@p10i/create-nestbox 0.1.2 → 0.3.0

package/tests/nestbox.ps1

@@ -91,6 +91,11 @@ function Invoke-Http([string]$Path, [string]$HostHeader = '', [string]$Method =
 
 try {
     New-Item -ItemType Directory -Path $TempDirectory | Out-Null
+    $configuredTokenFile = [regex]::Match([IO.File]::ReadAllText((Join-Path $Root '.env')), '(?m)^NESTBOX_HOST_TOKEN_FILE=(.+)$').Groups[1].Value.Trim()
+    if (-not $env:NESTBOX_HOST_TOKEN_FILE -and -not $configuredTokenFile) {
+        $env:NESTBOX_HOST_TOKEN_FILE = Join-Path $TempDirectory 'host-token'
+        [IO.File]::WriteAllText($env:NESTBOX_HOST_TOKEN_FILE, 'test-token-' + ('0' * 54))
+    }
 
     if (Get-Command docker -ErrorAction SilentlyContinue) { Pass 'docker is available' } else { Fail 'docker is required'; throw 'Missing Docker' }
     if (Get-Command curl.exe -ErrorAction SilentlyContinue) { Pass 'curl.exe is available' } else { Fail 'curl.exe is required'; throw 'Missing curl.exe' }
@@ -120,13 +125,15 @@ try {
     if ($openCodeInstance.Contains('Communication language:')) { Pass 'OpenCode instance policy records communication language' } else { Fail 'OpenCode instance policy omits communication language' }
     $openCodeConfig = [IO.File]::ReadAllText((Join-Path $Root 'home\configs\opencode\opencode.json'))
     if ($openCodeConfig.Contains('"instance.md"')) { Pass 'OpenCode loads instance policy directly' } else { Fail 'OpenCode does not load instance policy' }
+    if ($openCodeConfig.Contains('"control"')) { Pass 'OpenCode registers the control MCP' } else { Fail 'OpenCode does not register the control MCP' }
+    if ((Test-Path -LiteralPath (Join-Path $Root 'docker\control\server.py')) -and (Test-Path -LiteralPath (Join-Path $Root 'host-runner.mjs'))) { Pass 'Control and host runner sources exist' } else { Fail 'Control or host runner source is missing' }
 
     $result = Invoke-Compose @('config', '--quiet') -Quiet
     if ($result.Code -eq 0) { Pass 'Compose configuration is valid' } else { Fail 'Compose configuration is invalid' }
 
     $result = Invoke-Compose @('config', '--services') -Quiet
     $services = @($result.Output | ForEach-Object { $_.ToString().Trim() })
-    foreach ($service in @('nginx', 'php-fpm', 'rollup', 'opencode')) {
+    foreach ($service in @('nginx', 'php-fpm', 'rollup', 'control', 'opencode')) {
         if ($services -contains $service) { Pass "Compose defines $service" } else { Fail "Compose does not define $service" }
     }
     $result = Invoke-Compose @('ps', '--services') -Quiet
@@ -135,16 +142,16 @@ try {
     }
 
     if ($Start) {
-        $result = Invoke-Compose @('build', 'nginx', 'php-fpm', 'rollup', 'opencode')
+        $result = Invoke-Compose @('build', 'nginx', 'php-fpm', 'rollup', 'control', 'opencode')
         if ($result.Code -eq 0) { Pass 'All service images build' } else { Fail 'One or more service images failed to build' }
 
         # Do not start the bind-mounted Rollup watcher: it intentionally writes
         # generated bundles. Its image and output are validated separately.
-        $result = Invoke-Compose @('up', '-d', 'nginx', 'php-fpm', 'opencode')
+        $result = Invoke-Compose @('up', '-d', 'nginx', 'php-fpm', 'control', 'opencode')
         if ($result.Code -eq 0) { Pass 'Application services started' } else { Fail 'Application services failed to start' }
     }
 
-    foreach ($service in @('nginx', 'php-fpm', 'opencode')) {
+    foreach ($service in @('nginx', 'php-fpm', 'control', 'opencode')) {
         if (Test-ContainerRunning $service) { Pass "$service is running" } else { Fail "$service is not running" }
     }
     $rollupId = Get-ContainerId 'rollup'
@@ -155,7 +162,7 @@ try {
     }
 
     $restartCounts = @{}
-    foreach ($service in @('nginx', 'php-fpm', 'opencode')) { $restartCounts[$service] = Get-RestartCount $service }
+    foreach ($service in @('nginx', 'php-fpm', 'control', 'opencode')) { $restartCounts[$service] = Get-RestartCount $service }
 
     $result = Invoke-Compose @('port', 'nginx', '80') -Quiet
     $published = ($result.Output -join "`n").Trim()
@@ -242,6 +249,18 @@ try {
     $response = Invoke-Http '/_nestbox/publish?topics=nestbox-test:public' '' 'POST'
     if ($response.Status -eq 404) { Pass 'Publisher endpoint is unavailable on the public port' } else { Fail "Public publisher endpoint returned HTTP $($response.Status)" }
 
