1. 1#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
2. 2use axum::{
3. 3 Router,
4. 4 body::Body,
5. 5 http::{Request, StatusCode},
6. 6};
7. 7use http_body_util::BodyExt;
8. 8use serde_json::{Value, json};
9. 9use std::sync::{Arc, Mutex};
10. 10use tokio_util::sync::CancellationToken;
11. 11use tower::ServiceExt;
12. 12use vak_llm::{
13. 13 EventStream, LlmError, Provider, stream,
14. 14 types::{AssistantMessage, ChatRequest, ContentBlock, StopReason, Usage},
15. 15};
16. 16use vak_session::{Entry, EntryPayload, SessionPath};
17. 17
18. 18#[derive(Default)]
19. 19struct Capture(Mutex<Vec<ChatRequest>>);
20. 20#[async_trait::async_trait]
21. 21impl Provider for Capture {
22. 22 fn name(&self) -> &str {
23. 23 "capture"
24. 24 }
25. 25 async fn stream(
26. 26 &self,
27. 27 request: ChatRequest,
28. 28 _: CancellationToken,
29. 29 ) -> Result<EventStream, LlmError> {
30. 30 self.0.lock().unwrap().push(request);
31. 31 let (mut sink, rx) = stream::channel(8);
32. 32 let message = AssistantMessage {
33. 33 content: vec![ContentBlock::text("Your request is complete.")],
34. 34 stop_reason: StopReason::EndTurn,
35. 35 usage: Usage::default(),
36. 36 model: "test-model".into(),
37. 37 response_id: None,
38. 38 };
39. 39 sink.push(stream::StreamEvent::Start {
40. 40 partial: message.clone(),
41. 41 });
42. 42 sink.close_message(message).await;
43. 43 Ok(rx)
44. 44 }
45. 45}
46. 46
47. 47async fn call(app: &Router, method: &str, path: &str, body: Value) -> (StatusCode, Value) {
48. 48 let response = app
49. 49 .clone()
50. 50 .oneshot(
51. 51 Request::builder()
52. 52 .method(method)
53. 53 .uri(path)
54. 54 .header("content-type", "application/json")
55. 55 .body(Body::from(body.to_string()))
56. 56 .unwrap(),
57. 57 )
58. 58 .await
59. 59 .unwrap();
60. 60 let status = response.status();
61. 61 let bytes = response.into_body().collect().await.unwrap().to_bytes();
62. 62 (
63. 63 status,
64. 64 serde_json::from_slice(&bytes).unwrap_or(Value::Null),
65. 65 )
66. 66}
67. 67
68. 68#[tokio::test]
69. 69async fn explicit_new_agent_conversation_gets_a_distinct_durable_identity() {
70. 70 let temp = tempfile::tempdir().unwrap();
71. 71 let cwd = temp.path().join("workspace");
72. 72 std::fs::create_dir_all(&cwd).unwrap();
73. 73 let core = vak_core::Core::new_with_trust(cwd.clone(), true).unwrap();
74. 74 core.set_sessions_home(temp.path().join("sessions-home"));
75. 75 let app = vak_server::router(core.clone());
76. 76 let (status, existing) = call(&app, "POST", "/agents/vak/open", json!({})).await;
77. 77 assert_eq!(status, StatusCode::OK);
78. 78 let (status, created) = call(
79. 79 &app,
80. 80 "POST",
81. 81 "/agents/vak/open",
82. 82 json!({"create_new": true}),
83. 83 )
84. 84 .await;
85. 85 assert_eq!(status, StatusCode::OK);
86. 86 assert_ne!(created["session_id"], existing["session_id"]);
87. 87 let created_id = created["session_id"].as_str().unwrap();
88. 88 let ledger = SessionPath::new_session_file(&core.sessions_home(), &cwd, created_id);
89. 89 let first = std::fs::read_to_string(ledger).unwrap();
90. 90 let first: Entry = serde_json::from_str(first.lines().next().unwrap()).unwrap();
91. 91 let EntryPayload::Header(header) = first.payload else {
92. 92 panic!("new conversation must begin with a header");
93. 93 };
94. 94 assert!(
95. 95 header
96. 96 .conversation
97. 97 .as_ref()
98. 98 .is_some_and(|context| context.conversation_id.starts_with("agent:vak:local:"))
99. 99 );
100. 100 let (status, resumed) = call(&app, "POST", "/agents/vak/open", json!({})).await;
101. 101 assert_eq!(status, StatusCode::OK);
102. 102 assert_eq!(resumed["session_id"], existing["session_id"]);
103. 103}
104. 104
105. 105/// Finding 5: `/agents/{id}/open`'s directory scan used to read every
106. 106/// `.jsonl` sibling's header unconditionally and fail the WHOLE request
107. 107/// with 500 the moment any one of them could not be parsed — even a file
108. 108/// that would never have matched this conversation's own filter. It must
109. 109/// now skip an unreadable ledger and keep going.
