airaknit 1.1.2-rc.9

package/src/server/sandbox-journey.test.ts

@@ -0,0 +1,232 @@
+import { describe, test, expect, mock } from "bun:test"
+import type { DockerClient, ExecResult } from "./sandbox-manager"
+import { SandboxManager } from "./sandbox-manager"
+import type { ContainerInspect } from "../shared/sandbox-types"
+import type { SandboxRecord, SandboxSnapshot } from "../shared/sandbox-types"
+import { DEFAULT_RESOURCE_LIMITS } from "../shared/sandbox-types"
+import { createEmptyState, type StoreState, type SandboxEvent } from "./events"
+
+function createMockDocker(): DockerClient {
+  return {
+    create: mock(() => Promise.resolve("ctr-sandbox-001")),
+    start: mock(() => Promise.resolve()),
+    stop: mock(() => Promise.resolve()),
+    rm: mock(() => Promise.resolve()),
+    exec: mock(() => Promise.resolve({ stdout: "", stderr: "", exitCode: 0 } satisfies ExecResult)),
+    logs: mock(() => Promise.resolve("")),
+    inspect: mock(() =>
+      Promise.resolve({
+        id: "ctr-sandbox-001",
+        status: "running",
+        running: true,
+        startedAt: "2026-01-01T00:00:00Z",
+        memoryUsage: 256,
+        cpuPercent: 12,
+      } satisfies ContainerInspect),
+    ),
+  }
+}
+
+/**
+ * Derive a SandboxSnapshot from StoreState for a given workspace.
+ * This mirrors what a read model would do -- since event-store does not yet
+ * have sandbox projection, we project sandbox events manually for the test.
+ */
+function deriveSandboxSnapshot(state: StoreState, workspaceId: string): SandboxSnapshot {
+  const record = state.sandboxByWorkspace.get(workspaceId) ?? null
+  return { workspaceId, sandbox: record, health: null }
+}
+
+function applySandboxEvent(state: StoreState, event: SandboxEvent): void {
+  switch (event.type) {
+    case "sandbox_created": {
+      const record: SandboxRecord = {
+        id: event.id,
+        workspaceId: event.workspaceId,
+        containerId: null,
+        status: "creating",
+        resourceLimits: event.resourceLimits,
+        natsUrl: "",
+        createdAt: event.timestamp,
+        updatedAt: event.timestamp,
+        lastHealthCheck: null,
+        error: null,
+      }
+      state.sandboxByWorkspace.set(event.workspaceId, record)
+      break
+    }
+    case "sandbox_started": {
+      const existing = state.sandboxByWorkspace.get(
+        [...state.sandboxByWorkspace.entries()].find(([, r]) => r.id === event.id)?.[0] ?? "",
+      )
+      if (existing) {
+        existing.containerId = event.containerId
+        existing.natsUrl = event.natsUrl
+        existing.status = "running"
+        existing.updatedAt = event.timestamp
+      }
+      break
+    }
+    case "sandbox_stopped": {
+      const rec = [...state.sandboxByWorkspace.values()].find((r) => r.id === event.id)
+      if (rec) {
+        rec.status = "stopped"
+        rec.updatedAt = event.timestamp
+      }
+      break
+    }
+    case "sandbox_destroyed": {
+      for (const [wsId, rec] of state.sandboxByWorkspace) {
+        if (rec.id === event.id) {
+          state.sandboxByWorkspace.delete(wsId)
+          break
+        }
+      }
+      break
+    }
+    case "sandbox_error": {
+      const rec = [...state.sandboxByWorkspace.values()].find((r) => r.id === event.id)
+      if (rec) {
+        rec.status = "error"
+        rec.error = event.error
+        rec.updatedAt = event.timestamp
+      }
+      break
+    }
+    case "sandbox_health_updated": {
+      // Health is stored separately in a full impl; skip for now
+      break
+    }
+  }
+}
+
+describe("Journey 3: Isolated Dev - Sandbox Lifecycle", () => {
+  const NATS_URL = "nats://localhost:4222"
+  const WS_ID = "ws-journey3-test"
+
+  test("stage 1: empty state - no sandbox returns null snapshot", () => {
+    const state = createEmptyState()
+    const snapshot = deriveSandboxSnapshot(state, WS_ID)
