@ryanfw/prompt-orchestration-pipeline 1.3.3 → 1.3.4

package/src/ui/server/endpoints/__tests__/upload-endpoints.test.ts

@@ -1,12 +1,14 @@
-import { mkdtemp, readFile, rm, stat } from "node:fs/promises";
+import { mkdtemp, mkdir, readFile, rm, stat } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
 
 import { zipSync } from "fflate";
-import { describe, expect, it } from "vitest";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
 
 import { handleSeedUploadDirect, normalizeSeedUpload } from "../upload-endpoints";
 
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
 async function pathExists(target: string): Promise<boolean> {
   try {
     await stat(target);
@@ -27,6 +29,32 @@ function concatBytes(parts: Uint8Array[]): Uint8Array<ArrayBuffer> {
   return out;
 }
 
+async function scaffoldWorkspace(tmpDir: string): Promise<void> {
+  const pipelineConfigDir = path.join(tmpDir, "pipeline-config", "test-pipeline");
+  await mkdir(pipelineConfigDir, { recursive: true });
+  await mkdir(path.join(pipelineConfigDir, "tasks"), { recursive: true });
+
+  await Bun.write(
+    path.join(tmpDir, "pipeline-config", "registry.json"),
+    JSON.stringify({
+      version: 1,
+      pipelines: {
+        "test-pipeline": {
+          name: "Test Pipeline",
+          description: "test pipeline",
+          configDir: pipelineConfigDir,
+          tasksDir: path.join(pipelineConfigDir, "tasks"),
+        },
+      },
+    }),
+  );
+
+  await Bun.write(
+    path.join(pipelineConfigDir, "pipeline.json"),
+    JSON.stringify({ name: "test-pipeline", tasks: [] }),
+  );
+}
+
 describe("normalizeSeedUpload", () => {
   it("extracts seed and binary artifact from a multipart zip upload", async () => {
     const seed = { name: "demo", pipeline: "x" };
@@ -57,10 +85,8 @@ describe("normalizeSeedUpload", () => {
 
     const result = await normalizeSeedUpload(request);
 
-    // AC3: seedObject deep-equals the original seed.
     expect(result.seedObject).toEqual(seed);
 
-    // AC3: exactly one artifact, byte-identical to the source blob.
     expect(result.artifacts).toHaveLength(1);
     const blob = result.artifacts![0]!;
     expect(blob.filename).toBe("artifacts/blob.bin");
@@ -70,110 +96,150 @@ describe("normalizeSeedUpload", () => {
 });
 
 describe("handleSeedUploadDirect", () => {
+  let dataDir: string;
+
+  beforeEach(async () => {
+    dataDir = await mkdtemp(path.join(tmpdir(), "upload-endpoint-"));
+    await scaffoldWorkspace(dataDir);
+  });
+
+  afterEach(async () => {
+    await rm(dataDir, { recursive: true, force: true });
+  });
+
   it("stages artifacts under staging/{jobId}/ without creating current/{jobId}/", async () => {
-    const dataDir = await mkdtemp(path.join(tmpdir(), "upload-direct-"));
-    try {
-      const content = new TextEncoder().encode("# notes\nhello\n");
-      const seedObject = { name: "demo", pipeline: "x" };
-
-      const response = await handleSeedUploadDirect(seedObject, dataDir, [
-        { filename: "notes.md", content },
-      ]);
-      expect(response.status).toBe(201);
-      const body = (await response.json()) as { data: { jobId: string } };
-      const jobId = body.data.jobId;
-
-      const pipelineData = path.join(dataDir, "pipeline-data");
-
-      // Artifact staged byte-identical under staging/{jobId}/.
-      const staged = path.join(pipelineData, "staging", jobId, "notes.md");
-      const stagedBytes = await readFile(staged);
-      expect(Array.from(stagedBytes)).toEqual(Array.from(content));
-
-      // Pending seed trigger written.
-      expect(await pathExists(path.join(pipelineData, "pending", `${jobId}-seed.json`))).toBe(true);
-
-      // The endpoint must not create current/{jobId}/.
-      expect(await pathExists(path.join(pipelineData, "current", jobId))).toBe(false);
-    } finally {
-      await rm(dataDir, { recursive: true, force: true });
-    }
+    const content = new TextEncoder().encode("# notes\nhello\n");
+    const seedObject = { name: "demo", pipeline: "test-pipeline" };
+
+    const response = await handleSeedUploadDirect(seedObject, dataDir, [
+      { filename: "notes.md", content },
+    ]);
+    expect(response.status).toBe(201);
+    const body = (await response.json()) as { data: { jobId: string } };
+    const jobId = body.data.jobId;
+    expect(jobId).toMatch(UUID_PATTERN);
+
+    const pipelineData = path.join(dataDir, "pipeline-data");
+
+    const staged = path.join(pipelineData, "staging", jobId, "notes.md");
+    const stagedBytes = await readFile(staged);
+    expect(Array.from(stagedBytes)).toEqual(Array.from(content));
+
+    expect(await pathExists(path.join(pipelineData, "pending", `${jobId}-seed.json`))).toBe(true);
+
+    expect(await pathExists(path.join(pipelineData, "current", jobId))).toBe(false);
+  });
+
+  it("rejects seed with unknown pipeline as 400 with error envelope and writes no files", async () => {
+    const response = await handleSeedUploadDirect(
+      { name: "demo", pipeline: "missing-pipeline" },
+      dataDir,
+      [{ filename: "notes.md", content: new TextEncoder().encode("hi") }],
+    );
+
+    expect(response.status).toBe(400);
+    const body = (await response.json()) as { ok: boolean; code: string; message: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_REQUEST");
+    expect(body.message).toContain("not found");
+
+    expect(await pathExists(path.join(dataDir, "pipeline-data", "staging"))).toBe(false);
+    expect(await pathExists(path.join(dataDir, "pipeline-data", "pending"))).toBe(false);
   });
 
