@kafca/agentdock 0.1.58 → 0.1.62

package/dist-electron/tests/electron/automation-script-package.test.js

@@ -0,0 +1,499 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_process_1 = __importDefault(require("node:process"));
+const node_test_1 = __importDefault(require("node:test"));
+const script_package_js_1 = require("../../services/local-ai-core/src/automation/scripts/script-package.js");
+const local_core_acp_store_js_1 = require("../../services/local-ai-core/src/acp/local-core-acp-store.js");
+const globalTestHooks = globalThis;
+function tempDir(prefix) {
+    return (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), prefix));
+}
+function removeTempTree(path) {
+    makeWritable(path);
+    (0, node_fs_1.rmSync)(path, { recursive: true, force: true });
+}
+function makeWritable(path) {
+    let stat;
+    try {
+        stat = (0, node_fs_1.lstatSync)(path);
+    }
+    catch {
+        return;
+    }
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+        try {
+            (0, node_fs_1.chmodSync)(path, 0o644);
+        }
+        catch {
+            // Best effort for portable test cleanup.
+        }
+        return;
+    }
+    try {
+        (0, node_fs_1.chmodSync)(path, 0o755);
+    }
+    catch {
+        // Best effort for portable test cleanup.
+    }
+    for (const entry of (0, node_fs_1.readdirSync)(path)) {
+        makeWritable((0, node_path_1.join)(path, entry));
+    }
+}
+function writeBundle(root, overrides = {}) {
+    const manifest = overrides.manifest ?? {
+        protocolVersion: 1,
+        entrypoint: 'run.sh',
+        config: {},
+        configSchema: { type: 'object' },
+        capabilities: { network: 'none', internalAccess: false, allowedReadDirs: [] },
+        secretRefs: [],
+        env: [],
+        testPlan: { command: 'manual' },
+        limits: { timeoutMs: 30_000, stdoutBytes: 8192, stderrBytes: 8192, payloadBytes: 8192, stateBytes: 8192 },
+    };
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(root, 'manifest.json'), `${JSON.stringify(manifest, null, 2)}\n`);
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(root, 'run.sh'), overrides.entry ?? '#!/bin/sh\nnode helper.js\n');
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(root, 'helper.js'), overrides.helper ?? 'console.log("ok");\n');
+}
+function writeBundleWithNestedDir(root) {
+    writeBundle(root);
+    (0, node_fs_1.mkdirSync)((0, node_path_1.join)(root, 'nested'));
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(root, 'nested', 'keep.js'), 'console.log("nested");\n');
+}
+function withDirectoryReadHook(hooks, run) {
+    const previousHooks = globalTestHooks.__automationScriptPackageTestHooks;
+    globalTestHooks.__automationScriptPackageTestHooks = hooks;
+    try {
+        run();
+    }
+    finally {
+        if (previousHooks) {
+            globalTestHooks.__automationScriptPackageTestHooks = previousHooks;
+        }
+        else {
+            delete globalTestHooks.__automationScriptPackageTestHooks;
+        }
+    }
+}
+(0, node_test_1.default)('stages immutable script packages with deterministic whole-package hashes and read-only files', () => {
+    const userDataPath = tempDir('automation-script-user-data-');
+    const first = tempDir('automation-script-bundle-a-');
+    const second = tempDir('automation-script-bundle-b-');
+    try {
+        writeBundle(first);
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(second, 'helper.js'), 'console.log("ok");\n');
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(second, 'run.sh'), '#!/bin/sh\nnode helper.js\n');
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(second, 'manifest.json'), `${JSON.stringify({
+            protocolVersion: 1,
+            entrypoint: 'run.sh',
+            config: {},
+            configSchema: { type: 'object' },
+            capabilities: { network: 'none', internalAccess: false, allowedReadDirs: [] },
+            secretRefs: [],
+            env: [],
+            testPlan: { command: 'manual' },
+            limits: { timeoutMs: 30_000, stdoutBytes: 8192, stderrBytes: 8192, payloadBytes: 8192, stateBytes: 8192 },
+        }, null, 2)}\n`);
+        const staged = (0, script_package_js_1.stageImmutableScriptPackage)({ userDataPath, scriptId: 'script:alpha', sourceDir: first });
+        const same = (0, script_package_js_1.stageImmutableScriptPackage)({ userDataPath, scriptId: 'script:alpha', sourceDir: second });
