feat: add managed SSH execution spaces
Add managed SSH Hosts and projects with signed side-by-side GoodBuddy Agent and OpenCode Runtime installation, Ask and Execute workspace access, a Main-owned model bridge, detached Agent lifecycle, durable ACP output recovery, and project activation UI. Use protocol v2 with bounded FIFO frames over SSH instead of custom credit, priority, batching, or model-message chunking. Mismatched Host Agents now upgrade automatically, an exactly verified Node runtime is reused on-host, and local Portable builds can embed strictly verified Agent artifacts. Release note: 新增托管 SSH 远程项目，可自动安装或升级签名 Agent/OpenCode Runtime，并在 SSH 断线后继续 Agent 工作和同步未确认输出。
This commit is contained in:
mesalogo
@@ -0,0 +1,372 @@
|
||||
import { mkdtemp, rm } from 'node:fs/promises'
|
||||
import { tmpdir } from 'node:os'
|
||||
import { join } from 'node:path'
|
||||
import { DatabaseSync } from 'node:sqlite'
|
||||
import { describe, expect, it, vi } from 'vitest'
|
||||
import type { AssistantProject } from '../../shared/assistant-contracts'
|
||||
import { AssistantDatabase } from '../assistant/assistant-database'
|
||||
import {
|
||||
ExecutionSpaceResolver,
|
||||
REMOTE_EXECUTION_SPACE_UNAVAILABLE
|
||||
} from './execution-space-resolver'
|
||||
|
||||
function project(
|
||||
overrides: Partial<AssistantProject> = {}
|
||||
): AssistantProject {
|
||||
return {
|
||||
id: '00000000-0000-4000-8000-000000000101',
|
||||
name: 'Project',
|
||||
description: '',
|
||||
rootPath: 'C:\\Workspace',
|
||||
executionSpace: {
|
||||
kind: 'local',
|
||||
rootPath: 'C:\\Workspace'
|
||||
},
|
||||
defaultWorkMode: 'ask',
|
||||
kind: 'user',
|
||||
status: 'active',
|
||||
createdAt: '2026-08-01T00:00:00.000Z',
|
||||
updatedAt: '2026-08-01T00:00:00.000Z',
|
||||
...overrides
|
||||
}
|
||||
}
|
||||
|
||||
describe('ExecutionSpaceResolver', () => {
|
||||
it('uses a stable local cache identity without accessing the workspace', () => {
|
||||
const resolver = new ExecutionSpaceResolver()
|
||||
const first = resolver.resolveProject(project())
|
||||
const second = resolver.resolveProject(project())
|
||||
|
||||
expect(first.kind).toBe('local')
|
||||
expect(second.cacheIdentity).toBe(first.cacheIdentity)
|
||||
expect(first.workspaceAccess).not.toBe(second.workspaceAccess)
|
||||
})
|
||||
|
||||
it('keeps every remote workspace operation fail closed', async () => {
|
||||
const resolver = new ExecutionSpaceResolver()
|
||||
const descriptor = resolver.resolveProject(
|
||||
project({
|
||||
rootPath: '/srv/project',
|
||||
executionSpace: {
|
||||
kind: 'ssh',
|
||||
hostId: '00000000-0000-4000-8000-000000000201',
|
||||
remoteRootPath: '/srv/project'
|
||||
}
|
||||
})
|
||||
)
|
||||
|
||||
expect(descriptor.kind).toBe('ssh')
|
||||
await expect(
|
||||
descriptor.workspaceAccess.listDirectory({ path: '' })
|
||||
).rejects.toThrow(REMOTE_EXECUTION_SPACE_UNAVAILABLE)
|
||||
await expect(
|
||||
descriptor.workspaceAccess.getChanges({})
|
||||
).rejects.toThrow(REMOTE_EXECUTION_SPACE_UNAVAILABLE)
|
||||
await expect(
|
||||
descriptor.workspaceAccess.writeTextAtomic({
|
||||
path: 'file.txt',
|
||||
content: 'no'
|
||||
})
|
||||
).rejects.toThrow(REMOTE_EXECUTION_SPACE_UNAVAILABLE)
|
||||
})
|
||||
|
||||
it('uses an injected remote factory only for complete matching validation', async () => {
|
||||
const workspaceAccess = {
|
||||
getIdentity: vi.fn(),
|
||||
listDirectory: vi.fn(),