   it("AC-12: unsafe artifact path returns 400 and does not create the escape target", async () => {
-    const dataDir = await mkdtemp(path.join(tmpdir(), "upload-unsafe-"));
-    try {
-      const seedObject = { name: "demo", pipeline: "x" };
-      const response = await handleSeedUploadDirect(seedObject, dataDir, [
-        { filename: "../../../../tmp/PWNED.txt", content: new TextEncoder().encode("pwned") },
-      ]);
-      expect(response.status).toBe(400);
-
-      const escapeTarget = "/tmp/PWNED.txt";
-      expect(await pathExists(escapeTarget)).toBe(false);
-    } finally {
-      await rm(dataDir, { recursive: true, force: true });
-    }
+    const seedObject = { name: "demo", pipeline: "test-pipeline" };
+    const filename = "../../../../tmp/PWNED.txt";
+    const response = await handleSeedUploadDirect(seedObject, dataDir, [
+      { filename, content: new TextEncoder().encode("pwned") },
+    ]);
+    expect(response.status).toBe(400);
+    const body = (await response.json()) as { ok: boolean; code: string; message: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_REQUEST");
+    expect(body.message.startsWith("unsafe artifact path: ")).toBe(true);
+    expect(body.message).toContain(filename);
+
+    const escapeTarget = "/tmp/PWNED.txt";
+    expect(await pathExists(escapeTarget)).toBe(false);
+    expect(await pathExists(path.join(dataDir, "pipeline-data", "staging"))).toBe(false);
+    expect(await pathExists(path.join(dataDir, "pipeline-data", "pending"))).toBe(false);
   });
 
   it("AC-13: mixed safe and unsafe paths return 400 with no partial writes", async () => {
-    const dataDir = await mkdtemp(path.join(tmpdir(), "upload-mixed-"));
-    try {
-      const seedObject = { name: "demo", pipeline: "x" };
-      const artifacts = [
-        { filename: "safe.md", content: new TextEncoder().encode("safe") },
-        { filename: "../../tmp/escape.txt", content: new TextEncoder().encode("escape") },
-      ];
-
-      const response = await handleSeedUploadDirect(seedObject, dataDir, artifacts);
-      expect(response.status).toBe(400);
-
-      const stagingRoot = path.join(dataDir, "pipeline-data", "staging");
-      expect(await pathExists(stagingRoot)).toBe(false);
-    } finally {
-      await rm(dataDir, { recursive: true, force: true });
-    }
+    const seedObject = { name: "demo", pipeline: "test-pipeline" };
+    const unsafeFilename = "../../tmp/escape.txt";
+    const artifacts = [
+      { filename: "safe.md", content: new TextEncoder().encode("safe") },
+      { filename: unsafeFilename, content: new TextEncoder().encode("escape") },
+    ];
+
+    const response = await handleSeedUploadDirect(seedObject, dataDir, artifacts);
+    expect(response.status).toBe(400);
+    const body = (await response.json()) as { ok: boolean; code: string; message: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_REQUEST");
+    expect(body.message.startsWith("unsafe artifact path: ")).toBe(true);
+    expect(body.message).toContain(unsafeFilename);
+
+    const stagingRoot = path.join(dataDir, "pipeline-data", "staging");
+    expect(await pathExists(stagingRoot)).toBe(false);
+    expect(await pathExists(path.join(dataDir, "pipeline-data", "pending"))).toBe(false);
   });
 
