claude-dev-env 2.5.0 → 2.7.1

package/scripts/test_spawn_grok_batch.py

@@ -22,15 +22,17 @@ from dev_env_scripts_constants.grok_worker_constants import (  # noqa: E402
     BUILD_PROFILE_PROMPT_HEADER,
     CLASSIFICATION_ERROR,
     CLASSIFICATION_OK,
+    CLASSIFICATION_TIMEOUT,
     CLASSIFICATION_USAGE_LIMIT,
     DEBUG_FILE_FLAG,
     DEFAULT_ROLE,
-    DEFAULT_WORKER_MAX_TURNS,
     DEFAULT_WORKER_TIMEOUT_SECONDS,
     DISABLE_WEB_SEARCH_FLAG,
     DISALLOWED_TOOLS_FLAG,
     LEADER_SOCKET_FILENAME_PREFIX,
     LEADER_SOCKET_FILENAME_SUFFIX,
+    MAX_TURNS_FLAG,
+    MAXIMUM_WORKER_TIMEOUT_SECONDS,
     OUTPUT_FILENAME_PREFIX,
     PROMPT_FILENAME_PREFIX,
     READONLY_DISALLOWED_TOOLS_VALUE,
@@ -53,7 +55,6 @@ from dev_env_scripts_constants.grok_worker_constants import (  # noqa: E402
     TOOL_PROFILE_READONLY,
     UTF8_ENCODING,
     WORKER_SPEC_AGENT_NAME_KEY,
-    WORKER_SPEC_MAX_TURNS_KEY,
     WORKER_SPEC_PROMPT_PARTS_KEY,
     WORKER_SPEC_TIMEOUT_KEY,
 )
@@ -61,8 +62,10 @@ from dev_env_scripts_constants.timing import WORKER_STAGGER_SECONDS  # noqa: E40
 from grok_headless_runner import GrokRunnerOutcome  # noqa: E402
 from grok_worker_preflight import PreflightOutcome  # noqa: E402
 
+RETIRED_MAX_TURNS_KEYWORD = "max_turns"
 FIXTURE_REPORT_TEXT = '{"status":"done","role":"investigator"}'
 FIXTURE_USAGE_LIMIT_TEXT = "rate limit exceeded (HTTP 429): quota exceeded"
+FIXTURE_TIMEOUT_KILL_TEXT = "worker exceeded its timeout and was killed"
 
 
 def _write_prompt_parts(
@@ -871,7 +874,7 @@ def test_load_batch_spec_missing_worker_keys_raise_value_error(
     ).lower() or "must be" in str(raised_error.value).lower()
 
 
-def test_load_batch_spec_rejects_non_positive_timeout_and_max_turns(
+def test_load_batch_spec_rejects_non_positive_timeout(
     tmp_path: Path,
 ) -> None:
     header_part, body_part = _write_prompt_parts(tmp_path)
@@ -891,27 +894,11 @@ def test_load_batch_spec_rejects_non_positive_timeout_and_max_turns(
         zero_timeout_dir,
         all_worker_payloads=[zero_timeout_payload],
     )
-    with pytest.raises(ValueError, match=WORKER_SPEC_TIMEOUT_KEY):
+    with pytest.raises(ValueError, match="MIN_WORKER_TIMEOUT_SECONDS"):
         batch.load_batch_spec(zero_timeout_path)
 
-    negative_turns_dir = tmp_path / "negative-turns"
-    negative_turns_dir.mkdir()
-    negative_turns_payload = _worker_payload(
-        role_name="negative-turns",
-        all_prompt_parts=[str(header_part), str(body_part)],
-        working_directory=working_directory,
-        tool_profile=TOOL_PROFILE_BUILD,
-    )
-    negative_turns_payload[WORKER_SPEC_MAX_TURNS_KEY] = -1
-    negative_turns_path = _write_batch_spec(
-        negative_turns_dir,
-        all_worker_payloads=[negative_turns_payload],
-    )
-    with pytest.raises(ValueError, match=WORKER_SPEC_MAX_TURNS_KEY):
-        batch.load_batch_spec(negative_turns_path)
-
 
