okengine 0.5.1 → 0.6.1

package/src/docker/stack.integration.test.ts

@@ -1,5 +1,7 @@
 /**
  * Integration: generated compose brings up postgres; app URL talks to it.
+ *
+ * Opt-in via `OKE_TEST_DOCKER=1` plus a live Docker daemon. Never an empty pass.
  */
 
 import { describe, expect, test } from "bun:test";
@@ -8,127 +10,141 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { deriveInfrastructure, formatStackEnv, writeDerivedFiles } from "./index.ts";
 
-async function dockerAvailable(): Promise<boolean> {
+function dockerAvailable(): boolean {
   try {
-    const proc = Bun.spawn(["docker", "info"], {
-      stdout: "pipe",
-      stderr: "pipe",
-    });
-    return (await proc.exited) === 0;
+    return Bun.spawnSync(["docker", "info"], { stdout: "pipe", stderr: "pipe" }).exitCode === 0;
   } catch {
     return false;
   }
 }
 
-describe("oke dev --docker postgres integration", () => {
-  test("compose brings up postgres and the app talks to it", async () => {
-    if (!(await dockerAvailable())) {
-      console.warn("skipping: docker daemon not available");
-      return;
-    }
-
-    const dir = await mkdtemp(join(tmpdir(), "oke-stack-pg-"));
-    const dockerDir = join(dir, "docker");
-    const project = `oke-pg-${Date.now()}`;
-    try {
-      const derived = deriveInfrastructure({
-        images: { "store.sql": "postgres:18-alpine" },
-        credentials: {
-          "store.sql": {
-            user: "oke",
-            password: "stack-integration-pass",
-            database: "oke",
-          },
-        },
-        app: "stacktest",
-        host: "127.0.0.1",
-        includeApp: false,
-        composeDir: "docker",
-      });
-      await writeDerivedFiles(derived, dockerDir, {
-        writeStackEnv: true,
-      });
+const WANT = process.env.OKE_TEST_DOCKER === "1";
+const DOCKER = WANT && dockerAvailable();
+if (!DOCKER) {
+  console.log(
+    WANT
+      ? "skip: docker postgres stack e2e (docker daemon not available)"
+      : "skip: docker postgres stack e2e (OKE_TEST_DOCKER≠1)",
+  );
+}
+const live = DOCKER ? test : test.skip;
 
-      // Infra-only: network + role compose (no app build).
-      const composeFiles = ["compose.yml", "compose.store.sql.yml"];
-      const up = Bun.spawn(
-        ["docker", "compose", "-p", project, ...composeFiles.flatMap((f) => ["-f", f]), "up", "-d"],
-        {
-          cwd: dockerDir,
-          stdout: "pipe",
-          stderr: "pipe",
-          env: {
-            ...process.env,
-            ...derived.stackEnv,
+describe("oke dev --docker postgres integration", () => {
+  live(
+    "compose brings up postgres and the app talks to it",
+    async () => {
+      const dir = await mkdtemp(join(tmpdir(), "oke-stack-pg-"));
+      const dockerDir = join(dir, "docker");
+      const project = `oke-pg-${Date.now()}`;
+      try {
+        const derived = deriveInfrastructure({
+          images: { "store.sql": "postgres:18-alpine" },
+          credentials: {
+            "store.sql": {
+              user: "oke",
+              password: "stack-integration-pass",
+              database: "oke",
+            },
           },
-        },
-      );
-      const [upOut, upErr, upCode] = await Promise.all([
-        new Response(up.stdout).text(),
-        new Response(up.stderr).text(),
-        up.exited,
-      ]);
-      expect(upCode).toBe(0);
-      if (upCode !== 0) console.error(upOut, upErr);
+          app: "stacktest",
+          host: "127.0.0.1",
+          includeApp: false,
+          composeDir: "docker",
+        });
+        await writeDerivedFiles(derived, dockerDir, {
+          writeStackEnv: true,
+        });
 
