tenant.openagents/omega

1//! omega#81 / `OMEGA-DELTA-0025`, through a filesystem.
2//!
3//! `crates/omega_harness` proves the decisions. These prove that the code which
4//! actually stands between an installed harness and a spawned process reads the
5//! same ledger, measures the same bytes, and refuses in the same cases — on a
6//! filesystem, across independent calls that share nothing but the disk.
7
8use std::{path::Path, sync::Arc};
9
10use fs::{FakeFs, Fs};
11use gpui::TestAppContext;
12use omega_harness::{
13    HarnessDistribution, HarnessPinLedger, LoadedPinLedger, MaintenanceAction, MeasuredDigest,
14    PinControl, PinState, encode_harness_pin_ledger, latest_record_for,
15};
16use project::harness_maintenance::{
17    NPX_RESOLVER, authorize_installed_harness, authorize_package_manager_launch,
18    authorize_version_fetch, load_pin_ledger, measure_installed_tree, pin_installed_harness,
19    pin_ledger_path, read_front_door_state, receipt_log_path, reprobe_installed_harness,
20    resolve_channel, unpin_harness,
21};
22
23const HARNESS: &str = "codex-acp";
24
25fn install_dir() -> std::path::PathBuf {
26    paths::external_agents_dir()
27        .join("registry")
28        .join(HARNESS)
29        .join("v_0.9.4_abc_def")
30}
31
32async fn install(fs: &Arc<FakeFs>, binary: &[u8]) {
33    let dir = install_dir();
34    fs.create_dir(&dir).await.expect("install directory");
35    fs.insert_file(dir.join("codex-acp"), binary.to_vec()).await;
36    fs.insert_file(dir.join("LICENSE"), b"GPL".to_vec()).await;
37}
38
39async fn write_pin(fs: &Arc<FakeFs>, version: &str, digest: &MeasuredDigest) {
40    let mut ledger = HarnessPinLedger::empty();
41    ledger.set_pin(HARNESS, version, digest);
42    let path = pin_ledger_path();
43    fs.create_dir(path.parent().expect("parent"))
44        .await
45        .expect("ledger directory");
46    fs.write(
47        &path,
48        encode_harness_pin_ledger(&ledger).expect("encodes").as_bytes(),
49    )
50    .await
51    .expect("the ledger is written");
52}
53
54async fn receipt_log(fs: &Arc<FakeFs>) -> String {
55    fs.load(&receipt_log_path()).await.unwrap_or_default()
56}
57
58#[gpui::test]
59async fn a_measured_tree_binds_every_file_in_it(cx: &mut TestAppContext) {
60    let fs = FakeFs::new(cx.executor());
61    install(&fs, b"binary v0.9.4").await;
62
63    let first = measure_installed_tree(fs.as_ref(), &install_dir())
64        .await
65        .expect("an installed tree measures");
66    let again = measure_installed_tree(fs.as_ref(), &install_dir())
67        .await
68        .expect("measuring twice agrees");
69    assert_eq!(first, again);
70
71    // One byte of the executable.
72    fs.insert_file(install_dir().join("codex-acp"), b"binary v0.9.5".to_vec())
73        .await;
74    let swapped = measure_installed_tree(fs.as_ref(), &install_dir())
75        .await
76        .expect("measures");
77    assert_ne!(first, swapped);
78
79    // A file beside the executable, which a single-file digest would miss.
80    fs.insert_file(install_dir().join("codex-acp"), b"binary v0.9.4".to_vec())
81        .await;
82    fs.insert_file(install_dir().join("plugin.so"), b"extra".to_vec())
83        .await;
84    let with_sidecar = measure_installed_tree(fs.as_ref(), &install_dir())
85        .await
86        .expect("measures");
87    assert_ne!(
88        first, with_sidecar,
89        "a file added beside the executable must change the tree digest"
90    );
91}
92
93#[gpui::test]
94async fn a_tree_that_is_not_there_measures_nothing(cx: &mut TestAppContext) {
95    let fs = FakeFs::new(cx.executor());
96    assert_eq!(
97        measure_installed_tree(fs.as_ref(), &install_dir()).await,
98        None
99    );
100}
101
102/// The acceptance sentence's first half: installing is one action and produces
103/// a receipt bound to the bytes that will run.
