pi-harness-runtime 1.1.439 → 1.1.441

package/packages/runtime/test/runtime-api.test.ts

@@ -1,169 +0,0 @@
-/**
- * Runtime API tests — the job actions and the states they use.
- *
- * The API stores the job machine the harness registers and moves the job
- * through the state machine. The states are the ones the state machine
- * actually has: `paused_quota` is its only paused state, and there is no
- * plain `paused` status.
- */
-
-import { describe, it, expect, beforeEach, afterEach } from "bun:test";
-import {
-	RuntimeApi,
-	type JobStateMachineLike,
-	type JobTransitionResult,
-} from "../src/runtime-api.js";
-import type {
-	JobStatus,
-	RuntimeCheckpoint,
-} from "../../types/dist/runtime-types.js";
-
-/** The states the fake machine accepts. */
-const ACCEPTED: JobStatus[] = ["running", "paused_quota", "cancelled"];
-
-/** The envelope every API response uses. */
-interface ApiResponseBody<T> {
-	success: boolean;
-	data?: T;
-	error?: string;
-}
-
-/** Read the JSON body of a response. */
-async function readJson<T>(res: Response): Promise<ApiResponseBody<T>> {
-	return (await res.json()) as ApiResponseBody<T>;
-}
-
-/** A job machine that records the moves the API asks for. */
-class FakeMachine implements JobStateMachineLike {
-	status: JobStatus = "running";
-	readonly moves: JobStatus[] = [];
-
-	getStatusSummary() {
-		return {
-			status: this.status,
-			isTerminal: this.status === "cancelled",
-			canResume: this.status === "paused_quota",
-		};
-	}
-
-	getCheckpoint(): RuntimeCheckpoint {
-		return {
-			version: 1,
-			jobId: "job-1",
-			status: this.status,
-			requirement: "do the thing",
-			createdAt: "2026-01-01T00:00:00.000Z",
-			updatedAt: "2026-01-01T00:00:00.000Z",
-		};
-	}
-
-	async resumeJob(): Promise<JobTransitionResult> {
-		return { success: true };
-	}
-
-	async transition(to: JobStatus): Promise<JobTransitionResult> {
-		this.moves.push(to);
-		if (!ACCEPTED.includes(to)) {
-			return { success: false, error: `Invalid transition to ${to}` };
-		}
-		this.status = to;
-		return { success: true };
-	}
-}
-
-describe("RuntimeApi job actions", () => {
-	let api: RuntimeApi;
-	let machine: FakeMachine;
-	let base: string;
-
-	beforeEach(async () => {
-		api = new RuntimeApi({ port: 0, host: "127.0.0.1" });
-		machine = new FakeMachine();
-		api.registerJob("job-1", machine);
-		await api.start();
-		base = `http://127.0.0.1:${api.getPort()}`;
-	});
-
-	afterEach(async () => {
-		await api.stop();
-	});
-
-	it("pauses a job into the state the machine has", async () => {
-		const res = await fetch(`${base}/jobs/job-1?action=pause`, {
-			method: "POST",
-		});
-
-		expect(res.status).toBe(200);
-		expect(machine.moves).toEqual(["paused_quota"]);
-		expect(machine.status).toBe("paused_quota");
-	});
-
-	it("resumes a paused job", async () => {
-		await fetch(`${base}/jobs/job-1?action=pause`, { method: "POST" });
-		machine.moves.length = 0;
-
-		const res = await fetch(`${base}/jobs/job-1?action=resume`, {
-			method: "POST",
-		});
-
-		expect(res.status).toBe(200);
-		expect(machine.moves).toEqual(["running"]);
-		expect(machine.status).toBe("running");
-	});
-
-	it("cancels a job", async () => {
-		const res = await fetch(`${base}/jobs/job-1?action=cancel`, {
-			method: "POST",
-		});
-
-		expect(res.status).toBe(200);
-		expect(machine.status).toBe("cancelled");
-	});
-
-	it("reports a refused move instead of a false success", async () => {
-		const refusing = new FakeMachine();
-		refusing.transition = async (to: JobStatus) => {
