@oneuptime/common 12.0.6 → 12.0.8

package/Tests/Server/Utils/AI/CodeAgentCommandGuard.test.ts

@@ -0,0 +1,204 @@
+/*
+ * ---------------------------------------------------------------------------
+ * Unit tests for CodeAgentWorkspaceGuard.evaluateCommand — the rail that keeps
+ * the code agent's shell out of the repository's git state.
+ *
+ * The pipeline owns git: it cuts the branch, decides what to stage, writes the
+ * commit and pushes. It also decides "did the agent change anything" by
+ * looking at the working tree. So a model that helpfully runs `git commit`
+ * does not merely duplicate work — it leaves a CLEAN tree behind, the run
+ * reports no changes, and the fix is discarded without anyone seeing it. A
+ * `git checkout .` erases the fix outright; a `git push` puts a branch on the
+ * customer's remote that no pull request points at.
+ *
+ * The system prompt already tells the model not to do this. These tests exist
+ * because an instruction is not a control.
+ *
+ * What this is NOT: a sandbox. Shell is too expressive to filter
+ * adversarially, and the tests below say so explicitly where it matters. The
+ * containment boundary is elsewhere — the workspace is ephemeral, the
+ * credential is not in it, and nothing merges without a human. This guard
+ * stops a well-meaning model taking an obvious wrong turn, and the read-only
+ * git the agent genuinely needs stays available.
+ * ---------------------------------------------------------------------------
+ */
+
+import CodeAgentWorkspaceGuard, {
+  CommandGuardDecision,
+} from "../../../../Server/Utils/AI/CodeFix/CodeAgentWorkspaceGuard";
+
+function evaluate(command: string): CommandGuardDecision {
+  return CodeAgentWorkspaceGuard.evaluateCommand(command);
+}
+
+describe("commands the agent must be able to run", () => {
+  /*
+   * Building and testing IS the point of run_command — the verification loop
+   * depends on the agent being able to check its own work. A guard that broke
+   * these would be worse than no guard, because the agent would stop
+   * self-checking and the pull requests would get worse.
+   */
+  test.each([
+    "npm test",
+    "npm ci && npm run build",
+    "yarn jest src/checkout.test.ts",
+    "pytest -q",
+    "go build ./...",
+    "make lint",
+    "ls -la src",
+    "cat package.json",
+    "grep -rn 'checkout' src",
+    'node -e "console.log(1)"',
+    "./gradlew test --no-daemon",
+  ])("allows %s", (command: string) => {
+    expect(evaluate(command).allowed).toBe(true);
+  });
+
+  /*
+   * Read-only git is how an agent orients itself in an unfamiliar repository:
+   * what changed, what the history says, who touched this line. Refusing it
+   * would make the agent worse at the job without making anything safer.
+   */
+  test.each([
+    "git status",
+    "git diff",
+    "git diff --staged",
+    "git log --oneline -20",
+    "git show HEAD",
+    "git grep -n TODO",
+    "git blame src/checkout.ts",
+    "git ls-files",
+    "git rev-parse HEAD",
+    "git describe --tags",
+  ])("allows read-only git: %s", (command: string) => {
+    expect(evaluate(command).allowed).toBe(true);
+  });
+});
+
+describe("git commands that would destroy or bypass the pipeline", () => {
+  /*
+   * `commit` and `checkout`/`reset` are the two that silently lose the fix:
+   * both leave a clean working tree, which the pipeline reads as "the agent
+   * changed nothing" — so the run reports no fix found and the work is gone.
+   */
+  test.each([
+    "git commit -m 'fix'",
+    "git commit -am wip",
+    "git push",
+    "git push origin HEAD",
+    "git push --force",
+    "git reset --hard",
+    "git checkout .",
+    "git checkout -- src/checkout.ts",
+    "git switch main",
+    "git restore src/checkout.ts",
+    "git stash",
+    "git clean -fd",
+    "git rebase main",
+    "git merge origin/main",
+    "git cherry-pick abc123",
+    "git revert HEAD",
+    "git apply patch.diff",
+    "git remote set-url origin https://example.com",
+    "git config user.email nobody@example.com",
+  ])("refuses %s", (command: string) => {
