create-workframe 0.1.11 → 0.1.13

package/workframe-api/test_runtime_cohort.py

@@ -0,0 +1,85 @@
+"""WF-032 runtime_cohort self-check."""
+
+from __future__ import annotations
+
+import os
+import sys
+import tempfile
+import uuid
+from pathlib import Path
+
+API_DIR = Path(__file__).resolve().parent
+if str(API_DIR) not in sys.path:
+    sys.path.insert(0, str(API_DIR))
+
+os.environ.setdefault("WORKFRAME_API_DATA_DIR", str(API_DIR / ".tmp-test-data"))
+os.environ.setdefault("HERMES_DATA", str(API_DIR / ".tmp-test-hermes"))
+os.environ.setdefault("DEV_LOCAL_UNSAFE", "true")
+
+import runtime_cohort  # noqa: E402
+import server  # noqa: E402
+
+
+def test_runtime_profile_slug_format() -> None:
+    slug = runtime_cohort._runtime_profile_slug("aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", "architect")
+    assert slug.startswith("u-")
+    assert slug.endswith("-architect")
+    assert server._runtime_profile_slug("aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", "architect") == slug
+
+
+def test_self_grant_forbidden() -> None:
+    try:
+        runtime_cohort.create_delegation_grant("ws-1", "user-1", "user-1")
+        raise AssertionError("expected ValueError")
+    except ValueError as exc:
+        assert str(exc) == "self_grant_forbidden"
+
+
+def test_delegation_grant_round_trip() -> None:
+    with tempfile.TemporaryDirectory() as tmp:
+        os.environ["WORKFRAME_API_DATA_DIR"] = tmp
+        server.DATA_DIR = Path(tmp)
+        server.AUTH_DB_PATH = Path(tmp) / "auth.db"
+        server._ensure_workframe_db_schema()
+        ws_id = str(uuid.uuid4())
+        grantor = str(uuid.uuid4())
+        grantee = str(uuid.uuid4())
+        now = server._utc_now()
+        conn = server._workframe_db()
+        try:
+            conn.execute(
+                "INSERT INTO workspaces (id, slug, display_name, owner_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)",
+                (ws_id, "test-ws", "Test", grantor, now, now),
+            )
+            for uid, email in ((grantor, "a@test.local"), (grantee, "b@test.local")):
+                conn.execute(
+                    "INSERT INTO users (id, email, display_name, created_at, updated_at) VALUES (?, ?, ?, ?, ?)",
+                    (uid, email, email.split("@")[0], now, now),
+                )
+                conn.execute(
+                    """
+                    INSERT INTO workspace_memberships (
+                        id, workspace_id, user_id, role, status, created_at, updated_at
+                    ) VALUES (?, ?, ?, 'member', 'active', ?, ?)
+                    """,
+                    (str(uuid.uuid4()), ws_id, uid, now, now),
+                )
+            conn.commit()
+        finally:
+            conn.close()
+        created = runtime_cohort.create_delegation_grant(ws_id, grantor, grantee)
+        assert created["ok"] is True
+        grant_id = created["grant"]["id"]
+        listed = runtime_cohort.list_delegation_grants(ws_id, grantor)
+        assert any(row["id"] == grant_id for row in listed["grants"])
+        revoked = runtime_cohort.revoke_delegation_grant(ws_id, grant_id, grantor)
+        assert revoked["ok"] is True
+        grantors = runtime_cohort._delegation_grantor_ids_for_grantee(grantee, ws_id)
+        assert grantor not in grantors
+
+
+if __name__ == "__main__":
+    test_runtime_profile_slug_format()
+    test_self_grant_forbidden()
+    test_delegation_grant_round_trip()
+    print("test_runtime_cohort: ok")

