@vantran-se/openchamber-web 1.24.4 → 2.0.2

package/server/lib/spaces/places/server.docker.live.test.js

@@ -0,0 +1,225 @@
+// The server inside a space, on a real Docker daemon. Runs only with OPENCHAMBER_TEST_DOCKER=1.
+// The host reaches the server only through `exec`, as stage 1b does.
+
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+import { createSpaceId, hashProjectDirectory, toolsKeyFromVolumeName } from '../labels.js';
+import { SPACE_SERVER_PORT, SPACE_TOKEN_PATH, TOOLS_MOUNT_PATH } from '../layout.js';
+import { createSpaceServerChannel } from '../space-server.js';
+import { createRegistryToolsSource, readHostToolVersions } from '../tools.js';
+import { LIVE_DOCKER_ENABLED, createLiveDockerPlace } from './docker-live-support.js';
+
+const CREATE_TIMEOUT_MS = 25 * 60_000;
+const JSON_HEADERS = { 'Content-Type': 'application/json' };
+
+// Runs inside the space. It logs in with the token file, opens a terminal, types two
+// commands into its WebSocket and prints one JSON line. `ws` comes out of the tools volume.
+// The protocol is the one in server/lib/terminal: a cookie, an Origin whose host equals
+// Host, and binary frames of 0x01 plus JSON.
+const TERMINAL_PROBE = `
+const fs = require('node:fs');
+const WebSocket = require('${TOOLS_MOUNT_PATH}/node_modules/ws');
+const [tokenPath, port, cwd] = process.argv.slice(2);
+const base = 'http://127.0.0.1:' + port;
+const frame = (payload) => Buffer.concat([Buffer.from([1]), Buffer.from(JSON.stringify(payload), 'utf8')]);
+const finish = (result) => { console.log(JSON.stringify(result)); process.exit(0); };
+setTimeout(() => finish({ error: 'timeout' }), 30000);
+(async () => {
+  const password = fs.readFileSync(tokenPath, 'utf8').trim();
+  const login = await fetch(base + '/auth/session', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ password }) });
+  const cookie = (login.headers.get('set-cookie') || '').split(';')[0];
+  const withoutCookie = await fetch(base + '/api/terminal/sessions');
+  const created = await fetch(base + '/api/terminal/create', { method: 'POST', headers: { 'Content-Type': 'application/json', Cookie: cookie }, body: JSON.stringify({ cwd, cols: 80, rows: 24 }) });
+  const { sessionId } = await created.json();
+  const socket = new WebSocket('ws://127.0.0.1:' + port + '/api/terminal/ws', { headers: { Cookie: cookie, Origin: base } });
+  let output = '';
+  let backend = null;
+  socket.on('open', () => socket.send(frame({ t: 'attach', v: 3, s: sessionId })));
+  socket.on('error', (error) => finish({ error: String(error) }));
+  socket.on('message', async (raw) => {
+    const message = JSON.parse(raw.subarray(1).toString('utf8'));
+    if (message.t === 'snapshot') {
+      backend = message.ptyBackend;
+      socket.send(frame({ t: 'write', v: 3, s: sessionId, d: 'echo space-$((40+2)); id -u\\r' }));
+    }
+    if (message.t === 'output') output += message.d;
+    if (/space-42[\\s\\S]*\\n1000\\r?\\n/.test(output)) {
+      await fetch(base + '/api/terminal/' + sessionId, { method: 'DELETE', headers: { Cookie: cookie } });
+      finish({ loginStatus: login.status, withoutCookieStatus: withoutCookie.status, createStatus: created.status, backend, output });
+    }
+  });
+})().catch((error) => finish({ error: String(error) }));
+`;
+
+const HELLO_TOOL = `import { tool } from "@opencode/plugin"
+export default tool({
+  description: "Says hello",
+  args: { name: tool.schema.string() },
+  async execute(args) { return "hello " + args.name },
+})
+`;
+
+describe.skipIf(!LIVE_DOCKER_ENABLED)('server inside a space: docker (live)', () => {
+  const spec = {