|
||||
stat: vi.fn(),
|
||||
readText: vi.fn(),
|
||||
writeTextAtomic: vi.fn(),
|
||||
search: vi.fn(),
|
||||
getChanges: vi.fn(),
|
||||
dispose: vi.fn()
|
||||
}
|
||||
const factory = {
|
||||
create: vi.fn(() => workspaceAccess)
|
||||
}
|
||||
const validation = {
|
||||
hostRevision: 1,
|
||||
hostKeyGeneration: 2,
|
||||
remoteUsername: 'builder',
|
||||
workspaceIdentity: 'workspace-1',
|
||||
agentProtocolMajor: 1,
|
||||
agentInstallationIdAtValidation: 'agent-1',
|
||||
agentBinaryDigestAtValidation: `sha256:${'a'.repeat(64)}`,
|
||||
agentVersionAtValidation: '0.11.0',
|
||||
agentArchitectureAtValidation: 'x64' as const,
|
||||
validatedAt: '2026-08-01T00:00:00.000Z'
|
||||
}
|
||||
const runtimeValidation = {
|
||||
runtimeSelectionKey: 'opencode',
|
||||
runtimeBundleDigest: `sha256:${'b'.repeat(64)}`,
|
||||
runtimeAdapterDigest: `sha256:${'c'.repeat(64)}`,
|
||||
agentInstallationIdAtValidation: 'agent-1',
|
||||
validatedAt: '2026-08-01T00:00:00.000Z',
|
||||
workMode: 'ask' as const
|
||||
}
|
||||
const resolver = new ExecutionSpaceResolver(factory)
|
||||
const descriptor = resolver.resolveProject(
|
||||
project({
|
||||
rootPath: '/srv/project',
|
||||
executionSpace: {
|
||||
kind: 'ssh',
|
||||
hostId: '00000000-0000-4000-8000-000000000201',
|
||||
remoteRootPath: '/srv/project',
|
||||
validation
|
||||
},
|
||||
runtimeValidation
|
||||
})
|
||||
)
|
||||
|
||||
expect(descriptor.workspaceAccess).toBe(workspaceAccess)
|
||||
expect(descriptor).toMatchObject({
|
||||
kind: 'ssh',
|
||||
validation: {
|
||||
agentInstallationIdAtValidation: 'agent-1',
|
||||
agentBinaryDigestAtValidation: `sha256:${'a'.repeat(64)}`,
|
||||
agentVersionAtValidation: '0.11.0',
|
||||
agentArchitectureAtValidation: 'x64'
|
||||
},
|
||||
runtimeValidation
|
||||
})
|
||||
expect(factory.create).toHaveBeenCalledWith({
|
||||
hostId: '00000000-0000-4000-8000-000000000201',
|
||||
remoteRootPath: '/srv/project',
|
||||
hostRevision: 1,
|
||||
hostKeyGeneration: 2,
|
||||
remoteUsername: 'builder',
|
||||
workspaceIdentity: 'workspace-1',
|
||||
agentProtocolMajor: 1,
|
||||
agentInstallationId: 'agent-1',
|
||||
agentBinaryDigest: `sha256:${'a'.repeat(64)}`,
|
||||
agentVersion: '0.11.0',
|
||||
agentArchitecture: 'x64'
|
||||
})
|
||||
|
||||
const stale = resolver.resolveProject(
|
||||
project({
|
||||
rootPath: '/srv/project',
|
||||
executionSpace: {
|
||||
kind: 'ssh',
|
||||
hostId: '00000000-0000-4000-8000-000000000201',
|
||||
remoteRootPath: '/srv/project',
|
||||
validation
|
||||
},
|
||||
runtimeValidation: {
|
||||
...runtimeValidation,
|
||||
agentInstallationIdAtValidation: 'agent-2'
|
||||
}
|
||||
})
|
||||
)
|
||||
await expect(stale.workspaceAccess.getIdentity()).rejects.toThrow(
|
||||
REMOTE_EXECUTION_SPACE_UNAVAILABLE
|
||||
)
|
||||
|
||||
expect(factory.create).toHaveBeenCalledOnce()
|
||||
})
|
||||
|
||||
it('includes remote Host, Agent, Runtime, and work-mode identities in the cache identity', () => {
|
||||
const resolver = new ExecutionSpaceResolver()
|
||||
const baseValidation = {
|
||||
hostRevision: 1,
|
||||
hostKeyGeneration: 2,
|
||||
remoteUsername: 'builder',
|
||||
workspaceIdentity: 'workspace-1',
|
||||
agentProtocolMajor: 1,
|
||||
agentInstallationIdAtValidation: 'agent-1',
|
||||
agentBinaryDigestAtValidation: `sha256:${'a'.repeat(64)}`,
|
||||
agentVersionAtValidation: '0.11.0',
|
||||
agentArchitectureAtValidation: 'x64' as const,
|
||||
