@skyramp/mcp 0.3.1 → 0.3.2-rc.pom-2

package/build/services/TestExecutionService.d.ts

@@ -1,7 +1,8 @@
 import { TestExecutionResult, BatchExecutionResult, TestExecutionOptions, ProgressCallback } from "../types/TestExecution.js";
-export declare const EXECUTOR_DOCKER_IMAGE = "skyramp/executor:v1.3.34";
+export declare const EXECUTOR_DOCKER_IMAGE = "skyramp/executor:v1.3.35";
 export declare const PLAYWRIGHT_CONFIG_FILES: string[];
 export declare const EXCLUDED_MOUNT_ITEMS: string[];
+export declare const TEST_REPO_CONTAINER_SUBDIR = ".skyramp-test-repo";
 export declare const MOUNT_NULL_ITEMS: string[];
 /**
  * Check if a test type requires browser execution (UI/E2E)
@@ -35,6 +36,19 @@ export declare function detectSessionFiles(testFilePath: string): string[];
  * Skips recursing into directories that are themselves excluded.
  */
 export declare function findExcludedPaths(dir: string, excludedItems: string[]): string[];
+/**
+ * Find every nested `node_modules` directory under `dir` — i.e. all except the
+ * top-level `<dir>/node_modules` (which the workspace mount already excludes).
+ * Never descends into a `node_modules`. Used to shadow repo-local node_modules
+ * that ride into the executor inside a parent directory's wholesale bind-mount;
+ * a leaked `@playwright/test` becomes a second physical copy and trips
+ * Playwright's "Requiring @playwright/test second time" guard.
+ * Skips `.git` (nothing importable lives there) and does not follow symlinks —
+ * by design (a symlinked nested node_modules either dangles in-container,
+ * falling through to NODE_PATH's global copy, or its real-path target is
+ * walked directly).
+ */
+export declare function findNestedNodeModules(dir: string): string[];
 export declare class TestExecutionService {
     private docker;
     private imageReady;

package/build/services/TestExecutionService.js

@@ -20,6 +20,28 @@ const EXECUTION_PROGRESS_INTERVAL = 10000; // 10 seconds between progress update
 // so Node.js doesn't throw ERR_INVALID_PACKAGE_CONFIG when reading them.
 const EMPTY_JSON_PATH = path.join(os.tmpdir(), "skyramp-empty.json");
 fs.writeFileSync(EMPTY_JSON_PATH, "{}");
+// Empty directory used to shadow nested node_modules over their leaked mount
+// (a directory target — /dev/null only works for file targets). Per-process
+// mkdtemp guarantees it stays empty; best-effort removal on exit keeps tmp
+// from accumulating one dir per process start on long-lived hosts.
+const EMPTY_DIR_PATH = fs.mkdtempSync(path.join(os.tmpdir(), "skyramp-empty-"));
+process.on("exit", () => {
+    try {
+        fs.rmdirSync(EMPTY_DIR_PATH);
+    }
+    catch {
+        // best-effort: bind mounts from a still-running container or a prior crash may block removal
+    }
+});
+// Packages that must never load from a repo-local (nested) node_modules: a
+// second physical @playwright/test trips Playwright's "Requiring
+// @playwright/test second time" guard, and a host-installed @skyramp/skyramp
+// carries the wrong platform's native library. Shadow ONLY these inside each
+// nested node_modules — customer test-support deps (winston, dotenv, …) keep
+// resolving from the mounted repo. Node treats the empty shadow as a miss and
+// walks up to NODE_PATH's global install (both packages are global in the
+// executor image).
