AgentServer/apps/server/test/codex.test.ts

import os from 'node:os'
import fs from 'node:fs'
import path from 'node:path'
import { describe, expect, it } from 'vitest'
import type { AgentEventType, EventPayloads } from '@agent-server/shared'
import { config } from '../src/config'
import { CodexProvider } from '../src/providers/codex/adapter'
import { NO_CODEX_PLUGINS, type CodexPluginGrant, type RunContext } from '../src/providers/types'
import { resolveAccess } from '../src/services/access-policy'
import type { InteractionOutcome, NewApproval, NewQuestion } from '../src/services/interactions'
import { defaultSettings } from '../src/services/settings'

const fake = path.resolve(__dirname, 'fixtures-fake-codex.mjs')
const settings = defaultSettings()
settings.providers.codex = { ...settings.providers.codex, enabled: true, cliPath: fake }
const silent = { info: () => {}, warn: () => {}, error: () => {} }

function makeCtx(text: string, opts: { providerSessionId?: string; mode?: 'ask' | 'auto' | 'readonly'; answer?: (r: NewApproval | NewQuestion) => InteractionOutcome; signal?: AbortSignal; codexPlugins?: CodexPluginGrant } = {}) {
  const ws = path.join(config.dataDir, 'workspaces', `ses_codex_${Math.random().toString(36).slice(2)}`)
  fs.mkdirSync(ws, { recursive: true })
  const events: { type: AgentEventType; payload: unknown }[] = []
  const interactions: (NewApproval | NewQuestion)[] = []
  const audits: string[] = []
  let sessionId: string | null = null
  const ctx: RunContext = {
    sessionId: 's', runId: 'r', model: 'gpt-test', permissionMode: opts.mode ?? 'ask', providerSessionId: opts.providerSessionId ?? null,
    workspaceDir: ws, systemPromptAppend: '说明', allowedTools: [], disallowedTools: [], skills: 'all', plugins: [], codexPlugins: opts.codexPlugins ?? NO_CODEX_PLUGINS, skillsExcludedFromAll: [],
    gateway: { url: 'http://127.0.0.1:9/mcp', token: 'rt_test' },
    input: { text, images: [], attachments: [] },
    access: resolveAccess({ policy: { mode: 'restricted', read: [], write: [], deny: ['**/*.env'] }, knowledgeRoots: [], selectedKnowledgeRootIds: [], workspaceDir: ws, settings }),
    settings, signal: opts.signal ?? new AbortController().signal,
    emit: <T extends AgentEventType>(type: T, payload: EventPayloads[T]) => { events.push({ type, payload }) },
    interact: async r => { interactions.push(r); return opts.answer?.(r) ?? { resolution: 'allowed', scope: 'once' } },
    setProviderSessionId: id => { sessionId = id },
    audit: (kind, summary) => audits.push(`${kind}:${summary}`),
    log: silent,
  }
  return { ctx, events, interactions, audits, sessionId: () => sessionId }
}

describe('CodexProvider（模拟 app-server）', () => {
  const provider = new CodexProvider(silent)

  it('映射文本、命令与审批、用量；传入按 Profile 生成的权限配置', async () => {
    const t = makeCtx('请执行命令')
    const r = await provider.run(t.ctx)
    expect(t.sessionId()).toMatch(/^t-/)
    const types = t.events.map(e => e.type)
    expect(types).toEqual(expect.arrayContaining(['tool.started', 'tool.completed', 'message.delta', 'message.completed']))
    expect(t.interactions[0]).toMatchObject({ kind: 'approval', tool: 'Bash', detail: { command: 'ls -la' } })
    expect(t.events.find(e => e.type === 'tool.completed')!.payload).toMatchObject({ status: 'ok', output: 'a.csv' })
    // 本次用量 = 最新累计 - (首次累计 - 首次增量) = 220-100, 45-20
    // 上下文大小取最后一次调用的输入 + 输出
    expect(r.usage).toEqual({ inputTokens: 120, outputTokens: 25, cacheReadTokens: 0, cacheWriteTokens: 0, contextTokens: 85 })

