@app-vitals/agent-runtime 0.0.1 → 0.1.0

package/anthropic-federation-guard.unit.test.ts

@@ -0,0 +1,127 @@
+/**
+ * agent/src/runtime/anthropic-federation-guard.unit.test.ts
+ *
+ * Unit tests for the WIF-2.1 defense-in-depth filter: with
+ * ANTHROPIC_FEDERATION_RULE_ID in the pod env, the three Anthropic credential
+ * keys never reach process.env, whether via startup applyEnv or syncConfig.
+ */
+
+import { describe, expect, it } from "bun:test";
+import {
+  ANTHROPIC_CREDENTIAL_KEYS,
+  applyEnvToProcess,
+  filterAnthropicCredentials,
+} from "./anthropic-federation-guard.ts";
+
+const CREDS = {
+  CLAUDE_CODE_OAUTH_TOKEN: "oat-secret",
+  ANTHROPIC_API_KEY: "api-secret",
+  ANTHROPIC_AUTH_TOKEN: "auth-secret",
+};
+
+function setup(federated: boolean, initial: Record<string, string> = {}) {
+  const processEnv: Record<string, string | undefined> = {
+    ...(federated ? { ANTHROPIC_FEDERATION_RULE_ID: "rule-1" } : {}),
+    ...initial,
+  };
+  const logged = new Set<string>();
+  const logs: string[] = [];
+  const log = (m: string) => logs.push(m);
+  return { processEnv, logged, logs, log };
+}
+
+describe("filterAnthropicCredentials", () => {
+  it("lists exactly the three blocked keys", () => {
+    expect([...ANTHROPIC_CREDENTIAL_KEYS].sort()).toEqual([
+      "ANTHROPIC_API_KEY",
+      "ANTHROPIC_AUTH_TOKEN",
+      "CLAUDE_CODE_OAUTH_TOKEN",
+    ]);
+  });
+
+  it("returns env unchanged when federation is not configured", () => {
+    const s = setup(false);
+    const env = { FOO: "bar", ...CREDS };
+    expect(filterAnthropicCredentials(env, s)).toEqual(env);
+    expect(s.logs).toEqual([]);
+  });
+
+  it("drops the three keys and keeps the rest when federated", () => {
+    const s = setup(true);
+    expect(filterAnthropicCredentials({ FOO: "bar", ...CREDS }, s)).toEqual({
+      FOO: "bar",
+    });
+  });
+
+  it("also drops empty-string values (they still outrank federation)", () => {
+    const s = setup(true);
+    expect(
+      filterAnthropicCredentials({ ANTHROPIC_API_KEY: "", FOO: "x" }, s),
+    ).toEqual({ FOO: "x" });
+  });
+
+  it("logs once per key, names only, never values", () => {
+    const s = setup(true);
+    filterAnthropicCredentials({ ...CREDS }, s);
+    filterAnthropicCredentials({ ...CREDS }, s);
+    expect(s.logs).toHaveLength(3);
+    const all = s.logs.join("\n");
+    for (const k of ANTHROPIC_CREDENTIAL_KEYS) expect(all).toContain(k);
+    for (const v of Object.values(CREDS)) expect(all).not.toContain(v);
+  });
+
+  it("deletes the keys from process.env when federated", () => {
+    const s = setup(true, { ...CREDS, FOO: "keep" });
+    filterAnthropicCredentials({}, s);
+    expect(s.processEnv.CLAUDE_CODE_OAUTH_TOKEN).toBeUndefined();
