jishushell 0.4.30 → 0.5.22

package/scripts/perf/README.md

@@ -0,0 +1,49 @@
+# Performance Baseline Tests (k6)
+
+Latency baseline scripts for core API endpoints. Run nightly in CI to detect
+performance regressions.
+
+## Prerequisites
+
+- [k6](https://grafana.com/docs/k6/latest/set-up/install-k6/) installed on the runner
+- JishuShell server running (the CI job starts one automatically)
+
+## Scripts
+
+| Script | Endpoints covered |
+|--------|-------------------|
+| `auth.js` | `/api/auth/status`, `/api/auth/login`, `/api/auth/logout` |
+| `proxy.js` | `/proxy/v1/models`, `/api/llm/providers` |
+| `instances.js` | `/api/instances` CRUD lifecycle |
+
+## Environment Variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `BASE_URL` | `http://127.0.0.1:8090` | Server base URL |
+| `PASSWORD` | `perf-test-password-2026` | Admin password |
+| `SMOKE` | `false` | Set to `true` for quick 10s validation |
+
+## Usage
+
+```bash
+# Smoke test (quick validation)
+k6 run -e SMOKE=true scripts/perf/auth.js
+
+# Full baseline run
+k6 run scripts/perf/auth.js
+
+# All scripts with custom base URL
+for script in scripts/perf/auth.js scripts/perf/proxy.js scripts/perf/instances.js; do
+  k6 run -e BASE_URL=http://localhost:9090 "$script"
+done
+```
+
+## Thresholds
+
+Default thresholds (see `config.js`):
+- **p(95) < 500ms** for general endpoints
+- **p(99) < 1000ms** tail latency
+- **Error rate < 1%**
+
+Per-endpoint overrides are defined in each script's `options.thresholds`.

package/scripts/perf/auth.js

@@ -0,0 +1,99 @@
+import http from "k6/http";
+import { check, group, sleep } from "k6";
+import {
+  BASE_URL,
+  PASSWORD,
+  DEFAULT_THRESHOLDS,
+  DEFAULT_STAGES,
+  SMOKE_STAGES,
+  authHeaders,
+} from "./config.js";
+
+const isSmoke = __ENV.SMOKE === "true";
+
+export const options = {
+  stages: isSmoke ? SMOKE_STAGES : DEFAULT_STAGES,
+  thresholds: {
+    ...DEFAULT_THRESHOLDS,
+    "http_req_duration{name:login}": ["p(95)<300"],
+    "http_req_duration{name:auth_status}": ["p(95)<100"],
+  },
+  tags: { suite: "auth" },
+};
+
+/**
+ * Setup: initialize password and obtain a baseline token.
+ * Runs once before VUs start.
+ */
+export function setup() {
+  // Check if already initialized
+  const statusRes = http.get(`${BASE_URL}/api/auth/status`);
+  const initialized = statusRes.json("initialized");
+
+  let token;
+  if (!initialized) {
+    const initRes = http.post(
+      `${BASE_URL}/api/auth/init`,
+      JSON.stringify({ password: PASSWORD }),
+      { headers: { "Content-Type": "application/json" } },
+    );
+    check(initRes, { "init 200": (r) => r.status === 200 });
+    token = initRes.json("token");
+  } else {
+    const loginRes = http.post(
+      `${BASE_URL}/api/auth/login`,
+      JSON.stringify({ password: PASSWORD }),
+      { headers: { "Content-Type": "application/json" } },
+    );
+    check(loginRes, { "login 200": (r) => r.status === 200 });
+    token = loginRes.json("token");
+  }
+
+  if (!token) {
+    throw new Error("Failed to obtain auth token during setup");
+  }
+  return { token };
+}
+
+export default function (data) {
+  group("auth-status", () => {
+    const res = http.get(`${BASE_URL}/api/auth/status`, {
+      tags: { name: "auth_status" },
+    });
+    check(res, {
+      "status 200": (r) => r.status === 200,
+      "has initialized field": (r) => r.json("initialized") !== undefined,
+    });
+  });
+
+  sleep(0.5);
+
+  group("login", () => {
+    const res = http.post(
+      `${BASE_URL}/api/auth/login`,
+      JSON.stringify({ password: PASSWORD }),
+      {
+        headers: { "Content-Type": "application/json" },
+        tags: { name: "login" },
+      },
+    );
+    check(res, {
+      "login 200": (r) => r.status === 200,
+      "returns token": (r) => r.json("token") !== undefined,
+    });
+  });
+
+  sleep(0.5);
+
+  group("logout", () => {
+    const res = http.post(`${BASE_URL}/api/auth/logout`, null, {
+      headers: authHeaders(data.token),
+      tags: { name: "logout" },
+    });
+    check(res, {
+      "logout 200": (r) => r.status === 200,
+    });
+  });
+
+  sleep(1);
+}

