Hare/yoi
1
1
Fork 0
Code Actions Packages Releases Activity

chore: merge develop preserving documentation structure and console UX

Browse Source 
Integrate develop at 523bade3 while retaining concise agent guidance, rustdoc-owned design rationale, and current console history/rewind behavior. Adapt incoming tests to public entry-ID rewind and synchronize OpenAPI/TypeScript artifacts.

Validation: default-member cargo test --all-features (4936 passed, 23 ignored), root cargo check, all-feature rustdoc with broken links denied, format/diff/name guards, OpenAPI and 11 TypeScript freshness checks. Web: 613 unit, 327 component, 7 Ticket browser and 3 Console browser tests; check/build passed. Merged-state Ticket visual review at 1440/768/390px in light/dark; no matching pre-merge image baseline. E2E/live-provider checks not run.
This commit is contained in:
Hare
2026-10-13 02:46:50 +09:00
parent 88811466f2 523bade3a6
commit 12d1588c05
213 changed files with 59018 additions and 14443 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/worker-runtime/src/http_server.rs
+4
View File
@@ -5,6 +5,10 @@
//! command surface for a trusted backend/proxy. Browsers must not connect to the
//! Runtime process directly; a backend is expected to own any browser-facing
//! credentials, registration, and policy.
//!
//! Workdir list/detail/removal offload synchronous provider work to blocking workers.
//! Removal reserves only its target under the Runtime state mutex, releasing it before
//! filesystem/Git inspection and unlink; conflicting target use is rejected promptly.
mod runtime_management_api;
crates/worker-runtime/src/worker_backend.rs
+59 -9
View File
@@ -2545,16 +2545,24 @@ where
}
}
method => {
let result = self.send_method(
WorkerExecutionOperation::ProtocolMethod,
execution.handle.clone(),
method,
);
if result.is_accepted() {
// The connected protocol owns this bounded admission wait. The old
// generic adapter waiter could time out while leaving a detached send
// task alive; it might deliver later after the connection had ended.
// Join cancellation before releasing endpoint exclusion. A send which
// raced cancellation remains delivery-unknown, never automatically retried.
let handle = execution.handle.clone();
self.run_cancellable_on_adapter_runtime(USER_INPUT_TASK_TIMEOUT, async move {
handle.send(method).await.map_err(|error| {
format!("connected Worker method delivery failed or is unknown: {error}")
})?;
Ok(Vec::new())
} else {
Err(result)
}
})
.map_err(|message| {
WorkerExecutionResult::errored(
WorkerExecutionOperation::ProtocolMethod,
message,
)
})
}
}
}
@@ -7905,6 +7913,48 @@ mod tests {
assert!(backend.worker_snapshot(&worker_ref).is_none());
}
#[test]
fn connected_protocol_admission_timeout_joins_pending_send_before_capacity_reopens() {
// This is the adapter's cancellation/join policy boundary used by the
// captured protocol endpoint, not an execution-side-effect rollback.
let backend = WorkerRuntimeExecutionBackend::new(FailingFactory).unwrap();
let (sender, mut receiver) = tokio::sync::mpsc::channel(1);
sender.try_send(Method::ListPendingSubmissions).unwrap();
let dropped = Arc::new(AtomicBool::new(false));
struct PendingSendDrop(Arc<AtomicBool>);
impl Drop for PendingSendDrop {
fn drop(&mut self) {
self.0.store(true, Ordering::SeqCst);
}
}
let owned = PendingSendDrop(dropped.clone());
let error = backend
.run_cancellable_on_adapter_runtime(Duration::from_millis(5), async move {
let _owned = owned;
sender
.send(Method::ListWorkers)
.await
.map_err(|error| error.to_string())
})
.unwrap_err();
assert!(error.contains("was cancelled"), "{error}");
assert!(
dropped.load(Ordering::SeqCst),
"must join task cancellation before returning"
);
assert!(matches!(
receiver.try_recv(),
Ok(Method::ListPendingSubmissions)
));
assert!(
matches!(
receiver.try_recv(),
Err(tokio::sync::mpsc::error::TryRecvError::Disconnected)
),
"timeout must not leave an admission task capable of a late send"
);
}
#[test]
fn absent_execution_has_typed_input_rejection_and_safe_stop() {
let backend = WorkerRuntimeExecutionBackend::new(FailingFactory).unwrap();
crates/worker-runtime/src/worker_source.rs
+184
View File
@@ -18,6 +18,15 @@ use crate::auth::{
use crate::runtime::RuntimeWorkspaceScope;
use crate::worker_backend::WorkspacePromptProjectionCache;
fn ticket_assignment_role_segment(role: server_api::TicketAssignmentRole) -> &'static str {
match role {
server_api::TicketAssignmentRole::Orchestrator => "orchestrator",
server_api::TicketAssignmentRole::Worker => "worker",
server_api::TicketAssignmentRole::Owner => "owner",
server_api::TicketAssignmentRole::Contributor => "contributor",
