Compare commits
4
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
  mathiasandClaude Sonnet 5
|
43f43e4621 | ||
|
mathiasandClaude Sonnet 5
|
874206be9d | ||
|
mathiasandClaude Sonnet 5
|
41a9112860 | ||
|
mathias
|
a5a328fea5 |
+1
-5
@@ -64,11 +64,7 @@ the routing pod; brain tools moved to the brain MCP.
|
||||
|
||||
The brain HTTP REST API (`/query`, `/write`, `/ingest`, `/ingest-raw`,
|
||||
`/ingest-path`, `/backfill-refs`, `/pass-rate`) remains available on port 3300
|
||||
for shell scripts and non-MCP clients, **with the same bearer token as `/mcp`**
|
||||
(`BRAIN_MCP_TOKEN`; hyperguild#149). It is not served on the public host
|
||||
(infra#517): use the tailnet (`koala:8443`) or in-cluster
|
||||
`ingestion.supervisor.svc:3300`. `/ingest-path` and `brain_ingest` `path`
|
||||
accept only paths inside `brain/raw/`.
|
||||
for shell scripts and non-MCP clients.
|
||||
|
||||
`brain_answer(query)` performs BM25 retrieval + LLM synthesis (berget.ai
|
||||
gemma4:31b → iguana fallback). `brain_classify(text)` infers doc type, title,
|
||||
|
||||
@@ -78,27 +78,6 @@ These rules apply to every task across every project, regardless of harness.
|
||||
when a human reviewer outside the project is required. Document the reason in
|
||||
PROJECT.md.
|
||||
|
||||
**Exception — a GitOps repo where a branch cannot be reconciled.** In a repo whose
|
||||
deployment watches one branch (`mathias/infra`: Flux watches `main`), a branch is
|
||||
invisible to the thing that applies it. A `risk/medium` change to `alerts.yaml` or
|
||||
`litellm-config.yaml` can be linted on a branch but never *exercised* there, so a
|
||||
PR would buy a review of a state that was never deployed.
|
||||
|
||||
There, `risk/medium`+ work stays on `main` and instead requires a **recorded
|
||||
adversarial review pass before the push** — `skills:pr-gatekeeper` or equivalent,
|
||||
reviewing the staged diff. **The reviewer's verdict goes in the issue, not a PR
|
||||
thread.** No verdict recorded means the lane was not used, and saying "the gate was
|
||||
green" is not the same claim.
|
||||
|
||||
Be honest about what this is: a recorded *independent* pass, not four-eyes in the
|
||||
sense `assessor-loop` §4.1 means for a regulated organisation, because the reviewer
|
||||
is an agent. It is more than the repo had and less than the model it mirrors; do not
|
||||
describe it as the stronger property. (infra#470, decided 2026-09-29.)
|
||||
|
||||
This lane depends on the `risk/` label being right. A label that triggers a heavier
|
||||
lane is load-bearing, not cosmetic — if work that belongs in it is unlabelled, the
|
||||
lane silently does not apply.
|
||||
|
||||
6. **Close the loop — every substantive task ends with the same ritual.** Shipping
|
||||
the code is not the end of the task; capturing it is. Run this unprompted:
|
||||
- **Tag + bump SemVer** on the change (annotated tag; minor for a feature or
|
||||
@@ -127,43 +106,6 @@ These rules apply to every task across every project, regardless of harness.
|
||||
revisit Y". Those are exactly the items that need a locator. If it is worth
|
||||
saying in a summary, it is worth writing where it can be found again without you.
|
||||
|
||||
7. **Finish what's closable — only involve me for a genuine call.** If a
|
||||
tracker issue, PR, or checklist item is demonstrably resolved — the fix
|
||||
landed, the state changed, you verified it live — close/merge/check it off
|
||||
in the same turn. Don't leave it open "for the record" or park it waiting
|
||||
on me to confirm something that already happened; that's bookkeeping, not
|
||||
a decision. Reserve asking me (`AskUserQuestion`, a `DECISION NEEDED`
|
||||
comment, or otherwise pausing) for when it's genuinely mine to call:
|
||||
irreversible or prod/host-impacting actions, a real judgment call with no
|
||||
clearly-better option, ambiguous intent, or anything secret-writes/
|
||||
destructive-git already gate. Before claiming something is closable,
|
||||
verify it live (re-check the issue, re-run the command) rather than
|
||||
trusting your own earlier summary (brain: `filed-issue-not-same-as-fixed`).
|
||||
|
||||
8. **Control code needs an adversary, not a checklist.** Code whose job is to
|
||||
refuse, deny, gate or contain is not adequately verified by a green gate.
|
||||
Rule 5 makes CI the quality gate and that holds for ordinary work — but a
|
||||
passing suite only asserts what its author already thought of, and for a
|
||||
control the author is precisely the person whose imagination just failed.
