@animalabs/connectome-host 0.7.3 → 0.7.4

package/test/headless-panel-request.test.ts

@@ -0,0 +1,201 @@
+/**
+ * Integration test for the 'panel-request' IPC verb against a REAL headless
+ * child (full framework, no inference): the same runPanelOp dispatcher the
+ * WebUI host uses locally must answer over the socket, so every operator
+ * panel (mcpl / settings / pins / health / context debug) works for fleet
+ * children exactly as it does for the host.
+ *
+ * Also verifies panel-response bypasses subscription filtering — a narrowed
+ * event stream must never eat a request/response pair.
+ */
+import { describe, test, expect, beforeAll, afterAll } from 'bun:test';
+import { spawn, type ChildProcess } from 'node:child_process';
+import { mkdtempSync, writeFileSync, rmSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { connect as netConnect, type Socket } from 'node:net';
+import { join, resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const TEST_DIR = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = resolve(TEST_DIR, '..');
+const INDEX_PATH = join(REPO_ROOT, 'src', 'index.ts');
+
+const MINIMAL_RECIPE = {
+  name: 'Panel Test',
+  agent: {
+    name: 'commander',
+    systemPrompt: 'never asked to infer in this test',
+  },
+  modules: {
+    subagents: false,
+    lessons: false,
+    retrieval: false,
+    wake: false,
+    workspace: false,
+  },
+};
+
+function lineReader(socket: Socket): { events: Array<Record<string, unknown>>; stop: () => void } {
+  const events: Array<Record<string, unknown>> = [];
+  let buf = '';
+  const handler = (chunk: Buffer): void => {
+    buf += chunk.toString('utf-8');
+    let i: number;
+    while ((i = buf.indexOf('\n')) >= 0) {
+      const line = buf.slice(0, i).trim();
+      buf = buf.slice(i + 1);
+      if (!line) continue;
+      try { events.push(JSON.parse(line) as Record<string, unknown>); } catch { /* ignore malformed */ }
+    }
+  };
+  socket.on('data', handler);
+  return { events, stop: (): void => { socket.off('data', handler); } };
+}
+
+async function waitFor(check: () => boolean, timeoutMs: number, label: string): Promise<void> {
+  const start = Date.now();
+  while (Date.now() - start < timeoutMs) {
+    if (check()) return;
+    await new Promise((r) => setTimeout(r, 50));
+  }
+  throw new Error(`waitFor timed out after ${timeoutMs}ms: ${label}`);
+}
+
+async function connectSocket(path: string, timeoutMs = 3_000): Promise<Socket> {
+  return new Promise((resolveConn, rejectConn) => {
+    const s = netConnect(path);
+    const timer = setTimeout(() => {
+      s.destroy();
+      rejectConn(new Error(`socket connect timeout: ${path}`));
+    }, timeoutMs);
+    s.once('connect', () => { clearTimeout(timer); resolveConn(s); });
+    s.once('error', (err) => { clearTimeout(timer); rejectConn(err); });
+  });
+}
+
+describe('headless daemon — panel-request / panel-response', () => {
+  let tmpDir: string;
+  let socketPath: string;
+  let child: ChildProcess;
+  let sock: Socket;
+  let reader: { events: Array<Record<string, unknown>>; stop: () => void };
+  let corrSeq = 0;
+
+  /** Send one panel-request and await its panel-response. */
+  async function panel(op: string, params?: Record<string, unknown>): Promise<Record<string, unknown>> {
+    const corrId = `panel-test-${++corrSeq}`;
+    sock.write(JSON.stringify({ type: 'panel-request', op, ...(params ? { params } : {}), corrId }) + '\n');
+    await waitFor(
+      () => reader.events.some((e) => e.type === 'panel-response' && e.corrId === corrId),
+      10_000,
+      `panel-response for op=${op}`,
+    );
+    return reader.events.find((e) => e.type === 'panel-response' && e.corrId === corrId)!;
+  }
+
+  beforeAll(async () => {
+    tmpDir = mkdtempSync(join(tmpdir(), 'fkm-panelreq-'));
+    const recipePath = join(tmpDir, 'recipe.json');
+    socketPath = join(tmpDir, 'ipc.sock');
+    writeFileSync(recipePath, JSON.stringify(MINIMAL_RECIPE), 'utf-8');
+
+    child = spawn(
+      'bun',