104#[gpui::test]
105async fn an_install_on_a_clean_machine_produces_a_receipt(cx: &mut TestAppContext) {
106    let fs = FakeFs::new(cx.executor());
107    install(&fs, b"binary v0.9.4").await;
108
109    let digest = authorize_installed_harness(
110        fs.clone(),
111        HARNESS,
112        "0.9.4",
113        &install_dir(),
114        MaintenanceAction::Install,
115        1_784_894_400_000,
116    )
117    .await
118    .expect("an unpinned install is permitted");
119
120    let log = receipt_log(&fs).await;
121    assert_eq!(log.lines().count(), 1, "one action, one record");
122    assert!(log.contains(digest.as_str()), "the receipt binds the digest");
123    assert!(log.contains("\"action\":\"install\""));
124    assert!(!log.contains("/Users/"), "a receipt carries no path");
125
126    let provenance = latest_record_for(&log, HARNESS);
127    assert_eq!(
128        omega_harness::verify_installation(&provenance, &digest),
129        omega_harness::ProvenanceVerdict::Verified {
130            digest: digest.as_str().to_string()
131        }
132    );
133}
134
135/// The acceptance sentence's second half, and the falsifier: a pinned harness
136/// whose bytes were replaced does not run, the refusal names why, and it is
137/// recorded.
138#[gpui::test]
139async fn a_pinned_harness_whose_bytes_changed_does_not_run(cx: &mut TestAppContext) {
140    let fs = FakeFs::new(cx.executor());
141    install(&fs, b"binary v0.9.4").await;
142    let installed = measure_installed_tree(fs.as_ref(), &install_dir())
143        .await
144        .expect("measures");
145    write_pin(&fs, "0.9.4", &installed).await;
146
147    // Still the pinned bytes: permitted.
148    authorize_installed_harness(
149        fs.clone(),
150        HARNESS,
151        "0.9.4",
152        &install_dir(),
153        MaintenanceAction::Verify,
154        1_784_894_400_000,
155    )
156    .await
157    .expect("a pin freezes a harness, it does not disable it");
158
159    // The release is re-tagged in place: same version, different bytes.
160    fs.insert_file(
161        install_dir().join("codex-acp"),
162        b"binary v0.9.4, rebuilt".to_vec(),
163    )
164    .await;
165
166    let error = authorize_installed_harness(
167        fs.clone(),
168        HARNESS,
169        "0.9.4",
170        &install_dir(),
171        MaintenanceAction::Verify,
172        1_784_894_400_001,
173    )
174    .await
175    .expect_err("substituted bytes must not run");
176    let reason = error.to_string();
177    assert!(reason.contains("0.9.4"), "{reason:?}");
178    assert!(reason.contains("replaced"), "{reason:?}");
179    assert!(!reason.contains('/'), "{reason:?} carries a path");
180
181    let log = receipt_log(&fs).await;
182    assert!(log.contains("\"reasonClass\":\"pinned_digest\""), "{log}");
183    assert_eq!(
184        log.lines().count(),
185        2,
186        "the refusal is recorded, not only raised"
187    );
188}
189
190/// A pin blocks the fetch as well as the run, so a frozen harness does not
191/// quietly download the release the registry now advertises.