-def test_load_batch_spec_accepts_default_timeout_and_max_turns(
+def test_load_batch_spec_accepts_the_default_timeout(
     tmp_path: Path,
 ) -> None:
     header_part, body_part = _write_prompt_parts(tmp_path)
@@ -931,7 +918,223 @@ def test_load_batch_spec_accepts_default_timeout_and_max_turns(
 
     assert len(batch_spec.all_workers) == 1
     assert batch_spec.all_workers[0].timeout_seconds == DEFAULT_WORKER_TIMEOUT_SECONDS
-    assert batch_spec.all_workers[0].max_turns == DEFAULT_WORKER_MAX_TURNS
+
+
+def test_timeout_over_the_ceiling_is_refused_and_at_the_ceiling_passes(
+    tmp_path: Path,
+) -> None:
+    """The launcher refuses a spec past the 90-minute ceiling; it never clamps.
+
+    ::
+
+        timeout_seconds 5401  flag: ValueError naming MAXIMUM_WORKER_TIMEOUT_SECONDS
+        timeout_seconds 5400  ok:   loads, value untouched
+        timeout_seconds 30    ok:   loads, value untouched
+    """
+    header_part, body_part = _write_prompt_parts(tmp_path)
+    working_directory = tmp_path / "project"
+    working_directory.mkdir()
+
+    over_ceiling_directory = tmp_path / "over-ceiling"
+    over_ceiling_directory.mkdir()
+    over_ceiling_path = _write_batch_spec(
+        over_ceiling_directory,
+        all_worker_payloads=[
+            _worker_payload(
+                role_name="over-ceiling",
+                all_prompt_parts=[str(header_part), str(body_part)],
+                working_directory=working_directory,
+                tool_profile=TOOL_PROFILE_BUILD,
+                timeout_seconds=MAXIMUM_WORKER_TIMEOUT_SECONDS + 1,
+            )
+        ],
+    )
+    with pytest.raises(ValueError, match="MAXIMUM_WORKER_TIMEOUT_SECONDS"):
+        batch.load_batch_spec(over_ceiling_path)
+
+    at_ceiling_directory = tmp_path / "at-ceiling"
+    at_ceiling_directory.mkdir()
+    at_ceiling_path = _write_batch_spec(
+        at_ceiling_directory,
+        all_worker_payloads=[
+            _worker_payload(
+                role_name="at-ceiling",
+                all_prompt_parts=[str(header_part), str(body_part)],
+                working_directory=working_directory,
+                tool_profile=TOOL_PROFILE_BUILD,
+                timeout_seconds=MAXIMUM_WORKER_TIMEOUT_SECONDS,
+            ),
+            _worker_payload(
+                role_name="well-under-ceiling",
+                all_prompt_parts=[str(header_part), str(body_part)],
+                working_directory=working_directory,
+                tool_profile=TOOL_PROFILE_BUILD,
+                timeout_seconds=30,
+            ),
+        ],
+    )
+    at_ceiling_spec = batch.load_batch_spec(at_ceiling_path)
+
+    assert at_ceiling_spec.all_workers[0].timeout_seconds == (
+        MAXIMUM_WORKER_TIMEOUT_SECONDS
+    )
+    assert at_ceiling_spec.all_workers[1].timeout_seconds == 30
+
+
+def test_ceiling_timeout_reaches_the_runner_untouched(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    header_part, body_part = _write_prompt_parts(tmp_path, role_marker="long-worker")
+    working_directory = tmp_path / "project"
+    working_directory.mkdir()
+    run_state_directory = tmp_path / "run-state"
+    batch_spec = batch.load_batch_spec(
+        _write_batch_spec(
+            tmp_path,
+            all_worker_payloads=[
+                _worker_payload(
+                    role_name="long-worker",
+                    all_prompt_parts=[str(header_part), str(body_part)],
+                    working_directory=working_directory,
+                    tool_profile=TOOL_PROFILE_READONLY,
+                    timeout_seconds=MAXIMUM_WORKER_TIMEOUT_SECONDS,
+                )
+            ],
+        )
+    )
+    recorder = _RunnerRecorder({"long-worker": _ok_outcome()})
+    monkeypatch.setattr(
+        batch, "batch_preflight", lambda **_kwargs: PreflightOutcome(True, None)
+    )
+    monkeypatch.setattr(batch, "batch_headless_runner", recorder)
+    monkeypatch.setattr(batch, "batch_sleep", lambda _seconds: None)
+
+    batch.run_grok_batch(
+        batch_spec=batch_spec,
+        run_state_directory=run_state_directory,
+    )
+
+    assert recorder.all_keyword_arguments[0]["timeout_seconds"] == (
+        MAXIMUM_WORKER_TIMEOUT_SECONDS
+    )
+
+