}
}
pub const DEFAULT_WORKER_MUTATION_SOURCE_TTL_SECONDS: u64 = 60;
#[derive(Clone, Debug, PartialEq, Eq)]
@@ -590,6 +599,62 @@ impl WorkspaceClient for RuntimeOwnedWorkspaceClient {
.map_err(|error| WorkspaceClientError::Request(error.to_string()))?;
runtime.block_on(async move {
match operation {
WorkspaceServerOperation::TicketAssignmentSet {
ticket_id,
role,
request,
} => {
let role = ticket_assignment_role_segment(role);
generated_workspace_response(
client
.ticket_assignment_set(
workspace_id,
ticket_id,
role.to_owned(),
request,
)
.await,
)
}
WorkspaceServerOperation::TicketAssignmentClear {
ticket_id,
role,
query,
} => {
let role = ticket_assignment_role_segment(role);
generated_workspace_response(
client
.ticket_assignment_clear(
workspace_id,
ticket_id,
role.to_owned(),
query,
)
.await,
)
}
WorkspaceServerOperation::TicketAssignmentsPage { ticket_id, query } => {
generated_workspace_response(
client
.ticket_assignments_page(workspace_id, ticket_id, query)
.await,
)
}
WorkspaceServerOperation::TicketAssignmentDiagnostics {
ticket_id,
query,
} => generated_workspace_response(
client
.ticket_assignment_diagnostics(workspace_id, ticket_id, query)
.await,
),
WorkspaceServerOperation::TicketAssignmentAnswer { ticket_id, request } => {
generated_workspace_response(
client
.ticket_assignment_answer(workspace_id, ticket_id, request)
.await,
)
}
WorkspaceServerOperation::WorkerControlList => {
generated_workspace_response(
client.worker_control_list(workspace_id).await,
@@ -882,6 +947,125 @@ mod tests {
(base_url, server)
}
#[test]
fn generated_ticket_assignment_transport_signs_exact_authoring_and_bounded_read_subjects() {
use crate::auth::{RuntimeRequestSourceExpectation, verify_runtime_request_source};
let identity = RuntimeIdentityMaterial::generate("runtime-a").unwrap();
let assignment_result =
serde_json::json!({"workspace_id":"workspace-a", "ticket_id":"T-1", "assignment":null});
let answer: server_api::TicketAssignmentAnswerRequest = serde_json::from_value(serde_json::json!({ "assignment_id": "delegation", "expected_last_event_id": "observed", "operation_key": "answer-op", "body": "User answer\ncontinued" })).unwrap();
let cases = vec![
(
WorkspaceServerOperation::TicketAssignmentSet {
ticket_id: "T-1".into(),
role: server_api::TicketAssignmentRole::Orchestrator,
request: server_api::SetTicketRoleAssignmentRequest {
operation_id: "assign-op".into(),
expected_assignment_id: Some("delegation".into()),
orchestrator_assignment_id: None,
principal: server_api::TicketAssignmentPrincipal::WorkspaceAgent {
agent_key: "workspace-orchestrator".into(),
},
workdir_bindings: vec![],
},
},
"PUT",
"/api/w/workspace-a/tickets/T-1/assignments/orchestrator",
assignment_result.clone(),
),
(
WorkspaceServerOperation::TicketAssignmentClear {
ticket_id: "T-1".into(),
role: server_api::TicketAssignmentRole::Orchestrator,
query: server_api::ClearTicketRoleAssignmentQuery {
operation_id: Some("clear-op".into()),
assignment_id: Some("delegation".into()),
},
},
"DELETE",
"/api/w/workspace-a/tickets/T-1/assignments/orchestrator?operation_id=clear-op&assignment_id=delegation",
assignment_result,
),
(
WorkspaceServerOperation::TicketAssignmentsPage {
ticket_id: "T-1".into(),
query: server_api::TicketAssignmentsQuery {
after_assignment_id: Some("old id".into()),
limit: Some(1),
},
},
"GET",
"/workspaces/workspace-a/tickets/T-1/assignment-tracking/assignments?after_assignment_id=old+id&limit=1",
serde_json::json!({"items":[],"next_assignment_id":null}),
),
(
WorkspaceServerOperation::TicketAssignmentDiagnostics {
ticket_id: "T-1".into(),
query: server_api::TicketAssignmentDiagnosticsQuery {
assignment_id: "delegation".into(),
after_input_event_id: Some("ticket-event:1".into()),
after_start_operation_id: None,
limit: Some(1),
},
},
"GET",
"/workspaces/workspace-a/tickets/T-1/assignment-diagnostics?assignment_id=delegation&after_input_event_id=ticket-event%3A1&limit=1",
serde_json::json!({"assignment_id":"delegation","current":true,"input_origin_known":true,"actionable":true,"inputs":[],"starts":[],"next_input_event_id":null,"next_start_operation_id":null}),
),
(
WorkspaceServerOperation::TicketAssignmentAnswer {
ticket_id: "T-1".into(),
request: answer.clone(),
},
"POST",
"/workspaces/workspace-a/tickets/T-1/assignment-answer",
serde_json::json!({"assignment_id":"delegation","input_event_id":"ticket-event:1","event_index":1}),
),
];
for (operation, method, path, reply) in cases {
let reply = reply.to_string();
let response = format!("HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}", reply.len(), reply).into_bytes();
let (url, server) = binary_loopback(response);
