@desplega.ai/agent-swarm 2.7.5 → 2.7.7

package/src/tests/migration-260-runtime-pool-cache.test.ts

@@ -0,0 +1,118 @@
+import { Database } from "bun:sqlite";
+import { expect, test } from "bun:test";
+import { runMigrations } from "../be/migrations/runner";
+import {
+  ControllerClientMessageSchema,
+  ControllerCommandSchema,
+} from "../runtime-providers/controller-protocol";
+
+test("migration 260 adds an optional JSON cache and the release table to a fresh database", () => {
+  const db = new Database(":memory:");
+  try {
+    runMigrations(db);
+    expect(db.query("PRAGMA table_info(runtime_pools)").all()).toContainEqual(
+      expect.objectContaining({ name: "cache", type: "TEXT", notnull: 0 }),
+    );
+    expect(db.query("PRAGMA foreign_key_check").all()).toEqual([]);
+    for (const name of ["runtime_ids", "state", "created_by", "updated_by"])
+      expect(db.query("PRAGMA table_info(runtime_cache_releases)").all()).toContainEqual(
+        expect.objectContaining({ name, type: "TEXT" }),
+      );
+  } finally {
+    db.close();
+  }
+});
+
+test("migration 260 preserves existing pools with caching disabled", async () => {
+  const db = new Database(":memory:");
+  try {
+    db.exec(
+      "CREATE TABLE _migrations (version INTEGER PRIMARY KEY, name TEXT NOT NULL, applied_at TEXT NOT NULL, checksum TEXT NOT NULL)",
+    );
+    for (const file of [...new Bun.Glob("*.sql").scanSync("src/be/migrations")]
+      .sort()
+      .filter((file) => Number(file.split("_")[0]) <= 259)) {
+      const sql = await Bun.file(`src/be/migrations/${file}`).text();
+      db.transaction(() => {
+        db.exec(sql);
+        db.run("INSERT INTO _migrations VALUES (?, ?, ?, ?)", [
+          Number(file.split("_")[0]),
+          file.replace(".sql", ""),
+          new Date().toISOString(),
+          new Bun.CryptoHasher("sha256").update(sql).digest("hex"),
+        ]);
+      }).immediate();
+    }
+    db.run(
+      "INSERT INTO runtime_pools (id, name, kind, placements, image, resources, env, lifecycle) VALUES (?, ?, ?, ?, ?, ?, ?, 'idle')",
+      [
+        "existing-pool",
+        "existing",
+        "docker",
+        '["controller"]',
+        "worker:test",
+        '{"cpu":2}',
+        '{"CUSTOM":"kept"}',
+      ],
+    );
+    runMigrations(db);
+    expect(db.query("SELECT name, image, resources, env, cache FROM runtime_pools").get()).toEqual({
+      name: "existing",
+      image: "worker:test",
+      resources: '{"cpu":2}',
+      env: '{"CUSTOM":"kept"}',
+      cache: null,
+    });
+    expect(() => db.run("UPDATE runtime_pools SET cache = 'invalid json'")).toThrow();
+    expect(db.query("SELECT COUNT(*) AS n FROM runtime_cache_releases").get()).toEqual({ n: 0 });
+  } finally {
+    db.close();
+  }
+});
+
+test("cache release runtime IDs accept arrays and reject other JSON values", () => {
+  const db = new Database(":memory:");
+  try {
+    runMigrations(db);
+    db.run(
+      "INSERT INTO runtime_controllers (id, name, kind, placement) VALUES ('controller', 'controller', 'docker', 'builtin')",
+    );
+    db.run(`INSERT INTO runtime_cache_releases (id, pool_id, controller_id, owner_id, cache_key, runtime_ids)
+      VALUES ('release', 'pool', 'controller', 'owner', 'cache', '[]')`);
+    for (const invalid of ["null", "{}", "42", "true", '"runtime"', "invalid json"])
+      expect(() =>
+        db.run("UPDATE runtime_cache_releases SET runtime_ids = ?", [invalid]),
+      ).toThrow();
+    db.run("UPDATE runtime_cache_releases SET runtime_ids = ?", ['["runtime-a","runtime-b"]']);
+    expect(db.query("SELECT runtime_ids FROM runtime_cache_releases").get()).toEqual({
+      runtime_ids: '["runtime-a","runtime-b"]',
+    });
+  } finally {
+    db.close();
+  }
+});
+
+test("controller protocol accepts legacy hello messages and retains optional cache metadata", () => {
+  const legacy = ControllerClientMessageSchema.parse({
+    type: "hello",
+    controllerId: "controller",
+    kind: "docker",
+    version: 1,
+    traits: { canProvision: true, ephemeralDisk: true, supportsPause: false },
+  });
+  if (legacy.type !== "hello") throw new Error("Expected hello");
+  expect(legacy.traits.persistentCache).toBeUndefined();
+  const payload = {
+    runtimeId: "runtime",
+    agentId: "agent",
+    poolId: "pool",
+    ownerId: "owner",
+    image: "worker:test",
+    env: {},
+    labels: {},
+    cache: { key: "swarm-cache-pool", mountPath: "/cache" },
+  };
+  expect(
+    ControllerCommandSchema.parse({ type: "cmd", id: "command", op: "provision", payload }),
+  ).toMatchObject({ payload: { cache: payload.cache } });
+});

