create-workframe 0.1.0 → 0.1.2

package/workframe-api/tests/test_avatar_resolve.py

@@ -1,77 +0,0 @@
-import unittest
-
-import server
-
-
-class AvatarResolveTests(unittest.TestCase):
-    def test_avatar_url_for_id_uses_catalog_file(self) -> None:
-        url = server._avatar_url_for_id("ada")
-        self.assertTrue(url.endswith("/ada.png"))
-
-    def test_resolve_avatar_fields_from_id(self) -> None:
-        row = {"avatar_id": "grace"}
-        server._resolve_avatar_fields(row)
-        self.assertIn("avatar_url", row)
-        self.assertTrue(str(row["avatar_url"]).endswith("/grace.png"))
-
-    def test_avatar_id_from_catalog_url(self) -> None:
-        catalog_id = str((server._load_avatar_catalog().get("avatars") or [{}])[0].get("id") or "")
-        self.assertTrue(catalog_id)
-        url = server._avatar_url_for_id(catalog_id)
-        self.assertEqual(server._avatar_id_from_url(url), catalog_id)
-
-    def test_avatar_id_from_custom_url_is_empty(self) -> None:
-        self.assertEqual(server._avatar_id_from_url("/files/uploads/my-face.png"), "")
-
-    def test_explicit_url_survives_resolve_after_reconcile(self) -> None:
-        # Reconciled catalog pick: id matches url, resolver reproduces the chosen url.
-        catalog_id = str((server._load_avatar_catalog().get("avatars") or [{}])[0].get("id") or "")
-        chosen = server._avatar_url_for_id(catalog_id)
-        row = {"avatar_url": chosen, "avatar_id": server._avatar_id_from_url(chosen)}
-        server._resolve_avatar_fields(row)
-        self.assertEqual(row["avatar_url"], chosen)
-
-    def test_custom_url_survives_resolve_when_id_cleared(self) -> None:
-        row = {"avatar_url": "/files/uploads/my-face.png", "avatar_id": ""}
-        server._resolve_avatar_fields(row)
-        self.assertEqual(row["avatar_url"], "/files/uploads/my-face.png")
-
-    def test_avatar_id_from_vite_hashed_url(self) -> None:
-        self.assertEqual(server._avatar_id_from_url("/assets/frida-DAkwYbrd.png"), "frida")
-        self.assertEqual(
-            server._avatar_id_from_url("http://127.0.0.1:18644/assets/steve-CvzbBEg_.png"),
-            "steve",
-        )
-
-    def test_normalize_agent_avatar_patch_stable(self) -> None:
-        out = server._normalize_agent_avatar_patch("/assets/frida-DAkwYbrd.png", "")
-        self.assertEqual(out["avatar_id"], "frida")
-        self.assertTrue(out["avatar_url"].endswith("/frida.png"))
-
-    def test_native_assign_uses_steve(self) -> None:
-        native = str(server.NATIVE_PROFILE or "workframe-agent")
-        picked = server._assign_agent_avatar(native)
-        self.assertEqual(picked["avatar_id"], "steve")
-        self.assertTrue(picked["avatar_url"].endswith("/steve.png"))
-
-    def test_normalize_user_avatar_vite_hash(self) -> None:
-        out = server._normalize_user_avatar_url("/assets/grace-CnKLjc4q.png")
-        self.assertTrue(out.endswith("/grace.png"))
-
-    def test_normalize_logo_vite_hash(self) -> None:
-        out = server._normalize_logo_url("/assets/4-DGVBPxhf.png")
-        self.assertTrue(out.endswith("/4.png"))
-
-    def test_pick_logo_url_from_catalog(self) -> None:
-        url = server._pick_logo_url()
-        self.assertTrue(url.startswith("/assets/project-logos/"))
-        self.assertTrue(url.endswith(".png"))
-
-    def test_pick_user_avatar_url_from_catalog(self) -> None:
-        url = server._pick_user_avatar_url()
-        self.assertTrue(url.startswith("/assets/avatars/"))
-        self.assertTrue(url.endswith(".png"))
-
-
-if __name__ == "__main__":
-    unittest.main()

