direxio-deployer 0.1.0

package/tests/root_volume_tracking_test.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+export HOME="$tmp/home"
+export P2P_WORKDIR="$tmp/work"
+mkdir -p "$HOME" "$P2P_WORKDIR"
+
+fakebin="$tmp/bin"
+mkdir -p "$fakebin"
+cat > "$fakebin/aws" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+case "${1:-} ${2:-}" in
+  "ec2 describe-instances")
+    printf 'vol-root-test\n'
+    ;;
+  *)
+    echo "unexpected aws command: $*" >&2
+    exit 1
+    ;;
+esac
+EOF
+chmod 700 "$fakebin/aws"
+export PATH="$fakebin:$PATH"
+
+# shellcheck disable=SC1091
+source "$ROOT/scripts/lib/state.sh"
+state_init >/dev/null 2>&1
+
+# shellcheck disable=SC1091
+source "$ROOT/scripts/phases/s3_provision.sh"
+
+_record_root_volume_id i-root-test
+
+jq -e '.resources.root_volume_id == "vol-root-test"' "$STATE_JSON" >/dev/null
+
+echo "root volume tracking ok"

package/tests/route53_overwrite_guard_test.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+export HOME="$tmp/home"
+export P2P_WORKDIR="$tmp/work"
+mkdir -p "$HOME" "$P2P_WORKDIR"
+
+fakebin="$tmp/bin"
+mkdir -p "$fakebin"
+cat > "$fakebin/aws" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+printf 'aws' >> "$CALLS"
+printf ' %q' "$@" >> "$CALLS"
+printf '\n' >> "$CALLS"
+
+case "${1:-} ${2:-}" in
+  "route53 list-hosted-zones")
+    printf '{"HostedZones":[{"Id":"/hostedzone/ZEXISTING","Name":"overwrite.example.test."}]}\n'
+    ;;
+  "route53 list-resource-record-sets")
+    printf '{"ResourceRecordSets":[{"Name":"overwrite.example.test.","Type":"A","TTL":60,"ResourceRecords":[{"Value":"198.51.100.10"}]}]}\n'
+    ;;
+  "route53 change-resource-record-sets")
+    printf '{"ChangeInfo":{"Id":"/change/C123","Status":"PENDING"}}\n'
+    ;;
+  "route53 wait")
+    exit 0
+    ;;
+  *)
+    echo "unexpected aws command: $*" >&2
+    exit 1
+    ;;
+esac
+EOF
+chmod 700 "$fakebin/aws"
+export PATH="$fakebin:$PATH"
+
+# shellcheck disable=SC1091
+source "$ROOT/scripts/lib/state.sh"
+state_init >/dev/null 2>&1
+state_set run_id route53-overwrite-test
+state_set domain overwrite.example.test
+state_set domain_mode route53
+
+# shellcheck disable=SC1091
+source "$ROOT/scripts/phases/s3_provision.sh"
+
+CALLS="$tmp/blocked.calls"
+export CALLS
+set +e
+_upsert_route53_record overwrite.example.test 203.0.113.88 > "$tmp/blocked.out" 2>&1
+blocked_rc=$?