validatedAt: '2026-08-01T00:00:00.000Z'
|
||||
}
|
||||
const runtimeValidation = {
|
||||
runtimeSelectionKey: 'opencode',
|
||||
runtimeBundleDigest: `sha256:${'b'.repeat(64)}`,
|
||||
runtimeAdapterDigest: `sha256:${'c'.repeat(64)}`,
|
||||
agentInstallationIdAtValidation: 'agent-1',
|
||||
validatedAt: '2026-08-01T00:00:00.000Z',
|
||||
workMode: 'ask' as const
|
||||
}
|
||||
const first = resolver.resolveProject(
|
||||
project({
|
||||
rootPath: '/srv/project',
|
||||
executionSpace: {
|
||||
kind: 'ssh',
|
||||
hostId: '00000000-0000-4000-8000-000000000201',
|
||||
remoteRootPath: '/srv/project',
|
||||
validation: baseValidation
|
||||
},
|
||||
runtimeValidation
|
||||
})
|
||||
)
|
||||
const second = resolver.resolveProject(
|
||||
project({
|
||||
rootPath: '/srv/project',
|
||||
executionSpace: {
|
||||
kind: 'ssh',
|
||||
hostId: '00000000-0000-4000-8000-000000000201',
|
||||
remoteRootPath: '/srv/project',
|
||||
validation: {
|
||||
...baseValidation,
|
||||
hostRevision: 2
|
||||
}
|
||||
},
|
||||
runtimeValidation
|
||||
})
|
||||
)
|
||||
|
||||
expect(second.cacheIdentity).not.toBe(first.cacheIdentity)
|
||||
|
||||
for (const validation of [
|
||||
{
|
||||
...baseValidation,
|
||||
agentBinaryDigestAtValidation: `sha256:${'b'.repeat(64)}`
|
||||
},
|
||||
{
|
||||
...baseValidation,
|
||||
agentVersionAtValidation: '0.11.1'
|
||||
},
|
||||
{
|
||||
...baseValidation,
|
||||
agentArchitectureAtValidation: 'arm64' as const
|
||||
}
|
||||
]) {
|
||||
const changed = resolver.resolveProject(
|
||||
project({
|
||||
rootPath: '/srv/project',
|
||||
executionSpace: {
|
||||
kind: 'ssh',
|
||||
hostId: '00000000-0000-4000-8000-000000000201',
|
||||
remoteRootPath: '/srv/project',
|
||||
validation
|
||||
},
|
||||
runtimeValidation
|
||||
})
|
||||
)
|
||||
expect(changed.cacheIdentity).not.toBe(first.cacheIdentity)
|
||||
}
|
||||
|
||||
for (const changedRuntimeValidation of [
|
||||
{
|
||||
...runtimeValidation,
|
||||
workMode: 'execute' as const
|
||||
}
|
||||
]) {
|
||||
const changed = resolver.resolveProject(
|
||||
project({
|
||||
rootPath: '/srv/project',
|
||||
executionSpace: {
|
||||
kind: 'ssh',
|
||||
hostId: '00000000-0000-4000-8000-000000000201',
|
||||
remoteRootPath: '/srv/project',
|
||||
validation: baseValidation
|
||||
},
|
||||
runtimeValidation: changedRuntimeValidation
|
||||
})
|
||||
)
|
||||
expect(changed.cacheIdentity).not.toBe(first.cacheIdentity)
|
||||
}
|
||||
})
|
||||
|
||||
it('changes DB-backed cache identity for host and Runtime generations', async () => {
|
||||
const directory = await mkdtemp(
|
||||
join(tmpdir(), 'goodbuddy-execution-resolver-')
|
||||
)
|
||||
const databasePath = join(directory, 'assistant.sqlite')
|
||||
const database = new AssistantDatabase(databasePath)
|
||||
const raw = new DatabaseSync(databasePath)
|
||||
try {
|
||||
database.initialize('C:\\Workspace')
|
||||
const projectId = database.listProjects()[0]!.id
|
||||
raw
|
||||
.prepare(
|
||||
`UPDATE project_execution_spaces
|
||||
SET kind = 'ssh', root_path = ?, ssh_host_id = ?,
|
||||
host_revision = ?, host_key_generation = ?,
|
||||
remote_username = ?, workspace_identity = ?,
|
||||
agent_installation_id_at_validation = ?,
|
||||
agent_binary_digest_at_validation = ?,
|
||||
agent_version_at_validation = ?,
|
||||
agent_architecture_at_validation = ?,
|
||||
agent_protocol_major = ?,
|
||||
trust_attestation_revision = ?, validated_at = ?
