Something went wrong. Try again.
This repository has no description
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497import assert from "node:assert/strict";import { test } from "node:test";import { setTimeout as sleep } from "node:timers/promises";import { build } from "esbuild";import { Miniflare, convertV4MiniflareOptions } from "miniflare";
const identity = (skill) => ({ source: "installed", name: skill.name, fingerprint: skill.fingerprint, revision: skill.revision,});const choices = { execute: "ask", network: "never", workspaceRead: "never", workspaceWrite: "never", externalCapabilities: "never",};const envelope = (name, source, requirements, version = "1.0.0") => ({ formatVersion: 1, files: [ { path: "SKILL.md", content: `---\nname: ${name}\ndescription: Native execution fixture ${name}\nmetadata:\n version: "${version}"\n---\nINSTRUCTIONS ${name}: activate, inspect references, then run scripts/run.js.`, }, { path: "references/guide.txt", content: "REFERENCE CONTENT" }, { path: "scripts/run.js", content: source }, ...(requirements ? [{ path: "permissions.json", content: JSON.stringify(requirements) }] : []), ],});const scriptOutputs = (snapshot) => snapshot.messages .flatMap((message) => message.parts) .map((part) => part.output) .filter((output) => output?.kind === "skill-script");const scriptActivities = (snapshot) => snapshot.activities.filter( (item) => item.capability?.source.kind === "skill" && item.toolName.startsWith("capability_"), );
test( "native Conversation executes installed scripts through durable owner approvals", { timeout: 90_000 }, async (t) => { let worker; let cleanup; const requests = new AbortController(); const signal = AbortSignal.any([t.signal, requests.signal]); const dispose = () => { requests.abort(); if (!worker) return; return (cleanup ??= (async () => { let timer; try { await Promise.race([ worker.dispose(), new Promise((_, reject) => { timer = setTimeout( () => reject( new Error("Skill execution fixture disposal timed out"), ), 10000, ); }), ]); } finally { clearTimeout(timer); } })()); }; t.after(dispose); t.signal.addEventListener( "abort", () => { void dispose(); }, { once: true }, ); const bundle = await build({ entryPoints: ["tests/fixtures/skill-activation-worker.ts"], alias: { path: "node:path", crypto: "node:crypto", async_hooks: "node:async_hooks", }, target: "es2022", keepNames: true, bundle: true, write: false, format: "esm", platform: "neutral", conditions: ["workerd", "worker", "browser"], mainFields: ["module", "main"], external: ["cloudflare:*", "node:*"], }); signal.throwIfAborted(); const outbound = []; worker = new Miniflare( convertV4MiniflareOptions({ modules: true, script: bundle.outputFiles[0].text, compatibilityDate: "2026-09-04", compatibilityFlags: ["nodejs_compat"], durableObjects: { MODEL: { className: "PersonalAgent", useSQLite: true }, }, r2Buckets: ["ATTACHMENTS"], workerLoaders: { LOADER: {} }, outboundService: (request) => { outbound.push(request.url); return new Response("PUBLIC NETWORK CONTENT", { headers: { "Content-Type": "text/plain" }, }); }, }), ); const raw = async (action, value, name = "conversation") => ( await worker.dispatchFetch("https://fixture.example", { method: "POST", signal, body: JSON.stringify({ action, value, name }), }) ).json(); const call = async (action, value, name) => { const result = await raw(action, value, name); assert.ok(!result?.fixtureError, JSON.stringify(result)); return result; }; const until = async (read, predicate, label) => { const deadline = Date.now() + 10000; do { signal.throwIfAborted(); const value = await read(); if (predicate(value)) return value; await sleep(10, undefined, { signal }); } while (Date.now() < deadline); assert.fail(`Timed out: ${label}`); }; const snapshot = (name) => call("snapshot", undefined, name); const pending = (name) => until( () => call("pending", undefined, name), (items) => items.length === 1, "one native approval", ); const toggle = async (skill, enabled) => { const result = await call("toggle", { ...identity(skill), enabled }); assert.equal(result.ok, true); return result.value.find((item) => item.name === skill.name); }; const install = async (contents, previous) => call("install", { envelope: contents, revision: previous?.revision }); const manage = async (value) => { const result = await call("manage", value); assert.equal(result.status, 200, JSON.stringify(result)); return result.body; }; const permissions = async (skill, update) => { const previous = ( await manage({ action: "permissions", skill: identity(skill) }) ).permissions; return manage({ action: "set-permissions", skill: identity(skill), revision: previous.revision, choices: { ...choices, ...update }, }); }; const submit = (name, skill, input = {}, extra = {}) => call( "submit", { ...extra, scripts: [{ name: skill.name, path: "scripts/run.js", ...input }], }, name, ); const approve = async (name, decision = "approve") => { const [request] = await pending(name); const result = await call( "decide", { executionId: request.executionId, decision }, name, ); assert.equal(result.resolved, true); return request; }; const completed = (name) => until( () => snapshot(name), (value) => scriptOutputs(value).length > 0 && value.observed.at(-1)?.prompt.includes("skill-script"), "script outcome and native continuation", );