package/workframe-api/test_secure_mode_docker_boundary.py

@@ -0,0 +1,39 @@
+"""WF-NS-P1 secure-mode docker socket boundary self-check."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import server  # noqa: E402
+
+
+def test_docker_request_blocked_in_secure_mode() -> None:
+    prev = server.SECURE_MODE
+    try:
+        server.SECURE_MODE = True
+        try:
+            server._docker_request("GET", "/containers/json")
+            raise AssertionError("expected RuntimeError in SECURE_MODE")
+        except RuntimeError as exc:
+            assert "SECURE_MODE" in str(exc)
+    finally:
+        server.SECURE_MODE = prev
+
+
+def test_public_compose_api_has_no_docker_sock() -> None:
+    """Compose config assertion — complements WF-011 supervisor negatives."""
+    repo = Path(__file__).resolve().parents[2]
+    public = (repo / "infra" / "compose" / "workframe" / "docker-compose.public.yml").read_text(
+        encoding="utf-8"
+    )
+    api_block = public.split("workframe-api:")[1].split("workframe-supervisor:")[0]
+    assert "/var/run/docker.sock" not in api_block
+
+
+if __name__ == "__main__":
+    test_docker_request_blocked_in_secure_mode()
+    test_public_compose_api_has_no_docker_sock()
+    print("test_secure_mode_docker_boundary: ok")

package/workframe-api/test_server_reexports.py

@@ -0,0 +1,99 @@
+"""WF-032 guard: server.py must re-export symbols still called from extracted modules."""
+
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+
+API_DIR = Path(__file__).resolve().parent
+if str(API_DIR) not in sys.path:
+    sys.path.insert(0, str(API_DIR))
+
+os.environ.setdefault("WORKFRAME_API_DATA_DIR", str(API_DIR / ".tmp-test-data"))
+os.environ.setdefault("HERMES_DATA", str(API_DIR / ".tmp-test-hermes"))
+os.environ.setdefault("DEV_LOCAL_UNSAFE", "true")
+
+import server  # noqa: E402
+
+
+_REQUIRED = (
+    "_parse_workspace_settings",
+    "_strip_profile_action_env",
+    "_strip_profile_llm_env",
+    "_user_action_env_specs",
+    "_overlay_turn_user_env",
+    "_overlay_turn_provider_env",
+    "_llm_proxy_base_url",
+    "_require_user_provider",
+    "_ensure_profile_llm_proxy",
+    "_revoke_turn_credential_lease",
+    "_sync_profile_provider_env",
+    "_session_info",
+    "chat_messages",
+    "chat_bootstrap",
+    "_gateway_container_exec",
+    "_gateway_container_exec_detached",
+    "_docker_exec",
+    "_gateway_exec",
+    "_hermes_agent_version",
+    "ensure_profile_api",
+    "hermes_commands_catalog",
+    "hermes_commands_exec",
+    "hermes_usage",
+    "_runtime_profile_slug",
+    "ensure_runtime_profile",
+    "ensure_user_agent_cohort",
+    "resolve_runtime_assignee",
+    "cohort_runtime_slugs",
+    "_prepare_runtime_profile_credentials",
+    "purge_stale_runtime_profiles",
+    "list_delegation_grants",
+    "create_delegation_grant",
+    "revoke_delegation_grant",
+    "_delegation_grantor_ids_for_grantee",
+    "_runtime_profile_on_disk",
+    "_invalidate_gateway_registered_cache",
+    "_normalize_user_avatar_url",
+    "_normalize_logo_url",
+    "_normalize_agent_avatar_patch",
+    "_resolve_avatar_fields",
+    "_upsert_agent_registry_row",
+    "_assign_agent_avatar",
+    "_avatar_id_for_display_name",
+    "_pick_logo_url",
+    "_supervisor_ready",
+    "_supervisor_request",
+    "_maybe_sync_compose_public_url",
+    "_supervisor_gateway_exec",
+    "_supervisor_container_exec",
+    "_supervisor_profile_lifecycle",
+    "_parse_messaging_settings_patch",
+    "_workspace_messaging_integrations_payload",
+    "_sync_workspace_messaging_gateway",
+    "room_chat_bind",
+    "profile_chat_bind",
+    "list_room_sessions",
+    "profile_chat_activate_room_session",
+    "profile_chat_message",
+    "_enrich_room_chat_payload",
+    "_room_session_rows",
+    "_extract_title",
+    "bootstrap_agent_dm_lane",
+    "_provision_agent_dm_runtimes",
+    "_ensure_default_workspace",
+    "_bootstrap_after_setup",
+    "_promote_workspace_owner_if_unclaimed",
+    "_sync_workspace_home_room",
+    "_onboard_workspace_member_rooms",
+)
+
+
+def test_server_wf032_reexports_present() -> None:
+    missing = [name for name in _REQUIRED if not hasattr(server, name)]
+    assert not missing, f"missing server re-exports: {missing}"
+
+
+if __name__ == "__main__":
+    test_server_wf032_reexports_present()
+    print("ok")

