mirror of
https://github.com/outbackdingo/optimclaw.git
synced 2026-08-25 14:53:34 +00:00
* feat(testing): add StubChannel test double for Channel trait Adds StubChannel to src/testing.rs alongside StubLlm. Supports message injection via mpsc sender, response/status capture, and configurable health check toggling. Includes handle methods for use after ownership transfer to ChannelManager. Co-Authored-By: Claude Opus 4.6 <[email protected]> * feat(testing): wire StubChannel into TestHarnessBuilder Add with_stub_channel() builder method that creates a StubChannel pre-registered in a ChannelManager. Tests can inject messages via the sender and verify routing through the manager. The channel field on TestHarness is Optional, defaulting to None for backward compat. Co-Authored-By: Claude Opus 4.6 <[email protected]> * test: gate external-service tests behind integration feature flag Replace silent try_connect() skip pattern with explicit feature gating. cargo test now runs only self-contained tests. cargo test --features integration runs tests requiring PostgreSQL. Co-Authored-By: Claude Opus 4.6 <[email protected]> * test(channels): add ChannelManager unit tests using StubChannel Cover add/start_all stream merging, respond routing, unknown channel errors, health_check_all with mixed health, empty-channels error path, and injection channel merging -- all via StubChannel test double. Co-Authored-By: Claude Opus 4.6 <[email protected]> * docs: document test tier separation (unit/integration/live) Co-Authored-By: Claude Opus 4.6 <[email protected]> * ci: add architecture boundary check script Grep-based checks for three architecture boundaries: - Direct database driver usage (tokio_postgres/libsql) outside src/db/ - .unwrap()/.expect() in production code (warning only) - Direct std::env::var reads outside config layer (warning only) The DB driver check is a hard violation; the other two are warnings for gradual cleanup. Run with: bash scripts/check-boundaries.sh Co-Authored-By: Claude Opus 4.6 <[email protected]> * test(search): add RRF edge case tests for empty inputs, limits, and config modes Co-Authored-By: Claude Opus 4.6 <[email protected]> * test(security): add regression tests for skill installer ZIP and SSRF protections Add 11 regression tests covering the security controls in skill_tools: ZIP extraction safety: - Valid SKILL.md extraction works correctly - Non-SKILL.md entries are ignored (returns error) - Path traversal entries (../../SKILL.md) do not match - Nested path entries (subdir/SKILL.md) do not match - Oversized entries (>1MB uncompressed) are rejected SSRF prevention: - Loopback addresses (127.0.0.1) are blocked - Private ranges (10.x, 172.16.x, 192.168.x) are blocked - Link-local addresses (169.254.x) are blocked - Public IPs (8.8.8.8, 1.1.1.1) are allowed - IPv4-mapped IPv6 unwrapping logic works correctly - Metadata endpoints and .internal/.local hostnames are blocked - Normal hostnames (github.com, clawhub.dev) are allowed Also documents a known gap: url::Url::host_str() returns bracketed IPv6 addresses that std::net::IpAddr cannot parse, so IPv4-mapped IPv6 URLs currently bypass IP-based checks in validate_fetch_url. Co-Authored-By: Claude Opus 4.6 <[email protected]> * refactor(testing): extract TestGatewayBuilder to eliminate gateway test duplication Both ws_gateway_integration.rs and openai_compat_integration.rs manually constructed GatewayState with 19+ fields. Extracted to a shared builder in src/channels/web/test_helpers.rs that provides sensible defaults and lets tests override only what they need. Co-Authored-By: Claude Opus 4.6 <[email protected]> * docs: add implementation plans for testing batches 1 and 2 Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix(security): close IPv6 SSRF bypass in validate_fetch_url validate_fetch_url used host_str() which returns bracketed IPv6 (e.g. "[::ffff:7f00:1]") that IpAddr::parse() cannot handle, silently skipping IP-based SSRF checks for all IPv6 URLs. Switch to url::Host enum matching to extract proper IpAddr values without string parsing. IPv4-mapped IPv6 addresses like ::ffff:127.0.0.1 are now correctly unwrapped and blocked. Co-Authored-By: Claude Opus 4.6 <[email protected]> * test(skills): add activation criteria limits enforcement tests Adds test_activation_criteria_enforce_limits to verify that enforce_limits() correctly trims excess patterns (>5), keywords (>20), and tags (>10), and filters out short keywords/tags (<3 chars). Co-Authored-By: Claude Opus 4.6 <[email protected]> * test(wasm): add security regression tests for WASM tool loader Add 6 tests covering: tool name path separator rejection, empty name rejection, nonexistent file handling, invalid WASM bytes rejection, dotfile discovery behavior, and subdirectory non-recursion. Co-Authored-By: Claude Opus 4.6 <[email protected]> * refactor: address PR review feedback - Remove plan files from repo (ilblackdragon review) - Replace CLAUDE.md test tier rules with pointer to check-boundaries.sh - Add Check 4 to check-boundaries.sh: enforces integration tests are gated behind the 'integration' feature flag Co-Authored-By: Claude Opus 4.6 <[email protected]> * ci: add try_connect silent-skip pattern check to check-boundaries.sh Check 5 catches try_connect() and similar silent-skip patterns in integration tests. Tests should use feature gates to fail loudly when prerequisites are missing, not silently return. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix(security): harden skill fetch SSRF checks * fix(scripts): use bash arrays in check-boundaries.sh tier violation check Refactor Check 4 in check-boundaries.sh to use bash arrays and printf instead of string concatenation with echo -e. This is more robust with special characters in filenames and avoids portability concerns with echo -e. [skip-regression-check] Co-Authored-By: Claude Opus 4.6 <[email protected]> --------- Co-authored-by: Claude Opus 4.6 <[email protected]>
124 lines
4.3 KiB
Rust
124 lines
4.3 KiB
Rust
#![cfg(all(feature = "postgres", feature = "integration"))]
|
|
//! Heartbeat integration test.