package/scripts/perf/config.js

@@ -0,0 +1,63 @@
+/**
+ * Shared configuration and helpers for k6 performance tests.
+ *
+ * Environment variables:
+ *   BASE_URL  — server base URL (default: http://127.0.0.1:8090)
+ *   PASSWORD  — admin password for auth (default: perf-test-password-2026)
+ */
+
+export const BASE_URL = __ENV.BASE_URL || "http://127.0.0.1:8090";
+export const PASSWORD = __ENV.PASSWORD || "perf-test-password-2026";
+
+/**
+ * Standard k6 thresholds for API endpoints.
+ * - p(95) < 500ms: acceptable for most CRUD ops
+ * - p(99) < 1000ms: tail latency budget
+ * - error rate < 1%
+ */
+export const DEFAULT_THRESHOLDS = {
+  http_req_duration: ["p(95)<500", "p(99)<1000"],
+  http_req_failed: ["rate<0.01"],
+};
+
+/**
+ * Standard load profile for baseline tests.
+ * Ramp up to 10 VUs over 30s, hold for 2m, ramp down.
+ */
+export const DEFAULT_STAGES = [
+  { duration: "30s", target: 10 },
+  { duration: "2m", target: 10 },
+  { duration: "10s", target: 0 },
+];
+
+/**
+ * Smoke profile for quick validation (CI gate).
+ * 1 VU for 10s — just verify the script works.
+ */
+export const SMOKE_STAGES = [
+  { duration: "10s", target: 1 },
+];
+
+/**
+ * Build standard headers with auth cookie.
+ * @param {string} token - JWT token from login/init
+ * @returns {object} headers object for k6 http calls
+ */
+export function authHeaders(token) {
+  return {
+    "Content-Type": "application/json",
+    Cookie: `jishushell_session=${token}`,
+  };
+}
+
+/**
+ * Build standard headers with Bearer token (for proxy routes).
+ * @param {string} token - JWT token
+ * @returns {object} headers object for k6 http calls
+ */
+export function bearerHeaders(token) {
+  return {
+    "Content-Type": "application/json",
+    Authorization: `Bearer ${token}`,
+  };
+}

package/scripts/perf/instances.js

@@ -0,0 +1,143 @@
+import http from "k6/http";
+import { check, group, sleep } from "k6";
+import {
+  BASE_URL,
+  PASSWORD,
+  DEFAULT_THRESHOLDS,
+  DEFAULT_STAGES,
+  SMOKE_STAGES,
+  authHeaders,
+} from "./config.js";
+
+const isSmoke = __ENV.SMOKE === "true";
+
+export const options = {
+  stages: isSmoke ? SMOKE_STAGES : DEFAULT_STAGES,
+  thresholds: {
+    ...DEFAULT_THRESHOLDS,
+    "http_req_duration{name:list_instances}": ["p(95)<300"],
+    "http_req_duration{name:create_instance}": ["p(95)<1000"],
+    "http_req_duration{name:get_instance}": ["p(95)<300"],
+    "http_req_duration{name:delete_instance}": ["p(95)<1000"],
+  },
+  tags: { suite: "instances" },
+};
+
+/**
+ * Setup: obtain auth token.
+ */
+export function setup() {
+  const statusRes = http.get(`${BASE_URL}/api/auth/status`);
+  const initialized = statusRes.json("initialized");
+
+  let token;
+  if (!initialized) {
+    const initRes = http.post(
+      `${BASE_URL}/api/auth/init`,
+      JSON.stringify({ password: PASSWORD }),
+      { headers: { "Content-Type": "application/json" } },
+    );
+    token = initRes.json("token");
+  } else {
+    const loginRes = http.post(
+      `${BASE_URL}/api/auth/login`,
+      JSON.stringify({ password: PASSWORD }),
+      { headers: { "Content-Type": "application/json" } },
+    );
+    token = loginRes.json("token");
+  }
+
+  if (!token) {
+    throw new Error("Failed to obtain auth token during setup");
+  }
+  return { token };
+}
+
+export default function (data) {
+  const headers = authHeaders(data.token);
+  const instanceId = `perf-${__VU}-${__ITER}`;
+
+  group("list-instances", () => {
+    const res = http.get(`${BASE_URL}/api/instances`, {
+      headers,
+      tags: { name: "list_instances" },
+    });
+    check(res, {
+      "list 200": (r) => r.status === 200,
+      "returns array": (r) => {
+        try {
+          return Array.isArray(r.json());
+        } catch {
+          return false;
+        }
+      },
+    });
+  });
+
+  sleep(0.3);
+
+  group("create-instance", () => {
+    const payload = JSON.stringify({
+      id: instanceId,
+      name: `Perf Test ${instanceId}`,
+      description: "Created by k6 performance test",
+      agentType: "openclaw",
+    });
+    const res = http.post(`${BASE_URL}/api/instances`, payload, {
+      headers,
+      tags: { name: "create_instance" },
+    });
+    check(res, {
+      "create 200/201": (r) => r.status === 200 || r.status === 201,
+    });
+  });
+
+  sleep(0.3);
+
+  group("get-instance", () => {
+    const res = http.get(`${BASE_URL}/api/instances/${instanceId}`, {
+      headers,
+      tags: { name: "get_instance" },
+    });
+    check(res, {
+      "get 200": (r) => r.status === 200,
+      "has id": (r) => {
+        try {
+          return r.json("id") === instanceId;
+        } catch {
+          return false;
+        }
+      },
+    });
+  });
+
+  sleep(0.3);
+
+  group("update-instance", () => {
+    const payload = JSON.stringify({
+      name: `Updated ${instanceId}`,
+      description: "Updated by k6 performance test",
+    });
+    const res = http.put(`${BASE_URL}/api/instances/${instanceId}`, payload, {
+      headers,
+      tags: { name: "update_instance" },
+    });
+    check(res, {
+      "update 200": (r) => r.status === 200,
+    });
+  });
+
+  sleep(0.3);
+
+  group("delete-instance", () => {
+    const res = http.del(`${BASE_URL}/api/instances/${instanceId}`, null, {
+      headers,
+      tags: { name: "delete_instance" },
+    });
+    check(res, {
+      "delete 200": (r) => r.status === 200,
+    });
+  });
+
+  sleep(1);
+}

