mirror of
https://github.com/alkimake/paperclip.git
synced 2026-06-16 10:50:38 +09:00
Generalize sandbox provider core for plugin-only providers (#4449)
## Thinking Path > - Paperclip is a control plane, so optional execution providers should sit at the plugin edge instead of hardcoding provider-specific behavior into core shared/server/ui layers. > - Sandbox environments are already first-class, and the fake provider proves the built-in path; the remaining gap was that real providers still leaked provider-specific config and runtime assumptions into core. > - That coupling showed up in config normalization, secret persistence, capabilities reporting, lease reconstruction, and the board UI form fields. > - As long as core knew about those provider-shaped details, shipping a provider as a pure third-party plugin meant every new provider would still require host changes. > - This pull request generalizes the sandbox provider seam around schema-driven plugin metadata and generic secret-ref handling. > - The runtime and UI now consume provider metadata generically, so core only special-cases the built-in fake provider while third-party providers can live entirely in plugins. ## What Changed - Added generic sandbox-provider capability metadata so plugin-backed providers can expose `configSchema` through shared environment support and the environments capabilities API. - Reworked sandbox config normalization/persistence/runtime resolution to handle schema-declared secret-ref fields generically, storing them as Paperclip secrets and resolving them for probe/execute/release flows. - Generalized plugin sandbox runtime handling so provider validation, reusable-lease matching, lease reconstruction, and plugin worker calls all operate on provider-agnostic config instead of provider-shaped branches. - Replaced hardcoded sandbox provider form fields in Company Settings with schema-driven rendering and blocked agent environment selection from the built-in fake provider. - Added regression coverage for the generic seam across shared support helpers plus environment config, probe, routes, runtime, and sandbox-provider runtime tests. ## Verification - `pnpm vitest --run packages/shared/src/environment-support.test.ts server/src/__tests__/environment-config.test.ts server/src/__tests__/environment-probe.test.ts server/src/__tests__/environment-routes.test.ts server/src/__tests__/environment-runtime.test.ts server/src/__tests__/sandbox-provider-runtime.test.ts` - `pnpm -r typecheck` ## Risks - Plugin sandbox providers now depend more heavily on accurate `configSchema` declarations; incorrect schemas can misclassify secret-bearing fields or omit required config. - Reusable lease matching is now metadata-driven for plugin-backed providers, so providers that fail to persist stable metadata may reprovision instead of resuming an existing lease. - The UI form is now fully schema-driven for plugin-backed sandbox providers; provider manifests without good defaults or descriptions may produce a rougher operator experience. ## Model Used - OpenAI Codex via `codex_local` - Model ID: `gpt-5.4` - Reasoning effort: `high` - Context window observed in runtime session metadata: `258400` tokens - Capabilities used: terminal tool execution, git, and local code/test inspection ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [ ] If this change affects the UI, I have included before/after screenshots - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge
This commit is contained in:
Devin Foley
GitHub
parent
deba60ebb2
commit
5bd0f578fd
18 changed files with 1235 additions and 236 deletions
|
|
@ -141,6 +141,26 @@ describe("environment config helpers", () => {
|
|||
});
|
||||
});
|
||||
|
||||
it("normalizes schema-driven sandbox config into the generic plugin-backed stored shape", () => {
|
||||
