PaperClipAI/packages/adapter-utils/src/runner-connectivity.test.ts

import { describe, expect, it, vi } from "vitest";
import type { AdapterExecutionTarget } from "./execution-target.js";
import {
  buildDirectRunnerConnectUrl,
  resolvePaperclipRunnerTransport,
  type RunnerIngressEndpoint,
} from "./runner-connectivity.js";

const capabilities = {
  reusableLeases: false,
  nativeSyncIn: false,
  nativeSyncOut: false,
  persistentProcessSessions: true,
  independentControlCommands: true,
  incrementalSessionOutput: true,
  concurrentSyncOperations: false,
  duplexCommandStream: false,
  runnerWebSocketIngress: true,
} as const;

function ingress(): RunnerIngressEndpoint {
  const endpoint: RunnerIngressEndpoint = {
    kind: "authenticated_websocket",
    websocketUrl:
      "wss://43127-sandbox.proxy.daytona.test/api/runner/v1/connect/00000000-0000-4000-8000-000000000001",
    secretHeaders: [{ name: "X-Daytona-Preview-Token", value: "secret" }],
    generation: "generation-1",
    refresh: async () => endpoint,
    close: async () => undefined,
  };
  return endpoint;
}

describe("paperclip runner transport routing", () => {
  it("keeps same-host runnerd on plaintext loopback", async () => {
    const result = await resolvePaperclipRunnerTransport({
      target: { kind: "local" },
      runId: "00000000-0000-4000-8000-000000000001",
      localConnectUrl:
        "ws://127.0.0.1:3100/api/runner/v1/connect/00000000-0000-4000-8000-000000000001",
      runnerIngressAuthorized: false,
    });
    expect(result.mode).toBe("local_loopback");
  });

  it("selects provider ingress for Daytona-style capability even when a public URL exists", async () => {
    const getRunnerIngressEndpoint = vi.fn(async () => ingress());
    const target: AdapterExecutionTarget = {
      kind: "remote",
      transport: "sandbox",
      providerKey: "daytona",
      remoteCwd: "/workspace",
      leaseId: "lease-1",
      effectiveCapabilities: capabilities,
      getRunnerIngressEndpoint,
    };
    const result = await resolvePaperclipRunnerTransport({
      target,
      runId: "00000000-0000-4000-8000-000000000001",
      localConnectUrl: "ws://127.0.0.1/unused",
      runnerPublicUrl: "wss://paperclip.example.test",
      runnerIngressAuthorized: true,
    });
    expect(result.mode).toBe("provider_ingress");
    expect(getRunnerIngressEndpoint).toHaveBeenCalledOnce();
  });

  it("accepts the deprecated ingress input alias for existing consumers", async () => {
    const target: AdapterExecutionTarget = {
      kind: "remote",
      transport: "sandbox",
      providerKey: "daytona",
      remoteCwd: "/workspace",
      leaseId: "lease-legacy",
      effectiveCapabilities: capabilities,
      getRunnerIngressEndpoint: vi.fn(async () => ingress()),
    };

    const result = await resolvePaperclipRunnerTransport({
      target,
      runId: "00000000-0000-4000-8000-000000000001",
      localConnectUrl: "ws://127.0.0.1/unused",
      enableRunnerPreviewIngress: true,
    });

    expect(result.mode).toBe("provider_ingress");
  });

  it("lets resolved authorization override the deprecated ingress alias", async () => {
    const getRunnerIngressEndpoint = vi.fn(async () => ingress());
    const target: AdapterExecutionTarget = {
      kind: "remote",
      transport: "sandbox",
      providerKey: "daytona",
      remoteCwd: "/workspace",
      leaseId: "lease-1",
      effectiveCapabilities: capabilities,
      getRunnerIngressEndpoint,
    };
    await expect(
      resolvePaperclipRunnerTransport({
        target,
        runId: "00000000-0000-4000-8000-000000000001",
        localConnectUrl: "ws://127.0.0.1/unused",
        runnerPublicUrl: "wss://paperclip.example.test",
        runnerIngressAuthorized: false,
        enableRunnerPreviewIngress: true,
      }),
    ).rejects.toMatchObject({ code: "runner_ingress_unavailable" });
    const missingAuthorization = {
      target,
      runId: "00000000-0000-4000-8000-000000000002",
      localConnectUrl: "ws://127.0.0.1/unused",
    } as Parameters<typeof resolvePaperclipRunnerTransport>[0];
    await expect(
      resolvePaperclipRunnerTransport(missingAuthorization),
    ).rejects.toMatchObject({ code: "runner_ingress_unavailable" });
    expect(getRunnerIngressEndpoint).not.toHaveBeenCalled();
  });

