coder-mos1
b238e0a8b1
CHECKPOINT ONLY — not a deliverable, not reviewed, not complete.
Committed by mos-remediation as TRANSPORT after the authoring seat (coder-mos1) became
unable to act: its context window was exceeded at 102.6%/372k AND its overflow-recovery
path failed ("Turn prefix summarization failed: servers overloaded"). The seat could not
process instructions or commit its own work, leaving 28 modified files durable only on
local disk.
Authorship preserved as coder-mos1 — this is transport, not authorship. The work is the
seat's; committing it is the only way to make it survive the rotation that must follow.
Scope note, unresolved: this diff spans the queue-guard tools (9 files under
framework/tools/git) AND 5 framework guides plus 11 agent templates. RM-03 was scoped to
ci-queue-wait.sh and its tests. Whether the doc/template edits are consequential to the
tri-state change or drive-by was queried and never answered — the seat was bricked before
it could reply. That question stays open and must be resolved before any of this is
reviewed; the wider edits may need splitting out.
Direct instance of D-31: commit-then-rotate works, rotate-without-commit loses everything.
237 lines
7.0 KiB
Bash
Executable File
237 lines
7.0 KiB
Bash
Executable File
#!/bin/bash
|
|
# Regression harness for pr-merge.sh Gitea exact-head API path and input safety.
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
WORK_ROOT="${AGENT_WORK_ROOT:-${HOME:-/tmp}/mosaic/agent-work}"
|
|
SANDBOX="$WORK_ROOT/pr-merge-empty-uid-test-$$"
|
|
MOCK_BIN="$SANDBOX/bin"
|
|
REPO_DIR="$SANDBOX/repo"
|
|
LOG_FILE="$SANDBOX/mock.log"
|
|
|
|
cleanup() {
|
|
rm -rf "$SANDBOX"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
mkdir -p "$MOCK_BIN" "$REPO_DIR"
|
|
: > "$LOG_FILE"
|
|
|
|
cat > "$MOCK_BIN/tea" <<'EOF'
|
|
#!/bin/bash
|
|
set -euo pipefail
|
|
printf 'tea %q ' "$@" >> "$PR_MERGE_TEST_LOG"
|
|
printf '\n' >> "$PR_MERGE_TEST_LOG"
|
|
if [[ "$*" == *"login list"* ]]; then
|
|
echo '[{"name":"git.mosaicstack.dev","url":"https://git.mosaicstack.dev"}]'
|
|
exit 0
|
|
fi
|
|
if [[ "$*" == *"pr merge"* ]]; then
|
|
echo 'user does not exist [uid: 0, name: ]' >&2
|
|
exit 1
|
|
fi
|
|
exit 0
|
|
EOF
|
|
chmod +x "$MOCK_BIN/tea"
|
|
|
|
cat > "$MOCK_BIN/curl" <<'EOF'
|
|
#!/bin/bash
|
|
set -euo pipefail
|
|
printf 'curl %q ' "$@" >> "$PR_MERGE_TEST_LOG"
|
|
printf '\n' >> "$PR_MERGE_TEST_LOG"
|
|
args=" $* "
|
|
out_file=""
|
|
write_code=false
|
|
post_data=""
|
|
prev=""
|
|
for arg in "$@"; do
|
|
if [[ "$prev" == "-o" ]]; then
|
|
out_file="$arg"
|
|
prev=""
|
|
continue
|
|
fi
|
|
if [[ "$prev" == "-d" ]]; then
|
|
post_data="$arg"
|
|
prev=""
|
|
continue
|
|
fi
|
|
if [[ "$arg" == "-o" ]]; then
|
|
prev="-o"
|
|
continue
|
|
fi
|
|
if [[ "$arg" == "-d" ]]; then
|
|
prev="-d"
|
|
continue
|
|
fi
|
|
if [[ "$arg" == "-w" ]]; then
|
|
write_code=true
|
|
fi
|
|
done
|
|
emit_response() {
|
|
local body="$1"
|
|
if [[ -n "$out_file" ]]; then
|
|