+    const decision: CommandGuardDecision = evaluate(command);
+
+    expect(decision.allowed).toBe(false);
+    expect(decision.reason).toBeTruthy();
+  });
+
+  /*
+   * The refusal is handed straight back to the model as the tool result, so
+   * it has to teach rather than just deny — otherwise the model retries the
+   * same command and burns the run's LLM budget doing it.
+   */
+  test("the refusal explains what to do instead", () => {
+    const reason: string = evaluate("git commit -m x").reason || "";
+
+    expect(reason).toContain("write_file");
+    // It says what IS still available, so the agent does not stop using git entirely.
+    expect(reason.toLowerCase()).toContain("read-only git");
+  });
+});
+
+describe("the forms a model actually emits", () => {
+  /*
+   * Models chain commands constantly ("run the tests and then commit"). A
+   * guard that only inspects the first word of the string would wave every
+   * one of these through.
+   */
+  test.each([
+    "npm test && git commit -am 'fix'",
+    "npm test ; git push",
+    "npm test || git reset --hard",
+    "cd src && git checkout .",
+    "npm run build\ngit commit -m done",
+    "echo start; npm test; git push origin fix",
+  ])("sees the git in a chained command: %s", (command: string) => {
+    expect(evaluate(command).allowed).toBe(false);
+  });
+
+  test("sees git inside a subshell or command substitution", () => {
+    expect(evaluate("(git push)").allowed).toBe(false);
+    expect(evaluate("echo $(git commit -m x)").allowed).toBe(false);
+    expect(evaluate("echo `git push`").allowed).toBe(false);
+  });
+
+  test("sees git behind a leading environment assignment", () => {
+    expect(evaluate("GIT_AUTHOR_NAME=x git commit -m y").allowed).toBe(false);
+    expect(
+      evaluate("GIT_AUTHOR_NAME=x GIT_AUTHOR_EMAIL=y@z git push").allowed,
+    ).toBe(false);
+  });
+
+  test("sees git invoked by absolute path or quoted", () => {
+    expect(evaluate("/usr/bin/git push").allowed).toBe(false);
+    expect(evaluate('"git" commit -m x').allowed).toBe(false);
+  });
+
+  /*
+   * git's own global options come BEFORE the subcommand, and two of them
+   * consume the following token. `git -C sub push` must not read as
+   * subcommand "-C".
+   */
+  test("skips git's global options to find the real subcommand", () => {
+    expect(evaluate("git -C packages/api push").allowed).toBe(false);
+    expect(evaluate("git -c user.name=x commit -m y").allowed).toBe(false);
+    expect(evaluate("git --git-dir .git push").allowed).toBe(false);
+    expect(evaluate("git --no-pager log -5").allowed).toBe(true);
+    expect(evaluate("git -C packages/api status").allowed).toBe(true);
+  });
+
+  test("is case-insensitive about the subcommand", () => {
+    expect(evaluate("git PUSH").allowed).toBe(false);
+  });
+});
+
+describe("what the guard deliberately does not claim", () => {
+  /*
+   * Stated as a test so nobody mistakes this for a security boundary later.
+   * A determined adversary reaches git through an alias, a wrapper script, a
+   * variable, or a language runtime — and that is fine, because this guard is
+   * not what makes the harness safe. The real boundary is that the workspace
+   * is ephemeral and credential-free, and that a human merges.
+   */
+  test("an aliased or indirect invocation is not caught — this is a rail, not a sandbox", () => {
+    expect(evaluate("g=git; $g push").allowed).toBe(true);
+    expect(
+      evaluate("node -e \"require('child_process').execSync('git push')\"")
+        .allowed,
+    ).toBe(true);
+  });
+
+  test("a command merely mentioning git in text is allowed", () => {
+    // The word appears, but nothing invokes git.
+    expect(evaluate("echo 'do not run git push here'").allowed).toBe(true);
+    expect(evaluate("grep -rn 'git commit' docs/").allowed).toBe(true);
+  });
+
+  test("an empty or whitespace command is allowed (the caller rejects it first)", () => {
+    expect(evaluate("").allowed).toBe(true);
+    expect(evaluate("   ").allowed).toBe(true);
+  });
+});