    const cfg = JSON.parse((t.events.find(e => e.type === 'message.completed' && (e.payload as { messageId: string }).messageId === 'cfg')!.payload as { text: string }).text)
    const fsTable = cfg.permissions.agent_server.filesystem
    expect(cfg.default_permissions).toBe('agent_server')
    expect(fsTable[':root']).toBe('deny')
    expect(fsTable[':workspace_roots']).toEqual({ '.': 'write', '**/*.env': 'deny' })
    expect(fsTable[path.join(config.home, '.ssh')]).toBe('deny')
    expect(cfg.permissions.agent_server.network.enabled).toBe(false)
    expect(cfg.shell_environment_policy.inherit).toBe('core')
    // Profile 选择 all：禁用始终禁用的系统技能；没有开放插件时远程插件的技能也禁用
    expect(cfg.skills).toEqual({ config: [
      { path: '/sys/skill-installer/SKILL.md', enabled: false }, { path: '/plugins/google-drive/skills/google-docs/SKILL.md', enabled: false },
    ] })
    // 插件、应用连接器、插件安装建议与子代理在服务中关闭
    expect(cfg.features).toMatchObject({ plugins: false, remote_plugin: false, apps: false, tool_suggest: false, multi_agent: false })
    expect(cfg.apps._default.enabled).toBe(false)
    expect(cfg.agents).toEqual({ enabled: false })
    // 网关以 HTTP MCP 方式配置，携带本次 Run 的令牌
    expect(cfg.mcp_servers.gateway).toMatchObject({ url: 'http://127.0.0.1:9/mcp', http_headers: { Authorization: 'Bearer rt_test' }, default_tools_approval_mode: 'approve' })
  })

  it('Playground：开放插件与应用连接器，应用调用确认转为审批卡片', async () => {
    const t = makeCtx('调用应用', { codexPlugins: 'all' })
    await provider.run(t.ctx)
    const cfg = JSON.parse((t.events.find(e => (e.payload as { messageId?: string }).messageId === 'cfg')!.payload as { text: string }).text)
    expect(cfg.features).toMatchObject({ plugins: true, remote_plugin: true, apps: true, tool_suggest: false, multi_agent: false })
    expect(cfg.apps._default.enabled).toBe(true)
    // Playground 中子代理同样关闭
    expect(cfg.agents).toEqual({ enabled: false })
    expect(cfg.skills).toEqual({ config: [{ path: '/sys/skill-installer/SKILL.md', enabled: false }] })
    expect(t.interactions[0]).toMatchObject({ kind: 'approval', tool: 'mcp__codex_apps', title: '允许调用 Gmail 的 search_emails？' })
    expect(t.events.some(e => (e.payload as { text?: string }).text === 'app:accept')).toBe(true)
  })

  it('Profile 勾选的插件：只启用这些插件的应用与技能，应用调用确认转为审批卡片', async () => {
    const t = makeCtx('调用应用', { codexPlugins: { pluginIds: ['google-drive@openai-curated-remote'], appIds: ['connector_drive'] } })
    await provider.run(t.ctx)
    const cfg = JSON.parse((t.events.find(e => (e.payload as { messageId?: string }).messageId === 'cfg')!.payload as { text: string }).text)
    expect(cfg.features).toMatchObject({ plugins: true, remote_plugin: true, apps: true, tool_suggest: false })
    expect(cfg.apps).toEqual({ _default: { enabled: false, destructive_enabled: false, open_world_enabled: false }, connector_drive: { enabled: true } })
    // 勾选的插件带来的技能保留
    expect(cfg.skills).toEqual({ config: [{ path: '/sys/skill-installer/SKILL.md', enabled: false }] })
    expect(t.interactions[0]).toMatchObject({ kind: 'approval', tool: 'mcp__codex_apps' })