printf '%s' "$body" > "$out_file"
|
|
else
|
|
printf '%s' "$body"
|
|
fi
|
|
if [[ "$write_code" == true ]]; then
|
|
printf '200'
|
|
fi
|
|
}
|
|
if [[ "$args" == *"/api/v1/repos/mosaicstack/stack/pulls/123"* && "$args" != *"/api/v1/repos/mosaicstack/stack/pulls/123/merge"* ]]; then
|
|
emit_response '{"number":123,"title":"mock","state":"open","user":{"login":"tester"},"head":{"ref":"feature/mock","sha":"0123456789abcdef0123456789abcdef01234567","repo":{"full_name":"mosaicstack/stack"}},"base":{"ref":"main"},"labels":[],"assignees":[],"html_url":"https://git.mosaicstack.dev/mosaicstack/stack/pulls/123","mergeable":true}'
|
|
exit 0
|
|
fi
|
|
if [[ "$args" == *"-X POST"* && "$args" == *"/api/v1/repos/mosaicstack/stack/pulls/123/merge"* ]]; then
|
|
POST_DATA="$post_data" python3 - <<'PY'
|
|
import json
|
|
import os
|
|
payload = json.loads(os.environ["POST_DATA"])
|
|
assert payload == {
|
|
"Do": "squash",
|
|
"head_commit_id": "0123456789abcdef0123456789abcdef01234567",
|
|
}, payload
|
|
PY
|
|
emit_response '{"merged":true,"message":"mock merge complete"}'
|
|
exit 0
|
|
fi
|
|
echo "unexpected curl invocation: $*" >&2
|
|
exit 97
|
|
EOF
|
|
chmod +x "$MOCK_BIN/curl"
|
|
|
|
cd "$REPO_DIR"
|
|
git init -q
|
|
git remote add origin https://git.mosaicstack.dev/mosaicstack/stack.git
|
|
|
|
export PATH="$MOCK_BIN:$PATH"
|
|
export PR_MERGE_TEST_LOG="$LOG_FILE"
|
|
export GITEA_LOGIN="git.mosaicstack.dev"
|
|
export GITEA_URL="https://git.mosaicstack.dev"
|
|
export GITEA_TOKEN="redacted-test-token"
|
|
|
|
OUTPUT="$SANDBOX/output.log"
|
|
if ! "$SCRIPT_DIR/pr-merge.sh" -n 123 -m squash --skip-queue-guard > "$OUTPUT" 2>&1; then
|
|
echo "Expected pr-merge.sh to use the exact-head Gitea API path." >&2
|
|
echo "--- output ---" >&2
|
|
sed 's/redacted-test-token/***REDACTED***/g' "$OUTPUT" >&2
|
|
echo "--- mock log ---" >&2
|
|
sed 's/redacted-test-token/***REDACTED***/g' "$LOG_FILE" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! grep -q '/api/v1/repos/mosaicstack/stack/pulls/123/merge' "$LOG_FILE"; then
|
|
echo "Expected authenticated Gitea merge API endpoint to be called." >&2
|
|
sed 's/redacted-test-token/***REDACTED***/g' "$LOG_FILE" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if grep -q 'redacted-test-token' "$OUTPUT"; then
|
|
echo "Token leaked to pr-merge.sh output." >&2
|
|
exit 1
|
|
fi
|
|
|
|
cat > "$MOCK_BIN/tea" <<'EOF'
|
|
#!/bin/bash
|
|
set -euo pipefail
|
|
printf 'tea %q ' "$@" >> "$PR_MERGE_TEST_LOG"
|
|
printf '\n' >> "$PR_MERGE_TEST_LOG"
|
|
if [[ "$*" == *"login list"* ]]; then
|
|
echo '[]'
|
|
exit 0
|
|
fi
|
|
if [[ "$*" == *"pr merge"* ]]; then
|
|
echo 'tea merge should not run without a configured host login' >&2
|
|
exit 99
|
|
fi
|
|
exit 0
|
|
EOF
|
|
chmod +x "$MOCK_BIN/tea"
|
|
unset GITEA_LOGIN
|
|
: > "$LOG_FILE"
|
|
if ! "$SCRIPT_DIR/pr-merge.sh" -n 123 -m squash --skip-queue-guard > "$OUTPUT" 2>&1; then
|
|
echo "Expected the exact-head API path not to depend on a tea login." >&2