package/src/tests/page-proxy.test.ts

@@ -252,7 +252,7 @@ describe("/api/pages/:id/launch", () => {
     expect(cookie!).toContain("HttpOnly");
     expect(cookie!).toContain("Path=/");
     expect(cookie!).toContain("Max-Age=3600");
-    // In dev (NODE_ENV != production) the cookie should be SameSite=Lax sans Secure.
+    // Under bun test (NODE_ENV=test) from http://localhost the cookie should be SameSite=Lax sans Secure.
     expect(cookie!).toContain("SameSite=Lax");
     expect(cookie!).not.toMatch(/\bSecure\b/);
     const cookieValue = /page_session_[A-Za-z0-9_-]+=([^;]+)/.exec(cookie!)?.[1];

package/src/tests/page-session-dev-cookie.test.ts

@@ -0,0 +1,188 @@
+/**
+ * The page-session cookie may only drop `Secure` (SameSite=Lax) for an explicit
+ * development or test NODE_ENV and a request from http://localhost or
+ * http://127.0.0.1. Deployed images leave NODE_ENV unset, so unset must issue
+ * `SameSite=None; Secure`, and the localhost check must parse the origin
+ * instead of matching a string prefix.
+ *
+ * Covers both issuers: the launch endpoint (`src/http/pages.ts`) and the
+ * password flow on `/p/:id` (`src/http/pages-public.ts`).
+ */
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import crypto from "node:crypto";
+import { unlink } from "node:fs/promises";
+import {
+  createServer as createHttpServer,
+  type IncomingMessage,
+  type Server,
+  type ServerResponse,
+} from "node:http";
+import { closeDb, initDb } from "../be/db";
+import { handlePages } from "../http/pages";
+import { handlePagesPublic } from "../http/pages-public";
+import { getPathSegments, parseQueryParams } from "../http/utils";
+import { isLocalDevPageRequest } from "../utils/page-session";
+import { listenOnFreePort } from "./test-net";
+
+const TEST_DB_PATH = "./test-page-session-dev-cookie.sqlite";
+const PASSWORD = "example-swordfish";
+const ORIGINAL_NODE_ENV = process.env.NODE_ENV;
+
+function setNodeEnv(value: string | undefined): void {
+  if (value === undefined) delete process.env.NODE_ENV;
+  else process.env.NODE_ENV = value;
+}
+
+function createTestServer(): Server {
+  return createHttpServer(async (req: IncomingMessage, res: ServerResponse) => {
+    const pathSegments = getPathSegments(req.url || "");
+    const queryParams = parseQueryParams(req.url || "");
+    const myAgentId = req.headers["x-agent-id"] as string | undefined;
+    if (await handlePagesPublic(req, res, pathSegments, queryParams)) return;
+    if (await handlePages(req, res, pathSegments, queryParams, myAgentId)) return;
+    res.writeHead(404);
+    res.end("not found");
+  });
+}
+
+type Case = { name: string; nodeEnv: string | undefined; origin?: string; secure: boolean };
+
+const CASES: Case[] = [
+  { name: "NODE_ENV unset, no Origin", nodeEnv: undefined, secure: true },
+  {
+    name: "NODE_ENV unset, spoofed localhost prefix",
+    nodeEnv: undefined,
+    origin: "http://localhost.evil.example",
+    secure: true,
+  },
+  {
+    name: "NODE_ENV unset, real localhost origin",
+    nodeEnv: undefined,
+    origin: "http://localhost:5274",
+    secure: true,
+  },
+  {
+    name: "NODE_ENV=development, spoofed localhost prefix",
+    nodeEnv: "development",
+    origin: "http://localhost.evil.example",
+    secure: true,
+  },
+  {
+    name: "NODE_ENV=development, portless https origin",
+    nodeEnv: "development",
+    origin: "https://ui.swarm.localhost",
+    secure: true,
+  },
+  {
+    name: "NODE_ENV=development, localhost UI origin",
+    nodeEnv: "development",
+    origin: "http://localhost:5274",
+    secure: false,
+  },
+  {
