216 lines
7.8 KiB
TypeScript
216 lines
7.8 KiB
TypeScript
import { describe, expect, it } from "bun:test";
|
|
import { readFile, readdir } from "node:fs/promises";
|
|
import sandboxBash from "../../.opencode/tools/bash.js";
|
|
import tjwaterCli from "../../.opencode/tools/tjwater_cli.js";
|
|
import storeRenderRef, {
|
|
resolveStoreRenderFilePath,
|
|
} from "../../.opencode/tools/store_render_ref.js";
|
|
|
|
describe("internal OpenCode permissions", () => {
|
|
it("pins the runtime, SDK, plugin, and image to OpenCode 1.18.13", async () => {
|
|
const [rootPackageText, toolPackageText, dockerfile] = await Promise.all([
|
|
readFile("package.json", "utf8"),
|
|
readFile(".opencode/package.json", "utf8"),
|
|
readFile("Dockerfile", "utf8"),
|
|
]);
|
|
const rootPackage = JSON.parse(rootPackageText) as {
|
|
dependencies?: Record<string, string>;
|
|
};
|
|
const toolPackage = JSON.parse(toolPackageText) as {
|
|
dependencies?: Record<string, string>;
|
|
};
|
|
expect(rootPackage.dependencies?.["@opencode-ai/sdk"]).toBe("1.18.13");
|
|
expect(toolPackage.dependencies?.["@opencode-ai/plugin"]).toBe("1.18.13");
|
|
expect(dockerfile.startsWith("FROM smanx/opencode:1.18.13@")).toBe(true);
|
|
});
|
|
|
|
it("keeps protected paths denied in every approval mode", async () => {
|
|
const config = JSON.parse(await readFile("opencode.json", "utf8")) as {
|
|
permission?: Record<string, string | Record<string, string>>;
|
|
};
|
|
const permission = config.permission ?? {};
|
|
const bash = permission.bash as Record<string, string> | undefined;
|
|
const edit = permission.edit as Record<string, string> | undefined;
|
|
const read = permission.read as Record<string, string> | undefined;
|
|
|
|
expect(permission["*"]).toBe("ask");
|
|
expect(permission.external_directory).toBe("deny");
|
|
expect(permission.task).toBe("deny");
|
|
expect(permission.question).toBe("allow");
|
|
expect(permission.activity_update).toBe("allow");
|
|
expect(permission.final_answer).toBe("allow");
|
|
expect(permission.todowrite).toBe("allow");
|
|
expect(read?.["*"]).toBe("allow");
|
|
expect(read?.["data/**"]).toBe("deny");
|
|
expect(read?.["**/logs/**"]).toBe("deny");
|
|
expect(edit?.["*"]).toBe("ask");
|
|
expect(edit?.["data/**"]).toBe("deny");
|
|
expect(edit?.["**/logs/**"]).toBe("deny");
|
|
expect(bash?.["*"]).toBe("ask");
|
|
expect(bash?.["rm *"]).toBe("ask");
|
|
expect(bash?.["rm -rf *"]).toBe("deny");
|
|
expect(bash?.["rm -fr *"]).toBe("deny");
|
|
expect(bash?.["rm -r -f *"]).toBe("deny");
|
|
expect(bash?.["rm -f -r *"]).toBe("deny");
|
|
expect(bash?.["rm --recursive --force *"]).toBe("deny");
|
|
expect(bash?.["rm --force --recursive *"]).toBe("deny");
|
|
expect(bash?.["*.env*"]).toBe("deny");
|
|
expect(bash?.["*data/*"]).toBeUndefined();
|
|
expect(bash?.["*logs/*"]).toBeUndefined();
|
|
});
|
|
|
|
it("keeps reason only on the activity grouping tool", async () => {
|
|
const toolFiles = (await readdir(".opencode/tools"))
|
|
.filter((file) => file.endsWith(".ts"));
|
|
const sources = await Promise.all(
|
|
toolFiles.map(async (file) => ({
|
|
file,
|
|
source: await readFile(`.opencode/tools/${file}`, "utf8"),
|
|
})),
|
|
);
|
|
const reasonSchemaFiles = sources
|
|
.filter(({ source }) => /reason:\s*tool\.schema/u.test(source))
|
|
.map(({ file }) => file);
|
|
|
|
expect(reasonSchemaFiles).toEqual(["activity_update.ts"]);
|
|
});
|
|
});
|
|
|
|
describe("store_render_ref arguments", () => {
|
|
it("accepts the observed camelCase alias without changing snake_case precedence", () => {
|
|
expect(
|
|
resolveStoreRenderFilePath({
|
|
filePath: "/app/data/conversation-workspaces/chat-1/partition.json",
|
|
}),
|
|
).toBe("/app/data/conversation-workspaces/chat-1/partition.json");
|
|
|
|
expect(
|
|
resolveStoreRenderFilePath({
|
|
file_path: "/app/data/conversation-workspaces/chat-1/preferred.json",
|
|
filePath: "/app/data/conversation-workspaces/chat-1/compatibility.json",
|
|
}),
|
