deepseek-harness/packages/code-runtime/code-runtime-node/tests/runtime.spec.ts

import { mkdtemp, mkdir, readFile, rm, symlink } from 'node:fs/promises'
import { homedir } from 'node:os'
import { createServer, type Socket } from 'node:net'
import { join } from 'node:path'
import { Context } from '@deepseek-ai/cordis'
import { describe, expect, it, onTestFinished } from 'vitest'
import type { CodeBindingFunction, CodeBindingNamespace, CodeRunRequest } from '@deepseek-ai/dsh-code-runtime'
import type { Config } from '../src/index.ts'
import { mountRuntime } from './setup.ts'

async function setup(config: Config = {}, mode: 'read-only' | 'workspace-write' | 'danger-full-access' = 'danger-full-access') {
  const root = await mkdtemp(join(homedir(), '.dsh-node-runtime-test-'))
  const cwd = join(root, 'workspace')
  await mkdir(cwd)
  const ctx = new Context()
  onTestFinished(async () => { await ctx.fiber.dispose(); await rm(root, { recursive: true, force: true }) })
  const runtime = await mountRuntime(ctx, config, { mode, workspaceRoot: cwd })
  const run = (request: CodeRunRequest) => runtime.run(runtime.resolve(request))
  return { ctx, runtime, root, cwd, run }
}

function bindings(functions: Record<string, CodeBindingFunction>): CodeBindingNamespace[] {
  return [{ global: 'tools', functions, errorClass: { name: 'ToolCallError', memberNameProperty: 'toolName' } }]
}

describe('Node program process', () => {
  it('runs erasable TypeScript in the resolved directory with an empty environment', async () => {
    const { run, cwd } = await setup()
    const result = await run({ program: 'const n: number = 6; console.log("ready"); return { n: n * 7, cwd: process.cwd(), env: { ...process.env } };', bindings: [] })
    expect(result.error).toBeUndefined()
    expect(result.value).toEqual({ n: 42, cwd, env: {} })
    expect(result.logs).toEqual(['ready'])
    expect(result.sandbox).toEqual({ mode: 'danger-full-access', denied: false })
  })

  it('returns binding values and preserves typed binding rejection', async () => {
    const { run } = await setup()
    const result = await run({
      program: 'const value = await tools.echo({ n: 42 }); let rejected; try { await tools.fail({}) } catch (e) { rejected = [e instanceof ToolCallError,e.name,e.toolName,e.message]; } return {value,rejected};',
      bindings: bindings({ echo: async args => args as { n: number }, fail: async () => { throw new Error('denied') } }),
    })
    expect(result.error).toBeUndefined()
    expect(result.value).toEqual({ value: { n: 42 }, rejected: [true, 'ToolCallError', 'fail', 'denied'] })
  })

  it('retains raw native stdout and stderr separately from control frames', async () => {
    const { run } = await setup()
    const result = await run({ program: 'const fs = await import("node:fs"); fs.writeSync(1,"native-out你好"); fs.writeSync(2,"native-err🙂"); return 42;', bindings: [] })
    expect(result.error).toBeUndefined()
    expect(result.value).toBe(42)
    expect(result.logs.join('')).toContain('native-out你好')
    expect(result.logs.join('')).toContain('native-err🙂')
  })

  it.each(['throw new Error("broken")', 'enum E { A }'])('reports program failure for %s', async (program) => {
    const { run } = await setup()
    expect((await run({ program, bindings: [] })).error?.kind).toBe('exception')
  })

  it('rejects lossy program output', async () => {
    const { run } = await setup()
    expect((await run({ program: 'return { value: undefined }', bindings: [] })).error?.kind).toBe('invalid-output')
  })

  it('enforces the combined output cap', async () => {
    const { run } = await setup({ maxOutputBytes: 80 })
    const result = await run({ program: 'console.log("x".repeat(500)); return 42;', bindings: [] })
    expect(result.error?.kind).toBe('output-limit')
    const bytes = Buffer.byteLength(JSON.stringify(result.logs)) + Buffer.byteLength(JSON.stringify(result.error?.message))
    expect(bytes).toBeLessThanOrEqual(80)
  })

