@powerhousedao/switchboard 6.2.3-dev.5 → 6.2.3-dev.50

package/test/boot-without-require-signatures.test.ts

@@ -0,0 +1,74 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { ILogger } from "document-model";
+import { describe, expect, it, vi } from "vitest";
+import { startSwitchboard } from "../src/server.mjs";
+
+function stubLogger(): ILogger & { info: ReturnType<typeof vi.fn> } {
+  const logger = {
+    verbose: vi.fn(),
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    child: vi.fn(),
+  };
+  logger.child.mockReturnValue(logger);
+  return logger as unknown as ILogger & { info: ReturnType<typeof vi.fn> };
+}
+
+describe("booting Switchboard", () => {
+  it("has no REQUIRE_SIGNATURES flag, and ignores the variable", async () => {
+    const tempRoot = await mkdtemp(join(tmpdir(), "switchboard-signatures-"));
+    const previous = {
+      reactorDb: process.env.PH_REACTOR_DATABASE_URL,
+      requireSignatures: process.env.REQUIRE_SIGNATURES,
+    };
+    process.env.PH_REACTOR_DATABASE_URL = join(tempRoot, "reactor-storage");
+    process.env.REQUIRE_SIGNATURES = "true";
+    const logger = stubLogger();
+    let switchboard: Awaited<ReturnType<typeof startSwitchboard>> | undefined;
+
+    try {
+      switchboard = await startSwitchboard({
+        workflows: { enabled: false },
+        dbPath: join(tempRoot, "read-model"),
+        port: 0,
+        mcp: false,
+        disableLocalPackages: true,
+        identity: { keypairPath: join(tempRoot, "identity.json") },
+        logger,
+      });
+
+      const flagLog = logger.info.mock.calls.find(
+        ([message]) => message === "Feature flags: @flags",
+      );
+      expect(flagLog).toBeDefined();
+      expect(JSON.parse(flagLog![1] as string)).not.toHaveProperty(
+        "REQUIRE_SIGNATURES",
+      );
+
+      const created = await switchboard.reactor.createEmpty(
+        "powerhouse/document-model",
+      );
+      expect(created.header.id).toBeTruthy();
+
+      await switchboard.shutdown();
+      switchboard = undefined;
+    } finally {
+      await switchboard?.shutdown();
+      for (const [name, value] of [
+        ["PH_REACTOR_DATABASE_URL", previous.reactorDb],
+        ["REQUIRE_SIGNATURES", previous.requireSignatures],
+      ] as const) {
+        if (value === undefined) {
+          delete process.env[name];
+        } else {
+          process.env[name] = value;
+        }
+      }
+      await rm(tempRoot, { recursive: true, force: true });
+    }
+  }, 60_000);
+});