|
||||
WHERE project_id = ?`
|
||||
)
|
||||
.run(
|
||||
'/srv/project',
|
||||
'00000000-0000-4000-8000-000000000201',
|
||||
1,
|
||||
1,
|
||||
'builder',
|
||||
'workspace-1',
|
||||
'agent-1',
|
||||
`sha256:${'a'.repeat(64)}`,
|
||||
'0.11.0',
|
||||
'x64',
|
||||
1,
|
||||
0,
|
||||
'2026-08-01T00:00:00.000Z',
|
||||
projectId
|
||||
)
|
||||
raw
|
||||
.prepare(
|
||||
`INSERT INTO project_runtime_validations
|
||||
(project_id, runtime_selection_key,
|
||||
runtime_bundle_digest, runtime_adapter_digest,
|
||||
confinement_policy_digest, approval_bridge_version,
|
||||
agent_installation_id_at_validation, validated_at,
|
||||
work_mode, trust_tier, trust_attestation_revision)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
|
||||
)
|
||||
.run(
|
||||
projectId,
|
||||
'opencode',
|
||||
`sha256:${'b'.repeat(64)}`,
|
||||
`sha256:${'c'.repeat(64)}`,
|
||||
`sha256:${'c'.repeat(64)}`,
|
||||
'unused',
|
||||
'agent-1',
|
||||
'2026-08-01T00:00:00.000Z',
|
||||
'ask',
|
||||
null,
|
||||
null
|
||||
)
|
||||
|
||||
const resolver = new ExecutionSpaceResolver()
|
||||
const baseline = resolver.resolveProject(
|
||||
database.getProject(projectId)
|
||||
)
|
||||
raw
|
||||
.prepare(
|
||||
`UPDATE project_execution_spaces
|
||||
SET host_key_generation = 2
|
||||
WHERE project_id = ?`
|
||||
)
|
||||
.run(projectId)
|
||||
const nextHostGeneration = resolver.resolveProject(
|
||||
database.getProject(projectId)
|
||||
)
|
||||
raw
|
||||
.prepare(
|
||||
`UPDATE project_runtime_validations
|
||||
SET runtime_bundle_digest = ?
