diff --git a/tests/runner-e2e/api.test.ts b/tests/runner-e2e/api.test.ts index 0fc5d44b4c4..9f24e712338 100644 --- a/tests/runner-e2e/api.test.ts +++ b/tests/runner-e2e/api.test.ts @@ -5,7 +5,7 @@ const response = (status: number, data: unknown = {}): APIResponse => ({ ok: () => status >= 200 && status < 300, status: () => status, json: async () => data, text: async () => JSON.stringify(data), url: () => "http://fixture.invalid/instructions", }) as APIResponse; -afterEach(() => vi.unstubAllEnvs()); +afterEach(() => { vi.unstubAllEnvs(); vi.unstubAllGlobals(); }); describe("fixture instruction revision fence", () => { function api(current: APIResponse, saved = response(200)) { vi.stubEnv("PAPERCLIP_RUNNER_E2E_PORT", "3100"); @@ -67,3 +67,39 @@ it("keeps existing polling retries when the strict error policy is absent", asyn load, accept: Boolean, intervalMs: 1 })).resolves.toBe(true); expect(load).toHaveBeenCalledTimes(2); }); + +it("observes identical native poll results with the actual actor and no traced request", async () => { + vi.stubEnv("PAPERCLIP_RUNNER_E2E_PORT", "3100"); + const get = vi.fn(() => { throw new Error("Poll must not enter the Playwright API recorder"); }); + const api = new RunnerApi({ get } as unknown as APIRequestContext); + api.setBrowserSession("synthetic-cookie"); + const rows = [{ id: "11111111-1111-4111-8111-111111111111", status: "running" }]; + const fetcher = vi.fn(async (_input: RequestInfo | URL, _init?: RequestInit) => new Response(JSON.stringify(rows), { status: 200 })); + vi.stubGlobal("fetch", fetcher); + const endpoint = "/api/companies/22222222-2222-4222-8222-222222222222/heartbeat-runs?limit=100"; + await expect(api.getRunObservation(endpoint, { timeout: 1234 })).resolves.toEqual(rows); + expect(get).not.toHaveBeenCalled(); expect(fetcher).toHaveBeenCalledTimes(1); + expect(String(fetcher.mock.calls[0]![0])).toBe(`http://127.0.0.1:3100${endpoint}`); + expect(fetcher.mock.calls[0]![1]).toMatchObject({ method: "GET", redirect: "error", headers: { Cookie: "synthetic-cookie", Origin: "http://127.0.0.1:3100" } }); + expect((fetcher.mock.calls[0]![1] as RequestInit).signal).toBeInstanceOf(AbortSignal); +}); +it("keeps local-trusted run observations cookie-free and preserves typed HTTP failure without retry", async () => { + vi.stubEnv("PAPERCLIP_RUNNER_E2E_PORT", "3100"); + const api = new RunnerApi({} as APIRequestContext); + const fetcher = vi.fn(async (_input: RequestInfo | URL, _init?: RequestInit) => new Response("private failure body", { status: 403 })); vi.stubGlobal("fetch", fetcher); + await expect(api.getRunObservation("/api/heartbeat-runs/11111111-1111-4111-8111-111111111111/events?afterSeq=0&limit=1000")).rejects.toMatchObject({ name: "RunnerApiHttpError", status: 403 }); + expect(fetcher).toHaveBeenCalledTimes(1); + expect(fetcher.mock.calls[0]![1]).toMatchObject({ headers: { "content-type": "application/json" } }); + expect((fetcher.mock.calls[0]![1] as RequestInit).headers).not.toHaveProperty("Cookie"); +}); +it.each([ + "https://foreign.invalid/api/heartbeat-runs/11111111-1111-4111-8111-111111111111", + "/api/companies/22222222-2222-4222-8222-222222222222/agents", + "/api/heartbeat-runs/11111111-1111-4111-8111-111111111111?token=anything", + "/api/heartbeat-runs/11111111-1111-4111-8111-111111111111/events?afterSeq=0&limit=10&extra=1", +])("rejects non-observation transport target %s before dispatch", async endpoint => { + vi.stubEnv("PAPERCLIP_RUNNER_E2E_PORT", "3100"); + const fetcher = vi.fn(); vi.stubGlobal("fetch", fetcher); + await expect(new RunnerApi({} as APIRequestContext).getRunObservation(endpoint)).rejects.toThrow("allowlisted same-origin GET"); + expect(fetcher).not.toHaveBeenCalled(); +}); diff --git a/tests/runner-e2e/api.ts b/tests/runner-e2e/api.ts