110. 110#[tokio::test]
111. 111async fn agent_open_skips_a_corrupt_sibling_ledger() {
112. 112 let temp = tempfile::tempdir().unwrap();
113. 113 let cwd = temp.path().join("workspace");
114. 114 std::fs::create_dir_all(&cwd).unwrap();
115. 115 let core = vak_core::Core::new_with_trust(cwd.clone(), true).unwrap();
116. 116 let sessions_home = temp.path().join("sessions-home");
117. 117 core.set_sessions_home(sessions_home.clone());
118. 118 let app = vak_server::router(core.clone());
119. 119
120. 120 let dir = SessionPath::sessions_dir(&sessions_home, &cwd);
121. 121 std::fs::create_dir_all(&dir).unwrap();
122. 122 std::fs::write(dir.join("corrupt.jsonl"), "not valid json at all\n").unwrap();
123. 123
124. 124 let (status, body) = call(&app, "POST", "/agents/vak/open", json!({})).await;
125. 125 assert_eq!(
126. 126 status,
127. 127 StatusCode::OK,
128. 128 "a corrupt sibling ledger must not fail the open: {body}"
129. 129 );
130. 130 assert!(body["session_id"].as_str().is_some_and(|s| !s.is_empty()));
131. 131
132. 132 // Reopening still resolves to the same conversation with the corrupt
133. 133 // file still present.
134. 134 let (status2, body2) = call(&app, "POST", "/agents/vak/open", json!({})).await;
135. 135 assert_eq!(status2, StatusCode::OK);
136. 136 assert_eq!(body2["session_id"], body["session_id"]);
137. 137}
138. 138
139. 139fn profile(id: &str, name: &str) -> Value {
140. 140 json!({"id":id,"revision":1,"name":name,"character":"vak","personality":"Use the phrase identity-marker.","behaviour":"Answer concisely.","responsibilities":"Research news", "animation":"off","voice":"default"})
141. 141}
142. 142
143. 143async fn run(app: &Router, sid: &str, prompt: &str) {
144. 144 let (status, body) = call(
145. 145 app,
146. 146 "POST",
147. 147 &format!("/sessions/{sid}/run"),
148. 148 json!({"prompt":prompt,"request_id":uuid::Uuid::now_v7().to_string()}),
149. 149 )
150. 150 .await;
151. 151 assert_eq!(status, StatusCode::ACCEPTED, "{body}");
152. 152 for _ in 0..200 {
153. 153 let (_, sessions) = call(app, "GET", "/sessions", json!({})).await;
154. 154 if sessions["sessions"]
155. 155 .as_array()
156. 156 .unwrap()
157. 157 .iter()
158. 158 .any(|s| s["session_id"] == sid && s["running"] == false)
159. 159 {
160. 160 return;
161. 161 }
162. 162 tokio::time::sleep(std::time::Duration::from_millis(25)).await;
163. 163 }
164. 164 panic!("agent did not settle");
165. 165}
166. 166
167. 167#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
168. 168async fn agent_identity_survives_clients_restart_and_followups_without_cross_talk() {
169. 169 vak_config::paths::isolate_home_for_tests();
170. 170 let temp = tempfile::tempdir().unwrap();
171. 171 let cwd = temp.path().join("workspace");
172. 172 std::fs::create_dir_all(cwd.join(".vak")).unwrap();
173. 173 std::fs::write(
174. 174 cwd.join(".vak/config.toml"),
175. 175 "[memory]\nreflection = false\n",
176. 176 )
177. 177 .unwrap();
178. 178 let core = vak_core::Core::new_with_trust(cwd.clone(), true).unwrap();
179. 179 core.set_sessions_home(temp.path().join("sessions-home"));
180. 180 let capture = Arc::new(Capture::default());
181. 181 core.set_provider_instance(capture.clone());
182. 182 let app = vak_server::router(core.clone());
183. 183 let profiles =
184. 184 json!({"agents":[profile("newsy","Newsy"),profile("other","Other")],"scope":"workspace"});
185. 185 assert_eq!(
186. 186 call(&app, "PUT", "/config/agents", profiles).await.0,
187. 187 StatusCode::OK
188. 188 );
189. 189 assert_eq!(
190. 190 call(&app, "POST", "/agents/missing/open", json!({}))
191. 191 .await
192. 192 .0,
193. 193 StatusCode::NOT_FOUND
194. 194 );
195. 195 assert_eq!(
196. 196 call(&app, "POST", "/agents/vak/open", json!({})).await.0,
197. 197 StatusCode::OK
198. 198 );
199. 199 let (_, a) = call(&app, "POST", "/agents/newsy/open", json!({})).await;
200. 200 let sid = a["session_id"].as_str().unwrap().to_owned();
201. 201 // Newsy, a user-created agent, is resolved through a freshly-constructed
202. 202 // Core rooted at its own workspace (see agent_chats::open), but that
203. 203 // Core is repointed at the same sessions/data-home root the test's Vak
204. 204 // Core already uses (`set_sessions_home` above), just under its own
205. 205 // agent-scoped subdirectory — every agent's data lives under one root.
