@p10i/create-nestbox 0.2.0 → 0.3.0

package/tests/host-runner.mjs

@@ -1,49 +1,81 @@
-import { spawn } from 'node:child_process';
-import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { spawn, spawnSync } from 'node:child_process';
+import { createServer } from 'node:http';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const fixture = await mkdtemp(join(tmpdir(), 'nestbox-host-runner-'));
+const tokenFixture = await mkdtemp(join(tmpdir(), 'nestbox-host-token-'));
 const testDirectory = dirname(fileURLToPath(import.meta.url));
 const runnerPath = resolve(testDirectory, '..', 'host-runner.mjs');
-const queue = `${fixture}-queue`;
-const requests = join(queue, 'requests');
-const running = join(queue, 'running');
-const results = join(queue, 'results');
+const token = 'test-token-'.padEnd(64, 'x');
+const jobs = [];
+const results = new Map();
+const resultAttempts = new Map();
 let runner;
-let stdout = '';
+let runnerStdout = '';
+let heartbeatConflicts = 1;
 
-async function waitFor(path, timeout = 10000) {
+function readBody(request) {
+  return new Promise((resolveBody, reject) => {
+    const chunks = [];
+    request.on('data', chunk => chunks.push(chunk));
+    request.on('end', () => { try { resolveBody(JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}')); } catch (error) { reject(error); } });
+    request.on('error', reject);
+  });
+}
+
+const server = createServer(async (request, response) => {
+  if (request.headers.authorization !== `Bearer ${token}` || !request.headers['x-nestbox-runner-id']) {
+    response.writeHead(401).end('{"error":"unauthorized"}'); return;
+  }
+  if (request.method === 'POST' && request.url === '/host/heartbeat') {
+    if (heartbeatConflicts > 0) { heartbeatConflicts -= 1; response.writeHead(409).end('{"error":"another host runner is active"}'); return; }
+    await readBody(request); response.writeHead(200, { 'content-type': 'application/json' }).end('{"ok":true}'); return;
+  }
+  if (request.method === 'GET' && request.url.startsWith('/host/jobs/next')) {
+    const job = jobs.shift();
+    if (!job) { response.writeHead(204).end(); return; }
+    response.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(job)); return;
+  }
+  const match = request.url.match(/^\/host\/jobs\/([^/]+)\/result$/);
+  if (request.method === 'POST' && match) {
+    const jobId = decodeURIComponent(match[1]);
+    const result = await readBody(request);
+    const attempt = (resultAttempts.get(jobId) || 0) + 1;
+    resultAttempts.set(jobId, attempt);
+    if (jobId === 'job-retry' && attempt === 1) { response.writeHead(503).end('{"error":"restarting"}'); return; }
+    results.set(jobId, result);
+    response.writeHead(202, { 'content-type': 'application/json' }).end('{"accepted":true}'); return;
+  }
+  response.writeHead(404).end();
+});
+
+async function waitForResult(jobId, timeout = 10000) {
   const deadline = Date.now() + timeout;
   while (Date.now() < deadline) {
-    try { return await readFile(path, 'utf8'); }
-    catch (error) { if (error?.code !== 'ENOENT') throw error; }
+    if (results.has(jobId)) return results.get(jobId);
     await new Promise(resolveWait => setTimeout(resolveWait, 25));
   }
-  throw new Error(`Timed out waiting for ${path}`);
+  throw new Error(`Timed out waiting for result ${jobId}`);
 }
 
-async function waitForEvent(type, requestId) {
-  const deadline = Date.now() + 10000;
+async function waitForEvent(type, requestId, timeout = 10000) {
+  const deadline = Date.now() + timeout;
   while (Date.now() < deadline) {
-    for (const line of stdout.split(/\r?\n/).filter(Boolean)) {
+    for (const line of runnerStdout.split(/\r?\n/).filter(Boolean)) {
       const event = JSON.parse(line);
       if (event.type === type && (!requestId || event.requestId === requestId)) return event;
     }
     await new Promise(resolveWait => setTimeout(resolveWait, 25));
   }
-  throw new Error(`Timed out waiting for ${type}`);
+  throw new Error(`Timed out waiting for event ${type}`);
 }
 
