mirror of
https://github.com/tiennm99/goclaw.git
synced 2026-10-12 22:14:37 +00:00
Duc Nguyenandntduc
bb7712a9ff
* feat(collaboration): isolate delegated artifacts and child runs Isolate delegated inputs and outputs behind secure artifact exchange lifecycles. Scope Agent Link tasks by tenant and root agent, and enforce delegation spawn-tree boundaries. Add process-wide child-run admission and preserve logical media paths across native, MCP, and sandbox execution. * fix(collaboration): harden delegated task isolation Enforce tenant and root-agent task scope across migrations and stores. Add exactly-once async completion delivery, delegated sandbox boundaries, and confined artifact and media recovery across runtime surfaces. * fix(collaboration): recover interrupted async tasks * fix(collaboration): normalize persisted child-run status --------- Co-authored-by: ntduc <ntduc@cpp.ai.vn>
68 lines
1.8 KiB
Go
68 lines
1.8 KiB
Go
package sandbox
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestDockerCacheKeyIncludesWorkspaceAndConfig(t *testing.T) {
|
|
cfg := DefaultConfig()
|
|
key := "agent:default:session"
|
|
|
|
first := dockerCacheKey(key, "/srv/goclaw/workspace/tenant-a", cfg)
|
|
second := dockerCacheKey(key, "/srv/goclaw/workspace/tenant-b", cfg)
|
|
if first == second {
|
|
t.Fatalf("dockerCacheKey reused key for different workspaces: %q", first)
|
|
}
|
|
|
|
ro := cfg
|
|
ro.WorkspaceAccess = AccessRO
|
|
third := dockerCacheKey(key, "/srv/goclaw/workspace/tenant-a", ro)
|
|
if first == third {
|
|
t.Fatalf("dockerCacheKey reused key for different workspace access: %q", first)
|
|
}
|
|
}
|
|
|
|
func TestDockerCacheKeyPreservesEmptyWorkspaceCompatibility(t *testing.T) {
|
|
cfg := DefaultConfig()
|
|
key := "agent:default:session"
|
|
|
|
if got := dockerCacheKey(key, "", cfg); got != key {
|
|
t.Fatalf("dockerCacheKey empty workspace = %q, want original key %q", got, key)
|
|
}
|
|
}
|
|
|
|
func TestDockerCacheKeyDoesNotExposeMountRoots(t *testing.T) {
|
|
cfg := DefaultConfig()
|
|
hostRoot := "/sensitive/runtime/delegation/inputs"
|
|
got := dockerCacheKey(
|
|
"delegation:9db9",
|
|
"/sensitive/runtime/delegation/outputs",
|
|
cfg,
|
|
ReadOnlyMount{
|
|
Name: "inputs",
|
|
HostPath: hostRoot,
|
|
Destination: "/workspace/inputs",
|
|
},
|
|
)
|
|
|
|
if strings.Contains(got, "/sensitive/") || strings.Contains(got, hostRoot) {
|
|
t.Fatalf("dockerCacheKey exposed mount root: %q", got)
|
|
}
|
|
}
|
|
|
|
func TestDockerCacheKeyIncludesDelegationIdentity(t *testing.T) {
|
|
cfg := DefaultConfig()
|
|
mount := ReadOnlyMount{
|
|
Name: "inputs",
|
|
HostPath: "/runtime/inputs",
|
|
Destination: "/workspace/inputs",
|
|
}
|
|
|
|
first := dockerCacheKey("delegation:first", "/runtime/outputs", cfg, mount)
|
|
second := dockerCacheKey("delegation:second", "/runtime/outputs", cfg, mount)
|
|
if first == second {
|
|
t.Fatalf("dockerCacheKey reused identity across delegation keys: %q", first)
|
|
}
|
|
}
|