package/workframe-api/test_stack_config_install_smtp.py

@@ -53,4 +53,11 @@ os.environ["WORKFRAME_DEPLOYMENT_MODE"] = "trusted_team"
 stack_config.patch_stack_config({"deployment_mode": "single_user_local"})
 assert stack_config.resolve_deployment_mode() == "single_user_local"
 
+# Admin verify survives reload
+stack_config.patch_stack_config({"install_complete": False})
+stack_config.mark_install_admin_verified("owner@example.com")
+assert stack_config.install_admin_verified()
+cfg = stack_config.get_stack_config()
+assert cfg["smtp"]["admin_email"] == "owner@example.com"
+
 print("stack_config install-window smtp self-check ok")

package/workframe-api/time-bind-steps.py

@@ -0,0 +1,75 @@
+#!/usr/bin/env python3
+"""Granular bind + stream lease timings (docker exec)."""
+from __future__ import annotations
+
+import sqlite3
+import sys
+import time
+import uuid
+
+import server
+
+
+def ms(t0: float) -> int:
+    return round((time.perf_counter() - t0) * 1000)
+
+
+def main() -> int:
+    conn = sqlite3.connect(str(server._workframe_db_path()))
+    conn.row_factory = sqlite3.Row
+    room = conn.execute(
+        """
+        SELECT id, workspace_id FROM rooms
+        WHERE room_type = 'direct' AND deleted_at IS NULL
+        ORDER BY updated_at DESC LIMIT 1
+        """,
+    ).fetchone()
+    user = conn.execute(
+        "SELECT id FROM users WHERE status = 'active' ORDER BY created_at LIMIT 1",
+    ).fetchone()
+    conn.close()
+    if not room or not user:
+        print("no room/user", file=sys.stderr)
+        return 1
+
+    uid = str(user["id"])
+    rid = str(room["id"])
+    ws = str(room["workspace_id"])
+    prof = server._resolve_chat_hermes_profile("mybusiness-agent", uid, rid, ws)
+    payload = {
+        "room_id": rid,
+        "workspace_id": ws,
+        "source_id": "steps",
+        "client_id": "steps",
+        "binding_version": 2,
+    }
+    print(f"profile={prof}")
+
+    block = server._read_model_block(prof)
+    t = time.perf_counter()
+    block2 = server._read_model_block(prof)
+    print(f"read_model_block_ms={ms(t)} repeat_ms={ms(t)}")
+
+    t = time.perf_counter()
+    server.ensure_profile_api(prof, uid, ws)
+    print(f"ensure_api_ms={ms(t)}")
+
+    provider = server._llm_billing_provider(prof, user_id=uid, workspace_id=ws, block=block)
+    run_a, run_b = "steps-a", "steps-b"
+    t = time.perf_counter()
+    server._apply_turn_credential_lease(prof, uid, ws, provider, run_a)
+    print(f"lease_cold_ms={ms(t)} provider={provider}")
+    t = time.perf_counter()
+    server._apply_turn_credential_lease(prof, uid, ws, provider, run_b)
+    print(f"lease_warm_ms={ms(t)}")
+
+    for i in range(3):
+        t = time.perf_counter()
+        server.profile_chat_bind("", payload, user_id=uid)
+        print(f"bind_{i}_ms={ms(t)}")
+
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/workframe-api/time-perf.py