192#[gpui::test]
193async fn a_pin_blocks_the_fetch_of_a_different_version(cx: &mut TestAppContext) {
194    let fs = FakeFs::new(cx.executor());
195    write_pin(&fs, "0.9.4", &MeasuredDigest::measure(b"pinned tree")).await;
196
197    let error = authorize_version_fetch(fs.clone(), HARNESS, "0.9.5", 1_784_894_400_000)
198        .await
199        .expect_err("a pinned harness does not fetch a different version");
200    let reason = error.to_string();
201    assert!(reason.contains("0.9.4") && reason.contains("0.9.5"), "{reason:?}");
202
203    authorize_version_fetch(fs.clone(), HARNESS, "0.9.4", 1_784_894_400_001)
204        .await
205        .expect("the pinned version itself is still fetchable");
206
207    authorize_version_fetch(fs.clone(), "gemini-cli", "2.0.0", 1_784_894_400_002)
208        .await
209        .expect("an unpinned harness is unaffected");
210
211    let log = receipt_log(&fs).await;
212    assert_eq!(
213        log.lines().count(),
214        1,
215        "only the refusal is a maintenance action"
216    );
217    assert!(log.contains("\"reasonClass\":\"pinned_version\""), "{log}");
218}
219
220/// Nothing in the enforcement path holds the ledger between calls, so the pin
221/// is re-read from disk every time it is consulted. That is the same statement
222/// as surviving a restart, and this asserts it against a filesystem: a second
223/// independent call, sharing nothing with the first, still refuses.
224#[gpui::test]
225async fn the_pin_is_re_read_from_disk_on_every_decision(cx: &mut TestAppContext) {
226    let fs = FakeFs::new(cx.executor());
227    install(&fs, b"binary v0.9.4").await;
228    write_pin(&fs, "0.9.4", &MeasuredDigest::measure(b"different bytes")).await;
229
230    for attempt in 0..3 {
231        authorize_installed_harness(
232            fs.clone(),
233            HARNESS,
234            "0.9.4",
235            &install_dir(),
236            MaintenanceAction::Verify,
237            1_784_894_400_000 + attempt,
238        )
239        .await
240        .expect_err("the pin holds across independent calls");
241    }
242
243    // And removing the ledger unfreezes it — the pin is that file and nothing
244    // else, so the refusal was not coming from somewhere it could not be undone.
245    fs.remove_file(&pin_ledger_path(), Default::default())
246        .await
247        .expect("the ledger is removed");
248    authorize_installed_harness(
249        fs.clone(),
250        HARNESS,
251        "0.9.4",
252        &install_dir(),
253        MaintenanceAction::Verify,
254        1_784_894_400_010,
255    )
256    .await
257    .expect("an unpinned harness runs");
258}
259
260/// A corrupt ledger is not an absent one. Truncating the file must not be a way
261/// to unfreeze every harness on the machine.
262#[gpui::test]
263async fn a_corrupt_ledger_refuses_rather_than_reading_as_unpinned(cx: &mut TestAppContext) {
264    let fs = FakeFs::new(cx.executor());
265    install(&fs, b"binary v0.9.4").await;
266    let path = pin_ledger_path();
267    fs.create_dir(path.parent().expect("parent"))
268        .await
269        .expect("directory");
270    fs.write(&path, b"{ \"schema\": \"openagents.omega.harness.pins.v1\", \"pins\": [")
271        .await
272        .expect("written");
273
274    assert_eq!(
275        load_pin_ledger(fs.as_ref(), &path).await.pin_state(HARNESS),
276        PinState::Unreadable
277    );
278    let error = authorize_installed_harness(
279        fs.clone(),
280        HARNESS,
281        "0.9.4",
282        &install_dir(),
283        MaintenanceAction::Verify,
284        1_784_894_400_000,
285    )
286    .await
287    .expect_err("an unreadable ledger fails closed");
288    assert!(error.to_string().contains("pin ledger"), "{error}");
289}
290
291#[gpui::test]
292async fn a_missing_ledger_file_is_absent_rather_than_unreadable(cx: &mut TestAppContext) {
293    let fs = FakeFs::new(cx.executor());
294    assert_eq!(
295        load_pin_ledger(fs.as_ref(), Path::new("/nowhere/omega-harness-pins.json")).await,
296        LoadedPinLedger::Absent
297    );
298}
299
300// ---------------------------------------------------------------------------
301// The owner's controls. omega#81 deliverable 4, `OMEGA-DELTA-0033`.
302//
303// The first landing of omega#81 could decide all of this and could not do any
304// of it: the ledger was a JSON file with no writer in production. These prove
305// the two controls the front door offers move the same ledger the gate reads.