|
|
//!
|
|
//! Exercises the heartbeat system in isolation: connects to the real
|
|
//! database, reads the real HEARTBEAT.md, calls the real LLM, and prints
|
|
//! every step so you can see exactly where it breaks.
|
|
//!
|
|
//! Usage:
|
|
//! cargo test --test heartbeat_integration -- --ignored --nocapture
|
|
|
|
use std::sync::Arc;
|
|
|
|
use ironclaw::{
|
|
agent::HeartbeatRunner,
|
|
config::Config,
|
|
history::Store,
|
|
llm::{create_llm_provider, create_session_manager},
|
|
safety::SafetyLayer,
|
|
workspace::Workspace,
|
|
};
|
|
|
|
#[tokio::test]
|
|
#[ignore] // Requires running database and LLM credentials
|
|
async fn test_heartbeat_end_to_end() {
|
|
// Load .env and set up logging
|
|
let _ = dotenvy::dotenv();
|
|
let _ = tracing_subscriber::fmt()
|
|
.with_env_filter("ironclaw=debug")
|
|
.try_init();
|
|
|
|
println!("=== Heartbeat Integration Test ===\n");
|
|
|
|
// 1. Load config
|
|
let config = Config::from_env().await.expect("Failed to load config");
|
|
println!("[1/6] Config loaded");
|
|
println!(" heartbeat.enabled = {}", config.heartbeat.enabled);
|
|
println!(
|
|
" heartbeat.interval_secs = {}",
|
|
config.heartbeat.interval_secs
|
|
);
|
|
println!(
|
|
" heartbeat.notify_channel = {:?}",
|
|
config.heartbeat.notify_channel
|
|
);
|
|
println!(
|
|
" heartbeat.notify_user = {:?}",
|
|
config.heartbeat.notify_user
|
|
);
|
|
|
|
// 2. Connect to database
|
|
let store = Store::new(&config.database)
|
|
.await
|
|
.expect("Failed to connect to database");
|
|
store
|
|
.run_migrations()
|
|
.await
|
|
.expect("Failed to run migrations");
|
|
println!("[2/6] Database connected");
|
|
|
|
// 3. Create workspace
|
|
let workspace = Arc::new(Workspace::new("default", store.pool()));
|
|
println!("[3/6] Workspace created");
|
|
|
|
// 4. Read HEARTBEAT.md
|
|
let checklist = workspace.heartbeat_checklist().await;
|
|
match &checklist {
|
|
Ok(Some(content)) => {
|
|
let preview: String = content.chars().take(200).collect();
|
|
println!("[4/6] HEARTBEAT.md found ({} chars)", content.len());
|
|
println!(" Preview: {}...", preview);
|
|
}
|
|
Ok(None) => {
|
|
println!("[4/6] HEARTBEAT.md is None (no file, no seed fallback)");
|
|
println!(" Heartbeat will return Skipped.");
|
|
}
|
|
Err(e) => {
|
|
println!("[4/6] HEARTBEAT.md read error: {}", e);
|
|
}
|
|
}
|
|
|
|
// Check if the checklist would be considered "effectively empty"
|
|
if let Ok(Some(_)) = checklist {
|
|
println!(" (Will verify via runner below)");
|
|
}
|
|
|
|
// 5. Create LLM provider
|
|
let session = create_session_manager(config.llm.session.clone()).await;
|
|
let llm = create_llm_provider(&config.llm, session).expect("Failed to create LLM provider");
|
|
println!("[5/6] LLM provider created (model: {})", llm.model_name());
|
|
|
|
// 6. Run heartbeat check
|
|
println!("[6/6] Running check_heartbeat()...\n");
|
|
|
|
let hb_config = ironclaw::agent::HeartbeatConfig::default();
|
|
let hygiene_config = ironclaw::workspace::hygiene::HygieneConfig::default();
|
|
let safety = Arc::new(SafetyLayer::new(&config.safety));
|
|
let runner = HeartbeatRunner::new(hb_config, hygiene_config, workspace, llm, safety);
|
|
|
|
let result = runner.check_heartbeat().await;
|
|
|
|
println!("=== Result ===\n");
|
|
match &result {
|
|
ironclaw::agent::HeartbeatResult::Ok => {
|
|
println!("HeartbeatResult::Ok");
|
|
println!(" LLM responded HEARTBEAT_OK, nothing needs attention.");
|
|
}
|
|
ironclaw::agent::HeartbeatResult::NeedsAttention(msg) => {
|
|
println!("HeartbeatResult::NeedsAttention");
|
|
println!(" Message:\n{}", msg);
|
|
}
|
|
ironclaw::agent::HeartbeatResult::Skipped => {
|
|
println!("HeartbeatResult::Skipped");
|
|
println!(" No checklist found, or checklist was effectively empty.");
|
|
println!(" This means the HEARTBEAT.md either:");
|
|
println!(" - Does not exist in the workspace database");
|
|
println!(" - Contains only headers, comments, and empty checkboxes");
|
|
}
|
|
ironclaw::agent::HeartbeatResult::Failed(err) => {
|
|
println!("HeartbeatResult::Failed");
|
|
println!(" Error: {}", err);
|
|
}
|
|
}
|
|
}
|