+set -e
+[ "$blocked_rc" -eq 2 ] || {
+  echo "Route53 overwrite without confirmation should return waiting_user rc=2" >&2
+  cat "$tmp/blocked.out" >&2
+  exit 1
+}
+grep -q 'Route53 A record overwrite requires confirmation' "$tmp/blocked.out"
+if grep -q 'route53 change-resource-record-sets' "$CALLS"; then
+  echo "Route53 overwrite without confirmation must not change records" >&2
+  cat "$CALLS" >&2
+  exit 1
+fi
+jq -e '
+  .phases.S3_PROVISION.status == "waiting_user"
+  and .resources.route53_existing_a_value == "198.51.100.10"
+  and .resources.route53_pending_a_value == "203.0.113.88"
+' "$STATE_JSON" >/dev/null
+
+CALLS="$tmp/confirmed.calls"
+export CALLS
+DIREXIO_CONFIRM_DNS_OVERWRITE=1 _upsert_route53_record overwrite.example.test 203.0.113.88
+grep -q 'route53 change-resource-record-sets' "$CALLS"
+jq -e '
+  .resources.route53_existing_a_value == "198.51.100.10"
+  and .resources.route53_pending_a_value == "203.0.113.88"
+  and .resources.route53_overwrite_confirmed == "true"
+' "$STATE_JSON" >/dev/null
+
+echo "route53 overwrite guard ok"

package/tests/route53_zone_auto_create_test.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+export HOME="$tmp/home"
+export P2P_WORKDIR="$tmp/work"
+mkdir -p "$HOME" "$P2P_WORKDIR"
+
+fakebin="$tmp/bin"
+mkdir -p "$fakebin"
+cat > "$fakebin/aws" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+printf 'aws' >> "$CALLS"
+printf ' %q' "$@" >> "$CALLS"
+printf '\n' >> "$CALLS"
+
+case "${1:-} ${2:-}" in
+  "route53 list-hosted-zones")
+    printf '{"HostedZones":[]}\n'
+    ;;
+  "route53 create-hosted-zone")
+    printf '{"HostedZone":{"Id":"/hostedzone/ZCREATE","Name":"auto-zone.example.test."},"DelegationSet":{"NameServers":["ns-1.awsdns.test","ns-2.awsdns.test"]}}\n'
+    ;;
+  "route53 change-resource-record-sets")
+    printf '{"ChangeInfo":{"Id":"/change/C123","Status":"PENDING"}}\n'
+    ;;
+  "route53 wait")
+    exit 0
+    ;;
+  *)
+    echo "unexpected aws command: $*" >&2
+    exit 1
+    ;;
+esac
+EOF
+chmod 700 "$fakebin/aws"
+export CALLS="$tmp/aws.calls"
+export PATH="$fakebin:$PATH"
+
+# shellcheck disable=SC1091
+source "$ROOT/scripts/lib/state.sh"
+state_init >/dev/null 2>&1
+state_set run_id route53-test
+state_set domain auto-zone.example.test
+state_set domain_mode route53
+
+# shellcheck disable=SC1091
+source "$ROOT/scripts/phases/s3_provision.sh"
+
+_upsert_route53_record auto-zone.example.test 203.0.113.88
+
+jq -e '
+  .resources.route53_zone_id == "ZCREATE"
+  and .resources.route53_zone_name == "auto-zone.example.test"
+  and .resources.route53_zone_created_by_deployer == "true"
+  and (.resources.route53_name_servers | contains("ns-1.awsdns.test"))
+' "$STATE_JSON" >/dev/null
+
+grep -q 'route53 create-hosted-zone' "$CALLS"
+grep -q 'route53 change-resource-record-sets' "$CALLS"
+
+echo "route53 zone auto create ok"

package/tests/runtime_summary_check_test.sh

@@ -0,0 +1,203 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+tmp=$(mktemp -d "$ROOT/.tmp-runtime-summary.XXXXXX")
+trap 'rm -rf "$tmp"' EXIT
+
+export HOME="$tmp/home"
+mkdir -p "$HOME"
+
+fakebin="$tmp/bin"
+mkdir -p "$fakebin"
+
+windows_path() {
+  local path=$1 drive rest
+  case "$path" in
+    /mnt/[A-Za-z]/*)
+      drive=${path#/mnt/}
+      drive=${drive%%/*}
+      rest=${path#/mnt/$drive/}