|
|
sed 's/redacted-test-token/***REDACTED***/g' "$OUTPUT" >&2
|
|
sed 's/redacted-test-token/***REDACTED***/g' "$LOG_FILE" >&2
|
|
exit 1
|
|
fi
|
|
if ! grep -q '/api/v1/repos/mosaicstack/stack/pulls/123/merge' "$LOG_FILE"; then
|
|
echo "Expected missing tea login path to call Gitea API merge endpoint." >&2
|
|
sed 's/redacted-test-token/***REDACTED***/g' "$LOG_FILE" >&2
|
|
exit 1
|
|
fi
|
|
|
|
SENTINEL="$SANDBOX/injected-sentinel"
|
|
INJECTION="123; touch $SENTINEL #"
|
|
|
|
cat > "$MOCK_BIN/gh" <<'EOF'
|
|
#!/bin/bash
|
|
set -euo pipefail
|
|
printf 'gh %q ' "$@" >> "$PR_MERGE_TEST_LOG"
|
|
printf '\n' >> "$PR_MERGE_TEST_LOG"
|
|
if [[ "$*" == *"pr view"* ]]; then
|
|
cat <<'JSON'
|
|
{"number":123,"title":"mock","baseRefName":"main","headRefName":"feature/mock"}
|
|
JSON
|
|
exit 0
|
|
fi
|
|
if [[ "$*" == *"pr merge"* ]]; then
|
|
exit 0
|
|
fi
|
|
echo "unexpected gh invocation: $*" >&2
|
|
exit 98
|
|
EOF
|
|
chmod +x "$MOCK_BIN/gh"
|
|
|
|
cd "$REPO_DIR"
|
|
git remote set-url origin https://github.com/mosaicstack/stack.git
|
|
: > "$LOG_FILE"
|
|
rm -f "$SENTINEL"
|
|
if "$SCRIPT_DIR/pr-merge.sh" -n "$INJECTION" -m squash --skip-queue-guard > "$OUTPUT" 2>&1; then
|
|
echo "Expected GitHub metacharacter PR number to be rejected." >&2
|
|
sed 's/redacted-test-token/***REDACTED***/g' "$OUTPUT" >&2
|
|
exit 1
|
|
fi
|
|
if [[ -e "$SENTINEL" ]]; then
|
|
echo "GitHub metacharacter PR number executed injected shell command." >&2
|
|
exit 1
|
|
fi
|
|
if [[ -s "$LOG_FILE" ]]; then
|
|
echo "GitHub metacharacter PR number should be rejected before gh calls." >&2
|
|
sed 's/redacted-test-token/***REDACTED***/g' "$LOG_FILE" >&2
|
|
exit 1
|
|
fi
|
|
if ! grep -q 'Invalid PR number' "$OUTPUT"; then
|
|
echo "Expected invalid PR number error for GitHub metacharacter input." >&2
|
|
sed 's/redacted-test-token/***REDACTED***/g' "$OUTPUT" >&2
|
|
exit 1
|
|
fi
|
|
|
|
cd "$REPO_DIR"
|
|
git remote set-url origin https://git.mosaicstack.dev/mosaicstack/stack.git
|
|
export GITEA_LOGIN="git.mosaicstack.dev"
|
|
: > "$LOG_FILE"
|
|
rm -f "$SENTINEL"
|
|
if "$SCRIPT_DIR/pr-merge.sh" -n "$INJECTION" -m squash --skip-queue-guard > "$OUTPUT" 2>&1; then
|
|
echo "Expected Gitea metacharacter PR number to be rejected." >&2
|
|
sed 's/redacted-test-token/***REDACTED***/g' "$OUTPUT" >&2
|
|
exit 1
|
|
fi
|
|
if [[ -e "$SENTINEL" ]]; then
|
|
echo "Gitea metacharacter PR number executed injected shell command." >&2
|
|
exit 1
|
|
fi
|
|
if [[ -s "$LOG_FILE" ]]; then
|
|
echo "Gitea metacharacter PR number should be rejected before tea/curl calls." >&2
|
|
sed 's/redacted-test-token/***REDACTED***/g' "$LOG_FILE" >&2
|
|
exit 1
|
|
fi
|
|
if ! grep -q 'Invalid PR number' "$OUTPUT"; then
|
|
echo "Expected invalid PR number error for Gitea metacharacter input." >&2
|
|
sed 's/redacted-test-token/***REDACTED***/g' "$OUTPUT" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "pr-merge.sh Gitea exact-head API regression passed"
|