+    expect(snapshot.workspaceId).toBe(WS_ID)
+    expect(snapshot.sandbox).toBeNull()
+    expect(snapshot.health).toBeNull()
+  })
+
+  test("stage 2: create sandbox records creating status", () => {
+    const state = createEmptyState()
+    const event: SandboxEvent = {
+      v: 3,
+      type: "sandbox_created",
+      timestamp: Date.now(),
+      id: "sb-001",
+      workspaceId: WS_ID,
+      resourceLimits: DEFAULT_RESOURCE_LIMITS,
+    }
+    applySandboxEvent(state, event)
+
+    const snapshot = deriveSandboxSnapshot(state, WS_ID)
+    expect(snapshot.sandbox).not.toBeNull()
+    expect(snapshot.sandbox!.id).toBe("sb-001")
+    expect(snapshot.sandbox!.status).toBe("creating")
+    expect(snapshot.sandbox!.containerId).toBeNull()
+    expect(snapshot.sandbox!.resourceLimits).toEqual(DEFAULT_RESOURCE_LIMITS)
+  })
+
+  test("stage 3: start sandbox transitions to running with container id", () => {
+    const state = createEmptyState()
+    const now = Date.now()
+    applySandboxEvent(state, {
+      v: 3, type: "sandbox_created", timestamp: now, id: "sb-001", workspaceId: WS_ID, resourceLimits: DEFAULT_RESOURCE_LIMITS,
+    })
+    applySandboxEvent(state, {
+      v: 3, type: "sandbox_started", timestamp: now + 100, id: "sb-001", containerId: "ctr-abc", natsUrl: NATS_URL,
+    })
+
+    const snapshot = deriveSandboxSnapshot(state, WS_ID)
+    expect(snapshot.sandbox!.status).toBe("running")
+    expect(snapshot.sandbox!.containerId).toBe("ctr-abc")
+    expect(snapshot.sandbox!.natsUrl).toBe(NATS_URL)
+  })
+
+  test("stage 4-5: stop and restart transitions", () => {
+    const state = createEmptyState()
+    const now = Date.now()
+    applySandboxEvent(state, {
+      v: 3, type: "sandbox_created", timestamp: now, id: "sb-001", workspaceId: WS_ID, resourceLimits: DEFAULT_RESOURCE_LIMITS,
+    })
+    applySandboxEvent(state, {
+      v: 3, type: "sandbox_started", timestamp: now + 100, id: "sb-001", containerId: "ctr-abc", natsUrl: NATS_URL,
+    })
+
+    // Stop
+    applySandboxEvent(state, {
+      v: 3, type: "sandbox_stopped", timestamp: now + 200, id: "sb-001", reason: "user requested",
+    })
+    expect(deriveSandboxSnapshot(state, WS_ID).sandbox!.status).toBe("stopped")
+
+    // Restart
+    applySandboxEvent(state, {
+      v: 3, type: "sandbox_started", timestamp: now + 300, id: "sb-001", containerId: "ctr-abc", natsUrl: NATS_URL,
+    })
+    expect(deriveSandboxSnapshot(state, WS_ID).sandbox!.status).toBe("running")
+  })
+
+  test("stage 6: destroy sandbox returns to empty state", () => {
+    const state = createEmptyState()
+    const now = Date.now()
+    applySandboxEvent(state, {
+      v: 3, type: "sandbox_created", timestamp: now, id: "sb-001", workspaceId: WS_ID, resourceLimits: DEFAULT_RESOURCE_LIMITS,
+    })
+    applySandboxEvent(state, {
+      v: 3, type: "sandbox_started", timestamp: now + 100, id: "sb-001", containerId: "ctr-abc", natsUrl: NATS_URL,
+    })
+    applySandboxEvent(state, {
+      v: 3, type: "sandbox_destroyed", timestamp: now + 200, id: "sb-001",
+    })
+
+    const snapshot = deriveSandboxSnapshot(state, WS_ID)
+    expect(snapshot.sandbox).toBeNull()
+  })
+
+  test("error event transitions to error status", () => {
+    const state = createEmptyState()
+    const now = Date.now()
+    applySandboxEvent(state, {
+      v: 3, type: "sandbox_created", timestamp: now, id: "sb-001", workspaceId: WS_ID, resourceLimits: DEFAULT_RESOURCE_LIMITS,
+    })
+    applySandboxEvent(state, {
+      v: 3, type: "sandbox_error", timestamp: now + 50, id: "sb-001", error: "image not found",
+    })
+
+    const snapshot = deriveSandboxSnapshot(state, WS_ID)
+    expect(snapshot.sandbox!.status).toBe("error")
+    expect(snapshot.sandbox!.error).toBe("image not found")
+  })
+
+  test("full lifecycle through SandboxManager", async () => {