+const SHADOWED_NESTED_PACKAGES = ["@playwright/test", "playwright", "@skyramp/skyramp"];
 // Minimal Playwright config — shadows repo configs that may import dotenv or other
 // dependencies not available in the executor container.
 const MINIMAL_PLAYWRIGHT_CONFIG_PATH = path.join(os.tmpdir(), "skyramp-playwright.config.ts");
@@ -36,6 +58,11 @@ export const PLAYWRIGHT_CONFIG_FILES = [
 export const EXCLUDED_MOUNT_ITEMS = [
     "node_modules",
 ];
+// Reserved container subdir under /home/user where a cross-repo test repository
+// (testsRepoDir, SKYR-3819) is mounted. Must live INSIDE /home/user: the generated
+// Playwright config's testDir is anchored there, and a test path outside it is
+// reported as "No tests found".
+export const TEST_REPO_CONTAINER_SUBDIR = ".skyramp-test-repo";
 // Files to shadow with /dev/null recursively so the container ignores them
 export const MOUNT_NULL_ITEMS = [
     "package-lock.json",
@@ -336,6 +363,45 @@ export function findExcludedPaths(dir, excludedItems) {
     }
     return results;
 }
+/**
+ * Find every nested `node_modules` directory under `dir` — i.e. all except the
+ * top-level `<dir>/node_modules` (which the workspace mount already excludes).
+ * Never descends into a `node_modules`. Used to shadow repo-local node_modules
+ * that ride into the executor inside a parent directory's wholesale bind-mount;
+ * a leaked `@playwright/test` becomes a second physical copy and trips
+ * Playwright's "Requiring @playwright/test second time" guard.
+ * Skips `.git` (nothing importable lives there) and does not follow symlinks —
+ * by design (a symlinked nested node_modules either dangles in-container,
+ * falling through to NODE_PATH's global copy, or its real-path target is
+ * walked directly).
+ */
+export function findNestedNodeModules(dir) {
+    const results = [];
+    const walk = (current) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(current, { withFileTypes: true });
+        }
+        catch {
+            return; // best-effort: skip unreadable directory, keep going
+        }
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            if (entry.name === ".git")
+                continue;
+            const full = path.join(current, entry.name);
+            if (entry.name === "node_modules") {
+                if (current !== dir)
+                    results.push(full); // skip the top-level node_modules
+                continue; // never descend into a node_modules
+            }
+            walk(full);
+        }
+    };
+    walk(dir);
+    return results;
+}
 export class TestExecutionService {
     docker;
     imageReady = null;
@@ -442,14 +508,59 @@ export class TestExecutionService {
         });
         const containerMountPath = "/home/user";
         const dockerSocketPath = "/var/run/docker.sock";
-        // Calculate relative test file path
-        let testFilePath = path.relative(workspacePath, options.testFile);
-        testFilePath = path.resolve(containerMountPath, testFilePath);
+        const isUnder = (parent, child) => child === parent || child.startsWith(parent + path.sep);
+        // Cross-repo test file (SKYR-3819): a test delivered under the run's test
+        // repository lives outside workspacePath, so the workspace mounts below never
+        // include it and the relative-path computation would escape /home/user. Anchor
+        // it under the reserved subdir instead; the test repo is mounted there below.
+        const absTestFile = path.resolve(options.testFile);
+        const testRepoPath = options.testRepoPath ? path.resolve(options.testRepoPath) : undefined;
+        // A root-level test repo would bind-mount large portions of the host
+        // (read-write, alongside the Docker socket) into the executor — reject it
+        // explicitly rather than falling through to the generic path error below.