|
).toBe("/app/data/conversation-workspaces/chat-1/preferred.json");
|
|
});
|
|
|
|
it("forwards a camelCase compatibility argument as file_path", async () => {
|
|
const originalFetch = globalThis.fetch;
|
|
let requestBody: unknown;
|
|
globalThis.fetch = (async (
|
|
_input: RequestInfo | URL,
|
|
init?: RequestInit,
|
|
) => {
|
|
requestBody = JSON.parse(String(init?.body));
|
|
return new Response('{"render_ref":"res-test"}');
|
|
}) as unknown as typeof fetch;
|
|
|
|
try {
|
|
const definition = storeRenderRef as unknown as {
|
|
args: Record<string, unknown>;
|
|
execute: (args: unknown, context: unknown) => Promise<unknown>;
|
|
};
|
|
expect(definition.args.filePath).toBeDefined();
|
|
await definition.execute(
|
|
{
|
|
reason: "regression test",
|
|
filePath: "/app/data/conversation-workspaces/chat-1/partition.json",
|
|
},
|
|
{ sessionID: "session-test" } as never,
|
|
);
|
|
} finally {
|
|
globalThis.fetch = originalFetch;
|
|
}
|
|
|
|
expect(requestBody).toEqual({
|
|
session_id: "session-test",
|
|
file_path: "/app/data/conversation-workspaces/chat-1/partition.json",
|
|
});
|
|
});
|
|
});
|
|
|
|
describe("sandbox bash tool", () => {
|
|
it("forwards commands to the authenticated sandbox endpoint", async () => {
|
|
const originalFetch = globalThis.fetch;
|
|
const permissionRequests: unknown[] = [];
|
|
let requestUrl = "";
|
|
let requestBody: unknown;
|
|
globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
|
|
requestUrl = String(input);
|
|
requestBody = JSON.parse(String(init?.body));
|
|
return new Response('{"ok":true,"stdout":"done"}');
|
|
}) as unknown as typeof fetch;
|
|
try {
|
|
const definition = sandboxBash as unknown as {
|
|
execute: (args: unknown, context: unknown) => Promise<unknown>;
|
|
};
|
|
await definition.execute(
|
|
{ command: "python3 analysis.py", timeout: 300 },
|
|
{
|
|
sessionID: "session-test",
|
|
ask: async (input: unknown) => permissionRequests.push(input),
|
|
} as never,
|
|
);
|
|
} finally {
|
|
globalThis.fetch = originalFetch;
|
|
}
|
|
expect(requestUrl).toEndWith("/internal/tools/sandbox-shell");
|
|
expect(permissionRequests).toEqual([
|
|
{
|
|
permission: "bash",
|
|
patterns: ["python3 analysis.py"],
|
|
always: ["python3 analysis.py"],
|
|
metadata: {
|
|
command: "python3 analysis.py",
|
|
},
|
|
},
|
|
]);
|
|
expect(requestBody).toEqual({
|
|
session_id: "session-test",
|
|
command: "python3 analysis.py",
|
|
timeout: 300,
|
|
});
|
|
});
|
|
});
|
|
|
|
describe("tjwater_cli storage request", () => {
|
|
it("keeps command discovery rules in the always-visible tool contract", () => {
|
|
const definition = tjwaterCli as unknown as {
|
|
description: string;
|
|
args: { command: { description?: string } };
|
|
};
|
|
|
|
expect(definition.description).toContain("help");
|
|
expect(definition.args.command.description).toContain("禁止类推");
|
|
expect(definition.args.command.description).toContain("simulation runs list");
|
|
expect(definition.args.command.description).not.toContain(
|
|
"示例：'analysis runs list'",
|
|
);
|
|
});
|
|
|
|
it("forwards store_result so small workflow inputs can be staged", async () => {
|
|
const originalFetch = globalThis.fetch;
|
|
let requestBody: unknown;
|
|
globalThis.fetch = (async (_input: RequestInfo | URL, init?: RequestInit) => {
|
|
requestBody = JSON.parse(String(init?.body));
|
|
return new Response('{"ok":true,"data_file":{"file_path":"/tmp/test"}}');
|
|
}) as unknown as typeof fetch;
|
|
try {
|
|
const definition = tjwaterCli as unknown as {
|
|
execute: (args: unknown, context: unknown) => Promise<unknown>;
|
|
};
|
|
await definition.execute(
|
|
{
|
|
command: "network get-all-reservoirs-properties",
|
|
store_result: true,
|
|
},
|
|
{ sessionID: "session-test" } as never,
|
|
);
|
|
} finally {
|
|
globalThis.fetch = originalFetch;
|
|
}
|
|
expect(requestBody).toMatchObject({
|
|
session_id: "session-test",
|
|
store_result: true,
|
|
});
|
|
});
|
|
});
|