+    id: createSpaceId(),
+    name: 'Server inside',
+    project: hashProjectDirectory('/server/inside/project'),
+    created: new Date().toISOString(),
+    memoryBytes: 2 * 1024 * 1024 * 1024,
+  };
+  const repo = `/spaces/${spec.id}/repo`;
+  const link = `/spaces/${spec.id}/link-to-repo`;
+  let place;
+  let placeWith;
+  let host;
+  let owner;
+  let server;
+  let cookie;
+  let dispose = async () => {};
+
+  const shell = async (script, stdin = '') => {
+    const result = await place.exec(spec.id, ['sh', '-c', script], { stdin });
+    expect(result.code, `${script}: ${result.stderr}`).toBe(0);
+    return result.stdout;
+  };
+  const logIn = async () => {
+    const login = await server.request(spec.id, { method: 'POST', path: '/auth/session', headers: JSON_HEADERS, body: JSON.stringify({ password: await server.readToken(spec.id) }) });
+    expect(login.status).toBe(200);
+    return login.headers['set-cookie'][0].split(';')[0];
+  };
+  const health = async () => JSON.parse((await server.request(spec.id, { path: '/health' })).body);
+
+  beforeAll(async () => {
+    ({ place, placeWith, host, owner, dispose } = createLiveDockerPlace());
+    server = createSpaceServerChannel({ exec: place.exec });
+    await place.create(spec);
+    cookie = await logIn();
+  }, CREATE_TIMEOUT_MS);
+
+  afterAll(async () => {
+    await dispose();
+  });
+
+  it('answers /health and reports OpenCode ready as soon as create resolves', async () => {
+    expect(await health()).toMatchObject({ isOpenCodeReady: true, openCodeRunning: true });
+  });
+
+  it('refuses the API without the token, and the cookie name carries the port inside', async () => {
+    expect((await server.request(spec.id, { path: '/api/terminal/sessions' })).status).toBe(401);
+    expect(cookie).toMatch(new RegExp(`^oc_ui_session_${SPACE_SERVER_PORT}=`));
+    expect((await server.request(spec.id, { path: '/api/terminal/sessions', headers: { Cookie: cookie } })).status).toBe(200);
+  });
+
+  it('keeps the token in a private file, and not in the container environment', async () => {
+    expect(await shell(`stat -c '%a %u' ${SPACE_TOKEN_PATH} "$(dirname ${SPACE_TOKEN_PATH})"`)).toBe('600 1000\n700 1000\n');
+    expect(await shell('tr "\\0" "\\n" < /proc/1/environ')).not.toContain('OPENCHAMBER_UI_PASSWORD');
+  });
+
+  // The open question of stage 0: does OpenCode report the space path unchanged?
+  it('reports the directory of a session byte for byte as the space path', async () => {
+    await shell(`mkdir -p ${repo} && cd ${repo} && git init -q . && git -c user.email=space@example.invalid -c user.name=Space commit -q --allow-empty -m init`);
+
+    const created = await server.request(spec.id, { method: 'POST', path: `/api/session?directory=${encodeURIComponent(repo)}`, headers: { ...JSON_HEADERS, Cookie: cookie }, body: '{}' });
+    expect(created.status).toBe(200);
+    const session = JSON.parse(created.body);
+    expect(session.directory).toBe(repo);
+
+    const readBack = await server.request(spec.id, { path: `/api/session/${session.id}?directory=${encodeURIComponent(repo)}`, headers: { Cookie: cookie } });
+    expect(JSON.parse(readBack.body).directory).toBe(repo);
+
+    const listed = await server.request(spec.id, { path: `/api/session?directory=${encodeURIComponent(repo)}`, headers: { Cookie: cookie } });
+    expect(JSON.parse(listed.body).map((entry) => entry.directory)).toEqual([repo]);
+  });
+
+  // Recorded, not wished for: OpenCode 1.18.31 resolves a symlink and reports the real path.
+  // The dispatcher stage must therefore hand OpenCode real paths only.