package/workframe-api/tests/test_child_soul_template.py

@@ -1,71 +0,0 @@
-"""Child agent SOUL templates and native overlay seeding."""
-import tempfile
-import unittest
-from pathlib import Path
-from unittest import mock
-
-import server
-
-
-class ChildSoulTemplateTests(unittest.TestCase):
-    def test_format_child_template_expands_native_agent_name(self) -> None:
-        body = server._format_child_template(
-            server._CHILD_SOUL_TEMPLATE,
-            display_name="Elvis",
-            role="Rock legend",
-        )
-        self.assertNotIn("{nativeAgentName}", body)
-        self.assertIn("Workframe Agent", body)
-        self.assertIn("Elvis", body)
-
-    def test_install_child_base_artifacts_no_placeholder_error(self) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            root = Path(tmp)
-            prof = "elvis"
-            prof_dir = root / "profiles" / prof
-            prof_dir.mkdir(parents=True)
-            (prof_dir / "SOUL.md").write_text("test", encoding="utf-8")
-            with mock.patch.object(server, "_profile_dir", side_effect=lambda p: root / "profiles" / p), mock.patch.object(
-                server, "PROJECT_NAME", "Workframe"
-            ), mock.patch.object(server, "_is_native_profile", return_value=False):
-                ok = server._install_child_base_artifacts(prof, display_name="Elvis", role="Rock legend")
-            self.assertTrue(ok)
-            agents = (prof_dir / "AGENTS.md").read_text(encoding="utf-8")
-            self.assertNotIn("{nativeAgentName}", agents)
-
-    def test_seed_native_user_overlay_keeps_base_soul(self) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            root = Path(tmp)
-            template = root / "profiles" / "workframe-agent"
-            runtime = root / "profiles" / "u-user-workframe-agent"
-            template.mkdir(parents=True)
-            runtime.mkdir(parents=True)
-            (template / "SOUL.md").write_text(
-                "# Workframe Agent\n\nBase native system prompt.\n" + ("operate. " * 20),
-                encoding="utf-8",
-            )
-            (runtime / "SOUL.md").write_text("test", encoding="utf-8")
-            agents = root / "workframe" / "agents.json"
-            agents.parent.mkdir(parents=True)
-            agents.write_text('{"version":1,"agents":{}}', encoding="utf-8")
-            with mock.patch.object(server, "_profile_dir", side_effect=lambda p: root / "profiles" / p), mock.patch.object(
-                server, "AGENTS_JSON", agents
-            ), mock.patch.object(server, "_is_runtime_profile_slug", return_value=True), mock.patch.object(
-                server, "_runtime_template_slug", return_value="workframe-agent"
-            ):
-                server._seed_native_user_overlay(
-                    "u-user-workframe-agent",
-                    "workframe-agent",
-                    display_name="Andy",
-                    user_soul="Always be cheerful.",
-                )
-                base = (runtime / "SOUL.md").read_text(encoding="utf-8")
-                merged = server._profile_soul_text("u-user-workframe-agent")
-            self.assertIn("Base native system prompt", base)
-            self.assertIn("Base native system prompt", merged)
-            self.assertIn("## Additional instructions", merged)
-            self.assertIn("Always be cheerful.", merged)
-
-
-if __name__ == "__main__":
-    unittest.main()

