@stigmer/runner 3.0.1

package/src/shared/__tests__/approval-policy.test.ts

@@ -0,0 +1,256 @@
+/**
+ * Approval policy evaluation tests.
+ *
+ * Covers the four-level merge chain and placeholder resolution
+ * in approval messages. Ported from Python test_hitl_contracts.py
+ * policy evaluation sections.
+ */
+
+import { describe, it, expect } from "vitest";
+import {
+  mergeApprovalPolicies,
+  lookupMcpToolPolicy,
+  resolveApprovalMessage,
+  hasApproveAllDecision,
+} from "../approval-policy.js";
+import type { ResolvedMcpServer } from "../mcp-resolver.js";
+import type { ToolApprovalOverride } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
+import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { ApprovalAction } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+/**
+ * Builds a minimal AgentExecution shaped just enough for
+ * hasApproveAllDecision, which only reads tool-call approval actions on
+ * root and sub-agent messages.
+ */
+function makeExecution(opts: {
+  rootActions?: ApprovalAction[];
+  subAgentActions?: ApprovalAction[];
+  hasStatus?: boolean;
+}): AgentExecution {
+  const hasStatus = opts.hasStatus ?? true;
+  if (!hasStatus) {
+    return { status: undefined } as unknown as AgentExecution;
+  }
+  return {
+    status: {
+      messages: [
+        { toolCalls: (opts.rootActions ?? []).map(a => ({ approvalAction: a })) },
+      ],
+      subAgentExecutions: [
+        {
+          messages: [
+            { toolCalls: (opts.subAgentActions ?? []).map(a => ({ approvalAction: a })) },
+          ],
+        },
+      ],
+    },
+  } as unknown as AgentExecution;
+}
+
+function makeServer(
+  slug: string,
+  toolApprovals: Array<{ toolName: string; message?: string }>,
+  pinnedToolApprovals: Array<{ toolName: string; message?: string }> = [],
+): ResolvedMcpServer {
+  return {
+    slug,
+    connectionType: "stdio",
+    toolApprovals: toolApprovals.map(a => ({
+      toolName: a.toolName,
+      message: a.message ?? "",
+    })) as any[],
+    pinnedToolApprovals: pinnedToolApprovals.map(a => ({
+      toolName: a.toolName,
+      message: a.message ?? "",
+    })) as any[],
+    discoveredCapabilitiesEmpty: false,
+  };
+}
+
+describe("mergeApprovalPolicies", () => {
+  it("returns empty map when autoApproveAll is true", () => {
+    const servers = [makeServer("github", [{ toolName: "push" }])];
+    const result = mergeApprovalPolicies(servers, [], true);
+    expect(result.size).toBe(0);
+  });
+
+  it("creates policies from toolApprovals", () => {
+    const servers = [
+      makeServer("github", [
+        { toolName: "create_issue", message: "Create issue?" },
+      ]),
+    ];
+    const result = mergeApprovalPolicies(servers, [], false);
+
+    expect(result.size).toBe(1);
+    const policy = result.get("github/create_issue")!;
+    expect(policy.requiresApproval).toBe(true);
+    expect(policy.approvalMessage).toBe("Create issue?");
+    expect(policy.mcpServerSlug).toBe("github");
+  });
+
+  it("pinnedToolApprovals override toolApprovals", () => {
+    const servers = [
+      makeServer(
+        "github",
+        [{ toolName: "push", message: "auto message" }],
+        [{ toolName: "push", message: "pinned message" }],
+      ),
+    ];
+    const result = mergeApprovalPolicies(servers, [], false);
+
+    const policy = result.get("github/push")!;
+    expect(policy.approvalMessage).toBe("pinned message");
+  });
+
+  it("agent overrides can disable approval", () => {
+    const servers = [
+      makeServer("github", [{ toolName: "push" }]),
+    ];
+    const overrides: ToolApprovalOverride[] = [{
+      toolName: "push",
+      requiresApproval: false,
+      message: "",
+    }] as any[];
+
+    const result = mergeApprovalPolicies(servers, overrides, false);
+    expect(result.size).toBe(0);
+  });
+
+  it("agent overrides can add new approval requirement", () => {
+    const servers = [makeServer("github", [])];
+    const overrides: ToolApprovalOverride[] = [{
+      toolName: "delete_repo",
+      requiresApproval: true,
+      message: "Really delete?",
+    }] as any[];
+
