dsh 0.2.0-rc.2: in-container update (experimental channel), path-agnostic compose, upstream patches adapted to 0.1.x/0.2.x

upstream/container/platform/test/seed.test.mjs

@@ -0,0 +1,156 @@
+import assert from 'node:assert/strict'
+import { execFile, spawnSync } from 'node:child_process'
+import { lstat, mkdtemp, mkdir, readFile, readlink, symlink, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+import { promisify } from 'node:util'
+import test from 'node:test'
+import { provisionPlatformSeed } from '../stage0/lib/seed.mjs'
+import { TrustLedger } from '../stage0/lib/ledger.mjs'
+import { verifyRuntimePatches } from '../../control-plane/modules/patch-manager/index.mjs'
+import { writeDshEntrypointFixture } from './fixtures/dsh-package.mjs'
+
+const execute = promisify(execFile)
+
+test('checked-in development seed is Recovery-signed and contains no private key', async () => {
+  const trust = new URL('../seed/trust/', import.meta.url)
+  const publicKey = (await readFile(new URL('recovery-root.spki.base64', trust), 'utf8')).trim()
+  const keyring = await readFile(new URL('keyring.json', trust))
+  const signature = JSON.parse(await readFile(new URL('keyring.sig.json', trust), 'utf8'))
+  const root = await mkdtemp(join(tmpdir(), 'dsh-seed-trust-'))
+  const accepted = await new TrustLedger(root, publicKey).acceptKeyring(keyring, signature)
+  assert.equal(accepted.generation, 1)
+  for (const name of ['recovery-root.spki.base64', 'keyring.json', 'keyring.sig.json', 'DEVELOPMENT_FIXTURE']) {
+    assert.doesNotMatch(await readFile(new URL(name, trust), 'utf8'), /PRIVATE KEY/)
+  }
+})
+
+test('registers immutable image seed trees once and preserves later current links', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'dsh-platform-seed-'))
+  const seed = join(root, 'seed')
+  const data = join(root, 'data')
+  for (const [group, version] of [['environment', 'env-one'], ['runtime', 'runtime-one']]) {
+    await mkdir(join(seed, group, version), { recursive: true })
+    await writeFile(join(seed, group, 'VERSION'), `${version}\n`)
+  }
+  await mkdir(join(seed, 'pristine', 'runtime-one', 'node_modules/.bin'), { recursive: true })
+  await symlink('../package/bin.js', join(seed, 'pristine', 'runtime-one', 'node_modules/.bin/tool'))
+  await mkdir(join(seed, 'system-plugins', 'env-one'), { recursive: true })
+  const first = await provisionPlatformSeed(seed, data)
+  assert.equal(first.seededLinks.length, 4)
+  for (const [entry, source] of [
+    ['store/environments/versions/env-one', 'environment/env-one'],
+    ['store/runtimes/versions/runtime-one', 'runtime/runtime-one'],
+    ['store/pristine/runtime-one', 'pristine/runtime-one'],
+    ['store/system-plugins/versions/env-one', 'system-plugins/env-one'],
+  ]) {
+    assert.equal((await lstat(join(data, entry))).isSymbolicLink(), true)
+    assert.equal(await readlink(join(data, entry)), join(seed, source))
+  }
+  assert.equal(await readlink(join(data, 'store/environments', 'current')), 'versions/env-one')
+  assert.equal(await readlink(join(data, 'store/pristine/runtime-one/node_modules/.bin/tool')), '../package/bin.js')
+  assert.equal((await lstat(join(data, 'store/snapshots'))).isDirectory(), true)
+  await writeFile(join(data, 'state/updater', 'sentinel'), 'keep')
+  const repeated = await provisionPlatformSeed(seed, data)
+  assert.deepEqual(repeated.seededLinks, [])
+  assert.equal(await readFile(join(data, 'state/updater', 'sentinel'), 'utf8'), 'keep')
+})
+
+test('preserves an existing materialized version instead of replacing it with an image seed link', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'dsh-platform-materialized-'))
+  const seed = join(root, 'seed')
+  const data = join(root, 'data')
+  for (const [group, version] of [['environment', 'env-one'], ['runtime', 'runtime-one']]) {
+    await mkdir(join(seed, group, version), { recursive: true })
+    await writeFile(join(seed, group, 'VERSION'), `${version}\n`)
+  }
+  await mkdir(join(seed, 'pristine/runtime-one'), { recursive: true })
+  await mkdir(join(seed, 'system-plugins/env-one'), { recursive: true })
+  await mkdir(join(data, 'store/runtimes/versions/runtime-one'), { recursive: true })
+  await writeFile(join(data, 'store/runtimes/versions/runtime-one/sentinel'), 'materialized')
+
+  await provisionPlatformSeed(seed, data)
+
+  assert.equal((await lstat(join(data, 'store/runtimes/versions/runtime-one'))).isDirectory(), true)
+  assert.equal(await readFile(join(data, 'store/runtimes/versions/runtime-one/sentinel'), 'utf8'), 'materialized')
+})
+
+test('repairs broken image entries and current slots after an image replacement', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'dsh-platform-replaced-image-'))
+  const seed = join(root, 'seed')
+  const data = join(root, 'data')
+  for (const [group, version] of [['environment', 'env-one'], ['runtime', 'runtime-one']]) {
+    await mkdir(join(seed, group, version), { recursive: true })
+    await writeFile(join(seed, group, 'VERSION'), `${version}\n`)
+  }