-			refusing.moves.push(to);
-			return { success: false, error: "the state machine refused the move" };
-		};
-		api.registerJob("job-2", refusing);
-
-		const res = await fetch(`${base}/jobs/job-2?action=pause`, {
-			method: "POST",
-		});
-
-		expect(res.status).toBe(409);
-		const body = await readJson<never>(res);
-		expect(body.error).toBe("the state machine refused the move");
-	});
-
-	it("rejects an unknown action", async () => {
-		const res = await fetch(`${base}/jobs/job-1?action=explode`, {
-			method: "POST",
-		});
-
-		expect(res.status).toBe(400);
-		expect(machine.moves).toEqual([]);
-	});
-
-	it("counts a paused job as paused", async () => {
-		await fetch(`${base}/jobs/job-1?action=pause`, { method: "POST" });
-
-		const res = await fetch(`${base}/status`);
-		const body = await readJson<{
-			jobs: { total: number; active: number; paused: number; completed: number };
-		}>(res);
-
-		expect(body.data?.jobs.total).toBe(1);
-		expect(body.data?.jobs.paused).toBe(1);
-		expect(body.data?.jobs.active).toBe(0);
-	});
-
-	it("reports an unknown job", async () => {
-		const res = await fetch(`${base}/jobs/nope?action=pause`, {
-			method: "POST",
-		});
-
-		expect(res.status).toBe(404);
-	});
-});

package/packages/runtime/test/runtime.test.ts

@@ -1,297 +0,0 @@
-/**
- * Runtime Tests — Policy Engine & Runtime API
- */
-
-import { describe, it, expect, beforeEach } from "bun:test";
-import {
-	PolicyEngine,
-	createHarnessPolicyEngine,
-	type PolicyContext,
-} from "../src/policy-engine.js";
-
-describe("PolicyEngine", () => {
-	let engine: PolicyEngine;
-
-	beforeEach(() => {
-		engine = new PolicyEngine();
-	});
-
-	describe("defaults", () => {
-		it("denies rm -rf /", () => {
-			const result = engine.canExecuteCommand("rm -rf /");
-			expect(result.effect).toBe("deny");
-		});
-
-		it("allows git commands", () => {
-			const result = engine.canExecuteCommand("git status");
-			expect(result.effect).toBe("allow");
-		});
-
-		it("allows npm/npx commands", () => {
-			expect(engine.canExecuteCommand("npm install").effect).toBe("allow");
-			expect(engine.canExecuteCommand("npx test").effect).toBe("allow");
-		});
-
-		it("allows HTTPS network requests", () => {
-			const result = engine.canMakeNetworkRequest("https://api.example.com");
-			expect(result.effect).toBe("allow");
-		});
-
-		it("denies HTTP network requests by default", () => {
-			const result = engine.canMakeNetworkRequest(
-				"http://insecure.example.com",
-			);
-			expect(result.effect).toBe("ask"); // Default ask, not explicit deny
-		});
-
-		it("denies private network access", () => {
-			const result = engine.canMakeNetworkRequest("10.0.0.1");
-			expect(result.effect).toBe("deny");
-		});
-
-		it("denies localhost network access", () => {
-			const result = engine.canMakeNetworkRequest("localhost");
-			expect(result.effect).toBe("deny");
-		});
-
-		it("denies file access outside workspace (.. paths)", () => {
-			const result = engine.canAccessFile("../secret.txt", "read");
-			expect(result.effect).toBe("deny");
-		});
-
-		it("defaults to ask for unknown resources", () => {
-			const ctx: PolicyContext = {
-				subject: {},
-				resource: { type: "command", path: "unknown-cmd" },
-			};
-			const result = engine.evaluate(ctx);
-			expect(result.effect).toBe("ask");
-		});
-	});
-
-	describe("addPolicy / removePolicy", () => {
-		it("adds a custom allow policy", () => {
-			engine.addPolicy({
-				id: "allow-my-cmd",
-				name: "Allow my command",
-				priority: 5,