+    $controlId = Get-ContainerId 'control'
+    $controlInspect = @(& docker inspect $controlId 2>$null | ConvertFrom-Json)[0]
+    if ($null -eq $controlInspect.NetworkSettings.Ports.'4088/tcp') { Pass 'Control API is not published on the host' } else { Fail 'Control API is published on the host' }
+    $runnerBinding = $controlInspect.NetworkSettings.Ports.'4089/tcp'
+    if ($null -ne $runnerBinding -and @($runnerBinding.HostIp) -notcontains '0.0.0.0' -and @($runnerBinding.HostIp) -notcontains '::') { Pass 'Host runner API is published on loopback only' } else { Fail 'Host runner API is not restricted to loopback' }
+    $openCodeId = Get-ContainerId 'opencode'
+    $openCodeInspect = @(& docker inspect $openCodeId 2>$null | ConvertFrom-Json)[0]
+    if (@($openCodeInspect.Mounts.Destination) -notcontains '/var/run/docker.sock') { Pass 'OpenCode does not receive the Docker socket' } else { Fail 'OpenCode receives the Docker socket' }
+    if (@($openCodeInspect.Mounts.Destination) -notcontains '/run/secrets/nestbox-host-token' -and @($openCodeInspect.Config.Env) -notmatch '^NESTBOX_HOST_TOKEN=') { Pass 'OpenCode cannot read the host runner token' } else { Fail 'OpenCode can read the host runner token' }
+    if (@($controlInspect.Mounts.Destination) -contains '/var/run/docker.sock') { Pass 'Control receives the Docker socket' } else { Fail 'Control does not receive the Docker socket' }
+    if (@($controlInspect.Mounts.Destination) -contains '/run/secrets/nestbox-host-token') { Pass 'Control receives the host runner token file' } else { Fail 'Control does not receive the host runner token file' }
+
     if ($indexPresent) {
         $result = Invoke-Compose @('exec', '-T', 'php-fpm', 'php', '-l', '/home/code/index.php') -Quiet
         if ($result.Code -eq 0) { Pass 'Installed super-document passes PHP lint' } else { Fail 'Installed super-document failed PHP lint' }
@@ -299,7 +318,7 @@ try {
     Remove-Job -Job $SseJob -Force -ErrorAction SilentlyContinue
     $SseJob = $null
 
-    foreach ($service in @('nginx', 'php-fpm', 'opencode')) {
+    foreach ($service in @('nginx', 'php-fpm', 'control', 'opencode')) {
         $after = Get-RestartCount $service
         if ((Test-ContainerRunning $service) -and $null -ne $restartCounts[$service] -and $restartCounts[$service] -eq $after) { Pass "$service remained stable during the test" } else { Fail "$service restarted or stopped during the test" }
     }

package/tests/nestbox.sh

@@ -141,6 +141,8 @@ else
 fi
 
 TEMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/nestbox-test.XXXXXX")"
+configured_token_file="$(sed -n 's/^NESTBOX_HOST_TOKEN_FILE=//p' "$ROOT/.env" | tail -n 1)"
+if [[ -z "${NESTBOX_HOST_TOKEN_FILE:-}" && -z "$configured_token_file" ]]; then export NESTBOX_HOST_TOKEN_FILE="$TEMP_DIR/host-token"; printf 'test-token-%054d\n' 0 >"$NESTBOX_HOST_TOKEN_FILE"; fi
 
 [[ -f "$ROOT/.env" ]] && pass '.env exists' || fail '.env is missing'
 [[ ! -d "$ROOT/home/.git" ]] && pass 'Page and configuration tree has no embedded Git repository' || fail 'home/.git must not be included in an installation'
@@ -160,6 +162,8 @@ grep -Fq 'deliberately has no Docker socket' "$ROOT/home/configs/opencode/instru
 grep -Fq 'Commit policy:' "$ROOT/home/configs/opencode/instance.md" && pass 'OpenCode instance policy records commit behavior' || fail 'OpenCode instance policy omits commit behavior'
 grep -Fq 'Communication language:' "$ROOT/home/configs/opencode/instance.md" && pass 'OpenCode instance policy records communication language' || fail 'OpenCode instance policy omits communication language'
 grep -Fq '"instance.md"' "$ROOT/home/configs/opencode/opencode.json" && pass 'OpenCode loads instance policy directly' || fail 'OpenCode does not load instance policy'
+grep -Fq '"control"' "$ROOT/home/configs/opencode/opencode.json" && pass 'OpenCode registers the control MCP' || fail 'OpenCode does not register the control MCP'
+[[ -f "$ROOT/docker/control/server.py" && -f "$ROOT/host-runner.mjs" ]] && pass 'Control and host runner sources exist' || fail 'Control or host runner source is missing'
 
 if compose config --quiet; then
     pass 'Compose configuration is valid'
@@ -168,7 +172,7 @@ else
 fi
 