package/test/boot-worker-trust-policy.test.ts

@@ -0,0 +1,90 @@
+import type { ILogger } from "document-model";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type * as RenownModule from "../src/renown.js";
+import { startSwitchboard } from "../src/server.mjs";
+
+vi.mock("../src/renown.js", async (importOriginal) => ({
+  ...(await importOriginal<typeof RenownModule>()),
+  initRenown: vi.fn().mockRejectedValue(new Error("Renown is unreachable")),
+}));
+
+const TRUST_FAILURE =
+  /REACTOR_WORKERS[\s\S]*REACTOR_AUTH_ENFORCEMENT[\s\S]*RENOWN_SOURCE/;
+const ENV_KEYS = [
+  "PH_REACTOR_DATABASE_URL",
+  "RENOWN_SOURCE",
+  "REACTOR_DOCUMENT_DECISIONS",
+  "REACTOR_AUTH_ENFORCEMENT",
+] as const;
+
+function stubLogger(): ILogger {
+  const logger = {
+    verbose: vi.fn(),
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    child: vi.fn(),
+  };
+  logger.child.mockReturnValue(logger);
+  return logger as unknown as ILogger;
+}
+
+describe("booting with pooled workers under authEnforcement", () => {
+  let tempRoot: string;
+  let previous: Partial<Record<(typeof ENV_KEYS)[number], string>>;
+
+  beforeEach(async () => {
+    tempRoot = await mkdtemp(join(tmpdir(), "switchboard-worker-trust-"));
+    previous = Object.fromEntries(ENV_KEYS.map((k) => [k, process.env[k]]));
+    process.env.PH_REACTOR_DATABASE_URL = join(tempRoot, "reactor-storage");
+    process.env.REACTOR_DOCUMENT_DECISIONS = "true";
+    process.env.REACTOR_AUTH_ENFORCEMENT = "true";
+  });
+
+  afterEach(async () => {
+    for (const key of ENV_KEYS) {
+      if (previous[key] === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = previous[key];
+      }
+    }
+    await rm(tempRoot, { recursive: true, force: true });
+  });
+
+  function boot(numWorkers: number) {
+    return startSwitchboard({
+      workflows: { enabled: false },
+      dbPath: join(tempRoot, "read-model"),
+      port: 0,
+      mcp: false,
+      disableLocalPackages: true,
+      logger: stubLogger(),
+      workerPool: { numWorkers },
+    });
+  }
+
+  it("fails with a self Renown source", async () => {
+    process.env.RENOWN_SOURCE = "self";
+
+    await expect(boot(2)).rejects.toThrow(TRUST_FAILURE);
+  });
+
+  // Postgres is the next requirement a pooled boot has; reaching it passes the check.
+  it("passes the check with a remote Renown source", async () => {
+    process.env.RENOWN_SOURCE = "remote";
+
+    await expect(boot(2)).rejects.toThrow(/requires a Postgres/);
+  });
+
+  // No loaded package serves the renown read model here; reaching that check passes this one.
+  it("passes the check without workers", async () => {
+    process.env.RENOWN_SOURCE = "self";
+
+    await expect(boot(0)).rejects.toThrow(/no loaded package serves/);
+  }, 60_000);
+});

package/test/builder-defaults.test.ts

@@ -0,0 +1,80 @@
+import type { ISigner } from "@powerhousedao/shared/document-model";
+import {
+  ReactorBuilder,
+  ReactorClientBuilder,
+  type FactorySpec,
+} from "@powerhousedao/reactor";
+import type { IRenown } from "@renown/sdk/node";
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { describe, expect, it, vi } from "vitest";
+import { applySwitchboardReactorDefaults } from "../src/builder-defaults.mjs";
+import {
+  getRenownSignerConfig,
+  getRenownWorkerSignerSpec,
+} from "../src/renown.js";
+
+const USER = { address: "0xswitchboard", networkId: "eip155", chainId: 1 };
+
+function stubRenown(user = USER): IRenown {
+  const signer = {
+    user,
+    app: { name: "switchboard", key: "did:key:zSwitchboard" },
+  } as unknown as ISigner;
+  return { signer } as unknown as IRenown;
+}
+
+describe("applySwitchboardReactorDefaults", () => {
+  it("gives the reactor the signer and its worker spec", () => {
+    const reactorBuilder = new ReactorBuilder();
+    const clientBuilder = new ReactorClientBuilder();
+    const reactorWithSigner = vi.spyOn(reactorBuilder, "withSigner");
+    const clientWithSigner = vi.spyOn(clientBuilder, "withSigner");
+    const signer = getRenownSignerConfig(stubRenown(), ".ph/key.json");
+
+    applySwitchboardReactorDefaults(reactorBuilder, clientBuilder, {
+      includeBaseModels: false,
+      signalHandlers: false,
+      signer,
+    });
+
+    expect(clientWithSigner).toHaveBeenCalledWith(signer);
+    expect(reactorWithSigner).toHaveBeenCalledWith(
+      signer.signer,
+      signer.workerSigner,
+    );
+    expect(reactorBuilder.hasSigner()).toBe(true);
+  });
+});
+
+describe("getRenownWorkerSignerSpec", () => {
+  it("points workers at createNodeRenownSigner over the stored key", () => {
+    const spec: FactorySpec = getRenownWorkerSignerSpec(
+      stubRenown(),
+      ".ph/key.json",
+    );
+
+    expect(spec.module.exportName).toBe("createNodeRenownSigner");
+    const filePath = "filePath" in spec.module ? spec.module.filePath : "";
+    expect(existsSync(filePath)).toBe(true);
+    expect(spec.initArgs).toEqual({
+      appName: "switchboard",
+      keypairPath: resolve(".ph/key.json"),
+      did: "did:key:zSwitchboard",
+      user: USER,
+    });
+  });
+
+  it("leaves the user out when none is logged in", () => {
+    const renown = stubRenown();
+    (renown.signer as { user?: unknown }).user = undefined;
+
+    const spec = getRenownWorkerSignerSpec(renown);
+
+    expect(spec.initArgs).toEqual({
+      appName: "switchboard",
+      keypairPath: resolve(".ph/.keypair.json"),
+      did: "did:key:zSwitchboard",
+    });
+  });
+});