package/scripts/perf/proxy.js

@@ -0,0 +1,96 @@
+import http from "k6/http";
+import { check, group, sleep } from "k6";
+import {
+  BASE_URL,
+  PASSWORD,
+  DEFAULT_THRESHOLDS,
+  DEFAULT_STAGES,
+  SMOKE_STAGES,
+  bearerHeaders,
+} from "./config.js";
+
+const isSmoke = __ENV.SMOKE === "true";
+
+export const options = {
+  stages: isSmoke ? SMOKE_STAGES : DEFAULT_STAGES,
+  thresholds: {
+    ...DEFAULT_THRESHOLDS,
+    "http_req_duration{name:list_models}": ["p(95)<300"],
+  },
+  tags: { suite: "proxy" },
+};
+
+/**
+ * Setup: obtain auth token for proxy requests.
+ */
+export function setup() {
+  const statusRes = http.get(`${BASE_URL}/api/auth/status`);
+  const initialized = statusRes.json("initialized");
+
+  let token;
+  if (!initialized) {
+    const initRes = http.post(
+      `${BASE_URL}/api/auth/init`,
+      JSON.stringify({ password: PASSWORD }),
+      { headers: { "Content-Type": "application/json" } },
+    );
+    token = initRes.json("token");
+  } else {
+    const loginRes = http.post(
+      `${BASE_URL}/api/auth/login`,
+      JSON.stringify({ password: PASSWORD }),
+      { headers: { "Content-Type": "application/json" } },
+    );
+    token = loginRes.json("token");
+  }
+
+  if (!token) {
+    throw new Error("Failed to obtain auth token during setup");
+  }
+  return { token };
+}
+
+export default function (data) {
+  const headers = bearerHeaders(data.token);
+
+  group("list-models", () => {
+    const res = http.get(`${BASE_URL}/proxy/v1/models`, {
+      headers,
+      tags: { name: "list_models" },
+    });
+    check(res, {
+      "models 200": (r) => r.status === 200,
+      "has data array": (r) => {
+        try {
+          return Array.isArray(r.json("data"));
+        } catch {
+          return false;
+        }
+      },
+    });
+  });
+
+  sleep(0.5);
+
+  group("list-providers", () => {
+    const res = http.get(`${BASE_URL}/api/llm/providers`, {
+      headers: {
+        "Content-Type": "application/json",
+        Cookie: `jishushell_session=${data.token}`,
+      },
+      tags: { name: "list_providers" },
+    });
+    check(res, {
+      "providers 200": (r) => r.status === 200,
+      "returns array": (r) => {
+        try {
+          return Array.isArray(r.json());
+        } catch {
+          return false;
+        }
+      },
+    });
+  });
+
+  sleep(1);
+}

