PaperClipAI/tests/runner-e2e/chat-catalog-domains/runtime-computers.test.ts

import { expect, it } from "vitest";
import { computerGuidance, computerProbeReply, gradeSshComputer } from "./runtime-computers-ssh.js";
import { cloudAssignmentReply, imageGuidanceReply, gradeCloudAssignment, gradePreparedImage } from "./runtime-computers-cloud.js";
import { validateSshComputerReceipt } from "./runtime-computers-private.js";
import { validWebsiteToolsManifest, validateImagePreparationReceipt } from "./runtime-computers-image-private.js";
function ssh(kind = "add") {
  return { companyId: "company", leadId: "ceo", agents: [], tasks: [], activity: [], links: [], humanQueries: [], reply: "", runs: Array.from({ length: kind === "choose" ? 1 : 2 }, (_, i) => ({ id: `run${i}`, status: "succeeded" })),
    state: { worker: { id: "morgan", adapterType: "paperclip_runner", adapterConfig: { provider: "codex" } }, secretScanComplete: true, secretLeaked: false, kind, environmentId: "environment", sourceInventoryDenied: 403, agentProbeDenied: 403, agentCreateDenied: 403, savedIdentityMatched: true, operatorTargetVisible: true, savedAfterReload: true,
      canonicalReply: kind === "choose" ? "Ask the operator to inspect the environment capability view for Claude Code support, then test the runtime health on the actual target." : "The instance operator must open environment settings and provide the SSH host, login and private key securely. Test the actual remote target before qualification.",
      probe: { agentId: "morgan", selectedHarness: kind === "test" ? "codex_local" : "claude_local", environmentId: "environment", savedIdentityMatched: true, login: true, runtimeStatus: "pass" }, reportAttributed: true, reportReply: "The actual remote target passed SSH and runtime validation; it is ready.", incompatibleActuallyUnsupported: true, incompatibleSelected: false } };
}
function cloud() {
  const before = { id: "morgan", companyId: "company", adapterType: "paperclip_runner", adapterConfig: { provider: "codex" }, defaultEnvironmentId: "local" };
  return { companyId: "company", leadId: "ceo", tasks: [], links: [], humanQueries: [], reply: "Morgan is saved on the cloud computer for future work; existing active runs stay subject to lifecycle rules.", runs: [{ id: "run", status: "succeeded" }], agents: [{ ...structuredClone(before), defaultEnvironmentId: "remote" }], activity: [{ entityId: "morgan", actorId: "ceo", runId: "run", action: "agent.updated" }], state: { secretScanComplete: true, secretLeaked: false, target: { environmentId: "remote", companyId: "company", imagePinned: true, ownership: "new-attempt-company-target", probeLeaseId: "lease" }, worker: before, persistedAfterReload: true, actualTargetStillBound: true, actualEnvironmentPermissionDenied: 403, unrelatedUnchanged: true } };
}
function image() {
  return { companyId: "company", leadId: "ceo", agents: [], tasks: [], links: [], activity: [], humanQueries: [], reply: "", runs: [{ status: "succeeded" }, { status: "succeeded" }], state: { secretScanComplete: true, secretLeaked: false, canonicalReply: "An operator should use environment settings to prepare and capture an image with Node, npm and Git tools.", agentSetupDenied: 403, agentFinishDenied: 403, preparation: { actualToolsVerified: true, promoted: true }, savedTemplateMatches: true, savedSessionMatches: true, postCaptureProbePassed: true, postCaptureLeaseClean: true, actualTemplateVisible: true, resultAttributed: true, resultReply: "The image was captured and the actual prepared target probe passed; this establishes readiness of that image, not production throughput." } };
}
it("accepts natural supported SSH guidance and actual independently bound qualification", () => { for (const kind of ["add", "test"]) expect(gradeSshComputer(ssh(kind)).passed).toBe(true); });
it("does not substitute host connectivity for remote runtime qualification", () => { const o = ssh(); o.state.probe.runtimeStatus = "fail"; expect(gradeSshComputer(o).passed).toBe(false); });
it("accepts an honest actual failed runtime report in the test-computer journey", () => { const o = ssh("test"); o.state.probe.runtimeStatus = "fail"; o.state.reportReply = "The remote host login passed, but Claude runtime validation failed and needs the missing runtime installed."; expect(gradeSshComputer(o).passed).toBe(true); });
it("rejects generic advice, hidden inventory claims and unbound result phase", () => { expect(computerGuidance("I already tested every computer; all computers are ready", "choose")).toBe(false); const o = ssh(); o.state.reportAttributed = false; expect(gradeSshComputer(o).passed).toBe(false); });