+    expect(s.processEnv.ANTHROPIC_API_KEY).toBeUndefined();
+    expect(s.processEnv.ANTHROPIC_AUTH_TOKEN).toBeUndefined();
+    expect(s.processEnv.FOO).toBe("keep");
+  });
+
+  it("leaves process.env alone when federation is not configured", () => {
+    const s = setup(false, { ANTHROPIC_API_KEY: "mine" });
+    filterAnthropicCredentials({}, s);
+    expect(s.processEnv.ANTHROPIC_API_KEY).toBe("mine");
+  });
+});
+
+describe("applyEnvToProcess", () => {
+  it("applies all keys when not federated", () => {
+    const s = setup(false);
+    applyEnvToProcess({ FOO: "bar", ...CREDS }, s);
+    expect(s.processEnv).toMatchObject({ FOO: "bar", ...CREDS });
+  });
+
+  it("startup: never leaves the three keys in process.env when federated", () => {
+    const s = setup(true, { ANTHROPIC_API_KEY: "from-pod" });
+    applyEnvToProcess({ FOO: "bar", ...CREDS }, s);
+    expect(s.processEnv.FOO).toBe("bar");
+    for (const k of ANTHROPIC_CREDENTIAL_KEYS) {
+      expect(s.processEnv[k]).toBeUndefined();
+    }
+  });
+
+  it("config sync: a later bundle containing the keys is filtered too", () => {
+    const s = setup(true);
+    applyEnvToProcess({ FOO: "1" }, s);
+    applyEnvToProcess({ FOO: "2", ANTHROPIC_AUTH_TOKEN: "late" }, s);
+    expect(s.processEnv.FOO).toBe("2");
+    expect(s.processEnv.ANTHROPIC_AUTH_TOKEN).toBeUndefined();
+  });
+
+  it("config sync: reports changed keys, never a blocked credential key", () => {
+    const s = setup(true, { FOO: "same" });
+    const changed = applyEnvToProcess({ FOO: "same", BAR: "new", ...CREDS }, s);
+    expect(changed).toEqual(["BAR"]);
+  });
+
+  it("config sync: reports changed credential keys when not federated", () => {
+    const s = setup(false, { ANTHROPIC_API_KEY: "api-secret" });
+    const changed = applyEnvToProcess({ ...CREDS }, s);
+    expect(changed).toEqual([
+      "CLAUDE_CODE_OAUTH_TOKEN",
+      "ANTHROPIC_AUTH_TOKEN",
+    ]);
+  });
+});

package/base-image-contract.smoke.test.ts

@@ -0,0 +1,149 @@
+/**
+ * Base-image contract guard (ARD-2.1).
+ *
+ * Downstream images build FROM the shipwright-agent image and
+ * COPY a marketplace to the /opt/shipwright/marketplaces/ convention root. This
+ * test builds such a derived image the same way and asserts the contract:
+ *   - a marketplace at the convention root registers at boot via installPlugins()
+ *   - /app/runtime/entrypoint-main.ts exists and runs under `bun run`
+ *   - /app/scripts/bin/gh, git and the git-credential helper are executable, ahead of the real ones on PATH
+ *
+ * Needs a Docker daemon and an already-built base image, so it is image-level
+ * smoke and opt-in: set SHIPWRIGHT_CONTRACT_BASE_IMAGE (CI sets it to the image
+ * built by the `agent docker build` job). Skipped otherwise.
