Vakyartha documentation

21732 "/sessions/session-1/office-workspaces/room-1/presence",
21733 &participant(&["read"])
21734 ));
21735 assert!(!participant_read_route_allowed(
21736 &axum::http::Method::POST,
21737 "/sessions/session-1/office-workspaces/room-1",
21738 &participant(&["read"])
21739 ));
21740 assert!(participant_read_route_allowed(
21741 &axum::http::Method::POST,
21742 "/sessions/session-1/office-workspaces/room-1",
21743 &participant(&["read", "edit"])
21744 ));
21745 assert!(!participant_read_route_allowed(
21746 &axum::http::Method::POST,
21747 "/sessions/session-1/coworking/messages",
21748 &participant(&["read", "comment"])
21749 ));
21750 assert!(participant_read_route_allowed(
21751 &axum::http::Method::GET,
21752 "/sessions/session-1/coworking/approvals",
21753 &participant(&["read", "approve_once"])
21754 ));
21755 assert!(participant_read_route_allowed(
21756 &axum::http::Method::POST,
21757 "/sessions/session-1/coworking/approvals/request-1",
21758 &participant(&["read"])
21759 ));
21760 assert!(participant_read_route_allowed(
21761 &axum::http::Method::POST,
21762 "/sessions/session-1/coworking/approvals/request-1",
21763 &participant(&["read", "message"])
21764 ));
21765 assert!(!participant_read_route_allowed(
21766 &axum::http::Method::POST,
21767 "/sessions/session-1/sandbox/promote",
21768 &participant(&["read", "comment"])
21769 ));
21770 assert!(!participant_read_route_allowed(
21771 &axum::http::Method::POST,
21772 "/sessions/session-1/sandbox/candidates/candidate-1/comments/comment-1/request-revision",
21773 &participant(&["read", "comment"])
21774 ));
21775 assert!(!participant_read_route_allowed(
21776 &axum::http::Method::GET,
21777 "/sessions/session-1/transcript",
21778 &participant(&["comment"])
21779 ));
21780 }
21781
21782 #[test]
21783 fn coworking_presence_is_observed_and_expires() {
21784 vak_config::paths::isolate_home_for_tests();
21785 let dir = tempfile::tempdir().unwrap();
21786 let core = Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
21787 let state = AppState::new(core);
21788 touch_coworking_presence(&state, "conversation-1", "person-1", "Asha");
21789 let snapshot = coworking_presence_snapshot(&state, "conversation-1");
21790 assert_eq!(snapshot["participants"][0]["principal_id"], "person-1");
21791 assert_eq!(snapshot["participants"][0]["display_name"], "Asha");
21792 state
21793 .coworking_presence
21794 .lock()
21795 .unwrap()
21796 .get_mut("conversation-1")
21797 .unwrap()
21798 .get_mut("person-1")
21799 .unwrap()
21800 .seen_at = Instant::now() - COWORKING_PRESENCE_TTL - Duration::from_secs(1);
21801 assert_eq!(
21802 coworking_presence_snapshot(&state, "conversation-1")["participants"]
21803 .as_array()
21804 .unwrap()
21805 .len(),
21806 0
21807 );
21808 }
21809
21810 #[tokio::test]
21811 async fn participant_bearer_is_enforced_by_http_boundary() {
21812 use tower::ServiceExt;
21813
21814 let dir = tempfile::tempdir().unwrap();
21815 let core = Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
21816 core.set_sessions_home(dir.path().to_path_buf());
21817 seed_bound_result(&core, "session-1", "execution-1");
21818 let state = AppState::new(core);
21819 let token = "participant-secret";
21820 let grant = coworking::AudienceGrant {
21821 grant_id: "grant-http".into(),
21822 principal_id: "person-http".into(),
21823 display_name: "Asha".into(),
21824 conversation_id: "session-1".into(),
21825 audience_id: "local".into(),
21826 capabilities: vec!["read".into()],
21827 token_hash: coworking::token_hash(token),
21828 created_at: chrono::Utc::now().to_rfc3339(),
21829 expires_at: (chrono::Utc::now() + chrono::Duration::hours(1)).to_rfc3339(),
21830 };
21831 coworking::invite(&coworking::store_path(dir.path()), grant).unwrap();
21832 coworking::invite(
21833 &coworking::store_path(dir.path()),
21834 coworking::AudienceGrant {
21835 grant_id: "grant-wrong-audience".into(),
21836 principal_id: "person-wrong-audience".into(),
21837 display_name: "Ravi".into(),
21838 conversation_id: "session-1".into(),
21839 audience_id: "conversation:someone-else".into(),
21840 capabilities: vec!["read".into()],
21841 token_hash: coworking::token_hash("participant-wrong-audience"),
21842 created_at: chrono::Utc::now().to_rfc3339(),
21843 expires_at: (chrono::Utc::now() + chrono::Duration::hours(1)).to_rfc3339(),
21844 },
21845 )
21846 .unwrap();
21847 let app = Router::new()
21848 .route(
21849 "/sessions/{id}/transcript",
21850 get(|| async { StatusCode::OK }),
21851 )
21852 .route(
21853 "/sessions/{id}/run",
21854 post(|| async { StatusCode::NO_CONTENT }),
21855 )
21856 .with_state(state.clone())
21857 .layer(axum::middleware::from_fn_with_state(
21858 state,
21859 enforce_participant_audience,
21860 ))
21861 .layer(axum::middleware::from_fn_with_state(
21862 AuthPolicy {
21863 token: "operator-secret".into(),
21864 home: dir.path().into(),
21865 trusted_hosts: Vec::new(),
21866 },
21867 require_bearer,
21868 ));
21869 let request = |method: axum::http::Method, path: &str| {
21870 axum::http::Request::builder()
21871 .method(method)
21872 .uri(path)
21873 .header(axum::http::header::AUTHORIZATION, format!("Bearer {token}"))
21874 .body(axum::body::Body::empty())
21875 .unwrap()
21876 };
21877 assert_eq!(
21878 app.clone()
21879 .oneshot(request(
21880 axum::http::Method::GET,
21881 "/sessions/session-1/transcript"
21882 ))
21883 .await
21884 .unwrap()
21885 .status(),
21886 StatusCode::OK
21887 );
21888 let wrong_audience = axum::http::Request::builder()
21889 .uri("/sessions/session-1/transcript")
21890 .header(
21891 axum::http::header::AUTHORIZATION,
21892 "Bearer participant-wrong-audience",
21893 )
21894 .body(axum::body::Body::empty())
21895 .unwrap();
21896 assert_eq!(
21897 app.clone().oneshot(wrong_audience).await.unwrap().status(),
21898 StatusCode::FORBIDDEN
21899 );
21900 assert_eq!(
21901 app.clone()
21902 .oneshot(request(
21903 axum::http::Method::GET,
21904 "/sessions/session-2/transcript"
21905 ))
21906 .await
21907 .unwrap()
21908 .status(),
21909 StatusCode::FORBIDDEN
21910 );
21911 assert_eq!(
21912 app.clone()
21913 .oneshot(request(axum::http::Method::POST, "/sessions/session-1/run"))
21914 .await
21915 .unwrap()
21916 .status(),
21917 StatusCode::FORBIDDEN
21918 );
21919 coworking::revoke(&coworking::store_path(dir.path()), "grant-http", "operator").unwrap();
21920 assert_eq!(
21921 app.oneshot(request(
21922 axum::http::Method::GET,
21923 "/sessions/session-1/transcript"
21924 ))
21925 .await
21926 .unwrap()
21927 .status(),
21928 StatusCode::UNAUTHORIZED
21929 );
21930 }
21931
21932 #[tokio::test]
21933 async fn participant_message_is_attributed_idempotent_and_does_not_start_work() {
21934 use tower::ServiceExt;
21935
21936 vak_config::paths::isolate_home_for_tests();
21937 let dir = tempfile::tempdir().unwrap();
21938 let core = Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
21939 core.set_sessions_home(dir.path().join("home"));
21940 seed_bound_result(&core, "session-message", "exec-message");
21941 let state = AppState::new(core.clone());
21942 let path = core
21943 .sessions_home()
21944 .join("sessions")
21945 .join(vak_core::memory::hash_cwd(core.cwd()))
21946 .join("session-message.jsonl");
21947 let session = SessionLog::open(path).unwrap();
21948 let handle = register_handle(
21949 &state,
21950 "session-message".into(),
21951 session,
21952 core.cwd().to_path_buf(),
21953 core.clone(),
21954 );
21955 let token = "participant-message-token";
21956 coworking::invite(
21957 &coworking::store_path(&core.sessions_home()),
21958 coworking::AudienceGrant {
21959 grant_id: "grant-message".into(),
21960 principal_id: "person-message".into(),
21961 display_name: "Asha".into(),
21962 conversation_id: "session-message".into(),
21963 audience_id: "local".into(),
21964 capabilities: vec!["read".into(), "message".into()],
21965 token_hash: coworking::token_hash(token),
21966 created_at: chrono::Utc::now().to_rfc3339(),
21967 expires_at: (chrono::Utc::now() + chrono::Duration::hours(1)).to_rfc3339(),
21968 },
21969 )
21970 .unwrap();
21971 let app = Router::new()
21972 .route(
21973 "/sessions/{id}/coworking/messages",
21974 post(create_coworking_message),
21975 )
21976 .with_state(state)
21977 .layer(axum::middleware::from_fn_with_state(
21978 AuthPolicy {
21979 token: "operator-secret".into(),
21980 home: core.sessions_home(),
21981 trusted_hosts: Vec::new(),
21982 },
21983 require_bearer,
21984 ));
21985 let request = || {
21986 axum::http::Request::builder()
21987 .method(axum::http::Method::POST)
21988 .uri("/sessions/session-message/coworking/messages")
21989 .header(axum::http::header::AUTHORIZATION, format!("Bearer {token}"))
21990 .header(axum::http::header::CONTENT_TYPE, "application/json")
21991 .body(axum::body::Body::from(
21992 r#"{"text":"Please make the heading warmer.","request_id":"message-1"}"#,
21993 ))
21994 .unwrap()
21995 };
21996 assert_eq!(
21997 app.clone().oneshot(request()).await.unwrap().status(),
21998 StatusCode::CREATED
21999 );
22000 assert_eq!(
22001 app.oneshot(request()).await.unwrap().status(),
22002 StatusCode::OK
22003 );
22004 let guard = handle.session.lock().unwrap();
22005 let log = guard.as_ref().unwrap();
22006 let matching: Vec<_> = log
22007 .derive_transcript()
22008 .into_iter()
22009 .filter(|item| item.author_id.as_deref() == Some("person-message"))
22010 .collect();
22011 assert_eq!(matching.len(), 1);
22012 assert_eq!(matching[0].author_name.as_deref(), Some("Asha"));
22013 assert_eq!(
22014 matching[0].message.text_content(),
22015 "Asha: Please make the heading warmer."