+        strict_1.default.equal(staged.packageSha256, same.packageSha256);
+        strict_1.default.equal(staged.packagePath, (0, node_path_1.join)(userDataPath, 'automations', 'scripts', 'script:alpha', staged.packageSha256));
+        strict_1.default.deepEqual(staged.entries.map((entry) => entry.path), ['helper.js', 'manifest.json', 'run.sh']);
+        strict_1.default.equal(staged.manifest.entrypoint, 'run.sh');
+        strict_1.default.equal(staged.shebang, '#!/bin/sh');
+        strict_1.default.equal((0, node_fs_1.lstatSync)(staged.packagePath).mode & 0o222, 0);
+        for (const entry of staged.entries) {
+            const mode = (0, node_fs_1.lstatSync)((0, node_path_1.join)(staged.packagePath, entry.path)).mode;
+            strict_1.default.equal(mode & 0o222, 0);
+        }
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(first, 'helper.js'), 'console.log("changed");\n');
+        const changed = (0, script_package_js_1.stageImmutableScriptPackage)({ userDataPath, scriptId: 'script:alpha', sourceDir: first });
+        strict_1.default.notEqual(changed.packageSha256, staged.packageSha256);
+        strict_1.default.equal(changed.packagePath, (0, node_path_1.join)(userDataPath, 'automations', 'scripts', 'script:alpha', changed.packageSha256));
+    }
+    finally {
+        removeTempTree(userDataPath);
+        removeTempTree(first);
+        removeTempTree(second);
+    }
+});
+(0, node_test_1.default)('sorts package paths by deterministic UTF-8 byte order rather than locale collation', () => {
+    const userDataPath = tempDir('automation-script-user-data-');
+    const sourceDir = tempDir('automation-script-locale-order-');
+    try {
+        writeBundle(sourceDir);
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(sourceDir, 'a.js'), 'console.log("lower");\n');
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(sourceDir, 'z.js'), 'console.log("last ascii");\n');
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(sourceDir, 'ä.js'), 'console.log("non ascii");\n');
+        const staged = (0, script_package_js_1.stageImmutableScriptPackage)({ userDataPath, scriptId: 'script:order', sourceDir });
+        strict_1.default.deepEqual(staged.entries.map((entry) => entry.path), ['a.js', 'helper.js', 'manifest.json', 'run.sh', 'z.js', 'ä.js']);
+    }
+    finally {
+        removeTempTree(userDataPath);
+        removeTempTree(sourceDir);
+    }
+});
+(0, node_test_1.default)('rejects source nested directories that redirect during traversal', () => {
+    const userDataPath = tempDir('automation-script-user-data-');
+    const sourceDir = tempDir('automation-script-race-source-');
+    const outsideDir = tempDir('automation-script-race-outside-');
+    try {
+        writeBundleWithNestedDir(sourceDir);
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(outsideDir, 'escape.js'), 'console.log("outside");\n');
+        let swapped = false;
+        withDirectoryReadHook({
+            beforeDirectoryRead(directory) {
+                if (swapped || directory !== (0, node_path_1.join)(sourceDir, 'nested'))
+                    return;
+                swapped = true;
+                (0, node_fs_1.rmSync)(directory, { recursive: true, force: true });
+                (0, node_fs_1.symlinkSync)(outsideDir, directory);
+            },
+        }, () => {
+            strict_1.default.throws(() => (0, script_package_js_1.stageImmutableScriptPackage)({ userDataPath, scriptId: 'script:source-race', sourceDir }), /changed|redirect|outside|symlink|real directory/i);
+        });
+        strict_1.default.equal(swapped, true);
+    }
+    finally {
+        removeTempTree(userDataPath);
+        removeTempTree(sourceDir);
+        removeTempTree(outsideDir);
+    }
+});
+(0, node_test_1.default)('rejects existing package nested directories that redirect during verification', () => {
+    const userDataPath = tempDir('automation-script-user-data-');
+    const sourceDir = tempDir('automation-script-race-existing-');
+    const outsideDir = tempDir('automation-script-race-outside-');
+    try {
+        writeBundleWithNestedDir(sourceDir);
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(outsideDir, 'escape.js'), 'console.log("outside");\n');
+        const staged = (0, script_package_js_1.stageImmutableScriptPackage)({ userDataPath, scriptId: 'script:existing-race', sourceDir });
