diff options
Diffstat (limited to '9harness/test')
| -rwxr-xr-x | 9harness/test/e2e.sh | 347 |
1 files changed, 0 insertions, 347 deletions
diff --git a/9harness/test/e2e.sh b/9harness/test/e2e.sh deleted file mode 100755 index 254d999..0000000 --- a/9harness/test/e2e.sh +++ /dev/null @@ -1,347 +0,0 @@ -#!/usr/bin/env bash -# End-to-end suite for 9harness: the read-only, fresh-from-disk 9P view of -# every harness's state. -# -# Usage: bash 9harness/test/e2e.sh <9harness> [<9ns>] (zig build 9harness-itest) -# -# Part A always runs, entirely on fixtures: a fake home with fixture roots -# pinned by --root, a scratch XDG_RUNTIME_DIR registry, plan9port's 9p as -# the client. It proves: the posted name is listed, the roots walk and -# read, a transcript comes back byte-identical (cmp), credentials-shaped -# files are unreachable, a file appended after the daemon started is -# visible at once, writes answer EPERM, and --unix/--fd listen forms work. -# -# Part B (the money shot) runs against the REAL roots and the REAL -# registry only when the `harness` name is free, and only reads: the posted -# name in /run/user/<uid>/9p, 9p walks of the live ~/.claude, a real -# transcript byte-identical through the tree, the 9ns --mntgen mount of -# /mnt/9p/harness, and the live ~/.claude/.credentials.json unreachable. -# It is skipped (not failed) when a live daemon already owns the name. -# -# Exit 0 on success (or when the machine cannot run a part), 1 on failure. -set -u - -H9=$(realpath "${1:?path to 9harness}") -HARNESS_TMP_XDG="${XDG_RUNTIME_DIR:-}" -[ $# -ge 2 ] && [ -n "$2" ] && NS=$(realpath "$2") -P9P=/usr/lib/plan9/bin/9p -TMP=$(mktemp -d "${TMPDIR:-/tmp}/9harness.XXXXXX") -PIDS=() -FAILED=0 -PASSED=0 - -cleanup() { - for p in "${PIDS[@]:-}"; do [ -n "$p" ] && kill "$p" 2>/dev/null; done - rm -rf "$TMP" -} -trap cleanup EXIT - -pass() { PASSED=$((PASSED + 1)); echo "ok - $1"; } -fail() { FAILED=$((FAILED + 1)); echo "FAIL - $1"; shift; [ $# -gt 0 ] && printf ' %s\n' "$@"; } -expect_eq() { # name expected actual - if [ "$2" = "$3" ]; then pass "$1"; else fail "$1" "expected: $(printf %q "$2")" "actual: $(printf %q "$3")"; fi -} -expect_contains() { # name needle haystack - case "$3" in *"$2"*) pass "$1" ;; *) fail "$1" "missing: $(printf %q "$2")" "in: $(printf %q "$3")" ;; esac -} -expect_missing() { # name needle haystack - case "$3" in *"$2"*) fail "$1" "found: $(printf %q "$2")" "in: $(printf %q "$3")" ;; *) pass "$1" ;; esac -} - -if [ ! -x "$P9P" ]; then - echo "SKIP: plan9port 9p not at $P9P"; exit 0 -fi -if ! unshare -Urm true 2>/dev/null; then - echo "SKIP: unprivileged user namespaces unavailable"; exit 0 -fi - -start_daemon() { # args... -> sets DAEMON_PID, logs to $TMP/daemon.log - "$H9" "$@" >"$TMP/daemon.log" 2>&1 & - DAEMON_PID=$! - PIDS+=("$DAEMON_PID") -} -wait_posted() { # socket path - for _ in $(seq 1 100); do [ -S "$1" ] && return 0; sleep 0.05; done - return 1 -} -p9() { "$P9P" -a "unix!