22016 );
22017 }
22018
22019 #[tokio::test]
22020 async fn participant_one_time_approval_is_exact_attributed_and_cannot_create_a_rule() {
22021 use tower::ServiceExt;
22022
22023 vak_config::paths::isolate_home_for_tests();
22024 let dir = tempfile::tempdir().unwrap();
22025 let core = Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
22026 core.set_sessions_home(dir.path().join("home"));
22027 seed_bound_result(&core, "session-approval", "exec-approval");
22028 let state = AppState::new(core.clone());
22029 let path = core
22030 .sessions_home()
22031 .join("sessions")
22032 .join(vak_core::memory::hash_cwd(core.cwd()))
22033 .join("session-approval.jsonl");
22034 let session = SessionLog::open(path).unwrap();
22035 let handle = register_handle(
22036 &state,
22037 "session-approval".into(),
22038 session,
22039 core.cwd().to_path_buf(),
22040 core.clone(),
22041 );
22042 let (respond, answer) = oneshot::channel();
22043 let answered_by = Arc::new(Mutex::new(None));
22044 handle.pending.lock().unwrap().insert(
22045 "request-approval".into(),
22046 ApprovalRequest {
22047 id: "request-approval".into(),
22048 tool: "write".into(),
22049 args_json: r#"{"path":"draft.txt"}"#.into(),
22050 reason: "Save the requested draft".into(),
22051 requested_at: chrono::Utc::now(),
22052 respond: Arc::new(Mutex::new(Some(respond))),
22053 answered_by: answered_by.clone(),
22054 delegated_to: Arc::new(Mutex::new(None)),
22055 },
22056 );
22057 let token = "participant-approval-token";
22058 coworking::invite(
22059 &coworking::store_path(&core.sessions_home()),
22060 coworking::AudienceGrant {
22061 grant_id: "grant-approval".into(),
22062 principal_id: "person-approval".into(),
22063 display_name: "Asha".into(),
22064 conversation_id: "session-approval".into(),
22065 audience_id: "local".into(),
22066 capabilities: vec!["read".into()],
22067 token_hash: coworking::token_hash(token),
22068 created_at: chrono::Utc::now().to_rfc3339(),
22069 expires_at: (chrono::Utc::now() + chrono::Duration::hours(1)).to_rfc3339(),
22070 },
22071 )
22072 .unwrap();
22073 coworking::invite(
22074 &coworking::store_path(&core.sessions_home()),
22075 coworking::AudienceGrant {
22076 grant_id: "grant-other".into(),
22077 principal_id: "person-other".into(),
22078 display_name: "Ravi".into(),
22079 conversation_id: "session-approval".into(),
22080 audience_id: "local".into(),
22081 capabilities: vec!["read".into()],
22082 token_hash: coworking::token_hash("participant-other-token"),
22083 created_at: chrono::Utc::now().to_rfc3339(),
22084 expires_at: (chrono::Utc::now() + chrono::Duration::hours(1)).to_rfc3339(),
22085 },
22086 )
22087 .unwrap();
22088 let app = Router::new()
22089 .route(
22090 "/sessions/{id}/coworking/approvals",
22091 get(list_coworking_approvals),
22092 )
22093 .route(
22094 "/sessions/{id}/coworking/approvals/{req_id}",
22095 post(answer_coworking_approval),
22096 )
22097 .route(
22098 "/sessions/{id}/coworking/approvals/{req_id}/delegate",
22099 post(delegate_coworking_approval),
22100 )
22101 .with_state(state)
22102 .layer(axum::middleware::from_fn_with_state(
22103 AuthPolicy {
22104 token: "operator-secret".into(),
22105 home: core.sessions_home(),
22106 trusted_hosts: Vec::new(),
22107 },
22108 require_bearer,
22109 ));
22110 let authorization = format!("Bearer {token}");
22111 let list = axum::http::Request::builder()
22112 .uri("/sessions/session-approval/coworking/approvals")
22113 .header(axum::http::header::AUTHORIZATION, authorization.clone())
22114 .body(axum::body::Body::empty())
22115 .unwrap();
22116 assert_eq!(
22117 app.clone().oneshot(list).await.unwrap().status(),
22118 StatusCode::OK
22119 );
22120 let premature = axum::http::Request::builder()
22121 .method(axum::http::Method::POST)
22122 .uri("/sessions/session-approval/coworking/approvals/request-approval")
22123 .header(axum::http::header::AUTHORIZATION, authorization.clone())
22124 .header(axum::http::header::CONTENT_TYPE, "application/json")
22125 .body(axum::body::Body::from(r#"{"approve":true}"#))
22126 .unwrap();
22127 assert_eq!(
22128 app.clone().oneshot(premature).await.unwrap().status(),
22129 StatusCode::FORBIDDEN
22130 );
22131 let delegate = axum::http::Request::builder()
22132 .method(axum::http::Method::POST)
22133 .uri("/sessions/session-approval/coworking/approvals/request-approval/delegate")
22134 .header(axum::http::header::AUTHORIZATION, "Bearer operator-secret")
22135 .header(axum::http::header::CONTENT_TYPE, "application/json")
22136 .body(axum::body::Body::from(r#"{"grant_id":"grant-approval"}"#))
22137 .unwrap();
22138 assert_eq!(
22139 app.clone().oneshot(delegate).await.unwrap().status(),
22140 StatusCode::OK
22141 );
22142 let reassign = axum::http::Request::builder()
22143 .method(axum::http::Method::POST)
22144 .uri("/sessions/session-approval/coworking/approvals/request-approval/delegate")
22145 .header(axum::http::header::AUTHORIZATION, "Bearer operator-secret")
22146 .header(axum::http::header::CONTENT_TYPE, "application/json")
22147 .body(axum::body::Body::from(r#"{"grant_id":"grant-other"}"#))
22148 .unwrap();
22149 assert_eq!(
22150 app.clone().oneshot(reassign).await.unwrap().status(),
22151 StatusCode::CONFLICT
22152 );
22153 let wrong_person = axum::http::Request::builder()
22154 .method(axum::http::Method::POST)
22155 .uri("/sessions/session-approval/coworking/approvals/request-approval")
22156 .header(
22157 axum::http::header::AUTHORIZATION,
22158 "Bearer participant-other-token",
22159 )
22160 .header(axum::http::header::CONTENT_TYPE, "application/json")
22161 .body(axum::body::Body::from(r#"{"approve":true}"#))
22162 .unwrap();
22163 assert_eq!(
22164 app.clone().oneshot(wrong_person).await.unwrap().status(),
22165 StatusCode::FORBIDDEN
22166 );
22167 let assignment_count = handle.session.lock().unwrap().as_ref().unwrap().chain_to_root()
22168 .iter().filter(|entry| matches!(&entry.payload,
22169 vak_session::EntryPayload::Activity(activity)
22170 if activity.activity_id == "approval-delegation-request-approval"
22171 && activity.data.get("delegate_id").map(String::as_str) == Some("person-approval")))
22172 .count();
22173 assert_eq!(assignment_count, 1);
22174 let other_request = "other-request";
22175 let (other_respond, _other_answer) = oneshot::channel();
22176 handle.pending.lock().unwrap().insert(
22177 other_request.into(),
22178 ApprovalRequest {
22179 id: other_request.into(),
22180 tool: "write".into(),
22181 args_json: r#"{"path":"other.txt"}"#.into(),
22182 reason: "Save another draft".into(),
22183 requested_at: chrono::Utc::now(),
22184 respond: Arc::new(Mutex::new(Some(other_respond))),
22185 answered_by: Arc::new(Mutex::new(None)),
22186 delegated_to: Arc::new(Mutex::new(None)),
22187 },
22188 );
22189 let other_decision = axum::http::Request::builder()
22190 .method(axum::http::Method::POST)
22191 .uri(format!(
22192 "/sessions/session-approval/coworking/approvals/{other_request}"
22193 ))
22194 .header(axum::http::header::AUTHORIZATION, authorization.clone())
22195 .header(axum::http::header::CONTENT_TYPE, "application/json")
22196 .body(axum::body::Body::from(r#"{"approve":true}"#))
22197 .unwrap();
22198 assert_eq!(
22199 app.clone().oneshot(other_decision).await.unwrap().status(),
22200 StatusCode::FORBIDDEN
22201 );
22202 handle.pending.lock().unwrap().remove(other_request);
22203 let decide = axum::http::Request::builder()
22204 .method(axum::http::Method::POST)
22205 .uri("/sessions/session-approval/coworking/approvals/request-approval")
22206 .header(axum::http::header::AUTHORIZATION, authorization)
22207 .header(axum::http::header::CONTENT_TYPE, "application/json")
22208 .body(axum::body::Body::from(
22209 r#"{"approve":true,"remember":true}"#,
22210 ))
22211 .unwrap();
22212 assert_eq!(app.oneshot(decide).await.unwrap().status(), StatusCode::OK);
22213 assert!(answer.await.unwrap());
22214 assert_eq!(
22215 answered_by.lock().unwrap().clone(),
22216 Some(("person-approval".into(), "Asha".into()))
22217 );
22218 assert!(handle.pending.lock().unwrap().is_empty());
22219 assert!(!core.cwd().join(".vak/permissions.local.toml").exists());
22220 }
22221
22222 #[tokio::test]