-      // Wait for healthy
-      let healthy = false;
-      for (let i = 0; i < 40; i++) {
-        const ps = Bun.spawn(
+        // Infra-only: network + role compose (no app build).
+        const composeFiles = ["compose.yml", "compose.store.sql.yml"];
+        const up = Bun.spawn(
           [
             "docker",
             "compose",
             "-p",
             project,
             ...composeFiles.flatMap((f) => ["-f", f]),
-            "ps",
-            "--format",
-            "json",
+            "up",
+            "-d",
           ],
-          { cwd: dockerDir, stdout: "pipe", stderr: "pipe" },
+          {
+            cwd: dockerDir,
+            stdout: "pipe",
+            stderr: "pipe",
+            env: {
+              ...process.env,
+              ...derived.stackEnv,
+            },
+          },
         );
-        const text = await new Response(ps.stdout).text();
-        await ps.exited;
-        if (/healthy/i.test(text)) {
-          healthy = true;
-          break;
+        const [upOut, upErr, upCode] = await Promise.all([
+          new Response(up.stdout).text(),
+          new Response(up.stderr).text(),
+          up.exited,
+        ]);
+        expect(upCode).toBe(0);
+        if (upCode !== 0) console.error(upOut, upErr);
+
+        // Wait for healthy
+        let healthy = false;
+        for (let i = 0; i < 40; i++) {
+          const ps = Bun.spawn(
+            [
+              "docker",
+              "compose",
+              "-p",
+              project,
+              ...composeFiles.flatMap((f) => ["-f", f]),
+              "ps",
+              "--format",
+              "json",
+            ],
+            { cwd: dockerDir, stdout: "pipe", stderr: "pipe" },
+          );
+          const text = await new Response(ps.stdout).text();
+          await ps.exited;
+          if (/healthy/i.test(text)) {
+            healthy = true;
+            break;
+          }
+          await Bun.sleep(500);
         }
-        await Bun.sleep(500);
-      }
-      expect(healthy).toBe(true);
+        expect(healthy).toBe(true);
 
-      const url = derived.stackEnv.DATABASE_URL!;
-      // App talks to postgres via recipe URL (Bun.SQL) — kernel never sees env-var names.
-      const sql = new Bun.SQL(url);
-      try {
-        const rows = (await sql`select 1::int as n`) as Array<{ n: number }>;
-        expect(rows[0]?.n).toBe(1);
+        const url = derived.stackEnv.DATABASE_URL!;
+        // App talks to postgres via recipe URL (Bun.SQL) — kernel never sees env-var names.
+        const sql = new Bun.SQL(url);
+        try {
+          const rows = (await sql`select 1::int as n`) as Array<{ n: number }>;
+          expect(rows[0]?.n).toBe(1);
+        } finally {
+          await sql.close();
+        }
+
+        // Prove credentials live in docker/.env.docker, not YAML.
+        const yml = await Bun.file(join(dockerDir, "compose.store.sql.yml")).text();
+        expect(yml).not.toContain("stack-integration-pass");
+        expect(formatStackEnv(derived.stackEnv)).toContain("stack-integration-pass");
+        expect(await Bun.file(join(dockerDir, ".env.docker")).exists()).toBe(true);
       } finally {
-        await sql.close();
+        await Bun.spawn(
+          [
+            "docker",
+            "compose",
+            "-p",
+            project,
+            "-f",
+            "compose.yml",
+            "-f",
+            "compose.store.sql.yml",
+            "down",
+            "-v",
+          ],
+          { cwd: dockerDir, stdout: "pipe", stderr: "pipe" },
+        ).exited.catch(() => {});
+        await rm(dir, { recursive: true, force: true }).catch(() => {});
       }
-
-      // Prove credentials live in docker/.env.docker, not YAML.
-      const yml = await Bun.file(join(dockerDir, "compose.store.sql.yml")).text();
-      expect(yml).not.toContain("stack-integration-pass");
-      expect(formatStackEnv(derived.stackEnv)).toContain("stack-integration-pass");
-      expect(await Bun.file(join(dockerDir, ".env.docker")).exists()).toBe(true);
-    } finally {
-      await Bun.spawn(
-        [
-          "docker",
-          "compose",
-          "-p",
-          project,
-          "-f",
-          "compose.yml",
-          "-f",
-          "compose.store.sql.yml",
-          "down",
-          "-v",
-        ],
-        { cwd: dockerDir, stdout: "pipe", stderr: "pipe" },
-      ).exited.catch(() => {});
-      await rm(dir, { recursive: true, force: true }).catch(() => {});
-    }
-  }, 120_000);
+    },
+    120_000,
+  );
 });