-async function submit(job) {
-  await writeFile(join(requests, `${job.jobId}.json`), JSON.stringify({ schemaVersion: 1, ...job }));
-  return JSON.parse(await waitFor(join(results, `${job.jobId}.json`)));
-}
+function submit(job) { jobs.push({ schemaVersion: 1, ...job }); return waitForResult(job.jobId); }
 
 try {
-  await Promise.all([mkdir(requests, { recursive: true }), mkdir(running, { recursive: true })]);
-  await writeFile(join(running, 'interrupted-job.json'), JSON.stringify({ schemaVersion: 1, jobId: 'interrupted-job', type: 'npm.run', script: 'ok', args: [] }));
   await writeFile(join(fixture, 'package.json'), JSON.stringify({
     private: true,
     scripts: {
@@ -52,52 +84,60 @@ try {
       fail: `node -e "process.stderr.write('host-failed'); process.exit(7)"`,
     },
   }));
+  const tokenPath = join(tokenFixture, 'host-token');
+  await writeFile(tokenPath, `${token}\n`);
+  await new Promise((resolveListen, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolveListen); });
+  const port = server.address().port;
   runner = spawn(process.execPath, [runnerPath, '--json'], {
-    env: { ...process.env, NESTBOX_HOST_WORKSPACE: fixture, NESTBOX_HOST_QUEUE: queue },
-    stdio: ['ignore', 'pipe', 'pipe'],
-    windowsHide: true,
+    env: { ...process.env, npm_execpath: '', NESTBOX_HOST_WORKSPACE: fixture, NESTBOX_CONTROL_HOST_URL: `http://127.0.0.1:${port}`, NESTBOX_HOST_TOKEN_FILE: tokenPath, NESTBOX_HOST_TOKEN: '' },
+    stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true,
   });
-  let stderr = '';
-  runner.stdout.on('data', chunk => stdout += chunk);
-  runner.stderr.on('data', chunk => stderr += chunk);
-  await waitFor(join(queue, 'heartbeat.json'));
-  const interrupted = JSON.parse(await waitFor(join(results, 'interrupted-job.json')));
-  if (!interrupted.interrupted || interrupted.exitCode !== 1) throw new Error('Interrupted job was replayed instead of rejected.');
+  let runnerStderr = '';
+  runner.stdout.on('data', chunk => runnerStdout += chunk); runner.stderr.on('data', chunk => runnerStderr += chunk);
+  await waitForEvent('runner.ready');
 
   const success = await submit({ jobId: 'job-ok', type: 'npm.run', script: 'ok', args: [] });
   const failure = await submit({ jobId: 'job-fail', type: 'npm.run', script: 'fail', args: [] });
   if (success.exitCode !== 0 || !success.stdout.includes('host-ok') || !success.hostPlatform) throw new Error('Successful host result was not preserved.');
   if (failure.exitCode !== 7 || !failure.stderr.includes('host-failed')) throw new Error('Failed host result was not preserved.');
+  const retried = await submit({ jobId: 'job-retry', type: 'npm.run', script: 'ok', args: [] });
+  if (retried.exitCode !== 0 || resultAttempts.get('job-retry') !== 2) throw new Error('Host result was not retried after a transient control failure.');
 
   const requestId = 'npm-script-request-test-add';
-  const requested = await submit({ jobId: requestId, type: 'npm.scripts.request', requestId, operation: 'add', name: 'approved', command: `node -e "process.stdout.write('approved')"` });
+  const requestedPromise = submit({ jobId: requestId, type: 'npm.scripts.request', requestId, operation: 'add', name: 'approved', command: `node -e "process.stdout.write('approved')"` });
   const event = await waitForEvent('npm.scripts.confirmation_required', requestId);
+  const requested = await requestedPromise;
   if (requested.status !== 'confirmation_required' || Object.hasOwn(requested, 'code')) throw new Error('Script request exposed its confirmation code.');
   const confirmed = await submit({ jobId: 'confirm-add', type: 'npm.scripts.confirm', requestId, code: event.code });
   const changed = JSON.parse(await readFile(join(fixture, 'package.json'), 'utf8'));
   if (confirmed.status !== 'success' || !changed.scripts.approved) throw new Error('Approved script was not added.');
 