+      [INDEX_PATH, recipePath, '--headless'],
+      {
+        cwd: tmpDir,
+        env: {
+          ...process.env,
+          ANTHROPIC_API_KEY: 'sk-test-panel',
+          DATA_DIR: tmpDir,
+        },
+        stdio: ['ignore', 'ignore', 'ignore'],
+      },
+    );
+
+    await waitFor(() => existsSync(socketPath), 15_000, 'socket file appears');
+    sock = await connectSocket(socketPath);
+    reader = lineReader(sock);
+    await waitFor(
+      () => reader.events.some((e) => e.type === 'lifecycle' && (e as { phase?: string }).phase === 'ready'),
+      5_000,
+      'lifecycle:ready',
+    );
+  });
+
+  afterAll(async () => {
+    try { sock.write(JSON.stringify({ type: 'shutdown' }) + '\n'); } catch { /* noop */ }
+    await new Promise((r) => setTimeout(r, 500));
+    try { reader.stop(); sock.destroy(); } catch { /* noop */ }
+    try { if (child.exitCode === null) child.kill('SIGKILL'); } catch { /* noop */ }
+    try { rmSync(tmpDir, { recursive: true, force: true }); } catch { /* noop */ }
+  });
+
+  test('op=health returns the healthz assembly', async () => {
+    const res = await panel('health');
+    expect(res.ok).toBe(true);
+    expect(res.op).toBe('health');
+    const data = res.data as Record<string, unknown>;
+    // Same shape /healthz serves: framework snapshot + the panel-data extras.
+    expect(data.agents ?? data.runtimeSettings ?? data.contextComposition).toBeDefined();
+  });
+
+  test('op=settings returns the primary agent runtime settings', async () => {
+    const res = await panel('settings');
+    expect(res.ok).toBe(true);
+    const data = res.data as { agent: string; settings: Record<string, unknown>; hotKeys: string[] };
+    expect(data.agent).toBe('commander');
+    expect(typeof data.settings).toBe('object');
+    expect(Array.isArray(data.hotKeys)).toBe(true);
+  });
+
+  test('op=mcpl returns registry + live server view', async () => {
+    const res = await panel('mcpl');
+    expect(res.ok).toBe(true);
+    const data = res.data as { configPath: string; servers: unknown[]; live: unknown[] };
+    expect(typeof data.configPath).toBe('string');
+    expect(Array.isArray(data.servers)).toBe(true);
+    expect(Array.isArray(data.live)).toBe(true);
+    expect(data.live.length).toBe(0); // minimal recipe opts into no MCPLs
+  });
+
+  test('op=pins returns a snapshot with candidates when asked', async () => {
+    const res = await panel('pins', { withCandidates: true });
+    expect(res.ok).toBe(true);
+    const data = res.data as { agent: string; pins: unknown[]; pinsSupported: boolean; candidates?: unknown[] };
+    expect(data.agent).toBe('commander');
+    expect(Array.isArray(data.pins)).toBe(true);
+    expect(typeof data.pinsSupported).toBe('boolean');
+    expect(Array.isArray(data.candidates)).toBe(true);
+  });
+
+  test('op=context-coverage names the agent and its branch', async () => {
+    const res = await panel('context-coverage');
+    expect(res.ok).toBe(true);
+    const data = res.data as { agent: string; branch: string; totals: Record<string, number> };
+    expect(data.agent).toBe('commander');
+    expect(typeof data.branch).toBe('string');
+    expect(typeof data.totals.chunks).toBe('number');
+  });
+
+  test('unknown agent comes back ok:false with 404', async () => {
+    const res = await panel('context-coverage', { agent: 'nonexistent' });
+    expect(res.ok).toBe(false);
+    expect(res.status).toBe(404);
+    expect(res.error).toContain('nonexistent');
+  });
+
+  test('unknown op comes back ok:false with 400', async () => {
+    const res = await panel('no-such-op');
+    expect(res.ok).toBe(false);
+    expect(res.status).toBe(400);
+    expect(res.error).toContain('unknown panel op');
+  });
+
+  test('panel-response bypasses subscription filter', async () => {
+    sock.write(JSON.stringify({ type: 'subscribe', events: ['command-output'] }) + '\n');
+    await new Promise((r) => setTimeout(r, 100));
+    const res = await panel('health');
+    expect(res.ok).toBe(true);
+  });
+});