package/test/create-signature-policy.test.ts

@@ -0,0 +1,69 @@
+import { ReactorBuilder, ReactorClientBuilder } from "@powerhousedao/reactor";
+import { describe, expect, it, vi } from "vitest";
+import { applySwitchboardReactorDefaults } from "../src/builder-defaults.mjs";
+import { resolveCreateSignaturePolicy } from "../src/create-signature-policy.mjs";
+
+describe("resolveCreateSignaturePolicy", () => {
+  it("defaults to v2-required with a signer", () => {
+    expect(resolveCreateSignaturePolicy({}, { hasSigner: true })).toBe(
+      "v2-required",
+    );
+  });
+
+  it("reads CREATE_SIGNATURE_POLICY", () => {
+    expect(
+      resolveCreateSignaturePolicy(
+        { CREATE_SIGNATURE_POLICY: "legacy" },
+        { hasSigner: true },
+      ),
+    ).toBe("legacy");
+    expect(
+      resolveCreateSignaturePolicy(
+        { CREATE_SIGNATURE_POLICY: " v2-required " },
+        { hasSigner: true },
+      ),
+    ).toBe("v2-required");
+  });
+
+  it("refuses an unknown value", () => {
+    expect(() =>
+      resolveCreateSignaturePolicy(
+        { CREATE_SIGNATURE_POLICY: "v2" },
+        { hasSigner: true },
+      ),
+    ).toThrow(/CREATE_SIGNATURE_POLICY/);
+  });
+
+  it("falls back to legacy with a warning when there is no signer", () => {
+    const warn = vi.fn();
+
+    expect(
+      resolveCreateSignaturePolicy({}, { hasSigner: false, logger: { warn } }),
+    ).toBe("legacy");
+    expect(warn).toHaveBeenCalledOnce();
+
+    warn.mockClear();
+    expect(
+      resolveCreateSignaturePolicy(
+        { CREATE_SIGNATURE_POLICY: "legacy" },
+        { hasSigner: false, logger: { warn } },
+      ),
+    ).toBe("legacy");
+    expect(warn).not.toHaveBeenCalled();
+  });
+});
+
+describe("applySwitchboardReactorDefaults", () => {
+  it("hands the creation policy to the client builder", () => {
+    const clientBuilder = new ReactorClientBuilder();
+    const withPolicy = vi.spyOn(clientBuilder, "withCreateSignaturePolicy");
+
+    applySwitchboardReactorDefaults(new ReactorBuilder(), clientBuilder, {
+      includeBaseModels: false,
+      signalHandlers: false,
+      createSignaturePolicy: "legacy",
+    });
+
+    expect(withPolicy).toHaveBeenCalledWith("legacy");
+  });
+});