const config = normalizeEnvironmentConfig({
|
||||
driver: "sandbox",
|
||||
config: {
|
||||
provider: "secure-plugin",
|
||||
template: " base ",
|
||||
apiKey: "22222222-2222-2222-2222-222222222222",
|
||||
timeoutMs: "450000",
|
||||
},
|
||||
});
|
||||
|
||||
expect(config).toEqual({
|
||||
provider: "secure-plugin",
|
||||
template: " base ",
|
||||
apiKey: "22222222-2222-2222-2222-222222222222",
|
||||
timeoutMs: 450000,
|
||||
reuseLease: false,
|
||||
});
|
||||
});
|
||||
|
||||
it("normalizes plugin-backed sandbox provider config without server provider changes", () => {
|
||||
const config = normalizeEnvironmentConfig({
|
||||
driver: "sandbox",
|
||||
|
|
@ -162,6 +182,30 @@ describe("environment config helpers", () => {
|
|||
});
|
||||
});
|
||||
|
||||
it("parses a persisted schema-driven sandbox environment into a typed driver config", () => {
|
||||
const parsed = parseEnvironmentDriverConfig({
|
||||
driver: "sandbox",
|
||||
config: {
|
||||
provider: "secure-plugin",
|
||||
template: "base",
|
||||
apiKey: "22222222-2222-2222-2222-222222222222",
|
||||
timeoutMs: 300000,
|
||||
reuseLease: true,
|
||||
},
|
||||
});
|
||||
|
||||
expect(parsed).toEqual({
|
||||
driver: "sandbox",
|
||||
config: {
|
||||
provider: "secure-plugin",
|
||||
template: "base",
|
||||
apiKey: "22222222-2222-2222-2222-222222222222",
|
||||
timeoutMs: 300000,
|
||||
reuseLease: true,
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
it("parses a persisted plugin-backed sandbox environment into a typed driver config", () => {
|
||||
const parsed = parseEnvironmentDriverConfig({
|
||||
driver: "sandbox",
|
||||
|
|
|
|||
|
|
@ -3,6 +3,7 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
|
|||
const mockEnsureSshWorkspaceReady = vi.hoisted(() => vi.fn());
|
||||
const mockProbePluginEnvironmentDriver = vi.hoisted(() => vi.fn());
|
||||
const mockProbePluginSandboxProviderDriver = vi.hoisted(() => vi.fn());
|
||||
const mockResolvePluginSandboxProviderDriverByKey = vi.hoisted(() => vi.fn());
|
||||
|
||||
vi.mock("@paperclipai/adapter-utils/ssh", () => ({
|
||||
ensureSshWorkspaceReady: mockEnsureSshWorkspaceReady,
|
||||
|
|
@ -11,6 +12,7 @@ vi.mock("@paperclipai/adapter-utils/ssh", () => ({
|
|||
vi.mock("../services/plugin-environment-driver.js", () => ({
|
||||
probePluginEnvironmentDriver: mockProbePluginEnvironmentDriver,
|
||||
probePluginSandboxProviderDriver: mockProbePluginSandboxProviderDriver,
|
||||
resolvePluginSandboxProviderDriverByKey: mockResolvePluginSandboxProviderDriverByKey,
|
||||
}));
|
||||
|
||||
import { probeEnvironment } from "../services/environment-probe.ts";
|
||||
|
|
@ -20,6 +22,8 @@ describe("probeEnvironment", () => {
|
|||
mockEnsureSshWorkspaceReady.mockReset();
|
||||
mockProbePluginEnvironmentDriver.mockReset();
|
||||
mockProbePluginSandboxProviderDriver.mockReset();
|
||||
mockResolvePluginSandboxProviderDriverByKey.mockReset();
|
||||
mockResolvePluginSandboxProviderDriverByKey.mockResolvedValue(null);
|
||||
});
|
||||
|
||||
it("reports local environments as immediately available", async () => {
|
||||
|
|
|
|||
|
|
@ -38,6 +38,7 @@ const mockSecretService = vi.hoisted(() => ({
|
|||
resolveSecretValue: vi.fn(),
|
||||
}));
|
||||
const mockValidatePluginEnvironmentDriverConfig = vi.hoisted(() => vi.fn());
|
||||
const mockValidatePluginSandboxProviderConfig = vi.hoisted(() => vi.fn());
|
||||
const mockListReadyPluginEnvironmentDrivers = vi.hoisted(() => vi.fn());
|
||||
const mockExecutionWorkspaceService = vi.hoisted(() => ({}));
|
||||
|
||||
|
|
@ -69,6 +70,7 @@ vi.mock("../services/execution-workspaces.js", () => ({
|
|||
vi.mock("../services/plugin-environment-driver.js", () => ({
|
||||
listReadyPluginEnvironmentDrivers: mockListReadyPluginEnvironmentDrivers,
|
||||
validatePluginEnvironmentDriverConfig: mockValidatePluginEnvironmentDriverConfig,