+def test_worker_invocations_carry_no_turn_cap(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    header_part, body_part = _write_prompt_parts(tmp_path, role_marker="uncapped")
+    working_directory = tmp_path / "project"
+    working_directory.mkdir()
+    run_state_directory = tmp_path / "run-state"
+    batch_spec = batch.load_batch_spec(
+        _write_batch_spec(
+            tmp_path,
+            all_worker_payloads=[
+                _worker_payload(
+                    role_name="uncapped",
+                    all_prompt_parts=[str(header_part), str(body_part)],
+                    working_directory=working_directory,
+                    tool_profile=TOOL_PROFILE_READONLY,
+                )
+            ],
+        )
+    )
+    recorder = _RunnerRecorder({"uncapped": _ok_outcome()})
+    monkeypatch.setattr(
+        batch, "batch_preflight", lambda **_kwargs: PreflightOutcome(True, None)
+    )
+    monkeypatch.setattr(batch, "batch_headless_runner", recorder)
+    monkeypatch.setattr(batch, "batch_sleep", lambda _seconds: None)
+
+    batch.run_grok_batch(
+        batch_spec=batch_spec,
+        run_state_directory=run_state_directory,
+    )
+
+    launched_keyword_arguments = recorder.all_keyword_arguments[0]
+    all_extra_arguments = launched_keyword_arguments["all_extra_arguments"]
+    assert RETIRED_MAX_TURNS_KEYWORD not in launched_keyword_arguments
+    assert isinstance(all_extra_arguments, tuple)
+    assert MAX_TURNS_FLAG not in all_extra_arguments
+
+
+def test_timed_out_worker_reads_as_timeout_beside_a_completed_worker(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """A killed worker stays distinguishable from a completed one in the summary.
+
+    ::
+
+        killed worker    ok: classification timeout, is_ok False, exit code 1
+        completed worker ok: classification ok, is_ok True
+    """
+    header_done, body_done = _write_prompt_parts(tmp_path, role_marker="done-worker")
+    header_killed, body_killed = _write_prompt_parts(
+        tmp_path, role_marker="killed-worker"
+    )
+    working_directory = tmp_path / "project"
+    working_directory.mkdir()
+    run_state_directory = tmp_path / "run-state"
+    specification_path = _write_batch_spec(
+        tmp_path,
+        all_worker_payloads=[
+            _worker_payload(
+                role_name="done-worker",
+                all_prompt_parts=[str(header_done), str(body_done)],
+                working_directory=working_directory,
+                tool_profile=TOOL_PROFILE_BUILD,
+            ),
+            _worker_payload(
+                role_name="killed-worker",
+                all_prompt_parts=[str(header_killed), str(body_killed)],
+                working_directory=working_directory,
+                tool_profile=TOOL_PROFILE_BUILD,
+            ),
+        ],
+    )
+    recorder = _RunnerRecorder(
+        {
+            "done-worker": _ok_outcome(),
+            "killed-worker": GrokRunnerOutcome(
+                is_ok=False,
+                returncode=-9,
+                classification=CLASSIFICATION_TIMEOUT,
+                stdout="",
+                stderr=FIXTURE_TIMEOUT_KILL_TEXT,
+            ),
+        }
+    )
+    monkeypatch.setattr(
+        batch, "batch_preflight", lambda **_kwargs: PreflightOutcome(True, None)
+    )
+    monkeypatch.setattr(batch, "batch_headless_runner", recorder)
+    monkeypatch.setattr(batch, "batch_sleep", lambda _seconds: None)
+
+    exit_code = batch.main(
+        [
+            "--spec",
+            str(specification_path),
+            "--run-temp-dir",
+            str(run_state_directory),
+        ]
+    )
+
+    summary_payload = json.loads(capsys.readouterr().out)
+    payload_by_role_name = {
+        each_payload[SUMMARY_ROLE_NAME_KEY]: each_payload
+        for each_payload in summary_payload[SUMMARY_WORKERS_KEY]
+    }
+    killed_payload = payload_by_role_name["killed-worker"]
+    done_payload = payload_by_role_name["done-worker"]
+
+    assert exit_code == 1
+    assert killed_payload[SUMMARY_CLASSIFICATION_KEY] == CLASSIFICATION_TIMEOUT
+    assert killed_payload[SUMMARY_IS_OK_KEY] is False
+    assert killed_payload[SUMMARY_CLASSIFICATION_KEY] != CLASSIFICATION_OK
+    assert done_payload[SUMMARY_CLASSIFICATION_KEY] == CLASSIFICATION_OK
+    assert done_payload[SUMMARY_IS_OK_KEY] is True
 
