Something went wrong. Try again.
A local-first event pipeline for independent agents, built on Jazz.
Something went wrong. Try again.
3.6 kB · 91 lines
TypeScript
1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192import { describe, expect, test } from "vitest";
import { buildDockerRunArgs, dockerWarningsSatisfyHarness } from "../src/agents/harness/container-launcher.js";import { decodeHarnessFrame, encodeHarnessFrame, HARNESS_ADAPTER_ID, HARNESS_PROFILE_ID, HarnessRunPacketSchema,} from "../src/agents/harness/protocol.js";
describe("container harness contract", () => { test("rejects undeclared packet fields and trailing frames", () => { const packet = fixturePacket(); expect(() => HarnessRunPacketSchema.parse({ ...packet, credential: "must-not-cross" })).toThrow();
const frame = encodeHarnessFrame(packet); expect(decodeHarnessFrame(frame, 512 * 1024)).toEqual(packet); expect(() => decodeHarnessFrame(Buffer.concat([frame, Buffer.from("trailing")]), 512 * 1024)).toThrow(/trailing/u); });
test("builds the workspace profile with no host network, capabilities, or writable root", () => { const args = buildDockerRunArgs({ imageId: `sha256:${"a".repeat(64)}`, containerName: "thoughtstream-fixture", workspacePath: "/leases/workspace/fixture", stateDataPath: "/leases/state/fixture/data", brokerDirectory: "/tmp/broker-fixture", memoryBytes: 1_073_741_824, cpuLimit: 1, processLimit: 64, }); const joined = args.join(" "); expect(joined).toContain("--read-only"); expect(joined).toContain("--interactive"); expect(joined).toContain("--network=none"); expect(joined).toContain("--cap-drop=ALL"); expect(joined).toContain("no-new-privileges=true"); expect(joined).toContain("--pids-limit 64"); expect(joined).toContain("data=1073741824:1073741824"); expect(joined).toContain("fsize=268435456:268435456"); expect(joined).toContain("dst=/workspace"); expect(joined).toContain("dst=/state"); expect(joined).toContain("dst=/broker,readonly"); expect(joined).not.toContain("docker.sock"); expect(joined).not.toContain("--privileged"); expect(joined).not.toContain("fixture-secret"); });
test("fails runtime admission when Docker cannot enforce memory isolation", () => { expect(dockerWarningsSatisfyHarness(null)).toBe(true); expect(dockerWarningsSatisfyHarness([])).toBe(true); expect(dockerWarningsSatisfyHarness(["WARNING: No swap limit support"])).toBe(true); expect(dockerWarningsSatisfyHarness(["WARNING: No memory limit support"])).toBe(false); expect(dockerWarningsSatisfyHarness("unknown")).toBe(false); });});
function fixturePacket() { return { version: 1 as const, runId: "run-fixture", adapter: HARNESS_ADAPTER_ID, profile: HARNESS_PROFILE_ID, systemPrompt: "Use tools only when needed.", prompt: "Inspect the workspace.", workspace: { path: "/workspace" as const, identity: "workspace-fixture" }, state: { path: "/state" as const }, session: { mode: "new" as const }, model: { provider: "openai-compatible" as const, id: "fixture-model", profile: "fixture", reasoning: false, contextWindow: 32_000, maxOutputTokens: 1_000, }, broker: { socketPath: "/broker/provider.sock", capability: "a".repeat(64), virtualOrigin: "http://provider.invalid" as const, routePath: "/v1/chat/completions" as const, expiresAt: Date.now() + 5_000, maxRequests: 4, maxRequestBytes: 64 * 1024, maxResponseBytes: 64 * 1024, }, tools: ["read" as const, "bash" as const], limits: { maxResultBytes: 64 * 1024, maxToolReceipts: 100 }, };}