$1" "${@:2}"; } - -# ============================================================================ -echo "# part A: fixture roots, scratch registry" -# ============================================================================ -export XDG_RUNTIME_DIR="$TMP" -REG="$TMP/9p" -FX="$TMP/home" -mkdir -p "$FX" - -# The fixture home: five roots, a real-shaped claude project with a -# transcript, credentials-shaped files at several depths, codex sessions, -# an omp agent dir, hermes logs and dsh profiles. -mkfile() { mkdir -p "$(dirname "$1")"; printf '%s' "$2" > "$1"; } -mkfile "$FX/claude/projects/-tmp-proj/session-abc.jsonl" '{"type":"user","message":"first line"} -{"type":"assistant","message":"second line"} -' -mkfile "$FX/claude/projects/-tmp-proj/.credentials.json" 'STAY OUT' -mkfile "$FX/claude/projects/-tmp-proj/auth.json" 'STAY OUT' -mkfile "$FX/claude/projects/-tmp-proj/token.bin" 'STAY OUT' -mkfile "$FX/claude/history.jsonl" '{"display":"claude prompt one"} -{"display":"claude prompt two"} -' -mkdir -p "$FX/claude/skills/revu" -mkfile "$FX/claude/skills/revu/SKILL.md" '# revu skill' -mkfile "$FX/codex/sessions/2026/09/21/rollout-x.jsonl" '{"session":"codex one"} -' -mkfile "$FX/codex/session_index.jsonl" '{"id":"x"} -' -mkfile "$FX/codex/history.jsonl" '{"text":"codex prompt"} -' -mkfile "$FX/omp/agent/history.db" 'fake-history-db' -mkfile "$FX/omp/agent/config.yml" 'STAY OUT' -mkfile "$FX/hermes/auth.json" 'STAY OUT' -mkfile "$FX/hermes/logs/app.log" 'hermes log line -' -mkfile "$FX/hermes/state.db" 'fake-hermes-state' -mkfile "$FX/dsh/profiles/p1.yaml" 'name: p1' -mkfile "$FX/dsh/.credentials.yaml" 'STAY OUT' - -start_daemon --root "claude=$FX/claude" --root "codex=$FX/codex" \ - --root "omp=$FX/omp" --root "hermes=$FX/hermes" --root "dsh=$FX/dsh" \ - --name harness -wait_posted "$REG/harness" || { fail "the daemon posts as harness" "$(cat "$TMP/daemon.log")"; exit 1; } - -# 1. The posted name is listed. -expect_contains "posted name listed in the registry" harness "$(ls "$REG")" - -# 2. The roots walk; a real transcript reads back byte-identical. -expect_contains "ls / shows the roots" claude "$(p9 "$REG/harness" ls /)" -expect_contains "ls / shows codex" codex "$(p9 "$REG/harness" ls /)" -expect_contains "ls / shows skills" skills "$(p9 "$REG/harness" ls /)" -p9 "$REG/harness" read /claude/projects/-tmp-proj/session-abc.jsonl > "$TMP/via-9p.jsonl" 2>"$TMP/read.err" \ - || fail "transcript read through the tree" "$(cat "$TMP/read.err")" -cmp -s "$TMP/via-9p.jsonl" "$FX/claude/projects/-tmp-proj/session-abc.jsonl" \ - && pass "transcript byte-identical through the tree (cmp)" \ - || fail "transcript byte-identical through the tree (cmp)" "differs" -expect_eq "history file reads" "$(cat "$FX/claude/history.jsonl")" "$(p9 "$REG/harness" read /claude/history)" -expect_eq "skills union mirrors the harness tree" "$(cat "$FX/claude/skills/revu/SKILL.md")" \ - "$(p9 "$REG/harness" read /skills/claude/revu/SKILL.md)" - -# 3. A credentials-shaped file is unreachable anywhere in the tree. -PROJ_LS=$(p9 "$REG/harness" ls /claude/projects/-tmp-proj) -for bad in .credentials.json auth.json token.bin; do - expect_missing "credentials-shaped $bad not listed" "$bad" "$PROJ_LS" - p9 "$REG/harness" read "/claude/projects/-tmp-proj/$bad" >/dev/null 2>&1 \ - && fail "credentials-shaped $bad unreachable" "read succeeded" \ - || pass "credentials-shaped $bad unreachable" -done -expect_missing "hermes auth.json not listed" auth.json "$(p9 "$REG/harness" ls /hermes)" -expect_missing "omp config.yml not listed" config.yml "$(p9 "$REG/harness" ls /omp)" -expect_missing "dsh .credentials.yaml not listed" credentials.yaml "$(p9 "$REG/harness" ls /dsh)" -sleep 0.3 -expect_contains "hermes logs still served" logs "$(p9 "$REG/harness" ls /hermes)" - -# 3b. A file at the very top of a mirror root: its relative path is the -# bare name, the one case a join onto an empty directory path gets wrong. -expect_contains "a file at the top of a mirror root is listed" state.db "$(p9 "$REG/harness" ls /hermes)" -expect_eq "a file at the top of a mirror root reads back" "$(cat "$FX/hermes/state.db")" \ - "$(p9 "$REG/harness" read /hermes/state.db)" - -# 3c. A directory bigger than the listing caps fails loudly. A short -# listing is indistinguishable from a small directory, so the daemon must -# never answer one: the read errors and the client sees it. -mkdir -p "$FX/dsh/wide" -seq 1 1100 | while read -r i; do : > "$FX/dsh/wide/f$(printf %05d "$i")"; done -if p9 "$REG/harness" ls /dsh/wide > "$TMP/wide.out" 2>"$TMP/wide.err"; then - fail "an over-cap directory fails instead of truncating" "listed $(wc -l < "$TMP/wide.out") entries" -else - pass "an over-cap directory fails instead of truncating ($(head -c 80 "$TMP/wide.err"))" -fi -rm -rf "$FX/dsh/wide" - -# 4. Live visibility: a file appended after the daemon started. -printf '{"type":"assistant","message":"third line"}\n' >> "$FX/claude/projects/-tmp-proj/session-abc.jsonl" -expect_eq "append after start is visible immediately" \ - "$(cat "$FX/claude/projects/-tmp-proj/session-abc.jsonl")" \ - "$(p9 "$REG/harness" read /claude/projects/-tmp-proj/session-abc.jsonl)" -mkdir -p "$FX/claude/projects/-tmp-proj2" -mkfile "$FX/claude/projects/-tmp-proj2/session-new.jsonl" '{"new":true} -' -expect_contains "new session dir appears at once" -tmp-proj2 "$(p9 "$REG/harness" ls /claude/projects)" - -# 5. The facts and the write refusal. -DAEMON_PID_TEXT=$(p9 "$REG/harness" read /pid) -expect_eq "pid fact answers the daemon's pid" "$DAEMON_PID" "$DAEMON_PID_TEXT" -[ -n "$(p9 "$REG/harness" read /uptime)" ] && pass "uptime fact answers" || fail "uptime fact answers" "empty" -printf 'x' | p9 "$REG/harness" write /pid >/dev/null 2>&1 \ - && fail "write answers EPERM" "write succeeded" \ - || pass "write answers EPERM" - -# 6. The --unix listen form beside the post. -"$H9" --unix "$TMP/plain.sock" --no-post --root "claude=$FX/claude" >"$TMP/d2.log" 2>&1 & -PIDS+=($!) -for _ in $(seq 1 100); do [ -S "$TMP/plain.sock" ] && break; sleep 0.05; done -expect_eq "--unix listen form serves" "$(cat "$FX/claude/history.jsonl")" "$(p9 "$TMP/plain.sock" read /claude/history)" - -# 7. The --fd listen form: one 9P session over a connected stream fd -# (the 9ns --spawn / socket-activation shape), driven through a -# socketpair: the daemon sees EOF when both ends close and exits. -if command -v python3 >/dev/null; then - python3 - "$H9" "$FX" <<'EOF' -import os, socket, subprocess, sys -h9, fx = sys.argv[1], sys.argv[2] -a, b = socket.socketpair() -pid = os.fork() -if pid == 0: - a.close() - os.dup2(b.fileno(), 7) - os.execv(h9, [h9, "--fd", "7", "--root", f"claude={fx}/claude"]) -b.close() -a.close() -os.waitpid(pid, 0) -EOF - pass "--fd listen form runs a session and exits on hangup" -else - echo "skip - --fd form: python3 not available" -fi - -kill "$DAEMON_PID" 2>/dev/null -wait "$DAEMON_PID" 2>/dev/null -sleep 0.2 -[ -S "$REG/harness" ] && fail "SIGTERM unposts the name" "socket still there" || pass "SIGTERM unposts the name" - -# ============================================================================ -echo "# part C: /active, the derived view" -# ============================================================================ -# A fake agent: a process whose argv[0] basename is a harness name, with a -# session record Claude Code's own shape. The proc root is the real /proc -# (the fixture seam is unit-tested); nothing real is ever killed, because -# the only process this part touches is the sleep it started itself. -ACT="$TMP/act" -mkdir -p "$ACT/bin" "$ACT/home/.claude/sessions" "$ACT/home/.claude/projects" "$ACT/rt/9p/zmx" -cp /bin/sleep "$ACT/bin/claude" -# A zmx that records how it was called and posts the name, as the real one -# does; a move must never be tested against the user's live sessions. -cat > "$ACT/bin/zmx" <<ZEOF -#!/bin/sh -echo "\$@" > "$ACT/zmx-argv" -: > "$ACT/rt/9p/zmx/\$2" -exit 0 -ZEOF -chmod +x "$ACT/bin/zmx" - -"$ACT/bin/claude" 600 & -AGENT=$! -PIDS+=("$AGENT") -sleep 0.3 -# Field 22 of /proc/<pid>/stat, counted from the last ')' — the executable -# name can hold spaces and parentheses, so the line is never just split. -AGENT_START=$(sed 's/.*) //' "/proc/$AGENT/stat" | awk '{print $20}') -AGENT_CWD=$(readlink "/proc/$AGENT/cwd") -printf '{"pid":%d,"sessionId":"sess-e2e","cwd":"%s","name":"e2e-agent","status":"idle","procStart":"%s"}\n' \ - "$AGENT" "$AGENT_CWD" "$AGENT_START" > "$ACT/home/.claude/sessions/$AGENT.json" - -act_roots() { - echo --root "claude=$ACT/home/.claude" --root "codex=$ACT/home/.codex" \ - --root "omp=$ACT/home/.omp" --root "hermes=$ACT/home/.hermes" --root "dsh=$ACT/home/.dsh" -} - -# First: the read-only default. No --allow-move, so zmx cannot be written. -XDG_RUNTIME_DIR="$ACT/rt" "$H9" --no-post --unix "$ACT/ro.sock" $(act_roots) >"$ACT/ro.log" 2>&1 & -PIDS+=("$!") -wait_posted "$ACT/ro.sock" || { fail "read-only daemon listens" "$(cat "$ACT/ro.log")"; } -expect_contains "the agent lists under its harness" "$AGENT" "$(p9 "$ACT/ro.sock" ls /active/claude)" -expect_eq "its session comes from the harness's own record" "sess-e2e" "$(p9 "$ACT/ro.sock" read "/active/claude/$AGENT/session")" -expect_eq "the route taken is named" "registry" "$(p9 "$ACT/ro.sock" read "/active/claude/$AGENT/via")" -expect_eq "the harness's own name is served" "e2e-agent" "$(p9 "$ACT/ro.sock" read "/active/claude/$AGENT/name")" -expect_eq "the harness's own status is served" "idle" "$(p9 "$ACT/ro.sock" read "/active/claude/$AGENT/status")" -if echo "nope" | p9 "$ACT/ro.sock" write "/active/claude/$AGENT/zmx" 2>/dev/null; then - fail "without --allow-move the tree stays read-only" "the write was accepted" -else - pass "without --allow-move the tree stays read-only" -fi -expect_eq "a refused move leaves the agent running" "yes" "$([ -d "/proc/$AGENT" ] && echo yes)" - -# Now a daemon that allows moves. -XDG_RUNTIME_DIR="$ACT/rt" "$H9" --no-post --unix "$ACT/rw.sock" $(act_roots) \ - --allow-move --zmx "$ACT/bin/zmx" >"$ACT/rw.log" 2>&1 & -PIDS+=("$!") -wait_posted "$ACT/rw.sock" || { fail "move-allowing daemon listens" "$(cat "$ACT/rw.log")"; } - -# Every refusal must come before anything is destroyed. -for bad in "has space" "../escape" "semi;colon"; do - echo "$bad" | p9 "$ACT/rw.sock" write "/active/claude/$AGENT/zmx" 2>/dev/null - if [ $? -eq 0 ]; then fail "an illegal zmx name is refused ($bad)"; else pass "an illegal zmx name is refused ($bad)"; fi -done -: > "$ACT/rt/9p/zmx/occupied" -echo "occupied" | p9 "$ACT/rw.sock" write "/active/claude/$AGENT/zmx" 2>/dev/null \ - && fail "a name a live session holds is refused" || pass "a name a live session holds is refused" -expect_eq "no refusal killed the agent" "yes" "$([ -d "/proc/$AGENT" ] && echo yes)" - -# The move itself. -if echo "e2e-moved" | p9 "$ACT/rw.sock" write "/active/claude/$AGENT/zmx" 2>"$ACT/move.err"; then - pass "a legal name moves the agent" -else - fail "a legal name moves the agent" "$(cat "$ACT/move.err")" -fi -sleep 0.4 -expect_eq "the agent it replaced is gone" "gone" "$([ -d "/proc/$AGENT" ] || echo gone)" -# The command is fixed by the harness: the client supplied only the name. -expect_eq "zmx ran the harness with its session resumed" \ - "run e2e-moved -d claude --resume sess-e2e" "$(cat "$ACT/zmx-argv")" -expect_missing "no client byte reached the command" "e2e-moved -d claude --resume sess-e2e;" "$(cat "$ACT/zmx-argv")" - -# ============================================================================ -echo "# part B: the real roots, the real registry (read-only)" -# ============================================================================ -export XDG_RUNTIME_DIR="${HARNESS_TMP_XDG:-/run/user/$(id -u)}" -REAL_REG="$XDG_RUNTIME_DIR/9p" -REAL_SOCKET="$REAL_REG/harness" -if [ -e "$REAL_SOCKET" ]; then - echo "SKIP: a live daemon already owns the posted name `harness`" -else - HOME_DIR=$(getent passwd "$(id -u)" | cut -d: -f6) - start_daemon --name harness - if wait_posted "$REAL_SOCKET"; then - expect_contains "posted name listed in the real registry" harness "$(ls "$REAL_REG")" - expect_contains "ls / shows the claude root" claude "$(p9 "$REAL_SOCKET" ls /)" - # A real transcript, byte-identical through the tree. - REAL_T=$(ls "$HOME_DIR/.claude/projects"/*/*.jsonl 2>/dev/null | head -n 1 || true) - if [ -n "$REAL_T" ]; then - REL="${REAL_T#"$HOME_DIR/.claude/projects/"}" - p9 "$REAL_SOCKET" read "/claude/projects/$REL" > "$TMP/real-via-9p" 2>/dev/null \ - && cmp -s "$TMP/real-via-9p" "$REAL_T" \ - && pass "real transcript byte-identical through the tree" \ - || fail "real transcript byte-identical through the tree" "$REAL_T" - else - echo "skip - no real claude transcript found" - fi - # The credentials at ~/.claude are unreachable: no mount serves the - # root dir, and the exclusion rule holds everywhere else. - p9 "$REAL_SOCKET" read /claude/.credentials.json >/dev/null 2>&1 \ - && fail "live .credentials.json unreachable" "read succeeded" \ - || pass "live .credentials.json unreachable" - CLAUDE_LS=$(p9 "$REAL_SOCKET" ls /claude) - expect_missing "no credentials leaked into /claude" credentials "$CLAUDE_LS" - # The money shot: the mntgen mount every interactive fish sees. - if [ -n "$NS" ]; then - OUT=$(timeout 60 "$NS" --mntgen -- sh -c 'ls /mnt/9p/harness && head -c 200 /mnt/9p/harness/claude/history' 2>"$TMP/mntgen.err") - RC=$? - if [ $RC -eq 0 ]; then - expect_contains "mntgen mount lists the harness tree" claude "$OUT" - expect_contains "mntgen mount reads claude/history" claude "$OUT" - else - fail "mntgen money shot (exit $RC)" "$(cat "$TMP/mntgen.err")" - fi - else - echo "skip - mntgen money shot: 9ns not provided" - fi - kill "$DAEMON_PID" 2>/dev/null - wait "$DAEMON_PID" 2>/dev/null - sleep 0.2 - [ -S "$REAL_SOCKET" ] && fail "stop unposts the real name" "socket still there" || pass "stop unposts the real name" - else - fail "daemon posts into the real registry" "$(cat "$TMP/daemon.log")" - fi -fi - -echo "# $PASSED passed, $FAILED failed" -[ "$FAILED" -eq 0 ] |