 
 def test_unwritable_report_file_keeps_the_worker_outcome(

package/scripts/tests/test_code_review_constants.py

@@ -0,0 +1,80 @@
+"""Specifications for the permission modes the review binary is asked for.
+
+The review binary accepts one permission mode for an ordinary caller and a
+different one for root. Naming the wrong mode means the binary refuses the
+call, no review runs, and no stamp is ever minted.
+"""
+
+from __future__ import annotations
+
+import importlib
+import os
+
+import pytest
+
+from dev_env_scripts_constants import code_review_constants
+
+
+BYPASS_MODE_TOKEN: str = "bypassPermissions"
+ACCEPT_EDITS_MODE_TOKEN: str = "acceptEdits"
+ROOT_USER_ID: int = 0
+UNPRIVILEGED_USER_ID: int = 1000
+
+
+def _permission_mode_seen_by(
+    monkeypatch: pytest.MonkeyPatch, effective_user_id: int
+) -> str:
+    """Read the review permission mode a caller with this user id resolves."""
+    monkeypatch.setattr(os, "geteuid", lambda: effective_user_id)
+    reloaded_constants = importlib.reload(code_review_constants)
+    return str(reloaded_constants.REVIEW_PERMISSION_MODE)
+
+
+def test_root_detection_agrees_with_this_process(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(os, "geteuid", lambda: ROOT_USER_ID)
+    reloaded_constants = importlib.reload(code_review_constants)
+
+    assert reloaded_constants.IS_ROOT_CALLER is True
+    assert reloaded_constants.ROOT_EFFECTIVE_USER_ID == ROOT_USER_ID
+
+
+def test_bypass_mode_names_the_token_the_binary_reads() -> None:
+    assert code_review_constants.PERMISSION_MODE_BYPASS == BYPASS_MODE_TOKEN
+
+
+def test_accept_edits_mode_names_the_token_the_binary_reads() -> None:
+    assert code_review_constants.PERMISSION_MODE_ACCEPT_EDITS == ACCEPT_EDITS_MODE_TOKEN
+
+
+def test_a_root_caller_resolves_the_mode_the_binary_accepts(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    assert _permission_mode_seen_by(monkeypatch, ROOT_USER_ID) == (
+        ACCEPT_EDITS_MODE_TOKEN
+    )
+
+
+def test_an_ordinary_caller_resolves_the_bypass_mode(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    assert _permission_mode_seen_by(monkeypatch, UNPRIVILEGED_USER_ID) == (
+        BYPASS_MODE_TOKEN
+    )
+
+
+def test_a_platform_without_a_user_id_still_loads_the_constants(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Windows exposes no ``os.geteuid``, and the module still imports.
+
+    Reading a missing ``os.geteuid`` raises, and every caller of the review
+    invoker dies at import. A platform that reports no user id is never the
+    root the review binary refuses, so it reads as an ordinary caller.
+    """
+    monkeypatch.delattr(os, "geteuid", raising=False)
+    reloaded_constants = importlib.reload(code_review_constants)
+
+    assert reloaded_constants.IS_ROOT_CALLER is False
+    assert reloaded_constants.REVIEW_PERMISSION_MODE == BYPASS_MODE_TOKEN