package/src/drivers/ai-mock.ts

@@ -12,8 +12,16 @@ import type {
   AiEmbedResult,
   AiModelClient,
   AiOpenOptions,
+  AiStreamChunk,
+  AiToolCall,
 } from "./ai-types.ts";
 
+/** Scripted mock tool-call turn (optional). */
+export type MockToolCallScript = {
+  readonly toolCalls: readonly AiToolCall[];
+  readonly text?: string;
+};
+
 /**
  * Create a mock AI driver.
  */
@@ -27,6 +35,11 @@ export const mockAiDriver: AiDriver = {
       driverId: "mock",
       model,
       async complete(opts: AiCompleteOptions): Promise<AiCompleteResult> {
+        if (opts.signal?.aborted) {
+          const err = new Error("This operation was aborted");
+          err.name = "AbortError";
+          throw err;
+        }
         const last = opts.messages[opts.messages.length - 1]?.content ?? "";
         let payload: unknown | undefined;
         for (const [key, value] of Object.entries(canned)) {
@@ -39,6 +52,26 @@ export const mockAiDriver: AiDriver = {
         if (payload === undefined) {
           payload = canned["*"] ?? { ok: true, echo: last };
         }
+
+        // Scripted tool calls: `{ __toolCalls: [...] }` or MockToolCallScript shape
+        if (
+          payload &&
+          typeof payload === "object" &&
+          payload !== null &&
+          "__toolCalls" in payload
+        ) {
+          const script = payload as { __toolCalls: readonly AiToolCall[]; text?: string };
+          const text = script.text ?? "";
+          return {
+            text,
+            raw: payload,
+            model: opts.model ?? model,
+            driverId: "mock",
+            toolCalls: script.__toolCalls,
+            usage: { inputTokens: last.length, outputTokens: text.length, cost: 0 },
+          };
+        }
+
         const text = typeof payload === "string" ? payload : JSON.stringify(payload);
         return {
           text,
@@ -48,6 +81,33 @@ export const mockAiDriver: AiDriver = {
           usage: { inputTokens: last.length, outputTokens: text.length, cost: 0 },
         };
       },
+      async *stream(opts: AiCompleteOptions): AsyncIterable<AiStreamChunk> {
+        if (opts.signal?.aborted) {
+          const err = new Error("This operation was aborted");
+          err.name = "AbortError";
+          throw err;
+        }
+        const last = opts.messages[opts.messages.length - 1]?.content ?? "";
+        let payload: unknown = canned["*"] ?? last;
+        for (const [key, value] of Object.entries(canned)) {
+          if (key === "*") continue;
+          if (last.includes(key) || opts.model === key) {
+            payload = value;
+            break;
+          }
+        }
+        const text = typeof payload === "string" ? payload : JSON.stringify(payload);
+        const size = Math.max(1, Math.ceil(text.length / 3));
+        for (let i = 0; i < text.length; i += size) {
+          if (opts.signal?.aborted) {
+            const err = new Error("This operation was aborted");
+            err.name = "AbortError";
+            throw err;
+          }
+          yield { text: text.slice(i, i + size) };
+        }
+        yield { text: "", done: true };
+      },
       async embed(opts: AiEmbedOptions): Promise<AiEmbedResult> {
         const inputs = Array.isArray(opts.input) ? opts.input : [opts.input];
         const vectors = inputs.map((text) => {