package/Tests/Server/Utils/AI/CodeAgentWriteLimits.test.ts

@@ -0,0 +1,213 @@
+/*
+ * ---------------------------------------------------------------------------
+ * The two size limits on the code agent's workspace tools, and the workspace
+ * escape guard they sit next to.
+ *
+ * Both limits exist because the model on the other end of these tools is
+ * untrusted in the specific sense that matters here: it is not malicious, but
+ * its entire context is attacker-influenceable (a stack trace, an incident
+ * summary, and the contents of the repository it is reading), and it can loop.
+ *
+ *   - MAX_TOOL_OUTPUT_CHARS bounds what comes BACK from a tool into the
+ *     model's context. Without it, one `read_file` on a generated bundle
+ *     spends the whole run's context on a single file — and the model has no
+ *     way to know it saw only part of it, so it reasons confidently about a
+ *     file it never fully read.
+ *   - MAX_WRITE_FILE_CHARS bounds what goes OUT to disk. A model looping on a
+ *     generation bug can otherwise fill the Runner's disk from inside a tool
+ *     call, taking down every other capability on the host — runbooks
+ *     included — for every project that Runner serves.
+ *
+ * The escape guard is tested in CodeAgentWorkspaceGuard.test.ts; what is
+ * added here are the interactions between the guard and the paths a model
+ * actually produces.
+ * ---------------------------------------------------------------------------
+ */
+
+import CodeAgentWorkspaceGuard, {
+  MAX_TOOL_OUTPUT_CHARS,
+  MAX_WRITE_FILE_CHARS,
+} from "../../../../Server/Utils/AI/CodeFix/CodeAgentWorkspaceGuard";
+import path from "path";
+
+const WORKSPACE: string = "/tmp/oneuptime-ai-agent/task-1/acme__checkout";
+
+describe("MAX_WRITE_FILE_CHARS", () => {
+  /*
+   * The number itself is part of the contract: generous enough that no
+   * legitimate source file a fix writes comes close, small enough that a
+   * looping model cannot exhaust a disk before the run's other limits stop
+   * it. A change to it should be a deliberate decision, not a drift.
+   */
+  test("is 2 MB — far above any real source file, far below a disk", () => {
+    expect(MAX_WRITE_FILE_CHARS).toBe(2_000_000);
+  });
+
+  test("is much larger than the tool-output cap, because writing is not reading", () => {
+    expect(MAX_WRITE_FILE_CHARS).toBeGreaterThan(MAX_TOOL_OUTPUT_CHARS * 10);
+  });
+});
+
+describe("truncateToolOutput", () => {
+  test("output within the cap is returned byte for byte", () => {
+    const output: string = "export const a: number = 1;\n";
+
+    expect(CodeAgentWorkspaceGuard.truncateToolOutput(output)).toBe(output);
+  });
+
+  test("output exactly at the cap is not touched", () => {
+    const output: string = "x".repeat(MAX_TOOL_OUTPUT_CHARS);
+
+    expect(CodeAgentWorkspaceGuard.truncateToolOutput(output)).toBe(output);
+  });
+
+  /*
+   * The marker is not decoration. Without it the model cannot distinguish
+   * "this file ends here" from "you were shown the first 20,000 characters",
+   * and will happily rewrite a file based on a prefix of it.
+   */
+  test("oversized output is cut AND says so", () => {
+    const truncated: string = CodeAgentWorkspaceGuard.truncateToolOutput(
+      "y".repeat(MAX_TOOL_OUTPUT_CHARS + 5000),
+    );
+
+    expect(truncated).toContain("output truncated");
+    expect(truncated.startsWith("y".repeat(100))).toBe(true);
+  });
+
+  test("the marker names the limit, so the model knows how much it missed", () => {
+    const truncated: string = CodeAgentWorkspaceGuard.truncateToolOutput(
+      "z".repeat(MAX_TOOL_OUTPUT_CHARS + 1),
+    );
+
+    expect(truncated).toContain(MAX_TOOL_OUTPUT_CHARS.toLocaleString());
+  });
+
+  test("a caller may tighten the limit for its own tool", () => {
+    expect(CodeAgentWorkspaceGuard.truncateToolOutput("abcdef", 3)).toContain(
+      "abc",
+    );
+    expect(CodeAgentWorkspaceGuard.truncateToolOutput("abcdef", 3)).toContain(
+      "truncated",
+    );
+  });
+
+  test("empty output stays empty rather than gaining a marker", () => {