   it("rejects root-normalizing artifact paths without partial writes", async () => {
-    const dataDir = await mkdtemp(path.join(tmpdir(), "upload-root-target-"));
-    try {
-      const seedObject = { name: "demo", pipeline: "x" };
-      const artifacts = [
-        { filename: "safe.md", content: new TextEncoder().encode("safe") },
-        { filename: "dir/..", content: new TextEncoder().encode("root") },
-      ];
-
-      const response = await handleSeedUploadDirect(seedObject, dataDir, artifacts);
-      expect(response.status).toBe(400);
-
-      const stagingRoot = path.join(dataDir, "pipeline-data", "staging");
-      expect(await pathExists(stagingRoot)).toBe(false);
-    } finally {
-      await rm(dataDir, { recursive: true, force: true });
-    }
+    const seedObject = { name: "demo", pipeline: "test-pipeline" };
+    const unsafeFilename = "dir/..";
+    const artifacts = [
+      { filename: "safe.md", content: new TextEncoder().encode("safe") },
+      { filename: unsafeFilename, content: new TextEncoder().encode("root") },
+    ];
+
+    const response = await handleSeedUploadDirect(seedObject, dataDir, artifacts);
+    expect(response.status).toBe(400);
+    const body = (await response.json()) as { ok: boolean; code: string; message: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_REQUEST");
+    expect(body.message.startsWith("unsafe artifact path: ")).toBe(true);
+    expect(body.message).toContain(unsafeFilename);
+
+    const stagingRoot = path.join(dataDir, "pipeline-data", "staging");
+    expect(await pathExists(stagingRoot)).toBe(false);
+    expect(await pathExists(path.join(dataDir, "pipeline-data", "pending"))).toBe(false);
+  });
+
+  it("rejects absolute artifact paths without partial writes", async () => {
+    const seedObject = { name: "demo", pipeline: "test-pipeline" };
+    const filename = "/etc/passwd";
+    const response = await handleSeedUploadDirect(seedObject, dataDir, [
+      { filename, content: new TextEncoder().encode("data") },
+    ]);
+    expect(response.status).toBe(400);
+    const body = (await response.json()) as { ok: boolean; code: string; message: string };
+    expect(body.ok).toBe(false);
+    expect(body.code).toBe("BAD_REQUEST");
+    expect(body.message.startsWith("unsafe artifact path: ")).toBe(true);
+    expect(body.message).toContain(filename);
+
+    expect(await pathExists(path.join(dataDir, "pipeline-data", "staging"))).toBe(false);
+    expect(await pathExists(path.join(dataDir, "pipeline-data", "pending"))).toBe(false);
   });
 
   it("AC-14: all-safe artifact paths with nesting return 201 and files present", async () => {
-    const dataDir = await mkdtemp(path.join(tmpdir(), "upload-safe-"));
-    try {
-      const seedObject = { name: "demo", pipeline: "x" };
-      const artifacts = [
-        { filename: "out.json", content: new TextEncoder().encode("{}") },
-        { filename: "data/foo.json", content: new TextEncoder().encode('{"a":1}') },
-      ];
-
-      const response = await handleSeedUploadDirect(seedObject, dataDir, artifacts);
-      expect(response.status).toBe(201);
-
-      const body = (await response.json()) as { data: { jobId: string } };
-      const jobId = body.data.jobId;
-      const stagingJobDir = path.join(dataDir, "pipeline-data", "staging", jobId);
-
-      expect(await pathExists(path.join(stagingJobDir, "out.json"))).toBe(true);
-      expect(await pathExists(path.join(stagingJobDir, "data/foo.json"))).toBe(true);
-    } finally {
-      await rm(dataDir, { recursive: true, force: true });
-    }
+    const seedObject = { name: "demo", pipeline: "test-pipeline" };
+    const artifacts = [
+      { filename: "out.json", content: new TextEncoder().encode("{}") },
+      { filename: "data/foo.json", content: new TextEncoder().encode('{"a":1}') },
+    ];
+
+    const response = await handleSeedUploadDirect(seedObject, dataDir, artifacts);
+    expect(response.status).toBe(201);
+
+    const body = (await response.json()) as { data: { jobId: string } };
+    const jobId = body.data.jobId;
+    const stagingJobDir = path.join(dataDir, "pipeline-data", "staging", jobId);
+
+    expect(await pathExists(path.join(stagingJobDir, "out.json"))).toBe(true);
+    expect(await pathExists(path.join(stagingJobDir, "data/foo.json"))).toBe(true);
   });
 });