+  it('reports the real path for a directory that was reached through a symlink', async () => {
+    await shell(`ln -sfn ${repo} ${link}`);
+
+    const created = await server.request(spec.id, { method: 'POST', path: `/api/session?directory=${encodeURIComponent(link)}`, headers: { ...JSON_HEADERS, Cookie: cookie }, body: '{}' });
+    expect(created.status).toBe(200);
+    expect(JSON.parse(created.body).directory).toBe(repo);
+  });
+
+  it('lists a project tool that imports @opencode/plugin, without waiting for a download that cannot happen', async () => {
+    await shell(`mkdir -p ${repo}/.opencode/tool && cat > ${repo}/.opencode/tool/hello.ts`, HELLO_TOOL);
+    // Only the plugin is linked above the projects, not the whole tools node_modules.
+    expect(await shell(`ls /spaces/${spec.id}/node_modules /spaces/${spec.id}/node_modules/@opencode`)).toBe(`/spaces/${spec.id}/node_modules:\n@opencode\n\n/spaces/${spec.id}/node_modules/@opencode:\nplugin\n`);
+    // The instance of the earlier tests loaded before the tool existed.
+    await server.request(spec.id, { method: 'POST', path: `/api/instance/dispose?directory=${encodeURIComponent(repo)}`, headers: { Cookie: cookie } });
+
+    const started = Date.now();
+    const answer = await server.request(spec.id, { path: `/api/experimental/tool/ids?directory=${encodeURIComponent(repo)}`, headers: { Cookie: cookie } });
+    expect(answer.status).toBe(200);
+    expect(JSON.parse(answer.body)).toContain('hello');
+    // Without npm_config_fetch_retries=0 this took 131 seconds.
+    expect(Date.now() - started).toBeLessThan(15_000);
+  }, 60_000);
+
+  it('runs commands in a terminal as uid 1000, through the terminal WebSocket', async () => {
+    await shell('cat > /tmp/terminal-probe.cjs', TERMINAL_PROBE);
+    const result = await place.exec(spec.id, ['node', '/tmp/terminal-probe.cjs', SPACE_TOKEN_PATH, String(SPACE_SERVER_PORT), `/spaces/${spec.id}`], { timeoutMs: 60_000 });
+
+    expect(result.code, result.stderr).toBe(0);
+    const probe = JSON.parse(result.stdout);
+    expect(probe).toMatchObject({ loginStatus: 200, withoutCookieStatus: 401, createStatus: 200, backend: 'node-pty' });
+    expect(probe.output).toMatch(/space-42\r?\n1000\r?\n/);
+  }, 90_000);
+
+  it('comes back healthy after stop and start, with the same token and the same files', async () => {
+    const tokenBefore = await server.readToken(spec.id);
+    await place.stop(spec.id);
+    await place.start(spec.id);
+
+    expect(await health()).toMatchObject({ isOpenCodeReady: true });
+    expect(await server.readToken(spec.id)).toBe(tokenBefore);
+    expect(await shell(`cat ${repo}/.opencode/tool/hello.ts`)).toBe(HELLO_TOOL);
+    expect(await place.verify(spec.id)).toEqual([]);
+  }, 5 * 60_000);
+
+  it('moves a stopped space to new tools at its next start, and drops the old tools volume', async () => {
+    // The same packages under another key, as a host with other tools would ask for.
+    const updatedPlace = placeWith(createRegistryToolsSource({ ...readHostToolVersions(), revision: 'live-test-second-fill' }));
+    const toolsOf = async () => JSON.parse(await host.spaceMetadata(spec.id))[0].Mounts.find((mount) => mount.Destination === TOOLS_MOUNT_PATH).Name;
+    const before = await toolsOf();
+    const tokenBefore = await server.readToken(spec.id);
+
+    // A running space is never touched.