+        if (testRepoPath &&
+            testRepoPath === path.parse(testRepoPath).root &&
+            !isUnder(workspacePath, absTestFile)) {
+            throw new Error(`testRepoPath must not be the filesystem root, got: ${options.testRepoPath}`);
+        }
+        const crossRepoTestRoot = !isUnder(workspacePath, absTestFile) && testRepoPath && isUnder(testRepoPath, absTestFile)
+            ? testRepoPath
+            : undefined;
+        if (crossRepoTestRoot) {
+            try {
+                fs.accessSync(crossRepoTestRoot, fs.constants.R_OK);
+            }
+            catch {
+                throw new Error(`Cross-repo test repository path does not exist or is not readable: ${crossRepoTestRoot}`);
+            }
+        }
+        let testFilePath;
+        if (crossRepoTestRoot) {
+            testFilePath = path.join(containerMountPath, TEST_REPO_CONTAINER_SUBDIR, path.relative(crossRepoTestRoot, absTestFile));
+        }
+        else if (!isUnder(workspacePath, absTestFile)) {
+            throw new Error(`Test file ${options.testFile} is outside the workspace ${workspacePath}, so the executor container cannot reach it. ` +
+                `For tests delivered to a cross-repo test repository, run skyramp_analyze_changes with testsRepoDir first (it is remembered for the run), or move the test under the workspace.`);
+        }
+        else {
+            testFilePath = path.resolve(containerMountPath, path.relative(workspacePath, absTestFile));
+        }
         // Video recording setup for UI/E2E browser tests (no-op for API tests).
         const { browserTest, videoHostDir, videoContainerDir, playwrightConfigPath, pytestConfigPath } = setupVideoCapture(options, workspacePath, containerMountPath);
         // Prepare Docker command
         const command = [
-            "/root/runner.sh",
+            "bash",
+            "-c",
+            // Bare requires from mounted/reused customer code must resolve the shadowed
+            // packages (@playwright/test, @skyramp/skyramp — see SHADOWED_NESTED_PACKAGES)
+            // from the image's single global install; npm root -g resolves that path
+            // regardless of the image's pinned Node version. The current executor image
+            // already sets NODE_PATH via ENV; this wrap makes the resolution
+            // image-independent rather than relying on that.
+            // The wrap assumes `bash` and `npm` exist in the executor image (both
+            // verified present; runner.sh already requires bash).
+            'export NODE_PATH="$(npm root -g)"; exec /root/runner.sh "$@"',
+            "runner",
             options.language,
             testFilePath,
             options.testType,
@@ -466,20 +577,6 @@ export class TestExecutionService {
                 },
             ],
         };
-        // Mount workspace files, skipping EXCLUDED_MOUNT_ITEMS completely.
-        //
-        // Each workspace entry is bind-mounted at BOTH the canonical /home/user
-        // path AND its host-absolute path. The dual mount lets the test resolve
-        // any absolute reference the codegen happens to embed (storageState,
-        // fixture paths, snapshots) — including the host workspace path that
-        // Playwright's TypeScript loader sometimes produces from `__dirname` —
-        // without needing source-code detection. EXCLUDED_MOUNT_ITEMS
-        // (node_modules) stays excluded at both targets; MOUNT_NULL_ITEMS
-        // shadows (package.json → empty JSON, etc.) and PLAYWRIGHT_CONFIG_FILES
-        // shadows (minimal config) are applied at both targets too so the
-        // protections survive regardless of which path the test resolves to.
-        const workspaceFiles = fs.readdirSync(workspacePath);
-        const filesToMount = workspaceFiles.filter((file) => !EXCLUDED_MOUNT_ITEMS.includes(file) && !MOUNT_NULL_ITEMS.includes(file));
         // Single Set tracks every mount target we've added so far. Used to dedupe
         // both the workspace-mirror push (when workspacePath happens to equal
         // containerMountPath) and the session-file push below.
@@ -490,6 +587,92 @@ export class TestExecutionService {
             mountedPaths.add(mount.Target);
             hostConfig.Mounts.push(mount);
         };
+        // Mount one repo tree (the workspace, or a cross-repo test repository) into
+        // the container, skipping EXCLUDED_MOUNT_ITEMS completely.
