@jskit-ai/assistant-core 0.1.236 → 0.1.238

package/test/localExecution.test.js

@@ -0,0 +1,150 @@
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { test } from "node:test";
+import { createConversationProcessIdentity } from "../src/server/conversation/localExecution.js";
+
+const TOKEN_ENV = "JSKIT_EXECUTION_RUNTIME_TOKEN";
+const HASH_ENV = "JSKIT_EXECUTION_COMMAND_HASH";
+const runtimeToken = "0b6c8f8e-3f7a-4c1e-9d2b-5a4e6f7a8b9c";
+const commandHash = "abcdef012345";
+// Process-group ids far above any live pid, so liveness probes find nothing.
+const LEADER = 9_000_001;
+const CHILD = 9_000_002;
+const STARTED = "Wed Oct 21 10:00:00 2026";
+const STARTED_SECONDS = String(Date.UTC(2026, 9, 21, 10, 0, 0) / 1000);
+const uid = process.getuid?.() ?? 0;
+
+const IDENTITY_ENV = `PATH=/usr/bin ${TOKEN_ENV}=${runtimeToken} ${HASH_ENV}=${commandHash}`;
+
+function row(pid, pgid, { owner = uid, stat = "Ss", started = STARTED, args = "/usr/bin/codex app-server", env = IDENTITY_ENV } = {}) {
+  return { pid, pgid, owner, stat, started, args, env };
+}
+
+/** Renders the three darwin listings: every process, then the user's commands without and with `-E`. */
+function psListing(rows, args) {
+  if (args[0] === "-ax") {
+    return rows.map(({ pid, pgid, owner, stat, started }) =>
+      `${String(pid).padStart(7)} ${String(pgid).padStart(7)} ${String(owner).padStart(5)} ${stat.padEnd(4)} ${started}`).join("\n");
+  }
+  const withEnvironment = args[0] === "-E";
+  return rows.filter(({ owner }) => owner === uid).map(({ pid, args: command, env }) =>
+    `${String(pid).padStart(7)} ${command}${withEnvironment && env ? ` ${env}` : ""}`).join("\n");
+}
+
+function darwinIdentity(table, captureOutput = `${LEADER} ${STARTED}`) {
+  const calls = [];
+  const identity = createConversationProcessIdentity({
+    platform: "darwin",
+    async ps(args) {
+      calls.push(args);
+      if (args.includes("-p")) return captureOutput;
+      if (table instanceof Error) throw table;
+      return psListing(table, args);
+    }
+  });
+  return { calls, identity };
+}
+
+const metadata = (overrides = {}) => ({
+  pid: LEADER,
+  processState: "running",
+  processIdentity: { commandHash, platform: "darwin", runtimeToken, startTimeTicks: STARTED_SECONDS, version: 1, ...overrides }
+});
+
+test("darwin capture records the group leader's ps start time as epoch seconds", async () => {
+  const { calls, identity } = darwinIdentity([]);
+  const captured = await identity.capture({ commandHash, pid: LEADER, runtimeToken });
+  assert.deepEqual(captured, { commandHash, platform: "darwin", runtimeToken, startTimeTicks: STARTED_SECONDS, version: 1 });
+  assert.deepEqual(calls, [["-o", "pgid=,lstart=", "-p", String(LEADER)]]);
+  assert.equal(identity.isValid(captured), true);
+});
+
+test("darwin capture parses the padded BSD ps `pgid= lstart=` line", async () => {
+  // BSD ps prints lstart with strftime("%c"), which space-pads single-digit days in the C locale.
+  const { identity } = darwinIdentity([], `   ${LEADER} Tue Oct  7 09:05:03 2026\n`);
+  const captured = await identity.capture({ commandHash, pid: LEADER, runtimeToken });
+  assert.equal(captured.startTimeTicks, String(Date.UTC(2026, 9, 7, 9, 5, 3) / 1000));
+});
+
+test("darwin capture refuses a non-leader, an unparsable line or a failed ps", async (t) => {
+  for (const [name, output] of [
+    ["another group", `${CHILD} ${STARTED}`],
+    ["a non-numeric group", `pgid ${STARTED}`],
+    ["an unknown start format", `${LEADER} 2026-10-21T10:00:00Z`],
+    ["empty output", ""]
+  ]) {
+    await t.test(name, async () => {
+      const { identity } = darwinIdentity([], output);
+      await assert.rejects(identity.capture({ commandHash, pid: LEADER, runtimeToken }),
+        { code: "native_process_identity_unavailable" });
+    });
+  }
+});
+