@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+"""Measure model-save, gateway reload, bind, and reconcile latency (docker exec)."""
+from __future__ import annotations
+
+import sqlite3
+import sys
+import time
+
+import server
+
+
+def ms(t0: float) -> int:
+    return round((time.perf_counter() - t0) * 1000)
+
+
+def main() -> int:
+    conn = sqlite3.connect(str(server._workframe_db_path()))
+    conn.row_factory = sqlite3.Row
+    room = conn.execute(
+        """
+        SELECT r.id, r.workspace_id
+        FROM rooms r
+        WHERE r.room_type = 'direct' AND r.deleted_at IS NULL
+        ORDER BY r.updated_at DESC
+        LIMIT 1
+        """,
+    ).fetchone()
+    user = conn.execute(
+        "SELECT id FROM users WHERE status = 'active' ORDER BY created_at LIMIT 1",
+    ).fetchone()
+    conn.close()
+    if not room or not user:
+        print("no room/user", file=sys.stderr)
+        return 1
+
+    user_id = str(user["id"])
+    room_id = str(room["id"])
+    ws_id = str(room["workspace_id"])
+    prof = server._resolve_chat_hermes_profile("mybusiness-agent", user_id, room_id, ws_id)
+    print(f"profile={prof}")
+
+    t = time.perf_counter()
+    ok, err = server._apply_model_persisted(
+        prof, "codex", "gpt-5.4-mini", user_id, restart_gateway=False,
+    )
+    print(f"yaml_write_ms={ms(t)} ok={ok} err={err!r}")
+
+    t = time.perf_counter()
+    code, out = server._gateway_exec(prof, ["gateway", "restart"])
+    # ponytail: ~7s vs stop+start ~45s on dogfood
+    healthy = server._wait_profile_api_healthy(prof, attempts=24, delay=0.25)
+    print(f"gateway_restart_ms={ms(t)} code={code} healthy={healthy} out={out[:80]!r}")
+
+    t = time.perf_counter()
+    changed = server._reconcile_profile_llm_for_user(prof, user_id, ws_id)
+    print(f"reconcile_ms={ms(t)} changed={changed}")
+
+    t = time.perf_counter()
+    server.ensure_profile_api(prof, user_id, ws_id)
+    print(f"ensure_api_ms={ms(t)}")
+
+    payload = {
+        "room_id": room_id,
+        "workspace_id": ws_id,
+        "source_id": "perf",
+        "client_id": "perf",
+        "binding_version": 2,
+    }
+    t = time.perf_counter()
+    session = server.profile_chat_session("", payload, user_id=user_id)
+    print(f"bind_ms={ms(t)} session={str(session.get('session_id') or '')[:24]}")
+
+    t = time.perf_counter()
+    changed2 = server._reconcile_profile_llm_for_user(prof, user_id, ws_id)
+    print(f"reconcile_repeat_ms={ms(t)} changed={changed2}")
+
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/workframe-api/time-warm.py