package/test/durable-node-fs-pg16.test.ts

@@ -0,0 +1,80 @@
+import { createDurableNodeFs } from "@powerhousedao/reactor-api/pglite-node";
+import nodeFs, { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { loadNodeFsClass, loadPGliteModule } from "../src/pglite-version.js";
+
+// A fresh initdb takes ~10 s under suite load; the Windows runner is slower.
+const BOOT = 180_000;
+const COMMITS = 10;
+const RM = { recursive: true, force: true, maxRetries: 10 } as const;
+
+describe("durable NodeFS over pglite-legacy-02 (PG16)", () => {
+  const tempDirs: string[] = [];
+
+  afterEach(async () => {
+    for (const dir of tempDirs.splice(0)) {
+      await fs.rm(dir, RM);
+    }
+  });
+
+  it(
+    "opens a PG16 dir over pglite-legacy-02 with the durable fs",
+    async () => {
+      const dir = await fs.mkdtemp(path.join(os.tmpdir(), "durable-pg16-"));
+      tempDirs.push(dir);
+      const counts = { fsync: 0, fdatasync: 0 };
+      const hostFs = {
+        fsyncSync: (fd: number) => {
+          counts.fsync++;
+          nodeFs.fsyncSync(fd);
+        },
+        fdatasyncSync: (fd: number) => {
+          counts.fdatasync++;
+          nodeFs.fdatasyncSync(fd);
+        },
+      };
+      const [{ PGlite }, NodeFS] = await Promise.all([
+        loadPGliteModule(16),
+        loadNodeFsClass(16),
+      ]);
+      const pg = new PGlite({
+        fs: createDurableNodeFs(NodeFS, dir, {
+          hostFs,
+          maintenanceIntervalMs: 0,
+        }),
+      });
+      try {
+        await pg.waitReady;
+        const version = await pg.query<{ v: string }>(
+          "SELECT current_setting('server_version_num') AS v",
+        );
+        expect(version.rows[0].v.startsWith("16")).toBe(true);
+        await pg.exec("CREATE TABLE t (v int)");
+        const before = counts.fdatasync;
+        for (let i = 0; i < COMMITS; i++) {
+          await pg.exec(`INSERT INTO t VALUES (${i})`);
+        }
+        const perCommit = counts.fdatasync - before;
+        const fsyncBefore = counts.fsync;
+        await pg.exec("CHECKPOINT");
+        const checkpointSyncs = counts.fsync - fsyncBefore;
+        console.info(
+          `pglite-legacy-02: ${perCommit} host fdatasync over ${COMMITS} commits, ${checkpointSyncs} host fsync on CHECKPOINT, ${fsyncBefore} host fsync since open`,
+        );
+        // Pins decision 5's outcome on 0.2.17: WAL goes through
+        // open_datasync, which never reaches the fdatasync hook, so commits
+        // are not synced; the stream-op patch does take (CHECKPOINT syncs).
+        expect(perCommit).toBe(0);
+        expect(checkpointSyncs).toBeGreaterThan(0);
+      } finally {
+        await pg.close();
+      }
+      expect(
+        (await fs.readFile(path.join(dir, "PG_VERSION"), "utf8")).trim(),
+      ).toBe("16");
+    },
+    BOOT,
+  );
+});