let client =
RuntimeOwnedWorkspaceClient::new("workspace-a", url, "runtime-a", "worker-a")
.with_runtime_request_source(&identity, "server-a");
let result = client.execute_server_operation(operation).unwrap();
assert_eq!(result.status, 200);
let (head, body) = server.join().unwrap();
assert!(
head.starts_with(&format!("{method} {path} HTTP/1.1\r\n")),
"unexpected request: {head}"
);
let token = head
.lines()
.find_map(|line| {
let (key, value) = line.split_once(':')?;
key.eq_ignore_ascii_case(RUNTIME_REQUEST_SOURCE_PROOF_HEADER)
.then(|| value.trim())
})
.unwrap();
let digest = request_body_digest(&body);
let expected = RuntimeRequestSourceExpectation {
identity_id: "runtime-a",
audience: "server-a",
workspace_id: "workspace-a",
worker_id: Some("worker-a"),
permission: WORKSPACE_REQUEST_PERMISSION,
method,
path,
body_digest: &digest,
now_unix: unix_now_seconds() as i64,
};
verify_runtime_request_source(token, &identity.public_key, &expected).unwrap();
if method == "POST" {
assert_eq!(
serde_json::from_slice::<serde_json::Value>(&body).unwrap(),
serde_json::to_value(&answer).unwrap()
);
}
}
}
#[test]
fn binary_roundtrip_signs_exact_query_method_worker_and_raw_body() {
use crate::auth::{RuntimeRequestSourceExpectation, verify_runtime_request_source};
crates/worker-runtime/src/working_directory.rs
+16 -18
View File
@@ -10,10 +10,11 @@
//! Resource clones held by sessions and commands maintain that protection. Deletion invalidates
//! the materialization generation, so recreating the same ID cannot activate old bindings.
//!
//! Deletion is a provider operation checking current identity, mounts, and remaining content.
//! Partial-deletion witnesses are stored outside the tree. CleanupPending/unknown inventory status
//! does not guarantee current cleanliness. Detailed inspection and remaining-content checks
//! are limited to cleanup retries.
//! Deletion checks current identity, mounts, Git cleanliness when needed, and surviving entry
//! metadata. Durable metadata authority lives outside the tree; cleanup performs no content-hash
//! scan or byte-equality verification. CleanupPending/unknown inventory checks saved identity only,
//! not current cleanliness. Normal retries recheck safety; a failed attempt grants no deletion
//! permission and does not permanently forbid normal reattachment to a usable same-identity checkout.
use crate::catalog::{
MaterializerKind, RepositoryRefObservation, RepositoryRefObservationRequest,
@@ -758,22 +759,12 @@ impl RuntimeGitMaterializer {
// Frozen evidence normalization can write the record. Keep it inside
// use admission so observational reads cannot race physical cleanup.
let _use_lease = self.occupancy.acquire_use(working_directory_id)?;
self.read_binding_record(working_directory_id, true)
}
fn read_binding_for_cleanup(
&self,
working_directory_id: &str,
) -> Result<WorkingDirectoryBinding, WorkingDirectoryDiagnostic> {
// Cleanup already owns exclusive admission and validates the original
// bytes. Its witnessed status write performs any canonicalization.
self.read_binding_record(working_directory_id, false)
self.read_binding_record(working_directory_id)
}
fn read_binding_record(
&self,
working_directory_id: &str,
migrate: bool,
) -> Result<WorkingDirectoryBinding, WorkingDirectoryDiagnostic> {
let working_directory_root = self.working_directory_root(working_directory_id);
let path = working_directory_root.join(MATERIALIZATION_RECORD);
@@ -810,7 +801,7 @@ impl RuntimeGitMaterializer {
"materialization evidence is invalid",
)
})?;
if migrate && canonical != raw {
if canonical != raw {
let temporary = path.with_extension(format!("migration-{}.tmp", uuid::Uuid::now_v7()));
let result = (|| -> std::io::Result<()> {
let mut file = fs::OpenOptions::new()
@@ -4800,9 +4791,16 @@ mod tests {
materializer.read_binding(id).unwrap_err().code,
"working_directory_cleanup_resource_busy"
);
materializer.read_binding_for_cleanup(id).unwrap();
assert_eq!(fs::read(&path).unwrap(), original);
drop(cleanup);
// Actual cleanup admission reads the legacy record without rewriting it
// before change protection has admitted removal.
fs::write(binding.root.join("README.md"), "preserve change").unwrap();
assert_eq!(
materializer.cleanup_working_directory(id).unwrap_err().code,
"working_directory_cleanup_changes_present"
);
assert_eq!(fs::read(&path).unwrap(), original);
git(binding.root(), &["restore", "README.md"]);
materializer.read_binding(id).unwrap();
let canonical: serde_json::Value =
crates/worker-runtime/src/working_directory/cleanup.rs
+755 -123
View File
File diff suppressed because it is too large Load Diff