206. 206 let newsy_home = vak_config::paths::agent_home_at(&core.shared_data_home(), "newsy");
207. 207 let newsy_cwd = vak_config::paths::agent_workspace(&cwd, "newsy");
208. 208 assert_ne!(
209. 209 newsy_cwd, cwd,
210. 210 "a user-created agent must not share Vak's project workspace"
211. 211 );
212. 212 assert_eq!(
213. 213 std::fs::canonicalize(a["cwd"].as_str().unwrap()).unwrap(),
214. 214 std::fs::canonicalize(&newsy_cwd).unwrap()
215. 215 );
216. 216 let resolved_newsy_cwd = std::path::PathBuf::from(a["cwd"].as_str().unwrap());
217. 217 let ledger = SessionPath::new_session_file(&newsy_home, &resolved_newsy_cwd, &sid);
218. 218 assert!(
219. 219 !SessionPath::new_session_file(&core.sessions_home(), &cwd, &sid).exists(),
220. 220 "Newsy session must not be in Vak workspace"
221. 221 );
222. 222 let first = std::fs::read_to_string(ledger)
223. 223 .unwrap()
224. 224 .lines()
225. 225 .next()
226. 226 .map(|line| serde_json::from_str::<Entry>(line).unwrap())
227. 227 .unwrap();
228. 228 let EntryPayload::Header(header) = first.payload else {
229. 229 panic!("agent admission ledger must begin with a header");
230. 230 };
231. 231 let context = header
232. 232 .conversation
233. 233 .expect("Agent admission must stamp conversation context");
234. 234 assert_eq!(context.conversation_id, "agent:newsy:local");
235. 235 assert_eq!(context.audience_id, "local");
236. 236 assert_eq!(
237. 237 context
238. 238 .origin
239. 239 .as_ref()
240. 240 .map(|origin| origin.surface.as_str()),
241. 241 Some("desktop")
242. 242 );
243. 243 let (_, again) = call(&app, "POST", "/agents/newsy/open", json!({})).await;
244. 244 assert_eq!(
245. 245 again["session_id"], sid,
246. 246 "even header-only conversations must reopen"
247. 247 );
248. 248 let (_, sessions_list) = call(&app, "GET", "/sessions", json!({})).await;
249. 249 let found = sessions_list["sessions"]
250. 250 .as_array()
251. 251 .unwrap()
252. 252 .iter()
253. 253 .any(|s| s["session_id"] == sid);
254. 254 assert!(
255. 255 found,
256. 256 "newly opened active agent session must be present in list_sessions even if header-only"
257. 257 );
258. 258 let (_, b) = call(&app, "POST", "/agents/other/open", json!({})).await;
259. 259 assert_ne!(b["session_id"], sid);
260. 260 run(&app, &sid, "Remember private-newsy-marker").await;
261. 261 run(
262. 262 &app,
263. 263 b["session_id"].as_str().unwrap(),
264. 264 "A different request",
265. 265 )
266. 266 .await;
267. 267 {
268. 268 let requests = capture.0.lock().unwrap();
269. 269 assert!(
270. 270 requests
271. 271 .iter()
272. 272 .any(|r| r.system.as_deref().unwrap_or("").contains("You are Newsy."))
273. 273 );
274. 274 let other = requests
275. 275 .iter()
276. 276 .find(|r| r.system.as_deref().unwrap_or("").contains("You are Other."))
277. 277 .unwrap();
278. 278 assert!(
279. 279 !other
280. 280 .messages
281. 281 .iter()
282. 282 .any(|m| m.text_content().contains("private-newsy-marker"))
283. 283 );
284. 284 }
285. 285 drop(app);
286. 286 let app = vak_server::router(core.clone());
287. 287 let (_, reopened) = call(&app, "POST", "/agents/newsy/open", json!({})).await;
288. 288 assert_eq!(reopened["session_id"], sid);
289. 289 run(&app, &sid, "What did I ask you to remember?").await;
290. 290 {
291. 291 let requests = capture.0.lock().unwrap();
292. 292 let last = requests.last().unwrap();
293. 293 assert!(
294. 294 last.system
295. 295 .as_deref()
296. 296 .unwrap_or("")
297. 297 .contains("identity-marker")
298. 298 );
299. 299 assert!(
300. 300 last.messages
301. 301 .iter()
302. 302 .any(|m| m.text_content().contains("private-newsy-marker"))
303. 303 );
304. 304 assert!(
305. 305 !last
306. 306 .messages
307. 307 .iter()
308. 308 .any(|m| m.text_content().contains("Use my Agent"))
309. 309 );
310. 310 }
311. 311 let (_, transcript) = call(
312. 312 &app,
313. 313 "GET",
314. 314 &format!("/sessions/{sid}/transcript"),
315. 315 json!({}),
316. 316 )
317. 317 .await;
318. 318 assert!(transcript.to_string().contains("private-newsy-marker"));
319. 319 // Editing the catalogue never rewrites an admitted conversation's identity.
320. 320 call(
321. 321 &app,
322. 322 "PUT",
323. 323 "/config/agents",
324. 324 json!({"agents":[profile("newsy","Renamed"),profile("other","Other")]}),
325. 325 )
326. 326 .await;
327. 327 let (_, frozen) = call(&app, "POST", "/agents/newsy/open", json!({})).await;
328. 328 assert_eq!(frozen["agent"]["name"], "Newsy");
329. 329 assert_eq!(frozen["agent"]["revision"], 1);
330. 330 // Shared writes are not copied into the project layer; effective reads merge.
