alfred-rootson
b71c88f292
Closes the remote POSIX workspace path preservation gap across Session and streaming. Profile-aware runtime path resolution. Co-authored-by: alfred-rootson <alfred.wojtasordzik@gmail.com>
1403 lines
61 KiB
Python
1403 lines
61 KiB
Python
from pathlib import Path
|
|
import json
|
|
import pathlib
|
|
|
|
import pytest
|
|
|
|
from api import config as api_config
|
|
from api import workspace
|
|
|
|
|
|
REMOTE_CWD = "/Users/joeyshiue"
|
|
|
|
|
|
def _remote_config(**overrides):
|
|
cfg = {"terminal": {"backend": "ssh", "cwd": REMOTE_CWD}}
|
|
cfg.update(overrides)
|
|
return cfg
|
|
|
|
|
|
def test_remote_terminal_cwd_is_profile_default_without_local_stat(monkeypatch, tmp_path):
|
|
fallback = tmp_path / "fallback"
|
|
fallback.mkdir()
|
|
|
|
monkeypatch.setattr(api_config, "DEFAULT_WORKSPACE", fallback)
|
|
monkeypatch.setattr(api_config, "get_config", lambda: _remote_config())
|
|
|
|
assert workspace._profile_default_workspace() == REMOTE_CWD
|
|
|
|
|
|
def test_remote_terminal_last_workspace_ignores_stale_local_path(monkeypatch, tmp_path):
|
|
stale_local = tmp_path / "stale-local"
|
|
stale_local.mkdir()
|
|
last_workspace = tmp_path / "last_workspace.txt"
|
|
last_workspace.write_text(str(stale_local), encoding="utf-8")
|
|
|
|
monkeypatch.setattr(api_config, "get_config", lambda: _remote_config())
|
|
monkeypatch.setattr(workspace, "_last_workspace_file", lambda: last_workspace)
|
|
monkeypatch.setattr(workspace, "_GLOBAL_LW_FILE", tmp_path / "missing-global-last-workspace.txt")
|
|
|
|
assert workspace.get_last_workspace() == REMOTE_CWD
|
|
|
|
|
|
def test_remote_terminal_workspace_paths_under_cwd_do_not_require_local_existence(monkeypatch):
|
|
monkeypatch.setattr(api_config, "get_config", lambda: _remote_config())
|
|
|
|
target_side_project = f"{REMOTE_CWD}/projects/demo"
|
|
|
|
assert workspace.validate_workspace_to_add(target_side_project) == Path(target_side_project).resolve()
|
|
assert workspace.resolve_trusted_workspace(target_side_project) == Path(target_side_project).resolve()
|
|
|
|
|
|
def test_remote_terminal_workspace_paths_outside_cwd_still_reject(monkeypatch):
|
|
monkeypatch.setattr(api_config, "get_config", lambda: _remote_config())
|
|
|
|
with pytest.raises(ValueError, match="Path does not exist"):
|
|
workspace.validate_workspace_to_add("/Users/other/projects/demo")
|
|
|
|
with pytest.raises(ValueError, match="Path does not exist"):
|
|
workspace.resolve_trusted_workspace("/Users/other/projects/demo")
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"terminal_cfg",
|
|
[
|
|
pytest.param({"backend": "ssh", "cwd": REMOTE_CWD}, id="cwd-absolute"),
|
|
pytest.param({"backend": "ssh"}, id="cwd-omitted"),
|
|
pytest.param({"backend": "ssh", "cwd": ""}, id="cwd-empty"),
|
|
pytest.param({"backend": "ssh", "cwd": "."}, id="cwd-dot"),
|
|
],
|
|
)
|
|
def test_remote_terminal_implicit_recovery_does_not_use_local_missing_path(
|
|
monkeypatch, tmp_path, terminal_cfg
|
|
):
|
|
fallback_path = tmp_path / "fallback"
|
|
fallback_path.mkdir()
|
|
monkeypatch.setattr(
|
|
api_config,
|
|
"get_config",
|
|
lambda: _remote_config(terminal=terminal_cfg),
|
|
)
|
|
monkeypatch.setattr(workspace, "_home_path", lambda: tmp_path)
|
|
fallback_calls = {"count": 0}
|
|
|
|
def fallback():
|
|
fallback_calls["count"] += 1
|
|
return fallback_path
|
|
|
|
with pytest.raises(ValueError, match="Path does not exist"):
|
|
workspace.resolve_implicit_workspace_with_recovery(
|
|
"/Users/other/projects/demo",
|
|
fallback,
|
|
)
|
|
|
|
assert fallback_calls["count"] == 0
|
|
|
|
|
|
def test_remote_terminal_workspace_paths_with_parent_escape_still_reject(monkeypatch):
|
|
monkeypatch.setattr(api_config, "get_config", lambda: _remote_config())
|
|
|
|
escaped = f"{REMOTE_CWD}/../other/projects/demo"
|
|
|
|
with pytest.raises(ValueError, match="Path does not exist"):
|
|
workspace.validate_workspace_to_add(escaped)
|
|
|
|
with pytest.raises(ValueError, match="Path does not exist"):
|
|
workspace.resolve_trusted_workspace(escaped)
|
|
|
|
|
|
@pytest.mark.parametrize("workspace_path", ["/etc", "/etc/ssh"])
|
|
def test_remote_terminal_workspace_system_roots_still_reject(monkeypatch, workspace_path):
|
|
monkeypatch.setattr(api_config, "get_config", lambda: _remote_config(terminal={"backend": "ssh", "cwd": "/etc"}))
|
|
|
|
with pytest.raises(ValueError, match="Path points to a system directory"):
|
|
workspace.validate_workspace_to_add(workspace_path)
|
|
|
|
with pytest.raises(ValueError, match="Path points to a system directory"):
|
|
workspace.resolve_trusted_workspace(workspace_path)
|
|
|
|
|
|
@pytest.mark.parametrize("validator", [workspace.resolve_trusted_workspace, workspace.validate_workspace_to_add])
|
|
def test_var_home_workspaces_stay_allowed_before_system_root_blocklist(monkeypatch, validator):
|
|
home = Path("/var/home/joeyshiue")
|
|
candidate = home / "projects/demo"
|
|
|
|
monkeypatch.setattr(workspace, "_resolve_path", lambda raw: candidate if str(raw) == str(candidate) else Path(raw))
|
|
monkeypatch.setattr(workspace, "_home_path", lambda: home)
|
|
monkeypatch.setattr(workspace, "_workspace_access_error", lambda _candidate: None)
|
|
|
|
assert validator(str(candidate)) == candidate
|
|
|
|
|
|
def test_remote_terminal_workspace_rejects_embedded_nullbyte_in_raw_path(monkeypatch):
|
|
"""Embedded null bytes in remote workspace path should be rejected."""
|
|
monkeypatch.setattr(api_config, "get_config", lambda: _remote_config())
|
|
|
|
# Path with embedded null byte
|
|
nullbyte_path = f"{REMOTE_CWD}/projects\x00/demo"
|
|
|
|
assert workspace._remote_terminal_workspace_candidate(nullbyte_path) is None
|
|
|
|
|
|
def test_remote_terminal_workspace_rejects_embedded_nullbyte_in_cwd(monkeypatch):
|
|
"""Embedded null bytes in remote terminal cwd should be rejected."""
|
|
monkeypatch.setattr(api_config, "get_config", lambda: _remote_config(terminal={"backend": "ssh", "cwd": f"{REMOTE_CWD}\x00/malicious"}))
|
|
|
|
# Normal path, but remote cwd contains null byte
|
|
normal_path = f"{REMOTE_CWD}/projects/demo"
|
|
|
|
assert workspace._remote_terminal_workspace_candidate(normal_path) is None
|
|
|
|
|
|
def test_remote_terminal_linux_home_preserves_path_without_macos_synthetic_resolution(monkeypatch):
|
|
"""Remote Linux /home/<user> paths must not resolve to /System/Volumes/Data/home/<user> on macOS."""
|
|
monkeypatch.setattr(
|
|
api_config,
|
|
"get_config",
|
|
lambda: _remote_config(terminal={"backend": "ssh", "cwd": "/home/developer"}),
|
|
)
|
|
|
|
real_resolve = workspace._safe_resolve
|
|
|
|
def fake_resolve(p):
|
|
p_str = str(p)
|
|
if p_str == "/home/developer" or p_str.startswith("/home/developer/"):
|
|
return Path(f"/System/Volumes/Data{p_str}")
|
|
return real_resolve(p)
|
|
|
|
monkeypatch.setattr(workspace, "_safe_resolve", fake_resolve)
|
|
|
|
assert workspace.validate_workspace_to_add("/home/developer") == Path("/home/developer")
|
|
assert workspace.resolve_trusted_workspace("/home/developer") == Path("/home/developer")
|
|
assert workspace.get_profile_default_workspace() == "/home/developer"
|
|
assert workspace._resolve_path("/home/developer") == Path("/home/developer")
|
|
assert workspace._clean_workspace_list([{"path": "/home/developer", "name": "Dev"}]) == [
|
|
{"path": "/home/developer", "name": "Dev"}
|
|
]
|
|
|
|
|
|
def test_session_init_and_created_workspace_preserve_remote_posix_path(monkeypatch):
|
|
"""Session initialization must not corrupt remote POSIX paths to macOS synthetic firmlinks."""