22223 async fn participant_comment_is_shared_and_revocation_blocks_access() {
22224 use futures::StreamExt;
22225 use tower::ServiceExt;
22226
22227 vak_config::paths::isolate_home_for_tests();
22228 let dir = tempfile::tempdir().unwrap();
22229 let core = Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
22230 core.set_sessions_home(dir.path().join("home"));
22231 seed_bound_result(&core, "session-1", "exec-1");
22232 let state = AppState::new(core.clone());
22233 let scratch = dir.path().join(".vak/scratch/e1");
22234 tokio::fs::create_dir_all(&scratch).await.unwrap();
22235 tokio::fs::write(scratch.join("result.txt"), "saved candidate")
22236 .await
22237 .unwrap();
22238 let candidate = export_candidate(&state).await;
22239 let session_path = core
22240 .sessions_home()
22241 .join("sessions")
22242 .join(vak_core::memory::hash_cwd(core.cwd()))
22243 .join("session-1.jsonl");
22244 let session = SessionLog::open(session_path).unwrap();
22245 register_handle(
22246 &state,
22247 "session-1".into(),
22248 session,
22249 core.cwd().to_path_buf(),
22250 core.clone(),
22251 );
22252
22253 let token = "participant-comment-token";
22254 let grants = coworking::store_path(&core.sessions_home());
22255 coworking::invite(
22256 &grants,
22257 coworking::AudienceGrant {
22258 grant_id: "grant-comment".into(),
22259 principal_id: "person-2".into(),
22260 display_name: "Asha".into(),
22261 conversation_id: "session-1".into(),
22262 audience_id: "local".into(),
22263 capabilities: vec!["read".into(), "comment".into()],
22264 token_hash: coworking::token_hash(token),
22265 created_at: chrono::Utc::now().to_rfc3339(),
22266 expires_at: (chrono::Utc::now() + chrono::Duration::hours(1)).to_rfc3339(),
22267 },
22268 )
22269 .unwrap();
22270 let comments_path = format!(
22271 "/sessions/session-1/sandbox/candidates/{}/comments",
22272 candidate.candidate.candidate_id
22273 );
22274 let app = Router::new()
22275 .route(
22276 "/sessions/{id}/sandbox/candidates/{candidate_id}/comments",
22277 get(list_sandbox_candidate_comments).post(comment_on_sandbox_candidate),
22278 )
22279 .route("/sessions/{id}/coworking/updates", get(coworking_updates))
22280 .with_state(state)
22281 .layer(axum::middleware::from_fn_with_state(
22282 AuthPolicy {
22283 token: "operator-secret".into(),
22284 home: core.sessions_home(),
22285 trusted_hosts: Vec::new(),
22286 },
22287 require_bearer,
22288 ));
22289 let request = |method: axum::http::Method, bearer: &str, body: String| {
22290 axum::http::Request::builder()
22291 .method(method)
22292 .uri(&comments_path)
22293 .header(
22294 axum::http::header::AUTHORIZATION,
22295 format!("Bearer {bearer}"),
22296 )
22297 .header(axum::http::header::CONTENT_TYPE, "application/json")
22298 .body(axum::body::Body::from(body))
22299 .unwrap()
22300 };
22301 let posted = app.clone().oneshot(request(axum::http::Method::POST, token,
22302 serde_json::json!({"text":"Please make this clearer", "path":"result.txt", "line_start":1}).to_string()))
22303 .await.unwrap();
22304 assert_eq!(posted.status(), StatusCode::CREATED);
22305 let receipt: serde_json::Value = serde_json::from_slice(
22306 &axum::body::to_bytes(posted.into_body(), 64 * 1024)
22307 .await
22308 .unwrap(),
22309 )
22310 .unwrap();
22311 assert_eq!(receipt["intervention"], false);
22312 let participant_read = app
22313 .clone()
22314 .oneshot(request(axum::http::Method::GET, token, String::new()))
22315 .await
22316 .unwrap();
22317 assert_eq!(participant_read.status(), StatusCode::OK);
22318 let participant_body: serde_json::Value = serde_json::from_slice(
22319 &axum::body::to_bytes(participant_read.into_body(), 64 * 1024)
22320 .await
22321 .unwrap(),
22322 )
22323 .unwrap();
22324 let owner_read = app
22325 .clone()
22326 .oneshot(request(
22327 axum::http::Method::GET,
22328 "operator-secret",
22329 String::new(),
22330 ))
22331 .await
22332 .unwrap();
22333 assert_eq!(owner_read.status(), StatusCode::OK);
22334 let body: serde_json::Value = serde_json::from_slice(
22335 &axum::body::to_bytes(owner_read.into_body(), 64 * 1024)
22336 .await
22337 .unwrap(),
22338 )
22339 .unwrap();
22340 assert_eq!(body["comments"][0]["actor_id"], "person-2");
22341 assert_eq!(body["comments"][0]["actor_name"], "Asha");
22342 assert_eq!(body["comments"][0]["path"], "result.txt");
22343 assert_eq!(participant_body["comments"], body["comments"]);
22344 coworking::invite(
22345 &grants,
22346 coworking::AudienceGrant {
22347 grant_id: "grant-read-only".into(),
22348 principal_id: "person-3".into(),
22349 display_name: "Ravi".into(),
22350 conversation_id: "session-1".into(),
22351 audience_id: "local".into(),
22352 capabilities: vec!["read".into()],
22353 token_hash: coworking::token_hash("read-only-token"),
22354 created_at: chrono::Utc::now().to_rfc3339(),
22355 expires_at: (chrono::Utc::now() + chrono::Duration::hours(1)).to_rfc3339(),
22356 },
22357 )
22358 .unwrap();
22359 assert_eq!(
22360 app.clone()
22361 .oneshot(request(
22362 axum::http::Method::POST,
22363 "read-only-token",
22364 serde_json::json!({"text":"Cannot write"}).to_string()
22365 ))
22366 .await
22367 .unwrap()
22368 .status(),
22369 StatusCode::FORBIDDEN
22370 );
22371 let updates = app
22372 .clone()
22373 .oneshot(
22374 axum::http::Request::builder()
22375 .uri("/sessions/session-1/coworking/updates")
22376 .header(axum::http::header::AUTHORIZATION, format!("Bearer {token}"))
22377 .body(axum::body::Body::empty())
22378 .unwrap(),
22379 )
22380 .await
22381 .unwrap();
22382 assert_eq!(updates.status(), StatusCode::OK);
22383 let mut events = updates.into_body().into_data_stream();
22384 let heartbeat = tokio::time::timeout(std::time::Duration::from_secs(3), events.next())
22385 .await
22386 .unwrap()
22387 .unwrap()
22388 .unwrap();
22389 assert!(
22390 std::str::from_utf8(&heartbeat)
22391 .unwrap()
22392 .contains("event: heartbeat")
22393 );
22394 assert_eq!(
22395 app.clone()
22396 .oneshot(request(
22397 axum::http::Method::POST,
22398 token,
22399 serde_json::json!({"text":"One more note", "path":"result.txt"}).to_string()
22400 ))
22401 .await
22402 .unwrap()
22403 .status(),
22404 StatusCode::CREATED
22405 );
22406 let refresh = tokio::time::timeout(std::time::Duration::from_secs(3), events.next())
22407 .await
22408 .unwrap()
22409 .unwrap()
22410 .unwrap();
22411 assert!(
22412 std::str::from_utf8(&refresh)
22413 .unwrap()
22414 .contains("event: refresh")
22415 );
22416 coworking::revoke(&grants, "grant-comment", "operator").unwrap();
22417 let revoked = tokio::time::timeout(std::time::Duration::from_secs(3), events.next())
22418 .await
22419 .unwrap()
22420 .unwrap()
22421 .unwrap();
22422 assert!(
22423 std::str::from_utf8(&revoked)
22424 .unwrap()
22425 .contains("event: revoked")
22426 );
22427 assert!(
22428 tokio::time::timeout(std::time::Duration::from_secs(1), events.next())
22429 .await
22430 .unwrap()
22431 .is_none()
22432 );
22433 assert_eq!(
22434 app.oneshot(request(axum::http::Method::GET, token, String::new()))
22435 .await
22436 .unwrap()
22437 .status(),
22438 StatusCode::UNAUTHORIZED
22439 );
22440 }
22441
22442 #[tokio::test]
22443 async fn development_library_activates_seed_recipes_without_persisting_them() {
22444 let empty = vak_presentation::PresentationLibrary::default();
22445 let effective = super::effective_presentation_library(&empty, "/tmp/vak-dev-workspace");
22446 assert_eq!(empty.definitions().count(), 0);
22447 assert!(empty.activations().is_empty());
22448 assert_eq!(effective.definitions().count(), 75);
22449 assert_eq!(effective.activations().len(), 75);
22450 assert!(
22451 effective
22452 .select_preferred("metric", "user", "/tmp/vak-dev-workspace")
22453 .is_some()
22454 );
22455 assert!(
22456 effective
22457 .select_preferred("coding.diff", "user", "/tmp/vak-dev-workspace")
22458 .is_some()
22459 );
22460 }
22461
22462 #[tokio::test]
22463 async fn activate_all_and_deactivate_all_presentations() {
22464 let dir = tempfile::tempdir().unwrap();
22465 let store =
22466 vak_store::presentation::PresentationStore::new(dir.path().join("presentations.json"));
22467 let mut library = vak_presentation::PresentationLibrary::default();