+    expect(CodeAgentWorkspaceGuard.truncateToolOutput("")).toBe("");
+  });
+});
+
+describe("resolveWorkspacePath against the paths a model actually emits", () => {
+  test("a plain relative path resolves inside the workspace", () => {
+    expect(
+      CodeAgentWorkspaceGuard.resolveWorkspacePath(
+        WORKSPACE,
+        "src/checkout.ts",
+      ),
+    ).toBe(path.join(WORKSPACE, "src/checkout.ts"));
+  });
+
+  /*
+   * Models routinely echo back the absolute paths they were shown in an
+   * earlier tool result. Refusing those would make the agent fight its own
+   * transcript, so absolute paths INSIDE the workspace are allowed.
+   */
+  test("an absolute path inside the workspace is allowed", () => {
+    const absolute: string = path.join(WORKSPACE, "src/checkout.ts");
+
+    expect(
+      CodeAgentWorkspaceGuard.resolveWorkspacePath(WORKSPACE, absolute),
+    ).toBe(absolute);
+  });
+
+  test("a path with redundant segments still resolves inside", () => {
+    expect(
+      CodeAgentWorkspaceGuard.resolveWorkspacePath(
+        WORKSPACE,
+        "./src/../src/checkout.ts",
+      ),
+    ).toBe(path.join(WORKSPACE, "src/checkout.ts"));
+  });
+
+  test.each([
+    ["parent traversal", "../escaped.ts"],
+    ["deep traversal", "../../../../etc/passwd"],
+    ["traversal hidden mid-path", "src/../../escaped.ts"],
+    ["an absolute path elsewhere", "/etc/passwd"],
+    ["the user's ssh keys", "/root/.ssh/id_rsa"],
+  ])("refuses %s", (_label: string, requestedPath: string) => {
+    expect(() => {
+      return CodeAgentWorkspaceGuard.resolveWorkspacePath(
+        WORKSPACE,
+        requestedPath,
+      );
+    }).toThrow("escapes the workspace");
+  });
+
+  /*
+   * The sibling-prefix case: `/…/acme__checkout-backup` starts with the
+   * workspace path as a plain string but is a different directory. A
+   * `startsWith` without the separator lets it through — the same defect
+   * WorkspaceManager.deleteWorkspace had, where it would have meant
+   * recursively deleting the wrong directory.
+   */
+  test("refuses a sibling directory whose name merely starts with the workspace's", () => {
+    expect(() => {
+      return CodeAgentWorkspaceGuard.resolveWorkspacePath(
+        WORKSPACE,
+        `${WORKSPACE}-backup/secrets.env`,
+      );
+    }).toThrow("escapes the workspace");
+  });
+
+  test("the workspace root itself is allowed — list_directory defaults to it", () => {
+    expect(CodeAgentWorkspaceGuard.resolveWorkspacePath(WORKSPACE, ".")).toBe(
+      path.resolve(WORKSPACE),
+    );
+  });
+
+  test.each([
+    ["an empty path", ""],
+    ["a null path", null],
+    ["a number", 42],
+  ])("refuses %s with a clear message", (_label: string, value: unknown) => {
+    expect(() => {
+      return CodeAgentWorkspaceGuard.resolveWorkspacePath(
+        WORKSPACE,
+        value as string,
+      );
+    }).toThrow("A file path is required");
+  });
+});
+
+describe("toWorkspaceRelativePath", () => {
+  test("turns a guarded absolute path back into what the trail should show", () => {
+    expect(
+      CodeAgentWorkspaceGuard.toWorkspaceRelativePath(
+        WORKSPACE,
+        path.join(WORKSPACE, "src/checkout.ts"),
+      ),
+    ).toBe("src/checkout.ts");
+  });
+
+  test("the workspace root reads as '.' rather than as an empty string", () => {
+    expect(
+      CodeAgentWorkspaceGuard.toWorkspaceRelativePath(WORKSPACE, WORKSPACE),
+    ).toBe(".");
+  });
+
+  /*
+   * Every narration in the run's trail goes through this. A path that leaked
+   * the Runner's temp directory into the customer-visible activity feed would
+   * be noise at best and infrastructure detail at worst.
+   */
+  test("never leaks the absolute workspace location into the trail", () => {
+    const relative: string = CodeAgentWorkspaceGuard.toWorkspaceRelativePath(
+      WORKSPACE,
+      path.join(WORKSPACE, "deep/nested/file.ts"),
+    );
+
+    expect(relative).toBe("deep/nested/file.ts");
+    expect(relative).not.toContain("/tmp");
+  });
+});