  it('uses the default deadline and caps explicit requests', async () => {
    const { runtime } = await setup()
    expect(runtime.resolve({ program: '', bindings: [] }).timeoutMs).toBe(120_000)
    expect(runtime.resolve({ program: '', bindings: [], timeoutMs: 900_000 }).timeoutMs).toBe(600_000)
    for (const timeoutMs of [0, -1, NaN, Infinity]) expect(() => runtime.resolve({ program: '', bindings: [], timeoutMs })).toThrow()
    await expect(runtime.run({ program: '', bindings: [], cwd: process.cwd(), timeoutMs: 1000 })).rejects.toThrow('sandbox policy')
  })

  it.each(['for (;;) {}', 'await new Promise(() => {})'])('ends an unfinished program at its elapsed deadline: %s', async (program) => {
    const { run } = await setup({ timeoutMs: 600, graceMs: 50 })
    expect((await run({ program, bindings: [] })).error?.kind).toBe('timeout')
  })

  it('does not pause the deadline while a binding is pending', async () => {
    const { run } = await setup({ timeoutMs: 1000, graceMs: 50 })
    const result = await run({ program: 'void tools.wait({}); for (;;) {}', bindings: bindings({ wait: () => new Promise(() => {}) }) })
    expect(result.error?.kind).toBe('timeout')
  })

  it('cancels a live program and closes its managed process', async () => {
    const { run } = await setup()
    const entered = Promise.withResolvers<undefined>()
    const controller = new AbortController()
    const active = run({ program: 'await tools.enter({}); for (;;) {}', signal: controller.signal, bindings: bindings({ enter: async () => { entered.resolve(undefined); return null } }) })
    await entered.promise
    controller.abort('stop')
    expect((await active).error).toEqual({ kind: 'abort', message: 'stop' })
  })

  it('closes a still-running descendant before returning the program result', async () => {
    const { run } = await setup()
    const connected = Promise.withResolvers<undefined>()
    const disconnected = Promise.withResolvers<undefined>()
    let peer: Socket | undefined
    const server = createServer((socket) => {
      peer = socket
      // A terminated peer can reset its connection instead of sending FIN.
      socket.on('error', () => {})
      socket.once('close', () => { disconnected.resolve(undefined) })
      connected.resolve(undefined)
    })
    onTestFinished(async () => {
      peer?.destroy()
      if (server.listening) await new Promise<void>((resolve, reject) => {
        server.close((error) => { if (error) reject(error); else resolve() })
      })
    })
    await new Promise<void>((resolve, reject) => {
      server.once('error', reject)
      server.listen(0, '127.0.0.1', resolve)
    })
    const address = server.address()
    if (address === null || typeof address === 'string') throw new Error('expected bound TCP listener')
    const child = `require('node:net').connect(${address.port},'127.0.0.1')`
    const result = await run({
      program: `const {spawn}=await import("node:child_process"); spawn(process.execPath,["-e",${JSON.stringify(child)}],{stdio:"ignore"}); await tools.connected({}); return 42;`,
      bindings: bindings({ connected: async () => { await connected.promise; return null } }),
    })
    expect(result.error).toBeUndefined()
    expect(result.value).toBe(42)
    await disconnected.promise
  })

  it('applies the configured V8 old-generation ceiling to each fresh Node process', async () => {
    const limits: number[] = []
    for (const maxOldGenerationSizeMb of [32, 64]) {
      const { run } = await setup({ maxOldGenerationSizeMb })
      const result = await run({ program: 'return (await import("node:v8")).getHeapStatistics().heap_size_limit;', bindings: [] })
      expect(result.error).toBeUndefined()
      if (typeof result.value !== 'number') throw new Error('expected V8 heap limit')
      limits.push(result.value)
    }
    expect(Number(limits[1]) - Number(limits[0])).toBe(32 * 1024 * 1024)
  })