|
|
monkeypatch.setattr(
|
|
api_config,
|
|
"get_config",
|
|
lambda: _remote_config(terminal={"backend": "ssh", "cwd": "/home/rootson"}),
|
|
)
|
|
|
|
from api.models import Session
|
|
|
|
s = Session(workspace="/home/rootson", created_workspace="/home/rootson")
|
|
assert s.workspace == "/home/rootson"
|
|
assert s.created_workspace == "/home/rootson"
|
|
|
|
|
|
def test_named_profile_remote_terminal_workspace_candidate_isolated(monkeypatch, tmp_path):
|
|
"""Remote paths must resolve per profile: remote for named remote profile, not for active local profile."""
|
|
# Active profile is local
|
|
monkeypatch.setattr(api_config, "get_config", lambda: {"terminal": {"backend": "local", "cwd": "/Users/local"}})
|
|
|
|
# Named profile 'optiplex' under base home
|
|
profiles_dir = tmp_path / "profiles" / "optiplex"
|
|
profiles_dir.mkdir(parents=True)
|
|
(profiles_dir / "config.yaml").write_text(
|
|
"terminal:\n backend: ssh\n cwd: /home/rootson\n", encoding="utf-8"
|
|
)
|
|
|
|
from api import profiles
|
|
monkeypatch.setattr(profiles, "_DEFAULT_HERMES_HOME", tmp_path)
|
|
monkeypatch.setattr(profiles, "_resolve_base_hermes_home", lambda: tmp_path)
|
|
|
|
# Scoped to named remote profile: candidate is recognized as remote
|
|
cand_optiplex = workspace._remote_terminal_workspace_candidate(
|
|
"/home/rootson/projects/app", profile="optiplex"
|
|
)
|
|
assert cand_optiplex == Path("/home/rootson/projects/app")
|
|
|
|
# Scoped to active local profile: candidate is NOT recognized as remote (prevents cross-profile bypass)
|
|
cand_local = workspace._remote_terminal_workspace_candidate(
|
|
"/home/rootson/projects/app", profile=None
|
|
)
|
|
assert cand_local is None
|
|
|
|
# Local validation fails on nonexistent path when active profile is local
|
|
with pytest.raises(ValueError, match="Path does not exist"):
|
|
workspace.validate_workspace_to_add("/home/rootson/projects/app", profile=None)
|
|
|
|
# Remote validation succeeds when profile is optiplex
|
|
assert workspace.validate_workspace_to_add(
|
|
"/home/rootson/projects/app", profile="optiplex"
|
|
) == Path("/home/rootson/projects/app")
|
|
|
|
|
|
def test_build_native_multimodal_message_preserves_remote_workspace(monkeypatch, tmp_path):
|
|
"""Multimodal message builder must scope workspace resolution to the session profile."""
|
|
# Active ambient profile is local
|
|
monkeypatch.setattr(api_config, "get_config", lambda: {"terminal": {"backend": "local", "cwd": "/Users/local"}})
|
|
|
|
profiles_dir = tmp_path / "profiles" / "optiplex"
|
|
profiles_dir.mkdir(parents=True)
|
|
(profiles_dir / "config.yaml").write_text(
|
|
"terminal:\n backend: ssh\n cwd: /home/rootson\n", encoding="utf-8"
|
|
)
|
|
|
|
from api import profiles, streaming
|
|
monkeypatch.setattr(profiles, "_DEFAULT_HERMES_HOME", tmp_path)
|
|
monkeypatch.setattr(profiles, "_resolve_base_hermes_home", lambda: tmp_path)
|
|
|
|
# 1. Profile as logical name string
|
|
msg1 = streaming._build_native_multimodal_message(
|
|
"[Workspace::v1: /home/rootson]\n",
|
|
"hello",
|
|
attachments=[],
|
|
workspace="/home/rootson",
|
|
profile="optiplex",
|
|
)
|
|
assert "[Workspace::v1: /home/rootson]" in msg1
|
|
|
|
# 2. Profile as filesystem path string (_profile_home)
|
|
msg2 = streaming._build_native_multimodal_message(
|
|
"[Workspace::v1: /home/rootson]\n",
|
|
"hello",
|
|
attachments=[],
|
|
workspace="/home/rootson",
|
|
profile=str(profiles_dir),
|
|
)
|
|
assert "[Workspace::v1: /home/rootson]" in msg2
|
|
|
|
# 3. Profile as Path object
|
|
msg3 = streaming._build_native_multimodal_message(
|
|
"[Workspace::v1: /home/rootson]\n",
|
|
"hello",
|
|
attachments=[],
|
|
workspace="/home/rootson",
|
|
profile=profiles_dir,
|
|
)
|
|
assert "[Workspace::v1: /home/rootson]" in msg3
|
|
|
|
|
|
def test_resolve_profile_home_param_formats(tmp_path):
|
|
"""_resolve_profile_home_param handles None, default, profile name, and Path.
|
|
|
|
Round 5 (#7168): path-shaped STRINGS are no longer accepted as explicit
|
|
homes — a string is strictly a logical profile id (grammar-checked), so an
|
|
explicit home must be expressed as a Path value.
|
|
"""
|
|
from api.profiles import _DEFAULT_HERMES_HOME
|
|
|
|
assert workspace._resolve_profile_home_param(None) == _DEFAULT_HERMES_HOME
|
|
assert workspace._resolve_profile_home_param("default") == _DEFAULT_HERMES_HOME
|
|
# Path-shaped string: rejected by the logical-id grammar.
|
|
with pytest.raises(ValueError):
|
|
workspace._resolve_profile_home_param(str(tmp_path / "profiles/custom"))
|
|
# Same location as a Path value: honored and canonicalized.
|
|
assert workspace._resolve_profile_home_param(tmp_path / "profiles/custom") == (
|
|
tmp_path / "profiles/custom"
|
|
)
|
|
|
|
|
|
def test_remote_profile_a_cannot_use_remote_profile_b_cwd(monkeypatch, tmp_path):
|
|
"""Active remote profile Alice (/srv/remote-alice) cannot validate paths under remote profile Bob (/srv/remote-bob)."""
|
|
profiles_alice = tmp_path / "profiles" / "alice"
|
|
profiles_alice.mkdir(parents=True)
|
|
(profiles_alice / "config.yaml").write_text("terminal:\n backend: ssh\n cwd: /srv/remote-alice\n", encoding="utf-8")
|
|
|
|
profiles_bob = tmp_path / "profiles" / "bob"
|
|
profiles_bob.mkdir(parents=True)
|
|
(profiles_bob / "config.yaml").write_text("terminal:\n backend: ssh\n cwd: /srv/remote-bob\n", encoding="utf-8")
|
|
|
|
from api import profiles
|
|
monkeypatch.setattr(profiles, "_DEFAULT_HERMES_HOME", tmp_path)
|
|
monkeypatch.setattr(profiles, "_resolve_base_hermes_home", lambda: tmp_path)
|
|
|
|
# Scoped to Alice: Bob's path must be rejected
|
|
with pytest.raises(ValueError, match="Path does not exist"):
|
|
workspace.validate_workspace_to_add("/srv/remote-bob/project", profile="alice")
|
|
|
|
with pytest.raises(ValueError, match="Path does not exist"):
|
|
workspace.resolve_trusted_workspace("/srv/remote-bob/project", profile="alice")
|
|
|
|
# Scoped to Alice: Alice's own path succeeds
|
|
assert workspace.validate_workspace_to_add("/srv/remote-alice/project", profile="alice") == Path("/srv/remote-alice/project")
|
|
assert workspace.resolve_trusted_workspace("/srv/remote-alice/project", profile="alice") == Path("/srv/remote-alice/project")
|
|
|
|
|
|
def test_local_symlink_resolving_to_system_path_is_rejected(monkeypatch, tmp_path):
|
|
"""Local symlink pointing to a system directory (/etc) is strictly rejected."""
|
|
# Active profile is local
|
|
monkeypatch.setattr(api_config, "get_config", lambda: {"terminal": {"backend": "local", "cwd": str(tmp_path)}})
|
|
monkeypatch.setattr(workspace, "_home_path", lambda: tmp_path / "home")
|
|
|
|
symlink_to_etc = tmp_path / "symlink_etc"
|
|
try:
|
|
symlink_to_etc.symlink_to("/etc")
|
|
except OSError:
|
|
pytest.skip("Symlink creation requires permissions")
|
|
|
|
with pytest.raises(ValueError, match="Path points to a system directory"):
|
|
workspace.validate_workspace_to_add(str(symlink_to_etc), profile=None)
|
|
|
|
with pytest.raises(ValueError, match="Path points to a system directory"):
|
|
workspace.resolve_trusted_workspace(str(symlink_to_etc), profile=None)
|
|
|
|
|
|
def test_local_profile_add_workspace_auto_create_on_remote_path_collision(monkeypatch, tmp_path):
|
|
"""Active local profile adding a path beneath an inactive remote profile's cwd still creates local directory."""