+    const docker = createMockDocker()
+    const mgr = new SandboxManager(docker, NATS_URL)
+
+    // Create
+    const containerId = await mgr.create(WS_ID, {
+      repos: [{ id: "repo-1", localPath: "/tmp/repo-1" }],
+    })
+    expect(containerId).toBe("ctr-sandbox-001")
+
+    // Start
+    await mgr.start(containerId)
+    expect(docker.start).toHaveBeenCalledWith(containerId)
+
+    // Stop
+    await mgr.stop(containerId, "pausing work")
+    expect(docker.stop).toHaveBeenCalledWith(containerId, 10)
+
+    // Restart
+    await mgr.start(containerId)
+    expect((docker.start as ReturnType<typeof mock>).mock.calls).toHaveLength(2)
+
+    // Destroy
+    await mgr.destroy(containerId)
+    expect(docker.rm).toHaveBeenCalledWith(containerId, true)
+  })
+})

package/src/server/sandbox-manager.test.ts

@@ -0,0 +1,146 @@
+import { describe, test, expect, mock } from "bun:test"
+import type { DockerClient, ExecResult } from "./sandbox-manager"
+import { SandboxManager } from "./sandbox-manager"
+import type { ContainerInspect } from "../shared/sandbox-types"
+import { DEFAULT_RESOURCE_LIMITS } from "../shared/sandbox-types"
+
+function createMockDocker(): DockerClient {
+  return {
+    create: mock(() => Promise.resolve("container-123")),
+    start: mock(() => Promise.resolve()),
+    stop: mock(() => Promise.resolve()),
+    rm: mock(() => Promise.resolve()),
+    exec: mock(() => Promise.resolve({ stdout: "", stderr: "", exitCode: 0 } satisfies ExecResult)),
+    logs: mock(() => Promise.resolve("")),
+    inspect: mock(() =>
+      Promise.resolve({
+        id: "container-123",
+        status: "running",
+        running: true,
+        startedAt: "2026-01-01T00:00:00Z",
+        memoryUsage: 100,
+        cpuPercent: 5,
+      } satisfies ContainerInspect),
+    ),
+  }
+}
+
+describe("SandboxManager", () => {
+  const NATS_URL = "nats://localhost:4222"
+  const IMAGE = "kanna-sandbox:latest"
+
+  test("create() builds correct docker args", async () => {
+    const docker = createMockDocker()
+    const mgr = new SandboxManager(docker, NATS_URL, IMAGE)
+
+    const id = await mgr.create("ws-abcdef123456", {
+      repos: [{ id: "repo1", localPath: "/home/user/repo1" }],
+      limits: { cpuShares: 256, memoryMb: 1024, diskMb: 5120, pidsLimit: 128 },
+    })
+
+    expect(id).toBe("container-123")
+    const args = (docker.create as ReturnType<typeof mock>).mock.calls[0][0] as string[]
+
+    expect(args).toContain("-v")
+    expect(args).toContain("/home/user/repo1:/workspace/repo1")
+    expect(args).toContain("--memory")
+    expect(args).toContain("1024m")
+    expect(args).toContain("--cpu-shares")
+    expect(args).toContain("256")
+    expect(args).toContain("--pids-limit")
+    expect(args).toContain("128")
+    expect(args[args.length - 1]).toBe(IMAGE)
+  })
+
+  test("create() uses default resource limits when not specified", async () => {
+    const docker = createMockDocker()
+    const mgr = new SandboxManager(docker, NATS_URL, IMAGE)
+
+    await mgr.create("ws-abcdef123456", {
+      repos: [{ id: "repo1", localPath: "/tmp/repo1" }],
+    })
+
+    const args = (docker.create as ReturnType<typeof mock>).mock.calls[0][0] as string[]
+    expect(args).toContain(String(DEFAULT_RESOURCE_LIMITS.cpuShares))
+    expect(args).toContain(`${DEFAULT_RESOURCE_LIMITS.memoryMb}m`)
+    expect(args).toContain(String(DEFAULT_RESOURCE_LIMITS.pidsLimit))
+  })
+
+  test("create() includes security flags", async () => {
+    const docker = createMockDocker()
+    const mgr = new SandboxManager(docker, NATS_URL, IMAGE)
+
+    await mgr.create("ws-abcdef123456", {
+      repos: [{ id: "r", localPath: "/tmp/r" }],
+    })
+
+    const args = (docker.create as ReturnType<typeof mock>).mock.calls[0][0] as string[]
+    expect(args).toContain("--cap-drop")
+    expect(args).toContain("ALL")