await t.test( "default Ask executes once with exact provenance and native continuation", async () => { let skill = await install( envelope( "approval-script", `export default async (input) => {console.log('owner input', input.value); console.error('fixture warning'); return {value:input.value};}`, ), ); skill = await toggle(skill, true); const definition = (await call("definitions")).find( (item) => item.skill.name === skill.name, ); const before = await call("metrics"); await submit("approve", skill, { input: { value: "exact input", approvedOnce: true }, }); const [request] = await pending("approve"); assert.ok(request.summary.includes(skill.name)); assert.deepEqual(request.arguments, { input: { value: "exact input", approvedOnce: true }, workspace: [], }); assert.equal( (await call("metrics")).loads, before.loads, "Ask parks before loading native executable code", ); assert.equal(scriptOutputs(await snapshot("approve")).length, 0); await approve("approve"); const result = await completed("approve"); const [output] = scriptOutputs(result); assert.equal(output.result.ok, true); assert.deepEqual(output.result.result, { value: "exact input" }); assert.equal(output.result.stdout, "owner input exact input\n"); assert.equal(output.result.stderr, "fixture warning\n"); assert.equal(output.result.exitCode, 0); assert.deepEqual(output.skill, { source: "installed", name: skill.name, version: "1.0.0", fingerprint: skill.fingerprint, }); assert.equal(output.path, "scripts/run.js"); const activity = scriptActivities(result)[0]; assert.equal(activity.status, "succeeded"); assert.equal(activity.approvalDecision, "approved"); assert.equal( activity.capability.fingerprint, definition.metadata.fingerprint, ); assert.equal(activity.capability.version, "1.0.0"); assert.equal(activity.capability.source.id, `installed:${skill.name}`); assert.equal((await call("metrics")).loads, before.loads + 1); assert.deepEqual( await call( "decide", { executionId: request.executionId, decision: "approve" }, "approve", ), { resolved: false }, ); assert.equal((await call("metrics")).loads, before.loads + 1); assert.ok( JSON.stringify(result.messages).includes("Turn remains usable."), ); assert.ok(!JSON.stringify(result.diagnostics).includes("exact input")); }, );
await t.test( "denial and inherited native approval cannot authorize the Ask guard", async () => { let skill = await install( envelope("denial-script", "export default () => 'must not run';"), ); skill = await toggle(skill, true); const before = (await call("metrics")).loads; await submit("denied", skill); await approve("denied", "deny"); assert.equal((await call("metrics")).loads, before); const denied = await snapshot("denied"); assert.equal(scriptActivities(denied)[0].approvalDecision, "denied"); await submit("bare", skill); const [request] = await pending("bare"); await call("bare-approve", request.executionId, "bare"); const result = await completed("bare"); assert.equal(scriptOutputs(result)[0].result.ok, false); assert.equal((await call("metrics")).loads, before); }, );
await t.test( "current permission, disable and replacement invalidate parked script actions", async () => { for (const change of ["never", "disable", "replace"]) { let skill = await install( envelope(`stale-${change}`, "export default () => 'original';"), ); skill = await toggle(skill, true); const before = (await call("metrics")).loads; await submit(`stale-${change}`, skill); await pending(`stale-${change}`); if (change === "never") await permissions(skill, { execute: "never" }); if (change === "disable") skill = await toggle(skill, false); if (change === "replace") skill = await install( envelope( skill.name, "export default () => 'replacement';", undefined, "1.0.1", ), skill, ); await approve(`stale-${change}`); const result = await snapshot(`stale-${change}`); assert.equal((await call("metrics")).loads, before); assert.equal(scriptActivities(result).length, 1); assert.ok( scriptActivities(result).every((activity) => ["failed", "cancelled"].includes(activity.status), ), ); assert.deepEqual( await call("pending", undefined, `stale-${change}`), [], ); assert.ok(!scriptOutputs(result).some((output) => output.result.ok)); assert.ok( !(await call("definitions")).some( (item) => item.skill.name === skill.name && item.metadata.approval === "never", ), ); } }, );
