1. 1#![allow(clippy::expect_used)]
2. 2
3. 3use std::path::PathBuf;
4. 4use std::sync::Arc;
5. 5
6. 6use serde_json::json;
7. 7use tempfile::tempdir;
8. 8use vak_tools::sandbox::{Sandbox, SandboxMode, SandboxTarget, Seatbelt};
9. 9use vak_tools::{ToolContext, brokered_default_tools};
10. 10
11. 11fn worker() -> PathBuf {
12. 12 PathBuf::from(env!("CARGO_BIN_EXE_vak"))
13. 13}
14. 14
15. 15fn tool(name: &str) -> Arc<dyn vak_tools::Tool> {
16. 16 brokered_default_tools(worker())
17. 17 .into_iter()
18. 18 .find(|tool| tool.name() == name)
19. 19 .expect("built-in tool")
20. 20}
21. 21
22. 22struct CommandSandbox;
23. 23
24. 24impl Sandbox for CommandSandbox {
25. 25 fn name(&self) -> &str {
26. 26 "test-command"
27. 27 }
28. 28
29. 29 fn wrap(&self, command: &str) -> String {
30. 30 format!("printf 'command-boundary\\n'; {command}")
31. 31 }
32. 32
33. 33 fn target(&self) -> SandboxTarget {
34. 34 SandboxTarget::ToolCommand
35. 35 }
36. 36}
37. 37
38. 38#[tokio::test]
39. 39async fn builtins_execute_in_worker_process() {
40. 40 let workspace = tempdir().expect("workspace");
41. 41 let ctx = ToolContext::new(workspace.path().to_path_buf());
42. 42
43. 43 let write = tool("write")
44. 44 .execute(&json!({"path": "inside.txt", "content": "brokered"}), &ctx)
45. 45 .await;
46. 46 assert!(!write.is_error, "{}", write.content);
47. 47
48. 48 let read = tool("read")
49. 49 .execute(&json!({"path": "inside.txt"}), &ctx)
50. 50 .await;
51. 51 assert!(!read.is_error, "{}", read.content);
52. 52 assert!(read.content.contains("brokered"));
53. 53}
54. 54
55. 55#[tokio::test]
56. 56async fn brokered_bash_streams_live_sandbox_events_with_identity() {
57. 57 let workspace = tempdir().expect("workspace");
58. 58 let (sink, mut events) =
59. 59 vak_tools::sandbox_events::SandboxEventSink::new_with_id("broker-stress".into());
60. 60 let ctx = ToolContext::new(workspace.path().to_path_buf()).with_sandbox_sink(sink);
61. 61 let output = tool("bash")
62. 62 .execute(
63. 63 &json!({"command": "mkdir -p nested && echo brokered > nested/result.txt"}),
64. 64 &ctx,
65. 65 )
66. 66 .await;
67. 67 assert!(!output.is_error, "{}", output.content);
68. 68 let mut started = false;
69. 69 let mut artifact = false;
70. 70 while let Ok(event) = events.try_recv() {
71. 71 match event {
72. 72 vak_tools::SandboxEvent::ExecutionStarted { execution_id, .. } => {
73. 73 assert_eq!(execution_id, "broker-stress");
74. 74 started = true;
75. 75 }
76. 76 vak_tools::SandboxEvent::ArtifactGenerated {
77. 77 execution_id, path, ..
78. 78 } => {
79. 79 assert_eq!(execution_id, "broker-stress");
80. 80 artifact |= path.contains("nested/result.txt");
81. 81 }
82. 82 _ => {}
83. 83 }
84. 84 }
85. 85 assert!(started, "broker did not stream a start event");
86. 86 assert!(artifact, "broker did not stream the nested artifact event");
87. 87}
88. 88
89. 89#[tokio::test]
90. 90async fn missing_worker_fails_closed() {
91. 91 let workspace = tempdir().expect("workspace");
92. 92 let mut tools = vak_tools::brokered_default_tools(workspace.path().join("missing-worker"));
93. 93 let output = tools
94. 94 .remove(0)
95. 95 .execute(
96. 96 &json!({"path": "anything"}),
97. 97 &ToolContext::new(workspace.path().to_path_buf()),
98. 98 )
99. 99 .await;
100. 100 assert!(output.is_error);
101. 101 assert!(output.content.contains("broker unavailable"));
102. 102}
103. 103
104. 104#[tokio::test]
105. 105async fn cancellation_terminates_worker_process_group() {
106. 106 let workspace = tempdir().expect("workspace");
107. 107 let ctx = ToolContext::new(workspace.path().to_path_buf());
108. 108 let cancel = ctx.cancel.clone();
109. 109 tokio::spawn(async move {
110. 110 tokio::time::sleep(std::time::Duration::from_millis(1000)).await;
111. 111 cancel.cancel();
112. 112 });
113. 113
114. 114 let output = tokio::time::timeout(
115. 115 std::time::Duration::from_secs(5),
116. 116 tool("bash").execute(&json!({"command": "sleep 30"}), &ctx),
117. 117 )
118. 118 .await
119. 119 .expect("broker cancellation deadline");
120. 120 assert!(output.is_error);
121. 121 assert!(output.content.contains("cancelled"));
122. 122}
123. 123
124. 124#[tokio::test]
125. 125async fn command_scoped_sandbox_wraps_bash_inside_protocol() {
126. 126 let workspace = tempdir().expect("workspace");
127. 127 let mut ctx = ToolContext::new(workspace.path().to_path_buf());
128. 128 ctx.sandbox = Some(Arc::new(CommandSandbox));
129. 129
130. 130 let output = tool("bash")
131. 131 .execute(&json!({"command": "printf 'tool-command\\n'"}), &ctx)
132. 132 .await;
133. 133 assert!(!output.is_error, "{}", output.content);
134. 134 assert!(output.content.contains("command-boundary"));
135. 135 assert!(output.content.contains("tool-command"));
136. 136}
137. 137
138. 138#[cfg(target_os = "macos")]
139. 139#[tokio::test]
140. 140async fn restricted_worker_cannot_read_home_outside_workspace() {
141. 141 let workspace = tempdir().expect("workspace");
142. 142 let home = PathBuf::from(std::env::var_os("HOME").expect("home"));
143. 143 let protected = tempfile::Builder::new()
144. 144 .prefix("vak-broker-protected-")
145. 145 .tempdir_in(home)
146. 146 .expect("protected directory");
147. 147 let secret = protected.path().join("secret.txt");
148. 148 std::fs::write(&secret, "must-not-cross-boundary").expect("secret fixture");
149. 149 let mut ctx = ToolContext::new(workspace.path().to_path_buf());
150. 150 let mut seatbelt = Seatbelt::new(SandboxMode::WorkspaceWrite, workspace.path());
151. 151 seatbelt
152. 152 .read_paths
153. 153 .push(worker().parent().expect("worker parent").to_path_buf());
154. 154 ctx.sandbox = Some(Arc::new(seatbelt));
155. 155
156. 156 let output = tool("read").execute(&json!({"path": secret}), &ctx).await;
157. 157 assert!(output.is_error);
158. 158 assert!(!output.content.contains("must-not-cross-boundary"));
159. 159 assert!(
160. 160 !output.content.contains("tool broker exited"),
161. 161 "{}",
162. 162 output.content
163. 163 );
164. 164}
165. 165