|
||||
validatePluginSandboxProviderConfig: mockValidatePluginSandboxProviderConfig,
|
||||
}));
|
||||
|
||||
function createEnvironment() {
|
||||
|
|
@ -148,6 +150,18 @@ describe("environment routes", () => {
|
|||
});
|
||||
mockValidatePluginEnvironmentDriverConfig.mockReset();
|
||||
mockValidatePluginEnvironmentDriverConfig.mockImplementation(async ({ config }) => config);
|
||||
mockValidatePluginSandboxProviderConfig.mockReset();
|
||||
mockValidatePluginSandboxProviderConfig.mockImplementation(async ({ provider, config }) => ({
|
||||
normalizedConfig: config,
|
||||
pluginId: `plugin-${provider}`,
|
||||
pluginKey: `plugin.${provider}`,
|
||||
driver: {
|
||||
driverKey: provider,
|
||||
kind: "sandbox_provider",
|
||||
displayName: provider,
|
||||
configSchema: { type: "object" },
|
||||
},
|
||||
}));
|
||||
mockListReadyPluginEnvironmentDrivers.mockReset();
|
||||
mockListReadyPluginEnvironmentDrivers.mockResolvedValue([]);
|
||||
});
|
||||
|
|
@ -185,6 +199,52 @@ describe("environment routes", () => {
|
|||
expect(res.body.sandboxProviders).not.toHaveProperty("fake-plugin");
|
||||
});
|
||||
|
||||
it("returns installed plugin-backed sandbox capabilities for environment creation", async () => {
|
||||
mockListReadyPluginEnvironmentDrivers.mockResolvedValue([
|
||||
{
|
||||
pluginId: "plugin-1",
|
||||
pluginKey: "acme.secure-sandbox-provider",
|
||||
driverKey: "secure-plugin",
|
||||
displayName: "Secure Sandbox",
|
||||
description: "Provisions schema-driven cloud sandboxes.",
|
||||
configSchema: {
|
||||
type: "object",
|
||||
properties: {
|
||||
template: { type: "string" },
|
||||
apiKey: { type: "string", format: "secret-ref" },
|
||||
},
|
||||
},
|
||||
},
|
||||
]);
|
||||
const app = createApp({
|
||||
type: "board",
|
||||
userId: "user-1",
|
||||
source: "local_implicit",
|
||||
});
|
||||
|
||||
const res = await request(app).get("/api/companies/company-1/environments/capabilities");
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.sandboxProviders["secure-plugin"]).toMatchObject({
|
||||
status: "supported",
|
||||
supportsRunExecution: true,
|
||||
supportsReusableLeases: true,
|
||||
displayName: "Secure Sandbox",
|
||||
source: "plugin",
|
||||
pluginKey: "acme.secure-sandbox-provider",
|
||||
pluginId: "plugin-1",
|
||||
configSchema: {
|
||||
type: "object",
|
||||
properties: {
|
||||
template: { type: "string" },
|
||||
apiKey: { type: "string", format: "secret-ref" },
|
||||
},
|
||||
},
|
||||
});
|
||||
expect(res.body.adapters.find((row: any) => row.adapterType === "codex_local").sandboxProviders["secure-plugin"])
|
||||
.toBe("supported");
|
||||
});
|
||||
|
||||
it("redacts config and metadata for unprivileged agent list reads", async () => {
|
||||
mockEnvironmentService.list.mockResolvedValue([createEnvironment()]);
|
||||
mockAgentService.getById.mockResolvedValue({
|
||||
|
|
@ -453,11 +513,12 @@ describe("environment routes", () => {
|
|||
},
|
||||
};
|
||||
mockEnvironmentService.create.mockResolvedValue(environment);
|
||||
const pluginWorkerManager = {};
|
||||
const app = createApp({
|
||||
type: "board",
|
||||
userId: "user-1",
|
||||
source: "local_implicit",
|
||||
});
|
||||
}, { pluginWorkerManager });
|
||||
|
||||
const res = await request(app)
|
||||
.post("/api/companies/company-1/environments")
|
||||
|
|
@ -531,11 +592,12 @@ describe("environment routes", () => {
|
|||
},
|
||||
};
|
||||
mockEnvironmentService.create.mockResolvedValue(environment);
|
||||
const pluginWorkerManager = {};
|
||||
const app = createApp({
|
||||
type: "board",
|
||||
userId: "user-1",
|
||||
source: "local_implicit",
|
||||
});
|
||||
}, { pluginWorkerManager });
|
||||
|
||||
const res = await request(app)
|
||||
.post("/api/companies/company-1/environments")
|
||||
|
|