await t.test( "activation, resource read and workspace script share a usable native turn", async () => { let skill = await install( envelope( "workspace-script", `export default async (input,ctx) => {const before=await ctx.workspace.readFile('input.txt'); const missing=await ctx.workspace.readFile('ambient-secret.txt'); await ctx.workspace.writeFile('output.txt',before+' processed'); return {before,missing,reference:ctx.files['references/guide.txt']};}`, { workspace: "read-write" }, ), ); skill = await toggle(skill, true); await permissions(skill, { execute: "allow", workspaceRead: "allow", workspaceWrite: "allow", }); const result = await submit( "combined", skill, { workspace: [{ path: "input.txt", content: "explicit mount" }] }, { names: [skill.name], resources: [{ name: skill.name, path: "references/guide.txt" }], }, ); const [output] = scriptOutputs(result); assert.equal(output.result.ok, true); assert.deepEqual(output.result.result, { before: "explicit mount", missing: null, reference: "REFERENCE CONTENT", }); assert.deepEqual(output.workspace, { files: [{ path: "output.txt", content: "explicit mount processed" }], truncated: false, }); assert.deepEqual( result.activities.map((item) => item.status), ["succeeded", "succeeded", "succeeded"], ); assert.ok( result.observed .at(-1) .prompt.includes("INSTRUCTIONS workspace-script"), ); assert.ok(result.observed.at(-1).prompt.includes("REFERENCE CONTENT")); assert.equal((await call("pending", undefined, "combined")).length, 0); const next = await submit("combined-next", skill); assert.equal( scriptOutputs(next)[0].result.result.before, null, "workspace mounts do not survive invocation", ); }, );
await t.test( "script failure and oversized output remain bounded and mark native activity failed", async () => { for (const [name, source, code] of [ [ "throwing-script", `export default () => {console.log('before failure'); throw new Error('PRIVATE SECRET ERROR');}`, "script_failed", ], [ "large-script", `export default () => {console.log('😀\\u0000'.repeat(10000)); return '界'.repeat(30000);}`, "output_limit", ], ]) { let skill = await install(envelope(name, source)); skill = await toggle(skill, true); await permissions(skill, { execute: "allow" }); const result = await submit(name, skill); const [output] = scriptOutputs(result); assert.equal(output.result.error.code, code); assert.equal(output.result.exitCode, 1); assert.equal(scriptActivities(result)[0].status, "failed"); assert.ok(Buffer.byteLength(JSON.stringify(output)) <= 65536); assert.ok(!JSON.stringify(output).includes("PRIVATE SECRET ERROR")); assert.ok( JSON.stringify(result.messages).includes("Turn remains usable."), ); } }, );
await t.test( "clear and cancellation revoke a running script before its delayed network call", async () => { let skill = await install( envelope( "network-script", `export default async (_,ctx) => {await ctx.tools.network_fetch({url:'https://packages.example/started'}); await new Promise(r=>setTimeout(r,250)); return ctx.tools.network_fetch({url:'https://packages.example/late'});}`, { network: true }, ), ); skill = await toggle(skill, true); await permissions(skill, { execute: "allow", network: "allow" }); const successful = await submit("network-success", skill); assert.equal(scriptOutputs(successful)[0].result.ok, true); assert.deepEqual(scriptOutputs(successful)[0].result.result, { text: "PUBLIC NETWORK CONTENT", truncated: false, }); assert.equal( outbound.length, 2, "uninterrupted native script completes both permitted requests", ); for (const action of ["clear", "cancel"]) { const before = outbound.length; const work = raw( "submit", { scripts: [{ name: skill.name, path: "scripts/run.js" }] }, action, ); try { await until( async () => outbound.length, (count) => count === before + 1, "script reached initial permitted network call", ); } catch (error) { const state = await snapshot(action); t.diagnostic( JSON.stringify({ outbound, outputs: scriptOutputs(state), activities: scriptActivities(state), observed: state.observed.map((item) => item.tools), }), ); throw error; } await call(action, undefined, action); await work; await sleep(350, undefined, { signal }); assert.equal( outbound.length, before + 1, `${action} blocks the late host network effect`, ); const state = await snapshot(action); if (action === "clear") assert.deepEqual(state.messages, []); assert.ok(!scriptOutputs(state).some((output) => output.result.ok)); } }, ); },);