+    name: "NODE_ENV=development, 127.0.0.1 UI origin",
+    nodeEnv: "development",
+    origin: "http://127.0.0.1:5274",
+    secure: false,
+  },
+];
+
+function expectCookieShape(cookie: string | null, secure: boolean): void {
+  expect(cookie).toContain("page_session_");
+  if (secure) {
+    expect(cookie!).toContain("SameSite=None");
+    expect(cookie!).toMatch(/\bSecure\b/);
+  } else {
+    expect(cookie!).toContain("SameSite=Lax");
+    expect(cookie!).not.toMatch(/\bSecure\b/);
+  }
+}
+
+describe("page-session cookie dev softening fails closed", () => {
+  let server: Server;
+  let base = "";
+  let authedId = "";
+  let passwordId = "";
+  const agentId = crypto.randomUUID();
+
+  async function createPage(body: Record<string, unknown>): Promise<string> {
+    const post = await fetch(`${base}/api/pages`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-Agent-ID": agentId },
+      body: JSON.stringify({ contentType: "text/html", body: "<h1>x</h1>", ...body }),
+    });
+    expect(post.status).toBe(201);
+    return ((await post.json()) as { id: string }).id;
+  }
+
+  beforeAll(async () => {
+    process.env.PAGE_SESSION_SECRET = "example-test-page-session-dev-cookie-secret";
+    for (const suffix of ["", "-wal", "-shm"]) {
+      try {
+        await unlink(`${TEST_DB_PATH}${suffix}`);
+      } catch {}
+    }
+    initDb(TEST_DB_PATH);
+    server = createTestServer();
+    const port = await listenOnFreePort(server);
+    base = `http://localhost:${port}`;
+    authedId = await createPage({ slug: "dev-cookie-authed", title: "A", authMode: "authed" });
+    passwordId = await createPage({
+      slug: "dev-cookie-password",
+      title: "P",
+      authMode: "password",
+      password: PASSWORD,
+    });
+  });
+
+  afterEach(() => setNodeEnv(ORIGINAL_NODE_ENV));
+
+  afterAll(async () => {
+    setNodeEnv(ORIGINAL_NODE_ENV);
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+    closeDb();
+    for (const suffix of ["", "-wal", "-shm"]) {
+      try {
+        await unlink(`${TEST_DB_PATH}${suffix}`);
+      } catch {}
+    }
+  });
+
+  test.each(CASES)("launch endpoint: $name", async ({ nodeEnv, origin, secure }) => {
+    setNodeEnv(nodeEnv);
+    const res = await fetch(`${base}/api/pages/${authedId}/launch`, {
+      method: "POST",
+      headers: { "X-Agent-ID": agentId, ...(origin ? { Origin: origin } : {}) },
+    });
+    expect(res.status).toBe(204);
+    expectCookieShape(res.headers.get("set-cookie"), secure);
+  });
+
+  test.each(CASES)("/p/:id password flow: $name", async ({ nodeEnv, origin, secure }) => {
+    setNodeEnv(nodeEnv);
+    const res = await fetch(`${base}/p/${passwordId}?key=${PASSWORD}`, {
+      redirect: "manual",
+      headers: origin ? { Origin: origin } : {},
+    });
+    expect(res.status).toBeLessThan(400);
+    expectCookieShape(res.headers.get("set-cookie"), secure);
+  });
+});
+
+describe("isLocalDevPageRequest Host fallback", () => {
+  afterEach(() => setNodeEnv(ORIGINAL_NODE_ENV));
+
+  test.each([
+    [undefined, "localhost:3013", false],
+    ["production", "localhost:3013", false],
+    ["development", "localhost:3013", true],
+    ["development", "127.0.0.1:3013", true],
+    ["development", undefined, true],
+    ["development", "localhost.evil.example", false],
+    ["development", "localhost@evil.example", false],
+    ["development", "api.swarm.localhost", false],
+  ] as const)("NODE_ENV=%p Host=%p → %p", (nodeEnv, host, expected) => {
+    setNodeEnv(nodeEnv);
+    expect(isLocalDevPageRequest({ headers: host === undefined ? {} : { host } })).toBe(expected);
+  });
+});