+test("darwin inspection is exact only when every group member carries the identity", async () => {
+  const { calls, identity } = darwinIdentity([
+    row(LEADER, LEADER),
+    row(CHILD, CHILD),
+    row(9_000_003, 9_000_003, { env: "" })
+  ]);
+  assert.deepEqual(await identity.inspect(metadata()), { processGroupIds: [LEADER, CHILD], status: "exact" });
+  assert.deepEqual(calls, [
+    ["-ax", "-o", "pid=,pgid=,uid=,stat=,lstart="],
+    ["-x", "-U", String(uid), "-ww", "-o", "pid=,command="],
+    ["-E", "-x", "-U", String(uid), "-ww", "-o", "pid=,command="]
+  ]);
+});
+
+test("darwin inspection keeps the absent, mismatch and ambiguous outcomes", async (t) => {
+  const cases = [
+    ["no process in the group", [], {}, "absent"],
+    ["zombies are ignored", [row(LEADER, LEADER, { stat: "Z" })], {}, "absent"],
+    ["an unrelated process reuses the group", [row(LEADER, LEADER, { env: "PATH=/usr/bin" })], {}, "mismatch"],
+    ["the token only in the arguments", [row(LEADER, LEADER, {
+      args: `/usr/bin/env -i ${TOKEN_ENV}=${runtimeToken} ${HASH_ENV}=${commandHash} codex`, env: "PATH=/usr/bin"
+    })], {}, "mismatch"],
+    ["a hidden environment", [row(LEADER, LEADER, { env: "" })], {}, "ambiguous"],
+    ["the token only in the arguments of a hidden environment", [row(LEADER, LEADER, {
+      args: `/usr/bin/env ${TOKEN_ENV}=${runtimeToken} ${HASH_ENV}=${commandHash} codex`, env: ""
+    })], {}, "ambiguous"],
+    ["another runtime token", [row(LEADER, LEADER)], { runtimeToken: randomUUID() }, "mismatch"],
+    ["the leader restarted", [row(LEADER, LEADER, { started: "Wed Oct 21 10:00:01 2026" })], {}, "ambiguous"],
+    ["another user's process shares the group", [row(LEADER, LEADER), row(CHILD, LEADER, { owner: uid + 1 })], {}, "ambiguous"],
+    ["another user's environment is not trusted", [row(LEADER, LEADER, { owner: uid + 1 })], {}, "ambiguous"],
+    ["an unmarked member shares the group", [row(LEADER, LEADER), row(CHILD, LEADER, { env: "PATH=/usr/bin" })], {}, "ambiguous"],
+    ["ps fails", new Error("ps unavailable"), {}, "ambiguous"],
+    ["a Linux identity", [row(LEADER, LEADER)], { platform: "linux-proc" }, "ambiguous"]
+  ];
+  for (const [name, table, overrides, status] of cases) {
+    await t.test(name, async () => {
+      const { identity } = darwinIdentity(table);
+      assert.equal((await identity.inspect(metadata(overrides))).status, status);
+    });
+  }
+});
+
+async function liveGroup(t, env) {
+  const child = spawn(process.execPath, ["-e", "setInterval(() => {}, 1000)"], {
+    detached: true, stdio: "ignore", env: { ...process.env, ...env }
+  });
+  await new Promise((resolve, reject) => { child.once("spawn", resolve); child.once("error", reject); });
+  t.after(() => { try { process.kill(-child.pid, "SIGKILL"); } catch {} });
+  return child;
+}
+
+const nativePlatform = { linux: "linux-proc", darwin: "darwin" }[process.platform];
+
+test("the host platform captures, inspects and stops a real owned process group", { skip: !nativePlatform }, async (t) => {
+  const token = randomUUID();
+  const child = await liveGroup(t, { [TOKEN_ENV]: token, [HASH_ENV]: commandHash });
+  const identity = createConversationProcessIdentity();
+  const captured = await identity.capture({ commandHash, pid: child.pid, runtimeToken: token });
+  assert.equal(captured.platform, nativePlatform);
+  const owned = { pid: child.pid, processState: "running", processIdentity: captured };
+  assert.deepEqual(await identity.inspect(owned), { processGroupIds: [child.pid], status: "exact" });
+  assert.equal((await identity.inspect({ ...owned, processIdentity: { ...captured, runtimeToken: randomUUID() } })).status, "mismatch");
+  const stopped = await identity.stop(owned, { termTimeoutMs: 2000 });
+  assert.equal(stopped.processExitVerified, true);
+  assert.deepEqual(stopped.signaledProcessGroups, [child.pid]);
+});