@ -551,6 +613,16 @@ describe("environment routes", () => {
|
|||
});
|
||||
|
||||
expect(res.status).toBe(201);
|
||||
expect(mockValidatePluginSandboxProviderConfig).toHaveBeenCalledWith({
|
||||
db: expect.anything(),
|
||||
workerManager: pluginWorkerManager,
|
||||
provider: "fake-plugin",
|
||||
config: {
|
||||
image: "fake:test",
|
||||
timeoutMs: 450000,
|
||||
reuseLease: true,
|
||||
},
|
||||
});
|
||||
expect(mockEnvironmentService.create).toHaveBeenCalledWith("company-1", {
|
||||
name: "Fake plugin Sandbox",
|
||||
driver: "sandbox",
|
||||
|
|
@ -565,6 +637,101 @@ describe("environment routes", () => {
|
|||
expect(mockSecretService.create).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("creates a schema-driven sandbox environment with secret-ref fields persisted as secrets", async () => {
|
||||
const environment = {
|
||||
...createEnvironment(),
|
||||
id: "env-sandbox-secure-plugin",
|
||||
name: "Secure Sandbox",
|
||||
driver: "sandbox" as const,
|
||||
config: {
|
||||
provider: "secure-plugin",
|
||||
template: "base",
|
||||
apiKey: "11111111-1111-1111-1111-111111111111",
|
||||
timeoutMs: 450000,
|
||||
reuseLease: true,
|
||||
},
|
||||
};
|
||||
mockEnvironmentService.create.mockResolvedValue(environment);
|
||||
mockValidatePluginSandboxProviderConfig.mockResolvedValue({
|
||||
normalizedConfig: {
|
||||
template: "base",
|
||||
apiKey: "test-provider-key",
|
||||
timeoutMs: 450000,
|
||||
reuseLease: true,
|
||||
},
|
||||
pluginId: "plugin-secure",
|
||||
pluginKey: "acme.secure-sandbox-provider",
|
||||
driver: {
|
||||
driverKey: "secure-plugin",
|
||||
kind: "sandbox_provider",
|
||||
displayName: "Secure Sandbox",
|
||||
configSchema: {
|
||||
type: "object",
|
||||
properties: {
|
||||
template: { type: "string" },
|
||||
apiKey: { type: "string", format: "secret-ref" },
|
||||
timeoutMs: { type: "number" },
|
||||
reuseLease: { type: "boolean" },
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
const pluginWorkerManager = {};
|
||||
const app = createApp({
|
||||
type: "board",
|
||||
userId: "user-1",
|
||||
source: "local_implicit",
|
||||
}, { pluginWorkerManager });
|
||||
|
||||
const res = await request(app)
|
||||
.post("/api/companies/company-1/environments")
|
||||
.send({
|
||||
name: "Secure Sandbox",
|
||||
driver: "sandbox",
|
||||
config: {
|
||||
provider: "secure-plugin",
|
||||
template: " base ",
|
||||
apiKey: " test-provider-key ",
|
||||
timeoutMs: "450000",
|
||||
reuseLease: true,
|
||||
},
|
||||
});
|
||||
|
||||
expect(res.status).toBe(201);
|
||||
expect(mockValidatePluginSandboxProviderConfig).toHaveBeenCalledWith({
|
||||
db: expect.anything(),
|
||||
workerManager: pluginWorkerManager,
|
||||
provider: "secure-plugin",
|
||||
config: {
|
||||
template: " base ",
|
||||
apiKey: " test-provider-key ",
|
||||
timeoutMs: 450000,
|
||||
reuseLease: true,
|
||||
},
|
||||
});
|
||||
expect(mockEnvironmentService.create).toHaveBeenCalledWith("company-1", {
|
||||
name: "Secure Sandbox",
|
||||
driver: "sandbox",
|
||||
status: "active",
|
||||
config: {
|
||||
provider: "secure-plugin",
|
||||
template: "base",
|
||||
apiKey: "11111111-1111-1111-1111-111111111111",
|
||||
timeoutMs: 450000,
|
||||
reuseLease: true,
|
||||
},
|
||||
});
|
||||
expect(JSON.stringify(mockEnvironmentService.create.mock.calls[0][1])).not.toContain("test-provider-key");
|
||||
expect(mockSecretService.create).toHaveBeenCalledWith(
|
||||
"company-1",
|
||||
expect.objectContaining({
|
||||
provider: "local_encrypted",
|
||||
value: "test-provider-key",
|
||||
}),
|
||||
expect.any(Object),
|
||||
);
|
||||
});
|
||||
|
||||
it("validates plugin environment config through the plugin driver host", async () => {
|
||||
const environment = {
|
||||
...createEnvironment(),
|
||||
|
|
@ -997,12 +1164,13 @@ describe("environment routes", () => {