331. 331 call(
332. 332 &app,
333. 333 "PUT",
334. 334 "/config/agents",
335. 335 json!({"scope":"user","agents":[profile("shared-helper","Shared helper")]}),
336. 336 )
337. 337 .await;
338. 338 let (_, project_layer) = call(&app, "GET", "/config/agents?scope=workspace", json!({})).await;
339. 339 assert!(
340. 340 project_layer
341. 341 .get("agents")
342. 342 .and_then(|v| v.as_array())
343. 343 .is_some()
344. 344 );
345. 345 assert!(!project_layer.to_string().contains("shared-helper"));
346. 346 let (_, effective) = call(&app, "GET", "/agents", json!({})).await;
347. 347 assert!(effective.get("agents").and_then(|v| v.as_array()).is_some());
348. 348 assert!(effective.to_string().contains("shared-helper"));
349. 349 // Same identity in another workspace has a separate ledger.
350. 350 let other_dir = temp.path().join("other-workspace");
351. 351 std::fs::create_dir_all(&other_dir).unwrap();
352. 352 let other_core = vak_core::Core::new_with_trust(other_dir, true).unwrap();
353. 353 other_core.set_sessions_home(core.shared_data_home());
354. 354 other_core.set_provider_instance(capture);
355. 355 let other_app = vak_server::router(other_core);
356. 356 call(
357. 357 &other_app,
358. 358 "PUT",
359. 359 "/config/agents",
360. 360 json!({"agents":[profile("newsy","Newsy")]}),
361. 361 )
362. 362 .await;
363. 363 let (_, isolated) = call(&other_app, "POST", "/agents/newsy/open", json!({})).await;
364. 364 assert_ne!(isolated["session_id"], sid);
365. 365
366. 366 // Concurrent process simulation: a second server instance sharing the same workspace
367. 367 // and sessions home (e.g. gateway service when desktop application holds the writer lock).
368. 368 let concurrent_core = vak_core::Core::new_with_trust(cwd.clone(), true).unwrap();
369. 369 concurrent_core.set_sessions_home(core.shared_data_home());
370. 370 concurrent_core.set_provider_instance(Arc::new(Capture::default()));
371. 371 let concurrent_app = vak_server::router(concurrent_core);
372. 372
373. 373 let (status, opened) = call(&concurrent_app, "POST", "/agents/newsy/open", json!({})).await;
374. 374 assert_eq!(
375. 375 status,
376. 376 StatusCode::OK,
377. 377 "concurrent open must succeed read-only when locked by desktop"
378. 378 );
379. 379 assert_eq!(
380. 380 opened["session_id"], sid,
381. 381 "must match the canonical session id"
382. 382 );
383. 383
384. 384 let (transcript_status, transcript) = call(
385. 385 &concurrent_app,
386. 386 "GET",
387. 387 &format!("/sessions/{sid}/transcript"),
388. 388 json!({}),
389. 389 )
390. 390 .await;
391. 391 assert_eq!(
392. 392 transcript_status,
393. 393 StatusCode::OK,
394. 394 "transcript must be readable when session is locked"
395. 395 );
396. 396 assert!(transcript["messages"].as_array().is_some());
397. 397}
398. 398
399. 399/// Memory notes, learning proposals, and skill proposals are Agent-scoped
400. 400/// (docs/design/23-memory.md: "Per-agent data home: sessions, memory, and
401. 401/// agent-specific config") — a note or proposal written for one Agent must
402. 402/// never appear for, or be mutated by, a different Agent's `?agent=` view.
403. 403#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
404. 404async fn memory_and_proposals_are_scoped_per_agent() {
405. 405 vak_config::paths::isolate_home_for_tests();
406. 406 let temp = tempfile::tempdir().unwrap();
407. 407 let cwd = temp.path().join("workspace");
408. 408 std::fs::create_dir_all(&cwd).unwrap();
409. 409 let core = vak_core::Core::new_with_trust(cwd, true).unwrap();
410. 410 core.set_sessions_home(temp.path().join("sessions-home"));
411. 411 let app = vak_server::router(core);
412. 412 assert_eq!(
413. 413 call(
414. 414 &app,
415. 415 "PUT",
416. 416 "/config/agents",
417. 417 json!({"agents":[profile("newsy","Newsy"),profile("other","Other")],"scope":"workspace"}),
418. 418 )
419. 419 .await
420. 420 .0,
421. 421 StatusCode::OK
422. 422 );
423. 423
424. 424 // Each agent writes a note only it should ever see.