package/Tests/Server/Utils/AI/CodeWriteTools.test.ts

@@ -214,10 +214,20 @@ describe("open_code_pull_request", () => {
     } as never);
   }
 
-  test("opens a DRAFT pull request and says it is not merged", async () => {
+  /*
+   * The PR opens READY FOR REVIEW, not as a draft. A draft reaches no
+   * reviewer, no CODEOWNERS rule and no review automation, so drafting by
+   * default hid the agent's output where nobody was asked to look.
+   *
+   * Read this as a VISIBILITY change only. The safety boundary is the branch
+   * policy asserted above (never the default branch, never a protected one)
+   * plus the fact that nothing is merged automatically — and the model must
+   * keep saying so, which is what the dataForLlm assertions pin.
+   */
+  test("opens the pull request ready for review, not as a draft", async () => {
     mockHappyPath();
 
-    const result: ToolExecutionResult = await OpenCodePullRequestTool.execute(
+    await OpenCodePullRequestTool.execute(
       { title: "Fix charge", description: "why", changes: CHANGES },
       ctx,
     );
@@ -225,13 +235,50 @@ describe("open_code_pull_request", () => {
     const prCall: { isDraft: boolean } = (
       GitHubUtil.createPullRequestWithToken as unknown as jest.Mock
     ).mock.calls[0][0];
-    expect(prCall.isDraft).toBe(true);
+    expect(prCall.isDraft).toBe(false);
+  });
+
+  test("tells the model the PR is open, unmerged, and needs review", async () => {
+    mockHappyPath();
 
-    expect(result.dataForLlm).toContain("DRAFT");
+    const result: ToolExecutionResult = await OpenCodePullRequestTool.execute(
+      { title: "Fix charge", description: "why", changes: CHANGES },
+      ctx,
+    );
+
+    expect(result.dataForLlm).toContain("ready for review");
     expect(result.dataForLlm).toContain("NOT merged");
+    expect(result.dataForLlm).toContain("needs their review");
     expect(result.dataForLlm).toContain("/pull/7");
   });
 
+  /*
+   * The tool result is read back by the model and paraphrased to the user. If
+   * it still called the PR a draft, the model would tell the user to go mark
+   * it ready — an instruction for a state the PR is no longer in.
+   */
+  test("never describes the pull request as a draft to the model", async () => {
+    mockHappyPath();
+
+    const result: ToolExecutionResult = await OpenCodePullRequestTool.execute(
+      { title: "Fix charge", description: "why", changes: CHANGES },
+      ctx,
+    );
+
+    expect(result.dataForLlm.toLowerCase()).not.toContain("draft");
+    expect((result.citationLabel || "").toLowerCase()).not.toContain("draft");
+  });
+
+  test("the tool description no longer promises a draft", () => {
+    expect(OpenCodePullRequestTool.description.toLowerCase()).not.toContain(
+      "draft",
+    );
+    expect(OpenCodePullRequestTool.description).toContain("ready for review");
+    expect(OpenCodePullRequestTool.description).toContain(
+      "never writes to the default branch",
+    );
+  });
+
   /*
    * Chat PRs are recorded as AIAgentTaskPullRequest rows so the same per-repo
    * cap the autonomous agent obeys can see them. If they were not recorded,
@@ -473,7 +520,7 @@ describe("permission-mode gating", () => {
   test("the approval card names the action concretely", () => {
     expect(
       OpenCodePullRequestTool.buildActionTitle!({ title: "Fix charge bug" }),
-    ).toBe("Open draft pull request: Fix charge bug");
+    ).toBe("Open pull request: Fix charge bug");
 
     expect(
       CommitCodeToBranchTool.buildActionTitle!({

package/Tests/Server/Utils/AI/LLMServiceBaseUrl.test.ts

@@ -4,6 +4,7 @@ import URL from "../../../../Types/API/URL";
 import { JSONObject } from "../../../../Types/JSON";
 import LlmType from "../../../../Types/LLM/LlmType";
 import LLMService from "../../../../Server/Utils/LLM/LLMService";
+import stubLLMEgressGuard from "./StubLLMEgressGuard";
 import { afterEach, describe, expect, jest, test } from "@jest/globals";
 
 /*
@@ -15,6 +16,8 @@ import { afterEach, describe, expect, jest, test } from "@jest/globals";
  */
 
 function mockPostSuccess(): void {
+  // Placeholder hosts; egress policy is covered by LLMServiceEgressGuard.test.ts.
+  stubLLMEgressGuard();
   jest.spyOn(API, "post").mockResolvedValue({
     jsonData: {
       choices: [{ message: { content: "ok" } }],