22468 for seed in vak_presentation::seeds::built_in_seed_pack() {
22469 library.register(seed).unwrap();
22470 }
22471 store.save(&library).unwrap();
22472
22473 // Verify activate all
22474 let mut latest_by_id: std::collections::BTreeMap<String, u64> =
22475 std::collections::BTreeMap::new();
22476 for def in library.definitions() {
22477 let entry = latest_by_id
22478 .entry(def.spec.id.clone())
22479 .or_insert(def.spec.revision);
22480 if def.spec.revision > *entry {
22481 *entry = def.spec.revision;
22482 }
22483 }
22484 let mut activated = 0;
22485 for (id, rev) in latest_by_id {
22486 if library
22487 .activate(&id, rev, vak_presentation::LibraryScope::User, "user")
22488 .is_ok()
22489 {
22490 activated += 1;
22491 }
22492 }
22493 assert_eq!(activated, 75);
22494 assert_eq!(library.activations().len(), 75);
22495
22496 // Verify deactivate all
22497 let spec_ids: Vec<String> = library
22498 .activations()
22499 .iter()
22500 .filter(|a| a.scope == vak_presentation::LibraryScope::User && a.owner == "user")
22501 .map(|a| a.spec_id.clone())
22502 .collect();
22503 for id in spec_ids {
22504 library.deactivate(&id, vak_presentation::LibraryScope::User, "user");
22505 }
22506 assert_eq!(library.activations().len(), 0);
22507 }
22508}
22509
22510#[cfg(test)]
22511#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
22512mod scheduler_state_tests {
22513 use super::*;
22514
22515 struct Answers;
22516
22517 #[async_trait::async_trait]
22518 impl Provider for Answers {
22519 fn name(&self) -> &str {
22520 "answers"
22521 }
22522
22523 async fn stream(
22524 &self,
22525 _request: vak_llm::types::ChatRequest,
22526 _cancel: CancellationToken,
22527 ) -> Result<vak_llm::EventStream, vak_llm::LlmError> {
22528 let done = vak_llm::types::AssistantMessage {
22529 content: vec![vak_llm::ContentBlock::text("done")],
22530 stop_reason: vak_llm::types::StopReason::EndTurn,
22531 usage: vak_llm::types::Usage::default(),
22532 model: "answers".into(),
22533 response_id: None,
22534 };
22535 let (mut sink, rx) = vak_llm::stream::channel(8);
22536 sink.push(vak_llm::stream::StreamEvent::Start {
22537 partial: done.clone(),
22538 });
22539 sink.close_message(done).await;
22540 Ok(rx)
22541 }
22542 }
22543
22544 fn git(cwd: &std::path::Path, args: &[&str]) {
22545 let out = std::process::Command::new("git")
22546 .args(args)
22547 .current_dir(cwd)
22548 .env("GIT_AUTHOR_NAME", "t")
22549 .env("GIT_AUTHOR_EMAIL", "t@t")
22550 .env("GIT_COMMITTER_NAME", "t")
22551 .env("GIT_COMMITTER_EMAIL", "t@t")
22552 .output()
22553 .unwrap();
22554 assert!(out.status.success(), "git {args:?}");
22555 }
22556
22557 fn make_repo(cwd: &std::path::Path) {
22558 git(cwd, &["init", "-q"]);
22559 std::fs::write(cwd.join("README.md"), "seed\n").unwrap();
22560 git(cwd, &["add", "."]);
22561 git(cwd, &["commit", "-q", "-m", "seed"]);
22562 }
22563
22564 fn cron_task(id: &str, cwd: &std::path::Path, agent_id: Option<&str>) -> TaskDef {
22565 serde_json::from_value(serde_json::json!({
22566 "id": id,
22567 "name": id,
22568 "prompt": "summarise",
22569 "enabled": true,
22570 "cwd": cwd,
22571 "created_at": chrono::Utc::now(),
22572 "last_run_at": null,
22573 "last_session_id": null,
22574 "last_summary": null,
22575 "schedule": "0 3 * * *",
22576 "agent_id": agent_id,
22577 }))
22578 .unwrap()
22579 }
22580
22581 fn state_with(
22582 ws: &std::path::Path,
22583 home: &std::path::Path,
22584 tasks: Vec<TaskDef>,
22585 agent: Option<vak_session::types::AgentIdentity>,
22586 ) -> AppState {
22587 vak_config::paths::isolate_home_for_tests();
22588 std::fs::create_dir_all(ws.join(".vak")).unwrap();
22589 std::fs::write(
22590 ws.join(".vak/config.toml"),
22591 "[memory]\nreflection = false\n",
22592 )
22593 .unwrap();
22594 let core = Core::new_with_trust(ws.to_path_buf(), true)
22595 .unwrap()
22596 .with_agent_identity(agent);
22597 core.set_sessions_home(home.to_path_buf());
22598 core.set_provider_instance(Arc::new(Answers));
22599 let mut store = vak_core::tasks::TaskStore::load(home).unwrap();
22600 for task in tasks {
22601 store.put(task);
22602 }
22603 store.save().unwrap();
22604 AppState::new(core)
22605 }
22606
22607 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
22608 async fn cron_slot_not_lost_on_failure() {
22609 let dir = tempfile::tempdir().unwrap();
22610 let (ws, home) = (dir.path().join("ws"), dir.path().join("home"));
22611 std::fs::create_dir_all(&ws).unwrap();
22612 let state = state_with(&ws, &home, vec![cron_task("nightly", &ws, None)], None);
22613 let slot = chrono::Local::now() - chrono::Duration::minutes(5);
22614 let marker = |state: &AppState| state.next_fire.lock().unwrap().get("nightly").copied();
22615 state
22616 .next_fire
22617 .lock()
22618 .unwrap()
22619 .insert("nightly".into(), slot);
22620
22621 scheduler_tick(&state).await;
22622 assert_eq!(
22623 marker(&state),
22624 Some(slot),
22625 "a refused run leaves its slot to be tried again"
22626 );
22627
22628 make_repo(&ws);
22629 scheduler_tick(&state).await;
22630 assert!(
22631 marker(&state).is_some_and(|next| next > chrono::Local::now()),
22632 "the slot is spent once a run starts"
22633 );
22634 }
22635
22636 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
22637 async fn child_core_home_is_not_nested() {
22638 let dir = tempfile::tempdir().unwrap();
22639 let (ws, home) = (dir.path().join("ws"), dir.path().join("home"));
22640 std::fs::create_dir_all(&ws).unwrap();
22641 make_repo(&ws);
22642 let writer = agents::builtin_templates()
22643 .into_iter()
22644 .find(|template| template.template_id == "writer")
22645 .unwrap()
22646 .to_agent_definition("writer", None);
22647 agents::save(&ws, &[writer], true).unwrap();
22648 let vak = vak_session::types::AgentIdentity {
22649 id: "vak".into(),
22650 revision: 1,
22651 name: "Vakyartha".into(),
22652 character: String::new(),
22653 personality: String::new(),
22654 animation: "spark".into(),
22655 voice: "calm".into(),
22656 behaviour: String::new(),
22657 responsibilities: String::new(),
22658 instructions: String::new(),
22659 };
22660 let state = state_with(
22661 &ws,
22662 &home,
22663 vec![cron_task("for-writer", &ws, Some("writer"))],
22664 Some(vak),
22665 );
22666 load_tasks(&state);
22667 let session = fire_task(&state, "for-writer")
22668 .await
22669 .unwrap_or_else(|_| panic!("the routine starts"));
22670
22671 let ledger = std::fs::read_dir(home.join("agents").join("writer").join("sessions"))
22672 .unwrap()
22673 .flatten()
22674 .any(|project| project.path().join(format!("{session}.jsonl")).is_file());
22675 assert!(ledger, "the run's ledger is under the writer's own home");
22676 assert!(
22677 !home.join("agents").join("vak").join("agents").exists(),
22678 "no Agent home nested inside another's"
22679 );
22680 }
22681}
22682

21732 "/sessions/session-1/office-workspaces/room-1/presence",
21733 &participant(&["read"])
21734 ));
21735 assert!(!participant_read_route_allowed(
21736 &axum::http::Method::POST,
21737 "/sessions/session-1/office-workspaces/room-1",
21738 &participant(&["read"])
21739 ));
21740 assert!(participant_read_route_allowed(
21741 &axum::http::Method::POST,
21742 "/sessions/session-1/office-workspaces/room-1",
21743 &participant(&["read", "edit"])
21744 ));
21745 assert!(!participant_read_route_allowed(
21746 &axum::http::Method::POST,
21747 "/sessions/session-1/coworking/messages",
21748 &participant(&["read", "comment"])
21749 ));
21750 assert!(participant_read_route_allowed(
21751 &axum::http::Method::GET,
21752 "/sessions/session-1/coworking/approvals",
21753 &participant(&["read", "approve_once"])
21754 ));
21755 assert!(participant_read_route_allowed(
21756 &axum::http::Method::POST,
21757 "/sessions/session-1/coworking/approvals/request-1",
21758 &participant(&["read"])
21759 ));
21760 assert!(participant_read_route_allowed(
21761 &axum::http::Method::POST,
21762 "/sessions/session-1/coworking/approvals/request-1",
21763 &participant(&["read", "message"])
21764 ));
21765 assert!(!participant_read_route_allowed(
21766 &axum::http::Method::POST,
21767 "/sessions/session-1/sandbox/promote",
21768 &participant(&["read", "comment"])
21769 ));
21770 assert!(!participant_read_route_allowed(