+    expect(args).toContain("--security-opt=no-new-privileges")
+    expect(args).toContain("--read-only")
+    expect(args.some((a: string) => a.startsWith("/tmp:"))).toBe(true)
+    expect(args).toContain("--add-host=host.docker.internal:host-gateway")
+  })
+
+  test("start() calls docker.start", async () => {
+    const docker = createMockDocker()
+    const mgr = new SandboxManager(docker, NATS_URL, IMAGE)
+
+    await mgr.start("container-123")
+    expect(docker.start).toHaveBeenCalledWith("container-123")
+  })
+
+  test("stop() calls docker.stop with timeout", async () => {
+    const docker = createMockDocker()
+    const mgr = new SandboxManager(docker, NATS_URL, IMAGE)
+
+    await mgr.stop("container-123", "shutting down")
+    expect(docker.stop).toHaveBeenCalledWith("container-123", 10)
+  })
+
+  test("destroy() calls docker.rm with force", async () => {
+    const docker = createMockDocker()
+    const mgr = new SandboxManager(docker, NATS_URL, IMAGE)
+
+    await mgr.destroy("container-123")
+    expect(docker.rm).toHaveBeenCalledWith("container-123", true)
+  })
+
+  test("exec() returns ExecResult", async () => {
+    const docker = createMockDocker()
+    ;(docker.exec as ReturnType<typeof mock>).mockImplementation(() =>
+      Promise.resolve({ stdout: "hello", stderr: "", exitCode: 0 }),
+    )
+    const mgr = new SandboxManager(docker, NATS_URL, IMAGE)
+
+    const result = await mgr.exec("container-123", ["echo", "hello"])
+    expect(result.stdout).toBe("hello")
+    expect(result.exitCode).toBe(0)
+    expect(docker.exec).toHaveBeenCalledWith("container-123", ["echo", "hello"])
+  })
+
+  test("logs() passes tail option", async () => {
+    const docker = createMockDocker()
+    ;(docker.logs as ReturnType<typeof mock>).mockImplementation(() =>
+      Promise.resolve("log line 1\nlog line 2"),
+    )
+    const mgr = new SandboxManager(docker, NATS_URL, IMAGE)
+
+    const logs = await mgr.logs("container-123", 50)
+    expect(logs).toBe("log line 1\nlog line 2")
+    expect(docker.logs).toHaveBeenCalledWith("container-123", 50)
+  })
+
+  test("docker error surfaces as thrown error", async () => {
+    const docker = createMockDocker()
+    ;(docker.create as ReturnType<typeof mock>).mockImplementation(() =>
+      Promise.reject(new Error("daemon not running")),
+    )
+    const mgr = new SandboxManager(docker, NATS_URL, IMAGE)
+
+    await expect(
+      mgr.create("ws-abc", { repos: [{ id: "r", localPath: "/tmp/r" }] }),
+    ).rejects.toThrow("daemon not running")
+  })
+})

package/src/server/sandbox-manager.ts

@@ -0,0 +1,159 @@
+import { LOG_PREFIX } from "../shared/branding"
+import type { ResourceLimits, ContainerInspect } from "../shared/sandbox-types"
+import { DEFAULT_RESOURCE_LIMITS } from "../shared/sandbox-types"
+
+export interface ExecResult {
+  stdout: string
+  stderr: string
+  exitCode: number
+}
+
+export interface DockerClient {
+  create(args: string[]): Promise<string>
+  start(containerId: string): Promise<void>
+  stop(containerId: string, timeoutSecs?: number): Promise<void>
+  rm(containerId: string, force?: boolean): Promise<void>
+  exec(containerId: string, cmd: string[]): Promise<ExecResult>
+  logs(containerId: string, tail?: number): Promise<string>
+  inspect(containerId: string): Promise<ContainerInspect>
+}
+
+export class BunDockerClient implements DockerClient {
+  private async run(args: string[]): Promise<{ stdout: string; stderr: string; exitCode: number }> {
+    const proc = Bun.spawn(["docker", ...args], {
+      stdout: "pipe",
+      stderr: "pipe",
+    })
+    const [stdout, stderr] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+    ])
+    const exitCode = await proc.exited
+    if (exitCode !== 0) {
+      throw new Error(`docker ${args[0]} failed (exit ${exitCode}): ${stderr.trim()}`)
+    }