  it("selects direct WSS only for a remote target with an explicit URL", async () => {
    const target: AdapterExecutionTarget = {
      kind: "remote",
      transport: "ssh",
      remoteCwd: "/workspace",
      spec: {
        host: "runner.internal",
        port: 22,
        username: "runner",
        remoteWorkspacePath: "/workspace",
        remoteCwd: "/workspace",
        privateKey: null,
        knownHosts: null,
        strictHostKeyChecking: true,
      },
    };
    const result = await resolvePaperclipRunnerTransport({
      target,
      runId: "00000000-0000-4000-8000-000000000001",
      localConnectUrl: "ws://127.0.0.1/unused",
      runnerPublicUrl: "wss://paperclip.example.test/runner-base/",
      runnerCaBundlePath: "/etc/paperclip/runner-ca.pem",
      runnerIngressAuthorized: false,
    });
    expect(result).toEqual({
      mode: "direct_outbound",
      connectUrl:
        "wss://paperclip.example.test/runner-base/api/runner/v1/connect/00000000-0000-4000-8000-000000000001",
      caBundlePath: "/etc/paperclip/runner-ca.pem",
    });
  });

  it("fails the selected ingress mode without falling through to direct WSS", async () => {
    const target: AdapterExecutionTarget = {
      kind: "remote",
      transport: "sandbox",
      providerKey: "daytona",
      remoteCwd: "/workspace",
      leaseId: "lease-1",
      effectiveCapabilities: capabilities,
      getRunnerIngressEndpoint: async () => {
        throw new Error("preview unavailable");
      },
    };
    await expect(
      resolvePaperclipRunnerTransport({
        target,
        runId: "00000000-0000-4000-8000-000000000001",
        localConnectUrl: "ws://127.0.0.1/unused",
        runnerPublicUrl: "wss://paperclip.example.test",
        runnerIngressAuthorized: true,
      }),
    ).rejects.toThrow("preview unavailable");
  });

  it("never routes Daytona through direct outbound when ingress capability is unavailable", async () => {
    const target: AdapterExecutionTarget = {
      kind: "remote",
      transport: "sandbox",
      providerKey: "daytona",
      remoteCwd: "/workspace",
      leaseId: "lease-1",
      effectiveCapabilities: {
        ...capabilities,
        runnerWebSocketIngress: false,
      },
    };
    await expect(
      resolvePaperclipRunnerTransport({
        target,
        runId: "00000000-0000-4000-8000-000000000001",
        localConnectUrl: "ws://127.0.0.1/unused",
        runnerPublicUrl: "wss://paperclip.example.test",
        runnerIngressAuthorized: true,
      }),
    ).rejects.toMatchObject({ code: "runner_ingress_unavailable" });
  });

  it.each([
    "ws://paperclip.example.test",
    "wss://user@paperclip.example.test",
    "wss://paperclip.example.test?token=secret",
    "wss://paperclip.example.test#fragment",
  ])("rejects unsafe direct runner URL %s", (runnerPublicUrl) => {
    expect(() =>
      buildDirectRunnerConnectUrl({
        runnerPublicUrl,
        runId: "00000000-0000-4000-8000-000000000001",
      }),
    ).toThrow();
  });
});

it("uses each computer owner's allocated port without changing the sandbox default", async () => {
  const { adapterExecutionTargetIsCommandBacked } = await import("./execution-target.js");
  const endpoint = ingress();
  const getRunnerIngressEndpoint = vi.fn(async () => endpoint);
  const base = {
    kind: "remote" as const, transport: "computer" as const, providerKey: "boat", remoteCwd: "/home/user/project",
    leaseId: "attempt-lease", listenerPort: 45101, effectiveCapabilities: capabilities, getRunnerIngressEndpoint,
    processRunner: { execute: async () => ({ exitCode: 0, signal: null, timedOut: false, stdout: "", stderr: "", pid: null, startedAt: new Date().toISOString() }) },
    resourceAuthority: { kind: "computer-owner" as const, computerId: "machine", ownerId: "owner-a", generation: 2 },
    fileAuthority: { kind: "remote-persistent" as const, placementId: "placement", root: "/home/user/project", agentHome: "/home/user/agent-a" },
    launch: async () => ({}), inspectProcess: async () => ({ running: true, claim: {} }),
    retainWarm: async () => {}, retire: async () => true, computerTool: { command: "cua-driver", args: ["mcp"] },
  };
  expect(adapterExecutionTargetIsCommandBacked(base)).toBe(true);
  for (const port of [45101, 45102]) {
    const resolved = await resolvePaperclipRunnerTransport({ target: { ...base, listenerPort: port }, runId: "run-1",
      localConnectUrl: "ws://localhost/unused", runnerIngressAuthorized: true });
    expect(resolved).toMatchObject({ mode: "provider_ingress", listenPort: port });
    expect(getRunnerIngressEndpoint).toHaveBeenLastCalledWith({ leaseId: "attempt-lease", port, path: "/api/runner/v1/connect/run-1" });
  }
  const { listenerPort, processRunner, resourceAuthority, fileAuthority, launch, inspectProcess, retainWarm, retire, computerTool, ...common } = base;
  const resolved = await resolvePaperclipRunnerTransport({ target: { ...common, transport: "sandbox" }, runId: "sandbox-run",
    localConnectUrl: "ws://localhost/unused", runnerIngressAuthorized: true });
  expect(resolved).toMatchObject({ mode: "provider_ingress", listenPort: 43127 });
});