21771 &axum::http::Method::POST,
21772 "/sessions/session-1/sandbox/candidates/candidate-1/comments/comment-1/request-revision",
21773 &participant(&["read", "comment"])
21774 ));
21775 assert!(!participant_read_route_allowed(
21776 &axum::http::Method::GET,
21777 "/sessions/session-1/transcript",
21778 &participant(&["comment"])
21779 ));
21780 }
21781
21782 #[test]
21783 fn coworking_presence_is_observed_and_expires() {
21784 vak_config::paths::isolate_home_for_tests();
21785 let dir = tempfile::tempdir().unwrap();
21786 let core = Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
21787 let state = AppState::new(core);
21788 touch_coworking_presence(&state, "conversation-1", "person-1", "Asha");
21789 let snapshot = coworking_presence_snapshot(&state, "conversation-1");
21790 assert_eq!(snapshot["participants"][0]["principal_id"], "person-1");
21791 assert_eq!(snapshot["participants"][0]["display_name"], "Asha");
21792 state
21793 .coworking_presence
21794 .lock()
21795 .unwrap()
21796 .get_mut("conversation-1")
21797 .unwrap()
21798 .get_mut("person-1")
21799 .unwrap()
21800 .seen_at = Instant::now() - COWORKING_PRESENCE_TTL - Duration::from_secs(1);
21801 assert_eq!(
21802 coworking_presence_snapshot(&state, "conversation-1")["participants"]
21803 .as_array()
21804 .unwrap()
21805 .len(),
21806 0
21807 );
21808 }
21809
21810 #[tokio::test]
21811 async fn participant_bearer_is_enforced_by_http_boundary() {
21812 use tower::ServiceExt;
21813
21814 let dir = tempfile::tempdir().unwrap();
21815 let core = Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
21816 core.set_sessions_home(dir.path().to_path_buf());
21817 seed_bound_result(&core, "session-1", "execution-1");
21818 let state = AppState::new(core);
21819 let token = "participant-secret";
21820 let grant = coworking::AudienceGrant {
21821 grant_id: "grant-http".into(),
21822 principal_id: "person-http".into(),
21823 display_name: "Asha".into(),
21824 conversation_id: "session-1".into(),
21825 audience_id: "local".into(),
21826 capabilities: vec!["read".into()],
21827 token_hash: coworking::token_hash(token),
21828 created_at: chrono::Utc::now().to_rfc3339(),
21829 expires_at: (chrono::Utc::now() + chrono::Duration::hours(1)).to_rfc3339(),
21830 };
21831 coworking::invite(&coworking::store_path(dir.path()), grant).unwrap();
21832 coworking::invite(
21833 &coworking::store_path(dir.path()),
21834 coworking::AudienceGrant {
21835 grant_id: "grant-wrong-audience".into(),
21836 principal_id: "person-wrong-audience".into(),
21837 display_name: "Ravi".into(),
21838 conversation_id: "session-1".into(),
21839 audience_id: "conversation:someone-else".into(),
21840 capabilities: vec!["read".into()],
21841 token_hash: coworking::token_hash("participant-wrong-audience"),
21842 created_at: chrono::Utc::now().to_rfc3339(),
21843 expires_at: (chrono::Utc::now() + chrono::Duration::hours(1)).to_rfc3339(),
21844 },
21845 )
21846 .unwrap();
21847 let app = Router::new()
21848 .route(
21849 "/sessions/{id}/transcript",
21850 get(|| async { StatusCode::OK }),
21851 )
21852 .route(
21853 "/sessions/{id}/run",
21854 post(|| async { StatusCode::NO_CONTENT }),
21855 )
21856 .with_state(state.clone())
21857 .layer(axum::middleware::from_fn_with_state(
21858 state,
21859 enforce_participant_audience,
21860 ))
21861 .layer(axum::middleware::from_fn_with_state(
21862 AuthPolicy {
21863 token: "operator-secret".into(),
21864 home: dir.path().into(),
21865 trusted_hosts: Vec::new(),
21866 },
21867 require_bearer,
21868 ));
21869 let request = |method: axum::http::Method, path: &str| {
21870 axum::http::Request::builder()
21871 .method(method)
21872 .uri(path)
21873 .header(axum::http::header::AUTHORIZATION, format!("Bearer {token}"))
21874 .body(axum::body::Body::empty())
21875 .unwrap()
21876 };
21877 assert_eq!(
21878 app.clone()
21879 .oneshot(request(
21880 axum::http::Method::GET,
21881 "/sessions/session-1/transcript"
21882 ))
21883 .await
21884 .unwrap()
21885 .status(),
21886 StatusCode::OK
21887 );
21888 let wrong_audience = axum::http::Request::builder()
21889 .uri("/sessions/session-1/transcript")
21890 .header(
21891 axum::http::header::AUTHORIZATION,
21892 "Bearer participant-wrong-audience",
21893 )
21894 .body(axum::body::Body::empty())
21895 .unwrap();
21896 assert_eq!(
21897 app.clone().oneshot(wrong_audience).await.unwrap().status(),
21898 StatusCode::FORBIDDEN
21899 );
21900 assert_eq!(
21901 app.clone()
21902 .oneshot(request(
21903 axum::http::Method::GET,
21904 "/sessions/session-2/transcript"
21905 ))
21906 .await
21907 .unwrap()
21908 .status(),
21909 StatusCode::FORBIDDEN
21910 );
21911 assert_eq!(
21912 app.clone()
21913 .oneshot(request(axum::http::Method::POST, "/sessions/session-1/run"))
21914 .await
21915 .unwrap()
21916 .status(),
21917 StatusCode::FORBIDDEN
21918 );
21919 coworking::revoke(&coworking::store_path(dir.path()), "grant-http", "operator").unwrap();
21920 assert_eq!(
21921 app.oneshot(request(
21922 axum::http::Method::GET,
21923 "/sessions/session-1/transcript"
21924 ))
21925 .await
21926 .unwrap()
21927 .status(),
21928 StatusCode::UNAUTHORIZED
21929 );
21930 }
21931
21932 #[tokio::test]
21933 async fn participant_message_is_attributed_idempotent_and_does_not_start_work() {
21934 use tower::ServiceExt;
21935
21936 vak_config::paths::isolate_home_for_tests();
21937 let dir = tempfile::tempdir().unwrap();
21938 let core = Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
21939 core.set_sessions_home(dir.path().join("home"));
21940 seed_bound_result(&core, "session-message", "exec-message");
21941 let state = AppState::new(core.clone());
21942 let path = core
21943 .sessions_home()
21944 .join("sessions")
21945 .join(vak_core::memory::hash_cwd(core.cwd()))
21946 .join("session-message.jsonl");
21947 let session = SessionLog::open(path).unwrap();
21948 let handle = register_handle(
21949 &state,
21950 "session-message".into(),
21951 session,
21952 core.cwd().to_path_buf(),
21953 core.clone(),
21954 );
21955 let token = "participant-message-token";
21956 coworking::invite(
21957 &coworking::store_path(&core.sessions_home()),
21958 coworking::AudienceGrant {
21959 grant_id: "grant-message".into(),
21960 principal_id: "person-message".into(),
21961 display_name: "Asha".into(),
21962 conversation_id: "session-message".into(),
21963 audience_id: "local".into(),
21964 capabilities: vec!["read".into(), "message".into()],
21965 token_hash: coworking::token_hash(token),
21966 created_at: chrono::Utc::now().to_rfc3339(),
21967 expires_at: (chrono::Utc::now() + chrono::Duration::hours(1)).to_rfc3339(),
21968 },
21969 )
21970 .unwrap();
21971 let app = Router::new()
21972 .route(
21973 "/sessions/{id}/coworking/messages",
21974 post(create_coworking_message),
21975 )
21976 .with_state(state)
21977 .layer(axum::middleware::from_fn_with_state(
21978 AuthPolicy {
21979 token: "operator-secret".into(),
21980 home: core.sessions_home(),
21981 trusted_hosts: Vec::new(),
21982 },
21983 require_bearer,
21984 ));
21985 let request = || {
21986 axum::http::Request::builder()
21987 .method(axum::http::Method::POST)
21988 .uri("/sessions/session-message/coworking/messages")
21989 .header(axum::http::header::AUTHORIZATION, format!("Bearer {token}"))
21990 .header(axum::http::header::CONTENT_TYPE, "application/json")
21991 .body(axum::body::Body::from(
21992 r#"{"text":"Please make the heading warmer.","request_id":"message-1"}"#,
21993 ))
21994 .unwrap()
21995 };
21996 assert_eq!(
21997 app.clone().oneshot(request()).await.unwrap().status(),
21998 StatusCode::CREATED
21999 );
22000 assert_eq!(
22001 app.oneshot(request()).await.unwrap().status(),
22002 StatusCode::OK
22003 );
22004 let guard = handle.session.lock().unwrap();
22005 let log = guard.as_ref().unwrap();
22006 let matching: Vec<_> = log
22007 .derive_transcript()
22008 .into_iter()
22009 .filter(|item| item.author_id.as_deref() == Some("person-message"))
22010 .collect();
22011 assert_eq!(matching.len(), 1);
22012 assert_eq!(matching[0].author_name.as_deref(), Some("Asha"));
22013 assert_eq!(
22014 matching[0].message.text_content(),
22015 "Asha: Please make the heading warmer."