+        const nestedPackageDir = (0, node_path_1.join)(staged.packagePath, 'nested');
+        let swapped = false;
+        withDirectoryReadHook({
+            beforeDirectoryRead(directory) {
+                if (swapped || directory !== nestedPackageDir)
+                    return;
+                swapped = true;
+                (0, node_fs_1.chmodSync)(staged.packagePath, 0o755);
+                (0, node_fs_1.chmodSync)(nestedPackageDir, 0o755);
+                (0, node_fs_1.rmSync)(nestedPackageDir, { recursive: true, force: true });
+                (0, node_fs_1.symlinkSync)(outsideDir, nestedPackageDir);
+            },
+        }, () => {
+            strict_1.default.throws(() => (0, script_package_js_1.stageImmutableScriptPackage)({ userDataPath, scriptId: 'script:existing-race', sourceDir }), /changed|redirect|outside|symlink|real directory/i);
+        });
+        strict_1.default.equal(swapped, true);
+    }
+    finally {
+        removeTempTree(userDataPath);
+        removeTempTree(sourceDir);
+        removeTempTree(outsideDir);
+    }
+});
+(0, node_test_1.default)('rejects source file reads when the parent directory redirects during open', () => {
+    const userDataPath = tempDir('automation-script-user-data-');
+    const sourceDir = tempDir('automation-script-file-read-source-');
+    const outsideDir = tempDir('automation-script-file-read-outside-');
+    try {
+        writeBundleWithNestedDir(sourceDir);
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(outsideDir, 'keep.js'), 'console.log("outside");\n');
+        const nestedFile = (0, node_path_1.join)(sourceDir, 'nested', 'keep.js');
+        let swapped = false;
+        withDirectoryReadHook({
+            beforeFileRead(filePath) {
+                if (swapped || filePath !== nestedFile)
+                    return;
+                swapped = true;
+                (0, node_fs_1.rmSync)((0, node_path_1.dirname)(filePath), { recursive: true, force: true });
+                (0, node_fs_1.symlinkSync)(outsideDir, (0, node_path_1.dirname)(filePath));
+            },
+        }, () => {
+            strict_1.default.throws(() => (0, script_package_js_1.stageImmutableScriptPackage)({ userDataPath, scriptId: 'script:file-read-source', sourceDir }), /changed|redirect|outside|symlink|real directory|package root/i);
+        });
+        strict_1.default.equal(swapped, true);
+    }
+    finally {
+        removeTempTree(userDataPath);
+        removeTempTree(sourceDir);
+        removeTempTree(outsideDir);
+    }
+});
+(0, node_test_1.default)('rejects existing package file reads when the parent directory redirects during verification', () => {
+    const userDataPath = tempDir('automation-script-user-data-');
+    const sourceDir = tempDir('automation-script-file-read-existing-');
+    const outsideDir = tempDir('automation-script-file-read-outside-');
+    try {
+        writeBundleWithNestedDir(sourceDir);
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(outsideDir, 'keep.js'), 'console.log("outside");\n');
+        const staged = (0, script_package_js_1.stageImmutableScriptPackage)({ userDataPath, scriptId: 'script:file-read-existing', sourceDir });
+        const nestedFile = (0, node_path_1.join)(staged.packagePath, 'nested', 'keep.js');
+        let swapped = false;
+        withDirectoryReadHook({
+            beforeFileRead(filePath) {
+                if (swapped || filePath !== nestedFile)
+                    return;
+                swapped = true;
+                (0, node_fs_1.chmodSync)((0, node_path_1.dirname)((0, node_path_1.dirname)(filePath)), 0o755);
+                (0, node_fs_1.chmodSync)((0, node_path_1.dirname)(filePath), 0o755);
+                (0, node_fs_1.rmSync)((0, node_path_1.dirname)(filePath), { recursive: true, force: true });
+                (0, node_fs_1.symlinkSync)(outsideDir, (0, node_path_1.dirname)(filePath));
+            },
+        }, () => {
+            strict_1.default.throws(() => (0, script_package_js_1.stageImmutableScriptPackage)({ userDataPath, scriptId: 'script:file-read-existing', sourceDir }), /changed|redirect|outside|symlink|real directory|package root/i);
+        });
+        strict_1.default.equal(swapped, true);
+    }
+    finally {
+        removeTempTree(userDataPath);
+        removeTempTree(sourceDir);
+        removeTempTree(outsideDir);
+    }
+});
+(0, node_test_1.default)('rejects chmod when the parent directory redirects before chmod applies', () => {