package/workframe-api/tests/test_credential_canary.py

@@ -1,135 +0,0 @@
-"""Canary / red-team tests: cross-profile reads, exec guards, public tool gating."""
-
-from __future__ import annotations
-
-import tempfile
-import unittest
-from pathlib import Path
-from unittest.mock import patch
-
-import server
-from db_setup import ensure_workframe_schemas
-
-
-class CredentialCanaryTests(unittest.TestCase):
-    def setUp(self) -> None:
-        self._tmp = tempfile.TemporaryDirectory()
-        self.addCleanup(self._tmp.cleanup)
-        self._old_data_dir = server.DATA_DIR
-        self._old_auth_db_path = server.AUTH_DB_PATH
-        self._old_hermes_data = server.HERMES_DATA
-        server.DATA_DIR = Path(self._tmp.name)
-        server.AUTH_DB_PATH = Path(self._tmp.name) / "auth.db"
-        server.HERMES_DATA = Path(self._tmp.name) / "hermes"
-        (server.HERMES_DATA / "profiles").mkdir(parents=True)
-        ensure_workframe_schemas()
-        self.workspace_id = "ws-canary"
-        self.user_a = "cb6a2db4-ac86-4c49-8247-14a1d68aca72"
-        self.user_b = "44fb344c-0954-47b6-a19a-ebbcf20e9680"
-        conn = server._workframe_db()
-        try:
-            now = "1"
-            conn.execute(
-                "INSERT INTO workspaces (id, slug, display_name, owner_id, status, created_at, updated_at) VALUES (?,?,?,?,?,?,?)",
-                (self.workspace_id, "canary", "Canary", self.user_a, "active", now, now),
-            )
-            for uid, name, role in (
-                (self.user_a, "Alice", "owner"),
-                (self.user_b, "Bob", "member"),
-            ):
-                conn.execute(
-                    "INSERT INTO users (id, display_name, role, status, created_at, updated_at) VALUES (?,?,?,?,?,?)",
-                    (uid, name, "member", "active", now, now),
-                )
-                conn.execute(
-                    """
-                    INSERT INTO workspace_memberships (id, workspace_id, user_id, role, status, created_at, updated_at)
-                    VALUES (?, ?, ?, ?, 'active', ?, ?)
-                    """,
-                    (f"wm-{uid}", self.workspace_id, uid, role, now, now),
-                )
-            conn.execute(
-                """
-                INSERT INTO agent_profiles (id, workspace_id, slug, display_name, is_native, status, created_at, updated_at)
-                VALUES (?, ?, ?, ?, ?, 'available', ?, ?)
-                """,
-                ("ap-architect", self.workspace_id, "architect", "Architect", 0, now, now),
-            )
-            conn.commit()
-        finally:
-            conn.close()
-        self.runtime_a = server._runtime_profile_slug(self.user_a, "architect")
-        self.runtime_b = server._runtime_profile_slug(self.user_b, "architect")
-
-    def tearDown(self) -> None:
-        server.DATA_DIR = self._old_data_dir
-        server.AUTH_DB_PATH = self._old_auth_db_path
-        server.HERMES_DATA = self._old_hermes_data
-
-    def test_member_cannot_access_peer_runtime_profile_public_mode(self) -> None:
-        with patch.object(server, "DEPLOYMENT_MODE", "public_multi_user"):
-            self.assertFalse(
-                server._user_may_access_runtime_profile(self.user_b, self.runtime_a, self.workspace_id)
-            )
-            self.assertTrue(
-                server._user_may_access_runtime_profile(self.user_a, self.runtime_a, self.workspace_id)
-            )
-
-    def test_owner_can_access_peer_runtime_in_trusted_team(self) -> None:
-        with patch.object(server, "DEPLOYMENT_MODE", "trusted_team"):
-            self.assertTrue(
-                server._user_may_access_runtime_profile(self.user_a, self.runtime_b, self.workspace_id)
-            )
-            self.assertFalse(
-                server._user_may_access_runtime_profile(self.user_b, self.runtime_a, self.workspace_id)
-            )
-
-    def test_gateway_exec_blocks_cross_profile_env_cat(self) -> None:
-        victim_env = f"/opt/data/profiles/{self.runtime_a}/.env"
-        with patch.object(server, "DEPLOYMENT_MODE", "trusted_team"):
-            self.assertTrue(
-                server._exec_targets_runtime_profile_secrets(["sh", "-lc", f"cat {victim_env}"])
-            )
-
-    def test_gateway_exec_denies_foreign_runtime_profile(self) -> None:
-        with patch.object(server, "DEPLOYMENT_MODE", "public_multi_user"), patch.object(
-            server, "resolve_validated_profile", return_value=self.runtime_a
-        ), patch.object(server, "_gateway_exec") as gateway_exec:
-            out = server.hermes_gateway_exec(
-                "/help",
-                self.runtime_a,
-                user_id=self.user_b,
-                workspace_id=self.workspace_id,
-            )
-            gateway_exec.assert_not_called()
-        self.assertFalse(out.get("ok"))
-        self.assertEqual(out.get("error"), "profile_access_denied")
-
-    def test_docker_exec_guard_returns_blocked_without_running(self) -> None:
-        victim_env = f"/opt/data/profiles/{self.runtime_b}/.env"
-        with patch.object(server, "DEPLOYMENT_MODE", "trusted_team"), patch.object(
-            server, "_docker_request"
-        ) as docker_request:
-            code, out = server._docker_exec("workframe-gateway", ["cat", victim_env])
-            docker_request.assert_not_called()
-        self.assertEqual(code, 1)
-        self.assertIn("blocked", out)
-
-    def test_public_mode_toolsets_include_terminal(self) -> None:
-        with patch.object(server, "DEPLOYMENT_MODE", "public_multi_user"):
-            self.assertEqual(server._chat_toolsets_for_profile("architect"), ("hermes-cli", "terminal"))
-
-    def test_public_mode_ensure_toolsets_enables_terminal(self) -> None:
-        prof_dir = server._profile_dir("architect")
-        prof_dir.mkdir(parents=True, exist_ok=True)
-        cfg_path = prof_dir / "config.yaml"
-        cfg_path.write_text("toolsets: []\n", encoding="utf-8")
-        with patch.object(server, "DEPLOYMENT_MODE", "public_multi_user"):
-            server._ensure_profile_toolsets("architect")
-        text = cfg_path.read_text(encoding="utf-8")
-        self.assertIn("hermes-cli", text)
-        self.assertIn("terminal", text)
-
-
-if __name__ == "__main__":
-    unittest.main()