+    return { stdout, stderr, exitCode }
+  }
+
+  async create(args: string[]): Promise<string> {
+    const result = await this.run(["create", ...args])
+    return result.stdout.trim()
+  }
+
+  async start(containerId: string): Promise<void> {
+    await this.run(["start", containerId])
+  }
+
+  async stop(containerId: string, timeoutSecs = 10): Promise<void> {
+    await this.run(["stop", "-t", String(timeoutSecs), containerId])
+  }
+
+  async rm(containerId: string, force = false): Promise<void> {
+    const args = force ? ["rm", "-f", containerId] : ["rm", containerId]
+    await this.run(args)
+  }
+
+  async exec(containerId: string, cmd: string[]): Promise<ExecResult> {
+    const proc = Bun.spawn(["docker", "exec", containerId, ...cmd], {
+      stdout: "pipe",
+      stderr: "pipe",
+    })
+    const [stdout, stderr] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+    ])
+    const exitCode = await proc.exited
+    return { stdout, stderr, exitCode }
+  }
+
+  async logs(containerId: string, tail = 100): Promise<string> {
+    const result = await this.run(["logs", "--tail", String(tail), containerId])
+    return result.stdout
+  }
+
+  async inspect(containerId: string): Promise<ContainerInspect> {
+    const result = await this.run(["inspect", "--format", "{{json .}}", containerId])
+    try {
+      return JSON.parse(result.stdout) as ContainerInspect
+    } catch {
+      throw new Error(`Failed to parse docker inspect output for ${containerId}`)
+    }
+  }
+}
+
+export class SandboxManager {
+  constructor(
+    private readonly docker: DockerClient,
+    private readonly natsUrl: string,
+    private readonly imageName: string = "kanna-sandbox:latest",
+  ) {}
+
+  getNatsUrl(): string {
+    return this.natsUrl
+  }
+
+  async create(
+    workspaceId: string,
+    opts: { repos: Array<{ id: string; localPath: string }>; limits?: ResourceLimits },
+  ): Promise<string> {
+    const limits = opts.limits ?? DEFAULT_RESOURCE_LIMITS
+    const args: string[] = []
+
+    for (const repo of opts.repos) {
+      args.push("-v", `${repo.localPath}:/workspace/${repo.id}`)
+    }
+
+    args.push("-e", `NATS_URL=${this.natsUrl}`)
+    args.push("-e", `WORKSPACE_ID=${workspaceId}`)
+    args.push("--name", `kanna-sandbox-${workspaceId.slice(0, 12)}`)
+
+    // Security flags
+    args.push("--cap-drop", "ALL")
+    args.push("--security-opt=no-new-privileges")
+    args.push("--read-only")
+    args.push("--tmpfs", "/tmp:size=128m")
+    args.push("--add-host=host.docker.internal:host-gateway")
+
+    // Resource limits
+    args.push("--cpu-shares", String(limits.cpuShares))
+    args.push("--memory", `${limits.memoryMb}m`)
+    args.push("--pids-limit", String(limits.pidsLimit))
+
+    args.push(this.imageName)
+
+    try {
+      return await this.docker.create(args)
+    } catch (err: unknown) {
+      const msg = err instanceof Error ? err.message : String(err)
+      console.warn(LOG_PREFIX, `Failed to create sandbox for ${workspaceId}: ${msg}`)
+      throw err
+    }
+  }
+
+  async start(containerId: string): Promise<void> {
+    await this.docker.start(containerId)
+  }
+
+  async stop(containerId: string, reason?: string): Promise<void> {
+    if (reason) {
+      console.warn(LOG_PREFIX, `Stopping container ${containerId}: ${reason}`)
+    }
+    await this.docker.stop(containerId, 10)
+  }
+
+  async destroy(containerId: string): Promise<void> {
+    await this.docker.rm(containerId, true)
+  }
+
+  async exec(containerId: string, cmd: string[]): Promise<ExecResult> {
+    return this.docker.exec(containerId, cmd)
+  }
+
+  async logs(containerId: string, tail?: number): Promise<string> {
+    return this.docker.logs(containerId, tail)
+  }
+
+  async inspect(containerId: string): Promise<ContainerInspect> {
+    return this.docker.inspect(containerId)
+  }
+}