package/src/drivers/ai-ollama-tools.integration.test.ts

@@ -0,0 +1,109 @@
+/**
+ * Live Ollama tool-calling through fx.ask → fx.call (capability + ledger).
+ *
+ * Opt-in via `OKE_TEST_OLLAMA_URL` (reachable Ollama). A local daemon on
+ * :11434 is not enough — set the URL explicitly. Never an empty pass.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { memoryKvDriver } from "./index.ts";
+import { ai, aiRateGate, createAiRuntime } from "../elements/ai.ts";
+import { createGateRuntime, gate } from "../elements/gate.ts";
+import { createFxContext } from "../kernel/fx.ts";
+import { OLLAMA_DEFAULT_MODEL, openOllama } from "./ai-ollama.ts";
+
+const ENV_URL = process.env.OKE_TEST_OLLAMA_URL?.trim();
+
+async function probeOllama(url: string): Promise<boolean> {
+  try {
+    const res = await fetch(`${url}/api/tags`, { signal: AbortSignal.timeout(1_500) });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+
+const reachable = ENV_URL ? await probeOllama(ENV_URL) : false;
+const canLive = Boolean(ENV_URL) && reachable;
+
+if (!canLive) {
+  console.log(
+    ENV_URL
+      ? `skip: live ollama tool-calling e2e (unreachable at ${ENV_URL})`
+      : "skip: live ollama tool-calling e2e (OKE_TEST_OLLAMA_URL not set)",
+  );
+}
+const live = canLive ? test : test.skip;
+
+describe("ollama live — tool-calling via fx.call", () => {
+  live(
+    "gated ask → real tool call → capability ledger portal entry",
+    async () => {
+      const url = ENV_URL!;
+      const model = process.env.OKE_AI_MODEL?.trim() || OLLAMA_DEFAULT_MODEL;
+
+      const kv = await memoryKvDriver.open({ name: "ollama-tools-rate" });
+      const askRate = aiRateGate("ask");
+      const gates = createGateRuntime({
+        gates: [gate.public, askRate],
+        kv,
+        now: () => Date.now(),
+      });
+
+      // Simulate HTTP beforeHandle rate gate (AI ask preset).
+      const allowed = await gates.allow([askRate.name], {
+        auth: { userId: "user-1", scopes: new Set() },
+        operator: { id: null },
+      });
+      expect(allowed).toBe(true);
+
+      const client = await openOllama({ baseUrl: url, model });
+      const smart = ai.model("smart", { provider: "ollama", model });
+      const prompt = smart.prompt("tool-host");
+      const runtime = createAiRuntime({
+        models: [smart],
+        prompts: [prompt],
+        clients: { smart: client },
+        forceJournal: false,
+      });
+
+      const toolInvocations: Array<{ name: string; input: unknown }> = [];
+      const { fx, ledger } = createFxContext({
+        flow: "assistant.chat",
+        effects: {
+          asks: ["tool-host"],
+          calls: ["lookup.echo"],
+        },
+        aiRuntime: runtime,
+        callHandler: async (name, input) => {
+          toolInvocations.push({ name, input });
+          return { ok: true, echoed: input };
+        },
+      });
+
+      await fx.ask(
+        prompt,
+        [
+          "You are a tool-using assistant.",
+          'You MUST call the function lookup.echo with arguments {"text":"pong"}.',
+          "Do not answer in plain text until after the tool has been called.",
+        ].join(" "),
+        { tools: ["lookup.echo"], maxSteps: 4 },
+      );
+
+      expect(toolInvocations.length).toBeGreaterThan(0);
+      expect(toolInvocations.some((c) => c.name === "lookup.echo")).toBe(true);
+      expect(ledger.entries.some((e) => e.kind === "ask" && e.resource === "tool-host")).toBe(true);
+      expect(
+        ledger.entries.some(
+          (e) => e.kind === "call" && e.resource === "lookup.echo" && e.reversibility === "portal",
+        ),
+      ).toBe(true);
+
+      await kv.close();
+    },
+    // Match ai-ollama.integration.test.ts — cold model load on a 6GB+ pull
+    // can exceed a short CI wall clock even when the hot path is ~7s.
+    25 * 60_000,
+  );
+});