 services="$(compose config --services 2>/dev/null || true)"
-for service in nginx php-fpm rollup opencode; do
+for service in nginx php-fpm rollup control opencode; do
     if grep -qx "$service" <<<"$services"; then
         pass "Compose defines $service"
     else
@@ -184,7 +188,7 @@ while IFS= read -r service; do
 done <<<"$running_services"
 
 if ((START)); then
-    if compose build nginx php-fpm rollup opencode; then
+    if compose build nginx php-fpm rollup control opencode; then
         pass 'All service images build'
     else
         fail 'One or more service images failed to build'
@@ -193,14 +197,14 @@ if ((START)); then
     # The Rollup watcher intentionally writes generated bundles to the bind
     # mount, so lifecycle mode leaves it untouched and validates its image via
     # the build plus the bundles served by Nginx.
-    if compose up -d nginx php-fpm opencode; then
+    if compose up -d nginx php-fpm control opencode; then
         pass 'Application services started'
     else
         fail 'Application services failed to start'
     fi
 fi
 
-for service in nginx php-fpm opencode; do
+for service in nginx php-fpm control opencode; do
     if container_running "$service"; then
         pass "$service is running"
     else
@@ -217,6 +221,7 @@ fi
 NGINX_RESTARTS="$(restart_count nginx 2>/dev/null || printf '')"
 PHP_RESTARTS="$(restart_count php-fpm 2>/dev/null || printf '')"
 OPENCODE_RESTARTS="$(restart_count opencode 2>/dev/null || printf '')"
+CONTROL_RESTARTS="$(restart_count control 2>/dev/null || printf '')"
 
 published="$(compose port nginx 80 2>/dev/null || true)"
 if [[ "$published" =~ ^\[(.*)\]:([0-9]+)$ ]]; then
@@ -339,6 +344,20 @@ fi
 status="$(http_request '/_nestbox/publish?topics=nestbox-test:public' '' 'POST' 2>/dev/null || printf '000')"
 [[ "$status" == "404" ]] && pass 'Publisher endpoint is unavailable on the public port' || fail "Public publisher endpoint returned HTTP $status"
 
+control_id="$(container_id control)"
+control_binding="$(docker inspect --format '{{json (index .NetworkSettings.Ports "4088/tcp")}}' "$control_id" 2>/dev/null || true)"
+[[ -z "$control_binding" || "$control_binding" == "null" ]] && pass 'Control API is not published on the host' || fail 'Control API is published on the host'
+runner_binding="$(docker inspect --format '{{json (index .NetworkSettings.Ports "4089/tcp")}}' "$control_id" 2>/dev/null || true)"
+if [[ "$runner_binding" == *'"HostIp":"127.0.0.1"'* || "$runner_binding" == *'"HostIp":"::1"'* ]]; then pass 'Host runner API is published on loopback only'; else fail 'Host runner API is not restricted to loopback'; fi
+opencode_id="$(container_id opencode)"
+opencode_mounts="$(docker inspect --format '{{range .Mounts}}{{println .Source .Destination}}{{end}}' "$opencode_id" 2>/dev/null || true)"
+grep -Fq '/var/run/docker.sock' <<<"$opencode_mounts" && fail 'OpenCode receives the Docker socket' || pass 'OpenCode does not receive the Docker socket'
+opencode_env="$(docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' "$opencode_id" 2>/dev/null || true)"
+if ! grep -Fq '/run/secrets/nestbox-host-token' <<<"$opencode_mounts" && ! grep -Eq '^NESTBOX_HOST_TOKEN=' <<<"$opencode_env"; then pass 'OpenCode cannot read the host runner token'; else fail 'OpenCode can read the host runner token'; fi
+control_mounts="$(docker inspect --format '{{range .Mounts}}{{println .Source .Destination}}{{end}}' "$control_id" 2>/dev/null || true)"
+grep -Fq '/var/run/docker.sock' <<<"$control_mounts" && pass 'Control receives the Docker socket' || fail 'Control does not receive the Docker socket'
+grep -Fq '/run/secrets/nestbox-host-token' <<<"$control_mounts" && pass 'Control receives the host runner token file' || fail 'Control does not receive the host runner token file'
+
 if ((INDEX_PRESENT)); then
     if compose exec -T php-fpm php -l /home/code/index.php >/dev/null 2>&1; then
         pass 'Installed super-document passes PHP lint'
@@ -423,7 +442,7 @@ else
     fail 'EventSource did not receive the expected Nchan event'
 fi
 
-for entry in "nginx:$NGINX_RESTARTS" "php-fpm:$PHP_RESTARTS" "opencode:$OPENCODE_RESTARTS"; do
+for entry in "nginx:$NGINX_RESTARTS" "php-fpm:$PHP_RESTARTS" "control:$CONTROL_RESTARTS" "opencode:$OPENCODE_RESTARTS"; do
     service="${entry%%:*}"
     before="${entry#*:}"
     after="$(restart_count "$service" 2>/dev/null || printf '')"