mesalogo
607bb33249
Add managed SSH Hosts and projects with signed side-by-side GoodBuddy Agent and OpenCode Runtime installation, Ask and Execute workspace access, a Main-owned model bridge, detached Agent lifecycle, durable ACP output recovery, and project activation UI. Use protocol v2 with bounded FIFO frames over SSH instead of custom credit, priority, batching, or model-message chunking. Mismatched Host Agents now upgrade automatically, an exactly verified Node runtime is reused on-host, and local Portable builds can embed strictly verified Agent artifacts. Release note: 新增托管 SSH 远程项目，可自动安装或升级签名 Agent/OpenCode Runtime，并在 SSH 断线后继续 Agent 工作和同步未确认输出。
360 lines
10 KiB
TypeScript
360 lines
10 KiB
TypeScript
import { readFileSync } from 'node:fs'
|
|
import { join } from 'node:path'
|
|
import { describe, expect, it } from 'vitest'
|
|
import { parse } from 'yaml'
|
|
|
|
const workflow = readFileSync(
|
|
join(process.cwd(), '.github', 'workflows', 'packages.yml'),
|
|
'utf8'
|
|
)
|
|
const runtimeLock = JSON.parse(
|
|
readFileSync(
|
|
join(process.cwd(), 'agent-runtime-lock.json'),
|
|
'utf8'
|
|
)
|
|
) as {
|
|
node: {
|
|
version: string
|
|
source: string
|
|
targets: Record<
|
|
string,
|
|
{
|
|
archive: string
|
|
sha256: string
|
|
}
|
|
>
|
|
}
|
|
}
|
|
const parsedWorkflow = parse(workflow) as {
|
|
jobs: Record<
|
|
string,
|
|
{
|
|
needs?: string | string[]
|
|
strategy?: {
|
|
matrix?: {
|
|
include?: Array<Record<string, unknown>>
|
|
}
|
|
}
|
|
steps?: Array<{
|
|
name?: string
|
|
run?: string
|
|
uses?: string
|
|
with?: Record<string, unknown>
|
|
}>
|
|
}
|
|
>
|
|
}
|
|
|
|
function serializedJob(name: string): string {
|
|
return JSON.stringify(parsedWorkflow.jobs[name])
|
|
}
|
|
|
|
function jobScripts(name: string): string {
|
|
return (
|
|
parsedWorkflow.jobs[name]?.steps
|
|
?.map((step) => step.run ?? '')
|
|
.join('\n') ?? ''
|
|
)
|
|
}
|
|
|
|
function jobSteps(
|
|
name: string
|
|
): NonNullable<
|
|
(typeof parsedWorkflow.jobs)[string]['steps']
|
|
> {
|
|
return parsedWorkflow.jobs[name]?.steps ?? []
|
|
}
|
|
|
|
function jobNeeds(name: string): string[] {
|
|
const needs = parsedWorkflow.jobs[name]?.needs
|
|
return needs === undefined
|
|
? []
|
|
: Array.isArray(needs)
|
|
? needs
|
|
: [needs]
|
|
}
|
|
|
|
describe('packages workflow', () => {
|
|
it('uses valid YAML and Node.js 24 GitHub Actions', () => {
|
|
expect(() => parse(workflow)).not.toThrow()
|
|
|
|
const references = [
|
|
...workflow.matchAll(
|
|
/uses:\s+(actions\/(?:checkout|setup-node|cache|upload-artifact|download-artifact)@v\d+)/gu
|
|
)
|
|
].map((match) => match[1])
|
|
|
|
expect(new Set(references)).toEqual(
|
|
new Set([
|
|
'actions/checkout@v7',
|
|
'actions/setup-node@v7',
|
|
'actions/cache@v6',
|
|
'actions/upload-artifact@v7',
|
|
'actions/download-artifact@v8'
|
|
])
|
|
)
|
|
const setupNodeVersions = Object.values(parsedWorkflow.jobs)
|
|
.flatMap((job) => job.steps ?? [])
|
|
.filter((step) => step.uses === 'actions/setup-node@v7')
|
|
.map((step) => step.with?.['node-version'])
|
|
|
|
expect(setupNodeVersions.length).toBeGreaterThanOrEqual(4)
|
|
expect(new Set(setupNodeVersions)).toEqual(
|
|
new Set([runtimeLock.node.version])
|
|
)
|
|
})
|
|
|
|
it('builds signed Agent bundles natively before the release package matrix', () => {
|
|
const runtimeJob = serializedJob('agent-runtime')
|
|
const signingJob = serializedJob('agent-signing')
|
|
const signingMatrix =
|
|
parsedWorkflow.jobs['agent-signing']?.strategy?.matrix
|
|
?.include ?? []
|
|
const packageDownload = jobSteps('package').find(
|
|
(step) =>
|
|
step.uses === 'actions/download-artifact@v8' &&
|
|
step.with?.pattern !== undefined
|
|
)
|
|
|
|
expect(signingMatrix).toContainEqual(
|
|
expect.objectContaining({
|
|
arch: 'arm64',
