rpcTarget === rpcTarget)
+    .map((entry) => entry.requestId)
+    .filter(Boolean));
+  return entries
+    .filter((entry) => entry.event === "http_request" && requestIds.has(entry.requestId))
+    .map((entry) => Number(entry.contentLength ?? 0))
+    .filter((value) => Number.isFinite(value));
+}
+
+export function countBy(values, keyFor) {
+  const result = {};
+  for (const value of values) {
+    const key = keyFor(value);
+    result[key] = (result[key] ?? 0) + 1;
+  }
+  return result;
+}
+
+export async function waitForHealth(child, baseUrl) {
+  for (let attempt = 0; attempt < 80; attempt += 1) {
+    if (child.exitCode !== null) throw new Error(`debug server exited before health check: ${child.exitCode}`);
+    try {
+      const response = jsonRequest(`${baseUrl}/healthz`);
+      if (response.status === 200) return;
+    } catch {
+      // still starting
+    }
+    await delay(100);
+  }
+  throw new Error(`debug server did not become healthy on ${baseUrl}`);
+}
+
+export async function stopServer(child) {
+  if (child.exitCode !== null) return;
+  child.kill("SIGTERM");
+  const exited = once(child, "exit");
+  await Promise.race([
+    exited,
+    delay(3000).then(() => {
+      if (child.exitCode === null) child.kill("SIGKILL");
+    }),
+  ]);
+}
+
+export async function assertPortsFree(ports) {
+  const script = [
+    "const net=require('node:net');",
+    `const ports=${JSON.stringify(ports)};`,
+    "let pending=ports.length; let bad=[];",
+    "for(const port of ports){const s=net.connect({host:'127.0.0.1',port}); s.setTimeout(250);",
+    "s.once('connect',()=>{bad.push(port);s.destroy();done();});",
+    "s.once('error',()=>{s.destroy();done();}); s.once('timeout',()=>{s.destroy();done();});}",
+    "function done(){if(--pending===0){if(bad.length){console.error('busy:'+bad.join(','));process.exit(2)}}}",
+  ].join("");
+  const result = spawnSync(process.execPath, ["-e", script], { encoding: "utf8" });
+  if (result.status !== 0) throw new Error(`reserved debug port already in use: ${result.stderr.trim()}`);
+}
+
+export function jsonBytes(value) {
+  if (value === undefined) return 0;
+  return Buffer.byteLength(JSON.stringify(value), "utf8");
+}
+
+export function formatBytes(value) {
+  const bytes = Number(value);
+  if (!Number.isFinite(bytes)) return String(value);
+  if (bytes < 1024) return `${bytes.toFixed(0)} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KiB`;
+  if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(2)} MiB`;
+  return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GiB`;
+}
+
+
+export function jsonRequest(url, options = {}) {
+  const response = curlRequest({
+    method: options.method ?? "GET",
+    url,
+    headers: options.headers,
+    body: options.body,
+  });
+  return { ...response, json: JSON.parse(response.body) };
+}