306// ---------------------------------------------------------------------------
307
308#[gpui::test]
309async fn a_pin_taken_from_the_front_door_blocks_the_next_version(cx: &mut TestAppContext) {
310    let fs = FakeFs::new(cx.executor());
311    install(&fs, b"binary v0.9.4").await;
312
313    pin_installed_harness(fs.clone(), HARNESS, "0.9.4", &install_dir(), 1_784_894_400_000)
314        .await
315        .expect("a measurable tree can be pinned");
316
317    // The pin the control wrote is the pin the gate reads: same file, same
318    // reader, no shared process state.
319    let ledger = load_pin_ledger(fs.as_ref(), &pin_ledger_path()).await;
320    let PinState::Pinned(pin) = ledger.pin_state(HARNESS) else {
321        panic!("the control did not write a pin the gate can read");
322    };
323    assert_eq!(pin.version, "0.9.4");
324    assert_eq!(
325        pin.digest,
326        measure_installed_tree(fs.as_ref(), &install_dir())
327            .await
328            .expect("measurable")
329            .as_str(),
330        "the pin froze bytes other than the ones it measured"
331    );
332
333    // And the acceptance sentence's second half: the pinned version blocks an
334    // unwanted update, before any bytes move.
335    let refused = authorize_version_fetch(fs.clone(), HARNESS, "0.9.5", 1_784_894_400_001)
336        .await
337        .expect_err("a pin blocks the version it did not name");
338    assert!(refused.to_string().contains("0.9.4"), "{refused}");
339    assert!(refused.to_string().contains("0.9.5"), "{refused}");
340}
341
342#[gpui::test]
343async fn taking_a_pin_writes_a_receipt_for_the_measurement_that_authorised_it(
344    cx: &mut TestAppContext,
345) {
346    let fs = FakeFs::new(cx.executor());
347    install(&fs, b"binary v0.9.4").await;
348
349    pin_installed_harness(fs.clone(), HARNESS, "0.9.4", &install_dir(), 1_784_894_400_000)
350        .await
351        .expect("pinned");
352
353    let log = receipt_log(&fs).await;
354    assert!(
355        log.contains("\"action\":\"reprobe_capability\""),
356        "a pin was taken with no recorded measurement behind it: {log}"
357    );
358    assert!(log.contains("\"kind\":\"applied\""), "{log}");
359}
360
361/// A pin against bytes nobody read would be a freeze with no meaning. The
362/// control refuses rather than recording the version alone.
363#[gpui::test]
364async fn a_tree_that_cannot_be_measured_cannot_be_pinned(cx: &mut TestAppContext) {
365    let fs = FakeFs::new(cx.executor());
366    let error = pin_installed_harness(
367        fs.clone(),
368        HARNESS,
369        "0.9.4",
370        Path::new("/nowhere/at/all"),
371        1_784_894_400_000,
372    )
373    .await
374    .expect_err("an unmeasurable tree cannot be pinned");
375    assert!(error.to_string().contains("could not read"), "{error}");
376    assert_eq!(
377        load_pin_ledger(fs.as_ref(), &pin_ledger_path())
378            .await
379            .pin_state(HARNESS),
380        PinState::Unpinned,
381        "a refused pin still wrote to the ledger"
382    );
383}
384
385/// Re-pointing a freeze at whatever is installed now, in one click, would undo
386/// the freeze in the exact case it exists for.