-  const raceId = 'npm-script-request-race-test';
-  await submit({ jobId: raceId, type: 'npm.scripts.request', requestId: raceId, operation: 'edit', name: 'approved', command: 'node changed.mjs' });
-  const raceEvent = await waitForEvent('npm.scripts.confirmation_required', raceId);
-  changed.scripts.concurrent = 'node concurrent.mjs';
-  await writeFile(join(fixture, 'package.json'), JSON.stringify(changed));
-  const raced = await submit({ jobId: 'confirm-race', type: 'npm.scripts.confirm', requestId: raceId, code: raceEvent.code });
-  if (raced.exitCode !== 1 || !raced.stderr.includes('changed after approval')) throw new Error('Concurrent package change was overwritten.');
-
   const protectedResult = await submit({ jobId: 'protected-host', type: 'npm.scripts.request', requestId: 'protected-host', operation: 'delete', name: 'host' });
   if (protectedResult.exitCode !== 1 || !protectedResult.stderr.includes('cannot be changed')) throw new Error('Core host script was not protected.');
 
-  const exit = new Promise((resolveExit, reject) => {
-    runner.on('error', reject);
-    runner.on('close', code => code === 0 || code === null ? resolveExit() : reject(new Error(`Runner exited ${code}: ${stderr}`)));
+  const exit = new Promise((resolveExit, reject) => { runner.on('error', reject); runner.on('close', code => code === 0 || code === null ? resolveExit() : reject(new Error(`Runner exited ${code}: ${runnerStderr}`))); });
+  runner.kill('SIGTERM'); await exit; runner = undefined;
+
+  const onceRunner = spawn(process.execPath, [runnerPath, '--once', '--json'], {
+    env: { ...process.env, npm_execpath: '', NESTBOX_HOST_WORKSPACE: fixture, NESTBOX_CONTROL_HOST_URL: `http://127.0.0.1:${port}`, NESTBOX_HOST_TOKEN_FILE: tokenPath, NESTBOX_HOST_TOKEN: '' },
+    stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true,
+  });
+  const onceExit = await Promise.race([
+    new Promise(resolveExit => onceRunner.once('close', resolveExit)),
+    new Promise((_, reject) => setTimeout(() => reject(new Error('--once runner did not exit after an empty poll.')), 5000)),
+  ]);
+  if (onceExit !== 0) throw new Error(`--once runner exited ${onceExit}.`);
+
+  const unsafeToken = join(fixture, 'unsafe-token');
+  await writeFile(unsafeToken, `${token}\n`);
+  const unsafe = spawnSync(process.execPath, [runnerPath, '--once'], {
+    env: { ...process.env, NESTBOX_HOST_WORKSPACE: fixture, NESTBOX_CONTROL_HOST_URL: `http://127.0.0.1:${port}`, NESTBOX_HOST_TOKEN_FILE: unsafeToken, NESTBOX_HOST_TOKEN: '' }, encoding: 'utf8', windowsHide: true,
   });
-  runner.kill('SIGTERM');
-  await exit;
-  runner = undefined;
-  console.log('Host runner tests passed.');
+  if (unsafe.status === 0 || !unsafe.stderr.includes('must be outside')) throw new Error('Runner accepted a token inside the workspace.');
+  console.log('Host runner HTTP tests passed.');
 } finally {
   runner?.kill('SIGTERM');
+  await new Promise(resolveClose => server.close(resolveClose));
   await rm(fixture, { recursive: true, force: true });
-  await rm(queue, { recursive: true, force: true });
+  await rm(tokenFixture, { recursive: true, force: true });
 }