+    const userDataPath = tempDir('automation-script-user-data-');
+    const sourceDir = tempDir('automation-script-chmod-source-');
+    const outsideDir = tempDir('automation-script-chmod-outside-');
+    try {
+        writeBundleWithNestedDir(sourceDir);
+        const outsideFile = (0, node_path_1.join)(outsideDir, 'keep.js');
+        (0, node_fs_1.writeFileSync)(outsideFile, 'console.log("outside");\n');
+        (0, node_fs_1.chmodSync)(outsideFile, 0o600);
+        const outsideModeBefore = (0, node_fs_1.lstatSync)(outsideFile).mode & 0o777;
+        let swapped = false;
+        withDirectoryReadHook({
+            beforeChmod(filePath) {
+                if (swapped ||
+                    !filePath.includes((0, node_path_1.join)('automations', 'scripts', 'script:chmod-race')) ||
+                    !filePath.endsWith((0, node_path_1.join)('nested', 'keep.js'))) {
+                    return;
+                }
+                swapped = true;
+                (0, node_fs_1.rmSync)((0, node_path_1.dirname)(filePath), { recursive: true, force: true });
+                (0, node_fs_1.symlinkSync)(outsideDir, (0, node_path_1.dirname)(filePath));
+            },
+        }, () => {
+            strict_1.default.throws(() => (0, script_package_js_1.stageImmutableScriptPackage)({ userDataPath, scriptId: 'script:chmod-race', sourceDir }), /changed|redirect|outside|symlink|real directory|package root/i);
+        });
+        strict_1.default.equal(swapped, true);
+        strict_1.default.equal((0, node_fs_1.lstatSync)(outsideFile).mode & 0o777, outsideModeBefore);
+    }
+    finally {
+        removeTempTree(userDataPath);
+        removeTempTree(sourceDir);
+        removeTempTree(outsideDir);
+    }
+});
+(0, node_test_1.default)('rejects unsafe script package inputs before staging', () => {
+    const userDataPath = tempDir('automation-script-user-data-');
+    const sourceDirs = [];
+    const unsafeBundle = (name, overrides) => {
+        const sourceDir = tempDir(`automation-script-${name}-`);
+        sourceDirs.push(sourceDir);
+        writeBundle(sourceDir, overrides);
+        if (overrides.symlink)
+            (0, node_fs_1.symlinkSync)((0, node_path_1.join)(sourceDir, 'helper.js'), (0, node_path_1.join)(sourceDir, 'linked-helper.js'));
+        return sourceDir;
+    };
+    try {
+        strict_1.default.throws(() => (0, script_package_js_1.stageImmutableScriptPackage)({
+            userDataPath,
+            scriptId: 'script:unsafe',
+            sourceDir: unsafeBundle('traversal', {
+                manifest: {
+                    protocolVersion: 1,
+                    entrypoint: '../run.sh',
+                    config: {},
+                    configSchema: { type: 'object' },
+                    capabilities: { network: 'none', internalAccess: false, allowedReadDirs: [] },
+                    secretRefs: [],
+                    env: [],
+                    limits: { timeoutMs: 30_000, stdoutBytes: 8192, stderrBytes: 8192, payloadBytes: 8192, stateBytes: 8192 },
+                },
+            }),
+        }), /path traversal|relative/i);
+        strict_1.default.throws(() => (0, script_package_js_1.stageImmutableScriptPackage)({
+            userDataPath,
+            scriptId: 'script:unsafe',
+            sourceDir: unsafeBundle('absolute', {
+                manifest: {
+                    protocolVersion: 1,
+                    entrypoint: '/tmp/run.sh',
+                    config: {},
+                    configSchema: { type: 'object' },
+                    capabilities: { network: 'none', internalAccess: false, allowedReadDirs: [] },
+                    secretRefs: [],
+                    env: [],
+                    limits: { timeoutMs: 30_000, stdoutBytes: 8192, stderrBytes: 8192, payloadBytes: 8192, stateBytes: 8192 },
+                },
+            }),
+        }), /absolute|relative/i);
+        strict_1.default.throws(() => (0, script_package_js_1.stageImmutableScriptPackage)({
+            userDataPath,
+            scriptId: 'script:unsafe',
+            sourceDir: unsafeBundle('missing-shebang', { entry: 'echo missing shebang\n' }),
+        }), /shebang/i);
+        strict_1.default.throws(() => (0, script_package_js_1.stageImmutableScriptPackage)({
+            userDataPath,
+            scriptId: 'script:unsafe',