    const other = makeCtx('调用应用', { codexPlugins: { pluginIds: ['gmail@openai-curated-remote'], appIds: ['connector_gmail'] } })
    await provider.run(other.ctx)
    const cfg2 = JSON.parse((other.events.find(e => (e.payload as { messageId?: string }).messageId === 'cfg')!.payload as { text: string }).text)
    // 未勾选的插件（google-drive）的技能被禁用
    expect(cfg2.skills.config.map((s: { path: string }) => s.path)).toContain('/plugins/google-drive/skills/google-docs/SKILL.md')
  })

  it('API 会话：应用调用确认直接拒绝', async () => {
    const t = makeCtx('调用应用')
    await provider.run(t.ctx)
    expect(t.interactions).toHaveLength(0)
    expect(t.events.some(e => (e.payload as { text?: string }).text === 'app:decline')).toBe(true)
  })

  it('插件目录：只列出 openai-curated，搜索、安装、卸载', async () => {
    const { CodexPluginService } = await import('../src/services/codex-plugins')
    const audits: string[] = []
    const svc = new CodexPluginService(() => provider, () => settings, s => audits.push(s))
    const all = await svc.catalog({})
    expect(all.items.map(p => [p.name, p.installed])).toEqual([['gmail', true], ['notion', false], ['blocked', false]])
    expect(all.categories).toEqual(['Docs', 'Productivity'])
    expect((await svc.catalog({ query: 'notion' })).items.map(p => p.displayName)).toEqual(['Notion'])
    expect((await svc.catalog({ installed: true })).total).toBe(1)
    expect(await svc.install('notion')).toEqual({ appsNeedingAuth: [{ id: 'connector_n', name: 'Notion', installUrl: 'https://chatgpt.com/apps/notion' }] })
    await expect(svc.install('blocked')).rejects.toThrow(/不可安装/)
    // Codex 的错误原样转出（502），不是"服务器内部错误"
    await expect((svc as unknown as { call: (m: string, p: unknown) => Promise<unknown> }).call('plugin/install', { remoteMarketplaceName: 'openai-curated-remote', pluginName: 'notion' }))
      .rejects.toMatchObject({ status: 502, code: 'codex_error', message: expect.stringContaining('Plugin not found') })
    await expect(svc.install('other-plugin')).rejects.toThrow(/不存在/)
    await expect(svc.install('../x')).rejects.toThrow(/格式/)
    // Profile 勾选的插件 → 开放的插件与应用（未安装的忽略）
    expect(await svc.grant(['gmail@openai-curated-remote', 'notion@openai-curated-remote'])).toEqual({ pluginIds: ['gmail@openai-curated-remote'], appIds: ['connector_gmail'] })
    expect(await svc.grant([])).toEqual({ pluginIds: [], appIds: [] })
    await svc.uninstall('gmail')
    expect((await svc.catalog({})).items.find(p => p.name === 'gmail')!.installed).toBe(false)
    expect(audits).toEqual(['安装 Codex 插件 Notion（notion@openai-curated-remote）', '卸载 Codex 插件 GMAIL（gmail@openai-curated-remote）'])
  })

  it('拒绝审批时工具标记为 denied', async () => {
    const t = makeCtx('请执行命令', { answer: () => ({ resolution: 'denied' }) })
    await provider.run(t.ctx)
    expect(t.events.find(e => e.type === 'tool.completed')!.payload).toMatchObject({ status: 'denied' })
  })

  it('命令联网请求一律拒绝并审计，不打扰用户', async () => {
    const t = makeCtx('需要联网')
    await provider.run(t.ctx)
    expect(t.interactions).toHaveLength(0)
    expect(t.events.some(e => (e.payload as { text?: string }).text === 'network:decline')).toBe(true)
    expect(t.audits.some(a => a.startsWith('network_denied'))).toBe(true)
  })

  it('提问映射为问题卡片，回答按 questionId 返回', async () => {
    const t = makeCtx('请提问', { answer: () => ({ resolution: 'answered', answers: { chart: '折线图' } }) })
    await provider.run(t.ctx)
    expect(t.interactions[0]).toMatchObject({ kind: 'question', questions: [{ id: 'chart', options: [{ label: '柱状图' }, { label: '折线图' }] }] })
    expect(t.events.some(e => (e.payload as { text?: string }).text === 'answer:{"chart":{"answers":["折线图"]}}')).toBe(true)
  })

  it('同一会话配置不变时沿用；配置变化时分叉出新会话并采用新配置', async () => {
    const t1 = makeCtx('你好')
    await provider.run(t1.ctx)
    const first = t1.sessionId()!
    const t2 = makeCtx('你好', { providerSessionId: first })
    t2.ctx.workspaceDir = t1.ctx.workspaceDir
    t2.ctx.access = t1.ctx.access
    await provider.run(t2.ctx)
    expect(t2.sessionId()).toBeNull() // 未改变会话 ID