425. 425 for (agent, marker) in [
426. 426 ("newsy", "newsy-private-note"),
427. 427 ("other", "other-private-note"),
428. 428 ] {
429. 429 let (status, _) = call(
430. 430 &app,
431. 431 "POST",
432. 432 "/memory",
433. 433 json!({"text": marker, "agent": agent}),
434. 434 )
435. 435 .await;
436. 436 assert_eq!(status, StatusCode::CREATED, "append for {agent}");
437. 437 }
438. 438
439. 439 let (_, newsy_notes) = call(&app, "GET", "/memory?agent=newsy", json!({})).await;
440. 440 let newsy_text = newsy_notes.to_string();
441. 441 assert!(newsy_text.contains("newsy-private-note"));
442. 442 assert!(!newsy_text.contains("other-private-note"));
443. 443
444. 444 let (_, other_notes) = call(&app, "GET", "/memory?agent=other", json!({})).await;
445. 445 let other_text = other_notes.to_string();
446. 446 assert!(other_text.contains("other-private-note"));
447. 447 assert!(!other_text.contains("newsy-private-note"));
448. 448
449. 449 // The default (built-in) agent, and an unscoped call, see neither.
450. 450 let (_, default_notes) = call(&app, "GET", "/memory", json!({})).await;
451. 451 let default_text = default_notes.to_string();
452. 452 assert!(!default_text.contains("newsy-private-note"));
453. 453 assert!(!default_text.contains("other-private-note"));
454. 454
455. 455 // Forgetting newsy's note must not touch other's.
456. 456 let newsy_note_id = newsy_notes["notes"]
457. 457 .as_array()
458. 458 .unwrap()
459. 459 .iter()
460. 460 .find(|n| n["text"] == "newsy-private-note")
461. 461 .and_then(|n| n["id"].as_str())
462. 462 .unwrap()
463. 463 .to_string();
464. 464 let (status, _) = call(
465. 465 &app,
466. 466 "DELETE",
467. 467 &format!("/memory/{newsy_note_id}?agent=newsy"),
468. 468 json!({}),
469. 469 )
470. 470 .await;
471. 471 assert_eq!(status, StatusCode::OK);
472. 472 let (_, other_notes_after) = call(&app, "GET", "/memory?agent=other", json!({})).await;
473. 473 assert!(
474. 474 other_notes_after.to_string().contains("other-private-note"),
475. 475 "deleting newsy's note must not affect other's"
476. 476 );
477. 477}
478. 478
479. 479/// Set up two custom Agents (mirroring `memory_and_proposals_are_scoped_per_agent`)
480. 480/// and return `(app, core)`.
481. 481async fn two_agent_app() -> (Router, vak_core::Core, tempfile::TempDir) {
482. 482 vak_config::paths::isolate_home_for_tests();
483. 483 let temp = tempfile::tempdir().unwrap();
484. 484 let cwd = temp.path().join("workspace");
485. 485 std::fs::create_dir_all(&cwd).unwrap();
486. 486 let core = vak_core::Core::new_with_trust(cwd, true).unwrap();
487. 487 core.set_sessions_home(temp.path().join("sessions-home"));
488. 488 let app = vak_server::router(core.clone());
489. 489 assert_eq!(
490. 490 call(
491. 491 &app,
492. 492 "PUT",
493. 493 "/config/agents",
494. 494 json!({"agents":[profile("newsy","Newsy"),profile("other","Other")],"scope":"workspace"}),
495. 495 )
496. 496 .await
497. 497 .0,
498. 498 StatusCode::OK
499. 499 );
500. 500 // The caller must hold onto the returned `TempDir` for the rest of the
501. 501 // test — dropping it here (as a purely local variable would be, once
502. 502 // this function returns) deletes the on-disk workspace out from under
503. 503 // every subsequent request, which is exactly what produced the
504. 504 // spurious "This agent is no longer available" 404s while this helper
505. 505 // was being written.
506. 506 (app, core, temp)
507. 507}
508. 508
509. 509/// `GET /config/prompts/effective` assembles the merged prompt off whichever
510. 510/// `Core` the request resolves to — it must resolve per-`?agent=` exactly
511. 511/// like its sibling `GET /config/prompts` layer endpoint, not fall back to
512. 512/// the default "vak" Agent regardless of the query (the gap this test
513. 513/// closes: `get_prompt_effective` was left reading `state.core` directly
514. 514/// when the rest of the prompt endpoints were generalized to
515. 515/// `resolve_scoped_core`).
516. 516#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
517. 517async fn prompt_effective_is_scoped_per_agent() {
518. 518 let (app, _core, _temp) = two_agent_app().await;
519. 519
520. 520 let (status, _) = call(
521. 521 &app,
522. 522 "PUT",
523. 523 "/config/prompts",
524. 524 json!({
525. 525 "scope": "workspace",
526. 526 "block": "guardrails",
527. 527 "text": "newsy-only-guardrail-line",
528. 528 "agent": "newsy",
529. 529 }),
530. 530 )
531. 531 .await;
532. 532 assert_eq!(status, StatusCode::OK);
533. 533
534. 534 let (_, newsy_effective) = call(
535. 535 &app,
536. 536 "GET",
537. 537 "/config/prompts/effective?agent=newsy",
538. 538 json!({}),
539. 539 )
540. 540 .await;
541. 541 assert!(
542. 542 newsy_effective["text"]
543. 543 .as_str()
544. 544 .unwrap_or_default()
545. 545 .contains("newsy-only-guardrail-line"),
546. 546 "newsy's own effective prompt must include its guardrails override: {newsy_effective}"
547. 547 );
548. 548
549. 549 let (_, default_effective) = call(&app, "GET", "/config/prompts/effective", json!({})).await;
550. 550 assert!(
551. 551 !default_effective["text"]
552. 552 .as_str()
553. 553 .unwrap_or_default()
554. 554 .contains("newsy-only-guardrail-line"),
555. 555 "the default agent must not see newsy's effective prompt: {default_effective}"
556. 556 );
557. 557}
558. 558
559. 559/// `PUT /config/permissions` writes one Agent's own workspace rule layer —
560. 560/// same isolation contract as hooks/MCP, checked here for permission rules.