+ */
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const BASE_IMAGE = process.env.SHIPWRIGHT_CONTRACT_BASE_IMAGE;
+const CONVENTION_ROOT = "/opt/shipwright/marketplaces";
+const MARKETPLACE_NAME = "contract-test";
+const DERIVED_TAG = `shipwright-agent-contract:${process.pid}`;
+
+function docker(args: string[]) {
+  const proc = Bun.spawnSync(["docker", ...args], {
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  return {
+    exitCode: proc.exitCode,
+    stdout: proc.stdout.toString(),
+    stderr: proc.stderr.toString(),
+  };
+}
+
+describe.skipIf(!BASE_IMAGE)("agent base-image contract", () => {
+  let contextDir: string;
+
+  beforeAll(() => {
+    contextDir = mkdtempSync(join(tmpdir(), "base-image-contract-"));
+    const marketplaceDir = join(contextDir, "marketplace", ".claude-plugin");
+    mkdirSync(marketplaceDir, { recursive: true });
+    writeFileSync(
+      join(marketplaceDir, "marketplace.json"),
+      JSON.stringify({
+        name: MARKETPLACE_NAME,
+        owner: { name: "contract-test" },
+        plugins: [],
+      }),
+    );
+    writeFileSync(
+      join(contextDir, "Dockerfile"),
+      [
+        `FROM ${BASE_IMAGE}`,
+        "USER root",
+        `COPY marketplace ${CONVENTION_ROOT}/${MARKETPLACE_NAME}/`,
+        "USER 1000",
+        "",
+      ].join("\n"),
+    );
+    const build = docker(["build", "-t", DERIVED_TAG, contextDir]);
+    expect(build.exitCode, build.stderr).toBe(0);
+  }, 300_000);
+
+  afterAll(() => {
+    docker(["rmi", "-f", DERIVED_TAG]);
+    if (contextDir) rmSync(contextDir, { recursive: true, force: true });
+  });
+
+  test("installPlugins() registers a marketplace baked at the convention root", () => {
+    // Recording exec: asserts what installPlugins() asks `claude` to do without
+    // needing network access or a logged-in CLI inside the container.
+    const script = `
+      import { installPlugins } from "/app/runtime/setup.ts";
+      const calls = [];
+      const exec = async (cmd, args) => {
+        calls.push([cmd, ...args]);
+        return { stdout: "", exitCode: 0 };
+      };
+      await installPlugins(exec, "/tmp", [], undefined, "/nonexistent/installed_plugins.json");
+      console.log("CALLS:" + JSON.stringify(calls));
+    `;
+    const run = docker([
+      "run",
+      "--rm",
+      "--entrypoint",
+      "bun",
+      DERIVED_TAG,
+      "-e",
+      script,
+    ]);
+    expect(run.exitCode, run.stderr).toBe(0);
+
+    const line = run.stdout.split("\n").find((l) => l.startsWith("CALLS:"));
+    expect(line, run.stdout).toBeDefined();
+    const calls: string[][] = JSON.parse(
+      (line as string).slice("CALLS:".length),
+    );
+    const adds = calls
+      .filter(
+        (c) => c.slice(0, 4).join(" ") === "claude plugin marketplace add",
+      )
+      .map((c) => c[4]);
+
+    expect(adds).toContain(`${CONVENTION_ROOT}/${MARKETPLACE_NAME}`);
+  }, 60_000);
+
+  test("entrypoint-main.ts exists and runs under `bun run`", () => {
+    // No agent id/url/key: runEntrypoint() reports the missing vars and exits 1.
+    // A missing file or broken import graph fails differently ("Module not
+    // found"), so the message proves the entrypoint actually executed.
+    const run = docker([
+      "run",
+      "--rm",
+      "--entrypoint",
+      "bun",
+      "-e",
+      "SHIPWRIGHT_AGENT_ID=",
+      "-e",
+      "SHIPWRIGHT_API_URL=",
+      "-e",
+      "SHIPWRIGHT_AGENT_API_KEY=",
+      DERIVED_TAG,
+      "run",
+      "/app/runtime/entrypoint-main.ts",
+    ]);
+    expect(run.exitCode).toBe(1);
+    expect(run.stdout + run.stderr).toContain("SHIPWRIGHT_AGENT_ID");
+  }, 60_000);
+
+  test("scripts/bin holds executable gh, git and git-credential wrappers ahead of the real gh and git on PATH", () => {
+    const run = docker([
+      "run",
+      "--rm",
+      "--entrypoint",
+      "bash",
+      DERIVED_TAG,
+      "-c",
+      "test -x /app/scripts/bin/gh && test -x /app/scripts/bin/git && test -x /app/scripts/bin/git-credential-shipwright.sh && command -v gh git",
+    ]);
+    expect(run.exitCode, run.stderr).toBe(0);
+    expect(run.stdout.trim().split("\n")).toEqual([
+      "/app/scripts/bin/gh",
+      "/app/scripts/bin/git",
+    ]);
+  }, 60_000);
+});