package/test/mcpl-admin-module.test.ts

@@ -15,8 +15,14 @@ import { readAgentOverlay, saveAgentOverlay } from '../src/mcpl-config.js';
 interface StubServer {
   id: string;
   connected: boolean;
+  retrying: boolean;
   toolPrefix: string;
   toolCount: number;
+  policyEstablished: boolean;
+  effectiveGrant: string[];
+  maskedCapabilities: string[];
+  deniedCapabilities: string[];
+  allowHostCommands: boolean;
   command?: string;
   url?: string;
 }
@@ -32,8 +38,14 @@ function makeStubFramework() {
       servers.set(config.id, {
         id: config.id,
         connected: true,
+        retrying: false,
         toolPrefix: config.toolPrefix ?? `mcpl--${config.id}`,
         toolCount: 1,
+        policyEstablished: true,
+        effectiveGrant: ['channels.incoming'],
+        maskedCapabilities: ['channels.streaming'],
+        deniedCapabilities: ['contextHooks.beforeInference.inject.system'],
+        allowHostCommands: false,
         command: config.command,
         url: config.url,
       });
@@ -49,8 +61,14 @@ function makeStubFramework() {
       servers.set(id, {
         id,
         connected: true,
+        retrying: false,
         toolPrefix: `mcpl--${id}`,
         toolCount: 1,
+        policyEstablished: true,
+        effectiveGrant: ['channels.incoming'],
+        maskedCapabilities: ['channels.streaming'],
+        deniedCapabilities: ['contextHooks.beforeInference.inject.system'],
+        allowHostCommands: false,
         command: config?.command ?? prev?.command,
       });
     },
@@ -207,6 +225,11 @@ describe('mcpl_list', () => {
     const text = String(result.data);
     expect(text).toContain('discord: CONNECTED');
     expect(text).toContain('mytool: CONNECTED');
+    expect(text).toContain('policy=established');
+    expect(text).toContain('grant=[channels.incoming]');
+    expect(text).toContain('masked=[channels.streaming]');
+    expect(text).toContain('denied=[contextHooks.beforeInference.inject.system]');
+    expect(text).toContain('hostCommands=deny');
     expect(text).toContain('source=agent-overlay');
     expect(text).toContain('gone: UNLOADED');
   });

package/test/mock-headless-child.ts

@@ -83,6 +83,20 @@ function simulateFinalInference(text: string, emitIdleAfter: boolean): void {
 function dispatch(msg: Record<string, unknown>): void {
   const t = typeof msg.type === 'string' ? msg.type : '';
   if (t === 'subscribe') return;  // accept silently
+  if (t === 'panel-request') {
+    // Panel-op verbs for FleetModule.requestPanel tests:
+    //   op 'hang' → never answers (timeout path)
+    //   op 'fail' → ok:false with a status (error passthrough path)
+    //   anything else → ok:true echoing the params back
+    const op = typeof msg.op === 'string' ? msg.op : '';
+    if (op === 'hang') return;
+    if (op === 'fail') {
+      emit({ type: 'panel-response', corrId: msg.corrId, op, ok: false, error: 'mock failure', status: 418 });
+      return;
+    }
+    emit({ type: 'panel-response', corrId: msg.corrId, op, ok: true, data: { op, echo: msg.params ?? null } });
+    return;
+  }
   if (t === 'shutdown') {
     emit({ type: 'lifecycle', phase: 'exiting', reason: 'shutdown' });
     setTimeout(() => process.exit(0), 50);