+        //
+        // Each top-level entry is bind-mounted at the canonical container path and —
+        // when mirrorToHost is set — at its host-absolute path too. The dual mount
+        // lets the test resolve any absolute reference the codegen happens to embed
+        // (storageState, fixture paths, snapshots) — including the host workspace
+        // path that Playwright's TypeScript loader sometimes produces from
+        // `__dirname` — without needing source-code detection. EXCLUDED_MOUNT_ITEMS
+        // (node_modules) stays excluded at both targets; MOUNT_NULL_ITEMS shadows
+        // (package.json → empty JSON, etc.), nested-package shadows, and
+        // PLAYWRIGHT_CONFIG_FILES shadows (minimal config) are applied at both
+        // targets too so the protections survive regardless of which path the test
+        // resolves to.
+        //
+        // Ordering matters between the broad mounts and the shadows: Docker layers
+        // later mounts over earlier ones, so the top-level entry mounts must be
+        // pushed BEFORE the shadow mounts that override paths inside them.
+        //
+        // The three recursive scans (findExcludedPaths × 2 + findNestedNodeModules)
+        // are deliberately kept as separate walks rather than fused into one pass:
+        // each skips node_modules/.git so the cost is small, and separate walks keep
+        // each shadow category's semantics independently testable.
+        const mountRepoTree = (hostRoot, containerRoot, mirrorToHost) => {
+            // Top-level entries. MOUNT_NULL_ITEMS are excluded here and shadowed
+            // recursively below instead. Root-level Playwright configs are excluded
+            // here too so the config-shadow loop below (or the pre-mounted generated
+            // config, which wins by dedup) supplies the container's config instead —
+            // otherwise the entry mount would win the dedup race and the repo's own
+            // config (which may import dotenv, or simply isn't the minimal/generated
+            // one) would leak into the container.
+            const entriesToMount = fs
+                .readdirSync(hostRoot)
+                .filter((file) => !EXCLUDED_MOUNT_ITEMS.includes(file) &&
+                !MOUNT_NULL_ITEMS.includes(file) &&
+                !PLAYWRIGHT_CONFIG_FILES.includes(file));
+            for (const file of entriesToMount) {
+                const source = path.join(hostRoot, file);
+                pushMount({ Type: "bind", Target: path.join(containerRoot, file), Source: source });
+                if (mirrorToHost) {
+                    pushMount({ Type: "bind", Target: source, Source: source });
+                }
+            }
+            // Shadow MOUNT_NULL_ITEMS (found recursively) with /dev/null (or empty JSON for .json files).
+            for (const absolutePath of findExcludedPaths(hostRoot, MOUNT_NULL_ITEMS)) {
+                const rel = path.relative(hostRoot, absolutePath);
+                const source = absolutePath.endsWith(".json") ? EMPTY_JSON_PATH : "/dev/null";
+                pushMount({ Type: "bind", Source: source, Target: path.join(containerRoot, rel) });
+                if (mirrorToHost) {
+                    pushMount({ Type: "bind", Source: source, Target: absolutePath });
+                }
+            }
+            // Shadow SHADOWED_NESTED_PACKAGES inside every nested node_modules leaked in
+            // via a parent-directory bind-mount (see findNestedNodeModules) — the
+            // top-level node_modules is already excluded above via EXCLUDED_MOUNT_ITEMS.
+            for (const nested of findNestedNodeModules(hostRoot)) {
+                for (const pkg of SHADOWED_NESTED_PACKAGES) {
+                    const pkgPath = path.join(nested, pkg);
+                    if (!fs.existsSync(pkgPath))
+                        continue; // only shadow what actually exists
+                    const rel = path.relative(hostRoot, pkgPath);
+                    pushMount({
+                        Type: "bind",
+                        Source: EMPTY_DIR_PATH,
+                        Target: path.join(containerRoot, rel),
+                        ReadOnly: true,
+                    });
+                    if (mirrorToHost) {
+                        pushMount({ Type: "bind", Source: EMPTY_DIR_PATH, Target: pkgPath, ReadOnly: true });
+                    }
+                }
+            }
+            // Mount Playwright config files with the per-execution config (minimal or
+            // generated). Shadows ANY repo playwright.config.{ts,js,mjs} recursively so
+            // repo configs that import dotenv/etc. don't crash the executor. Applies to
+            // ALL tests — including non-browser TypeScript tests
+            // (contract/integration/fuzz/smoke/load) which per runner.sh also run via
+            // `npx playwright test <file>` and read playwright.config.ts.