|
|||
summary: "Fake plugin sandbox provider is ready.",
|
||||
details: { provider: "fake-plugin" },
|
||||
});
|
||||
const pluginWorkerManager = {};
|
||||
const app = createApp({
|
||||
type: "board",
|
||||
userId: "user-1",
|
||||
source: "local_implicit",
|
||||
runId: "run-1",
|
||||
});
|
||||
}, { pluginWorkerManager });
|
||||
|
||||
const res = await request(app)
|
||||
.post("/api/companies/company-1/environments/probe-config")
|
||||
|
|
@ -1031,7 +1199,7 @@ describe("environment routes", () => {
|
|||
}),
|
||||
}),
|
||||
expect.objectContaining({
|
||||
pluginWorkerManager: undefined,
|
||||
pluginWorkerManager,
|
||||
resolvedConfig: expect.objectContaining({
|
||||
driver: "sandbox",
|
||||
}),
|
||||
|
|
|
|||
|
|
@ -56,6 +56,7 @@ describe("findReusableSandboxLeaseId", () => {
|
|||
metadata: {
|
||||
provider: "fake-plugin",
|
||||
image: "template-a",
|
||||
timeoutMs: 300000,
|
||||
reuseLease: true,
|
||||
},
|
||||
},
|
||||
|
|
@ -64,13 +65,14 @@ describe("findReusableSandboxLeaseId", () => {
|
|||
metadata: {
|
||||
provider: "fake-plugin",
|
||||
image: "template-b",
|
||||
timeoutMs: 300000,
|
||||
reuseLease: true,
|
||||
},
|
||||
},
|
||||
],
|
||||
});
|
||||
|
||||
expect(selected).toBe("sandbox-template-a");
|
||||
expect(selected).toBe("sandbox-template-b");
|
||||
});
|
||||
|
||||
it("requires image identity for reusable fake sandbox leases", () => {
|
||||
|
|
@ -476,7 +478,12 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
|
|||
const workerManager = {
|
||||
isRunning: vi.fn((id: string) => id === pluginId),
|
||||
call: vi.fn(async (_pluginId: string, method: string, params: any) => {
|
||||
expect(params.config).toEqual(expect.objectContaining(fakePluginConfig));
|
||||
expect(params.config).toEqual(expect.objectContaining({
|
||||
image: "fake:test",
|
||||
timeoutMs: 1234,
|
||||
reuseLease: false,
|
||||
}));
|
||||
expect(params.config).not.toHaveProperty("provider");
|
||||
if (method === "environmentAcquireLease") {
|
||||
return {
|
||||
providerLeaseId: "sandbox-1",
|
||||
|
|
@ -499,12 +506,17 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
|
|||
};
|
||||
}
|
||||
if (method === "environmentReleaseLease") {
|
||||
expect(params.config).toEqual(fakePluginConfig);
|
||||
expect(params.config).toEqual({
|
||||
image: "fake:test",
|
||||
timeoutMs: 1234,
|
||||
reuseLease: false,
|
||||
});
|
||||
expect(params.config).not.toHaveProperty("driver");
|
||||
expect(params.config).not.toHaveProperty("executionWorkspaceMode");
|
||||
expect(params.config).not.toHaveProperty("pluginId");
|
||||
expect(params.config).not.toHaveProperty("pluginKey");
|
||||
expect(params.config).not.toHaveProperty("providerMetadata");
|
||||
expect(params.config).not.toHaveProperty("provider");
|
||||
expect(params.config).not.toHaveProperty("sandboxProviderPlugin");
|
||||
return undefined;
|
||||
}
|
||||
|
|
@ -543,6 +555,270 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
|
|||
expect(workerManager.call).toHaveBeenCalledWith(pluginId, "environmentReleaseLease", expect.anything());
|
||||
});
|
||||
|
||||
it("uses resolved secret-ref config for plugin-backed sandbox execute and release", async () => {
|
||||
const pluginId = randomUUID();
|
||||
const { companyId, environment: baseEnvironment, runId } = await seedEnvironment();
|
||||
const apiSecret = await secretService(db).create(companyId, {
|
||||
name: `secure-plugin-api-key-${randomUUID()}`,
|
||||
provider: "local_encrypted",
|
||||
value: "resolved-provider-key",
|
||||
});
|
||||
const providerConfig = {
|
||||
provider: "secure-plugin",
|
||||
template: "base",
|
||||
apiKey: apiSecret.id,
|
||||
timeoutMs: 1234,
|
||||
reuseLease: false,
|
||||
};
|
||||
const environment = {
|
||||
...baseEnvironment,
|
||||
name: "Secure Plugin Sandbox",
|
||||
driver: "sandbox",