package/test/fatal-shutdown.test.ts

@@ -0,0 +1,165 @@
+import { EventEmitter } from "node:events";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+  installFatalErrorShutdown,
+  triggerFatalShutdown,
+} from "../src/fatal-shutdown.mjs";
+
+function makeProc() {
+  const emitter = new EventEmitter();
+  const proc = Object.assign(emitter, {
+    pid: 1234,
+    exitCode: undefined as number | undefined,
+    kill: vi.fn((_pid: number, signal: string) => {
+      emitter.emit(signal);
+      return true;
+    }),
+    exit: vi.fn(),
+  });
+  return proc;
+}
+
+const logger = {
+  error: vi.fn(),
+} as unknown as Parameters<typeof installFatalErrorShutdown>[0];
+
+describe("installFatalErrorShutdown", () => {
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it.each(["uncaughtException", "unhandledRejection"])(
+    "routes %s through SIGTERM with exit code 1",
+    (event) => {
+      const proc = makeProc();
+      const onSigterm = vi.fn();
+      proc.on("SIGTERM", onSigterm);
+      installFatalErrorShutdown(logger, proc as never);
+
+      proc.emit(event, new Error("boom"));
+
+      expect(proc.kill).toHaveBeenCalledWith(1234, "SIGTERM");
+      expect(onSigterm).toHaveBeenCalledOnce();
+      expect(proc.exitCode).toBe(1);
+      expect(proc.exit).not.toHaveBeenCalled();
+    },
+  );
+
+  it("leaves an unhandled rejection to another listener, such as Sentry's", () => {
+    const proc = makeProc();
+    const other = vi.fn();
+    proc.on("unhandledRejection", other);
+    installFatalErrorShutdown(logger, proc as never);
+
+    proc.emit("unhandledRejection", new Error("boom"));
+
+    expect(other).toHaveBeenCalledOnce();
+    expect(proc.kill).not.toHaveBeenCalled();
+    expect(proc.exitCode).toBeUndefined();
+  });
+
+  it("still shuts down on an uncaught exception when another listener exists", () => {
+    const proc = makeProc();
+    proc.on("uncaughtException", vi.fn());
+    installFatalErrorShutdown(logger, proc as never);
+
+    proc.emit("uncaughtException", new Error("boom"));
+
+    expect(proc.kill).toHaveBeenCalledWith(1234, "SIGTERM");
+    expect(proc.exitCode).toBe(1);
+  });
+
+  it("signals once when a second fatal error arrives during shutdown", () => {
+    const proc = makeProc();
+    installFatalErrorShutdown(logger, proc as never);
+
+    proc.emit("unhandledRejection", new Error("first"));
+    proc.emit("uncaughtException", new Error("second"));
+
+    expect(proc.kill).toHaveBeenCalledOnce();
+  });
+
+  it("forces exit 1 through the original exit when shutdown hangs", () => {
+    vi.useFakeTimers();
+    const proc = makeProc();
+    const originalExit = proc.exit;
+    installFatalErrorShutdown(logger, proc as never);
+    // The builder swaps process.exit for a recording shim during shutdown.
+    proc.exit = vi.fn();
+
+    proc.emit("unhandledRejection", new Error("boom"));
+    vi.advanceTimersByTime(15_000);
+
+    expect(originalExit).toHaveBeenCalledWith(1);
+    expect(proc.exit).not.toHaveBeenCalled();
+  });
+
+  it("still reaches exit when the logger itself throws EPIPE inside onFatal", () => {
+    vi.useFakeTimers();
+    const proc = makeProc();
+    const onSigterm = vi.fn();
+    proc.on("SIGTERM", onSigterm);
+    const error = vi.fn(() => {
+      throw Object.assign(new Error("write EPIPE"), { code: "EPIPE" });
+    });
+    const throwingLogger = { error } as unknown as Parameters<
+      typeof installFatalErrorShutdown
+    >[0];
+    installFatalErrorShutdown(throwingLogger, proc as never);
+
+    // Without the guard the EPIPE propagates out of the uncaughtException
+    // listener, which in a real process re-enters fatal handling instead of
+    // running the shutdown.
+    expect(() =>
+      proc.emit("uncaughtException", new Error("boom")),
+    ).not.toThrow();
+
+    expect(proc.kill).toHaveBeenCalledOnce();
+    expect(onSigterm).toHaveBeenCalledOnce();
+    expect(proc.exitCode).toBe(1);
+
+    vi.advanceTimersByTime(15_000);
+
+    expect(proc.exit).toHaveBeenCalledTimes(1);
+    expect(proc.exit).toHaveBeenCalledWith(1);
+    // Exactly the two guarded log attempts: the fatal report and the
+    // forced-exit notice. A re-entered handler would log again.
+    expect(error).toHaveBeenCalledTimes(2);
+  });
+
+  it("routes a triggered fatal error through SIGTERM with exit code 1", () => {
+    const proc = makeProc();
+    const onSigterm = vi.fn();
+    proc.on("SIGTERM", onSigterm);
+    installFatalErrorShutdown(logger, proc as never);
+
+    expect(
+      triggerFatalShutdown("Flush failed", new Error("ENOSPC"), proc as never),
+    ).toBe(true);
+    triggerFatalShutdown("Flush failed", new Error("ENOSPC"), proc as never);
+    proc.emit("uncaughtException", new Error("later"));
+
+    expect(proc.kill).toHaveBeenCalledOnce();
+    expect(onSigterm).toHaveBeenCalledOnce();
+    expect(proc.exitCode).toBe(1);
+  });
+
+  it("ignores a trigger when shutdown on fatal errors is not installed", () => {
+    const proc = makeProc();
+
+    expect(
+      triggerFatalShutdown("Flush failed", new Error("ENOSPC"), proc as never),
+    ).toBe(false);
+    expect(proc.kill).not.toHaveBeenCalled();
+    expect(proc.exitCode).toBeUndefined();
+  });
+
+  it("installs its listeners once per process", () => {
+    const proc = makeProc();
+    installFatalErrorShutdown(logger, proc as never);
+    installFatalErrorShutdown(logger, proc as never);
+
+    expect(proc.listenerCount("uncaughtException")).toBe(1);
+    expect(proc.listenerCount("unhandledRejection")).toBe(1);
+  });
+});