22016 );
22017 }
22018
22019 #[tokio::test]
22020 async fn participant_one_time_approval_is_exact_attributed_and_cannot_create_a_rule() {
22021 use tower::ServiceExt;
22022
22023 vak_config::paths::isolate_home_for_tests();
22024 let dir = tempfile::tempdir().unwrap();
22025 let core = Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
22026 core.set_sessions_home(dir.path().join("home"));
22027 seed_bound_result(&core, "session-approval", "exec-approval");
22028 let state = AppState::new(core.clone());
22029 let path = core
22030 .sessions_home()
22031 .join("sessions")
22032 .join(vak_core::memory::hash_cwd(core.cwd()))
22033 .join("session-approval.jsonl");
22034 let session = SessionLog::open(path).unwrap();
22035 let handle = register_handle(
22036 &state,
22037 "session-approval".into(),
22038 session,
22039 core.cwd().to_path_buf(),
22040 core.clone(),
22041 );
22042 let (respond, answer) = oneshot::channel();
22043 let answered_by = Arc::new(Mutex::new(None));
22044 handle.pending.lock().unwrap().insert(
22045 "request-approval".into(),
22046 ApprovalRequest {
22047 id: "request-approval".into(),
22048 tool: "write".into(),
22049 args_json: r#"{"path":"draft.txt"}"#.into(),
22050 reason: "Save the requested draft".into(),
22051 requested_at: chrono::Utc::now(),
22052 respond: Arc::new(Mutex::new(Some(respond))),
22053 answered_by: answered_by.clone(),
22054 delegated_to: Arc::new(Mutex::new(None)),
22055 },
22056 );
22057 let token = "participant-approval-token";
22058 coworking::invite(
22059 &coworking::store_path(&core.sessions_home()),
22060 coworking::AudienceGrant {
22061 grant_id: "grant-approval".into(),
22062 principal_id: "person-approval".into(),
22063 display_name: "Asha".into(),
22064 conversation_id: "session-approval".into(),
22065 audience_id: "local".into(),
22066 capabilities: vec!["read".into()],
22067 token_hash: coworking::token_hash(token),
22068 created_at: chrono::Utc::now().to_rfc3339(),
22069 expires_at: (chrono::Utc::now() + chrono::Duration::hours(1)).to_rfc3339(),
22070 },
22071 )
22072 .unwrap();
22073 coworking::invite(
22074 &coworking::store_path(&core.sessions_home()),
22075 coworking::AudienceGrant {
22076 grant_id: "grant-other".into(),
22077 principal_id: "person-other".into(),
22078 display_name: "Ravi".into(),
22079 conversation_id: "session-approval".into(),
22080 audience_id: "local".into(),
22081 capabilities: vec!["read".into()],
22082 token_hash: coworking::token_hash("participant-other-token"),
22083 created_at: chrono::Utc::now().to_rfc3339(),
22084 expires_at: (chrono::Utc::now() + chrono::Duration::hours(1)).to_rfc3339(),
22085 },
22086 )
22087 .unwrap();
22088 let app = Router::new()
22089 .route(
22090 "/sessions/{id}/coworking/approvals",
22091 get(list_coworking_approvals),
22092 )
22093 .route(
22094 "/sessions/{id}/coworking/approvals/{req_id}",
22095 post(answer_coworking_approval),
22096 )
22097 .route(
22098 "/sessions/{id}/coworking/approvals/{req_id}/delegate",
22099 post(delegate_coworking_approval),
22100 )
22101 .with_state(state)
22102 .layer(axum::middleware::from_fn_with_state(
22103 AuthPolicy {
22104 token: "operator-secret".into(),
22105 home: core.sessions_home(),
22106 trusted_hosts: Vec::new(),
22107 },
22108 require_bearer,
22109 ));
22110 let authorization = format!("Bearer {token}");
22111 let list = axum::http::Request::builder()
22112 .uri("/sessions/session-approval/coworking/approvals")
22113 .header(axum::http::header::AUTHORIZATION, authorization.clone())
22114 .body(axum::body::Body::empty())
22115 .unwrap();
22116 assert_eq!(
22117 app.clone().oneshot(list).await.unwrap().status(),
22118 StatusCode::OK
22119 );
22120 let premature = axum::http::Request::builder()
22121 .method(axum::http::Method::POST)
22122 .uri("/sessions/session-approval/coworking/approvals/request-approval")
22123 .header(axum::http::header::AUTHORIZATION, authorization.clone())
22124 .header(axum::http::header::CONTENT_TYPE, "application/json")
22125 .body(axum::body::Body::from(r#"{"approve":true}"#))
22126 .unwrap();
22127 assert_eq!(
22128 app.clone().oneshot(premature).await.unwrap().status(),
22129 StatusCode::FORBIDDEN
22130 );
22131 let delegate = axum::http::Request::builder()
22132 .method(axum::http::Method::POST)
22133 .uri("/sessions/session-approval/coworking/approvals/request-approval/delegate")
22134 .header(axum::http::header::AUTHORIZATION, "Bearer operator-secret")
22135 .header(axum::http::header::CONTENT_TYPE, "application/json")
22136 .body(axum::body::Body::from(r#"{"grant_id":"grant-approval"}"#))
22137 .unwrap();
22138 assert_eq!(
22139 app.clone().oneshot(delegate).await.unwrap().status(),
22140 StatusCode::OK
22141 );
22142 let reassign = axum::http::Request::builder()
22143 .method(axum::http::Method::POST)
22144 .uri("/sessions/session-approval/coworking/approvals/request-approval/delegate")
22145 .header(axum::http::header::AUTHORIZATION, "Bearer operator-secret")
22146 .header(axum::http::header::CONTENT_TYPE, "application/json")
22147 .body(axum::body::Body::from(r#"{"grant_id":"grant-other"}"#))
22148 .unwrap();
22149 assert_eq!(
22150 app.clone().oneshot(reassign).await.unwrap().status(),
22151 StatusCode::CONFLICT
22152 );
22153 let wrong_person = axum::http::Request::builder()
22154 .method(axum::http::Method::POST)
22155 .uri("/sessions/session-approval/coworking/approvals/request-approval")
22156 .header(
22157 axum::http::header::AUTHORIZATION,
22158 "Bearer participant-other-token",
22159 )
22160 .header(axum::http::header::CONTENT_TYPE, "application/json")
22161 .body(axum::body::Body::from(r#"{"approve":true}"#))
22162 .unwrap();
22163 assert_eq!(
22164 app.clone().oneshot(wrong_person).await.unwrap().status(),
22165 StatusCode::FORBIDDEN
22166 );
22167 let assignment_count = handle.session.lock().unwrap().as_ref().unwrap().chain_to_root()
22168 .iter().filter(|entry| matches!(&entry.payload,
22169 vak_session::EntryPayload::Activity(activity)
22170 if activity.activity_id == "approval-delegation-request-approval"
22171 && activity.data.get("delegate_id").map(String::as_str) == Some("person-approval")))
22172 .count();
22173 assert_eq!(assignment_count, 1);
22174 let other_request = "other-request";
22175 let (other_respond, _other_answer) = oneshot::channel();
22176 handle.pending.lock().unwrap().insert(
22177 other_request.into(),
22178 ApprovalRequest {
22179 id: other_request.into(),
22180 tool: "write".into(),
22181 args_json: r#"{"path":"other.txt"}"#.into(),
22182 reason: "Save another draft".into(),
22183 requested_at: chrono::Utc::now(),
22184 respond: Arc::new(Mutex::new(Some(other_respond))),
22185 answered_by: Arc::new(Mutex::new(None)),
22186 delegated_to: Arc::new(Mutex::new(None)),
22187 },
22188 );
22189 let other_decision = axum::http::Request::builder()
22190 .method(axum::http::Method::POST)
22191 .uri(format!(
22192 "/sessions/session-approval/coworking/approvals/{other_request}"
22193 ))
22194 .header(axum::http::header::AUTHORIZATION, authorization.clone())
22195 .header(axum::http::header::CONTENT_TYPE, "application/json")
22196 .body(axum::body::Body::from(r#"{"approve":true}"#))
22197 .unwrap();
22198 assert_eq!(
22199 app.clone().oneshot(other_decision).await.unwrap().status(),
22200 StatusCode::FORBIDDEN
22201 );
22202 handle.pending.lock().unwrap().remove(other_request);
22203 let decide = axum::http::Request::builder()
22204 .method(axum::http::Method::POST)
22205 .uri("/sessions/session-approval/coworking/approvals/request-approval")
22206 .header(axum::http::header::AUTHORIZATION, authorization)
22207 .header(axum::http::header::CONTENT_TYPE, "application/json")
22208 .body(axum::body::Body::from(
22209 r#"{"approve":true,"remember":true}"#,