|
||||
config: providerConfig,
|
||||
};
|
||||
await environmentService(db).update(environment.id, {
|
||||
driver: "sandbox",
|
||||
name: environment.name,
|
||||
config: providerConfig,
|
||||
});
|
||||
await db.insert(plugins).values({
|
||||
id: pluginId,
|
||||
pluginKey: "acme.secure-sandbox-provider",
|
||||
packageName: "@acme/secure-sandbox-provider",
|
||||
version: "1.0.0",
|
||||
apiVersion: 1,
|
||||
categories: ["automation"],
|
||||
manifestJson: {
|
||||
id: "acme.secure-sandbox-provider",
|
||||
apiVersion: 1,
|
||||
version: "1.0.0",
|
||||
displayName: "Secure Sandbox Provider",
|
||||
description: "Test schema-driven provider",
|
||||
author: "Paperclip",
|
||||
categories: ["automation"],
|
||||
capabilities: ["environment.drivers.register"],
|
||||
entrypoints: { worker: "dist/worker.js" },
|
||||
environmentDrivers: [
|
||||
{
|
||||
driverKey: "secure-plugin",
|
||||
kind: "sandbox_provider",
|
||||
displayName: "Secure Sandbox",
|
||||
configSchema: {
|
||||
type: "object",
|
||||
properties: {
|
||||
template: { type: "string" },
|
||||
apiKey: { type: "string", format: "secret-ref" },
|
||||
timeoutMs: { type: "number" },
|
||||
reuseLease: { type: "boolean" },
|
||||
},
|
||||
},
|
||||
},
|
||||
],
|
||||
},
|
||||
status: "ready",
|
||||
installOrder: 1,
|
||||
updatedAt: new Date(),
|
||||
} as any);
|
||||
const workerManager = {
|
||||
isRunning: vi.fn((id: string) => id === pluginId),
|
||||
call: vi.fn(async (_pluginId: string, method: string, params: any) => {
|
||||
expect(params.config.apiKey).toBe("resolved-provider-key");
|
||||
expect(params.config).not.toHaveProperty("provider");
|
||||
if (method === "environmentAcquireLease") {
|
||||
return {
|
||||
providerLeaseId: "sandbox-1",
|
||||
metadata: {
|
||||
provider: "secure-plugin",
|
||||
template: "base",
|
||||
apiKey: "resolved-provider-key",
|
||||
timeoutMs: 1234,
|
||||
reuseLease: false,
|
||||
sandboxId: "sandbox-1",
|
||||
remoteCwd: "/workspace",
|
||||
},
|
||||
};
|
||||
}
|
||||
if (method === "environmentExecute") {
|
||||
return {
|
||||
exitCode: 0,
|
||||
signal: null,
|
||||
timedOut: false,
|
||||
stdout: "ok\n",
|
||||
stderr: "",
|
||||
};
|
||||
}
|
||||
if (method === "environmentReleaseLease") {
|
||||
return undefined;
|
||||
}
|
||||
throw new Error(`Unexpected plugin method: ${method}`);
|
||||
}),
|
||||
} as unknown as PluginWorkerManager;
|
||||
const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
|
||||
|
||||
const acquired = await runtimeWithPlugin.acquireRunLease({
|
||||
companyId,
|
||||
environment,
|
||||
issueId: null,
|
||||
heartbeatRunId: runId,
|
||||
persistedExecutionWorkspace: null,
|
||||
});
|
||||
expect(acquired.lease.metadata).toMatchObject({
|
||||
provider: "secure-plugin",
|
||||
template: "base",
|
||||
apiKey: apiSecret.id,
|
||||
timeoutMs: 1234,
|
||||
sandboxId: "sandbox-1",
|
||||
});
|
||||
const executed = await runtimeWithPlugin.execute({
|
||||
environment,
|
||||
lease: acquired.lease,
|
||||
command: "printf",
|
||||
args: ["ok"],
|
||||
cwd: "/workspace",
|
||||
env: {},
|
||||
timeoutMs: 1000,
|
||||
});
|
||||
|
||||
await environmentService(db).update(environment.id, {
|
||||
driver: "local",
|
||||
config: {},
|
||||
});
|
||||
const released = await runtimeWithPlugin.releaseRunLeases(runId);
|
||||
|
||||
expect(executed.stdout).toBe("ok\n");
|
||||
expect(released).toHaveLength(1);
|
||||
expect(released[0]?.lease.status).toBe("released");
|
||||
expect(workerManager.call).toHaveBeenCalledWith(pluginId, "environmentExecute", expect.objectContaining({
|
||||
config: expect.objectContaining({
|
||||
apiKey: "resolved-provider-key",
|
||||
}),
|
||||
}));
|
||||
expect(workerManager.call).toHaveBeenCalledWith(pluginId, "environmentReleaseLease", expect.objectContaining({
|
||||