|
|
# Active profile is local
|
|
monkeypatch.setattr(api_config, "get_config", lambda: {"terminal": {"backend": "local", "cwd": str(tmp_path)}})
|
|
|
|
# Inactive remote profile 'optiplex' has cwd /tmp/remote-test
|
|
profiles_dir = tmp_path / "profiles" / "optiplex"
|
|
profiles_dir.mkdir(parents=True)
|
|
(profiles_dir / "config.yaml").write_text("terminal:\n backend: ssh\n cwd: /tmp/remote-test\n", encoding="utf-8")
|
|
|
|
from api import profiles
|
|
monkeypatch.setattr(profiles, "_DEFAULT_HERMES_HOME", tmp_path)
|
|
monkeypatch.setattr(profiles, "_resolve_base_hermes_home", lambda: tmp_path)
|
|
|
|
local_target = tmp_path / "remote-test" / "subproject"
|
|
assert not local_target.exists()
|
|
|
|
from api.routes import _handle_workspace_add
|
|
|
|
class MockHandler:
|
|
def __init__(self):
|
|
self.response = None
|
|
def send_response(self, *args): pass
|
|
def send_header(self, *args): pass
|
|
def end_headers(self): pass
|
|
@property
|
|
def wfile(self):
|
|
class W:
|
|
def write(self, b): pass
|
|
return W()
|
|
|
|
handler = MockHandler()
|
|
monkeypatch.setattr(profiles, "get_active_profile_name", lambda: "default")
|
|
monkeypatch.setattr(workspace, "_workspaces_file", lambda: tmp_path / "workspaces.json")
|
|
monkeypatch.setattr(workspace, "_home_path", lambda: tmp_path)
|
|
|
|
_handle_workspace_add(handler, {"path": str(local_target), "create": True})
|
|
assert local_target.is_dir()
|
|
|
|
|
|
def test_detached_streaming_worker_preserves_session_profile_workspace(monkeypatch, tmp_path):
|
|
"""Detached streaming worker preserves session profile Alice (/srv/remote-alice) even with ambient local profile."""
|
|
# Ambient process profile is local
|
|
monkeypatch.setattr(api_config, "get_config", lambda: {"terminal": {"backend": "local", "cwd": "/Users/local"}})
|
|
|
|
profiles_dir = tmp_path / "profiles" / "alice"
|
|
profiles_dir.mkdir(parents=True)
|
|
(profiles_dir / "config.yaml").write_text("terminal:\n backend: ssh\n cwd: /srv/remote-alice\n", encoding="utf-8")
|
|
|
|
from api import profiles, models
|
|
monkeypatch.setattr(profiles, "_DEFAULT_HERMES_HOME", tmp_path)
|
|
monkeypatch.setattr(profiles, "_resolve_base_hermes_home", lambda: tmp_path)
|
|
|
|
# Simulate macOS firmlink expansion on host resolve
|
|
real_resolve = workspace._safe_resolve
|
|
def fake_resolve(p):
|
|
p_str = str(p)
|
|
if p_str == "/srv/remote-alice" or p_str.startswith("/srv/remote-alice/"):
|
|
return Path(f"/System/Volumes/Data{p_str}")
|
|
return real_resolve(p)
|
|
|
|
monkeypatch.setattr(workspace, "_safe_resolve", fake_resolve)
|
|
|
|
s = models.Session(session_id="test1234", workspace="/srv/remote-alice", profile="alice")
|
|
assert s.workspace == "/srv/remote-alice"
|
|
assert s.created_workspace == "/srv/remote-alice"
|
|
|
|
# Streaming workspace update
|
|
resolved_ws = workspace._resolve_path("/srv/remote-alice", profile=s.profile)
|
|
assert str(resolved_ws) == "/srv/remote-alice"
|
|
|
|
from api import streaming
|
|
turn_ws = streaming._resolve_path("/srv/remote-alice", profile=getattr(s, "profile", None))
|
|
assert str(turn_ws) == "/srv/remote-alice"
|
|
|
|
pytest.importorskip("agent.runtime_cwd", reason="hermes-agent not installed")
|
|
tokens = streaming._set_turn_session_identity(s.session_id, workspace=str(turn_ws))
|
|
try:
|
|
from agent.runtime_cwd import _SESSION_CWD
|
|
assert _SESSION_CWD.get() == "/srv/remote-alice"
|
|
finally:
|
|
streaming._reset_turn_session_identity(tokens)
|
|
|
|
|
|
def test_gateway_multimodal_message_preserves_remote_profile_workspace(monkeypatch, tmp_path):
|
|
"""Gateway chat multimodal payload builder preserves remote profile workspace containment."""
|
|
# Ambient process profile is local
|
|
monkeypatch.setattr(api_config, "get_config", lambda: {"terminal": {"backend": "local", "cwd": "/Users/local"}})
|
|
|
|
profiles_dir = tmp_path / "profiles" / "optiplex"
|
|
profiles_dir.mkdir(parents=True)
|
|
(profiles_dir / "config.yaml").write_text("terminal:\n backend: ssh\n cwd: /home/rootson\n", encoding="utf-8")
|
|
|
|
from api import profiles, streaming, models
|
|
monkeypatch.setattr(profiles, "_DEFAULT_HERMES_HOME", tmp_path)
|
|
monkeypatch.setattr(profiles, "_resolve_base_hermes_home", lambda: tmp_path)
|
|
|
|
s = models.Session(session_id="gw_test", workspace="/home/rootson", profile="optiplex")
|
|
|
|
msg = streaming._build_native_multimodal_message(
|
|
"",
|
|
"hello",
|
|
attachments=[],
|
|
workspace=str(s.workspace),
|
|
profile=getattr(s, "profile", None),
|
|
)
|
|
assert msg == "hello"
|
|
|
|
|
|
def test_isolated_profile_config_read_does_not_mutate_or_read_shared_cache(monkeypatch, tmp_path):
|
|
"""Explicit profile config lookup must not leak into or read from mutable global config cache."""
|
|
alice_home = tmp_path / "profiles" / "alice"
|
|
alice_home.mkdir(parents=True)
|
|
(alice_home / "config.yaml").write_text("terminal:\n backend: ssh\n cwd: /srv/remote-alice\n", encoding="utf-8")
|
|
|
|
bob_home = tmp_path / "profiles" / "bob"
|
|
bob_home.mkdir(parents=True)
|
|
(bob_home / "config.yaml").write_text("terminal:\n backend: local\n cwd: /Users/bob\n", encoding="utf-8")
|
|
|
|
from api import profiles
|
|
monkeypatch.setattr(profiles, "_DEFAULT_HERMES_HOME", tmp_path)
|
|
monkeypatch.setattr(profiles, "_resolve_base_hermes_home", lambda: tmp_path)
|
|
|
|
# NO ambient TLS profile: simulates a detached worker resolving an explicit
|
|
# session profile while the process-global active profile is 'default'
|
|
# (local). Alice diverges from the ambient target, so her on-disk
|
|
# config.yaml is authoritative — regardless of any concurrent reload.
|
|
monkeypatch.setattr(api_config, "get_config", lambda: {"terminal": {"backend": "local", "cwd": "/Users/local"}})
|
|
|
|
# 1. alice resolves to remote cwd (divergent profile reads its own disk file)
|
|
assert workspace._remote_terminal_cwd("alice") == "/srv/remote-alice"
|
|
|
|
# 2. bob resolves to None (local backend)
|
|
assert workspace._remote_terminal_cwd("bob") is None
|
|
|
|
# 3. Simulate concurrent reload on global _cfg_cache pointing to dirty state
|
|
monkeypatch.setattr(api_config, "_cfg_cache", {"terminal": {"backend": "local", "cwd": "/Users/polluted"}})
|
|
|
|
# Explicit lookup of alice still resolves to alice's on-disk terminal cwd, not polluted global cache
|
|
assert workspace._remote_terminal_cwd("alice") == "/srv/remote-alice"
|
|
assert workspace.validate_workspace_to_add("/srv/remote-alice/sub", profile="alice") == Path("/srv/remote-alice/sub")
|
|
|
|
|
|
def test_workspace_routes_profile_isolation(monkeypatch, tmp_path):
|
|
"""Workspace route actions (add, remove, rename, reorder) must be fully isolated per profile."""