package/scripts/smoke/files-w1.sh

@@ -0,0 +1,142 @@
+#!/bin/bash
+#
+# End-to-end smoke for Files M1 W1 (PR-4).
+#
+# Drives the eight /api/files endpoints against a running jishushell panel:
+#   1. GET  /api/files                  (list root)
+#   2. PUT  /api/files?path=...         (upload, octet-stream)
+#   3. GET  /api/files?path=...         (list subdirectory)
+#   4. POST /api/files/mkdir            (create directory)
+#   5. POST /api/files/move             (move/rename)
+#   6. GET  /api/files/raw?path=...     (stream download, sha verified)
+#   7. GET  /api/files/preview?path=... (text preview, truncation)
+#   8. GET  /api/files/quota            (quota info)
+#   9. DELETE /api/files?path=...       (soft-delete)
+#  10. PUT with Content-Type: text/plain → expect 415
+#  11. PUT with path traversal           → expect 400
+#
+# Usage:
+#   # Either provide a token directly:
+#   JISHUSHELL_URL=http://pi2:8090 JISHUSHELL_TOKEN=... ./scripts/smoke/files-w1.sh
+#   # Or let the script log in for you:
+#   JISHUSHELL_URL=http://pi2:8090 JISHUSHELL_PASSWORD=... ./scripts/smoke/files-w1.sh
+#
+# Per docs/feedback_validate_before_commit.md, this script MUST run on a real
+# Pi2 box before the Files W1 work is considered complete.
+
+set -eo pipefail
+
+PANEL_URL="${JISHUSHELL_URL:-http://127.0.0.1:8090}"
+AUTH_TOKEN="${JISHUSHELL_TOKEN:-}"
+PANEL_PASSWORD="${JISHUSHELL_PASSWORD:-}"
+PREFIX="${PREFIX:-smoke-w1}"
+
+if [[ -z "$AUTH_TOKEN" && -z "$PANEL_PASSWORD" ]]; then
+  echo "ERROR: set JISHUSHELL_TOKEN or JISHUSHELL_PASSWORD env var" >&2
+  exit 1
+fi
+
+if [[ -z "$AUTH_TOKEN" ]]; then
+  echo "[auth] logging in as admin"
+  AUTH_TOKEN=$(curl -sS -X POST -H "Content-Type: application/json" \
+    -d "{\"password\":\"$PANEL_PASSWORD\"}" \
+    "$PANEL_URL/api/auth/login" | sed -n 's/.*"token":"\([^"]*\)".*/\1/p')
+  if [[ -z "$AUTH_TOKEN" ]]; then
+    echo "ERROR: login failed" >&2
+    exit 1
+  fi
+  echo "  ok: got JWT (${#AUTH_TOKEN} chars)"
+fi
+
+H_AUTH=(-H "Authorization: Bearer $AUTH_TOKEN")
+fail() { echo "FAIL: $*" >&2; exit 1; }
+pass() { echo "  ok: $*"; }
+
+# Cleanup any leftovers from a previous run (best-effort)
+curl -s -X DELETE "$PANEL_URL/api/files?path=$PREFIX/x.txt" "${H_AUTH[@]}" >/dev/null || true
+curl -s -X DELETE "$PANEL_URL/api/files?path=$PREFIX/y.txt" "${H_AUTH[@]}" >/dev/null || true
+curl -s -X DELETE "$PANEL_URL/api/files?path=$PREFIX/sub" "${H_AUTH[@]}" >/dev/null || true
+curl -s -X DELETE "$PANEL_URL/api/files?path=$PREFIX" "${H_AUTH[@]}" >/dev/null || true
+
+echo "[1/11] List root"
+RESP=$(curl -sS "${H_AUTH[@]}" "$PANEL_URL/api/files")
+echo "$RESP" | grep -q '"entries"' || fail "list root missing entries: $RESP"
+pass "list root ok"
+
+echo "[2/11] mkdir $PREFIX"
+RESP=$(curl -sS -X POST "${H_AUTH[@]}" -H "Content-Type: application/json" \
+  -d "{\"path\":\"$PREFIX\"}" "$PANEL_URL/api/files/mkdir")
+echo "$RESP" | grep -q "\"$PREFIX\"" || fail "mkdir failed: $RESP"
+pass "mkdir $PREFIX"
+
+echo "[3/11] PUT octet-stream upload"
+echo -n "hello smoke" > /tmp/files-smoke-w1.bin
+RESP=$(curl -sS -X PUT "${H_AUTH[@]}" \
+  -H "Content-Type: application/octet-stream" \