22210 ))
22211 .unwrap();
22212 assert_eq!(app.oneshot(decide).await.unwrap().status(), StatusCode::OK);
22213 assert!(answer.await.unwrap());
22214 assert_eq!(
22215 answered_by.lock().unwrap().clone(),
22216 Some(("person-approval".into(), "Asha".into()))
22217 );
22218 assert!(handle.pending.lock().unwrap().is_empty());
22219 assert!(!core.cwd().join(".vak/permissions.local.toml").exists());
22220 }
22221
22222 #[tokio::test]
22223 async fn participant_comment_is_shared_and_revocation_blocks_access() {
22224 use futures::StreamExt;
22225 use tower::ServiceExt;
22226
22227 vak_config::paths::isolate_home_for_tests();
22228 let dir = tempfile::tempdir().unwrap();
22229 let core = Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
22230 core.set_sessions_home(dir.path().join("home"));
22231 seed_bound_result(&core, "session-1", "exec-1");
22232 let state = AppState::new(core.clone());
22233 let scratch = dir.path().join(".vak/scratch/e1");
22234 tokio::fs::create_dir_all(&scratch).await.unwrap();
22235 tokio::fs::write(scratch.join("result.txt"), "saved candidate")
22236 .await
22237 .unwrap();
22238 let candidate = export_candidate(&state).await;
22239 let session_path = core
22240 .sessions_home()
22241 .join("sessions")
22242 .join(vak_core::memory::hash_cwd(core.cwd()))
22243 .join("session-1.jsonl");
22244 let session = SessionLog::open(session_path).unwrap();
22245 register_handle(
22246 &state,
22247 "session-1".into(),
22248 session,
22249 core.cwd().to_path_buf(),
22250 core.clone(),
22251 );
22252
22253 let token = "participant-comment-token";
22254 let grants = coworking::store_path(&core.sessions_home());
22255 coworking::invite(
22256 &grants,
22257 coworking::AudienceGrant {
22258 grant_id: "grant-comment".into(),
22259 principal_id: "person-2".into(),
22260 display_name: "Asha".into(),
22261 conversation_id: "session-1".into(),
22262 audience_id: "local".into(),
22263 capabilities: vec!["read".into(), "comment".into()],
22264 token_hash: coworking::token_hash(token),
22265 created_at: chrono::Utc::now().to_rfc3339(),
22266 expires_at: (chrono::Utc::now() + chrono::Duration::hours(1)).to_rfc3339(),
22267 },
22268 )
22269 .unwrap();
22270 let comments_path = format!(
22271 "/sessions/session-1/sandbox/candidates/{}/comments",
22272 candidate.candidate.candidate_id
22273 );
22274 let app = Router::new()
22275 .route(
22276 "/sessions/{id}/sandbox/candidates/{candidate_id}/comments",
22277 get(list_sandbox_candidate_comments).post(comment_on_sandbox_candidate),
22278 )
22279 .route("/sessions/{id}/coworking/updates", get(coworking_updates))
22280 .with_state(state)
22281 .layer(axum::middleware::from_fn_with_state(
22282 AuthPolicy {
22283 token: "operator-secret".into(),
22284 home: core.sessions_home(),
22285 trusted_hosts: Vec::new(),
22286 },
22287 require_bearer,
22288 ));
22289 let request = |method: axum::http::Method, bearer: &str, body: String| {
22290 axum::http::Request::builder()
22291 .method(method)
22292 .uri(&comments_path)
22293 .header(
22294 axum::http::header::AUTHORIZATION,
22295 format!("Bearer {bearer}"),
22296 )
22297 .header(axum::http::header::CONTENT_TYPE, "application/json")
22298 .body(axum::body::Body::from(body))
22299 .unwrap()
22300 };
22301 let posted = app.clone().oneshot(request(axum::http::Method::POST, token,
22302 serde_json::json!({"text":"Please make this clearer", "path":"result.txt", "line_start":1}).to_string()))
22303 .await.unwrap();
22304 assert_eq!(posted.status(), StatusCode::CREATED);
22305 let receipt: serde_json::Value = serde_json::from_slice(
22306 &axum::body::to_bytes(posted.into_body(), 64 * 1024)
22307 .await
22308 .unwrap(),
22309 )
22310 .unwrap();
22311 assert_eq!(receipt["intervention"], false);
22312 let participant_read = app
22313 .clone()
22314 .oneshot(request(axum::http::Method::GET, token, String::new()))
22315 .await
22316 .unwrap();
22317 assert_eq!(participant_read.status(), StatusCode::OK);
22318 let participant_body: serde_json::Value = serde_json::from_slice(
22319 &axum::body::to_bytes(participant_read.into_body(), 64 * 1024)
22320 .await
22321 .unwrap(),
22322 )
22323 .unwrap();
22324 let owner_read = app
22325 .clone()
22326 .oneshot(request(
22327 axum::http::Method::GET,
22328 "operator-secret",
22329 String::new(),
22330 ))
22331 .await
22332 .unwrap();
22333 assert_eq!(owner_read.status(), StatusCode::OK);
22334 let body: serde_json::Value = serde_json::from_slice(
22335 &axum::body::to_bytes(owner_read.into_body(), 64 * 1024)
22336 .await
22337 .unwrap(),
22338 )
22339 .unwrap();
22340 assert_eq!(body["comments"][0]["actor_id"], "person-2");
22341 assert_eq!(body["comments"][0]["actor_name"], "Asha");
22342 assert_eq!(body["comments"][0]["path"], "result.txt");
22343 assert_eq!(participant_body["comments"], body["comments"]);
22344 coworking::invite(
22345 &grants,
22346 coworking::AudienceGrant {
22347 grant_id: "grant-read-only".into(),
22348 principal_id: "person-3".into(),
22349 display_name: "Ravi".into(),
22350 conversation_id: "session-1".into(),
22351 audience_id: "local".into(),
22352 capabilities: vec!["read".into()],
22353 token_hash: coworking::token_hash("read-only-token"),
22354 created_at: chrono::Utc::now().to_rfc3339(),
22355 expires_at: (chrono::Utc::now() + chrono::Duration::hours(1)).to_rfc3339(),
22356 },
22357 )
22358 .unwrap();
22359 assert_eq!(
22360 app.clone()
22361 .oneshot(request(
22362 axum::http::Method::POST,
22363 "read-only-token",
22364 serde_json::json!({"text":"Cannot write"}).to_string()
22365 ))
22366 .await
22367 .unwrap()
22368 .status(),
22369 StatusCode::FORBIDDEN
22370 );
22371 let updates = app
22372 .clone()
22373 .oneshot(
22374 axum::http::Request::builder()
22375 .uri("/sessions/session-1/coworking/updates")
22376 .header(axum::http::header::AUTHORIZATION, format!("Bearer {token}"))
22377 .body(axum::body::Body::empty())
22378 .unwrap(),
22379 )
22380 .await
22381 .unwrap();
22382 assert_eq!(updates.status(), StatusCode::OK);
22383 let mut events = updates.into_body().into_data_stream();
22384 let heartbeat = tokio::time::timeout(std::time::Duration::from_secs(3), events.next())
22385 .await
22386 .unwrap()
22387 .unwrap()
22388 .unwrap();
22389 assert!(
22390 std::str::from_utf8(&heartbeat)
22391 .unwrap()
22392 .contains("event: heartbeat")
22393 );
22394 assert_eq!(
22395 app.clone()
22396 .oneshot(request(
22397 axum::http::Method::POST,
22398 token,
22399 serde_json::json!({"text":"One more note", "path":"result.txt"}).to_string()
22400 ))
22401 .await
22402 .unwrap()
22403 .status(),
22404 StatusCode::CREATED
22405 );
22406 let refresh = tokio::time::timeout(std::time::Duration::from_secs(3), events.next())
22407 .await
22408 .unwrap()
22409 .unwrap()
22410 .unwrap();
22411 assert!(
22412 std::str::from_utf8(&refresh)
22413 .unwrap()
22414 .contains("event: refresh")
22415 );
22416 coworking::revoke(&grants, "grant-comment", "operator").unwrap();
22417 let revoked = tokio::time::timeout(std::time::Duration::from_secs(3), events.next())
22418 .await
22419 .unwrap()
22420 .unwrap()
22421 .unwrap();
22422 assert!(
22423 std::str::from_utf8(&revoked)
22424 .unwrap()
22425 .contains("event: revoked")
22426 );
22427 assert!(
22428 tokio::time::timeout(std::time::Duration::from_secs(1), events.next())
22429 .await
22430 .unwrap()
22431 .is_none()
22432 );
22433 assert_eq!(
22434 app.oneshot(request(axum::http::Method::GET, token, String::new()))
22435 .await
22436 .unwrap()
22437 .status(),
22438 StatusCode::UNAUTHORIZED
22439 );
22440 }
22441
22442 #[tokio::test]
22443 async fn development_library_activates_seed_recipes_without_persisting_them() {
22444 let empty = vak_presentation::PresentationLibrary::default();