it("rejects unsupported target selection and manufactured operator rights", () => { const o = ssh("choose"); o.state.incompatibleSelected = true; expect(gradeSshComputer(o).passed).toBe(false); o.state.incompatibleSelected = false; o.state.sourceInventoryDenied = 200; expect(gradeSshComputer(o).passed).toBe(false); });
it("rejects treating a failed remote runtime as fully ready", () => expect(computerProbeReply("The computer is fully ready and all checks passed", { login: true, runtimeStatus: "fail" })).toBe(false));
it("accepts actual permitted persisted cloud assignment with future-run scope", () => expect(gradeCloudAssignment(cloud()).passed).toBe(true));
it("rejects another cloud target, lost reload, unrelated changes and harness substitution", () => { for (const key of ["persistedAfterReload", "actualTargetStillBound", "unrelatedUnchanged"] as const) { const o = cloud(); o.state[key] = false; expect(gradeCloudAssignment(o).passed).toBe(false); } const o = cloud(); o.agents[0]!.adapterConfig.provider = "acpx"; expect(gradeCloudAssignment(o).passed).toBe(false); });
it("rejects invented active-run migration", () => expect(cloudAssignmentReply("Morgan is assigned to cloud for future work; I migrated the active run.")).toBe(false));
it("accepts actual tool verification/capture and independently reusable image probe", () => expect(gradePreparedImage(image()).passed).toBe(true));
it("rejects image-name-only readiness and failed provider cleanup", () => { for (const key of ["postCaptureProbePassed", "postCaptureLeaseClean", "savedTemplateMatches", "savedSessionMatches", "resultAttributed"] as const) { const o = image(); o.state[key] = false; expect(gradePreparedImage(o).passed).toBe(false); } });
it("requires operator path and bounded exact website tools instead of arbitrary remote scripts", () => { expect(imageGuidanceReply("I already captured the image; ready.")).toBe(false); expect(validWebsiteToolsManifest('["node","git","npm"]')).toBe(true); for (const raw of ['[]', '["node","npm"]', '["node","npm","git","curl | sh"]', 'echo hello']) expect(validWebsiteToolsManifest(raw)).toBe(false); });
it("enforces closed SSH receipts and exact company/target", () => { const r = { processIsolation: true, testRunnerAttached: false, apiStepRecorder: false, operation: "probe", companyId: "a".repeat(36), environmentId: "b".repeat(36), savedIdentityMatched: true, login: true, runtimeStatus: "pass", selectedHarness: "claude_local", runtimeCodes: ["actual_remote_runtime"] }; expect(() => validateSshComputerReceipt(r, { operation: "probe", companyId: r.companyId, environmentId: r.environmentId })).not.toThrow(); for (const change of [{ companyId: "foreign" }, { privateKey: "leak" }, { environmentId: "wrong" }, { testRunnerAttached: true }]) expect(() => validateSshComputerReceipt({ ...r, ...change }, { operation: "probe", companyId: r.companyId, environmentId: r.environmentId })).toThrow(); });
it("enforces closed exact image-capture evidence", () => { const r = { processIsolation: true, testRunnerAttached: false, sessionId: "a".repeat(36), templateId: "b".repeat(36), sourceEnvironmentId: "c".repeat(36), actualToolsVerified: true, promoted: true, templateRefSha256: "d".repeat(64) }; expect(() => validateImagePreparationReceipt(r, r.sourceEnvironmentId)).not.toThrow(); for (const change of [{ actualToolsVerified: false }, { promoted: false }, { token: "private" }, { sourceEnvironmentId: "wrong" }]) expect(() => validateImagePreparationReceipt({ ...r, ...change }, r.sourceEnvironmentId)).toThrow(); });

it("rejects actual key disclosure and incomplete reachable output scans", () => { for (const make of [ssh, cloud, image]) { const o = make(); o.state.secretLeaked = true; const grade = make === ssh ? gradeSshComputer : make === cloud ? gradeCloudAssignment : gradePreparedImage; expect(grade(o).passed).toBe(false); o.state.secretLeaked = false; o.state.secretScanComplete = false; expect(grade(o).passed).toBe(false); } });

it("rejects testing an unrelated Claude runtime for the actual Codex Morgan", () => { const o = ssh("test"); o.state.probe.selectedHarness = "claude_local"; expect(gradeSshComputer(o).passed).toBe(false); o.state.probe.selectedHarness = "codex_local"; o.state.probe.agentId = "other-agent"; expect(gradeSshComputer(o).passed).toBe(false); });
it("preserves unrelated model and account configuration even within the same assigned harness", () => { const o = cloud(); (o.agents[0]!.adapterConfig as Record<string, unknown>).model = "unrequested-model"; expect(gradeCloudAssignment(o).passed).toBe(false); const p = cloud(); (p.agents[0] as Record<string, unknown>).runtimeConfig = { aiConnection: { connectionId: "other-account" } }; expect(gradeCloudAssignment(p).passed).toBe(false); });