-				effect: "allow",
-				condition: {
-					resource: { pathPattern: "^my-script" },
-				},
-			});
-
-			const result = engine.canExecuteCommand("my-script.sh");
-			expect(result.effect).toBe("allow");
-		});
-
-		it("higher priority policies override lower", () => {
-			engine.addPolicy({
-				id: "allow-any",
-				name: "Allow all",
-				priority: 1,
-				effect: "allow",
-				condition: { resource: { type: "command" } },
-			});
-			engine.addPolicy({
-				id: "deny-specific",
-				name: "Deny specific",
-				priority: 50,
-				effect: "deny",
-				condition: {
-					resource: { pathPattern: "git" },
-				},
-			});
-
-			const result = engine.canExecuteCommand("git status");
-			expect(result.effect).toBe("deny");
-		});
-
-		it("removes policy by id", () => {
-			engine.addPolicy({
-				id: "temp-policy",
-				name: "Temp",
-				priority: 5,
-				effect: "allow",
-				condition: { resource: { type: "command" } },
-			});
-			expect(engine.removePolicy("temp-policy")).toBe(true);
-			expect(engine.removePolicy("nonexistent")).toBe(false);
-		});
-
-		it("getPolicies returns all policies", () => {
-			engine.addPolicy({
-				id: "p1",
-				name: "Policy 1",
-				priority: 1,
-				effect: "allow",
-				condition: { resource: { type: "command" } },
-			});
-			const policies = engine.getPolicies();
-			expect(policies.some((p) => p.id === "p1")).toBe(true);
-		});
-	});
-
-	describe("canExecuteCommand", () => {
-		it("returns policy name in result", () => {
-			const result = engine.canExecuteCommand("git status");
-			expect(result.policy).toBeDefined();
-		});
-	});
-
-	describe("canAccessFile", () => {
-		it("allows reading safe paths", () => {
-			const result = engine.canAccessFile("/home/project/src/index.ts", "read");
-			expect(result.effect).not.toBe("deny");
-		});
-	});
-
-	describe("canMakeNetworkRequest", () => {
-		it("allows github HTTPS", () => {
-			const result = engine.canMakeNetworkRequest("https://github.com/api");
-			expect(result.effect).toBe("allow");
-		});
-	});
-
-	describe("addCommandRule", () => {
-		it("adds regex-based command rule", () => {
-			engine.addCommandRule(/^curl\s+/, "allow", "curl allowed");
-			const result = engine.canExecuteCommand("curl https://example.com");
-			expect(result.effect).toBe("allow");
-			expect(result.reason).toBe("curl allowed");
-		});
-	});
-
-	describe("addFileRule", () => {
-		it("adds regex-based file rule", () => {
-			engine.addFileRule(/\.log$/, "deny", "No log files");
-			const result = engine.canAccessFile("/tmp/debug.log", "read");
-			expect(result.effect).toBe("deny");
-		});
-	});
-
-	describe("addNetworkRule", () => {
-		it("adds regex-based network rule", () => {
-			engine.addNetworkRule(
-				/internal\.company\.com/,
-				"deny",
-				"Internal hosts blocked",
-			);
-			const result = engine.canMakeNetworkRequest(
-				"https://internal.company.com",
-			);
-			expect(result.effect).toBe("deny");
-		});
-	});
-
-	describe("rate limiting", () => {
-		it("enforces rate limits via custom policy", () => {
-			// Add policy with custom rate limit condition
-			let callCount = 0;
-			engine.addPolicy({
-				id: "rate-limit-test",
-				name: "Rate Limit Test",
-				priority: 50,
-				effect: "deny",
-				condition: {
-					resource: { type: "command" },
-					custom: () => {
-						callCount++;
-						return callCount > 3;
-					},
-				},
-				reason: "Rate limit exceeded",
-			});
-
-			// First 3 should be allowed (no policy match)
-			expect(engine.canExecuteCommand("git status").effect).toBe("allow");