+    const result = mergeApprovalPolicies(servers, overrides, false);
+    expect(result.has("github/delete_repo")).toBe(true);
+  });
+
+  it("skips tools without names", () => {
+    const servers = [
+      makeServer("github", [{ toolName: "" }]),
+    ];
+    const result = mergeApprovalPolicies(servers, [], false);
+    expect(result.size).toBe(0);
+  });
+
+  it("generates default message when none provided", () => {
+    const servers = [
+      makeServer("github", [{ toolName: "push" }]),
+    ];
+    const result = mergeApprovalPolicies(servers, [], false);
+    expect(result.get("github/push")!.approvalMessage).toContain("Execute tool: push");
+  });
+
+  it("handles multiple servers independently", () => {
+    const servers = [
+      makeServer("github", [{ toolName: "push" }]),
+      makeServer("database", [{ toolName: "drop_table" }]),
+    ];
+    const result = mergeApprovalPolicies(servers, [], false);
+    expect(result.size).toBe(2);
+    expect(result.has("github/push")).toBe(true);
+    expect(result.has("database/drop_table")).toBe(true);
+  });
+});
+
+describe("hasApproveAllDecision", () => {
+  it("returns false when there is no status", () => {
+    expect(hasApproveAllDecision(makeExecution({ hasStatus: false }))).toBe(false);
+  });
+
+  it("returns false when no tool call carries APPROVE_ALL", () => {
+    const exec = makeExecution({
+      rootActions: [ApprovalAction.APPROVE, ApprovalAction.SKIP],
+      subAgentActions: [ApprovalAction.REJECT],
+    });
+    expect(hasApproveAllDecision(exec)).toBe(false);
+  });
+
+  it("detects APPROVE_ALL on a root message tool call", () => {
+    const exec = makeExecution({
+      rootActions: [ApprovalAction.APPROVE, ApprovalAction.APPROVE_ALL],
+    });
+    expect(hasApproveAllDecision(exec)).toBe(true);
+  });
+
+  it("detects APPROVE_ALL on a sub-agent message tool call", () => {
+    const exec = makeExecution({
+      rootActions: [ApprovalAction.APPROVE],
+      subAgentActions: [ApprovalAction.APPROVE_ALL],
+    });
+    expect(hasApproveAllDecision(exec)).toBe(true);
+  });
+});
+
+describe("lookupMcpToolPolicy", () => {
+  it("finds policy by server/tool key", () => {
+    const policies = new Map([
+      ["github/push", {
+        toolName: "push",
+        mcpServerSlug: "github",
+        requiresApproval: true,
+        approvalMessage: "Push?",
+      }],
+    ]);
+
+    const policy = lookupMcpToolPolicy("push", "github", policies);
+    expect(policy?.requiresApproval).toBe(true);
+  });
+
+  it("returns undefined for missing tool", () => {
+    const policies = new Map();
+    expect(lookupMcpToolPolicy("missing", "server", policies)).toBeUndefined();
+  });
+});
+
+describe("resolveApprovalMessage", () => {
+  it("resolves {{tool_name}} placeholder", () => {
+    expect(resolveApprovalMessage(
+      "Execute {{tool_name}}?",
+      "create_issue",
+      {},
+    )).toBe("Execute create_issue?");
+  });
+
+  it("resolves {{args.field}} placeholders", () => {
+    expect(resolveApprovalMessage(
+      "Create issue '{{args.title}}' in {{args.repo}}?",
+      "create_issue",
+      { title: "Bug fix", repo: "org/repo" },
+    )).toBe("Create issue 'Bug fix' in org/repo?");
+  });
+
+  it("shows <unknown> for missing args", () => {
+    expect(resolveApprovalMessage(
+      "Delete {{args.name}}?",
+      "delete",
+      {},
+    )).toBe("Delete <unknown>?");
+  });
+
+  it("JSON-stringifies non-string arg values", () => {
+    expect(resolveApprovalMessage(
+      "Set {{args.count}}",
+      "set",
+      { count: 42 },
+    )).toBe("Set 42");
+  });
+
+  it("handles null arg values", () => {
+    expect(resolveApprovalMessage(
+      "Value: {{args.val}}",
+      "test",
+      { val: null },
+    )).toBe("Value: <unknown>");
+  });
+
+  it("returns template unchanged when no placeholders", () => {
+    expect(resolveApprovalMessage("Simple message", "tool", {}))
+      .toBe("Simple message");
+  });
+});

package/src/shared/__tests__/artifact-storage-extended.test.ts

@@ -0,0 +1,208 @@
+/**
+ * Extended artifact storage tests — ported from Python test_local_storage.py.