561. 561#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
562. 562async fn permission_rules_are_scoped_per_agent() {
563. 563 let (app, _core, _temp) = two_agent_app().await;
564. 564
565. 565 let (status, _) = call(
566. 566 &app,
567. 567 "PUT",
568. 568 "/config/permissions",
569. 569 json!({
570. 570 "scope": "workspace",
571. 571 "deny": ["bash(rm -rf /)"],
572. 572 "agent": "newsy",
573. 573 }),
574. 574 )
575. 575 .await;
576. 576 assert_eq!(status, StatusCode::OK);
577. 577
578. 578 let (_, newsy_rules) = call(&app, "GET", "/config/permissions?agent=newsy", json!({})).await;
579. 579 assert!(
580. 580 newsy_rules["layer"]["deny"]
581. 581 .as_array()
582. 582 .unwrap()
583. 583 .iter()
584. 584 .any(|v| v == "bash(rm -rf /)"),
585. 585 "newsy's own rule layer must include its deny rule: {newsy_rules}"
586. 586 );
587. 587
588. 588 let (_, default_rules) = call(&app, "GET", "/config/permissions", json!({})).await;
589. 589 assert!(
590. 590 !default_rules["layer"]["deny"]
591. 591 .as_array()
592. 592 .unwrap()
593. 593 .iter()
594. 594 .any(|v| v == "bash(rm -rf /)"),
595. 595 "the default agent must not see newsy's deny rule: {default_rules}"
596. 596 );
597. 597}
598. 598
599. 599/// `PATCH /finops` sets budget caps in one Agent's own `.vak/config.toml` —
600. 600/// same isolation contract as hooks/MCP, checked here for FinOps caps.
601. 601#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
602. 602async fn finops_caps_are_scoped_per_agent() {
603. 603 let (app, _core, _temp) = two_agent_app().await;
604. 604
605. 605 let (status, _) = call(
606. 606 &app,
607. 607 "PATCH",
608. 608 "/finops",
609. 609 json!({
610. 610 "max_run_usd": 1.5,
611. 611 "agent": "newsy",
612. 612 }),
613. 613 )
614. 614 .await;
615. 615 assert_eq!(status, StatusCode::OK);
616. 616
617. 617 let (_, newsy_status) = call(&app, "GET", "/finops?agent=newsy", json!({})).await;
618. 618 assert_eq!(newsy_status["run_cap_usd"].as_f64(), Some(1.5));
619. 619
620. 620 let (_, default_status) = call(&app, "GET", "/finops", json!({})).await;
621. 621 assert_ne!(
622. 622 default_status["run_cap_usd"].as_f64(),
623. 623 Some(1.5),
624. 624 "the default agent must not see newsy's run cap: {default_status}"
625. 625 );
626. 626}
627. 627
628. 628/// `GET /sessions/{id}/checkpoints` must resolve a *closed* session's real
629. 629/// owning Agent via `?agent=` rather than silently falling back to the
630. 630/// default Agent once no in-memory session handle exists for it — the exact
631. 631/// gap `resolve_scoped_core`'s session-id-first, agent-id-fallback path
632. 632/// exists to close.
633. 633#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
634. 634async fn checkpoints_resolve_the_owning_agent_once_the_session_is_closed() {
635. 635 let (app, core, _temp) = two_agent_app().await;
636. 636
637. 637 // Seed a checkpoint directly under Newsy's isolated workspace/home,
638. 638 // exactly as a real run would have via `vak_core::checkpoints::capture`
639. 639 // — no session handle is ever registered for `sid`, simulating a
640. 640 // session that closed (or a server restart) before this request.