package/tests/nestbox.ps1

@@ -91,9 +91,11 @@ function Invoke-Http([string]$Path, [string]$HostHeader = '', [string]$Method =
 
 try {
     New-Item -ItemType Directory -Path $TempDirectory | Out-Null
-    $configuredQueue = [regex]::Match([IO.File]::ReadAllText((Join-Path $Root '.env')), '(?m)^NESTBOX_HOST_QUEUE_PATH=(.+)$').Groups[1].Value.Trim()
-    if (-not $env:NESTBOX_HOST_QUEUE_PATH -and -not $configuredQueue) { $env:NESTBOX_HOST_QUEUE_PATH = Join-Path $TempDirectory 'host-runner' }
-    if ($env:NESTBOX_HOST_QUEUE_PATH) { New-Item -ItemType Directory -Path $env:NESTBOX_HOST_QUEUE_PATH -Force | Out-Null }
+    $configuredTokenFile = [regex]::Match([IO.File]::ReadAllText((Join-Path $Root '.env')), '(?m)^NESTBOX_HOST_TOKEN_FILE=(.+)$').Groups[1].Value.Trim()
+    if (-not $env:NESTBOX_HOST_TOKEN_FILE -and -not $configuredTokenFile) {
+        $env:NESTBOX_HOST_TOKEN_FILE = Join-Path $TempDirectory 'host-token'
+        [IO.File]::WriteAllText($env:NESTBOX_HOST_TOKEN_FILE, 'test-token-' + ('0' * 54))
+    }
 
     if (Get-Command docker -ErrorAction SilentlyContinue) { Pass 'docker is available' } else { Fail 'docker is required'; throw 'Missing Docker' }
     if (Get-Command curl.exe -ErrorAction SilentlyContinue) { Pass 'curl.exe is available' } else { Fail 'curl.exe is required'; throw 'Missing curl.exe' }
@@ -250,10 +252,14 @@ try {
     $controlId = Get-ContainerId 'control'
     $controlInspect = @(& docker inspect $controlId 2>$null | ConvertFrom-Json)[0]
     if ($null -eq $controlInspect.NetworkSettings.Ports.'4088/tcp') { Pass 'Control API is not published on the host' } else { Fail 'Control API is published on the host' }
+    $runnerBinding = $controlInspect.NetworkSettings.Ports.'4089/tcp'
+    if ($null -ne $runnerBinding -and @($runnerBinding.HostIp) -notcontains '0.0.0.0' -and @($runnerBinding.HostIp) -notcontains '::') { Pass 'Host runner API is published on loopback only' } else { Fail 'Host runner API is not restricted to loopback' }
     $openCodeId = Get-ContainerId 'opencode'
     $openCodeInspect = @(& docker inspect $openCodeId 2>$null | ConvertFrom-Json)[0]
     if (@($openCodeInspect.Mounts.Destination) -notcontains '/var/run/docker.sock') { Pass 'OpenCode does not receive the Docker socket' } else { Fail 'OpenCode receives the Docker socket' }
+    if (@($openCodeInspect.Mounts.Destination) -notcontains '/run/secrets/nestbox-host-token' -and @($openCodeInspect.Config.Env) -notmatch '^NESTBOX_HOST_TOKEN=') { Pass 'OpenCode cannot read the host runner token' } else { Fail 'OpenCode can read the host runner token' }
     if (@($controlInspect.Mounts.Destination) -contains '/var/run/docker.sock') { Pass 'Control receives the Docker socket' } else { Fail 'Control does not receive the Docker socket' }
+    if (@($controlInspect.Mounts.Destination) -contains '/run/secrets/nestbox-host-token') { Pass 'Control receives the host runner token file' } else { Fail 'Control does not receive the host runner token file' }
 