+ *
+ * Adds download URL construction, upload/download round-trip, exists for
+ * missing keys, and proxy backend URL formatting.
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { LocalArtifactStorage, ProxyArtifactStorage, createArtifactStorage } from "../artifact-storage.js";
+
+function makeTempDir(): string {
+  return mkdtempSync(join(tmpdir(), "as-test-"));
+}
+
+describe("LocalArtifactStorage", () => {
+  let basePath: string;
+  let storage: LocalArtifactStorage;
+
+  beforeEach(() => {
+    basePath = makeTempDir();
+    storage = new LocalArtifactStorage(basePath, "http://localhost:7235");
+  });
+
+  afterEach(() => {
+    rmSync(basePath, { recursive: true, force: true });
+  });
+
+  describe("upload", () => {
+    it("writes content to the correct path", async () => {
+      await storage.upload("exec-1/file.txt", Buffer.from("hello"));
+      const content = readFileSync(join(basePath, "exec-1/file.txt"), "utf-8");
+      expect(content).toBe("hello");
+    });
+
+    it("creates nested directories automatically", async () => {
+      await storage.upload("deep/nested/dir/file.txt", Buffer.from("deep"));
+      const content = readFileSync(join(basePath, "deep/nested/dir/file.txt"), "utf-8");
+      expect(content).toBe("deep");
+    });
+
+    it("returns the key on success", async () => {
+      const key = await storage.upload("key.txt", Buffer.from("data"));
+      expect(key).toBe("key.txt");
+    });
+
+    it("overwrites existing files", async () => {
+      await storage.upload("overwrite.txt", Buffer.from("first"));
+      await storage.upload("overwrite.txt", Buffer.from("second"));
+      const content = readFileSync(join(basePath, "overwrite.txt"), "utf-8");
+      expect(content).toBe("second");
+    });
+  });
+
+  describe("getDownloadUrl", () => {
+    it("constructs URL without double slashes", async () => {
+      const url = await storage.getDownloadUrl("exec-1/file.txt");
+      expect(url).toBe("http://localhost:7235/exec-1/file.txt");
+    });
+
+    it("strips trailing slash from serve URL base", async () => {
+      const s = new LocalArtifactStorage(basePath, "http://localhost:7235/");
+      const url = await s.getDownloadUrl("file.txt");
+      expect(url).toBe("http://localhost:7235/file.txt");
+    });
+  });
+
+  describe("exists", () => {
+    it("returns true after upload", async () => {
+      await storage.upload("present.txt", Buffer.from("data"));
+      expect(await storage.exists("present.txt")).toBe(true);
+    });
+
+    it("returns false for non-existent key", async () => {
+      expect(await storage.exists("missing.txt")).toBe(false);
+    });
+
+    it("returns false for nested non-existent key", async () => {
+      expect(await storage.exists("deep/path/missing.txt")).toBe(false);
+    });
+  });
+});
+
+describe("ProxyArtifactStorage", () => {
+  let originalFetch: typeof globalThis.fetch;
+
+  beforeEach(() => {
+    originalFetch = globalThis.fetch;
+  });
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+  });
+
+  it("calls presigned-upload-url endpoint on upload", async () => {
+    const storage = new ProxyArtifactStorage("https://proxy.example.com", "tok");
+
+    globalThis.fetch = vi.fn()
+      .mockResolvedValueOnce({
+        ok: true,
+        json: async () => ({ url: "https://r2.example.com/presigned", headers: {} }),
+      } as any)