-			expect(engine.canExecuteCommand("git status").effect).toBe("allow");
-			expect(engine.canExecuteCommand("git status").effect).toBe("allow");
-
-			// 4th should be denied
-			const result = engine.canExecuteCommand("git status");
-			expect(result.effect).toBe("deny");
-		});
-
-		it("getRateLimit returns configured limit", () => {
-			engine.setRateLimit("network", { maxRequests: 50, windowMs: 60000 });
-			const limit = engine.getRateLimit("network");
-			expect(limit?.maxRequests).toBe(50);
-			expect(limit?.windowMs).toBe(60000);
-		});
-	});
-
-	describe("audit log", () => {
-		it("logs audited policies", () => {
-			engine.addPolicy({
-				id: "audit-test",
-				name: "Audit Test",
-				priority: 5,
-				effect: "allow",
-				audit: true,
-				condition: {
-					resource: { type: "command", pathPattern: "^test-audit" },
-				},
-			});
-
-			engine.canExecuteCommand("test-audit");
-			const log = engine.getAuditLog();
-			expect(log.length).toBeGreaterThan(0);
-		});
-
-		it("filters audit log by effect", () => {
-			engine.clearAuditLog();
-			const log = engine.getAuditLog({ effect: "deny" });
-			expect(Array.isArray(log)).toBe(true);
-		});
-
-		it("clears audit log", () => {
-			engine.clearAuditLog();
-			expect(engine.getAuditLog()).toEqual([]);
-		});
-	});
-
-	describe("export/import policies", () => {
-		it("exports policies as JSON", () => {
-			const json = engine.exportPolicies();
-			expect(json).toContain("policies");
-			expect(json).toContain("commandRules");
-		});
-
-		it("imports policies from JSON", () => {
-			const original = engine.exportPolicies();
-			const imported = new PolicyEngine();
-			expect(imported.importPolicies(original)).toBe(true);
-
-			// After import, should still deny rm -rf
-			expect(imported.canExecuteCommand("rm -rf /").effect).toBe("deny");
-		});
-
-		it("returns false for invalid JSON", () => {
-			expect(engine.importPolicies("not valid json")).toBe(false);
-		});
-	});
-});
-
-describe("createHarnessPolicyEngine", () => {
-	it("creates engine with harness-specific policies", () => {
-		const engine = createHarnessPolicyEngine();
-
-		// Should still deny dangerous commands
-		expect(engine.canExecuteCommand("rm -rf /").effect).toBe("deny");
-
-		// Should allow harness internal commands
-		expect(engine.canExecuteCommand("pi-status").effect).toBe("allow");
-		expect(engine.canExecuteCommand("harness-status").effect).toBe("allow");
-
-		// Should deny system commands
-		expect(engine.canExecuteCommand("sudo rm /").effect).toBe("deny");
-	});
-
-	it("has rate limits configured", () => {
-		const engine = createHarnessPolicyEngine();
-		expect(engine.getRateLimit("command")?.maxRequests).toBe(60);
-		expect(engine.getRateLimit("network")?.maxRequests).toBe(100);
-		expect(engine.getRateLimit("file")?.maxRequests).toBe(200);
-	});
-});

package/packages/scheduler/test/scheduler.test.ts

@@ -1,125 +0,0 @@
-/**
- * Scheduler Tests
- */
-
-import { describe, it, expect, beforeEach } from "bun:test";
-import { mkdirSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { JsonRuntimeScheduler } from "../src/scheduler";
-
-const TMP = join(process.cwd(), ".test-scheduler-tmp");
-
-function scheduler(): JsonRuntimeScheduler {
-	return new JsonRuntimeScheduler(TMP);
-}
-
-beforeEach(() => {
-	rmSync(TMP, { force: true, recursive: true });
-	mkdirSync(TMP, { recursive: true });
-});
-
-describe("JsonRuntimeScheduler", () => {
-	describe("scheduleResume", () => {