config: expect.objectContaining({
|
||||
apiKey: "resolved-provider-key",
|
||||
}),
|
||||
}));
|
||||
});
|
||||
|
||||
it("falls back to acquire when plugin-backed sandbox lease resume throws", async () => {
|
||||
const pluginId = randomUUID();
|
||||
const { companyId, environment: baseEnvironment, runId } = await seedEnvironment();
|
||||
const providerConfig = {
|
||||
provider: "fake-plugin",
|
||||
image: "fake:test",
|
||||
timeoutMs: 1234,
|
||||
reuseLease: true,
|
||||
};
|
||||
const environment = {
|
||||
...baseEnvironment,
|
||||
name: "Reusable Plugin Sandbox",
|
||||
driver: "sandbox",
|
||||
config: providerConfig,
|
||||
};
|
||||
await environmentService(db).update(environment.id, {
|
||||
driver: "sandbox",
|
||||
name: environment.name,
|
||||
config: providerConfig,
|
||||
});
|
||||
await db.insert(plugins).values({
|
||||
id: pluginId,
|
||||
pluginKey: "acme.fake-sandbox-provider",
|
||||
packageName: "@acme/fake-sandbox-provider",
|
||||
version: "1.0.0",
|
||||
apiVersion: 1,
|
||||
categories: ["automation"],
|
||||
manifestJson: {
|
||||
id: "acme.fake-sandbox-provider",
|
||||
apiVersion: 1,
|
||||
version: "1.0.0",
|
||||
displayName: "Fake Sandbox Provider",
|
||||
description: "Test schema-driven provider",
|
||||
author: "Paperclip",
|
||||
categories: ["automation"],
|
||||
capabilities: ["environment.drivers.register"],
|
||||
entrypoints: { worker: "dist/worker.js" },
|
||||
environmentDrivers: [
|
||||
{
|
||||
driverKey: "fake-plugin",
|
||||
kind: "sandbox_provider",
|
||||
displayName: "Fake Plugin",
|
||||
configSchema: {
|
||||
type: "object",
|
||||
properties: {
|
||||
image: { type: "string" },
|
||||
timeoutMs: { type: "number" },
|
||||
reuseLease: { type: "boolean" },
|
||||
},
|
||||
},
|
||||
},
|
||||
],
|
||||
},
|
||||
status: "ready",
|
||||
installOrder: 1,
|
||||
updatedAt: new Date(),
|
||||
} as any);
|
||||
await environmentService(db).acquireLease({
|
||||
companyId,
|
||||
environmentId: environment.id,
|
||||
heartbeatRunId: runId,
|
||||
leasePolicy: "reuse_by_environment",
|
||||
provider: "fake-plugin",
|
||||
providerLeaseId: "stale-plugin-lease",
|
||||
metadata: {
|
||||
provider: "fake-plugin",
|
||||
image: "fake:test",
|
||||
timeoutMs: 1234,
|
||||
reuseLease: true,
|
||||
},
|
||||
});
|
||||
|
||||
const workerManager = {
|
||||
isRunning: vi.fn((id: string) => id === pluginId),
|
||||
call: vi.fn(async (_pluginId: string, method: string) => {
|
||||
if (method === "environmentResumeLease") {
|
||||
throw new Error("stale sandbox");
|
||||
}
|
||||
if (method === "environmentAcquireLease") {
|
||||
return {
|
||||
providerLeaseId: "fresh-plugin-lease",
|
||||
metadata: {
|
||||
provider: "fake-plugin",
|
||||
image: "fake:test",
|
||||
timeoutMs: 1234,
|
||||
reuseLease: true,
|
||||
remoteCwd: "/workspace",
|
||||
},
|
||||
};
|
||||
}
|
||||
throw new Error(`Unexpected plugin method: ${method}`);
|
||||
}),
|
||||
} as unknown as PluginWorkerManager;
|
||||
const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
|
||||
|
||||
const acquired = await runtimeWithPlugin.acquireRunLease({
|
||||
companyId,
|
||||
environment,
|
||||
issueId: null,
|
||||
heartbeatRunId: runId,
|
||||
persistedExecutionWorkspace: null,
|
||||
});
|
||||
|
||||
expect(acquired.lease.providerLeaseId).toBe("fresh-plugin-lease");
|
||||
expect(workerManager.call).toHaveBeenNthCalledWith(1, pluginId, "environmentResumeLease", expect.objectContaining({
|
||||
driverKey: "fake-plugin",
|
||||
providerLeaseId: "stale-plugin-lease",
|
||||
}));
|
||||
expect(workerManager.call).toHaveBeenNthCalledWith(2, pluginId, "environmentAcquireLease", expect.objectContaining({
|
||||
driverKey: "fake-plugin",
|
||||
config: {
|
||||
image: "fake:test",
|
||||
timeoutMs: 1234,
|
||||
reuseLease: true,
|
||||
},
|
||||
runId,
|
||||
}));
|
||||
});