package/src/drivers/ai-ollama.integration.test.ts

@@ -0,0 +1,181 @@
+/**
+ * Live Ollama round-trip — real prompt, real response, documented default model.
+ *
+ * Opt-in (never auto-pull a multi-GB model in ordinary `bun test`):
+ * 1. `OKE_TEST_OLLAMA_URL` — point at any reachable Ollama
+ * 2. `OKE_TEST_OLLAMA_DOCKER=1` — start `ollama/ollama` via the recipe and pull
+ *    `qwen3.5:9b` (slow first run)
+ *
+ * Without one of those, the suite skips with a visible reason (never an empty pass).
+ * A local daemon on :11434 is not enough — set `OKE_TEST_OLLAMA_URL` explicitly.
+ */
+
+import { afterAll, describe, expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { deriveInfrastructure, writeDerivedFiles } from "../docker/index.ts";
+import { ai } from "../elements/ai.ts";
+import { bindAi } from "../kernel/boot-bind/ai.ts";
+import { OLLAMA_DEFAULT_MODEL, openOllama } from "./ai-ollama.ts";
+
+const OLLAMA_IMAGE = "ollama/ollama:latest";
+const ENV_URL = process.env.OKE_TEST_OLLAMA_URL?.trim();
+const WANT_DOCKER = process.env.OKE_TEST_OLLAMA_DOCKER === "1";
+
+function dockerAvailable(): boolean {
+  try {
+    return Bun.spawnSync(["docker", "info"], { stdout: "pipe", stderr: "pipe" }).exitCode === 0;
+  } catch {
+    return false;
+  }
+}
+
+const DOCKER = dockerAvailable();
+const canLive = Boolean(ENV_URL) || (WANT_DOCKER && DOCKER);
+
+if (!canLive) {
+  const reasons: string[] = [];
+  if (!ENV_URL) reasons.push("OKE_TEST_OLLAMA_URL not set");
+  if (!WANT_DOCKER) reasons.push("OKE_TEST_OLLAMA_DOCKER≠1");
+  else if (!DOCKER) reasons.push("docker daemon not available");
+  console.log(`skip: live ollama e2e (${reasons.join("; ")})`);
+}
+const live = canLive ? test : test.skip;
+
+let cleanup: (() => Promise<void>) | undefined;
+
+afterAll(async () => {
+  if (cleanup) await cleanup();
+});
+
+async function waitForOllama(url: string, timeoutMs: number, requireModel: boolean): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      const res = await fetch(`${url}/api/tags`);
+      if (res.ok) {
+        if (!requireModel) return;
+        const body = (await res.json()) as { models?: readonly { name?: string }[] };
+        const names = (body.models ?? []).map((m) => m.name ?? "");
+        if (
+          names.some((n) => n === OLLAMA_DEFAULT_MODEL || n.startsWith(`${OLLAMA_DEFAULT_MODEL}`))
+        ) {
+          return;
+        }
+      }
+    } catch {
+      // still starting
+    }
+    await Bun.sleep(1_000);
+  }
+  throw new Error(
+    `ollama not ready at ${url} within ${timeoutMs}ms${
+      requireModel ? ` (need model ${OLLAMA_DEFAULT_MODEL})` : ""
+    }`,
+  );
+}
+
+async function resolveLiveUrl(): Promise<{ url: string; model: string }> {
+  if (ENV_URL) {
+    await waitForOllama(ENV_URL, 30_000, false);
+    return { url: ENV_URL, model: process.env.OKE_AI_MODEL?.trim() || OLLAMA_DEFAULT_MODEL };
+  }
+
+  const dir = await mkdtemp(join(tmpdir(), "oke-ollama-"));
+  const dockerDir = join(dir, "docker");
+  const project = `oke-ollama-${Date.now()}`;
+  const instanceId = crypto.randomUUID().replace(/-/g, "").slice(0, 6);
+  const derived = deriveInfrastructure({