|
||||
WHERE project_id = ?`
|
||||
)
|
||||
.run(`sha256:${'e'.repeat(64)}`, projectId)
|
||||
const nextRuntimeGeneration = resolver.resolveProject(
|
||||
database.getProject(projectId)
|
||||
)
|
||||
|
||||
expect(nextHostGeneration.cacheIdentity).not.toBe(
|
||||
baseline.cacheIdentity
|
||||
)
|
||||
expect(nextRuntimeGeneration.cacheIdentity).not.toBe(
|
||||
nextHostGeneration.cacheIdentity
|
||||
)
|
||||
} finally {
|
||||
raw.close()
|
||||
database.close()
|
||||
await rm(directory, { recursive: true, force: true })
|
||||
}
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,167 @@
|
||||
import { isAbsolute, normalize, resolve } from 'node:path'
|
||||
import type {
|
||||
AssistantProject,
|
||||
ProjectRuntimeValidation,
|
||||
SshExecutionValidation
|
||||
} from '../../shared/assistant-contracts'
|
||||
import {
|
||||
LocalWorkspaceAccess,
|
||||
UnsupportedRemoteWorkspaceAccess,
|
||||
type RemoteWorkspaceAccessFactory,
|
||||
type RemoteWorkspaceProjectBinding,
|
||||
type WorkspaceAccess
|
||||
} from '../workspace'
|
||||
|
||||
export const REMOTE_EXECUTION_SPACE_UNAVAILABLE =
|
||||
'远程执行空间尚不可用'
|
||||
|
||||
export type LocalExecutionSpaceDescriptor = {
|
||||
kind: 'local'
|
||||
rootPath: string
|
||||
cacheIdentity: string
|
||||
routeIdentity: string
|
||||
workspaceAccess: WorkspaceAccess
|
||||
}
|
||||
|
||||
export type SshExecutionSpaceDescriptor = {
|
||||
kind: 'ssh'
|
||||
hostId: string
|
||||
remoteRootPath: string
|
||||
validation?: SshExecutionValidation
|
||||
runtimeValidation?: ProjectRuntimeValidation
|
||||
cacheIdentity: string
|
||||
routeIdentity: string
|
||||
workspaceAccess: WorkspaceAccess
|
||||
}
|
||||
|
||||
export type ExecutionSpaceDescriptor =
|
||||
| LocalExecutionSpaceDescriptor
|
||||
| SshExecutionSpaceDescriptor
|
||||
|
||||
function normalizeLocalIdentity(rootPath: string): string {
|
||||
const trimmed = rootPath.trim()
|
||||
if (!trimmed) {
|
||||
return 'local:unconfigured'
|
||||
}
|
||||
const normalized = normalize(
|
||||
isAbsolute(trimmed) ? trimmed : resolve(trimmed)
|
||||
)
|
||||
return `local:${
|
||||
process.platform === 'win32'
|
||||
? normalized.toLocaleLowerCase('en-US')
|
||||
: normalized
|
||||
}`
|
||||
}
|
||||
|
||||
export class ExecutionSpaceResolver {
|
||||
constructor(
|
||||
private readonly remoteWorkspaceAccessFactory?:
|
||||
RemoteWorkspaceAccessFactory
|
||||
) {}
|
||||
|
||||
resolveLocal(rootPath: string): LocalExecutionSpaceDescriptor {
|
||||
const cacheIdentity = normalizeLocalIdentity(rootPath)
|
||||
return {
|
||||
kind: 'local',
|
||||
rootPath,
|
||||
cacheIdentity,
|
||||
routeIdentity: cacheIdentity,
|
||||
workspaceAccess: new LocalWorkspaceAccess(rootPath)
|
||||
}
|
||||
}
|
||||
|
||||
resolveProject(project: AssistantProject): ExecutionSpaceDescriptor {
|
||||
const executionSpace = project.executionSpace ?? {
|
||||
kind: 'local' as const,
|
||||
rootPath: project.rootPath
|
||||
}
|
||||
if (executionSpace.kind === 'local') {
|
||||
return this.resolveLocal(executionSpace.rootPath)
|
||||
}
|
||||
|
||||
const sshValidation = executionSpace.validation
|
||||
const runtimeValidation = project.runtimeValidation
|
||||
const identity = {
|
||||
hostId: executionSpace.hostId,
|
||||
remoteRootPath: executionSpace.remoteRootPath,
|
||||
validation: sshValidation,
|
||||
runtimeValidation
|
||||
}
|
||||
const remoteBinding: RemoteWorkspaceProjectBinding | undefined =
|
||||
sshValidation &&
|
||||
runtimeValidation &&
|
||||
sshValidation.agentInstallationIdAtValidation ===
|
||||
runtimeValidation.agentInstallationIdAtValidation
|
||||
? {
|
||||
hostId: executionSpace.hostId,
|
||||
remoteRootPath: executionSpace.remoteRootPath,
|
||||
hostRevision: sshValidation.hostRevision,
|
||||
hostKeyGeneration: sshValidation.hostKeyGeneration,
|
||||
remoteUsername: sshValidation.remoteUsername,
|
||||
workspaceIdentity: sshValidation.workspaceIdentity,
|
||||
agentProtocolMajor: sshValidation.agentProtocolMajor,
|
||||
agentInstallationId:
|
||||
sshValidation.agentInstallationIdAtValidation,
|
||||
agentBinaryDigest:
|
||||
sshValidation.agentBinaryDigestAtValidation,
|
||||
agentVersion: sshValidation.agentVersionAtValidation,
|
||||
agentArchitecture:
|
||||
sshValidation.agentArchitectureAtValidation
|
||||
}
|
||||
: undefined
|
||||
return {
|
||||
kind: 'ssh',
|
||||
...identity,
|
||||
cacheIdentity: JSON.stringify([
|
||||
'ssh',
|
||||
identity.hostId,
|
||||
identity.remoteRootPath,
|
||||
identity.validation
|
||||
? [
|
||||
identity.validation.hostRevision,
|
||||
identity.validation.hostKeyGeneration,
|
||||
identity.validation.remoteUsername,
|
||||
identity.validation.workspaceIdentity,
|
||||
identity.validation.agentProtocolMajor,
|
||||
identity.validation.agentInstallationIdAtValidation,
|
||||
identity.validation.agentBinaryDigestAtValidation,
|
||||
identity.validation.agentVersionAtValidation,
|
||||
identity.validation.agentArchitectureAtValidation,
|
||||
identity.validation.validatedAt
|
||||
]
|
||||
: null,
|
||||
identity.runtimeValidation
|
||||
? [
|
||||
identity.runtimeValidation.runtimeSelectionKey,
|
||||
identity.runtimeValidation.runtimeBundleDigest,
|
||||
identity.runtimeValidation.runtimeAdapterDigest,
|
||||
identity.runtimeValidation
|
||||
.agentInstallationIdAtValidation,
|
||||
identity.runtimeValidation.validatedAt,
|
||||
identity.runtimeValidation.workMode
|
||||
]
|
||||
: null
|
||||
]),
|
||||
routeIdentity: JSON.stringify([
|
||||
'ssh',
|
||||
project.id,
|
||||
identity.hostId,
|
||||
identity.remoteRootPath
|
||||
]),
|
||||
workspaceAccess:
|
||||
remoteBinding && this.remoteWorkspaceAccessFactory
|
||||
? this.remoteWorkspaceAccessFactory.create(remoteBinding)
|
||||
: new UnsupportedRemoteWorkspaceAccess(
|
||||
REMOTE_EXECUTION_SPACE_UNAVAILABLE
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
assertLocal(
|
||||
descriptor: ExecutionSpaceDescriptor
|
||||
): asserts descriptor is LocalExecutionSpaceDescriptor {
|
||||
if (descriptor.kind !== 'local') {
|
||||
throw new Error(REMOTE_EXECUTION_SPACE_UNAVAILABLE)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,9 @@
|
||||
export {
|
||||
ExecutionSpaceResolver,
|
||||
REMOTE_EXECUTION_SPACE_UNAVAILABLE
|
||||
} from './execution-space-resolver'
|
||||
export type {
|
||||
ExecutionSpaceDescriptor,
|
||||
LocalExecutionSpaceDescriptor,
|
||||
SshExecutionSpaceDescriptor
|
||||
} from './execution-space-resolver'
|
||||
@@ -0,0 +1,91 @@
|
||||
import { describe, expect, it } from 'vitest'
|
||||
import type { SshExecutionSpaceDescriptor } from './execution-space-resolver'
|
||||
import { assertRemoteRuntimeRequestValidated } from './remote-runtime-request-validation'
|
||||
|
||||
const digest = `sha256:${'a'.repeat(64)}`
|
||||
|
||||
function descriptor(): SshExecutionSpaceDescriptor {
|
||||
return {
|
||||
kind: 'ssh',
|
||||
hostId: 'host-1',
|
||||
remoteRootPath: '/srv/project',
|
||||
validation: {
|
||||
hostRevision: 1,
|
||||
hostKeyGeneration: 1,
|
||||
remoteUsername: 'builder',
|
||||
workspaceIdentity: 'workspace-1',
|
||||
agentProtocolMajor: 1,
|
||||
agentInstallationIdAtValidation: 'installation-1',
|
||||
agentBinaryDigestAtValidation: digest,
|
||||
agentVersionAtValidation: '1.0.0',
|
||||
agentArchitectureAtValidation: 'x64',
|
||||
validatedAt: '2026-08-21T00:00:00.000Z'
|
||||
},
|
||||
runtimeValidation: {
|
||||
runtimeSelectionKey: 'opencode:default',
|
||||
runtimeBundleDigest: digest,
|
||||
runtimeAdapterDigest: digest,
|
||||
agentInstallationIdAtValidation: 'installation-1',
|
||||
validatedAt: '2026-08-21T00:00:00.000Z',
|
||||
workMode: 'ask'
|
||||
},
|
||||
cacheIdentity: 'ssh-cache',
|
||||
routeIdentity: 'ssh-route',
|
||||
workspaceAccess: {} as SshExecutionSpaceDescriptor['workspaceAccess']
|
||||
}
|
||||
}
|
||||
|
||||
describe('assertRemoteRuntimeRequestValidated', () => {
|
||||
it('accepts the exact persisted Runtime, Agent, and work mode', () => {
|
||||
expect(() =>
|
||||
assertRemoteRuntimeRequestValidated(
|
||||
descriptor(),
|
||||
{ provider: 'opencode' },
|
||||
'ask'
|
||||
)
|
||||
).not.toThrow()
|
||||
})
|
||||
|
||||
it('rejects Runtime selection and work-mode reuse', () => {
|
||||
expect(() =>
|
||||
assertRemoteRuntimeRequestValidated(
|
||||
descriptor(),
|
||||
{
|
||||
provider: 'opencode',
|
||||
profileId: '00000000-0000-4000-8000-000000000001'
|
||||
},
|
||||
'ask'
|
||||
)
|
||||
).toThrow('Runtime 选择已变化')
|
||||
expect(() =>
|
||||
assertRemoteRuntimeRequestValidated(
|
||||
descriptor(),
|
||||
{ provider: 'opencode' },
|
||||
'execute'
|
||||
)
|
||||
).toThrow('仅验证了 Ask')
|
||||
})
|
||||
|
||||
it('rejects missing or cross-installation evidence', () => {
|
||||
expect(() =>
|
||||
assertRemoteRuntimeRequestValidated(
|
||||
{ ...descriptor(), runtimeValidation: undefined },
|
||||
{ provider: 'opencode' },
|
||||
'ask'
|
||||
)
|
||||
).toThrow('缺少完整')
|
||||
expect(() =>
|
||||
assertRemoteRuntimeRequestValidated(
|
||||
{
|
||||
...descriptor(),
|
||||
runtimeValidation: {
|
||||
...descriptor().runtimeValidation!,
|
||||
agentInstallationIdAtValidation: 'installation-2'
|
||||
}
|
||||
},
|
||||
{ provider: 'opencode' },
|
||||
'ask'
|
||||
)
|
||||
).toThrow('缺少完整')
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,38 @@
|
||||
import type { WorkMode } from '../../shared/assistant-contracts'
|
||||
import {
|
||||
agentRuntimeSelectionKey,
|
||||
type AgentRuntimeSelection
|
||||
} from '../../shared/runtime-selection-contracts'
|
||||
import type { SshExecutionSpaceDescriptor } from './execution-space-resolver'
|
||||
|
||||
/**
|
||||
* Prevents a request from reusing persisted remote Runtime evidence under a
|
||||
* different Runtime selection, work mode, or Agent install.
|
||||
*/
|
||||
export function assertRemoteRuntimeRequestValidated(
|
||||
executionSpace: SshExecutionSpaceDescriptor,
|
||||
selection: AgentRuntimeSelection,
|
||||
workMode: WorkMode
|
||||
): void {
|
||||
const executionValidation = executionSpace.validation
|
||||
const runtimeValidation = executionSpace.runtimeValidation
|
||||
if (
|
||||
!executionValidation ||
|
||||
!runtimeValidation ||
|
||||
executionValidation.agentInstallationIdAtValidation !==
|
||||
runtimeValidation.agentInstallationIdAtValidation
|
||||
) {
|
||||
throw new Error('远程 Project 缺少完整的当前验证，请重新验证')
|
||||
}
|
||||
if (
|
||||
runtimeValidation.runtimeSelectionKey !==
|
||||
agentRuntimeSelectionKey(selection)
|
||||
) {
|
||||
throw new Error('远程 Project 的 Runtime 选择已变化，请重新验证')
|
||||
}
|
||||
if (runtimeValidation.workMode !== workMode) {
|
||||
throw new Error(
|
||||
`远程 Project 仅验证了 ${runtimeValidation.workMode === 'ask' ? 'Ask' : 'Execute'} 模式，请先重新验证工作模式`
|
||||
)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user