package/src/ui/server/endpoints/concurrency-endpoint.ts

@@ -26,7 +26,7 @@ interface PublicConcurrencyStatus {
   }>;
   staleSlots: Array<{
     jobId: string;
-    reason: "missing_current_job" | "missing_pid" | "dead_pid" | "invalid_json";
+    reason: "missing_current_job" | "missing_pid" | "dead_pid" | "invalid_json" | "stale_runner";
   }>;
 }
 
@@ -62,6 +62,7 @@ export async function handleConcurrencyStatus(dataDir: string): Promise<Response
       getPipelineDataDir(dataDir),
       orchestrator.maxConcurrentJobs,
       orchestrator.lockFileTimeout,
+      orchestrator.staleLeaseTimeoutMs,
     );
     const response = sendJson(200, { ok: true, data: toPublicStatus(status) });
     response.headers.set("Cache-Control", "no-store");

package/src/ui/server/endpoints/create-pipeline-endpoint.ts

@@ -1,18 +1,16 @@
-import { mkdir, rename } from "node:fs/promises";
+import { mkdir } from "node:fs/promises";
 import path from "node:path";
 
-import { getConfig, resetConfig } from "../../../core/config";
+import { resetConfig } from "../../../core/config";
+import {
+  readRegistrySync,
+  registerPipeline,
+} from "../../../config/pipeline-registry";
 import { createErrorResponse } from "../config-bridge";
 import { sendJson } from "../utils/http-utils";
 import { ensureUniqueSlug, generateSlug } from "../utils/slug";
 
-async function writeAtomicJson(filePath: string, value: unknown): Promise<void> {
-  const tmpPath = `${filePath}.${process.pid}.tmp`;
-  await Bun.write(tmpPath, JSON.stringify(value, null, 2));
-  await rename(tmpPath, filePath);
-}
-
-export async function handleCreatePipeline(req: Request): Promise<Response> {
+export async function handleCreatePipeline(req: Request, root: string): Promise<Response> {
   const body = (await req.json()) as Record<string, unknown>;
   const name = typeof body["name"] === "string" ? body["name"].trim() : "";
   const description = typeof body["description"] === "string" ? body["description"].trim() : "";
@@ -20,33 +18,20 @@ export async function handleCreatePipeline(req: Request): Promise<Response> {
     return sendJson(400, createErrorResponse("BAD_REQUEST", "pipeline name is required"));
   }
 
-  const root = process.env["PO_ROOT"] ?? process.cwd();
-  const registryPath = path.join(root, "pipeline-config", "registry.json");
-  const registry = (await Bun.file(registryPath).exists())
-    ? (JSON.parse(await Bun.file(registryPath).text()) as { pipelines: Record<string, { configDir: string; tasksDir: string }> })
-    : { pipelines: {} };
+  const registry = readRegistrySync(root);
   const slug = ensureUniqueSlug(generateSlug(name), new Set(Object.keys(registry.pipelines)));
 
   const configDir = path.join(root, "pipeline-config", slug);
   const tasksDir = path.join(configDir, "tasks");
   await mkdir(tasksDir, { recursive: true });
   await Bun.write(path.join(configDir, "pipeline.json"), JSON.stringify({ name, description, slug }, null, 2));
-  await registryFileUpdate(registryPath, registry, slug, configDir, tasksDir);
+  await registerPipeline(root, slug, {
+    name,
+    description,
+    configDir: path.relative(root, configDir),
+    tasksDir: path.relative(root, tasksDir),
+  });
   resetConfig();
 