+            for (const absolutePath of findExcludedPaths(hostRoot, PLAYWRIGHT_CONFIG_FILES)) {
+                const rel = path.relative(hostRoot, absolutePath);
+                pushMount({ Type: "bind", Source: playwrightConfigPath, Target: path.join(containerRoot, rel) });
+                if (mirrorToHost) {
+                    pushMount({ Type: "bind", Source: playwrightConfigPath, Target: absolutePath });
+                }
+            }
+        };
         // For browser tests, mount generated video-enabled configs at canonical container
         // paths BEFORE the nullPaths loop so they WIN over any /dev/null shadows and work
         // even if the repo has no config file. The pushMount dedup ensures later shadows
@@ -512,44 +695,16 @@ export class TestExecutionService {
                 });
             }
         }
+        // Mirror workspace mounts at their host-absolute paths unless the workspace
+        // already IS the canonical container path (mirroring would double-mount).
         const mirrorAtHostPath = workspacePath !== containerMountPath;
-        for (const file of filesToMount) {
-            const source = path.join(workspacePath, file);
-            pushMount({
-                Type: "bind",
-                Target: path.join(containerMountPath, file),
-                Source: source,
-            });
-            if (mirrorAtHostPath) {
-                pushMount({ Type: "bind", Target: source, Source: source });
-            }
-        }
-        // Mount MOUNT_NULL_ITEMS (found recursively) to /dev/null (or empty JSON for .json files)
-        const nullPaths = findExcludedPaths(workspacePath, MOUNT_NULL_ITEMS);
-        for (const absolutePath of nullPaths) {
-            const rel = path.relative(workspacePath, absolutePath);
-            const source = absolutePath.endsWith(".json") ? EMPTY_JSON_PATH : "/dev/null";
-            pushMount({
-                Type: "bind",
-                Source: source,
-                Target: path.join(containerMountPath, rel),
-            });
-            if (mirrorAtHostPath) {
-                pushMount({ Type: "bind", Source: source, Target: absolutePath });
-            }
-        }
-        // Mount Playwright config files with the per-execution config (minimal or generated).
-        // Shadows ANY repo playwright.config.{ts,js,mjs} recursively so repo configs that
-        // import dotenv/etc. don't crash the executor. Applies to ALL tests — including
-        // non-browser TypeScript tests (contract/integration/fuzz/smoke/load) which per
-        // runner.sh also run via `npx playwright test <file>` and read playwright.config.ts.
-        const playwrightConfigPaths = findExcludedPaths(workspacePath, PLAYWRIGHT_CONFIG_FILES);
-        for (const absolutePath of playwrightConfigPaths) {
-            const rel = path.relative(workspacePath, absolutePath);
-            pushMount({ Type: "bind", Source: playwrightConfigPath, Target: path.join(containerMountPath, rel) });
-            if (mirrorAtHostPath) {
-                pushMount({ Type: "bind", Source: playwrightConfigPath, Target: absolutePath });
-            }
+        mountRepoTree(workspacePath, containerMountPath, mirrorAtHostPath);
+        // Cross-repo test repository mounts (SKYR-3819): expose the delivered tests
+        // under the reserved /home/user subdir — inside Playwright's testDir — with
+        // the same exclusions and shadows as the workspace, plus host-absolute
+        // mirrors so absolute references embedded in tests resolve.
+        if (crossRepoTestRoot) {
+            mountRepoTree(crossRepoTestRoot, path.join(containerMountPath, TEST_REPO_CONTAINER_SUBDIR), true);
         }
         // Mount video output directory for browser tests (writable)
         if (browserTest && videoHostDir) {