package/test/messageDelivery.test.js

@@ -146,6 +146,23 @@ test("a failed message retains its retry identity while later guidance is pendin
   assert.equal(delivery.state.sending, false);
 });
 
+test("a failed client-only message keeps its time while newer saved turns and pending messages follow it", async () => {
+  const delivery = createAssistantMessageDelivery({ deliver: async () => ({ ok: false, error: "Unavailable" }) });
+  await delivery.send({ message: "Lost" }, { messageId: "lost" });
+  const sentAt = delivery.find("lost").createdAtMs;
+  const earlier = { turnId: "1", user: { messageId: "earlier", text: "Earlier", at: new Date(sentAt - 1000).toISOString() } };
+  const newer = { turnId: "2", user: { messageId: "newer", text: "Newer", at: new Date(sentAt + 1000).toISOString() }, pending: true };
+  assert.deepEqual(delivery.turns([earlier, newer]).map(turn => turn.turnId), ["1", "lost", "2"]);
+  assert.deepEqual(delivery.turns([earlier]).map(turn => turn.turnId), ["1", "lost"]);
+  const waiting = Promise.withResolvers();
+  const queued = createAssistantMessageDelivery({ deliver: () => waiting.promise });
+  const sending = queued.send({ message: "Queued" }, { messageId: "queued" });
+  assert.deepEqual(queued.turns([{ ...newer, user: { ...newer.user, at: new Date(Date.now() + 60000).toISOString() } }])
+    .map(turn => turn.turnId), ["2", "queued"]);
+  waiting.resolve({ ok: true });
+  await sending;
+});
+
 test("reset discards queued delivery without waiting for the old transport", async () => {
   const request = Promise.withResolvers();
   const sent = [];

package/test/openCodeTools.test.js

@@ -242,6 +242,16 @@ test("non-project common OpenCode tools stay behind approval and require the exe
   const guarded = openCodeConversationAgents({ sessionEnvironmentRegistry: "/private/sessions.json" });
   assert.equal(guarded["jskit-assistant"].permission["*"], "ask");
   assert.equal(guarded["jskit-assistant-actions"].permission["*"], "ask");
+  // OpenCode applies the agent's last matching rule: an agent without application
+  // tools must not be offered them, and no agent waits on a repeated-call approval.
+  for (const name of ["assistant_action_search", "assistant_action_contract", "assistant_action_execute"]) {
+    assert.equal(guarded["jskit-assistant"].permission[name], "deny");
+    assert.equal(guarded["jskit-assistant-actions"].permission[name], "allow");
+    assert.equal(Object.keys(guarded["jskit-assistant"].permission).indexOf(name) > 0, true);
+  }
+  assert.equal(guarded["jskit-assistant"].permission.doom_loop, "deny");
+  assert.equal(guarded["jskit-assistant-actions"].permission.doom_loop, "deny");
+  assert.equal(guarded["jskit-assistant-coding"].permission["*"], "deny");
 });
 
 test("common non-project OpenCode calls retain the original fail-closed execution guard", async t => {