+            sourceDir: unsafeBundle('binary-entry', { entry: '#!/bin/sh\u0000\n' }),
+        }), /text|binary/i);
+        strict_1.default.throws(() => (0, script_package_js_1.stageImmutableScriptPackage)({
+            userDataPath,
+            scriptId: 'script:unsafe',
+            sourceDir: unsafeBundle('missing-protocol', { manifest: { entrypoint: 'run.sh' } }),
+        }), /protocolVersion/i);
+        strict_1.default.throws(() => (0, script_package_js_1.stageImmutableScriptPackage)({
+            userDataPath,
+            scriptId: 'script:unsafe',
+            sourceDir: unsafeBundle('minimal-manifest', { manifest: { protocolVersion: 1, entrypoint: 'run.sh' } }),
+        }), /config|capabilities|secretRefs|env|limits/i);
+        strict_1.default.throws(() => (0, script_package_js_1.stageImmutableScriptPackage)({
+            userDataPath,
+            scriptId: 'script:unsafe',
+            sourceDir: unsafeBundle('symlink', { symlink: true }),
+        }), /symlink|regular file/i);
+    }
+    finally {
+        removeTempTree(userDataPath);
+        for (const sourceDir of sourceDirs) {
+            removeTempTree(sourceDir);
+        }
+    }
+});
+(0, node_test_1.default)('rejects existing package destinations that were replaced by symlinks', () => {
+    const userDataPath = tempDir('automation-script-user-data-');
+    const sourceDir = tempDir('automation-script-bundle-');
+    const symlinkTarget = tempDir('automation-script-symlink-target-');
+    try {
+        writeBundle(sourceDir);
+        writeBundle(symlinkTarget);
+        const staged = (0, script_package_js_1.stageImmutableScriptPackage)({ userDataPath, scriptId: 'script:symlink', sourceDir });
+        (0, node_fs_1.chmodSync)(staged.packagePath, 0o755);
+        (0, node_fs_1.rmSync)(staged.packagePath, { recursive: true, force: true });
+        (0, node_fs_1.symlinkSync)(symlinkTarget, staged.packagePath);
+        strict_1.default.throws(() => (0, script_package_js_1.stageImmutableScriptPackage)({ userDataPath, scriptId: 'script:symlink', sourceDir }), /symlink|real directory/i);
+    }
+    finally {
+        removeTempTree(userDataPath);
+        removeTempTree(sourceDir);
+        removeTempTree(symlinkTarget);
+    }
+});
+(0, node_test_1.default)('persists automation script and staged version metadata across reopen', () => {
+    const userDataPath = tempDir('automation-script-store-');
+    const sourceDir = tempDir('automation-script-bundle-');
+    try {
+        writeBundle(sourceDir);
+        const store = new local_core_acp_store_js_1.LocalCoreAcpStore(userDataPath);
+        const script = store.createAutomationScript({
+            workspaceId: 'workspace-1',
+            title: 'Check package',
+            description: 'approved script',
+        });
+        const version = store.createAutomationScriptVersionFromPackage({
+            scriptId: script.id,
+            sourceDir,
+            interpreterPath: '/bin/sh',
+            interpreterVersion: 'sh 1.0',
+        });
+        strict_1.default.equal(version.scriptId, script.id);
+        strict_1.default.equal(version.status, 'draft');
+        strict_1.default.match(version.packageSha256, /^[a-f0-9]{64}$/);
+        strict_1.default.equal(version.packagePath, (0, node_path_1.join)(userDataPath, 'automations', 'scripts', script.id, version.packageSha256));
+        strict_1.default.equal(version.shebang, '#!/bin/sh');
+        strict_1.default.deepEqual(version.config, {});
+        strict_1.default.equal(version.networkMode, 'none');
+        strict_1.default.equal(version.internalAccess, false);
+        strict_1.default.deepEqual(version.allowedReadDirs, []);
+        strict_1.default.deepEqual(version.env, []);
+        strict_1.default.deepEqual(version.limits, { timeoutMs: 30_000, stdoutBytes: 8192, stderrBytes: 8192, payloadBytes: 8192, stateBytes: 8192 });
+        store.close();
+        const reopened = new local_core_acp_store_js_1.LocalCoreAcpStore(userDataPath);
+        strict_1.default.equal(reopened.getAutomationScript(script.id)?.title, 'Check package');
+        strict_1.default.equal(reopened.listAutomationScriptVersions(script.id)[0]?.packageSha256, version.packageSha256);
+        reopened.close();
+    }
+    finally {
+        removeTempTree(userDataPath);
+        removeTempTree(sourceDir);
+    }
+});
+(0, node_test_1.default)('rejects malformed optional automation script version JSON fields', () => {