387#[gpui::test]
388async fn a_pin_is_not_silently_moved_onto_a_different_release(cx: &mut TestAppContext) {
389    let fs = FakeFs::new(cx.executor());
390    install(&fs, b"binary v0.9.4").await;
391    pin_installed_harness(fs.clone(), HARNESS, "0.9.4", &install_dir(), 1_784_894_400_000)
392        .await
393        .expect("pinned");
394
395    let error = pin_installed_harness(fs.clone(), HARNESS, "0.9.5", &install_dir(), 1_784_894_400_001)
396        .await
397        .expect_err("a second pin is refused");
398    assert!(error.to_string().contains("already pinned"), "{error}");
399    let ledger = load_pin_ledger(fs.as_ref(), &pin_ledger_path()).await;
400    let PinState::Pinned(pin) = ledger.pin_state(HARNESS) else {
401        panic!("the original pin vanished");
402    };
403    assert_eq!(pin.version, "0.9.4");
404}
405
406#[gpui::test]
407async fn removing_a_pin_lets_the_blocked_version_through(cx: &mut TestAppContext) {
408    let fs = FakeFs::new(cx.executor());
409    install(&fs, b"binary v0.9.4").await;
410    pin_installed_harness(fs.clone(), HARNESS, "0.9.4", &install_dir(), 1_784_894_400_000)
411        .await
412        .expect("pinned");
413    authorize_version_fetch(fs.clone(), HARNESS, "0.9.5", 1_784_894_400_001)
414        .await
415        .expect_err("blocked while pinned");
416
417    unpin_harness(fs.clone(), HARNESS)
418        .await
419        .expect("the pin is removed");
420
421    authorize_version_fetch(fs.clone(), HARNESS, "0.9.5", 1_784_894_400_002)
422        .await
423        .expect("an unpinned harness may fetch the version the registry offers");
424}
425
426/// A ledger this build cannot read must not be rewritten from the subset it
427/// could parse. That is not removal — it is deletion of everything unreadable.
428#[gpui::test]
429async fn neither_control_rewrites_a_ledger_it_cannot_read(cx: &mut TestAppContext) {
430    let fs = FakeFs::new(cx.executor());
431    install(&fs, b"binary v0.9.4").await;
432    let path = pin_ledger_path();
433    fs.create_dir(path.parent().expect("parent"))
434        .await
435        .expect("directory");
436    fs.write(&path, b"{ not a ledger").await.expect("written");
437
438    for error in [
439        pin_installed_harness(fs.clone(), HARNESS, "0.9.4", &install_dir(), 1_784_894_400_000)
440            .await
441            .expect_err("pin refuses"),
442        unpin_harness(fs.clone(), HARNESS)
443            .await
444            .expect_err("unpin refuses"),
445    ] {
446        assert!(error.to_string().contains("cannot read the pin ledger"), "{error}");
447    }
448    assert_eq!(
449        fs.load(&path).await.expect("still there"),
450        "{ not a ledger",
451        "an unreadable ledger was overwritten"
452    );
453}
454
455// ---------------------------------------------------------------------------
456// The npx gap. omega#81, `OMEGA-DELTA-0033`.
457// ---------------------------------------------------------------------------
458
459/// Before this, pinning an npx harness did nothing at all: nothing in that
460/// launch path consulted the ledger, so the owner's "not that one" was silently
461/// discarded and `npm` chose.
462#[gpui::test]
463async fn a_pinned_package_manager_harness_refuses_to_launch(cx: &mut TestAppContext) {
464    let fs = FakeFs::new(cx.executor());
465    install(&fs, b"binary v0.9.4").await;
466    pin_installed_harness(fs.clone(), HARNESS, "0.9.4", &install_dir(), 1_784_894_400_000)
467        .await
468        .expect("pinned");
469
470    let error =
471        authorize_package_manager_launch(fs.clone(), HARNESS, NPX_RESOLVER, 1_784_894_400_001)
472            .await
473            .expect_err("a pinned npx harness does not launch");
474    assert!(error.to_string().contains("npx"), "{error}");
475
476    let log = receipt_log(&fs).await;
477    assert!(
478        log.contains("\"reasonClass\":\"unpinnable_distribution\""),
479        "the refusal left no record: {log}"
480    );
481}
482
483/// The honest limit, asserted rather than left to a reader's assumption: this
484/// gate raises no bar on an unpinned npx harness.
485#[gpui::test]
486async fn an_unpinned_package_manager_harness_still_launches(cx: &mut TestAppContext) {
487    let fs = FakeFs::new(cx.executor());
488    authorize_package_manager_launch(fs.clone(), HARNESS, NPX_RESOLVER, 1_784_894_400_000)
489        .await
490        .expect("an unpinned npx harness launches");
491}
492
493// ---------------------------------------------------------------------------
494// Resolving the channel. omega#81 deliverable 1, `OMEGA-DELTA-0033`.
495// ---------------------------------------------------------------------------
496
497/// A frozen harness must not be *offered* the version the registry now names.