+    await updatedPlace.start(spec.id);
+    expect(await toolsOf()).toBe(before);
+
+    await place.stop(spec.id);
+    await updatedPlace.start(spec.id);
+
+    const after = await toolsOf();
+    expect(after).not.toBe(before);
+    expect(toolsKeyFromVolumeName(after, owner)).toMatch(/^[0-9a-f]{16}$/);
+    expect(await updatedPlace.verify(spec.id)).toEqual([]);
+    expect(await health()).toMatchObject({ isOpenCodeReady: true });
+    expect(await server.readToken(spec.id)).toBe(tokenBefore);
+    expect(await shell(`cat ${repo}/.opencode/tool/hello.ts`)).toBe(HELLO_TOOL);
+    expect(await updatedPlace.list()).toMatchObject([{ id: spec.id, state: 'running', damaged: false }]);
+    // No container mounts the old tools volume any more, so it is gone.
+    expect((await host.volumes()).filter((name) => name.startsWith('openchamber-tools-'))).toEqual([after]);
+  }, CREATE_TIMEOUT_MS);
+});
+
+describe.skipIf(!LIVE_DOCKER_ENABLED)('failed tools fill: docker (live)', () => {
+  it('rejects the create and leaves no container, network or volume', async () => {
+    const neverPublished = createRegistryToolsSource({ ...readHostToolVersions(), webVersion: '0.0.0-never-published' });
+    const { place, dispose, host } = createLiveDockerPlace({ toolsSource: neverPublished });
+    const spec = { id: createSpaceId(), name: 'Failed fill', project: hashProjectDirectory('/failed/fill'), created: new Date().toISOString(), memoryBytes: 1024 * 1024 * 1024 };
+
+    try {
+      const error = await place.create(spec).catch((caught) => caught);
+      expect(error.code).toBe('tools_fill_failed');
+      expect(error.message).toMatch(/0\.0\.0-never-published/);
+      expect(error.details).toMatchObject({ rollbackFailures: [], uncertain: false });
+      expect(await place.list()).toEqual([]);
+      expect(await host.volumes()).toEqual([]);
+    } finally {
+      // Asserts that nothing with this owner's label is left.
+      await dispose();
+    }
+  }, CREATE_TIMEOUT_MS);
+});

package/server/lib/spaces/run-command.js

@@ -0,0 +1,261 @@
+import { spawn, spawnSync } from 'node:child_process';
+import path from 'node:path';
+
+import { SpaceError } from './errors.js';
+
+const DEFAULT_TIMEOUT_MS = 60_000;
+const DEFAULT_MAX_OUTPUT_BYTES = 4 * 1024 * 1024;
+// How long a tree kill waits for `taskkill` and for the child to close before it gives up waiting.
+const KILL_WAIT_MS = 5_000;
+
+// Children started with `killTree` whose own process has not exited yet. A `killTree` child leads a
+// process group of its own on POSIX, so a Ctrl-C that reaches the server's group does not reach it,
+// and measured, it outlived the server. When this process exits, each of these trees is killed
+// synchronously. No signal handler is installed here: the server has its own, which end in
+// `process.exit`, and those decide how it shuts down.
+//
+// Windows needs this too. libuv puts each child it starts into a job object that kills its members
+// when this Node process goes, whatever way it goes, but the job is created with silent breakaway:
+// only the processes libuv adds are members, "and *their* subprocesses are not", as libuv's
+// src/win/process.c says. git is a member and dies with us; the `docker exec` git starts is not.
+//
+// An entry leaves the set when the child itself exits, not when its pipes close: an escaped
+// grandchild can hold the pipes for ever, and a pid that exited long ago may belong to somebody else.
+const liveTrees = new Set();
+let exitHandlerInstalled = false;
+
+/** How many `killTree` children are live, for the tests. */
+export const liveTreeCount = () => liveTrees.size;
+
+/**
+ * Kills each tree synchronously, refusing any pid that is not an integer greater than 1, and never
+ * throws: it runs from `process.on('exit')`, where nothing asynchronous finishes. `children` defaults
+ * to the live set, which is emptied; the rest is injectable for the tests.