package/test/retrieval-auth-loopback.test.ts

@@ -0,0 +1,49 @@
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import type { ModuleContext } from '@animalabs/agent-framework';
+import {
+  WebUiModule,
+  __getSharedServerPortForTests,
+  __resetSharedServerForTests,
+} from '../src/modules/web-ui-module.js';
+
+describe('retrieval operator authentication on credential-free loopback', () => {
+  let webUiModule: WebUiModule | undefined;
+  let root: string;
+  let baseUrl: string;
+
+  beforeAll(async () => {
+    root = mkdtempSync(join(tmpdir(), 'retrieval-auth-loopback-'));
+    const staticRoot = join(root, 'web');
+    mkdirSync(staticRoot);
+    writeFileSync(join(staticRoot, 'index.html'), '<!doctype html><title>loopback</title>');
+    webUiModule = new WebUiModule({
+      port: 0,
+      host: '127.0.0.1',
+      staticDir: staticRoot,
+    });
+    await webUiModule.start({} as ModuleContext);
+    const port = __getSharedServerPortForTests();
+    if (!port) throw new Error('webui server not bound; did start() succeed?');
+    baseUrl = `http://127.0.0.1:${port}`;
+  });
+
+  afterAll(async () => {
+    await webUiModule?.stop();
+    await __resetSharedServerForTests();
+    if (root) rmSync(root, { recursive: true, force: true });
+  });
+
+  test('denies both retrieval routes without changing ordinary loopback routes', async () => {
+    expect((await fetch(`${baseUrl}/`)).status).toBe(200);
+    expect((await fetch(`${baseUrl}/debug/context`)).status).toBe(503);
+
+    for (const path of ['/debug/retrieval', '/debug/retrieval/view']) {
+      const response = await fetch(`${baseUrl}${path}`);
+      expect(response.status).toBe(401);
+      expect(response.headers.get('cache-control')).toBe('no-store');
+    }
+  });
+});

package/test/retrieval-config.test.ts

@@ -0,0 +1,74 @@
+import { describe, expect, test } from 'bun:test';
+import type { Membrane } from '@animalabs/membrane';
+import { validateRecipe } from '../src/recipe.js';
+import { buildRetrievalModuleConfig } from '../src/retrieval-config.js';
+
+const membrane = {} as Membrane;
+
+function recipe(retrieval: unknown, provider: string = 'openai-codex') {
+  return {
+    name: 'retrieval-config-test',
+    agent: { systemPrompt: 'sys', provider },
+    modules: { retrieval },
+  };
+}
+
+describe('retrieval recipe config', () => {
+  test('accepts and maps provider reasoning settings', () => {
+    const parsed = validateRecipe(recipe({
+      model: 'test-model',
+      maxInjected: 7,
+      reasoningEffort: 'minimal',
+    }));
+
+    expect(parsed.modules?.retrieval).toEqual({
+      model: 'test-model',
+      maxInjected: 7,
+      reasoningEffort: 'minimal',
+    });
+    expect(buildRetrievalModuleConfig(membrane, parsed.modules!.retrieval!, 'openai-codex')).toEqual({
+      membrane,
+      retrievalModel: 'test-model',
+      maxInjectedLessons: 7,
+      retrievalReasoning: { effort: 'minimal' },
+    });
+  });
+
+  test('preserves boolean shorthand and omits unconfigured reasoning', () => {
+    expect(validateRecipe(recipe(true)).modules?.retrieval).toBe(true);
+    expect(validateRecipe(recipe(false)).modules?.retrieval).toBe(false);
+    expect(buildRetrievalModuleConfig(membrane, { model: 'test-model' }, 'anthropic')).toEqual({
+      membrane,
+      retrievalModel: 'test-model',
+    });
+  });
+
+  test('rejects malformed retrieval reasoning settings', () => {
+    expect(() => validateRecipe(recipe(null))).toThrow(/modules\.retrieval must be a boolean or object/);
+    expect(() => validateRecipe(recipe([]))).toThrow(/modules\.retrieval must be a boolean or object/);
+    expect(() => validateRecipe(recipe({ reasoningEffort: 'ultra' }))).toThrow(/reasoningEffort/);
+    expect(() => validateRecipe(recipe({ reasoningEffort: ['high'] }))).toThrow(/reasoningEffort/);
+    expect(() => validateRecipe(recipe({ reasoningContext: 'current_turn' }))).toThrow(
+      /independent one-shot requests/,
+    );
+    expect(() => validateRecipe(recipe({ reasoningEffort: 'high' }, 'anthropic'))).toThrow(
+      /requires agent\.provider/,
+    );
+    expect(() => buildRetrievalModuleConfig(
+      membrane,
+      { reasoningEffort: 'high' },
+      'anthropic',
+    )).toThrow(/requires agent\.provider/);
+    expect(() => validateRecipe(recipe({ reasoningEffort: 'high' }))).toThrow(
+      /model must be a non-empty string/,
+    );
+    expect(() => validateRecipe(recipe({ model: '  ', reasoningEffort: 'high' }))).toThrow(
+      /model must be a non-empty string/,
+    );
+    expect(() => buildRetrievalModuleConfig(
+      membrane,
+      { reasoningEffort: 'high' },
+      'openai-codex',
+    )).toThrow(/model must be a non-empty string/);
+  });
+});