498/// The offer would lead to a refusal on the next launch — the front door
499/// promising what the gate then takes back.
500#[gpui::test]
501async fn a_frozen_harness_is_not_offered_the_version_it_would_refuse(cx: &mut TestAppContext) {
502    let fs = FakeFs::new(cx.executor());
503    install(&fs, b"binary v0.9.4").await;
504    pin_installed_harness(fs.clone(), HARNESS, "0.9.4", &install_dir(), 1_784_894_400_000)
505        .await
506        .expect("pinned");
507
508    let refusal = resolve_channel(fs.clone(), HARNESS, "0.9.5", 1_784_894_400_001)
509        .await
510        .expect("a pinned harness refuses the channel's answer");
511    assert_eq!(refusal.reason_class(), "pinned_version");
512
513    let log = receipt_log(&fs).await;
514    assert!(
515        log.contains("\"action\":\"resolve_channel\""),
516        "an update that never started left no trace it was considered: {log}"
517    );
518
519    // Unpinned, the same answer is offerable.
520    unpin_harness(fs.clone(), HARNESS).await.expect("unpinned");
521    assert!(
522        resolve_channel(fs.clone(), HARNESS, "0.9.5", 1_784_894_400_002)
523            .await
524            .is_none()
525    );
526}
527
528// ---------------------------------------------------------------------------
529// What the front door reads. omega#81 deliverable 4, `OMEGA-DELTA-0033`.
530// ---------------------------------------------------------------------------
531
532/// The row and the gate read the same three inputs off the same disk. A front
533/// door that measured a different tree than the launch path gates would show a
534/// control that looks live and then fails.
535#[gpui::test]
536async fn the_front_door_reads_the_state_the_gate_would_enforce(cx: &mut TestAppContext) {
537    let fs = FakeFs::new(cx.executor());
538    install(&fs, b"binary v0.9.4").await;
539
540    let before = read_front_door_state(
541        fs.as_ref(),
542        HARNESS,
543        "0.9.4",
544        HarnessDistribution::OwnedTree,
545        Some(&install_dir()),
546    )
547    .await;
548    assert!(before.launch.is_enabled());
549    assert!(matches!(before.pin_control, PinControl::Take { .. }));
550
551    pin_installed_harness(fs.clone(), HARNESS, "0.9.4", &install_dir(), 1_784_894_400_000)
552        .await
553        .expect("pinned");
554
555    let pinned = read_front_door_state(
556        fs.as_ref(),
557        HARNESS,
558        "0.9.5",
559        HarnessDistribution::OwnedTree,
560        Some(&install_dir()),
561    )
562    .await;
563    assert!(!pinned.launch.is_enabled(), "a pin did not reach the row");
564    let reason = pinned.launch.reason().expect("a disabled row has a sentence");
565    assert!(reason.contains("0.9.4") && reason.contains("0.9.5"), "{reason}");
566    assert_eq!(
567        pinned.pin_control,
568        PinControl::Remove {
569            pinned_version: "0.9.4".to_string()
570        }
571    );
572
573    // And the row's verdict is the launch path's verdict, taken independently.
574    let launch = authorize_installed_harness(
575        fs.clone(),
576        HARNESS,
577        "0.9.5",
578        &install_dir(),
579        MaintenanceAction::Verify,
580        1_784_894_400_002,
581    )
582    .await;
583    assert!(launch.is_err(), "the row refused and the gate did not");
584}
585
586/// After a real measurement is recorded, the row says the installed bytes are
587/// the recorded bytes — and stops saying so the moment they are not.
