@paperclipai/adapter-utils 2026.1007.0-canary.13 → 2026.1007.0-canary.14

package/dist/execution-target-sandbox.test.js

@@ -940,6 +940,7 @@ describe("sandbox adapter execution targets", () => {
         // ACP keeps stdin open while it waits for a handshake. A remote child can
         // exit before replying; that must close the proxy and fail the handshake.
         const output = "final output\n".repeat(16_384);
+        const logs = [];
         const bridge = await startAdapterExecutionTargetProcessSessionBridge({
             runId: "run-open-stdin",
             target: {
@@ -957,11 +958,17 @@ describe("sandbox adapter execution targets", () => {
             env: {},
             timeoutSec: 10,
             streamOutputViaSession,
+            onLog: async (stream, chunk) => { if (stream === "stderr")
+                logs.push(chunk); },
         });
         expect(bridge).not.toBeNull();
         try {
             const result = await runProxyWithInput(bridge.agentCommand, "initialize\n", true);
             expect(result.code).toBe(exitCode ?? 1);
+            const terminal = logs.filter((line) => line.includes("ACP process session terminal:"));
+            expect(terminal).toEqual([
+                `[paperclip] ACP process session terminal: source=remote_event outcome=${exitCode === null ? "error" : "exit"} exitCode=${exitCode ?? "unknown"} signal=unknown.\n`,
+            ]);
             if (exitCode === null) {
                 expect(result.stdout).toBe("");
                 expect(result.stderr).toContain("ENOENT");
@@ -975,6 +982,204 @@ describe("sandbox adapter execution targets", () => {
             await bridge?.stop();
         }
     }, 15_000);
+    it("flushes remote errors under backpressure and retains only bounded terminal evidence", async () => {
+        const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-terminal-flush-"));
+        cleanupDirs.push(rootDir);
+        const delegate = createLocalSandboxRunner();
+        const logs = [];
+        let emit;
+        let complete;
+        let failInput;
+        let inputStarted = false;
+        const inputFailure = new Promise((_resolve, reject) => { failInput = reject; });
+        void inputFailure.catch(() => { });
+        const commandComplete = new Promise((resolve) => { complete = resolve; });
+        const frame = {
+            type: "error", message: "synthetic-private-detail".repeat(200_000),
+            code: 1e100, signal: "untrusted-private-signal",
+        };
+        const bridge = await startAdapterExecutionTargetProcessSessionBridge({
+            runId: "terminal-flush", adapterKey: "acpx", runtimeRootDir: rootDir,
+            target: {
+                kind: "remote", transport: "sandbox", remoteCwd: rootDir,
+                runner: { execute: async (input) => {
+                        if (!input.useSession) {
+                            const script = input.args?.[1] ?? "";
+                            if (script.startsWith("mkdir -p") && script.includes("/stdin/000000000001.json")) {
+                                inputStarted = true;
+                                return inputFailure;
+                            }
+                            return delegate.execute(input);
+                        }
+                        emit = async (text) => { await input.onLog?.("stdout", text); };
+                        await commandComplete;
+                        return { exitCode: 1, stdout: "", stderr: "", timedOut: false, signal: null, pid: null, startedAt: null };
+                    } },
+            },
+            command: "cat", args: [], cwd: rootDir, env: {}, streamOutputViaSession: true,
+            onLog: async (stream, chunk) => { if (stream === "stderr")
+                logs.push(chunk); },
+        });
+        let peer;
+        try {
+            const source = await readFile(bridge.agentCommand, "utf8");
+            const port = Number(/port: (\d+)/.exec(source)[1]);
+            const token = JSON.parse(/const token = (".*?");/.exec(source)[1]);
+            peer = net.createConnection({ host: "127.0.0.1", port });
+            peer.on("error", () => { });
+            peer.setEncoding("utf8");
+            let output = "";
+            peer.on("data", (chunk) => { output += chunk; });
+            const closed = new Promise((resolve) => peer.once("close", resolve));
+            await new Promise((resolve) => peer.once("connect", resolve));
+            peer.write(JSON.stringify({ token, type: "hello" }) + "\n");
+            // Confirm authentication by receiving a marker before applying backpressure.
+            await emit(JSON.stringify({ type: "data", stream: "stdout", data: "" }) + "\n");
+            await waitForCondition(() => output.length > 0, "Missing authenticated marker.");
+            output = "";
+            peer.write(JSON.stringify({ token, type: "stdin", data: "aW5wdXQ=" }) + "\n");
+            await waitForCondition(() => inputStarted, "Input write did not start.");
+            peer.pause();
+            // The real wrapper emits error then exit when a child fails to spawn.
+            // A later frame must not write after end() and abort the pending error.
+            await emit([
+                frame,
+                { type: "exit", code: 1 },
+                { type: "data", stream: "stdout", data: "bGF0ZQ==" },
+                { type: "shutdownAck" },
+            ].map((event) => JSON.stringify(event) + "\n").join(""));
+            // The reverse race matters too: an already-accepted input write can
+            // reject after the remote error started draining. Its end(data) must
+            // not abort or replace the first terminal frame.