package/test/mcp-flag.test.ts

@@ -0,0 +1,56 @@
+import { afterEach, beforeAll, describe, expect, it } from "vitest";
+import { initFeatureFlags } from "../src/feature-flags.js";
+import { MCP_ENABLED, resolveMcpEnabled } from "../src/mcp-flag.mjs";
+import type { BooleanFlagSource } from "../src/workflow-runtime.mjs";
+
+describe("resolveMcpEnabled", () => {
+  let featureFlags: BooleanFlagSource;
+
+  beforeAll(async () => {
+    featureFlags = await initFeatureFlags();
+  });
+
+  afterEach(() => {
+    delete process.env[MCP_ENABLED];
+  });
+
+  it("defaults to on", async () => {
+    await expect(resolveMcpEnabled({ featureFlags })).resolves.toBe(true);
+    await expect(
+      resolveMcpEnabled({ featureFlags, option: true }),
+    ).resolves.toBe(true);
+  });
+
+  it('is turned off by MCP_ENABLED="false"', async () => {
+    process.env[MCP_ENABLED] = "false";
+
+    await expect(resolveMcpEnabled({ featureFlags })).resolves.toBe(false);
+  });
+
+  // `ph vetra` passes `mcp: true` explicitly; the env var still wins.
+  it("turns off a host that asked for MCP", async () => {
+    process.env[MCP_ENABLED] = "false";
+
+    await expect(
+      resolveMcpEnabled({ featureFlags, option: true }),
+    ).resolves.toBe(false);
+  });
+
+  it("never turns on a host that switched MCP off", async () => {
+    process.env[MCP_ENABLED] = "true";
+
+    await expect(
+      resolveMcpEnabled({ featureFlags, option: false }),
+    ).resolves.toBe(false);
+  });
+
+  it("leaves MCP on for any value but the string false", async () => {
+    for (const raw of ["true", "0", "no", ""]) {
+      process.env[MCP_ENABLED] = raw;
+      await expect(
+        resolveMcpEnabled({ featureFlags }),
+        `MCP_ENABLED=${JSON.stringify(raw)}`,
+      ).resolves.toBe(true);
+    }
+  });
+});