    // 改为只读：工作区权限从 write 变为 read
    const t3 = makeCtx('你好', { providerSessionId: first, mode: 'readonly' })
    t3.ctx.workspaceDir = t1.ctx.workspaceDir
    t3.ctx.access = t1.ctx.access
    await provider.run(t3.ctx)
    expect(t3.sessionId()).toMatch(/^f-/)
    const cfg = JSON.parse((t3.events.find(e => (e.payload as { messageId?: string }).messageId === 'cfg')!.payload as { text: string }).text)
    expect(cfg.permissions.agent_server.filesystem[':workspace_roots']['.']).toBe('read')
  })

  it('恢复不存在的会话时新建；中断正在运行的 turn', async () => {
    const t = makeCtx('你好', { providerSessionId: 't-999' })
    await provider.run(t.ctx)
    expect(t.sessionId()).toMatch(/^t-\d+$/)
    expect(t.sessionId()).not.toBe('t-999')

    const ac = new AbortController()
    const t2 = makeCtx('等待', { signal: ac.signal })
    const p = provider.run(t2.ctx)
    setTimeout(() => ac.abort(), 200)
    await expect(p).rejects.toThrow(/中断/)
  })

  it('设备码登录、账户状态与模型列表', async () => {
    const before = await provider.status(settings)
    expect(before.loggedIn).toBe(false)
    const login = await provider.startLogin(settings)
    expect(login).toMatchObject({ verificationUrl: 'https://auth.example.com/device', userCode: 'ABCD-1234', status: 'pending' })
    await new Promise(r => setTimeout(r, 300))
    expect(provider.loginState()?.status).toBe('success')
    const after = await provider.status(settings)
    expect(after).toMatchObject({ loggedIn: true, available: true, account: 'me@example.com (plus)', version: '9.9.9', models: ['gpt-test'] })
    expect(provider.knownModels()).toEqual(['gpt-test'])
  })
})

describe('commandTitle', () => {
  it('去掉 Codex 的 shell 包装', async () => {
    const { commandTitle } = await import('../src/providers/codex/adapter')
    expect(commandTitle(`/usr/bin/bash -lc "python - <<'PY'\nimport x\nPY"`)).toBe(`python - <<'PY'`)
    expect(commandTitle(`/usr/bin/bash -lc 'curl -I https://example.com'`)).toBe('curl -I https://example.com')
    expect(commandTitle('ls -la')).toBe('ls -la')
  })
})

describe('Codex 权限：父目录禁止、子路径可读', () => {
  it('denyAround：逐层展开，只留下通往可读路径的目录', async () => {
    const { denyAround } = await import('../src/providers/codex/permissions')
    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'deny-'))
    for (const d of ['data/custom-skills/skills', 'data/community-skills', 'data/mcp', 'workspaces/a']) fs.mkdirSync(path.join(root, d), { recursive: true })
    fs.writeFileSync(path.join(root, 'data', 'agent.db'), '')
    const keep = [path.join(root, 'data', 'custom-skills'), path.join(root, 'data', 'community-skills')]
    expect(denyAround(path.join(root, 'data'), keep).map(p => path.relative(root, p)).sort()).toEqual(['data/agent.db', 'data/mcp'])
    expect(denyAround(root, keep).map(p => path.relative(root, p)).sort()).toEqual(['data/agent.db', 'data/mcp', 'workspaces'])
    expect(denyAround(path.join(root, 'workspaces'), keep)).toEqual([path.join(root, 'workspaces')])
  })
})