|
|
runner: 'ubuntu-24.04-arm'
|
|
})
|
|
)
|
|
expect(signingJob).toContain(
|
|
'GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY'
|
|
)
|
|
expect(signingJob).toContain(
|
|
'Preflight production Agent signing registry'
|
|
)
|
|
expect(signingJob).toContain(
|
|
'node build/agent-bundle.cjs preflight'
|
|
)
|
|
for (const target of Object.values(runtimeLock.node.targets)) {
|
|
expect(runtimeJob).toContain(target.archive)
|
|
}
|
|
expect(packageDownload?.with?.pattern).toBe(
|
|
'goodbuddy-agent-linux-*'
|
|
)
|
|
const packageScripts = jobScripts('package')
|
|
for (const targetName of Object.keys(runtimeLock.node.targets)) {
|
|
expect(packageScripts).toContain(
|
|
`--archive dist/agent-downloads/goodbuddy-agent-${targetName}.tar`
|
|
)
|
|
}
|
|
expect(jobNeeds('package')).toEqual(
|
|
expect.arrayContaining(['validate', 'agent-signing'])
|
|
)
|
|
})
|
|
|
|
it('imports Agent artifacts before invoking the explicit release packager', () => {
|
|
const scripts = jobScripts('package')
|
|
const importIndex = scripts.indexOf(
|
|
'node build/agent-bundle.cjs import'
|
|
)
|
|
const releaseIndex = scripts.indexOf(
|
|
'npm run release:package'
|
|
)
|
|
|
|
expect(importIndex).toBeGreaterThanOrEqual(0)
|
|
expect(releaseIndex).toBeGreaterThan(importIndex)
|
|
expect(scripts).not.toContain('npm run dist')
|
|
expect(scripts).not.toContain('npm run portable')
|
|
})
|
|
|
|
it('authorizes signing only for protected-main commits and matching immutable version tags', () => {
|
|
const authorization = serializedJob(
|
|
'authorize-agent-signing'
|
|
)
|
|
const policy = jobScripts('authorize-agent-signing')
|
|
|
|
expect(authorization).toContain(
|
|
"github.ref == 'refs/heads/main'"
|
|
)
|
|
expect(policy).toContain(
|
|
'git merge-base --is-ancestor'
|
|
)
|
|
expect(policy).toContain(
|
|
"require('./package.json').version"
|
|
)
|
|
expect(policy).toContain(
|
|
'GITHUB_EVENT_PATH).created'
|
|
)
|
|
expect(policy).toContain(
|
|
'GITHUB_EVENT_PATH).forced'
|
|
)
|
|
expect(policy).toContain(
|
|
'GITHUB_EVENT_PATH).deleted'
|
|
)
|
|
expect(policy).toContain(
|
|
'test "$GITHUB_REF" = "refs/tags/$expected"'
|
|
)
|
|
expect(policy).toContain(
|
|
'git cat-file -t "refs/tags/$GITHUB_REF_NAME"'
|
|
)
|
|
expect(policy).toContain(
|
|
'refs/tags/$GITHUB_REF_NAME^{commit}'
|
|
)
|
|
expect(policy).toContain(
|
|
'test "$GITHUB_REF" = "refs/heads/main"'
|
|
)
|
|
expect(policy).toContain(
|
|
'test "$GITHUB_SHA" = "$(git rev-parse refs/remotes/origin/main)"'
|
|
)
|
|
expect(policy).toContain(
|
|
'echo "authorized=true" >> "$GITHUB_OUTPUT"'
|
|
)
|
|
})
|
|
|
|
it('gates the only Agent private-key step behind the protected signing environment', () => {
|
|
const signing = serializedJob('agent-signing')
|
|
|
|
expect(signing).toContain('"name":"agent-signing"')
|
|
expect(signing).toContain(
|
|
'"authorize-agent-signing"'
|
|
)
|
|
expect(signing).toContain(
|
|
"needs.authorize-agent-signing.outputs.authorized == 'true'"
|
|
)
|
|
expect(signing).toContain(
|
|
'${{ secrets.GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY }}'
|
|
)
|
|
expect(signing.indexOf('Preflight production Agent signing registry'))
|
|
.toBeLessThan(
|
|
signing.indexOf(
|
|
'${{ secrets.GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY }}'
|
|
)
|
|
)
|
|
expect(signing).not.toContain('"cache"')
|
|
expect(signing).not.toContain('actions/cache')
|
|
expect(
|
|
workflow.match(
|
|
/\$\{\{\s*secrets\.GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY\s*\}\}/gu
|
|
)
|
|
).toHaveLength(1)
|
|
})
|
|
|
|
it('keeps production signing inputs out of arbitrary-ref jobs', () => {
|
|
for (const name of [
|
|
'validate',
|
|
'authorize-agent-signing',
|
|
'agent-runtime'
|
|
]) {
|
|
expect(serializedJob(name)).not.toContain('secrets.')
|
|
expect(serializedJob(name)).not.toContain(
|
|
'GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY'
|
|
)
|
|
}
|
|
|
|
expect(serializedJob('validate')).not.toContain(
|
|
'GOODBUDDY_AGENT_SIGNING_KEY_ID'
|
|
)
|
|
expect(serializedJob('authorize-agent-signing')).not.toContain(
|
|
'GOODBUDDY_AGENT_SIGNING_KEY_ID'
|
|
)
|
|
})
|
|
|
|
it('preserves unsigned validation while rejecting arbitrary refs from release jobs', () => {
|
|
const validation = serializedJob('validate')
|
|
const authorization = serializedJob(
|
|
'authorize-agent-signing'
|
|
)
|
|
|
|
expect(validation).toContain('npm test')
|
|
expect(validation).toContain('npm run typecheck')
|
|
expect(validation).toContain('npm run lint')
|
|
expect(validation).toContain('npm run build:bundle')
|
|
expect(authorization).toContain(
|
|
"github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'"
|
|
)
|
|
expect(authorization).not.toContain(
|
|
"github.event_name == 'workflow_dispatch' || github.ref_type == 'tag'"
|
|
)
|
|
expect(serializedJob('package')).toContain(
|
|
"needs.authorize-agent-signing.outputs.authorized == 'true'"
|
|
)
|
|
})
|
|
|
|
it('acquires every locked Agent runtime securely on cold runners', () => {
|
|
const runtimeJob = serializedJob('agent-runtime')
|
|
const runtimeScripts = jobScripts('agent-runtime')
|
|
const signingJob = serializedJob('agent-signing')
|
|
const runtimeUses = jobSteps('agent-runtime')
|
|
.map((step) => step.uses)
|
|
.filter((value) => value !== undefined)
|
|
const runtimeUpload = jobSteps('agent-runtime').find(
|
|
(step) =>
|
|
step.uses === 'actions/upload-artifact@v7'
|
|
)
|
|
|
|
for (const target of Object.values(runtimeLock.node.targets)) {
|
|
expect(runtimeJob).toContain(
|
|
new URL(target.archive, runtimeLock.node.source).toString()
|
|
)
|
|
expect(runtimeJob).toContain(target.sha256)
|
|
}
|
|
expect(runtimeScripts).toContain(
|
|
"curl --proto '=https' --tlsv1.2"
|
|
)
|
|
expect(runtimeScripts).toContain('--max-filesize 104857600')
|
|
expect(runtimeScripts).toContain('sha256sum --check --strict -')
|
|
expect(runtimeUses).toEqual(
|
|
expect.arrayContaining([
|
|
'actions/cache/restore@v6',
|
|
'actions/cache/save@v6'
|
|
])
|
|
)
|
|
expect(runtimeUpload?.with?.name).toBe(
|
|
'goodbuddy-agent-node-${{ matrix.arch }}'
|
|
)
|
|
expect(runtimeJob).toContain(
|
|
'steps.node-runtime-cache.outputs.cache-hit != \'true\''
|
|
)
|
|
expect(runtimeJob).not.toContain('fail-on-cache-miss: true')
|
|
expect(jobNeeds('agent-signing')).toEqual(
|
|
expect.arrayContaining(['validate', 'agent-runtime'])
|
|
)
|
|
expect(signingJob).toContain('agent-runtime')
|
|
})
|
|
|
|
it('passes the endpoint-derived region to every OSS upload', () => {
|
|
expect(workflow).toContain(
|
|
'https://oss-cn-beijing.aliyuncs.com'
|
|
)
|
|
expect(workflow).toContain('goodbuddy) ;;')
|
|
expect(workflow).toContain(
|
|
'oss_region="${endpoint_host#oss-}"'
|
|
)
|
|
expect(workflow).toContain(
|
|
'echo "region=$oss_region" >> "$GITHUB_OUTPUT"'
|
|
)
|
|
expect(
|
|
[...workflow.matchAll(/--region "\$OSS_REGION"/gu)]
|
|
).toHaveLength(2)
|
|
})
|
|
|
|
it('allows fully unsigned macOS builds but rejects partial credentials', () => {
|
|
expect(workflow).toContain('id: macos-signing')
|
|
expect(workflow).toContain(
|
|
'if [[ "$configured" -eq 0 ]]; then'
|
|
)
|
|
expect(workflow).toContain(
|
|
'if [[ "$configured" -ne "${#names[@]}" ]]; then'
|
|
)
|
|
expect(workflow).toContain(
|
|
'Build unsigned macOS release packages'
|
|
)
|
|
expect(workflow).toContain('--skip-build --unsigned')
|
|
expect(workflow).toContain(
|
|
"steps.macos-signing.outputs.enabled == 'true'"
|
|
)
|
|
expect(workflow).toContain(
|
|
"steps.macos-signing.outputs.enabled == 'false'"
|
|
)
|
|
expect(workflow).toContain(
|
|
'Apple signing credentials are not configured'
|
|
)
|
|
})
|
|
})
|