|
||||
|
||||
it("releases a sandbox run lease from metadata after the environment config changes", async () => {
|
||||
const { companyId, environment, runId } = await seedEnvironment({
|
||||
driver: "sandbox",
|
||||
|
|
|
|||
44
server/src/__tests__/json-schema-secret-refs.test.ts
Normal file
44
server/src/__tests__/json-schema-secret-refs.test.ts
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
import { describe, expect, it } from "vitest";
|
||||
import { collectSecretRefPaths } from "../services/json-schema-secret-refs.ts";
|
||||
|
||||
describe("collectSecretRefPaths", () => {
|
||||
it("collects nested secret-ref paths from object properties", () => {
|
||||
expect(Array.from(collectSecretRefPaths({
|
||||
type: "object",
|
||||
properties: {
|
||||
credentials: {
|
||||
type: "object",
|
||||
properties: {
|
||||
apiKey: { type: "string", format: "secret-ref" },
|
||||
},
|
||||
},
|
||||
},
|
||||
}))).toEqual(["credentials.apiKey"]);
|
||||
});
|
||||
|
||||
it("collects secret-ref paths from JSON Schema composition keywords", () => {
|
||||
expect(Array.from(collectSecretRefPaths({
|
||||
type: "object",
|
||||
allOf: [
|
||||
{
|
||||
properties: {
|
||||
apiKey: { type: "string", format: "secret-ref" },
|
||||
},
|
||||
},
|
||||
{
|
||||
properties: {
|
||||
nested: {
|
||||
oneOf: [
|
||||
{
|
||||
properties: {
|
||||
token: { type: "string", format: "secret-ref" },
|
||||
},
|
||||
},
|
||||
],
|
||||
},
|
||||
},
|
||||
},
|
||||
],
|
||||
})).sort()).toEqual(["apiKey", "nested.token"]);
|
||||
});
|
||||
});
|
||||
|
|
@ -109,6 +109,41 @@ describe("sandbox provider runtime", () => {
|
|||
).toBe("sandbox-image-b");
|
||||
});
|
||||
|
||||
it("matches reusable plugin leases by persisted config fields", () => {
|
||||
expect(
|
||||
findReusableSandboxProviderLeaseId({
|
||||
config: {
|
||||
provider: "secure-plugin",
|
||||
template: "template-b",
|
||||
apiKey: "22222222-2222-2222-2222-222222222222",
|
||||
timeoutMs: 300000,
|
||||
reuseLease: true,
|
||||
},
|
||||
leases: [
|
||||
{
|
||||
providerLeaseId: "sandbox-template-a",
|
||||
metadata: {
|
||||
provider: "secure-plugin",
|
||||
template: "template-a",
|
||||
apiKey: "11111111-1111-1111-1111-111111111111",
|
||||
reuseLease: true,
|
||||
},
|
||||
},
|
||||
{
|
||||
providerLeaseId: "sandbox-template-b",
|
||||
metadata: {
|
||||
provider: "secure-plugin",
|
||||
template: "template-b",
|
||||
apiKey: "22222222-2222-2222-2222-222222222222",
|
||||
timeoutMs: 300000,
|
||||
reuseLease: true,
|
||||
},
|
||||
},
|
||||
],
|
||||
}),
|
||||
).toBe("sandbox-template-b");
|
||||
});
|
||||
|
||||
it("reconstructs fake sandbox config from lease metadata for later release", () => {
|
||||
const metadata = {
|
||||
provider: "fake",
|
||||
|
|
@ -146,6 +181,31 @@ describe("sandbox provider runtime", () => {
|
|||
});
|
||||
});
|
||||
|
||||
it("reconstructs plugin-backed secret-ref config from lease metadata for later release", () => {
|
||||
expect(sandboxConfigFromLeaseMetadata({
|
||||
metadata: {
|
||||
provider: "secure-plugin",
|
||||
template: "paperclip-template",
|
||||
},
|
||||
})).toBeNull();
|
||||
|
||||
expect(sandboxConfigFromLeaseMetadataLoose({
|
||||
metadata: {
|
||||
provider: "secure-plugin",
|
||||
template: "paperclip-template",
|
||||
timeoutMs: 120000,
|
||||
reuseLease: true,
|
||||
apiKey: "11111111-1111-1111-1111-111111111111",
|
||||
},
|
||||
})).toEqual({
|
||||
provider: "secure-plugin",
|
||||
template: "paperclip-template",
|
||||
apiKey: "11111111-1111-1111-1111-111111111111",
|
||||
timeoutMs: 120000,
|
||||
reuseLease: true,
|
||||
});
|
||||
});
|
||||
|
||||
it("releases fake leases without external side effects", async () => {
|
||||
await expect(releaseSandboxProviderLease({
|
||||
config: {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue