@p10i/create-nestbox 0.1.2 → 0.2.0

package/tests/creator.mjs

@@ -0,0 +1,42 @@
+import { spawnSync } from 'node:child_process';
+import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+
+const fixture = await mkdtemp(join(tmpdir(), 'nestbox-creator-'));
+
+function create(target, layout) {
+  const result = spawnSync(process.execPath, [resolve('bin/create-nestbox.js'), target, '--layout', layout, '--yes', '--no-git'], { encoding: 'utf8', env: { ...process.env, NESTBOX_CREATOR_STATE_ROOT: join(fixture, 'state') } });
+  if (result.status !== 0) throw new Error(`Creator failed for ${layout}: ${result.stderr || result.stdout}`);
+}
+
+try {
+  const nested = join(fixture, 'nested');
+  await mkdir(nested);
+  await writeFile(join(nested, 'package.json'), JSON.stringify({ name: 'existing', scripts: { build: 'node build.mjs' } }));
+  create(nested, 'nestbox');
+  const nestedPackage = JSON.parse(await readFile(join(nested, 'package.json'), 'utf8'));
+  if (nestedPackage.name !== 'existing' || nestedPackage.scripts.build !== 'node build.mjs') throw new Error('Creator replaced existing package metadata.');
+  if (nestedPackage.scripts.host !== 'node .nestbox/host-runner.mjs') throw new Error('Nested host script has the wrong path.');
+  const nestedEnv = await readFile(join(nested, '.nestbox', '.env'), 'utf8');
+  if (!/^WORKSPACE_PATH=\.\.$/m.test(nestedEnv) || !/^NESTBOX_HOST_QUEUE_PATH=.+$/m.test(nestedEnv)) throw new Error('Nested runtime paths were not configured.');
+  const npmCommand = process.env.npm_execpath ? process.execPath : (process.platform === 'win32' ? 'npm.cmd' : 'npm');
+  const npmArgs = process.env.npm_execpath ? [process.env.npm_execpath, 'run', 'test:host'] : ['run', 'test:host'];
+  const nestedHostTest = spawnSync(npmCommand, npmArgs, { cwd: nested, encoding: 'utf8' });
+  if (nestedHostTest.status !== 0) throw new Error(`Nested host test script failed: ${nestedHostTest.error?.message || nestedHostTest.stderr || nestedHostTest.stdout}`);
+
+  const direct = join(fixture, 'direct');
+  create(direct, 'current');
+  const directPackage = JSON.parse(await readFile(join(direct, 'package.json'), 'utf8'));
+  if (directPackage.scripts.host !== 'node host-runner.mjs' || directPackage.scripts['test:host'] !== 'node tests/host-runner.mjs') throw new Error('Direct host scripts have the wrong paths.');
+
+  const conflicting = join(fixture, 'conflicting');
+  await mkdir(conflicting);
+  await writeFile(join(conflicting, 'package.json'), JSON.stringify({ scripts: { host: 'node something-else.mjs' } }));
+  const conflict = spawnSync(process.execPath, [resolve('bin/create-nestbox.js'), conflicting, '--layout', 'nestbox', '--yes', '--no-git'], { encoding: 'utf8', env: { ...process.env, NESTBOX_CREATOR_STATE_ROOT: join(fixture, 'state') } });
+  if (conflict.status === 0 || !conflict.stderr.includes('Refusing to overwrite')) throw new Error('Creator accepted a conflicting host script.');
+
+  console.log('Creator tests passed.');
+} finally {
+  await rm(fixture, { recursive: true, force: true });
+}

package/tests/host-runner.mjs

@@ -0,0 +1,103 @@
+import { spawn } from 'node:child_process';
+import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const fixture = await mkdtemp(join(tmpdir(), 'nestbox-host-runner-'));
+const testDirectory = dirname(fileURLToPath(import.meta.url));
+const runnerPath = resolve(testDirectory, '..', 'host-runner.mjs');
+const queue = `${fixture}-queue`;
+const requests = join(queue, 'requests');
+const running = join(queue, 'running');
+const results = join(queue, 'results');
+let runner;
+let stdout = '';
+
+async function waitFor(path, timeout = 10000) {
+  const deadline = Date.now() + timeout;
+  while (Date.now() < deadline) {
+    try { return await readFile(path, 'utf8'); }
+    catch (error) { if (error?.code !== 'ENOENT') throw error; }
+    await new Promise(resolveWait => setTimeout(resolveWait, 25));
+  }
+  throw new Error(`Timed out waiting for ${path}`);
+}
+
+async function waitForEvent(type, requestId) {
+  const deadline = Date.now() + 10000;
+  while (Date.now() < deadline) {
+    for (const line of stdout.split(/\r?\n/).filter(Boolean)) {
+      const event = JSON.parse(line);
+      if (event.type === type && (!requestId || event.requestId === requestId)) return event;
+    }
+    await new Promise(resolveWait => setTimeout(resolveWait, 25));
+  }
+  throw new Error(`Timed out waiting for ${type}`);
+}
+
+async function submit(job) {
+  await writeFile(join(requests, `${job.jobId}.json`), JSON.stringify({ schemaVersion: 1, ...job }));
+  return JSON.parse(await waitFor(join(results, `${job.jobId}.json`)));
+}
+
+try {
+  await Promise.all([mkdir(requests, { recursive: true }), mkdir(running, { recursive: true })]);
+  await writeFile(join(running, 'interrupted-job.json'), JSON.stringify({ schemaVersion: 1, jobId: 'interrupted-job', type: 'npm.run', script: 'ok', args: [] }));
+  await writeFile(join(fixture, 'package.json'), JSON.stringify({
+    private: true,
+    scripts: {
+      host: 'node host-runner.mjs',
+      ok: `node -e "process.stdout.write('host-ok')"`,
+      fail: `node -e "process.stderr.write('host-failed'); process.exit(7)"`,
+    },
+  }));
+  runner = spawn(process.execPath, [runnerPath, '--json'], {
+    env: { ...process.env, NESTBOX_HOST_WORKSPACE: fixture, NESTBOX_HOST_QUEUE: queue },
+    stdio: ['ignore', 'pipe', 'pipe'],
+    windowsHide: true,
+  });
+  let stderr = '';
+  runner.stdout.on('data', chunk => stdout += chunk);
+  runner.stderr.on('data', chunk => stderr += chunk);
+  await waitFor(join(queue, 'heartbeat.json'));
+  const interrupted = JSON.parse(await waitFor(join(results, 'interrupted-job.json')));
+  if (!interrupted.interrupted || interrupted.exitCode !== 1) throw new Error('Interrupted job was replayed instead of rejected.');
+
+  const success = await submit({ jobId: 'job-ok', type: 'npm.run', script: 'ok', args: [] });
+  const failure = await submit({ jobId: 'job-fail', type: 'npm.run', script: 'fail', args: [] });
+  if (success.exitCode !== 0 || !success.stdout.includes('host-ok') || !success.hostPlatform) throw new Error('Successful host result was not preserved.');
+  if (failure.exitCode !== 7 || !failure.stderr.includes('host-failed')) throw new Error('Failed host result was not preserved.');
+
+  const requestId = 'npm-script-request-test-add';
+  const requested = await submit({ jobId: requestId, type: 'npm.scripts.request', requestId, operation: 'add', name: 'approved', command: `node -e "process.stdout.write('approved')"` });
+  const event = await waitForEvent('npm.scripts.confirmation_required', requestId);
+  if (requested.status !== 'confirmation_required' || Object.hasOwn(requested, 'code')) throw new Error('Script request exposed its confirmation code.');
+  const confirmed = await submit({ jobId: 'confirm-add', type: 'npm.scripts.confirm', requestId, code: event.code });
+  const changed = JSON.parse(await readFile(join(fixture, 'package.json'), 'utf8'));
+  if (confirmed.status !== 'success' || !changed.scripts.approved) throw new Error('Approved script was not added.');
+
+  const raceId = 'npm-script-request-race-test';
+  await submit({ jobId: raceId, type: 'npm.scripts.request', requestId: raceId, operation: 'edit', name: 'approved', command: 'node changed.mjs' });
+  const raceEvent = await waitForEvent('npm.scripts.confirmation_required', raceId);
+  changed.scripts.concurrent = 'node concurrent.mjs';
+  await writeFile(join(fixture, 'package.json'), JSON.stringify(changed));
+  const raced = await submit({ jobId: 'confirm-race', type: 'npm.scripts.confirm', requestId: raceId, code: raceEvent.code });
+  if (raced.exitCode !== 1 || !raced.stderr.includes('changed after approval')) throw new Error('Concurrent package change was overwritten.');
+
+  const protectedResult = await submit({ jobId: 'protected-host', type: 'npm.scripts.request', requestId: 'protected-host', operation: 'delete', name: 'host' });
+  if (protectedResult.exitCode !== 1 || !protectedResult.stderr.includes('cannot be changed')) throw new Error('Core host script was not protected.');
+
+  const exit = new Promise((resolveExit, reject) => {
+    runner.on('error', reject);
+    runner.on('close', code => code === 0 || code === null ? resolveExit() : reject(new Error(`Runner exited ${code}: ${stderr}`)));
+  });
+  runner.kill('SIGTERM');
+  await exit;
+  runner = undefined;
+  console.log('Host runner tests passed.');
+} finally {
+  runner?.kill('SIGTERM');
+  await rm(fixture, { recursive: true, force: true });
+  await rm(queue, { recursive: true, force: true });
+}

package/tests/nestbox.ps1

@@ -91,6 +91,9 @@ function Invoke-Http([string]$Path, [string]$HostHeader = '', [string]$Method =
 
 try {
     New-Item -ItemType Directory -Path $TempDirectory | Out-Null
+    $configuredQueue = [regex]::Match([IO.File]::ReadAllText((Join-Path $Root '.env')), '(?m)^NESTBOX_HOST_QUEUE_PATH=(.+)$').Groups[1].Value.Trim()
+    if (-not $env:NESTBOX_HOST_QUEUE_PATH -and -not $configuredQueue) { $env:NESTBOX_HOST_QUEUE_PATH = Join-Path $TempDirectory 'host-runner' }
+    if ($env:NESTBOX_HOST_QUEUE_PATH) { New-Item -ItemType Directory -Path $env:NESTBOX_HOST_QUEUE_PATH -Force | Out-Null }
 
     if (Get-Command docker -ErrorAction SilentlyContinue) { Pass 'docker is available' } else { Fail 'docker is required'; throw 'Missing Docker' }
     if (Get-Command curl.exe -ErrorAction SilentlyContinue) { Pass 'curl.exe is available' } else { Fail 'curl.exe is required'; throw 'Missing curl.exe' }
@@ -120,13 +123,15 @@ try {
     if ($openCodeInstance.Contains('Communication language:')) { Pass 'OpenCode instance policy records communication language' } else { Fail 'OpenCode instance policy omits communication language' }
     $openCodeConfig = [IO.File]::ReadAllText((Join-Path $Root 'home\configs\opencode\opencode.json'))
     if ($openCodeConfig.Contains('"instance.md"')) { Pass 'OpenCode loads instance policy directly' } else { Fail 'OpenCode does not load instance policy' }
+    if ($openCodeConfig.Contains('"control"')) { Pass 'OpenCode registers the control MCP' } else { Fail 'OpenCode does not register the control MCP' }
+    if ((Test-Path -LiteralPath (Join-Path $Root 'docker\control\server.py')) -and (Test-Path -LiteralPath (Join-Path $Root 'host-runner.mjs'))) { Pass 'Control and host runner sources exist' } else { Fail 'Control or host runner source is missing' }
 
     $result = Invoke-Compose @('config', '--quiet') -Quiet
     if ($result.Code -eq 0) { Pass 'Compose configuration is valid' } else { Fail 'Compose configuration is invalid' }
 
     $result = Invoke-Compose @('config', '--services') -Quiet
     $services = @($result.Output | ForEach-Object { $_.ToString().Trim() })
-    foreach ($service in @('nginx', 'php-fpm', 'rollup', 'opencode')) {
+    foreach ($service in @('nginx', 'php-fpm', 'rollup', 'control', 'opencode')) {
         if ($services -contains $service) { Pass "Compose defines $service" } else { Fail "Compose does not define $service" }
     }
     $result = Invoke-Compose @('ps', '--services') -Quiet
@@ -135,16 +140,16 @@ try {
     }
 
     if ($Start) {
-        $result = Invoke-Compose @('build', 'nginx', 'php-fpm', 'rollup', 'opencode')
+        $result = Invoke-Compose @('build', 'nginx', 'php-fpm', 'rollup', 'control', 'opencode')
         if ($result.Code -eq 0) { Pass 'All service images build' } else { Fail 'One or more service images failed to build' }
 
         # Do not start the bind-mounted Rollup watcher: it intentionally writes
         # generated bundles. Its image and output are validated separately.
-        $result = Invoke-Compose @('up', '-d', 'nginx', 'php-fpm', 'opencode')
+        $result = Invoke-Compose @('up', '-d', 'nginx', 'php-fpm', 'control', 'opencode')
         if ($result.Code -eq 0) { Pass 'Application services started' } else { Fail 'Application services failed to start' }
     }
 
-    foreach ($service in @('nginx', 'php-fpm', 'opencode')) {
+    foreach ($service in @('nginx', 'php-fpm', 'control', 'opencode')) {
         if (Test-ContainerRunning $service) { Pass "$service is running" } else { Fail "$service is not running" }
     }
     $rollupId = Get-ContainerId 'rollup'
@@ -155,7 +160,7 @@ try {
     }
 
     $restartCounts = @{}
-    foreach ($service in @('nginx', 'php-fpm', 'opencode')) { $restartCounts[$service] = Get-RestartCount $service }
+    foreach ($service in @('nginx', 'php-fpm', 'control', 'opencode')) { $restartCounts[$service] = Get-RestartCount $service }
 
     $result = Invoke-Compose @('port', 'nginx', '80') -Quiet
     $published = ($result.Output -join "`n").Trim()
@@ -242,6 +247,14 @@ try {
     $response = Invoke-Http '/_nestbox/publish?topics=nestbox-test:public' '' 'POST'
     if ($response.Status -eq 404) { Pass 'Publisher endpoint is unavailable on the public port' } else { Fail "Public publisher endpoint returned HTTP $($response.Status)" }
 
+    $controlId = Get-ContainerId 'control'
+    $controlInspect = @(& docker inspect $controlId 2>$null | ConvertFrom-Json)[0]
+    if ($null -eq $controlInspect.NetworkSettings.Ports.'4088/tcp') { Pass 'Control API is not published on the host' } else { Fail 'Control API is published on the host' }
+    $openCodeId = Get-ContainerId 'opencode'
+    $openCodeInspect = @(& docker inspect $openCodeId 2>$null | ConvertFrom-Json)[0]
+    if (@($openCodeInspect.Mounts.Destination) -notcontains '/var/run/docker.sock') { Pass 'OpenCode does not receive the Docker socket' } else { Fail 'OpenCode receives the Docker socket' }
+    if (@($controlInspect.Mounts.Destination) -contains '/var/run/docker.sock') { Pass 'Control receives the Docker socket' } else { Fail 'Control does not receive the Docker socket' }
+
     if ($indexPresent) {
         $result = Invoke-Compose @('exec', '-T', 'php-fpm', 'php', '-l', '/home/code/index.php') -Quiet
         if ($result.Code -eq 0) { Pass 'Installed super-document passes PHP lint' } else { Fail 'Installed super-document failed PHP lint' }
@@ -299,7 +312,7 @@ try {
     Remove-Job -Job $SseJob -Force -ErrorAction SilentlyContinue
     $SseJob = $null
 
-    foreach ($service in @('nginx', 'php-fpm', 'opencode')) {
+    foreach ($service in @('nginx', 'php-fpm', 'control', 'opencode')) {
         $after = Get-RestartCount $service
         if ((Test-ContainerRunning $service) -and $null -ne $restartCounts[$service] -and $restartCounts[$service] -eq $after) { Pass "$service remained stable during the test" } else { Fail "$service restarted or stopped during the test" }
     }

package/tests/nestbox.sh

@@ -141,6 +141,11 @@ else
 fi
 
 TEMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/nestbox-test.XXXXXX")"
+configured_queue="$(sed -n 's/^NESTBOX_HOST_QUEUE_PATH=//p' "$ROOT/.env" | tail -n 1)"
+if [[ -z "${NESTBOX_HOST_QUEUE_PATH:-}" && -z "$configured_queue" ]]; then
+    export NESTBOX_HOST_QUEUE_PATH="$TEMP_DIR/host-runner"
+fi
+if [[ -n "${NESTBOX_HOST_QUEUE_PATH:-}" ]]; then mkdir -p "$NESTBOX_HOST_QUEUE_PATH"; fi
 
 [[ -f "$ROOT/.env" ]] && pass '.env exists' || fail '.env is missing'
 [[ ! -d "$ROOT/home/.git" ]] && pass 'Page and configuration tree has no embedded Git repository' || fail 'home/.git must not be included in an installation'
@@ -160,6 +165,8 @@ grep -Fq 'deliberately has no Docker socket' "$ROOT/home/configs/opencode/instru
 grep -Fq 'Commit policy:' "$ROOT/home/configs/opencode/instance.md" && pass 'OpenCode instance policy records commit behavior' || fail 'OpenCode instance policy omits commit behavior'
 grep -Fq 'Communication language:' "$ROOT/home/configs/opencode/instance.md" && pass 'OpenCode instance policy records communication language' || fail 'OpenCode instance policy omits communication language'
 grep -Fq '"instance.md"' "$ROOT/home/configs/opencode/opencode.json" && pass 'OpenCode loads instance policy directly' || fail 'OpenCode does not load instance policy'
+grep -Fq '"control"' "$ROOT/home/configs/opencode/opencode.json" && pass 'OpenCode registers the control MCP' || fail 'OpenCode does not register the control MCP'
+[[ -f "$ROOT/docker/control/server.py" && -f "$ROOT/host-runner.mjs" ]] && pass 'Control and host runner sources exist' || fail 'Control or host runner source is missing'
 
 if compose config --quiet; then
     pass 'Compose configuration is valid'
@@ -168,7 +175,7 @@ else
 fi
 
 services="$(compose config --services 2>/dev/null || true)"
-for service in nginx php-fpm rollup opencode; do
+for service in nginx php-fpm rollup control opencode; do
     if grep -qx "$service" <<<"$services"; then
         pass "Compose defines $service"
     else
@@ -184,7 +191,7 @@ while IFS= read -r service; do
 done <<<"$running_services"
 
 if ((START)); then
-    if compose build nginx php-fpm rollup opencode; then
+    if compose build nginx php-fpm rollup control opencode; then
         pass 'All service images build'
     else
         fail 'One or more service images failed to build'
@@ -193,14 +200,14 @@ if ((START)); then
     # The Rollup watcher intentionally writes generated bundles to the bind
     # mount, so lifecycle mode leaves it untouched and validates its image via
     # the build plus the bundles served by Nginx.
-    if compose up -d nginx php-fpm opencode; then
+    if compose up -d nginx php-fpm control opencode; then
         pass 'Application services started'
     else
         fail 'Application services failed to start'
     fi
 fi
 
-for service in nginx php-fpm opencode; do
+for service in nginx php-fpm control opencode; do
     if container_running "$service"; then
         pass "$service is running"
     else
@@ -217,6 +224,7 @@ fi
 NGINX_RESTARTS="$(restart_count nginx 2>/dev/null || printf '')"
 PHP_RESTARTS="$(restart_count php-fpm 2>/dev/null || printf '')"
 OPENCODE_RESTARTS="$(restart_count opencode 2>/dev/null || printf '')"
+CONTROL_RESTARTS="$(restart_count control 2>/dev/null || printf '')"
 
 published="$(compose port nginx 80 2>/dev/null || true)"
 if [[ "$published" =~ ^\[(.*)\]:([0-9]+)$ ]]; then
@@ -339,6 +347,15 @@ fi
 status="$(http_request '/_nestbox/publish?topics=nestbox-test:public' '' 'POST' 2>/dev/null || printf '000')"
 [[ "$status" == "404" ]] && pass 'Publisher endpoint is unavailable on the public port' || fail "Public publisher endpoint returned HTTP $status"
 
+control_id="$(container_id control)"
+control_binding="$(docker inspect --format '{{json (index .NetworkSettings.Ports "4088/tcp")}}' "$control_id" 2>/dev/null || true)"
+[[ -z "$control_binding" || "$control_binding" == "null" ]] && pass 'Control API is not published on the host' || fail 'Control API is published on the host'
+opencode_id="$(container_id opencode)"
+opencode_mounts="$(docker inspect --format '{{range .Mounts}}{{println .Source .Destination}}{{end}}' "$opencode_id" 2>/dev/null || true)"
+grep -Fq '/var/run/docker.sock' <<<"$opencode_mounts" && fail 'OpenCode receives the Docker socket' || pass 'OpenCode does not receive the Docker socket'
+control_mounts="$(docker inspect --format '{{range .Mounts}}{{println .Source .Destination}}{{end}}' "$control_id" 2>/dev/null || true)"
+grep -Fq '/var/run/docker.sock' <<<"$control_mounts" && pass 'Control receives the Docker socket' || fail 'Control does not receive the Docker socket'
+
 if ((INDEX_PRESENT)); then
     if compose exec -T php-fpm php -l /home/code/index.php >/dev/null 2>&1; then
         pass 'Installed super-document passes PHP lint'
@@ -423,7 +440,7 @@ else
     fail 'EventSource did not receive the expected Nchan event'
 fi
 
-for entry in "nginx:$NGINX_RESTARTS" "php-fpm:$PHP_RESTARTS" "opencode:$OPENCODE_RESTARTS"; do
+for entry in "nginx:$NGINX_RESTARTS" "php-fpm:$PHP_RESTARTS" "control:$CONTROL_RESTARTS" "opencode:$OPENCODE_RESTARTS"; do
     service="${entry%%:*}"
     before="${entry#*:}"
     after="$(restart_count "$service" 2>/dev/null || printf '')"