     if ($indexPresent) {
         $result = Invoke-Compose @('exec', '-T', 'php-fpm', 'php', '-l', '/home/code/index.php') -Quiet

package/tests/nestbox.sh

@@ -141,11 +141,8 @@ else
 fi
 
 TEMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/nestbox-test.XXXXXX")"
-configured_queue="$(sed -n 's/^NESTBOX_HOST_QUEUE_PATH=//p' "$ROOT/.env" | tail -n 1)"
-if [[ -z "${NESTBOX_HOST_QUEUE_PATH:-}" && -z "$configured_queue" ]]; then
-    export NESTBOX_HOST_QUEUE_PATH="$TEMP_DIR/host-runner"
-fi
-if [[ -n "${NESTBOX_HOST_QUEUE_PATH:-}" ]]; then mkdir -p "$NESTBOX_HOST_QUEUE_PATH"; fi
+configured_token_file="$(sed -n 's/^NESTBOX_HOST_TOKEN_FILE=//p' "$ROOT/.env" | tail -n 1)"
+if [[ -z "${NESTBOX_HOST_TOKEN_FILE:-}" && -z "$configured_token_file" ]]; then export NESTBOX_HOST_TOKEN_FILE="$TEMP_DIR/host-token"; printf 'test-token-%054d\n' 0 >"$NESTBOX_HOST_TOKEN_FILE"; fi
 
 [[ -f "$ROOT/.env" ]] && pass '.env exists' || fail '.env is missing'
 [[ ! -d "$ROOT/home/.git" ]] && pass 'Page and configuration tree has no embedded Git repository' || fail 'home/.git must not be included in an installation'
@@ -350,11 +347,16 @@ status="$(http_request '/_nestbox/publish?topics=nestbox-test:public' '' 'POST'
 control_id="$(container_id control)"
 control_binding="$(docker inspect --format '{{json (index .NetworkSettings.Ports "4088/tcp")}}' "$control_id" 2>/dev/null || true)"
 [[ -z "$control_binding" || "$control_binding" == "null" ]] && pass 'Control API is not published on the host' || fail 'Control API is published on the host'
+runner_binding="$(docker inspect --format '{{json (index .NetworkSettings.Ports "4089/tcp")}}' "$control_id" 2>/dev/null || true)"
+if [[ "$runner_binding" == *'"HostIp":"127.0.0.1"'* || "$runner_binding" == *'"HostIp":"::1"'* ]]; then pass 'Host runner API is published on loopback only'; else fail 'Host runner API is not restricted to loopback'; fi
 opencode_id="$(container_id opencode)"
 opencode_mounts="$(docker inspect --format '{{range .Mounts}}{{println .Source .Destination}}{{end}}' "$opencode_id" 2>/dev/null || true)"
 grep -Fq '/var/run/docker.sock' <<<"$opencode_mounts" && fail 'OpenCode receives the Docker socket' || pass 'OpenCode does not receive the Docker socket'
+opencode_env="$(docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' "$opencode_id" 2>/dev/null || true)"
+if ! grep -Fq '/run/secrets/nestbox-host-token' <<<"$opencode_mounts" && ! grep -Eq '^NESTBOX_HOST_TOKEN=' <<<"$opencode_env"; then pass 'OpenCode cannot read the host runner token'; else fail 'OpenCode can read the host runner token'; fi
 control_mounts="$(docker inspect --format '{{range .Mounts}}{{println .Source .Destination}}{{end}}' "$control_id" 2>/dev/null || true)"
 grep -Fq '/var/run/docker.sock' <<<"$control_mounts" && pass 'Control receives the Docker socket' || fail 'Control does not receive the Docker socket'
+grep -Fq '/run/secrets/nestbox-host-token' <<<"$control_mounts" && pass 'Control receives the host runner token file' || fail 'Control does not receive the host runner token file'
 
 if ((INDEX_PRESENT)); then
     if compose exec -T php-fpm php -l /home/code/index.php >/dev/null 2>&1; then