+      printf '%s:\\%s\n' "$(printf '%s' "$drive" | tr '[:lower:]' '[:upper:]')" "$(printf '%s' "$rest" | sed 's#/#\\#g')"
+      ;;
+    /[A-Za-z]/*)
+      drive=${path#/}
+      drive=${drive%%/*}
+      rest=${path#/$drive/}
+      printf '%s:\\%s\n' "$(printf '%s' "$drive" | tr '[:lower:]' '[:upper:]')" "$(printf '%s' "$rest" | sed 's#/#\\#g')"
+      ;;
+    *) printf '%s\n' "$path" ;;
+  esac
+}
+
+cat > "$fakebin/direxio-connect" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+[ "${1:-}" = "daemon" ]
+[ "${2:-}" = "status" ]
+[ "${3:-}" = "--service-name" ]
+[ "${4:-}" = "runtime-summary.example.test" ]
+cat <<STATUS
+cc-connect daemon status
+
+  Status:    Running
+  Platform:  test
+  WorkDir:   ${CONNECT_WORK_DIR:-}
+STATUS
+EOF
+chmod 700 "$fakebin/direxio-connect"
+
+cat > "$fakebin/direxio-mcp" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+if [ "${DIREXIO_CREDENTIALS_FILE:-}" != "${EXPECTED_CREDENTIALS_FILE:-}" ]; then
+  echo "wrong DIREXIO_CREDENTIALS_FILE" >&2
+  exit 1
+fi
+
+if [ "${1:-}" = "doctor" ] && [ "${2:-}" = "--json" ]; then
+  printf '{"ok":true,"domain":"runtime-summary.example.test","agent_room_id":"!agent:runtime-summary.example.test","token":"redacted"}\n'
+  exit 0
+fi
+
+frame() {
+  local body=$1
+  printf 'Content-Length: %s\r\n\r\n%s' "${#body}" "$body"
+}
+
+frame '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{"tools":{}},"serverInfo":{"name":"fake-direxio-mcp","version":"0.0.0"}}}'
+frame '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"search_rooms"},{"name":"send_message"},{"name":"list_messages"}]}}'
+EOF
+chmod 700 "$fakebin/direxio-mcp"
+
+cat > "$tmp/fake-mcp.ps1" <<'EOF'
+if ($env:DIREXIO_CREDENTIALS_FILE -ne $env:EXPECTED_CREDENTIALS_FILE) {
+  [Console]::Error.WriteLine("wrong DIREXIO_CREDENTIALS_FILE")
+  exit 1
+}
+
+if (($args.Count -ge 2) -and ($args[0] -eq "doctor") -and ($args[1] -eq "--json")) {
+  [Console]::Out.WriteLine('{"ok":true,"domain":"runtime-summary.example.test","agent_room_id":"!agent:runtime-summary.example.test","token":"redacted"}')
+  exit 0
+}
+
+function Frame($body) {
+  [Console]::Out.Write("Content-Length: $($body.Length)`r`n`r`n$body")
+}
+
+Frame '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{"tools":{}},"serverInfo":{"name":"fake-direxio-mcp","version":"0.0.0"}}}'
+Frame '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"search_rooms"},{"name":"send_message"},{"name":"list_messages"}]}}'
+EOF
+
+mcp_command=direxio-mcp
+case "$(uname -s)" in
+  MINGW*|MSYS*|CYGWIN*) use_windows_mcp=1 ;;
+  *) use_windows_mcp=0 ;;
+esac
+if { [ "$use_windows_mcp" = "1" ] || ! command -v node >/dev/null 2>&1; } && command -v node.exe >/dev/null 2>&1; then
+  fake_mcp_ps1=$(windows_path "$tmp/fake-mcp.ps1")
+  mcp_command="powershell.exe -NoProfile -ExecutionPolicy Bypass -File \"$fake_mcp_ps1\""
+fi
+
+cat > "$fakebin/curl" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+body_path=""
+write_code=0
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    -o) body_path=$2; shift 2 ;;
+    -w) write_code=1; shift 2 ;;
+    *) shift ;;
+  esac
+done
+payload='{"room_id":"!agent:runtime-summary.example.test","messages":[]}'
+if [ -n "$body_path" ]; then
+  printf '%s\n' "$payload" > "$body_path"
+else
+  printf '%s\n' "$payload"
+fi
+[ "$write_code" -eq 1 ] && printf '200'
+EOF
+chmod 700 "$fakebin/curl"
+