22445 let effective = super::effective_presentation_library(&empty, "/tmp/vak-dev-workspace");
22446 assert_eq!(empty.definitions().count(), 0);
22447 assert!(empty.activations().is_empty());
22448 assert_eq!(effective.definitions().count(), 75);
22449 assert_eq!(effective.activations().len(), 75);
22450 assert!(
22451 effective
22452 .select_preferred("metric", "user", "/tmp/vak-dev-workspace")
22453 .is_some()
22454 );
22455 assert!(
22456 effective
22457 .select_preferred("coding.diff", "user", "/tmp/vak-dev-workspace")
22458 .is_some()
22459 );
22460 }
22461
22462 #[tokio::test]
22463 async fn activate_all_and_deactivate_all_presentations() {
22464 let dir = tempfile::tempdir().unwrap();
22465 let store =
22466 vak_store::presentation::PresentationStore::new(dir.path().join("presentations.json"));
22467 let mut library = vak_presentation::PresentationLibrary::default();
22468 for seed in vak_presentation::seeds::built_in_seed_pack() {
22469 library.register(seed).unwrap();
22470 }
22471 store.save(&library).unwrap();
22472
22473 // Verify activate all
22474 let mut latest_by_id: std::collections::BTreeMap<String, u64> =
22475 std::collections::BTreeMap::new();
22476 for def in library.definitions() {
22477 let entry = latest_by_id
22478 .entry(def.spec.id.clone())
22479 .or_insert(def.spec.revision);
22480 if def.spec.revision > *entry {
22481 *entry = def.spec.revision;
22482 }
22483 }
22484 let mut activated = 0;
22485 for (id, rev) in latest_by_id {
22486 if library
22487 .activate(&id, rev, vak_presentation::LibraryScope::User, "user")
22488 .is_ok()
22489 {
22490 activated += 1;
22491 }
22492 }
22493 assert_eq!(activated, 75);
22494 assert_eq!(library.activations().len(), 75);
22495
22496 // Verify deactivate all
22497 let spec_ids: Vec<String> = library
22498 .activations()
22499 .iter()
22500 .filter(|a| a.scope == vak_presentation::LibraryScope::User && a.owner == "user")
22501 .map(|a| a.spec_id.clone())
22502 .collect();
22503 for id in spec_ids {
22504 library.deactivate(&id, vak_presentation::LibraryScope::User, "user");
22505 }
22506 assert_eq!(library.activations().len(), 0);
22507 }
22508}
22509
22510#[cfg(test)]
22511#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
22512mod scheduler_state_tests {
22513 use super::*;
22514
22515 struct Answers;
22516
22517 #[async_trait::async_trait]
22518 impl Provider for Answers {
22519 fn name(&self) -> &str {
22520 "answers"
22521 }
22522
22523 async fn stream(
22524 &self,
22525 _request: vak_llm::types::ChatRequest,
22526 _cancel: CancellationToken,
22527 ) -> Result<vak_llm::EventStream, vak_llm::LlmError> {
22528 let done = vak_llm::types::AssistantMessage {
22529 content: vec![vak_llm::ContentBlock::text("done")],
22530 stop_reason: vak_llm::types::StopReason::EndTurn,
22531 usage: vak_llm::types::Usage::default(),
22532 model: "answers".into(),
22533 response_id: None,
22534 };
22535 let (mut sink, rx) = vak_llm::stream::channel(8);
22536 sink.push(vak_llm::stream::StreamEvent::Start {
22537 partial: done.clone(),
22538 });
22539 sink.close_message(done).await;
22540 Ok(rx)
22541 }
22542 }
22543
22544 fn git(cwd: &std::path::Path, args: &[&str]) {
22545 let out = std::process::Command::new("git")
22546 .args(args)
22547 .current_dir(cwd)
22548 .env("GIT_AUTHOR_NAME", "t")
22549 .env("GIT_AUTHOR_EMAIL", "t@t")
22550 .env("GIT_COMMITTER_NAME", "t")
22551 .env("GIT_COMMITTER_EMAIL", "t@t")
22552 .output()
22553 .unwrap();
22554 assert!(out.status.success(), "git {args:?}");
22555 }
22556
22557 fn make_repo(cwd: &std::path::Path) {
22558 git(cwd, &["init", "-q"]);
22559 std::fs::write(cwd.join("README.md"), "seed\n").unwrap();
22560 git(cwd, &["add", "."]);
22561 git(cwd, &["commit", "-q", "-m", "seed"]);
22562 }
22563
22564 fn cron_task(id: &str, cwd: &std::path::Path, agent_id: Option<&str>) -> TaskDef {
22565 serde_json::from_value(serde_json::json!({
22566 "id": id,
22567 "name": id,
22568 "prompt": "summarise",
22569 "enabled": true,
22570 "cwd": cwd,
22571 "created_at": chrono::Utc::now(),
22572 "last_run_at": null,
22573 "last_session_id": null,
22574 "last_summary": null,
22575 "schedule": "0 3 * * *",
22576 "agent_id": agent_id,
22577 }))
22578 .unwrap()
22579 }
22580
22581 fn state_with(
22582 ws: &std::path::Path,
22583 home: &std::path::Path,
22584 tasks: Vec<TaskDef>,
22585 agent: Option<vak_session::types::AgentIdentity>,
22586 ) -> AppState {
22587 vak_config::paths::isolate_home_for_tests();
22588 std::fs::create_dir_all(ws.join(".vak")).unwrap();
22589 std::fs::write(
22590 ws.join(".vak/config.toml"),
22591 "[memory]\nreflection = false\n",
22592 )
22593 .unwrap();
22594 let core = Core::new_with_trust(ws.to_path_buf(), true)
22595 .unwrap()
22596 .with_agent_identity(agent);
22597 core.set_sessions_home(home.to_path_buf());
22598 core.set_provider_instance(Arc::new(Answers));
22599 let mut store = vak_core::tasks::TaskStore::load(home).unwrap();
22600 for task in tasks {
22601 store.put(task);
22602 }
22603 store.save().unwrap();
22604 AppState::new(core)
22605 }
22606
22607 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
22608 async fn cron_slot_not_lost_on_failure() {
22609 let dir = tempfile::tempdir().unwrap();
22610 let (ws, home) = (dir.path().join("ws"), dir.path().join("home"));
22611 std::fs::create_dir_all(&ws).unwrap();
22612 let state = state_with(&ws, &home, vec![cron_task("nightly", &ws, None)], None);
22613 let slot = chrono::Local::now() - chrono::Duration::minutes(5);
22614 let marker = |state: &AppState| state.next_fire.lock().unwrap().get("nightly").copied();
22615 state
22616 .next_fire
22617 .lock()
22618 .unwrap()
22619 .insert("nightly".into(), slot);
22620
22621 scheduler_tick(&state).await;
22622 assert_eq!(
22623 marker(&state),
22624 Some(slot),
22625 "a refused run leaves its slot to be tried again"
22626 );
22627
22628 make_repo(&ws);
22629 scheduler_tick(&state).await;
22630 assert!(
22631 marker(&state).is_some_and(|next| next > chrono::Local::now()),
22632 "the slot is spent once a run starts"
22633 );
22634 }
22635
22636 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
22637 async fn child_core_home_is_not_nested() {
22638 let dir = tempfile::tempdir().unwrap();
22639 let (ws, home) = (dir.path().join("ws"), dir.path().join("home"));
22640 std::fs::create_dir_all(&ws).unwrap();
22641 make_repo(&ws);
22642 let writer = agents::builtin_templates()
22643 .into_iter()
22644 .find(|template| template.template_id == "writer")
22645 .unwrap()
22646 .to_agent_definition("writer", None);
22647 agents::save(&ws, &[writer], true).unwrap();
22648 let vak = vak_session::types::AgentIdentity {
22649 id: "vak".into(),
22650 revision: 1,
22651 name: "Vakyartha".into(),
22652 character: String::new(),
22653 personality: String::new(),
22654 animation: "spark".into(),
22655 voice: "calm".into(),
22656 behaviour: String::new(),
22657 responsibilities: String::new(),
22658 instructions: String::new(),
22659 };
22660 let state = state_with(
22661 &ws,
22662 &home,
22663 vec![cron_task("for-writer", &ws, Some("writer"))],
22664 Some(vak),
22665 );
22666 load_tasks(&state);
22667 let session = fire_task(&state, "for-writer")
22668 .await
22669 .unwrap_or_else(|_| panic!("the routine starts"));
22670
22671 let ledger = std::fs::read_dir(home.join("agents").join("writer").join("sessions"))
22672 .unwrap()
22673 .flatten()
22674 .any(|project| project.path().join(format!("{session}.jsonl")).is_file());
22675 assert!(ledger, "the run's ledger is under the writer's own home");
22676 assert!(
22677 !home.join("agents").join("vak").join("agents").exists(),
22678 "no Agent home nested inside another's"
22679 );
22680 }
22681}
22682

Indexing the workspace…