package/src/tests/pages-frame-ancestors.test.ts

@@ -50,6 +50,7 @@ describe("PAGES_FRAME_ANCESTORS on /p/:id", () => {
     APP_URL: process.env.APP_URL,
     DASHBOARD_URL: process.env.DASHBOARD_URL,
     PAGE_SESSION_SECRET: process.env.PAGE_SESSION_SECRET,
+    NODE_ENV: process.env.NODE_ENV,
   };
 
   function restore(key: keyof typeof ORIG): void {
@@ -93,7 +94,10 @@ describe("PAGES_FRAME_ANCESTORS on /p/:id", () => {
     BASE = `http://localhost:${port}`;
   });
 
-  afterEach(() => restore("PAGES_FRAME_ANCESTORS"));
+  afterEach(() => {
+    restore("PAGES_FRAME_ANCESTORS");
+    restore("NODE_ENV");
+  });
 
   afterAll(async () => {
     await new Promise<void>((resolve) => server.close(() => resolve()));
@@ -150,6 +154,29 @@ describe("PAGES_FRAME_ANCESTORS on /p/:id", () => {
     expect(blank).toBe(unset);
   });
 
+  // Deployed images leave NODE_ENV unset. Localhost dev origins must only be
+  // allowed to frame pages under an explicit development or test NODE_ENV.
+  for (const nodeEnv of [undefined, "production", "staging"]) {
+    test(`NODE_ENV=${nodeEnv ?? "<unset>"} emits no localhost ancestors`, async () => {
+      if (nodeEnv === undefined) delete process.env.NODE_ENV;
+      else process.env.NODE_ENV = nodeEnv;
+      const id = await createPage(`public-env-${nodeEnv ?? "unset"}`, "public");
+      const fa = frameAncestors(await fetch(`${BASE}/p/${id}`));
+      expect(fa.trim()).toBe("frame-ancestors 'self' https://app.example.test");
+    });
+  }
+
+  for (const nodeEnv of ["development", "test"]) {
+    test(`NODE_ENV=${nodeEnv} keeps the local dashboard origins`, async () => {
+      process.env.NODE_ENV = nodeEnv;
+      const id = await createPage(`public-env-${nodeEnv}`, "public");
+      const fa = frameAncestors(await fetch(`${BASE}/p/${id}`));
+      expect(fa).toContain("https://app.example.test");
+      expect(fa).toContain("http://localhost:5274");
+      expect(fa).toContain("https://*.localhost");
+    });
+  }
+
   test("parser accepts comma or space lists and drops invalid entries", () => {
     process.env.PAGES_FRAME_ANCESTORS =
       "https://www.agent-swarm.dev/, https://*.example.com:8443 blog.example.org,* 'none' https://evil.test;script-src javascript:alert(1) https://x.test/path";