+ */
+export function killLiveTrees({
+  children = liveTrees,
+  platform = process.platform,
+  kill = (pid, signal) => process.kill(pid, signal),
+  spawnSyncProcess = spawnSync,
+  systemRoot = process.env.SystemRoot,
+} = {}) {
+  for (const child of children) {
+    const pid = child?.pid;
+    if (!Number.isInteger(pid) || pid <= 1) continue;
+    try {
+      if (platform === 'win32') {
+        if (systemRoot) {
+          spawnSyncProcess(path.win32.join(systemRoot, 'System32', 'taskkill.exe'), ['/T', '/F', '/PID', String(pid)], {
+            shell: false, windowsHide: true, stdio: 'ignore', timeout: KILL_WAIT_MS,
+          });
+        }
+      } else {
+        kill(-pid, 'SIGKILL');
+      }
+    } catch {
+      // Already gone, or nothing more can be done from an exit handler.
+    }
+  }
+  if (children === liveTrees) liveTrees.clear();
+}
+
+const killLiveTreesAtExit = () => killLiveTrees();
+
+const trackTree = (child) => {
+  if (!exitHandlerInstalled) {
+    exitHandlerInstalled = true;
+    // First in line: a listener registered earlier that throws would otherwise stop ours.
+    process.prependListener('exit', killLiveTreesAtExit);
+  }
+  liveTrees.add(child);
+};
+
+/**
+ * Runs one executable with an argument array and resolves `{ code, stdout, stderr }`
+ * for any exit code. The executable is spawned directly, never through a shell.
+ *
+ * `options.stdin` is a string or a Buffer. A Buffer goes to the child byte for byte, which is
+ * how the tarballs of a development build reach the tools filler. `options.cwd` is the
+ * working directory of the child, and `options.env` its whole environment when given.
+ *
+ * `options.killTree: true` makes a kill end the child's whole process tree instead of the child
+ * alone. It is for a child that starts children of its own that hold a connection open: a
+ * `git push` over `ext::` runs `docker exec`, and measured on three machines, killing only the
+ * `git` process left that `docker exec` running on the host. See `killProcessTree`. The rejection
+ * then waits until the kill has done its work and the child has closed, at most five seconds, so a
+ * caller that cleans up afterwards does not race processes that still hold its files. Measured on
+ * Windows: without the wait, removing the temporary folder failed with EBUSY and hid the timeout.
+ * `options.killWaitMs` changes that bound, for the tests. While a `killTree` child runs, an exit of
+ * this process kills its tree too, see `liveTrees`.
+ *
+ * Rejects with a SpaceError when the process cannot start (`command_spawn_failed`),
+ * runs past `timeoutMs` (`command_timeout`), prints more than `maxOutputBytes`
+ * (`command_output_too_large`), or dies from a signal (`command_killed`). The child
+ * is killed in the first three cases.
+ */
+export function runCommand(file, args, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const maxOutputBytes = options.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
+  const stdin = options.stdin ?? '';
+  const killTree = options.killTree === true;
+  const killWaitMs = options.killWaitMs ?? KILL_WAIT_MS;
+
+  return new Promise((resolve, reject) => {
+    let child;
+    try {
+      child = spawn(file, args, {
+        shell: false,
+        windowsHide: true,
+        cwd: options.cwd,
+        env: options.env,
+        // On POSIX the child leads a process group of its own, so the kill can reach its children.
+        // Never on Windows: there `detached` gives the child a console of its own.