package/test/opencodeConversationSession.test.js

@@ -194,6 +194,18 @@ async function fixture(t, options = {}) {
             session.messages.push(row("assistant", randomUUID(), [], { error: { data: { message: error.message } } })); save(); return;
           }
         }
+        if (text === "refused-tools") {
+          // A model that keeps retrying an ungranted native tool and never answers.
+          while (busy.has(session.id)) {
+            const part = { type: "tool", callID: randomUUID(), tool: "assistant_action_search", state: { status: "running", input: {} } };
+            session.messages.push(row("assistant", randomUUID(), [part], { parentID: body.messageID, finish: "tool-calls" }));
+            try { await hooks["tool.execute.before"]({ tool: part.tool, sessionID: session.id }, { args: {} }); }
+            catch (error) { part.state = { ...part.state, status: "error", error: error.message }; }
+            save();
+            await new Promise(resolve => setTimeout(resolve, 20));
+          }
+          return;
+        }
         if (text === "compact") {
           session.messages.push(row("user", randomUUID(), [{ type: "compaction", auto: true }]));
           session.messages.push(row("assistant", randomUUID(), [{ type: "text", text: "Native summary" }], { summary: true, finish: "stop" }));
@@ -327,7 +339,8 @@ test("OpenCode admits once, streams and saves native reasoning through the commo
   assert.equal(trace.find(item => item.url === "/api/session").body.model.id, "test-model");
   assert.equal(trace.find(item => item.url?.endsWith("/prompt_async")).body.model.modelID, "test-model");
   assert.equal(trace[0].inheritedSecret, null);
-  assert.deepEqual(trace[0].configuration.agent[trace.find(item => item.url?.endsWith("/prompt_async")).body.agent].permission, { "*": "ask" });
+  assert.deepEqual(trace[0].configuration.agent[trace.find(item => item.url?.endsWith("/prompt_async")).body.agent].permission, { "*": "ask",
+    assistant_action_search: "deny", assistant_action_contract: "deny", assistant_action_execute: "deny", doom_loop: "deny" });
   assert.match(trace[0].configuration.plugin[0], /openCodePlugin\.js$/u);
   assert.deepEqual(trace[0].configuration.provider.test.models["test-model"].limit, { context: 32000, output: 4000 });
   assert.equal(trace[0].configuration.provider.test.models["test-model"].id, "test-model");
@@ -423,6 +436,17 @@ test("the production recovery stops after two reasoning-only completions through
   assert.equal(state.conversationLog[0].assistant, null);
 });
 
+test("a model that keeps calling refused native tools fails visibly and stops its native turn", async t => {
+  const f = await fixture(t);
+  await f.conversation.send({ messageId: "client-message-refused-tools", text: "refused-tools" });
+  const state = await f.conversation.wait();
+  assert.equal(state.conversationLog.length, 1);
+  assert.equal(state.conversationLog[0].metadata.runtime.status, "failed");
+  assert.equal(state.error, "The model kept calling tools that this conversation does not provide and gave no answer. No tool ran. Your message is kept; retry or choose another model.");
+  assert.equal(state.conversationLog[0].assistant, null);
+  assert.ok((await f.trace()).some(row => row.url?.endsWith("/abort")), "The refused native loop is stopped");
+});
+
 test("OpenCode steering follows the newly admitted input in the same native conversation", async t => {
   const f = await fixture(t);
   const started = Promise.withResolvers();
@@ -520,7 +544,7 @@ test("OpenCode shares discovery, saved results and current permissions across na
   assert.equal(executions, 1);
   const trace = await f.trace();
   assert.deepEqual(trace[0].configuration.agent[trace.find(item => item.url?.endsWith("/prompt_async")).body.agent].permission, { "*": "ask", assistant_action_search: "allow",
-    assistant_action_contract: "allow", assistant_action_execute: "allow" });
+    assistant_action_contract: "allow", assistant_action_execute: "allow", doom_loop: "deny" });
   const original = await f.binding();
   await f.first.close();
   const resumed = await f.runtime().open({ id: "conversation", context });
@@ -1625,7 +1649,8 @@ test("completed OpenCode caller markers preserve ordinary native discovery witho
     assert.equal(ordinaryPrompt.body.agent, "jskit-assistant-actions");
     assert.match(ordinaryPrompt.body.parts[0].text, /\[Application data\]/);
     assert.deepEqual(initialTrace[0].configuration.agent[ordinaryPrompt.body.agent].permission, {
-      "*": "ask", assistant_action_search: "allow", assistant_action_contract: "allow", assistant_action_execute: "allow"
+      "*": "ask", assistant_action_search: "allow", assistant_action_contract: "allow", assistant_action_execute: "allow",
+      doom_loop: "deny"
     });
     await assert.rejects(f.prepare({ messageId: "ordinary-opencode", turnId: receipt.turnId }), /no current verified receipt/);
     // The original native fixture invokes discovery only for exact plain tools.