+      .mockResolvedValueOnce({
+        ok: true,
+        text: async () => "",
+      } as any);
+
+    await storage.upload("key.txt", Buffer.from("content"), "text/plain");
+
+    expect(fetch).toHaveBeenCalledTimes(2);
+    const firstCall = (fetch as ReturnType<typeof vi.fn>).mock.calls[0];
+    expect(firstCall[0]).toBe("https://proxy.example.com/v1/proxy/artifacts/presigned-upload-url");
+  });
+
+  it("throws on presign failure", async () => {
+    const storage = new ProxyArtifactStorage("https://proxy.example.com", "tok");
+
+    globalThis.fetch = vi.fn().mockResolvedValueOnce({
+      ok: false,
+      status: 403,
+      text: async () => "Forbidden",
+    } as any);
+
+    await expect(
+      storage.upload("key.txt", Buffer.from("data")),
+    ).rejects.toThrow("HTTP 403");
+  });
+
+  it("calls presigned-download-url for getDownloadUrl", async () => {
+    const storage = new ProxyArtifactStorage("https://proxy.example.com", "tok");
+
+    globalThis.fetch = vi.fn().mockResolvedValueOnce({
+      ok: true,
+      json: async () => ({ url: "https://r2.example.com/download/key.txt" }),
+    } as any);
+
+    const url = await storage.getDownloadUrl("key.txt");
+    expect(url).toBe("https://r2.example.com/download/key.txt");
+  });
+
+  it("exists returns true when presign succeeds", async () => {
+    const storage = new ProxyArtifactStorage("https://proxy.example.com", "tok");
+
+    globalThis.fetch = vi.fn().mockResolvedValueOnce({
+      ok: true,
+      json: async () => ({ url: "https://r2.example.com/dl" }),
+    } as any);
+
+    expect(await storage.exists("key.txt")).toBe(true);
+  });
+
+  it("exists returns false when presign fails", async () => {
+    const storage = new ProxyArtifactStorage("https://proxy.example.com", "tok");
+
+    globalThis.fetch = vi.fn().mockResolvedValueOnce({
+      ok: false,
+      status: 404,
+    } as any);
+
+    expect(await storage.exists("missing.txt")).toBe(false);
+  });
+});
+
+describe("createArtifactStorage", () => {
+  it("creates LocalArtifactStorage for local type", () => {
+    const storage = createArtifactStorage({
+      type: "local",
+      localPath: "/var/artifacts",
+      localServeUrl: "http://localhost:7235",
+      proxyEndpoint: null,
+      proxyAuthToken: null,
+    });
+    expect(storage).toBeInstanceOf(LocalArtifactStorage);
+  });
+
+  it("creates ProxyArtifactStorage for proxy type", () => {
+    const storage = createArtifactStorage({
+      type: "proxy",
+      localPath: "/var/artifacts",
+      localServeUrl: "http://localhost:7235",
+      proxyEndpoint: "https://proxy.example.com",
+      proxyAuthToken: "token",
+    });
+    expect(storage).toBeInstanceOf(ProxyArtifactStorage);
+  });
+
+  it("throws when proxy type lacks endpoint", () => {
+    expect(() => createArtifactStorage({
+      type: "proxy",
+      localPath: "/var/artifacts",
+      localServeUrl: "http://localhost:7235",
+      proxyEndpoint: null,
+      proxyAuthToken: "token",
+    })).toThrow("STIGMER_PROXY_ENDPOINT");
+  });
+
+  it("throws when proxy type lacks auth token", () => {
+    expect(() => createArtifactStorage({
+      type: "proxy",
+      localPath: "/var/artifacts",
+      localServeUrl: "http://localhost:7235",
+      proxyEndpoint: "https://proxy.example.com",
+      proxyAuthToken: null,
+    })).toThrow("STIGMER_TOKEN");
+  });
+});