+        detached: killTree && process.platform !== 'win32',
+        stdio: ['pipe', 'pipe', 'pipe'],
+      });
+    } catch (error) {
+      reject(new SpaceError('command_spawn_failed', `Could not start ${file}: ${error.message}`, { errno: error.code ?? null }));
+      return;
+    }
+
+    if (killTree) trackTree(child);
+
+    const stdoutChunks = [];
+    const stderrChunks = [];
+    let capturedBytes = 0;
+    let settled = false;
+    let closed = false;
+    const closeWaiters = [];
+    const waitForClose = () => new Promise((resolveWait) => {
+      if (closed) {
+        resolveWait();
+        return;
+      }
+      const bound = setTimeout(resolveWait, killWaitMs);
+      closeWaiters.push(() => { clearTimeout(bound); resolveWait(); });
+    });
+
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (!killTree) {
+        child.kill('SIGKILL');
+        reject(error);
+        return;
+      }
+      killProcessTree(child, { waitMs: killWaitMs }).then(waitForClose).then(() => reject(error));
+    };
+
+    const timer = setTimeout(() => {
+      fail(new SpaceError('command_timeout', `${file} ${args[0] ?? ''} did not finish within ${timeoutMs} ms and was stopped`));
+    }, timeoutMs);
+
+    const capture = (chunks) => (chunk) => {
+      capturedBytes += chunk.length;
+      if (capturedBytes > maxOutputBytes) {
+        fail(new SpaceError('command_output_too_large', `${file} ${args[0] ?? ''} printed more than ${maxOutputBytes} bytes and was stopped`));
+        return;
+      }
+      chunks.push(chunk);
+    };
+
+    child.stdout.on('data', capture(stdoutChunks));
+    child.stderr.on('data', capture(stderrChunks));
+
+    child.on('error', (error) => {
+      liveTrees.delete(child);
+      fail(new SpaceError('command_spawn_failed', `Could not start ${file}: ${error.message}`, { errno: error.code ?? null }));
+    });
+
+    child.on('exit', () => {
+      liveTrees.delete(child);
+    });
+
+    child.on('close', (code, signal) => {
+      closed = true;
+      for (const wake of closeWaiters.splice(0)) wake();
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (code === null) {
+        reject(new SpaceError('command_killed', `${file} ${args[0] ?? ''} was stopped by signal ${signal}`));
+        return;
+      }
+      resolve({
+        code,
+        stdout: Buffer.concat(stdoutChunks).toString('utf8'),
+        stderr: Buffer.concat(stderrChunks).toString('utf8'),
+      });
+    });
+
+    // A child that exits without reading its input closes the pipe first.
+    child.stdin.on('error', () => {});
+    child.stdin.end(stdin);
+  });
+}
+
+/**
+ * Kills a child and every process it started. Resolves true once the kill is under way and done
+ * as far as we can tell, false when it refused, and never rejects.
+ *
+ * POSIX: the child was spawned with `detached: true`, so it leads a process group, and the
+ * signal goes to that group. Windows: `taskkill.exe /T /F`, named by its absolute path under
+ * `SystemRoot` and spawned directly, hidden, with no shell.
+ *
+ * A pid that is not an integer greater than 1 is refused and nothing is signalled. A fake process
+ * with pid 1 once became `kill(-1)` and closed every program on a developer's machine, and a pid
+ * of 0 would signal our own process group. Tests hand in fakes with `pid: null`.
+ *
+ * On Windows it resolves when `taskkill` exits, or after `waitMs` if it does not.
+ *
+ * `platform`, `kill`, `spawnProcess`, `systemRoot` and `waitMs` are injectable for the tests.
+ */
+export async function killProcessTree(child, {
+  platform = process.platform,
+  kill = (pid, signal) => process.kill(pid, signal),
+  spawnProcess = spawn,
+  systemRoot = process.env.SystemRoot,
+  waitMs = KILL_WAIT_MS,
+} = {}) {
+  const pid = child?.pid;
+  if (!Number.isInteger(pid) || pid <= 1) {
+    return false;
+  }
+  const killChildOnly = () => {
+    try {
+      child.kill('SIGKILL');
+    } catch {
+      // Already gone.
+    }
+  };
+  if (platform === 'win32') {
+    if (!systemRoot) {
+      killChildOnly();
+      return true;
+    }
+    await new Promise((resolveKill) => {
+      const bound = setTimeout(resolveKill, waitMs);
+      const done = () => { clearTimeout(bound); resolveKill(); };
+      try {
+        const killer = spawnProcess(path.win32.join(systemRoot, 'System32', 'taskkill.exe'), ['/T', '/F', '/PID', String(pid)], {
+          shell: false,
+          windowsHide: true,
+          stdio: 'ignore',
+        });
+        killer.once('error', () => { killChildOnly(); done(); });
+        killer.once('exit', done);
+      } catch {
+        killChildOnly();
+        done();
+      }
+    });
+    return true;
+  }
+  try {
+    kill(-pid, 'SIGKILL');
+  } catch {
+    killChildOnly();
+  }
+  return true;
+}