+  --data-binary @/tmp/files-smoke-w1.bin \
+  "$PANEL_URL/api/files?path=$PREFIX/x.txt")
+echo "$RESP" | grep -q '"size":11' || fail "upload size wrong: $RESP"
+ETAG=$(echo "$RESP" | sed -n 's/.*"etag":"\([^"]*\)".*/\1/p')
+[[ -n "$ETAG" ]] || fail "upload returned no etag: $RESP"
+pass "uploaded $PREFIX/x.txt (etag=$ETAG)"
+
+echo "[4/11] PUT with wrong Content-Type expects 415"
+CODE=$(curl -sS -o /dev/null -w "%{http_code}" -X PUT "${H_AUTH[@]}" \
+  -H "Content-Type: text/plain" --data "x" \
+  "$PANEL_URL/api/files?path=$PREFIX/y.txt")
+[[ "$CODE" == "415" ]] || fail "expected 415, got $CODE"
+pass "wrong content-type → 415"
+
+echo "[5/11] PUT path traversal expects 400"
+CODE=$(curl -sS -o /dev/null -w "%{http_code}" -X PUT "${H_AUTH[@]}" \
+  -H "Content-Type: application/octet-stream" --data "x" \
+  "$PANEL_URL/api/files?path=../../../etc/passwd")
+[[ "$CODE" == "400" ]] || fail "expected 400, got $CODE"
+pass "path traversal → 400"
+
+echo "[6/11] List $PREFIX"
+RESP=$(curl -sS "${H_AUTH[@]}" "$PANEL_URL/api/files?path=$PREFIX")
+echo "$RESP" | grep -q '"x.txt"' || fail "missing x.txt in list: $RESP"
+pass "subdirectory listing ok"
+
+echo "[7/11] Move x.txt → sub/x.txt"
+curl -sS -X POST "${H_AUTH[@]}" -H "Content-Type: application/json" \
+  -d "{\"path\":\"$PREFIX/sub\"}" "$PANEL_URL/api/files/mkdir" >/dev/null
+RESP=$(curl -sS -X POST "${H_AUTH[@]}" -H "Content-Type: application/json" \
+  -d "{\"from\":\"$PREFIX/x.txt\",\"to\":\"$PREFIX/sub/x.txt\"}" \
+  "$PANEL_URL/api/files/move")
+echo "$RESP" | grep -q '"to":' || fail "move response missing 'to': $RESP"
+pass "move ok"
+
+echo "[8/11] GET /raw streams content"
+GOT=$(curl -sS "${H_AUTH[@]}" "$PANEL_URL/api/files/raw?path=$PREFIX/sub/x.txt")
+[[ "$GOT" == "hello smoke" ]] || fail "raw content mismatch: '$GOT'"
+pass "raw download verified"
+
+echo "[9/11] GET /preview truncates"
+RESP=$(curl -sS "${H_AUTH[@]}" "$PANEL_URL/api/files/preview?path=$PREFIX/sub/x.txt&max_kb=1")
+echo "$RESP" | grep -q '"truncated":false' || fail "preview missing truncated:false: $RESP"
+echo "$RESP" | grep -q '"content":"hello smoke"' || fail "preview content mismatch: $RESP"
+pass "preview ok"
+
+echo "[10/11] GET /quota"
+RESP=$(curl -sS "${H_AUTH[@]}" "$PANEL_URL/api/files/quota")
+echo "$RESP" | grep -q '"quota_mb"' || fail "quota response missing quota_mb: $RESP"
+pass "quota ok"
+
+echo "[11/11] DELETE soft-deletes to .trash/"
+CODE=$(curl -sS -o /dev/null -w "%{http_code}" -X DELETE "${H_AUTH[@]}" \
+  "$PANEL_URL/api/files?path=$PREFIX/sub/x.txt")
+[[ "$CODE" == "204" ]] || fail "expected 204, got $CODE"
+# Confirm by listing — file should be gone from sub/
+RESP=$(curl -sS "${H_AUTH[@]}" "$PANEL_URL/api/files?path=$PREFIX/sub")
+echo "$RESP" | grep -q '"x.txt"' && fail "x.txt still in sub/ after delete"
+pass "soft-delete ok"
+
+# Final cleanup
+curl -s -X DELETE "$PANEL_URL/api/files?path=$PREFIX/sub" "${H_AUTH[@]}" >/dev/null || true
+curl -s -X DELETE "$PANEL_URL/api/files?path=$PREFIX" "${H_AUTH[@]}" >/dev/null || true
+rm -f /tmp/files-smoke-w1.bin
+
+echo ""
+echo "✓ All 11 smoke checks passed against $PANEL_URL"