+service_dir="$HOME/.direxio/nodes/runtime-summary.example.test"
+mkdir -p "$service_dir/cc-connect"
+credentials="$service_dir/credentials.json"
+config="$service_dir/cc-connect/config.toml"
+: > "$credentials"
+: > "$config"
+expected_credentials="$credentials"
+if command -v cygpath >/dev/null 2>&1; then
+  expected_credentials=$(cygpath -m "$expected_credentials")
+fi
+state="$service_dir/state.json"
+jq -n \
+  --arg service_dir "$service_dir" \
+  --arg credentials "$credentials" \
+  --arg config "$config" \
+  --arg mcp_command "$mcp_command" \
+  '{
+    run_id: "runtime-summary-test",
+    region: "ap-northeast-1",
+    domain_mode: "user",
+    domain: "runtime-summary.example.test",
+    as_url: "https://runtime-summary.example.test",
+    agent_service_id: "runtime-summary.example.test",
+    agent_service_dir: $service_dir,
+    agent_credentials_file: $credentials,
+    mcp_credentials_file: $credentials,
+    mcp_command: $mcp_command,
+    agent_token: "AGENT_TOKEN_RUNTIME",
+    agent_room_id: "!agent:runtime-summary.example.test",
+    cc_connect_config: $config,
+    cc_connect_binary: "direxio-connect",
+    phase: "S7_VERIFY_E2E",
+    phases: {
+      S0_PREREQ_AWS: {status: "done"},
+      S1_PREFLIGHT: {status: "done"},
+      S2_DOMAIN: {status: "done"},
+      S3_PROVISION: {status: "done"},
+      S4_BOOTSTRAP_STACK: {status: "done"},
+      S5_INIT_TOKENS: {status: "done"},
+      S6_WIRE_LOCAL: {status: "done"},
+      S7_VERIFY_E2E: {status: "done"}
+    },
+    resources: {}
+  }' > "$state"
+
+verify_output=$(P2P_WORKDIR="$service_dir" PATH="$fakebin:$PATH" EXPECTED_CREDENTIALS_FILE="$expected_credentials" CONNECT_WORK_DIR="$service_dir/cc-connect" bash "$ROOT/scripts/orchestrate.sh" verify runtime)
+printf '%s\n' "$verify_output" | grep -q 'verified runtime checks: passed'
+
+jq -e '
+  .runtime_checks.summary.status == "passed"
+  and .runtime_checks.summary.failed_count == 0
+  and .runtime_checks.summary.checks.connect_daemon == "passed"
+  and .runtime_checks.summary.checks.mcp_doctor == "passed"
+  and .runtime_checks.summary.checks.mcp_tools == "passed"
+  and .runtime_checks.summary.checks.mcp_smoke == "passed"
+  and (.user_confirmations.agent_mcp_runtime | not)
+' "$state" >/dev/null
+
+report_output=$(P2P_WORKDIR="$service_dir" bash "$ROOT/scripts/orchestrate.sh" report new_deploy)
+report_path=$(printf '%s\n' "$report_output" | sed -nE 's/^operation report: //p' | tail -n 1)
+jq -e '.runtime_checks.summary.status == "passed"' "$report_path" >/dev/null
+
+set +e
+P2P_WORKDIR="$service_dir" PATH="$fakebin:$PATH" EXPECTED_CREDENTIALS_FILE="$expected_credentials" CONNECT_WORK_DIR="$HOME/.direxio/nodes/other.example.test/cc-connect" bash "$ROOT/scripts/orchestrate.sh" verify runtime > "$tmp/runtime-fail.out" 2>&1
+fail_rc=$?
+set -e
+[ "$fail_rc" -ne 0 ] || {
+  echo "runtime summary must fail when any runtime check fails" >&2
+  exit 1
+}
+jq -e '
+  .runtime_checks.summary.status == "failed"
+  and .runtime_checks.summary.failed_count == 1
+  and .runtime_checks.summary.checks.connect_daemon == "failed"
+  and .runtime_checks.summary.checks.mcp_doctor == "passed"
+  and .runtime_checks.summary.checks.mcp_tools == "passed"
+  and .runtime_checks.summary.checks.mcp_smoke == "passed"
+' "$state" >/dev/null
+
+echo "runtime summary check ok"