+    images: { ai: OLLAMA_IMAGE },
+    app: "ollama-e2e",
+    host: "127.0.0.1",
+    includeApp: false,
+    composeDir: "docker",
+    instanceId,
+    controls: { OKE_AI_MODEL: OLLAMA_DEFAULT_MODEL },
+  });
+  await writeDerivedFiles(derived, dockerDir, { writeStackEnv: true });
+
+  const composeFiles = ["compose.yml", "compose.ai.yml"];
+  const up = Bun.spawn(
+    ["docker", "compose", "-p", project, ...composeFiles.flatMap((f) => ["-f", f]), "up", "-d"],
+    {
+      cwd: dockerDir,
+      stdout: "pipe",
+      stderr: "pipe",
+      env: { ...process.env, ...derived.stackEnv, OKE_AI_MODEL: OLLAMA_DEFAULT_MODEL },
+    },
+  );
+  const [upErr, upCode] = await Promise.all([new Response(up.stderr).text(), up.exited]);
+  if (upCode !== 0) {
+    await rm(dir, { recursive: true, force: true });
+    throw new Error(`docker compose up failed: ${upErr}`);
+  }
+
+  const url = derived.stackEnv.OKE_AI_URL!;
+  cleanup = async () => {
+    const down = Bun.spawn(
+      ["docker", "compose", "-p", project, ...composeFiles.flatMap((f) => ["-f", f]), "down", "-v"],
+      { cwd: dockerDir, stdout: "pipe", stderr: "pipe" },
+    );
+    await down.exited;
+    await rm(dir, { recursive: true, force: true });
+  };
+
+  // Model pull can take a long time on first run.
+  await waitForOllama(url, 20 * 60_000, true);
+  return { url, model: OLLAMA_DEFAULT_MODEL };
+}
+
+describe("ollama live — real completion", () => {
+  live(
+    "boots against a real Ollama, completes with a real model, returns a real response",
+    async () => {
+      const { url, model } = await resolveLiveUrl();
+      const prevUrl = process.env.OKE_AI_URL;
+      const prevModel = process.env.OKE_AI_MODEL;
+      process.env.OKE_AI_URL = url;
+      process.env.OKE_AI_MODEL = model;
+
+      try {
+        const smart = ai.model("smart", { provider: "ollama", model });
+        const ping = smart.prompt("ollama-ping", { version: 1 });
+
+        const runtime = bindAi(
+          {
+            config: { drivers: { ai: { local: "ollama", test: "ollama" } } },
+            ai: { models: [smart], prompts: [ping] },
+          },
+          undefined,
+          () => Date.now(),
+          "local",
+          false,
+        );
+        expect(runtime.prompts.has("ollama-ping")).toBe(true);
+
+        const client = await openOllama({ baseUrl: url, model });
+        const result = await client.complete({
+          messages: [
+            {
+              role: "user",
+              content: "Reply with exactly the single word: pong",
+            },
+          ],
+          temperature: 0,
+          maxTokens: 32,
+        });
+
+        expect(result.driverId).toBe("ollama");
+        expect(result.text.trim().length).toBeGreaterThan(0);
+        expect(result.text.toLowerCase()).toContain("pong");
+      } finally {
+        if (prevUrl === undefined) delete process.env.OKE_AI_URL;
+        else process.env.OKE_AI_URL = prevUrl;
+        if (prevModel === undefined) delete process.env.OKE_AI_MODEL;
+        else process.env.OKE_AI_MODEL = prevModel;
+      }
+    },
+    25 * 60_000,
+  );
+});