   return sendJson(201, { ok: true, data: { slug, name, description } });
 }
-
-async function registryFileUpdate(
-  registryPath: string,
-  registry: { pipelines: Record<string, { configDir: string; tasksDir: string }> },
-  slug: string,
-  configDir: string,
-  tasksDir: string,
-): Promise<void> {
-  registry.pipelines[slug] = {
-    configDir: path.relative(process.env["PO_ROOT"] ?? process.cwd(), configDir),
-    tasksDir: path.relative(process.env["PO_ROOT"] ?? process.cwd(), tasksDir),
-  };
-  await writeAtomicJson(registryPath, registry);
-}

package/src/ui/server/endpoints/file-endpoints.ts

@@ -3,6 +3,7 @@ import path from "node:path";
 import { readJob } from "../job-reader";
 import { sendJson } from "../utils/http-utils";
 import { getMimeType, isTextMime } from "../utils/mime-types";
+import { resolveWithin } from "../../../utils/path-containment";
 
 export function validateFileName(filename: string): boolean {
   return Boolean(
@@ -20,8 +21,7 @@ type TaskFiles = {
   tmp: string[];
 };
 
-function getJobFilesBase(location: string, jobId: string): string {
-  const root = process.env["PO_ROOT"] ?? process.cwd();
+function getJobFilesBase(location: string, jobId: string, root: string): string {
   return path.join(root, "pipeline-data", location, jobId, "files");
 }
 
@@ -49,25 +49,27 @@ function getTaskFiles(data: Record<string, unknown>, taskId: string): TaskFiles
   };
 }
 
-export async function handleTaskFileList(req: Request, jobId: string, taskId: string): Promise<Response> {
+export async function handleTaskFileList(req: Request, jobId: string, taskId: string, root: string): Promise<Response> {
   const type = new URL(req.url).searchParams.get("type") ?? "artifacts";
   if (!validateFileName(type)) return sendJson(400, { ok: false, code: "BAD_REQUEST", message: "invalid file type" });
-  const job = await readJob(jobId);
+  const job = await readJob(jobId, root);
   if (!job.ok) return sendJson(404, job);
 
   const files = getTaskFiles(job.data, taskId);
   return sendJson(200, { ok: true, data: files[type as keyof TaskFiles] ?? [] });
 }
 
-export async function handleTaskFile(req: Request, jobId: string, taskId: string): Promise<Response> {
+export async function handleTaskFile(req: Request, jobId: string, taskId: string, root: string): Promise<Response> {
   const url = new URL(req.url);
   const type = url.searchParams.get("type") ?? "artifacts";
   const filename = url.searchParams.get("filename") ?? "";
-  if (!validateFileName(type) || !validateFileName(filename)) {
+  const job = await readJob(jobId, root);
+  if (!job.ok) return sendJson(404, job);
+
+  const filePath = resolveWithin(getJobFilesBase(job.location, jobId, root), path.join(type, filename));
+  if (filePath === null) {
     return sendJson(400, { ok: false, code: "BAD_REQUEST", message: "invalid filename" });
   }
-  const job = await readJob(jobId);
-  if (!job.ok) return sendJson(404, job);
 
   const taskFiles = getTaskFiles(job.data, taskId);
   const allowedFiles = taskFiles[type as keyof TaskFiles] ?? [];
@@ -75,9 +77,12 @@ export async function handleTaskFile(req: Request, jobId: string, taskId: string
     return sendJson(404, { ok: false, code: "NOT_FOUND", message: `file not found for task: ${type}/${filename}` });
   }
 
-  const filePath = path.join(getJobFilesBase(job.location, jobId), type, filename);
+  const file = Bun.file(filePath);
+  if (!(await file.exists())) {
+    return sendJson(404, { ok: false, code: "NOT_FOUND", message: `file not found for task: ${type}/${filename}` });
+  }
   const mime = getMimeType(filename);
-  const buffer = new Uint8Array(await Bun.file(filePath).arrayBuffer());
+  const buffer = new Uint8Array(await file.arrayBuffer());
   return sendJson(200, {
     ok: true,
     data: isTextMime(mime) ? new TextDecoder().decode(buffer) : Buffer.from(buffer).toString("base64"),