+            failInput(new Error("synthetic-private-input-detail"));
+            await waitForCondition(() => logs.some((line) => line.includes("ACP process session input delivery failed.")), "Input failure was not handled.");
+            peer.resume();
+            await closed;
+            expect(JSON.parse(output)).toEqual(frame);
+            expect(logs.filter((line) => line.includes("ACP process session terminal:"))).toEqual([
+                "[paperclip] ACP process session terminal: source=remote_event outcome=error exitCode=unknown signal=unknown.\n",
+            ]);
+        }
+        finally {
+            failInput(new Error("test cleanup"));
+            complete();
+            peer?.destroy();
+            await bridge?.stop();
+        }
+    }, 15_000);
+    it("reports a streamed transport failure even when diagnostic persistence stalls", async () => {
+        const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-terminal-stream-"));
+        cleanupDirs.push(rootDir);
+        const delegate = createLocalSandboxRunner();
+        const logs = [];
+        let releaseLog;
+        const stalledLog = new Promise((resolve) => { releaseLog = resolve; });
+        const bridge = await startAdapterExecutionTargetProcessSessionBridge({
+            runId: "terminal-stream", adapterKey: "acpx", runtimeRootDir: rootDir,
+            target: {
+                kind: "remote", transport: "sandbox", remoteCwd: rootDir,
+                runner: { execute: async (input) => {
+                        if (input.useSession)
+                            throw new Error("synthetic-private-provider-detail");
+                        return delegate.execute(input);
+                    } },
+            },
+            command: "cat", args: [], cwd: rootDir, env: {}, streamOutputViaSession: true,
+            onLog: async (stream, chunk) => {
+                if (stream === "stderr") {
+                    logs.push(chunk);
+                    await stalledLog;
+                }
+            },
+        });
+        try {
+            const result = await runProxyWithInput(bridge.agentCommand, "", true);
+            expect(result.code).toBe(1);
+            expect(logs).toEqual([
+                "[paperclip] ACP process session terminal: source=output_stream outcome=error exitCode=unknown signal=unknown.\n",
+            ]);
+        }
+        finally {
+            releaseLog();
+            await bridge?.stop();
+        }
+    }, 10_000);
+    it("closes a failed output poll without waiting for the run log", async () => {
+        const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-terminal-poll-"));
+        cleanupDirs.push(rootDir);
+        const delegate = createLocalSandboxRunner();
+        const logs = [];
+        let releaseLog;
+        const stalledLog = new Promise((resolve) => { releaseLog = resolve; });
+        const bridge = await startAdapterExecutionTargetProcessSessionBridge({
+            runId: "terminal-poll", adapterKey: "acpx", runtimeRootDir: rootDir,
+            target: {
+                kind: "remote", transport: "sandbox", remoteCwd: rootDir,
+                runner: { execute: async (input) => {
+                        const script = input.args?.[1] ?? "";
+                        if (script.includes("/events'/*.json"))
+                            throw new Error("synthetic-private-provider-detail");
+                        return delegate.execute(input);
+                    } },
+            },
+            command: "cat", args: [], cwd: rootDir, env: {},
+            onLog: async (stream, chunk) => {
+                if (stream === "stderr") {
+                    logs.push(chunk);
+                    await stalledLog;
+                }
+            },
+        });
+        try {
+            const result = await runProxyWithInput(bridge.agentCommand, "", true);
+            expect(result.code).toBe(1);
+            expect(logs).toEqual([
+                "[paperclip] ACP process session terminal: source=output_poll outcome=error exitCode=unknown signal=unknown.\n",
+            ]);
+        }
+        finally {
+            releaseLog();
+            await bridge?.stop();
+        }
+    }, 10_000);
+    it("records an unexpected authenticated proxy close once and ignores unauthenticated peers", async () => {
+        const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-terminal-proxy-"));
+        cleanupDirs.push(rootDir);
+        const logs = [];
+        const bridge = await startAdapterExecutionTargetProcessSessionBridge({
+            runId: "terminal-proxy", adapterKey: "acpx", runtimeRootDir: rootDir,
+            target: { kind: "remote", transport: "sandbox", remoteCwd: rootDir, runner: createLocalSandboxRunner() },
+            command: "cat", args: [], cwd: rootDir, env: {},
+            onLog: async (stream, chunk) => { if (stream === "stderr")
+                logs.push(chunk); },
+        });
+        try {
+            const source = await readFile(bridge.agentCommand, "utf8");
+            const port = Number(/port: (\d+)/.exec(source)[1]);
+            const token = JSON.parse(/const token = (".*?");/.exec(source)[1]);
+            for (const authenticated of [false, true]) {
+                const peer = net.createConnection({ host: "127.0.0.1", port });
+                peer.on("error", () => { });
+                const closed = new Promise((resolve) => peer.once("close", resolve));
+                await new Promise((resolve) => peer.once("connect", resolve));
+                if (authenticated)
+                    peer.end(JSON.stringify({ token, type: "hello" }) + "\n");
+                else
+                    peer.end();
+                await closed;
+                if (!authenticated)
+                    expect(logs).toEqual([]);
+            }
+            await waitForCondition(() => logs.length === 1, "Missing proxy-close diagnostic.");
+            await bridge.stop();
+            expect(logs.filter((line) => line.includes("ACP process session terminal:"))).toEqual([
+                "[paperclip] ACP process session terminal: source=proxy_close outcome=error exitCode=unknown signal=unknown.\n",
+            ]);
+        }
+        finally {
+            await bridge?.stop();
+        }
+    }, 10_000);
     it("buffers sandbox process session output until the local proxy connects", async () => {
         const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-process-session-buffer-"));
         cleanupDirs.push(rootDir);