index f7bb1008efb..e9574ca0f7e 100644 --- a/tests/runner-e2e/api.ts +++ b/tests/runner-e2e/api.ts @@ -47,6 +47,20 @@ export class RunnerApi { return response.json() as Promise; } + /** Repeated native observation reads retain explicit snapshots, without duplicating full DTO bodies in the browser trace. */ + async getRunObservation(path: string, options?: { timeout: number }): Promise { + const url = new URL(path, this.baseURL); + const uuid = "[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}"; + const companyRuns = new RegExp(`^/api/companies/${uuid}/heartbeat-runs$`, "i").test(url.pathname) + && [...url.searchParams.keys()].every(key => key === "limit") && url.searchParams.get("limit") === "100"; + const run = new RegExp(`^/api/heartbeat-runs/${uuid}$`, "i").test(url.pathname) && !url.search; + const events = new RegExp(`^/api/heartbeat-runs/${uuid}/events$`, "i").test(url.pathname) + && [...url.searchParams.keys()].every(key => ["afterSeq", "limit"].includes(key)) + && /^\d+$/.test(url.searchParams.get("afterSeq") ?? "") && /^[1-9]\d*$/.test(url.searchParams.get("limit") ?? ""); + if (url.origin !== this.baseURL || url.username || url.password || url.hash || !(companyRuns || run || events)) throw new Error("Run observation requires an allowlisted same-origin GET endpoint"); + return this.authenticatedJson("GET", path, undefined, options); + } + /** Fetch owned attachment bytes with the same authenticated actor as JSON reads. */ async getAttachmentContent(attachmentId: string): Promise { if (!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(attachmentId)) throw new Error("Invalid fixture attachment identity"); diff --git a/tests/runner-e2e/chat-flow.test.ts b/tests/runner-e2e/chat-flow.test.ts index ceff2c91a87..26baaa5f61a 100644 --- a/tests/runner-e2e/chat-flow.test.ts +++ b/tests/runner-e2e/chat-flow.test.ts @@ -267,7 +267,7 @@ If you only have the club name, audience, and tone, that is enough to begin; I c it("retains reset events without requesting a provider log, and does not hide missing real logs", async () => { const get = vi.fn().mockResolvedValue([{ seq: 1, type: "session_reset" }]); const reset = { ...run, resultJson: { conversationReset: true } }; - await expect(collectChatRunEvidence({ get }, reset)).resolves.toEqual({ + await expect(collectChatRunEvidence({ get, getRunObservation: get }, reset)).resolves.toEqual({ runId: run.id, log: null, events: [{ seq: 1, type: "session_reset" }], @@ -276,7 +276,7 @@ If you only have the club name, audience, and tone, that is enough to begin; I c [`/api/heartbeat-runs/${run.id}/events?afterSeq=0&limit=1000`], ]); get.mockRejectedValue(new Error("Run log not found")); - await expect(collectChatRunEvidence({ get }, run)).rejects.toThrow( + await expect(collectChatRunEvidence({ get, getRunObservation: get }, run)).rejects.toThrow( "Run log not found", ); }); @@ -285,7 +285,7 @@ If you only have the club name, audience, and tone, that is enough to begin; I c const tail = { seq: 1001, eventType: "run.terminal" }; const get = vi.fn().mockResolvedValueOnce({ content: "fixture log" }) .mockResolvedValueOnce(firstPage).mockResolvedValueOnce([tail]); - const evidence = await collectChatRunEvidence({ get }, run); + const evidence = await collectChatRunEvidence({ get, getRunObservation: get }, run); expect(evidence.events).toEqual([...firstPage, tail]); expect(get.mock.calls).toEqual([ [`/api/heartbeat-runs/${run.id}/log?limitBytes=1048576`], @@ -297,22 +297,22 @@ If you only have the club name, audience, and tone, that is enough to begin; I c const stopped = { ...run, status: "interrupted", runtimeMode: "legacy", runtimeModeResolvedAt: null, logStore: null, logRef: null, resultJson: { executionRecovery: { kind: "bootstrap", providerWorkStarted: false } } }; const get = vi.fn().mockResolvedValue([]); - expect(await collectChatRunEvidence({ get }, stopped)).toMatchObject({ log: null, logOmissionReason: "provider_not_started", events: [] }); + expect(await collectChatRunEvidence({ get, getRunObservation: get }, stopped)).toMatchObject({ log: null, logOmissionReason: "provider_not_started", events: [] }); expect(get).toHaveBeenCalledTimes(1); get.mockRejectedValue(new Error("Run log not found")); for (const change of [{ resultJson: {} }, { runtimeMode: "native" }, { logRef: "recorded-log" }, { logStore: undefined }, { runtimeModeResolvedAt: "2026-09-28T00:00:00Z" }, { resultJson: { executionRecovery: { kind: "bootstrap", providerWorkStarted: true } } }]) { - await expect(collectChatRunEvidence({ get }, { ...stopped, ...change })).rejects.toThrow("Run log not found"); + await expect(collectChatRunEvidence({ get, getRunObservation: get }, { ...stopped, ...change })).rejects.toThrow("Run log not found"); } }); it("retains events for an unstarted dependency-blocked wake without asking for a nonexistent log", async () => { const get = vi.fn().mockResolvedValue([]); const suppressed = { ...run, status: "cancelled", errorCode: "issue_dependencies_blocked", startedAt: null }; - expect((await collectChatRunEvidence({ get }, suppressed)).log).toBeNull(); + expect((await collectChatRunEvidence({ get, getRunObservation: get }, suppressed)).log).toBeNull(); expect(get).toHaveBeenCalledTimes(1); get.mockRejectedValue(new Error("Run log not found")); - await expect(collectChatRunEvidence({ get }, { ...suppressed, startedAt: "2026-09-18T00:00:00Z" })).rejects.toThrow("Run log not found"); - await expect(collectChatRunEvidence({ get }, { ...suppressed, errorCode: "provider_transport_failed" })).rejects.toThrow("Run log not found"); + await expect(collectChatRunEvidence({ get, getRunObservation: get }, { ...suppressed, startedAt: "2026-09-18T00:00:00Z" })).rejects.toThrow("Run log not found"); + await expect(collectChatRunEvidence({ get, getRunObservation: get }, { ...suppressed, errorCode: "provider_transport_failed" })).rejects.toThrow("Run log not found"); }); it("waits for a newly running provider's log file without swallowing server failures", async () => { const get = vi.fn().mockResolvedValue({ status: () => 404 }); diff --git a/tests/runner-e2e/chat-flow.ts b/tests/runner-e2e/chat-flow.ts index 7fc82af288c..d0807bf448b 100644 --- a/tests/runner-e2e/chat-flow.ts +++ b/tests/runner-e2e/chat-flow.ts @@ -295,7 +295,7 @@ export async function readRunningChatLog( /** Reset/blocked runs and proven pre-provider failures may have no provider log. * Preserve their durable events; missing logs for real provider work still fail. */ export async function collectChatRunEvidence( - api: Pick, + api: Pick, run: ChatRun, ) { const recovery = run.resultJson?.executionRecovery as Record | undefined; @@ -309,7 +309,7 @@ export async function collectChatRunEvidence( ? null : await api.get(`/api/heartbeat-runs/${run.id}/log?limitBytes=1048576`), events: await collectRunEvents((afterSeq, limit) => - api.get(`/api/heartbeat-runs/${run.id}/events?afterSeq=${afterSeq}&limit=${limit}`), + api.getRunObservation(`/api/heartbeat-runs/${run.id}/events?afterSeq=${afterSeq}&limit=${limit}`), ), }; } @@ -397,11 +397,11 @@ export async function runChatFlow(input: ChatFlowInput) { "/api/instance/settings/experimental", ); const allRuns = async () => { - const rows = await api.get( + const rows = await api.getRunObservation( `/api/companies/${f.company.id}/heartbeat-runs?limit=100`, ); return Promise.all( - rows.map((row) => api.get(`/api/heartbeat-runs/${row.id}`)), + rows.map((row) => api.getRunObservation(`/api/heartbeat-runs/${row.id}`)), ); }; if (catalogDescriptor?.journeyKind === "native-slack-thread") {