+    const userDataPath = tempDir('automation-script-store-');
+    const sourceDir = tempDir('automation-script-bundle-');
+    try {
+        writeBundle(sourceDir);
+        const store = new local_core_acp_store_js_1.LocalCoreAcpStore(userDataPath);
+        const script = store.createAutomationScript({
+            workspaceId: 'workspace-1',
+            title: 'Check package',
+        });
+        const version = store.createAutomationScriptVersionFromPackage({
+            scriptId: script.id,
+            sourceDir,
+            interpreterPath: '/bin/sh',
+            interpreterVersion: 'sh 1.0',
+        });
+        const db = store.db;
+        db.prepare('UPDATE automation_script_versions SET version_json = ? WHERE id = ?').run(JSON.stringify({
+            ...version,
+            testAuthorization: { actor: 42, at: version.createdAt },
+            approval: { actor: 'security', at: 'not-a-date' },
+            rejection: 'malformed',
+            revocation: { actor: 'security' },
+        }), version.id);
+        strict_1.default.throws(() => store.listAutomationScriptVersions(script.id), /testAuthorization|approval|rejection|revocation|invalid persisted data/i);
+        store.close();
+    }
+    finally {
+        removeTempTree(userDataPath);
+        removeTempTree(sourceDir);
+    }
+});
+(0, node_test_1.default)('stages an API source bundle through a server-owned directory without accepting source paths', () => {
+    const userDataPath = tempDir('automation-script-upload-');
+    try {
+        const store = new local_core_acp_store_js_1.LocalCoreAcpStore(userDataPath);
+        const script = store.createAutomationScript({ workspaceId: 'workspace-1', title: 'Uploaded script' });
+        const manifest = {
+            protocolVersion: 1, entrypoint: 'run.js', config: {}, configSchema: {},
+            capabilities: { network: 'none', internalAccess: false, allowedReadDirs: [] }, secretRefs: [], env: [], testPlan: {},
+            limits: { timeoutMs: 30_000, stdoutBytes: 8192, stderrBytes: 8192, payloadBytes: 8192, stateBytes: 8192 },
+        };
+        const staged = store.stageAutomationScriptSource({
+            scriptId: script.id,
+            files: [
+                { path: 'manifest.json', content: JSON.stringify(manifest) },
+                { path: 'run.js', content: '#!/usr/bin/env node\nprocess.stdout.write("{\\"protocolVersion\\":1,\\"matched\\":false}")\n' },
+            ],
+        });
+        const version = store.createAutomationScriptVersionFromStaged({
+            scriptId: script.id, staged, interpreterPath: node_process_1.default.execPath, interpreterVersion: node_process_1.default.version,
+        });
+        strict_1.default.equal(version.status, 'draft');
+        strict_1.default.match(version.packagePath, new RegExp(`automations[/\\\\]scripts`));
+        strict_1.default.throws(() => store.stageAutomationScriptSource({ scriptId: script.id, files: [{ path: '../escape', content: 'nope' }] }), /traversal|relative POSIX/i);
+        const discarded = store.stageAutomationScriptSource({
+            scriptId: script.id,
+            files: [
+                { path: 'manifest.json', content: JSON.stringify({ ...manifest, config: { discarded: true } }) },
+                { path: 'run.js', content: '#!/usr/bin/env node\nprocess.exit(0)\n' },
+            ],
+        });
+        strict_1.default.equal((0, node_fs_1.existsSync)(discarded.packagePath), true);
+        store.discardUnreferencedAutomationScriptPackage(script.id, discarded);
+        strict_1.default.equal((0, node_fs_1.existsSync)(discarded.packagePath), false);
+        store.close();
+    }
+    finally {
+        removeTempTree(userDataPath);
+    }
+});

package/dist-electron/tests/electron/automation-script-runner.test.js

@@ -0,0 +1,120 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_test_1 = __importDefault(require("node:test"));
+const script_protocol_runner_js_1 = require("../../services/local-ai-core/src/automation/scripts/script-protocol-runner.js");
+const anthropic_sandbox_runner_js_1 = require("../../services/local-ai-core/src/automation/scripts/anthropic-sandbox-runner.js");
+class FakeSandbox {
+    input;
+    result = { exitCode: 0, signal: null, stdout: '{"protocolVersion":1,"matched":true,"summary":"ok","nextState":{"cursor":2}}', stderr: 'diagnostic\u0001' };