  it('disposes active programs and rejects later execution', async () => {
    const { ctx, run, runtime } = await setup()
    const spec = runtime.resolve({ program: '', bindings: [] })
    const entered = Promise.withResolvers<undefined>()
    const active = run({ program: 'await tools.enter({}); await new Promise(() => {})', bindings: bindings({ enter: async () => { entered.resolve(undefined); return null } }) })
    await entered.promise
    await ctx.fiber.dispose()
    expect((await active).error?.kind).toBe('abort')
    await expect(runtime.run(spec)).rejects.toThrow('disposal')
    expect(() => runtime.resolve({ program: '', bindings: [] })).toThrow('disposal')
    expect(runtime.isolation).toBe('process')
  })

  it.each([
    'const fs = await import("node:fs"); const b=Buffer.alloc(4); b.writeUInt32BE(4294967295); fs.writeSync(7,b); await new Promise(()=>{});',
    'const fs = await import("node:fs"); const body=Buffer.from(JSON.stringify({type:"call",id:1,global:"tools",name:"undeclared",args:[]})); const h=Buffer.alloc(4); h.writeUInt32BE(body.length); fs.writeSync(7,Buffer.concat([h,body])); await new Promise(()=>{});',
  ])('refuses hostile program control traffic', async (program) => {
    const { run } = await setup()
    expect((await run({ program, bindings: [] })).error?.kind).toBe('protocol')
  })

  it('applies read-only confinement to direct Node filesystem writes', async () => {
    const { run, cwd } = await setup({}, 'read-only')
    const path = join(cwd, 'denied.txt')
    const result = await run({ program: `await (await import('node:fs/promises')).writeFile(${JSON.stringify(path)}, 'denied')`, bindings: [] })
    expect(result.error?.kind).toBe('exception')
    expect(result.sandbox).toMatchObject({ mode: 'read-only', denied: true })
    await expect(readFile(path)).rejects.toMatchObject({ code: 'ENOENT' })
  })

  it('permits workspace writes and denies a symlink to a sibling outside it', async () => {
    const { run, cwd, root } = await setup({}, 'workspace-write')
    const target = join(cwd, 'allowed.txt')
    expect((await run({ program: `await (await import('node:fs/promises')).writeFile(${JSON.stringify(target)}, 'allowed'); return true`, bindings: [] })).value).toBe(true)
    expect(await readFile(target, 'utf8')).toBe('allowed')
    const outside = join(root, 'outside')
    await mkdir(outside)
    await symlink(outside, join(cwd, 'escape'), process.platform === 'win32' ? 'junction' : 'dir')
    const result = await run({ program: `await (await import('node:fs/promises')).writeFile(${JSON.stringify(join(cwd, 'escape', 'denied.txt'))}, 'denied')`, bindings: [] })
    expect(result.error?.kind).toBe('exception')
    expect(result.sandbox).toMatchObject({ mode: 'workspace-write', denied: true })
    await expect(readFile(join(outside, 'denied.txt'))).rejects.toMatchObject({ code: 'ENOENT' })
  })
})

it('preserves empty console entries and bounds native output overflow', async () => {
  const { run } = await setup({ maxOutputBytes: 100 })
  const lines = await run({ program: 'console.log("a"); console.log(""); console.log("b")', bindings: [] })
  expect(lines.logs).toEqual(['a', '', 'b'])
  const overflow = await run({ program: 'const fs=await import("node:fs"); fs.writeSync(1,"HEAD-"+"x".repeat(100000));', bindings: [] })
  expect(overflow.error?.kind).toBe('output-limit')
  expect(overflow.logs.join('')).toContain('HEAD-')
  const bytes = Buffer.byteLength(JSON.stringify(overflow.logs)) + Buffer.byteLength(JSON.stringify(overflow.error?.message))
  expect(bytes).toBeLessThanOrEqual(100)
})