641. 641 let newsy_cwd = vak_config::paths::agent_workspace(core.cwd(), "newsy");
642. 642 std::fs::create_dir_all(&newsy_cwd).unwrap();
643. 643 let newsy_home = vak_config::paths::agent_home_at(&core.shared_data_home(), "newsy");
644. 644 let sid = "closed-newsy-session";
645. 645 let (cp, _) = vak_core::checkpoints::capture(&newsy_cwd, &newsy_home, sid, 1, "seed").unwrap();
646. 646 vak_core::checkpoints::store(&newsy_home, &cp).unwrap();
647. 647
648. 648 let (status, newsy_checkpoints) = call(
649. 649 &app,
650. 650 "GET",
651. 651 &format!("/sessions/{sid}/checkpoints?agent=newsy"),
652. 652 json!({}),
653. 653 )
654. 654 .await;
655. 655 assert_eq!(status, StatusCode::OK, "{newsy_checkpoints}");
656. 656 assert_eq!(
657. 657 newsy_checkpoints["checkpoints"].as_array().unwrap().len(),
658. 658 1,
659. 659 "newsy's own checkpoint must be found via ?agent=newsy: {newsy_checkpoints}"
660. 660 );
661. 661
662. 662 let (_, default_checkpoints) = call(
663. 663 &app,
664. 664 "GET",
665. 665 &format!("/sessions/{sid}/checkpoints"),
666. 666 json!({}),
667. 667 )
668. 668 .await;
669. 669 assert!(
670. 670 default_checkpoints["checkpoints"]
671. 671 .as_array()
672. 672 .unwrap()
673. 673 .is_empty(),
674. 674 "the default agent must not see newsy's checkpoint: {default_checkpoints}"
675. 675 );
676. 676}
677. 677
678. 678/// A user-created Agent's isolated workspace is never separately visited or
679. 679/// trust-prompted, so without `agents::save` carrying the creating context's
680. 680/// own trust decision forward onto it (`vak_core::trust::mark_trusted`), its
681. 681/// own privileged config — `permission_mode`, `hooks`, `mcp.servers`, ... —
682. 682/// gets silently stripped by `CorePool::resolve_at` forever, no matter how
683. 683/// correctly it's scoped per-Agent. This is the live-tested gap that
684. 684/// surfaced *after* every other per-Agent scoping fix in this file: a write
685. 685/// through `/config/mode?agent=newsy` persisted correctly to newsy's own
686. 686/// `config.toml`, but read back as the untouched default because the
687. 687/// directory it lived in had no trust marker.
688. 688#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
689. 689async fn a_new_agents_workspace_is_trusted_when_its_creator_is() {
690. 690 let (app, _core, _temp) = two_agent_app().await;
691. 691
692. 692 let (status, _) = call(
693. 693 &app,
694. 694 "POST",
695. 695 "/config/mode",
696. 696 json!({"mode": "ReadOnly", "agent": "newsy"}),
697. 697 )
698. 698 .await;
699. 699 assert_eq!(status, StatusCode::OK);
700. 700
701. 701 let (_, newsy_config) = call(&app, "GET", "/config?agent=newsy", json!({})).await;
702. 702 assert_eq!(
703. 703 newsy_config["permission_mode"], "ReadOnly",
704. 704 "newsy's own permission mode must actually take effect once its \
705. 705 workspace is trusted, not silently stay at the untrusted default: \
706. 706 {newsy_config}"
707. 707 );
708. 708}
709. 709
710. 710/// `PUT /config/hooks` writes the project's own `[[hooks]]` array
711. 711/// (docs/design/45-prompt-layers.md-adjacent config-layer semantics) — a
712. 712/// hook saved for one Agent must not appear in, or be overwritten by, a
713. 713/// different Agent's `?agent=` view, since each Agent has its own isolated
714. 714/// workspace file (see commit 15c9c256's memory/proposals precedent).
715. 715#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
716. 716async fn hooks_are_scoped_per_agent() {
717. 717 let (app, _core, _temp) = two_agent_app().await;
718. 718
719. 719 let (status, body) = call(
720. 720 &app,
721. 721 "PUT",
722. 722 "/config/hooks",
723. 723 json!({
724. 724 "hooks": [{"event": "session_start", "command": "echo newsy-hook", "enabled": true}],
725. 725 "agent": "newsy",
726. 726 }),
727. 727 )
728. 728 .await;
729. 729 assert_eq!(status, StatusCode::OK, "{body}");
730. 730
731. 731 let (_, newsy_hooks) = call(&app, "GET", "/config/hooks?agent=newsy", json!({})).await;
732. 732 assert!(newsy_hooks.to_string().contains("newsy-hook"));
733. 733
734. 734 let (_, other_hooks) = call(&app, "GET", "/config/hooks?agent=other", json!({})).await;
735. 735 assert!(
736. 736 !other_hooks.to_string().contains("newsy-hook"),
737. 737 "other agent must not see newsy's hook"
738. 738 );
739. 739
740. 740 let (_, default_hooks) = call(&app, "GET", "/config/hooks", json!({})).await;
741. 741 assert!(
742. 742 !default_hooks.to_string().contains("newsy-hook"),
743. 743 "the default agent must not see newsy's hook either"
744. 744 );
745. 745}
746. 746
747. 747/// `PUT /config/mcp` writes the project's own MCP server map — same
748. 748/// isolation contract as hooks above, checked here for the MCP config
749. 749/// layer.