+    async probe() { return { available: true, platform: 'test', missing: [] }; }
+    async run(input) {
+        this.input = input;
+        if (input.command.endsWith(' --version'))
+            return { exitCode: 0, signal: null, stdout: 'sh 1.0', stderr: '' };
+        return this.result;
+    }
+}
+function version(overrides = {}) {
+    const packageSha256 = overrides.packageSha256 || 'a'.repeat(64);
+    return {
+        id: 'version-1', scriptId: 'script-1', status: 'approved', packageSha256, packagePath: `/packages/${packageSha256}`,
+        shebang: '#!/bin/sh', interpreterPath: '/bin/sh', interpreterVersion: 'sh 1.0', capabilities: {}, config: { threshold: 2 }, configSchema: {},
+        networkMode: 'none', internalAccess: false, allowedReadDirs: [], secretRefs: [], env: [],
+        limits: { timeoutMs: 30_000, stdoutBytes: 1024, stderrBytes: 1024, payloadBytes: 256, stateBytes: 256 },
+        staticCheck: {}, testPlan: {}, createdAt: '2026-07-12T00:00:00.000Z', updatedAt: '2026-07-12T00:00:00.000Z', ...overrides,
+    };
+}
+function runner(sandbox = new FakeSandbox(), current = version()) {
+    return {
+        sandbox,
+        runner: new script_protocol_runner_js_1.ScriptProtocolRunner({
+            sandbox,
+            getVersion: () => current,
+            verifyPackage: () => undefined,
+            entrypointFor: () => 'run.sh',
+        }),
+    };
+}
+(0, node_test_1.default)('sends the exact v1 request and accepts exactly one v1 JSON response', async () => {
+    const { sandbox, runner: subject } = runner();
+    const result = await subject.run({ scriptId: 'script-1', approvedVersionId: 'version-1', evaluationId: 'evaluation-1', triggeredAt: '2026-07-12T01:02:03.000Z', previousState: { cursor: 1 } });
+    strict_1.default.deepEqual(JSON.parse(sandbox.input?.stdin || ''), {
+        protocolVersion: 1, evaluationId: 'evaluation-1', triggeredAt: '2026-07-12T01:02:03.000Z', config: { threshold: 2 }, previousState: { cursor: 1 },
+    });
+    strict_1.default.equal(sandbox.input?.timeoutMs, 30_000);
+    strict_1.default.equal(sandbox.input?.stdoutBytes, 1024);
+    strict_1.default.equal(sandbox.input?.stderrBytes, 1024);
+    strict_1.default.equal(result.matched, true);
+    strict_1.default.deepEqual(result.nextState, { cursor: 2 });
+    strict_1.default.equal(result.stderr, 'diagnostic');
+});
+(0, node_test_1.default)('rejects non-single JSON stdout, failed exits, and oversized response fields', async () => {
+    const { sandbox, runner: subject } = runner();
+    sandbox.result = { exitCode: 0, signal: null, stdout: '{"protocolVersion":1,"matched":false}\n{}', stderr: '' };
+    await strict_1.default.rejects(subject.run({ scriptId: 'script-1', approvedVersionId: 'version-1', evaluationId: 'e', triggeredAt: '2026-07-12T00:00:00.000Z', previousState: {} }), /exactly one JSON/i);
+    sandbox.result = { exitCode: 1, signal: null, stdout: '', stderr: 'failure' };
+    await strict_1.default.rejects(subject.run({ scriptId: 'script-1', approvedVersionId: 'version-1', evaluationId: 'e', triggeredAt: '2026-07-12T00:00:00.000Z', previousState: {} }), /exit code 1/i);
+    sandbox.result = { exitCode: 0, signal: null, stdout: '{"protocolVersion":1,"matched":true,"payload":{"long":"'.concat('x'.repeat(300), '"}}'), stderr: '' };
+    await strict_1.default.rejects(subject.run({ scriptId: 'script-1', approvedVersionId: 'version-1', evaluationId: 'e', triggeredAt: '2026-07-12T00:00:00.000Z', previousState: {} }), /payload exceeds/i);
+    sandbox.result = { exitCode: 0, signal: null, stdout: '{"protocolVersion":1,"matched":true,"extra":1}', stderr: '' };
+    await strict_1.default.rejects(subject.run({ scriptId: 'script-1', approvedVersionId: 'version-1', evaluationId: 'e', triggeredAt: '2026-07-12T00:00:00.000Z', previousState: {} }), /unsupported field/i);
+});
+(0, node_test_1.default)('runtime sandbox loss after probing blocks execution fail-closed', async () => {
+    class LostSandbox extends FakeSandbox {
+        async run(input) {
+            if (input.command.endsWith(' --version'))
+                return { exitCode: 0, signal: null, stdout: 'sh 1.0', stderr: '' };
+            throw new anthropic_sandbox_runner_js_1.SandboxUnavailableError(['sandbox_runtime']);
+        }
+    }
+    const subject = runner(new LostSandbox()).runner;