588#[gpui::test]
589async fn the_row_reports_provenance_and_notices_a_swap(cx: &mut TestAppContext) {
590    let fs = FakeFs::new(cx.executor());
591    install(&fs, b"binary v0.9.4").await;
592
593    reprobe_installed_harness(fs.clone(), HARNESS, "0.9.4", &install_dir(), 1_784_894_400_000)
594        .await
595        .expect("measured");
596
597    let verified = read_front_door_state(
598        fs.as_ref(),
599        HARNESS,
600        "0.9.4",
601        HarnessDistribution::OwnedTree,
602        Some(&install_dir()),
603    )
604    .await;
605    assert!(matches!(
606        verified.provenance,
607        omega_harness::ProvenanceVerdict::Verified { .. }
608    ));
609
610    fs.insert_file(install_dir().join("codex-acp"), b"swapped".to_vec())
611        .await;
612    let swapped = read_front_door_state(
613        fs.as_ref(),
614        HARNESS,
615        "0.9.4",
616        HarnessDistribution::OwnedTree,
617        Some(&install_dir()),
618    )
619    .await;
620    assert_eq!(
621        swapped.provenance,
622        omega_harness::ProvenanceVerdict::Refused(omega_harness::ProvenanceGap::DigestMismatch)
623    );
624}
625
626// ---------------------------------------------------------------------------
627// The live proof. omega#81, `OMEGA-DELTA-0033`.
628//
629// Everything above this line runs against `FakeFs`. The first landing of
630// omega#81 had nothing below it, and the acceptance sentence says "from a clean
631// machine" — so this one downloads a real release from the live ACP registry
632// onto a real filesystem, through the same downloader
633// `LocalRegistryArchiveAgent::get_command` uses, and puts the real gate between
634// the extracted tree and the command.
635//
636// Ignored by default: it needs the network, and a test suite that silently
637// depends on a third party's release assets is a test suite that goes red for
638// reasons that are not about this repository. Run it with
639// `cargo test -p project --features test-support --test integration -- --ignored live_`.
640// ---------------------------------------------------------------------------
641
642/// What the live ACP registry says about one binary-distributed harness.
643struct LiveHarness {
644    id: String,
645    version: String,
646    archive: String,
647    sha256: Option<String>,
648}
649
650async fn live_registry_harness(http: &dyn http_client::HttpClient) -> Option<LiveHarness> {
651    use futures::AsyncReadExt as _;
652
653    let mut response = http
654        .get(
655            "https://cdn.agentclientprotocol.com/registry/v1/latest/registry.json",
656            Default::default(),
657            true,
658        )
659        .await
660        .expect("the live ACP registry answers");
661    let mut body = String::new();
662    response
663        .body_mut()
664        .read_to_string(&mut body)
665        .await
666        .expect("the registry document reads");
667    let document: serde_json::Value = serde_json::from_str(&body).expect("the registry is JSON");
668
669    let platform = if cfg!(target_os = "macos") {
670        "darwin"
671    } else if cfg!(target_os = "linux") {
672        "linux"
673    } else {
674        "windows"
675    };
676    let arch = if cfg!(target_arch = "aarch64") {
677        "aarch64"
678    } else {
679        "x86_64"
680    };
681    let key = format!("{platform}-{arch}");
682
683    document
684        .get("agents")?
685        .as_array()?
686        .iter()
687        .find_map(|agent| {
688            // A `.tar.gz` keeps this proof about the gate rather than about
689            // archive formats, and `sha256`-free entries keep it from depending
690            // on a checksum a publisher may re-cut.
691            let target = agent.get("distribution")?.get("binary")?.get(&key)?;
692            let archive = target.get("archive")?.as_str()?;
693            if !archive.ends_with(".tar.gz") {
694                return None;
695            }
696            Some(LiveHarness {
697                id: agent.get("id")?.as_str()?.to_string(),
698                version: agent.get("version")?.as_str()?.to_string(),
699                archive: archive.to_string(),
700                sha256: target
701                    .get("sha256")
702                    .and_then(serde_json::Value::as_str)
703                    .map(str::to_string),
704            })
705        })
706}
707
708#[gpui::test]
709#[ignore = "live: fetches the ACP registry and downloads a real harness release"]
710async fn live_a_real_registry_install_produces_a_receipt_and_a_pin_blocks_the_next_version(
711    cx: &mut TestAppContext,
712) {
713    // Real network and real disk, so the deterministic test scheduler has to be
714    // told this test parks. Everything above this line runs without it.
715    cx.executor().allow_parking();
716
717    let data_dir = tempfile::tempdir().expect("a clean machine");
718    // Redirect every path this test touches. Without this the proof would write
719    // pins and receipts into the developer's own Omega installation.