750. 750#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
751. 751async fn mcp_servers_are_scoped_per_agent() {
752. 752 let (app, _core, _temp) = two_agent_app().await;
753. 753
754. 754 let (status, _) = call(
755. 755 &app,
756. 756 "PUT",
757. 757 "/config/mcp",
758. 758 json!({
759. 759 "servers": {"newsy-server": {"command": "true", "args": [], "env": {}}},
760. 760 "agent": "newsy",
761. 761 }),
762. 762 )
763. 763 .await;
764. 764 assert_eq!(status, StatusCode::OK);
765. 765
766. 766 let (_, newsy_servers) = call(&app, "GET", "/config/mcp?agent=newsy", json!({})).await;
767. 767 assert!(newsy_servers.to_string().contains("newsy-server"));
768. 768
769. 769 let (_, other_servers) = call(&app, "GET", "/config/mcp?agent=other", json!({})).await;
770. 770 assert!(
771. 771 !other_servers.to_string().contains("newsy-server"),
772. 772 "other agent must not see newsy's MCP server"
773. 773 );
774. 774
775. 775 let (_, default_servers) = call(&app, "GET", "/config/mcp", json!({})).await;
776. 776 assert!(
777. 777 !default_servers.to_string().contains("newsy-server"),
778. 778 "the default agent must not see newsy's MCP server either"
779. 779 );
780. 780}
781. 781
782. 782/// The plugin store (retired-plugin sweep, catalog sources, key
783. 783/// revocation, install/enable/disable/rollback/remove) is rooted at
784. 784/// `<Agent's own cwd>/.vak` (`plugin_store`) — revoking a signing key for
785. 785/// one Agent's workspace-scoped plugin store must not touch a different
786. 786/// Agent's, or the default Agent's, own store.
787. 787#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
788. 788async fn plugin_key_revocation_is_scoped_per_agent() {
789. 789 let (app, _core, _temp) = two_agent_app().await;
790. 790
791. 791 let (status, _) = call(
792. 792 &app,
793. 793 "POST",
794. 794 "/plugins/keys/test-signing-key/revoke?agent=newsy&scope=workspace",
795. 795 json!({}),
796. 796 )
797. 797 .await;
798. 798 assert_eq!(status, StatusCode::OK);
799. 799
800. 800 // Read each Agent's own plugin registry file directly — there is no
801. 801 // dedicated "list revoked keys" endpoint, and the registry file is
802. 802 // exactly what every plugin_store-backed endpoint (install, enable,
803. 803 // disable, rollback, remove, sources) reads and writes.
804. 804 let newsy_root = vak_config::paths::agent_workspace(_core.cwd(), "newsy").join(".vak");
805. 805 let other_root = vak_config::paths::agent_workspace(_core.cwd(), "other").join(".vak");
806. 806 let default_root = _core.cwd().join(".vak");
807. 807
808. 808 let newsy_registry = vak_plugin::PluginStore::new(newsy_root)
809. 809 .load_sources()
810. 810 .unwrap();
811. 811 assert!(
812. 812 newsy_registry.revoked_keys.contains("test-signing-key"),
813. 813 "newsy's own store must record the revocation"
814. 814 );
815. 815
816. 816 let other_registry = vak_plugin::PluginStore::new(other_root)
817. 817 .load_sources()
818. 818 .unwrap();
819. 819 assert!(
820. 820 !other_registry.revoked_keys.contains("test-signing-key"),
821. 821 "other agent's plugin store must not see newsy's key revocation"
822. 822 );
823. 823
824. 824 let default_registry = vak_plugin::PluginStore::new(default_root)
825. 825 .load_sources()
826. 826 .unwrap();
827. 827 assert!(
828. 828 !default_registry.revoked_keys.contains("test-signing-key"),
829. 829 "the default agent's plugin store must not see newsy's key revocation either"
830. 830 );
831. 831}
832. 832
833. 833/// Isolated, credential-free browser fixture. Never reads the operator's home.
834. 834/// Run with: cargo test -p vak-server --test agent_chats browser_fixture -- --ignored --nocapture
835. 835#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
836. 836#[ignore = "manual browser verification server; stops after ten minutes"]
837. 837async fn browser_fixture() {
838. 838 vak_config::paths::isolate_home_for_tests();
839. 839 let temp = tempfile::tempdir().unwrap();
840. 840 let cwd = temp.path().join("workspace");
841. 841 std::fs::create_dir_all(cwd.join(".vak")).unwrap();
842. 842 std::fs::write(
843. 843 cwd.join(".vak/config.toml"),
844. 844 "[memory]\nreflection = false\n",
845. 845 )
846. 846 .unwrap();
847. 847 let core = vak_core::Core::new_with_trust(cwd, true).unwrap();
848. 848 core.set_sessions_home(temp.path().join("sessions"));
849. 849 core.set_provider_instance(Arc::new(Capture::default()));
850. 850 let app = vak_server::router(core);
851. 851 call(
852. 852 &app,
853. 853 "PUT",
854. 854 "/config/agents",
855. 855 json!({"agents":[profile("newsy","Newsy"),profile("other","Other")]}),
856. 856 )
857. 857 .await;
858. 858 let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
859. 859 println!(
860. 860 "AGENT_BROWSER_URL=http://{}/app",
861. 861 listener.local_addr().unwrap()
862. 862 );
863. 863 let server = axum::serve(listener, app).with_graceful_shutdown(async {
864. 864 tokio::time::sleep(std::time::Duration::from_secs(600)).await;
865. 865 });
866. 866 server.await.unwrap();
867. 867}
868. 868