+    await strict_1.default.rejects(subject.run({ scriptId: 'script-1', approvedVersionId: 'version-1', evaluationId: 'e', triggeredAt: '2026-07-12T00:00:00.000Z', previousState: {} }), (error) => error instanceof script_protocol_runner_js_1.ScriptProtocolError && error.code === 'sandbox_unavailable' && error.blockAutomation);
+});
+(0, node_test_1.default)('fails closed before execution for non-approved, changed package, or interpreter facts', async () => {
+    for (const changed of [version({ status: 'tested' }), version({ packageSha256: 'b'.repeat(64), packagePath: '/packages/a' }), version({ interpreterVersion: 'different' })]) {
+        const { sandbox, runner: subject } = runner(new FakeSandbox(), changed);
+        await strict_1.default.rejects(subject.run({ scriptId: 'script-1', approvedVersionId: 'version-1', evaluationId: 'e', triggeredAt: '2026-07-12T00:00:00.000Z', previousState: {} }), (error) => error instanceof script_protocol_runner_js_1.ScriptProtocolError && error.blockAutomation);
+        strict_1.default.equal(sandbox.input?.stdin, undefined);
+    }
+});
+(0, node_test_1.default)('enforces a 30 second default and five minute maximum', async () => {
+    const { sandbox, runner: subject } = runner(new FakeSandbox(), version({ limits: { timeoutMs: 999_999, stdoutBytes: 1024, stderrBytes: 1024, payloadBytes: 256, stateBytes: 256 } }));
+    await subject.run({ scriptId: 'script-1', approvedVersionId: 'version-1', evaluationId: 'e', triggeredAt: '2026-07-12T00:00:00.000Z', previousState: {} });
+    strict_1.default.equal(sandbox.input?.timeoutMs, 300_000);
+});
+(0, node_test_1.default)('validates an interpreter only through the sandbox boundary', async () => {
+    const sandbox = new FakeSandbox();
+    const current = version({ interpreterPath: '/untrusted/side-effect-interpreter', interpreterVersion: 'different' });
+    const subject = new script_protocol_runner_js_1.ScriptProtocolRunner({ sandbox, getVersion: () => current, verifyPackage: () => undefined, entrypointFor: () => 'run.sh' });
+    await strict_1.default.rejects(subject.run({ scriptId: 'script-1', approvedVersionId: 'version-1', evaluationId: 'e', triggeredAt: '2026-07-12T00:00:00.000Z', previousState: {} }), (error) => error instanceof script_protocol_runner_js_1.ScriptProtocolError && error.code === 'interpreter_mismatch');
+    strict_1.default.match(sandbox.input?.command || '', /untrusted\/side-effect-interpreter/);
+    strict_1.default.equal(sandbox.input?.stdin, undefined);
+});
+(0, node_test_1.default)('injects only declared env secrets for one process and redacts them from persisted output', async () => {
+    const sandbox = new FakeSandbox();
+    sandbox.result = { exitCode: 0, signal: null, stdout: '{"protocolVersion":1,"matched":true,"summary":"token-value"}', stderr: 'token-value\u0002' };
+    const current = version({ secretRefs: ['env://API_TOKEN'], env: ['API_TOKEN'] });
+    const subject = new script_protocol_runner_js_1.ScriptProtocolRunner({
+        sandbox, getVersion: () => current, verifyPackage: () => undefined, entrypointFor: () => 'run.sh',
+        secretResolver: { get: (name) => name === 'API_TOKEN' ? 'token-value' : undefined },
+    });
+    const result = await subject.run({ scriptId: 'script-1', approvedVersionId: 'version-1', evaluationId: 'e', triggeredAt: '2026-07-12T00:00:00.000Z', previousState: {} });
+    strict_1.default.deepEqual(sandbox.input?.env, { API_TOKEN: 'token-value' });
+    strict_1.default.deepEqual(sandbox.input?.allowedEnv, ['API_TOKEN']);
+    strict_1.default.equal(result.summary, '[REDACTED]');
+    strict_1.default.equal(result.stderr, '');
+});
+(0, node_test_1.default)('fails with secret_unavailable without running undeclared or unavailable secrets', async () => {
+    const sandbox = new FakeSandbox();
+    const current = version({ secretRefs: ['env://API_TOKEN'], env: [] });
+    const subject = new script_protocol_runner_js_1.ScriptProtocolRunner({
+        sandbox, getVersion: () => current, verifyPackage: () => undefined, entrypointFor: () => 'run.sh',
+        secretResolver: { get: () => 'must-not-read' },
+    });
+    await strict_1.default.rejects(subject.run({ scriptId: 'script-1', approvedVersionId: 'version-1', evaluationId: 'e', triggeredAt: '2026-07-12T00:00:00.000Z', previousState: {} }), (error) => error instanceof script_protocol_runner_js_1.ScriptProtocolError && error.code === 'secret_unavailable');
+    strict_1.default.equal(sandbox.input?.stdin, undefined);
+});