-		it("writes a job to schedule.json", async () => {
-			const s = scheduler();
-			await s.scheduleResume("job-1", "2025-01-01T12:00:00Z", "test reason");
-			const jobs = await s.readAll();
-			expect(jobs).toHaveLength(1);
-			expect(jobs[0].jobId).toBe("job-1");
-			expect(jobs[0].status).toBe("scheduled");
-			expect(jobs[0].reason).toBe("test reason");
-		});
-
-		it("overwrites existing job with same ID", async () => {
-			const s = scheduler();
-			await s.scheduleResume("job-1", "2025-01-01T12:00:00Z", "reason A");
-			await s.scheduleResume("job-1", "2025-01-02T12:00:00Z", "reason B");
-			const jobs = await s.readAll();
-			expect(jobs).toHaveLength(1);
-			expect(jobs[0].reason).toBe("reason B");
-		});
-
-		it("keeps separate jobs distinct", async () => {
-			const s = scheduler();
-			await s.scheduleResume("job-A", "2025-01-01T12:00:00Z", "reason A");
-			await s.scheduleResume("job-B", "2025-01-02T12:00:00Z", "reason B");
-			const jobs = await s.readAll();
-			expect(jobs).toHaveLength(2);
-		});
-	});
-
-	describe("dueJobs", () => {
-		it("returns empty when nothing is due", async () => {
-			const s = scheduler();
-			await s.scheduleResume("job-1", "2099-12-31T23:59:59Z", "far future");
-			const due = await s.dueJobs(new Date("2025-01-01"));
-			expect(due).toHaveLength(0);
-		});
-
-		it("returns job when resumeAt has passed", async () => {
-			const s = scheduler();
-			await s.scheduleResume("job-1", "2024-01-01T12:00:00Z", "past");
-			const due = await s.dueJobs(new Date("2025-01-01"));
-			expect(due).toEqual(["job-1"]);
-		});
-
-		it("skips cancelled jobs", async () => {
-			const s = scheduler();
-			await s.scheduleResume("job-1", "2024-01-01T12:00:00Z", "cancelled");
-			await s.cancel("job-1");
-			const due = await s.dueJobs(new Date("2025-01-01"));
-			expect(due).toHaveLength(0);
-		});
-
-		it("returns multiple due jobs", async () => {
-			const s = scheduler();
-			await s.scheduleResume("job-A", "2024-01-01T12:00:00Z", "A");
-			await s.scheduleResume("job-B", "2024-01-02T12:00:00Z", "B");
-			await s.cancel("job-A");
-			const due = await s.dueJobs(new Date("2025-01-01"));
-			expect(due).toEqual(["job-B"]);
-		});
-
-		it("ignores resumeAt in the future", async () => {
-			const s = scheduler();
-			await s.scheduleResume("job-future", "2099-01-01T00:00:00Z", "too late");
-			const due = await s.dueJobs(new Date("2025-06-15"));
-			expect(due).toHaveLength(0);
-		});
-	});
-
-	describe("cancel", () => {
-		it("sets status to cancelled", async () => {
-			const s = scheduler();
-			await s.scheduleResume("job-1", "2024-01-01T00:00:00Z", "to cancel");
-			await s.cancel("job-1");
-			const jobs = await s.readAll();
-			expect(jobs).toHaveLength(1);
-			expect(jobs[0].status).toBe("cancelled");
-		});
-
-		it("no-op for unknown job", async () => {
-			const s = scheduler();
-			await s.scheduleResume("job-1", "2024-01-01T00:00:00Z", "exists");
-			await s.cancel("nonexistent");
-			const jobs = await s.readAll();
-			expect(jobs).toHaveLength(1);
-		});
-
-		it("cancelled job not returned by dueJobs", async () => {
-			const s = scheduler();
-			await s.scheduleResume("job-1", "2020-01-01T00:00:00Z", "was due");
-			await s.cancel("job-1");
-			const due = await s.dueJobs(new Date("2025-01-01"));
-			expect(due).toHaveLength(0);
-		});
-	});
-
-	describe("readAll", () => {
-		it("returns empty array for missing file", async () => {
-			const s = scheduler();
-			const jobs = await s.readAll();
-			expect(jobs).toEqual([]);
-		});
-	});
-});