package/scripts/tests/test_codex_capability_bridge.py

@@ -0,0 +1,91 @@
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+from codex_capability_bridge import translate_capability
+
+
+@pytest.mark.parametrize("source_surface, expected_target, capability_payload", [("TaskList", "update_plan", {"plan": []}), ("TaskCreate", "update_plan", {"name": "review", "status": "pending"}), ("TaskUpdate", "update_plan", {"name": "review", "status": "pending"}), ("Task", "multi_agent_v1__spawn_agent", {"prompt": "review"}), ("SendMessage", "multi_agent_v1__send_input", {"message": "review"}), ("TaskOutput", "multi_agent_v1__wait_agent", {"task_id": "task-1"}), ("TaskStop", "multi_agent_v1__close_agent", {"task_id": "task-1"})])
+def test_maps_capability(source_surface: str, expected_target: str, capability_payload: dict[str, object]) -> None:
+    translated_record = translate_capability(source_surface, capability_payload)
+    assert translated_record["target"] == expected_target
+
+
+def test_normalizes_alias_and_task_payload() -> None:
+    translated_record = translate_capability("task_create", {"subject": "write tests", "status": "in-progress"})
+    assert translated_record["payload"] == {"plan": [{"step": "write tests", "status": "in_progress"}]}
+
+
+def test_rejects_bad_payload_and_schedule() -> None:
+    assert translate_capability("TaskUpdate", {"name": "x", "status": "later"})["status"] == "malformed"
+    assert translate_capability("ScheduleWakeup", {})["status"] == "unsupported"
+
+
+def test_rejects_unknown_and_private_paths() -> None:
+    assert translate_capability("NoSuchSurface", {})["status"] == "unknown"
+    assert translate_capability("SendMessage", {"message": "C:\\Users\\melan\\secret"})["status"] == "rejected"
+
+
+@pytest.mark.parametrize("private_path", ["C:/private/file", "\\\\server\\share\\file", "/private/file", "~/secret", "$HOME/secret", "%USERPROFILE%\\secret", "safe/../secret"])
+def test_rejects_absolute_private_and_traversal_paths(private_path: str) -> None:
+    assert translate_capability("SendMessage", {"message": private_path})["status"] == "rejected"
+
+
+def test_validates_mapped_surface_payloads() -> None:
+    assert translate_capability("spawn", {"message": "hello"})["status"] == "malformed"
+    assert translate_capability("stop", {"task_id": 3})["status"] == "malformed"
+    assert translate_capability("TaskList", {"plan": [{"step": "review"}]})["status"] == "malformed"
+
+
+def test_translation_is_byte_identical_for_repeated_input() -> None:
+    payload = {"message": "hello", "agent_id": "agent-1"}
+    first_json = json.dumps(translate_capability("message", payload), sort_keys=True, separators=(",", ":"))
+    second_json = json.dumps(translate_capability("message", payload), sort_keys=True, separators=(",", ":"))
+    assert first_json == second_json
+
+
+def test_translation_does_not_execute_payload() -> None:
+    payload = {"message": "__import__('subprocess').run('whoami')"}
+    translated_record = translate_capability("message", payload)
+    assert translated_record["payload"] == payload
+
+
+def test_translation_is_deterministic_and_cli_is_json() -> None:
+    payload = {"message": "hello", "agent_id": "agent-1"}
+    first_record = translate_capability("SendMessage", payload)
+    second_record = translate_capability("SendMessage", payload)
+    assert first_record == second_record
+    script_path = Path(__file__).parents[1] / "codex_capability_bridge.py"
+    cli_run = subprocess.run([sys.executable, str(script_path), "SendMessage", json.dumps(payload)], capture_output=True, text=True, check=True)
+    assert json.loads(cli_run.stdout) == first_record
+
+
+def test_cli_rejects_malformed_payload_with_one_json_error_record() -> None:
+    script_path = Path(__file__).parents[1] / "codex_capability_bridge.py"
+    cli_run = subprocess.run(
+        [sys.executable, str(script_path), "SendMessage", "{"],
+        capture_output=True,
+        text=True,
+    )
+    assert cli_run.returncode != 0
+    assert json.loads(cli_run.stdout) == {
+        "source": "unknown",
+        "status": "error",
+        "error": "payload must be valid JSON",
+    }
+    assert cli_run.stderr == ""
+
+
+def test_cli_rejects_malformed_arguments_with_one_json_error_record() -> None:
+    script_path = Path(__file__).parents[1] / "codex_capability_bridge.py"
+    cli_run = subprocess.run(
+        [sys.executable, str(script_path)],
+        capture_output=True,
+        text=True,
+    )
+    assert cli_run.returncode != 0
+    assert json.loads(cli_run.stdout)["status"] == "error"
+    assert cli_run.stderr == ""