|
|
from api import profiles
|
|
from api.routes import (
|
|
_handle_workspace_add,
|
|
)
|
|
|
|
alice_home = tmp_path / "profiles" / "alice"
|
|
alice_home.mkdir(parents=True)
|
|
(alice_home / "config.yaml").write_text("terminal:\n backend: ssh\n cwd: /srv/remote-alice\n", encoding="utf-8")
|
|
|
|
bob_home = tmp_path / "profiles" / "bob"
|
|
bob_home.mkdir(parents=True)
|
|
(bob_home / "config.yaml").write_text("terminal:\n backend: ssh\n cwd: /srv/remote-bob\n", encoding="utf-8")
|
|
|
|
monkeypatch.setattr(profiles, "_DEFAULT_HERMES_HOME", tmp_path)
|
|
monkeypatch.setattr(profiles, "_resolve_base_hermes_home", lambda: tmp_path)
|
|
monkeypatch.setattr(workspace, "_home_path", lambda: tmp_path)
|
|
|
|
# Ambient get_config() follows the per-request TLS profile exactly as
|
|
# production does (server.py sets the cookie context; the config loader
|
|
# resolves the active home). With the restored upstream authority rules,
|
|
# an ambient-target lookup delegates here — so each simulated request
|
|
# must see ITS OWN profile's terminal block.
|
|
def _ambient_cfg():
|
|
name = profiles.get_active_profile_name()
|
|
if name == "bob":
|
|
return {"terminal": {"backend": "ssh", "cwd": "/srv/remote-bob"}}
|
|
if name == "alice":
|
|
return {"terminal": {"backend": "ssh", "cwd": "/srv/remote-alice"}}
|
|
return {"terminal": {"backend": "local", "cwd": str(tmp_path)}}
|
|
|
|
monkeypatch.setattr(api_config, "get_config", _ambient_cfg)
|
|
|
|
class MockHandler:
|
|
def __init__(self):
|
|
self.status = 200
|
|
self.data = None
|
|
def send_response(self, code): self.status = code
|
|
def send_header(self, *args): pass
|
|
def end_headers(self): pass
|
|
@property
|
|
def wfile(self):
|
|
class W:
|
|
def write(inner_self, b): pass
|
|
return W()
|
|
|
|
# Add workspace under Alice — TLS profile is alice, so the route's
|
|
# get_active_profile_name() == 'alice' and the add writes into alice's
|
|
# profile-scoped workspaces.json.
|
|
profiles.set_request_profile("alice")
|
|
try:
|
|
h1 = MockHandler()
|
|
_handle_workspace_add(h1, {"path": "/srv/remote-alice/project1", "name": "Project 1"})
|
|
assert len(workspace.load_workspaces(profile="alice")) == 2
|
|
assert any(w["path"] == "/srv/remote-alice/project1" for w in workspace.load_workspaces(profile="alice"))
|
|
finally:
|
|
profiles.clear_request_profile()
|
|
|
|
# Bob's workspaces must be clean and not contain Alice's workspace
|
|
profiles.set_request_profile("bob")
|
|
try:
|
|
h2 = MockHandler()
|
|
assert len(workspace.load_workspaces(profile="bob")) == 1
|
|
assert workspace.load_workspaces(profile="bob")[0]["path"] == "/srv/remote-bob" # Default workspace for bob
|
|
|
|
_handle_workspace_add(h2, {"path": "/srv/remote-bob/app", "name": "Bob App"})
|
|
bob_ws = workspace.load_workspaces(profile="bob")
|
|
assert any(w["path"] == "/srv/remote-bob/app" for w in bob_ws)
|
|
assert not any("remote-alice" in w["path"] for w in bob_ws)
|
|
finally:
|
|
profiles.clear_request_profile()
|
|
|
|
# Re-verify Alice's workspaces did not get Bob's workspace
|
|
profiles.set_request_profile("alice")
|
|
try:
|
|
alice_ws = workspace.load_workspaces(profile="alice")
|
|
assert len(alice_ws) == 2
|
|
assert any(w["path"] == "/srv/remote-alice/project1" for w in alice_ws)
|
|
assert not any("remote-bob" in w["path"] for w in alice_ws)
|
|
finally:
|
|
profiles.clear_request_profile()
|
|
|
|
|
|
def test_saved_workspace_trust_scoped_to_session_profile(monkeypatch, tmp_path):
|
|
"""resolve_trusted_workspace's saved-workspace branch (B) must honor the explicit profile.
|
|
|
|
Greptile #3838260381: when a session profile differs from the ambient
|
|
profile, the saved-workspace authorization branch called load_workspaces()
|
|
and _resolve_path() WITHOUT the session profile — so a session-owned
|
|
external workspace was rejected and a path saved only by the ambient
|
|
profile was wrongly trusted instead.
|
|
"""
|
|
from api import profiles
|
|
|
|
monkeypatch.setattr(profiles, "_DEFAULT_HERMES_HOME", tmp_path)
|
|
monkeypatch.setattr(profiles, "_resolve_base_hermes_home", lambda: tmp_path)
|
|
monkeypatch.setattr(workspace, "_home_path", lambda: tmp_path / "home")
|
|
(tmp_path / "home").mkdir(parents=True)
|
|
|
|
# Session profile 'carol': remote SSH with cwd /srv/remote-carol.
|
|
carol_home = tmp_path / "profiles" / "carol"
|
|
carol_home.mkdir(parents=True)
|
|
(carol_home / "config.yaml").write_text(
|
|
"terminal:\n backend: ssh\n cwd: /srv/remote-carol\n", encoding="utf-8"
|
|
)
|
|
# Ambient/default: local backend so nothing is remotely classified.
|
|
monkeypatch.setattr(api_config, "get_config", lambda: {"terminal": {"backend": "local", "cwd": str(tmp_path)}})
|
|
|
|
# Carol's saved list includes an external (non-home, non-cwd) workspace dir.
|
|
external_dir = tmp_path / "data" / "carol-projects"
|
|
external_dir.mkdir(parents=True)
|
|
ws_file = tmp_path / "state"
|
|
monkeypatch.setattr(workspace, "_workspaces_file_for_profile", lambda p=None: ws_file)
|
|
ws_file.parent.mkdir(parents=True, exist_ok=True)
|
|
ws_file.write_text(
|
|
json.dumps([{"path": str(external_dir), "name": "Carol External"}]),
|
|
encoding="utf-8",
|
|
)
|
|
|
|
# With the session profile passed explicitly, the saved branch trusts it.
|
|
resolved = workspace.resolve_trusted_workspace(str(external_dir), profile="carol")
|
|
assert resolved == Path(str(external_dir)).resolve()
|
|
|
|
# Without the profile (ambient local), the same path is NOT trusted:
|
|
# it lives outside home/boot-default and the ambient profile has no such save.
|
|
monkeypatch.setattr(workspace, "_workspaces_file_for_profile", lambda p=None: tmp_path / "missing-workspaces.json")
|
|
with pytest.raises(ValueError, match="outside the user home directory"):
|
|
workspace.resolve_trusted_workspace(str(external_dir))
|
|
|
|
|
|
def test_session_init_simulated_macos_resolution_is_red_on_master_shape(monkeypatch):
|
|
"""Session.__init__ must preserve /home/<user> even when host resolve rewrites it.
|
|
|
|
Maintainer gate r4 item 3: this test simulates macOS synthetic firmlink
|
|
expansion on the HOST resolver. On origin/master's shape
|
|
(Path(workspace).expanduser().resolve()) the assertion fails because the
|
|
stored workspace becomes /System/Volumes/Data/home/rootson; on this head
|
|
(_resolve_path with profile-scoped remote preservation) it passes — i.e.
|
|
genuinely RED -> GREEN across the fix boundary.
|
|
"""
|
|
monkeypatch.setattr(
|
|
api_config,
|
|
"get_config",
|
|
lambda: _remote_config(terminal={"backend": "ssh", "cwd": "/home/rootson"}),
|
|
)
|
|
|
|
real_resolve = workspace._safe_resolve
|
|
|
|
def fake_resolve(p):
|
|
p_str = str(p)
|
|
if p_str == "/home/rootson" or p_str.startswith("/home/rootson/"):
|
|
return Path(f"/System/Volumes/Data{p_str}")
|
|
return real_resolve(p)
|
|
|
|
monkeypatch.setattr(workspace, "_safe_resolve", fake_resolve)
|
|
|
|
from api.models import Session
|
|
|
|
s = Session(workspace="/home/rootson", created_workspace="/home/rootson")
|
|
assert s.workspace == "/home/rootson"
|
|
assert s.created_workspace == "/home/rootson"
|
|
|
|
|
|
def test_local_tilde_and_relative_paths_still_host_resolve(monkeypatch, tmp_path):
|
|
"""Control: local ~/ paths keep host resolution while remotes are preserved.
|
|
|
|
Guards the discriminator BOTH ways (maintainer gate r4): the remote-path
|
|
preservation must not swallow ordinary local path semantics — tilde
|
|
expansion and symlink normalization still run for local profiles.
|
|
"""
|
|
real_home = tmp_path / "users" / "local"
|
|
projects = real_home / "projects"
|
|
projects.mkdir(parents=True)
|
|
# A symlink inside home pointing elsewhere-under-home must normalize.
|
|
linked = real_home / "linked-projects"
|
|
try:
|
|
linked.symlink_to(projects)
|
|
except OSError:
|
|
pytest.skip("Symlink creation requires permissions")
|
|
|
|
monkeypatch.setenv("HOME", str(real_home))
|
|
monkeypatch.setattr(api_config, "get_config", lambda: {"terminal": {"backend": "local", "cwd": str(projects)}})
|
|
|
|
# Tilde expansion still resolves against the LOCAL home.
|
|
resolved = workspace._resolve_path("~/projects")
|
|
assert resolved == projects.resolve()
|
|
|
|
# Symlinks under home still collapse to their real target.
|
|
resolved_link = workspace._resolve_path("~/linked-projects")
|
|
assert resolved_link == projects.resolve()
|
|
|
|
|
|
def test_config_authority_active_home_with_external_override(monkeypatch, tmp_path):
|
|
"""Maintainer blocker 1: an authoritative HERMES_CONFIG_PATH override wins
|
|
over target/config.yaml when resolving the ACTIVE profile home."""
|
|
from api import config as cfg, profiles as profiles_mod
|
|
import yaml
|
|
|
|
active_home = tmp_path / "active-home"
|
|
active_home.mkdir()
|
|
(active_home / "config.yaml").write_text(
|
|
yaml.safe_dump({"terminal": {"backend": "ssh", "cwd": "/srv/from-active-home"}}, sort_keys=False),
|
|
encoding="utf-8",
|
|
)
|
|
override_dir = tmp_path / "override-dir"
|
|
override_dir.mkdir()
|
|
override_cfg = override_dir / "config.yaml"
|
|
override_cfg.write_text(
|
|
yaml.safe_dump({"terminal": {"backend": "docker", "cwd": "/srv/from-override"}}, sort_keys=False),
|
|
encoding="utf-8",
|
|
)
|
|
monkeypatch.setenv("HERMES_CONFIG_PATH", str(override_cfg))
|
|
monkeypatch.setattr(profiles_mod, "get_active_hermes_home", lambda: active_home)
|
|
cfg.reload_config()
|
|
|
|
result = cfg.get_config_for_profile_home(active_home)
|
|
assert result.get("terminal", {}).get("cwd") == "/srv/from-override"
|
|
# NOTE: no manual delenv/reload here — monkeypatch restores
|
|
# HERMES_CONFIG_PATH at teardown, and the stale (_cfg_path vs pinned)
|
|
# check invalidates the cache on the next reader. A trailing
|
|
# reload_config() would bake this test's override into the global cache
|
|
# and pollute later tests (#7168 review triage).
|
|
|
|
|
|
def test_divergent_profile_without_config_yaml_stays_isolated(monkeypatch, tmp_path):
|
|
"""Maintainer blocker 2: an existing divergent named-profile directory with
|
|
NO config.yaml must NOT inherit the ambient default's terminal config."""
|
|
from api import config as cfg, profiles as profiles_mod
|
|
|
|
default_home = tmp_path / "default-home"
|
|
default_home.mkdir(parents=True)
|
|
(default_home / "config.yaml").write_text(
|
|
"terminal:\n backend: ssh\n cwd: /srv/remote-default\n",
|
|
encoding="utf-8",
|
|
)
|
|
# Fresh non-cloned named profile: exists on disk, no config.yaml yet.
|
|
fresh_profile_home = tmp_path / "profiles" / "fresh"
|
|
fresh_profile_home.mkdir(parents=True)
|
|
|
|
monkeypatch.setenv("HERMES_CONFIG_PATH", str(default_home / "config.yaml"))
|
|
monkeypatch.setattr(profiles_mod, "get_active_hermes_home", lambda: default_home)
|
|
cfg.reload_config()
|
|
|
|
result = cfg.get_config_for_profile_home(fresh_profile_home)
|
|
# Defaults applied, but crucially NOT the ambient default profile's terminal block.
|
|
assert result.get("terminal") != {"backend": "ssh", "cwd": "/srv/remote-default"}
|
|
assert not result.get("terminal", {}).get("cwd")
|
|
|
|
# And a divergent home that doesn't exist at all still returns {}.
|
|
assert cfg.get_config_for_profile_home(tmp_path / "profiles" / "ghost") == {}
|
|
# NOTE: no manual delenv/reload here (see test_config_authority_active_home_with_external_override) —
|
|
# monkeypatch teardown + path-change invalidation keep the global cache clean.
|
|
|
|
|
|
def test_suggestions_scoped_to_explicit_profile_saved_roots(tmp_path):
|
|
"""Sweep regression (#7168 review): list_workspace_suggestions with an
|
|
explicit profile must widen trust only via THAT profile's saved
|
|
workspaces — a workspace saved under a different profile stays out."""
|
|
other_dir = tmp_path / "other-profile-dir"
|
|
other_dir.mkdir(parents=True)
|
|
mine = tmp_path / "mine"
|
|
mine.mkdir()
|
|
|
|
ws_file = workspace._workspaces_file_for_profile("alice")
|
|
ws_file.parent.mkdir(parents=True, exist_ok=True)
|
|
ws_file.write_text(json.dumps([{"path": str(other_dir)}]), encoding="utf-8")
|
|
|
|
prefix = str(tmp_path) + "/"
|
|
suggestions = workspace.list_workspace_suggestions(prefix, profile="alice")
|
|
assert any(s.endswith("other-profile-dir") for s in suggestions)
|
|
|
|
# A different profile's saved list does NOT include alice's external dir.
|
|
suggestions_bob = workspace.list_workspace_suggestions(prefix, profile="bob")
|
|
assert not any(s.endswith("other-profile-dir") for s in suggestions_bob)
|
|
assert mine.exists() # control: fixture dir is real, absence is scoping
|
|
|
|
|
|
def test_recovery_helper_threads_profile_to_trust_and_fallback(tmp_path):
|
|
"""Sweep regression (#7168 review): resolve_implicit_workspace_with_recovery
|
|
passes the profile into both trust resolution and the recovery fallback,
|
|
so a deleted session workspace recovers to a fallback trusted for THAT
|
|
profile — never via another profile's saved list."""
|
|
external = tmp_path / "external-carol"
|
|
external.mkdir()
|
|
stale = tmp_path / "stale-workspace"
|
|
fallback_dir = tmp_path / "fallback"
|
|
fallback_dir.mkdir()
|
|
|
|
ws_file = workspace._workspaces_file_for_profile("carol")
|
|
ws_file.parent.mkdir(parents=True, exist_ok=True)
|
|
ws_file.write_text(
|
|
json.dumps([{"path": str(external)}, {"path": str(fallback_dir)}]),
|
|
encoding="utf-8",
|
|
)
|
|
|
|
resolved, recovered = workspace.resolve_implicit_workspace_with_recovery(
|
|
str(stale),
|
|
lambda: str(fallback_dir),
|
|
profile="carol",
|
|
)
|
|
assert recovered is True
|
|
assert resolved == fallback_dir.resolve()
|
|
|
|
# Under a DIFFERENT profile neither the stale candidate nor the recovery
|
|
# fallback may gain trust via carol's saved list.
|
|
with pytest.raises(ValueError):
|
|
workspace.resolve_implicit_workspace_with_recovery(
|
|
str(stale),
|
|
lambda: str(fallback_dir),
|
|
profile="not-carol",
|
|
)
|
|
|
|
|
|
|
|
def test_clean_workspace_list_explicit_profile_keeps_own_entries(monkeypatch, tmp_path):
|
|
"""_clean_workspace_list must define 'own profile dir' by the explicit profile.
|
|
|
|
Maintainer re-gate 2026-08-25 (CORE / data-loss): with an explicit
|
|
profile="alice", own_profile_dir was still derived from the AMBIENT home.
|
|
Loading Alice's saved list while ambient Bob was active dropped Alice's own
|
|
workspace (it sat under Alice's home, not Bob's) and load_workspaces()
|
|
persisted the emptied list back to disk — silent destruction of a
|
|
profile's saved workspaces.
|
|
|
|
Regression: Alice request / Bob ambient — Alice's own entry survives and
|
|
is persisted intact; a genuinely foreign profile path is still removed.
|
|
"""
|
|
from api import profiles
|
|
|
|
# _clean_workspace_list derives the profiles root as _home_path()/'.hermes'/profiles.
|
|
monkeypatch.setattr(workspace, "_home_path", lambda: tmp_path)
|
|
monkeypatch.setattr(profiles, "_DEFAULT_HERMES_HOME", tmp_path / ".hermes")
|
|
monkeypatch.setattr(profiles, "_resolve_base_hermes_home", lambda: tmp_path / ".hermes")
|
|
(tmp_path / ".hermes" / "profiles").mkdir(parents=True)
|
|
|
|
alice_home = tmp_path / ".hermes" / "profiles" / "alice"
|
|
alice_home.mkdir(parents=True)
|
|
bob_home = tmp_path / ".hermes" / "profiles" / "bob"
|
|
bob_home.mkdir(parents=True)
|
|
|
|
# Alice owns a workspace that lives inside her OWN profile directory.
|
|
alice_own = alice_home / "projects"
|
|
alice_own.mkdir(parents=True)
|
|
# A foreign entry pointing into BOB's profile dir must still be pruned.
|
|
foreign = bob_home / "secret"
|
|
foreign.mkdir(parents=True)
|
|
|
|
raw = [
|
|
{"path": str(alice_own), "name": "AliceProjects"},
|
|
{"path": str(foreign), "name": "BobLeak"},
|
|
]
|
|
|
|
cleaned = workspace._clean_workspace_list(raw, profile="alice")
|
|
|
|
paths = [w["path"] for w in cleaned]
|
|
assert str(alice_own) in paths, (
|
|
"explicit-profile cleaning must keep the target profile's OWN entry"
|
|
)
|
|
assert not any("bob" in p for p in paths), "cross-profile leak must still be pruned"
|
|
|
|
# End-to-end through the loader: with ambient Bob active, loading ALICE's
|
|
# list must neither drop nor rewrite-away her own entry.
|
|
monkeypatch.setattr(
|
|
profiles, "get_active_profile_name", lambda: "bob", raising=False
|
|
)
|
|
ws_file = tmp_path / "state" / "workspaces.json"
|
|
monkeypatch.setattr(workspace, "_workspaces_file_for_profile", lambda p=None: ws_file)
|
|
ws_file.parent.mkdir(parents=True, exist_ok=True)
|
|
ws_file.write_text(json.dumps(raw), encoding="utf-8")
|
|
|
|
loaded = workspace.load_workspaces(profile="alice")
|
|
loaded_paths = [w["path"] for w in loaded]
|
|
assert str(alice_own) in loaded_paths
|
|
on_disk = json.loads(ws_file.read_text(encoding="utf-8"))
|
|
assert any(w["path"] == str(alice_own) for w in on_disk), (
|
|
"persisted list must retain Alice's own workspace"
|
|
)
|
|
|
|
|
|
def test_stale_workspace_recovery_scoped_to_explicit_profile(monkeypatch, tmp_path):
|
|
"""Recovery classification/probe/fallback must honor the explicit profile.
|
|
|
|
Maintainer re-gate 2026-08-25 (CORE): resolve_implicit_workspace_with_recovery
|
|
classified the backend via ambient get_config(), probed candidate paths
|
|
without profile=, and fell back to an unbound getter. With profile="alice"
|
|
under ambient Bob it returned BOB's last workspace as recovered=True, and an
|
|
Alice remote backend without terminal.cwd was misclassified as local.
|
|
|
|
Regression A (remote misclassification): alice is ssh WITHOUT cwd, ambient
|
|
is local — recovery must fail closed preserving the original error.
|
|
Regression B (cross-profile bind): alice local, stored path missing,
|
|
fallback=get_last_workspace — must never return Bob's path nor claim
|
|
recovered=True for it.
|
|
"""
|
|
from api import profiles
|
|
|
|
monkeypatch.setattr(workspace, "_home_path", lambda: tmp_path)
|
|
monkeypatch.setattr(profiles, "_DEFAULT_HERMES_HOME", tmp_path / ".hermes")
|
|
monkeypatch.setattr(profiles, "_resolve_base_hermes_home", lambda: tmp_path / ".hermes")
|
|
(tmp_path / ".hermes" / "profiles").mkdir(parents=True)
|
|
|
|
alice_home = tmp_path / ".hermes" / "profiles" / "alice"
|
|
alice_home.mkdir(parents=True)
|
|
bob_home = tmp_path / ".hermes" / "profiles" / "bob"
|
|
bob_home.mkdir(parents=True)
|
|
|
|
def _ambient_cfg():
|
|
# Ambient context belongs to Bob: LOCAL backend.
|
|
return {"terminal": {"backend": "local"}}
|
|
|
|
monkeypatch.setattr(api_config, "get_config", _ambient_cfg)
|
|
|
|
# ── A: remote backend without terminal.cwd fails closed ──
|
|
(alice_home / "config.yaml").write_text(
|
|
"terminal:\n backend: ssh\n", encoding="utf-8"
|
|
)
|
|
missing_remote = tmp_path / "gone" / "remote-ws"
|
|
|
|
with pytest.raises(ValueError):
|
|
workspace.resolve_implicit_workspace_with_recovery(
|
|
str(missing_remote),
|
|
None,
|
|
profile="alice",
|
|
)
|
|
|
|
# ── B: missing-path fallback can never bind another profile's workspace ──
|
|
(alice_home / "config.yaml").write_text(
|
|
"terminal:\n backend: local\n", encoding="utf-8"
|
|
)
|
|
stored_missing = tmp_path / "data" / "vanished"
|
|
bob_ws = tmp_path / "srv" / "bobs-place"
|
|
bob_ws.mkdir(parents=True)
|
|
alice_ws = tmp_path / "srv" / "alice-own"
|
|
alice_ws.mkdir(parents=True)
|
|
|
|
# Alice's SAVED list contains her own external workspace (so it is trusted),
|
|
# while Bob's list contains his. The saved-workspace trust branch is itself
|
|
# profile-scoped (earlier fix), so each name resolves only its own list.
|
|
alice_list = tmp_path / "state-alice" / "workspaces.json"
|
|
bob_list = tmp_path / "state-bob" / "workspaces.json"
|
|
alice_list.parent.mkdir(parents=True, exist_ok=True)
|
|
bob_list.parent.mkdir(parents=True, exist_ok=True)
|
|
alice_list.write_text(json.dumps([{"path": str(alice_ws), "name": "AliceOwn"}]), encoding="utf-8")
|
|
bob_list.write_text(json.dumps([{"path": str(bob_ws), "name": "BobWs"}]), encoding="utf-8")
|
|
|
|
def _ws_file_for(p=None):
|
|
return alice_list if p is not None and str(p) == "alice" else bob_list
|
|
|
|
monkeypatch.setattr(workspace, "_workspaces_file_for_profile", _ws_file_for)
|
|
|
|
def _last_for(p=None):
|
|
if p is not None:
|
|
# Profile-aware getter: only ever returns THAT profile's state.
|
|
if str(p) in ("alice",):
|
|
return str(alice_ws)
|
|
return str(bob_ws)
|
|
return str(bob_ws) # unscoped/ambient getter leaks Bob's path
|
|
|
|
resolved, recovered = workspace.resolve_implicit_workspace_with_recovery(
|
|
str(stored_missing),
|
|
_last_for,
|
|
profile="alice",
|
|
)
|
|
assert recovered is True
|
|
assert resolved == alice_ws.resolve(), (
|
|
"recovery under profile='alice' must bind Alice's own workspace"
|
|
)
|
|
assert "bobs-place" not in str(resolved), (
|
|
"recovery under profile='alice' must never return Bob's workspace"
|
|
)
|
|
|
|
def test_get_last_workspace_named_profile_never_reads_global_file(monkeypatch, tmp_path):
|
|
"""get_last_workspace(profile=...) must not fall back to the global file.
|
|
|
|
Maintainer re-gate round 3 (CORE): for a named profile the getter still
|
|
consulted _GLOBAL_LW_FILE after missing the profile-local file, so a direct
|
|
probe returned Bob's globally-recorded workspace for profile="alice".
|
|
The legacy global fallback is now allowed ONLY for the root/default
|
|
profile. Uses the REAL getter with a real global-file fixture.
|
|
"""
|
|
from api import profiles
|
|
|
|
monkeypatch.setattr(workspace, "_home_path", lambda: tmp_path)
|
|
monkeypatch.setattr(profiles, "_DEFAULT_HERMES_HOME", tmp_path / ".hermes")
|
|
monkeypatch.setattr(profiles, "_resolve_base_hermes_home", lambda: tmp_path / ".hermes")
|
|
(tmp_path / ".hermes" / "profiles").mkdir(parents=True)
|
|
(tmp_path / ".hermes" / "profiles" / "alice").mkdir(parents=True)
|
|
|
|
bobs_dir = tmp_path / "srv" / "bobs-global"
|
|
bobs_dir.mkdir(parents=True)
|
|
|
|
# The legacy GLOBAL last-workspace file records BOB's workspace.
|
|
global_lw = tmp_path / "global-state"
|
|
global_lw.mkdir(parents=True)
|
|
(global_lw / "last_workspace.txt").write_text(str(bobs_dir), encoding="utf-8")
|
|
monkeypatch.setattr(workspace, "_GLOBAL_LW_FILE", global_lw / "last_workspace.txt")
|
|
|
|
# Alice has NO profile-local last-workspace file at all.
|
|
alice_state = tmp_path / ".hermes" / "profiles" / "alice" / "webui_state"
|
|
|
|
def _lw_file_for(p=None):
|
|
if p is not None and str(p) == "alice":
|
|
return alice_state / "last_workspace.txt"
|
|
return global_lw / "last_workspace.txt"
|
|
|
|
monkeypatch.setattr(workspace, "_last_workspace_file_for_profile", _lw_file_for)
|
|
|
|
# Direct probe: named profile must NOT inherit Bob's global binding.
|
|
got = workspace.get_last_workspace(profile="alice")
|
|
assert "bobs-global" not in str(got), (
|
|
"named profile must never fall back to the global last-workspace file"
|
|
)
|
|
|
|
# Control: the root/default profile KEEPS the historical global fallback.
|
|
monkeypatch.setattr(
|
|
profiles,
|
|
"_resolve_profile_home_param",
|
|
lambda p: tmp_path / ".hermes" if p is None or str(p) in ("default",) else _lw_file_for(p).parent.parent.parent,
|
|
raising=False,
|
|
)
|
|
got_default = workspace.get_last_workspace(profile="default")
|
|
assert str(got_default) == str(bobs_dir), (
|
|
"root/default profile retains the global last-workspace fallback"
|
|
)
|
|
|
|
|
|
def test_new_session_binds_explicit_profile_not_ambient_last_workspace(monkeypatch, tmp_path):
|
|
"""new_session()/import_cli_session() must scope their fallback getter.
|
|
|
|
Maintainer re-gate round 3 (CORE): both Session constructions fell back to
|
|
get_last_workspace() WITHOUT the profile even though profile=profile was
|
|
set on the same Session — an Alice session created under ambient Bob bound
|
|
to BOB's workspace. Uses the real getters and real state files.
|
|
"""
|
|
import api.models as models
|
|
from api import profiles
|
|
|
|
monkeypatch.setattr(workspace, "_home_path", lambda: tmp_path)
|
|
monkeypatch.setattr(profiles, "_DEFAULT_HERMES_HOME", tmp_path / ".hermes")
|
|
monkeypatch.setattr(profiles, "_resolve_base_hermes_home", lambda: tmp_path / ".hermes")
|
|
(tmp_path / ".hermes" / "profiles").mkdir(parents=True)
|
|
(tmp_path / ".hermes" / "profiles" / "alice").mkdir(parents=True)
|
|
|
|
bobs_ws = tmp_path / "srv" / "bobs-workspace"
|
|
bobs_ws.mkdir(parents=True)
|
|
alice_ws = tmp_path / "srv" / "alice-workspace"
|
|
alice_ws.mkdir(parents=True)
|
|
|
|
# Ambient/global last-workspace points at BOB's directory.
|
|
global_lw = tmp_path / "global-state"
|
|
global_lw.mkdir(parents=True)
|
|
(global_lw / "last_workspace.txt").write_text(str(bobs_ws), encoding="utf-8")
|
|
monkeypatch.setattr(workspace, "_GLOBAL_LW_FILE", global_lw / "last_workspace.txt")
|
|
|
|
# Alice's OWN profile-local last-workspace points at her own directory.
|
|
alice_state = tmp_path / ".hermes" / "profiles" / "alice" / "webui_state"
|
|
alice_state.mkdir(parents=True)
|
|
(alice_state / "last_workspace.txt").write_text(str(alice_ws), encoding="utf-8")
|
|
|
|
def _lw_file_for(p=None):
|
|
if p is not None and str(p) == "alice":
|
|
return alice_state / "last_workspace.txt"
|
|
return global_lw / "last_workspace.txt"
|
|
|
|
monkeypatch.setattr(workspace, "_last_workspace_file_for_profile", _lw_file_for)
|
|
monkeypatch.setattr(models, "get_last_workspace", workspace.get_last_workspace)
|
|
|
|
s = models.new_session(profile="alice")
|
|
assert str(s.workspace) == str(alice_ws), (
|
|
"new_session under profile='alice' must bind ALICE's last workspace, "
|
|
f"got {s.workspace!r}"
|
|
)
|
|
|
|
imported = models.import_cli_session(
|
|
session_id="cli-import-alice-1",
|
|
title="t",
|
|
messages=[],
|
|
profile="alice",
|
|
)
|
|
assert str(imported.workspace) == str(alice_ws), (
|
|
"import_cli_session under profile='alice' must bind ALICE's last "
|
|
f"workspace, got {imported.workspace!r}"
|
|
)
|
|
|
|
|
|
# ── Re-gate round 4 (#7168): malformed names, aliases, unwired boundaries ────
|
|
|
|
|
|
class TestRound4ProfileIsolation:
|
|
"""Re-gate round 4: the four remaining profile-isolation instances."""
|
|
|
|
def test_invalid_profile_name_never_reads_default_state(self, monkeypatch, tmp_path):
|
|
"""A malformed name must NOT be clamped onto the default home.
|
|
|
|
Old behavior: _resolve_profile_home_param('bad name') returned
|
|
_DEFAULT_HERMES_HOME, so get_last_workspace(profile='bad name') read
|
|
(and could fall back to) the DEFAULT profile's global state file.
|
|
"""
|
|
import api.models as models # noqa: F401 (import parity with R3 tests)
|
|
from api import profiles
|
|
|
|
default_home = tmp_path / ".hermes"
|
|
default_home.mkdir(parents=True)
|
|
monkeypatch.setattr(profiles, "_DEFAULT_HERMES_HOME", default_home)
|
|
monkeypatch.setattr(profiles, "_resolve_base_hermes_home", lambda: default_home)
|
|
|
|
global_lw = tmp_path / "global-state"
|
|
global_lw.mkdir(parents=True)
|
|
poisoned = tmp_path / "poisoned-workspace"
|
|
poisoned.mkdir()
|
|
(global_lw / "last_workspace.txt").write_text(str(poisoned), encoding="utf-8")
|
|
monkeypatch.setattr(workspace, "_GLOBAL_LW_FILE", global_lw / "last_workspace.txt")
|
|
|
|
# The invalid name resolves to NOTHING state-like and raises on resolve.
|
|
with pytest.raises(ValueError):
|
|
workspace._resolve_profile_home_param("bad name")
|
|
|
|
# Getter: never returns the poisoned default/global binding.
|
|
got = workspace.get_last_workspace(profile="bad name")
|
|
assert str(got) != str(poisoned)
|
|
|
|
# Setter: writes no file anywhere under the default home.
|
|
workspace.set_last_workspace(str(poisoned), profile="bad name")
|
|
assert not (default_home / "webui_state").exists()
|
|
|
|
# save_workspaces refuses outright.
|
|
with pytest.raises(ValueError):
|
|
workspace.save_workspaces([{"path": str(poisoned)}], profile="bad name")
|
|
|
|
def test_symlink_alias_of_default_home_keeps_legacy_fallback(self, monkeypatch, tmp_path):
|
|
"""A symlink alias of _DEFAULT_HERMES_HOME is canonically the DEFAULT.
|
|
|
|
Old behavior compared lexically: alias != _DEFAULT_HERMES_HOME, so the
|
|
default profile accessed through its alias wrongly LOST the legacy
|
|
global fallback. With canonical identity it keeps it.
|
|
"""
|
|
from api import profiles
|
|
|
|
real_home = tmp_path / "real-hermes"
|
|
real_home.mkdir(parents=True)
|
|
alias = tmp_path / "alias-hermes"
|
|
try:
|
|
alias.symlink_to(real_home, target_is_directory=True)
|
|
except OSError:
|
|
pytest.skip("symlinks unavailable in this environment")
|
|
|
|
monkeypatch.setattr(profiles, "_DEFAULT_HERMES_HOME", real_home)
|
|
monkeypatch.setattr(profiles, "_resolve_base_hermes_home", lambda: real_home)
|
|
|
|
shared_ws = tmp_path / "shared-workspace"
|
|
shared_ws.mkdir()
|
|
# The default profile's state dir IS the global STATE_DIR — pin both
|
|
# the legacy global fallback file and the profile-scoped file path so
|
|
# no real ~/.hermes state leaks into the assertion.
|
|
global_state = tmp_path / "global-state"
|
|
global_state.mkdir(parents=True)
|
|
(global_state / "last_workspace.txt").write_text(str(shared_ws), encoding="utf-8")
|
|
monkeypatch.setattr(workspace, "_GLOBAL_LW_FILE", global_state / "last_workspace.txt")
|
|
monkeypatch.setattr(
|
|
workspace,
|
|
"_GLOBAL_WS_FILE",
|
|
global_state / "workspaces.json",
|
|
)
|
|
monkeypatch.setattr(workspace, "_STATE_DIR_OVERRIDE", str(global_state), raising=False)
|
|
monkeypatch.setattr(
|
|
workspace,
|
|
"_last_workspace_file_for_profile",
|
|
lambda p=None: (
|
|
global_state / "last_workspace.txt"
|
|
if p is None or workspace._is_default_profile_home(
|
|
workspace._resolve_profile_home_param(p)
|
|
)
|
|
else tmp_path / "other" / "webui_state" / "last_workspace.txt"
|
|
),
|
|
raising=False,
|
|
)
|
|
|
|
assert workspace._is_default_profile_home(alias), (
|
|
"symlink alias must compare canonically equal to the default home"
|
|
)
|
|
|
|
# No profile-local last_workspace.txt exists → legacy global fallback applies.
|
|
# Explicit home is expressed as a Path value (#7168 re-gate round 5:
|
|
# path-shaped STRINGS are rejected profile ids).
|
|
got = workspace.get_last_workspace(profile=alias)
|
|
assert str(got) == str(shared_ws)
|
|
|
|
def test_set_last_workspace_threads_session_profile(self, monkeypatch, tmp_path):
|
|
"""set_last_workspace call sites write the SESSION's profile state file.
|
|
|
|
Repro of review finding #1: a server-initiated turn for named-profile
|
|
session Alice wrote only the GLOBAL file, so Alice fell back to her
|
|
configured workspace while default incorrectly read Alice's selection.
|
|
"""
|
|
alice_state = tmp_path / "profiles" / "alice" / "webui_state"
|
|
alice_state.mkdir(parents=True)
|
|
|
|
lw_paths = {}
|
|
real_set = workspace.set_last_workspace
|
|
|
|
def spy(path, profile=None):
|
|
lw = workspace._last_workspace_file_for_profile(profile)
|
|
lw_paths["profile"] = profile
|
|
lw_paths["file"] = str(lw)
|
|
return real_set(path, profile=profile)
|
|
|
|
# Pin the resolver so 'alice' maps into the fixture tree (the product
|
|
# code path under test is the routes.py call shape, not profiles lookup).
|
|
monkeypatch.setattr(
|
|
workspace,
|
|
"_resolve_profile_home_param",
|
|
lambda p: tmp_path / "profiles" / (p or "default"),
|
|
raising=False,
|
|
)
|
|
|
|
# Simulate exactly what the three routes.py sites now do:
|
|
s_like = type("S", (), {"profile": "alice"})()
|
|
spy("/srv/alice-ws", profile=getattr(s_like, "profile", None))
|
|
|
|
assert lw_paths["profile"] == "alice"
|
|
assert pathlib.PurePath(lw_paths["file"]).name == "last_workspace.txt"
|
|
assert "alice" in lw_paths["file"], (
|
|
f"session-profile write must land in ALICE's webui_state, got {lw_paths['file']!r}"
|
|
)
|
|
assert not (tmp_path / "global").exists()
|
|
|
|
def test_cli_projection_uses_own_cli_profile(self, monkeypatch, tmp_path):
|
|
"""The all-profile CLI sidebar projection scopes its workspace probe.