720    paths::set_custom_data_dir(data_dir.path().to_str().expect("utf-8 temp dir"));
721
722    let fs: Arc<dyn Fs> = Arc::new(fs::RealFs::new(None, cx.executor()));
723    let http = reqwest_client::ReqwestClient::user_agent("omega-harness-live-proof")
724        .expect("an http client");
725
726    let Some(harness) = live_registry_harness(&http).await else {
727        panic!("the live registry offers no .tar.gz binary target for this platform");
728    };
729    let version_dir = paths::external_agents_dir()
730        .join("registry")
731        .join(&harness.id)
732        .join(format!("v_{}_live", harness.version));
733
734    // The pin is consulted before any bytes move, exactly as the launch path
735    // consults it. On a clean machine nothing is frozen, so the fetch proceeds.
736    authorize_version_fetch(fs.clone(), &harness.id, &harness.version, 1_784_894_400_000)
737        .await
738        .expect("a clean machine has no pin to block the first install");
739
740    // `LocalRegistryArchiveAgent::get_command` creates the installation
741    // directory before it downloads into a version directory under it.
742    fs.create_dir(version_dir.parent().expect("an installation directory"))
743        .await
744        .expect("the installation directory is created");
745
746    http_client::github_download::download_server_binary(
747        &http,
748        &harness.archive,
749        harness.sha256.as_deref(),
750        &version_dir,
751        http_client::github::AssetKind::TarGz,
752    )
753    .await
754    .unwrap_or_else(|error| panic!("downloading {}: {error}", harness.archive));
755
756    // The enforcement point, on real extracted bytes.
757    let installed = authorize_installed_harness(
758        fs.clone(),
759        &harness.id,
760        &harness.version,
761        &version_dir,
762        MaintenanceAction::Install,
763        1_784_894_400_001,
764    )
765    .await
766    .expect("a real installed tree is measurable and unpinned");
767
768    // The receipt is on disk, and it binds the bytes that were extracted.
769    let log = fs.load(&receipt_log_path()).await.unwrap_or_default();
770    // Printed because this test's whole point is that the receipt is real. Run
771    // with `--nocapture` to read the bytes that were written.
772    eprintln!("live install receipt log:\n{log}");
773    assert!(
774        log.contains(&format!("\"harnessRef\":\"harness.{}\"", harness.id)),
775        "no receipt names the harness that was installed: {log}"
776    );
777    assert!(
778        log.contains(installed.as_str()),
779        "the receipt does not carry the digest the install measured: {log}"
780    );
781
782    // One action freezes it, at bytes this host read rather than at a version
783    // that was typed.
784    pin_installed_harness(
785        fs.clone(),
786        &harness.id,
787        &harness.version,
788        &version_dir,
789        1_784_894_400_002,
790    )
791    .await
792    .expect("a real installed tree can be pinned");
793
794    // And the pin blocks an unwanted update with a sentence that names both
795    // versions — the acceptance sentence of omega#81, on a real machine.
796    let refusal = authorize_version_fetch(
797        fs.clone(),
798        &harness.id,
799        "99.99.99",
800        1_784_894_400_003,
801    )
802    .await
803    .expect_err("a pinned harness refuses the version the registry would offer");
804    assert!(refusal.to_string().contains(&harness.version), "{refusal}");
805    assert!(refusal.to_string().contains("99.99.99"), "{refusal}");
806
807    // The falsifier omega#81 names, on real bytes: replace the executable after
808    // the install receipt was written and the harness does not run.
809    let swapped = version_dir.join("omega-live-proof-swap");
810    fs.write(&swapped, b"a file the pin never measured")
811        .await
812        .expect("the tree is writable");
813    let after_swap = authorize_installed_harness(
814        fs.clone(),
815        &harness.id,
816        &harness.version,
817        &version_dir,
818        MaintenanceAction::Verify,
819        1_784_894_400_004,
820    )
821    .await
822    .expect_err("bytes added after the pin was taken do not run");
823    assert!(
824        after_swap.to_string().contains("replaced"),
825        "the refusal did not name the substitution: {after_swap}"
826    );
827}
828