+  await mkdir(join(seed, 'pristine/runtime-one'), { recursive: true })
+  await mkdir(join(seed, 'system-plugins/env-one'), { recursive: true })
+  await mkdir(join(data, 'store/runtimes/versions'), { recursive: true })
+  await symlink('/missing-old-image/runtime-old', join(data, 'store/runtimes/versions/runtime-old'))
+  await symlink('versions/runtime-old', join(data, 'store/runtimes/current'))
+
+  await provisionPlatformSeed(seed, data)
+
+  assert.equal(await readlink(join(data, 'store/runtimes/versions/runtime-one')), join(seed, 'runtime/runtime-one'))
+  assert.equal(await readlink(join(data, 'store/runtimes/current')), 'versions/runtime-one')
+  assert.equal((await lstat(join(data, 'store/runtimes/current'))).isSymbolicLink(), true)
+})
+
+test('rejects seed IDs that could escape their image roots', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'dsh-platform-invalid-seed-'))
+  const seed = join(root, 'seed')
+  await mkdir(join(seed, 'environment'), { recursive: true })
+  await mkdir(join(seed, 'runtime'), { recursive: true })
+  await writeFile(join(seed, 'environment/VERSION'), '../escape\n')
+  await writeFile(join(seed, 'runtime/VERSION'), 'runtime-one\n')
+  await assert.rejects(provisionPlatformSeed(seed, join(root, 'data')), /Environment seed ID is invalid/)
+})
+
+test('builds a self-contained Bootstrap seed and preserves npm bin links', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'dsh-build-seed-'))
+  const installed = join(root, 'installed')
+  const output = join(root, 'output')
+  await writeDshEntrypointFixture(installed)
+  await writeFile(join(installed, 'package.json'), JSON.stringify({ name: '@deepseek-ai/dsh', version: '0.1.0-rc.fixture' }))
+  const picker = join(installed, 'node_modules/@deepseek-ai/dsh-host-directory-picker-browse/lib')
+  const connection = join(installed, 'node_modules/@deepseek-ai/dsh-client-connection/lib')
+  const theme = join(installed, 'node_modules/@deepseek-ai/dsh-client-ui-theme/lib')
+  await mkdir(picker, { recursive: true })
+  await mkdir(connection, { recursive: true })
+  await mkdir(theme, { recursive: true })
+  await writeFile(join(picker, 'index.js'), 'const target = resolve(path ?? home);\n')
+  await writeFile(join(connection, 'client.js'), 'isLoopback: pageLocation === void 0 || isLoopbackHostname(pageLocation.hostname),\n')
+  await writeFile(join(theme, 'client.js'), 'var corner_shape_css_default = "@supports (corner-shape:superellipse(1.5)){:root{--dsw-corner-shape:superellipse(1.5)}*,:before,:after{corner-shape:var(--dsw-corner-shape)}}";\n')
+  await mkdir(join(installed, 'node_modules/.bin'), { recursive: true })
+  await symlink('../tool/bin.js', join(installed, 'node_modules/.bin/tool'))
+
+  await execute(process.execPath, [fileURLToPath(new URL('../tools/build-seed.mjs', import.meta.url)), installed, output])
+  const bootstrapVersion = (await readFile(new URL('../bootstrap/VERSION', import.meta.url), 'utf8')).trim()
+  const bootstrapRoot = join(output, 'bootstrap', bootstrapVersion)
+  const contracts = await import(pathToFileURL(join(bootstrapRoot, 'platform/lib/contracts.mjs')).href)
+  const { parseImageInventory } = await import('../lib/deployment-contracts.mjs')
+  assert.equal(typeof contracts.parseStable, 'function')
+  const inventory = parseImageInventory(await readFile(join(output, 'inventory.json')))
+  assert.equal(inventory.authority, 'development')
+  assert.equal(inventory.targetSequence, 0)
+  assert.equal(inventory.bootstrap.version, bootstrapVersion)
+  assert.equal(inventory.deployment.dshVersion, '0.1.0-rc.fixture')
+  assert.equal((await lstat(join(bootstrapRoot, 'control-plane/services/management/node_modules/ws/index.js'))).isFile(), true)
+  assert.equal((await lstat(join(bootstrapRoot, 'control-plane/services/management/node_modules/@xterm/xterm/css/xterm.css'))).isFile(), true)
+  assert.equal((await lstat(join(bootstrapRoot, 'control-plane/services/outbound-proxy/index.mjs'))).isFile(), true)
+  assert.equal((await lstat(join(bootstrapRoot, 'control-plane/services/access-manager/index.mjs'))).isFile(), true)
+  await assert.rejects(lstat(join(bootstrapRoot, 'control-plane/skills')), { code: 'ENOENT' })
+  const skillArchive = join(
+    output, 'environments', inventory.deployment.environment.id, 'artifacts', 'system-skill-catalog',
+  )
+  const skillListing = spawnSync('tar', ['-tzf', skillArchive], { encoding: 'utf8' })
+  assert.equal(skillListing.status, 0, skillListing.stderr)
+  assert.match(skillListing.stdout, /^skills\/dsh-docker-operations\/SKILL\.md$/m)
+  assert.equal(await readlink(join(output, 'pristine/0.1.0-rc.fixture/node_modules/.bin/tool')), '../tool/bin.js')
+  assert.equal(await readlink(join(output, 'runtime/0.1.0-rc.fixture/package/node_modules/.bin/tool')), '../tool/bin.js')
+  assert.deepEqual(await verifyRuntimePatches({
+    runtimeRoot: join(output, 'runtimes', inventory.deployment.runtime.id),
+    environmentRoot: join(output, 'environments', inventory.deployment.environment.id),
+  }), ['directory-picker', 'browser-loopback', 'managed-lifecycle', 'native-corners'])
+})