@@ -0,0 +1,107 @@
+#!/usr/bin/env python3
+"""Warm-path timings: model save API return + bind + first stream token."""
+from __future__ import annotations
+
+import json
+import sqlite3
+import sys
+import time
+import urllib.error
+import urllib.request
+
+import server
+
+
+def ms(t0: float) -> int:
+    return round((time.perf_counter() - t0) * 1000)
+
+
+def main() -> int:
+    conn = sqlite3.connect(str(server._workframe_db_path()))
+    conn.row_factory = sqlite3.Row
+    room = conn.execute(
+        """
+        SELECT id, workspace_id FROM rooms
+        WHERE room_type = 'direct' AND deleted_at IS NULL
+        ORDER BY updated_at DESC LIMIT 1
+        """,
+    ).fetchone()
+    user = conn.execute(
+        "SELECT id FROM users WHERE status = 'active' ORDER BY created_at LIMIT 1",
+    ).fetchone()
+    conn.close()
+    if not room or not user:
+        print("no room/user", file=sys.stderr)
+        return 1
+
+    uid = str(user["id"])
+    rid = str(room["id"])
+    ws = str(room["workspace_id"])
+    prof = server._resolve_chat_hermes_profile("mybusiness-agent", uid, rid, ws)
+    payload = {
+        "room_id": rid,
+        "workspace_id": ws,
+        "source_id": "warm",
+        "client_id": "warm",
+        "binding_version": 2,
+    }
+    print(f"profile={prof} healthy={server._profile_api_healthy(prof)}")
+
+    t = time.perf_counter()
+    result = server.hermes_model_set(
+        prof, "gpt-5.4-medium", user_id=uid, workspace_id=ws, billing_provider="codex",
+    )
+    print(f"model_set_ms={ms(t)} ok={result.get('ok')}")
+
+    time.sleep(0.5)
+    t = time.perf_counter()
+    session = server.profile_chat_session("", payload, user_id=uid)
+    sid = str(session.get("session_id") or "")
+    print(f"bind_ms={ms(t)} session={sid[:28]}")
+
+    t = time.perf_counter()
+    server.profile_chat_session("", payload, user_id=uid)
+    print(f"bind_repeat_ms={ms(t)}")
+
+    for i in range(2):
+        t = time.perf_counter()
+        server._reconcile_profile_llm_for_user(prof, uid, ws)
+        print(f"reconcile_cached_{i}_ms={ms(t)}")
+
+    t = time.perf_counter()
+    server.profile_chat_session("", payload, user_id=uid)
+    print(f"bind_cached_ms={ms(t)}")
+
+    port = server._profile_api_port(prof)
+    key = server._profile_api_key(prof)
+    body = json.dumps(server._profile_turn_payload(prof, "Reply with exactly: pong", rid)).encode()
+    url = f"http://gateway:{port}/api/sessions/{sid}/chat/stream"
+    req = urllib.request.Request(
+        url,
+        data=body,
+        headers={"Authorization": f"Bearer {key}", "Content-Type": "application/json"},
+        method="POST",
+    )
+    t = time.perf_counter()
+    first_ms = None
+    try:
+        with urllib.request.urlopen(req, timeout=120) as resp:
+            while True:
+                chunk = resp.read(4096)
+                if not chunk:
+                    break
+                if first_ms is None and b"data:" in chunk:
+                    first_ms = ms(t)
+                    print(f"first_upstream_chunk_ms={first_ms} sample={chunk[:120]!r}")
+                    break
+    except urllib.error.HTTPError as exc:
+        print(f"stream_http_error={exc.code} body={exc.read()[:200]!r}")
+        return 1
+    if first_ms is None:
+        print("no_stream_chunk")
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/workframe-api/turn_credentials.py

@@ -157,11 +157,22 @@ def parse_lease_token(value: str) -> str:
     return ""
 
 
-def validate_lease(token: str) -> dict[str, Any] | None:
-    """Return lease metadata if token is active (not revoked/expired)."""
+def _lease_row_to_meta(row: sqlite3.Row) -> dict[str, Any]:
+    return {
+        "run_id": str(row["run_id"]),
+        "payer_user_id": str(row["payer_user_id"]),
+        "workspace_id": str(row["workspace_id"]),
+        "provider": str(row["provider"]),
+        "credential_binding_id": str(row["credential_binding_id"] or ""),
+        "profile_slug": str(row["profile_slug"]),
+    }
+
+
+def inspect_lease(token: str) -> tuple[str | None, dict[str, Any] | None]:
+    """Return (deny_reason, lease_meta). deny_reason is None when the lease is active."""
     token = parse_lease_token(token)
     if not token:
-        return None
+        return "missing_token", None
     ensure_schema()
     conn = _connect()
     try:
@@ -176,16 +187,20 @@ def validate_lease(token: str) -> dict[str, Any] | None:
         ).fetchone()
     finally:
         conn.close()
-    if not row or row["revoked_at"] or _expired(str(row["expires_at"] or "")):
-        return None
-    return {
-        "run_id": str(row["run_id"]),
-        "payer_user_id": str(row["payer_user_id"]),
-        "workspace_id": str(row["workspace_id"]),
-        "provider": str(row["provider"]),
-        "credential_binding_id": str(row["credential_binding_id"] or ""),
-        "profile_slug": str(row["profile_slug"]),
-    }
+    if not row:
+        return "not_found", None
+    meta = _lease_row_to_meta(row)
+    if row["revoked_at"]:
+        return "revoked", meta
+    if _expired(str(row["expires_at"] or "")):
+        return "expired", meta
+    return None, meta
+
+
+def validate_lease(token: str) -> dict[str, Any] | None:
+    """Return lease metadata if token is active (not revoked/expired)."""
+    deny_reason, lease = inspect_lease(token)
+    return lease if deny_reason is None else None
 
 
 def revoke_lease(run_id: str) -> None: