mesalogo
607bb33249
Add managed SSH Hosts and projects with signed side-by-side GoodBuddy Agent and OpenCode Runtime installation, Ask and Execute workspace access, a Main-owned model bridge, detached Agent lifecycle, durable ACP output recovery, and project activation UI. Use protocol v2 with bounded FIFO frames over SSH instead of custom credit, priority, batching, or model-message chunking. Mismatched Host Agents now upgrade automatically, an exactly verified Node runtime is reused on-host, and local Portable builds can embed strictly verified Agent artifacts. Release note: 新增托管 SSH 远程项目，可自动安装或升级签名 Agent/OpenCode Runtime，并在 SSH 断线后继续 Agent 工作和同步未确认输出。
105 lines
2.9 KiB
TypeScript
105 lines
2.9 KiB
TypeScript
import {
|
|
chmod,
|
|
mkdir,
|
|
mkdtemp,
|
|
rename,
|
|
rm,
|
|
symlink,
|
|
writeFile
|
|
} from 'node:fs/promises'
|
|
import { tmpdir } from 'node:os'
|
|
import { join } from 'node:path'
|
|
import { afterEach, describe, expect, it } from 'vitest'
|
|
import {
|
|
openPrivateSqliteDatabase,
|
|
PreparedPrivateSqliteDatabaseFile
|
|
} from './private-sqlite-database'
|
|
|
|
describe('private SQLite database opening', () => {
|
|
const temporaryDirectories: string[] = []
|
|
|
|
afterEach(async () => {
|
|
await Promise.all(
|
|
temporaryDirectories.splice(0).map((directory) =>
|
|
rm(directory, { recursive: true, force: true })
|
|
)
|
|
)
|
|
})
|
|
|
|
async function privateDirectory(): Promise<string> {
|
|
const directory = await mkdtemp(
|
|
join(tmpdir(), 'goodbuddy-private-sqlite-')
|
|
)
|
|
temporaryDirectories.push(directory)
|
|
return directory
|
|
}
|
|
|
|
it('opens a verified regular filesystem database', async () => {
|
|
const path = join(await privateDirectory(), 'verified.sqlite')
|
|
const database = openPrivateSqliteDatabase(path)
|
|
database.exec('CREATE TABLE verified (value TEXT) STRICT')
|
|
database.close()
|
|
})
|
|
|
|
it.runIf(process.platform !== 'win32')(
|
|
'rejects a symbolic-link database path',
|
|
async () => {
|
|
const directory = await privateDirectory()
|
|
const target = join(directory, 'target.sqlite')
|
|
const link = join(directory, 'link.sqlite')
|
|
await writeFile(target, '')
|
|
await symlink(target, link)
|
|
|
|
expect(() => openPrivateSqliteDatabase(link)).toThrow(
|
|
'non-symbolic-link'
|
|
)
|
|
}
|
|
)
|
|
|
|
it.runIf(process.platform !== 'win32')(
|
|
'rejects a symbolic-link parent path',
|
|
async () => {
|
|
const directory = await privateDirectory()
|
|
const realParent = join(directory, 'real-parent')
|
|
const linkedParent = join(directory, 'linked-parent')
|
|
await mkdir(realParent, { mode: 0o700 })
|
|
await symlink(realParent, linkedParent, 'dir')
|
|
|
|
expect(() =>
|
|
openPrivateSqliteDatabase(join(linkedParent, 'database.sqlite'))
|
|
).toThrow('parent must be a real directory')
|
|
}
|
|
)
|
|
|
|
it.runIf(process.platform !== 'win32')(
|
|
'rejects a parent outside the private same-UID boundary',
|
|
async () => {
|
|
const directory = await privateDirectory()
|
|
await chmod(directory, 0o755)
|
|
|
|
expect(() =>
|
|
openPrivateSqliteDatabase(join(directory, 'database.sqlite'))
|
|
).toThrow('parent must be private')
|
|
}
|
|
)
|
|
|
|
it.runIf(process.platform !== 'win32')(
|
|
'rejects path replacement while the verified descriptor remains open',
|
|
async () => {
|
|
const directory = await privateDirectory()
|
|
const path = join(directory, 'database.sqlite')
|
|
const moved = join(directory, 'moved.sqlite')
|
|
const prepared = new PreparedPrivateSqliteDatabaseFile(path)
|
|
try {
|
|
await rename(path, moved)
|
|
await writeFile(path, '')
|
|
await expect(() => prepared.openDatabase()).toThrow(
|
|
'path identity changed'
|
|
)
|
|
} finally {
|
|
prepared.close()
|
|
}
|
|
}
|
|
)
|
|
})
|