|
|
|
|
Review finding #3: _load_cli_sessions_uncached had _cli_profile in
|
|
scope but called get_last_workspace() ambiently, producing
|
|
profile='alice', workspace='<default's workspace>'.
|
|
"""
|
|
import api.models as models
|
|
|
|
calls = []
|
|
|
|
def fake_getlw(profile=None):
|
|
calls.append(profile)
|
|
return f"workspace-for:{profile}"
|
|
|
|
monkeypatch.setattr(models, "get_last_workspace", fake_getlw)
|
|
monkeypatch.setattr(models, "get_claude_code_sessions", lambda: [])
|
|
monkeypatch.setattr(models, "read_importable_agent_session_rows", lambda *a, **k: [
|
|
{
|
|
"id": "tui-row-alice",
|
|
"title": "TUI Session",
|
|
"model": "test-model",
|
|
"source": "tui",
|
|
"raw_source": "tui",
|
|
"message_count": 1,
|
|
"actual_message_count": 1,
|
|
"actual_user_message_count": 1,
|
|
"last_activity": 10.0,
|
|
"started_at": 9.0,
|
|
}
|
|
])
|
|
monkeypatch.setattr(models, "_profile_has_user_projects", lambda: False)
|
|
monkeypatch.setattr(models, "ensure_cron_project", lambda **_: None)
|
|
monkeypatch.setattr(models.Session, "load_metadata_only", lambda _sid: None)
|
|
|
|
db = tmp_path / "state.db"
|
|
db.write_text("", encoding="utf-8")
|
|
rows = models._load_cli_sessions_uncached(
|
|
tmp_path, db, _cli_profile="alice"
|
|
)
|
|
assert any(r.get("session_id") == "tui-row-alice" for r in rows), rows
|
|
assert calls and calls[0] == "alice", (
|
|
f"_cli_workspace() must consult get_last_workspace(profile=_cli_profile); "
|
|
f"profiles seen: {calls}"
|
|
)
|
|
alice_rows = [r for r in rows if r.get("workspace") == "workspace-for:alice"]
|
|
assert alice_rows, (
|
|
f"projected row must carry the ALICE-scoped workspace; got "
|
|
f"{[r.get('workspace') for r in rows]}"
|
|
)
|
|
|
|
|
|
# ── Re-gate round 5 (#7168): traversal gate + symlinked config authority ─────
|
|
|
|
|
|
class TestRound5TraversalAndSymlinkAuthority:
|
|
"""Round 5: path-shaped profile STRINGS are rejected ids; config authority
|
|
survives a symlinked HERMES_HOME."""
|
|
|
|
def test_path_shaped_profile_string_rejected_no_traversal_write(
|
|
self, monkeypatch, tmp_path
|
|
):
|
|
"""'../evil' as a STRING profile must be rejected by the id grammar.
|
|
|
|
Repro of review finding #1 (CORE / security): the old resolver treated
|
|
any string containing '/' or '\\' as an explicit home and resolved it
|
|
directly BEFORE the grammar check, so a malformed profile value like
|
|
``../evil`` bypassed validation entirely and could read AND overwrite
|
|
an arbitrary ``webui_state/last_workspace.txt`` outside the profile
|
|
boundary. Real getters + real state files throughout.
|
|
"""
|
|
from api import profiles
|
|
|
|
default_home = tmp_path / ".hermes"
|
|
default_home.mkdir(parents=True)
|
|
monkeypatch.setattr(profiles, "_DEFAULT_HERMES_HOME", default_home)
|
|
monkeypatch.setattr(profiles, "_resolve_base_hermes_home", lambda: default_home)
|
|
|
|
# The file the traversal WOULD reach if it escaped the boundary.
|
|
evil_dir = tmp_path / "evil"
|
|
evil_state = evil_dir / "webui_state"
|
|
evil_state.mkdir(parents=True)
|
|
victim = evil_state / "last_workspace.txt"
|
|
victim.write_text("/original-victim-binding", encoding="utf-8")
|
|
|
|
traversal = "../evil"
|
|
|
|
# Grammar gate: a path-shaped STRING is not a valid logical id.
|
|
with pytest.raises(ValueError):
|
|
workspace._resolve_profile_home_param(traversal)
|
|
|
|
# Getter: reads NOTHING from the traversal target.
|
|
got = workspace.get_last_workspace(profile=traversal)
|
|
assert got != "/original-victim-binding"
|
|
|
|
# Setter: writes NO file anywhere along the traversal.
|
|
workspace.set_last_workspace("/attacker-chosen", profile=traversal)
|
|
assert victim.read_text(encoding="utf-8") == "/original-victim-binding"
|
|
assert sorted(p.name for p in evil_state.iterdir()) == ["last_workspace.txt"], (
|
|
"traversal profile must not create or modify any state file"
|
|
)
|
|
|
|
# Saved-list writer refuses outright too.
|
|
with pytest.raises(ValueError):
|
|
workspace.save_workspaces([{"path": str(evil_dir)}], profile=traversal)
|
|
|
|
# Same location delivered as a REAL Path is still honored — explicit
|
|
# homes move to Path values; they are canonicalized, not banned.
|
|
assert workspace._resolve_profile_home_param(Path(traversal)) == Path(
|
|
traversal
|
|
).expanduser().resolve()
|
|
|
|
def test_symlinked_home_with_authoritative_config_path_keeps_authority(
|
|
self, monkeypatch, tmp_path
|
|
):
|
|
"""HERMES_HOME via symlink + authoritative HERMES_CONFIG_PATH.
|
|
|
|
Repro of review finding #2 (CORE): workspace canonicalization hands
|
|
get_config_for_profile_home the RESOLVED alias target, but the config
|
|
authority compared the active home and the config parent LEXICALLY.
|
|
With HERMES_HOME reached through a symlink alias, both identity checks
|
|
failed and the function performed a DIRECT read of the symlink
|
|
target's own (wrong) config.yaml instead of deferring to the
|
|
authoritative HERMES_CONFIG_PATH — master trusts the remote
|
|
terminal.cwd from the override; the lexical head rejected it.
|
|
Canonicalize all three sides before comparing.
|
|
"""
|
|
import os
|
|
|
|
import yaml
|
|
|
|
from api import profiles
|
|
|
|
real_home = tmp_path / "real-hermes"
|
|
real_home.mkdir(parents=True)
|
|
alias_home = tmp_path / "alias-hermes"
|
|
try:
|
|
alias_home.symlink_to(real_home, target_is_directory=True)
|
|
except OSError:
|
|
pytest.skip("symlinks unavailable in this environment")
|
|
|
|
# The symlink target's OWN config is the WRONG one a naive direct
|
|
# read picks up (no remote cwd — exactly what "rejects the remote
|
|
# path" looks like downstream).
|
|
(real_home / "config.yaml").write_text(
|
|
yaml.safe_dump(
|
|
{"terminal": {"backend": "local", "cwd": "/srv/from-symlink-target"}},
|
|
sort_keys=False,
|
|
),
|
|
encoding="utf-8",
|
|
)
|
|
# The AUTHORITATIVE config lives OUTSIDE the home, behind
|
|
# HERMES_CONFIG_PATH (maintainer-blocker-1 semantics).
|
|
override_dir = tmp_path / "override-dir"
|
|
override_dir.mkdir()
|
|
override_cfg = override_dir / "config.yaml"
|
|
override_cfg.write_text(
|
|
yaml.safe_dump(
|
|
{"terminal": {"backend": "ssh", "cwd": "/srv/from-override"}},
|
|
sort_keys=False,
|
|
),
|
|
encoding="utf-8",
|
|
)
|
|
|
|
# Ambient resolver reports the home under its ALIAS spelling (as an
|
|
# env-provided HERMES_HOME would); callers pass the canonicalized
|
|
# target — the exact divergence the lexical comparison mishandled.
|
|
monkeypatch.setattr(profiles, "get_active_hermes_home", lambda: alias_home)
|
|
monkeypatch.setenv("HERMES_CONFIG_PATH", str(override_cfg))
|
|
api_config.reload_config()
|
|
|
|
got = api_config.get_config_for_profile_home(real_home)
|
|
assert got.get("terminal", {}).get("cwd") == "/srv/from-override", (
|
|
"canonicalized alias target must preserve HERMES_CONFIG_PATH "
|
|
f"authority; got {got.get('terminal')!r}"
|
|
)
|
|
assert got.get("terminal", {}).get("backend") == "ssh"
|
|
|
|
# The un-canonicalized alias spelling converges to the SAME answer —
|
|
# identity is by resolution, never by lexical spelling.
|
|
got_alias = api_config.get_config_for_profile_home(alias_home)
|
|
assert got_alias.get("terminal", {}).get("cwd") == "/srv/from-override"
|
|
|
|
# Sanity: the fixture genuinely exercises alias-vs-resolved-target
|
|
# comparison rather than passing trivially.
|
|
assert os.path.realpath(alias_home) == str(real_home)
|
|
assert os.path.realpath(real_home) != str(alias_home)
|
|
# NOTE: no manual delenv/reload here (see
|
|
# test_config_authority_active_home_with_external_override) —
|
|
# monkeypatch teardown + stale-path check invalidate the cache.
|