|
||||
Measured on `dispatch#75`: five review rounds, five real escapes verified by
|
||||
execution, and **CI was green on every one of them** while `git rm
|
||||
././.dispatch-allow` deleted the file the control existed to protect. So
|
||||
route this work through a review with authority to block, instructed to
|
||||
verify by execution rather than by reading the implementation. Expect to be
|
||||
blocked more than once; that is the control working, not the reviewer being
|
||||
difficult. (brain: `a-green-gate-is-not-evidence-for-control-code`; the
|
||||
practices live in the `pr-gatekeeper` agent.)
|
||||
|
||||
9. **A test's name must not claim more than its assertions prove.** Name a test
|
||||
after the mechanism it observes, not the goal it serves.
|
||||
`DoesNotInheritEnv` is honest; `IsContained` is a claim the test cannot
|
||||
support. This is not pedantry about naming — when name and assertion
|
||||
diverge, the name wins in the reader's head and the gap becomes invisible,
|
||||
which is what lets the defect survive review. Found three times in one PR,
|
||||
twice in tests written to fix the previous instance of it; each passed while
|
||||
the thing it was named for was exploitable. If you cannot name the mechanism,
|
||||
you do not yet know what the test observes.
|
||||
|
||||
## CAD sprint patterns
|
||||
|
||||
Two CAD sprint archetypes (defs: brain `wiki/homelab/decisions/continuous-agentic-development-cad-concept-2026-06-16`):
|
||||
@@ -304,16 +246,10 @@ entries that age well are about *why*, *how to avoid*, and *what to do when*.
|
||||
|---------|-------|-------|
|
||||
| **Claude Code, Claude Desktop** | `brain_query` (BM25), `brain_answer` (LLM-synth + sources) MCP tools | `brain_write` MCP tool |
|
||||
| **Crush, Pi, Antigravity, other MCP-capable** | same MCP server: `ingestion-brain` (via the `mcp__*_brain__*` namespace once authenticated) | same |
|
||||
| **Anything HTTP-only (curl, scripts)** | Tailnet only: `POST https://koala.tail30472e.ts.net:8443/query` with `{"query":"..."}`, sending `BRAIN_MCP_TOKEN` (not yet enforced on REST, hyperguild#149). The public `brain-mcp.d-ma.be` serves `/mcp` only (infra#517). | `POST .../write` with `{"content":"...","wing":"...","hall":"..."}` |
|
||||
| **Anything HTTP-only (curl, scripts)** | `POST https://brain-mcp.d-ma.be/query` with `{"query":"..."}` (auth via `BRAIN_MCP_TOKEN`) | `POST .../write` with `{"content":"...","filename":"..."}` |
|
||||
| **Browser / human inspection** | `https://git.d-ma.be/mathias/hyperguild` → `knowledge/` and `wiki/` markdown files |
|
||||
|
||||
- **Scoping — the brain holds no confidential client content.** Nothing on the read path
|
||||
filters by client: every token holder can read every wing, and `wing` on `brain_query`
|
||||
is an optional argument, not an access control. Client confidentiality is enforced only
|
||||
at write time (`capture`'s I1 gate refuses internal/confidential). So never `brain_write`
|
||||
client material; generalise it first or keep it in the client's own repo. (hyperguild#144,
|
||||
decided 2026-10-01. This line previously claimed client projects were filtered; they
|
||||
were not.)
|
||||
- **Scoping**: defaults to `public` collection; client projects filter to `{client}` + `public`.
|
||||
- **Routing**: brain_answer's LLM uses berget.ai as primary, iguana ollama as
|
||||
fallback. Both are configurable in the `supervisor/ingestion-deployment.yaml`
|
||||
on the koala k3s cluster; don't hardcode local-only model names into the
|
||||
@@ -383,20 +319,8 @@ Workflow:
|
||||
and missing-untracked adapters). A drift fails the check with a
|
||||
message telling you to stage the regenerated files.
|
||||
|
||||
Behavior rules in this file and per-project rules in `PROJECT.md` apply on every
|
||||
host and every harness.
|
||||
|
||||
**Where a project rule contradicts a rule here, the project rule governs — and it
|
||||
must state its reason.** Both halves matter: the project file wins because it knows
|
||||
something this file cannot (infra's Flux constraint is real and not visible from
|
||||
here), and it must say why because a bare override is indistinguishable from drift.
|
||||
|
||||
This replaces the previous wording, which said rules here and in `PROJECT.md` both
|
||||
apply *"unconditionally"*. That was not a tiebreak but a contradiction, and it went
|
||||
unnoticed until rule 5 and infra's "never create feature branches" had to be obeyed
|
||||
at the same time (infra#470). A standard can hold two individually sensible clauses
|
||||
that are jointly unsatisfiable, and survive for as long as everyone reads it
|
||||
charitably — the same failure the Inception Sprint Oath's G6 had.
|
||||
Behavior rules in this file and per-project rules in `PROJECT.md` apply
|
||||
unconditionally on every host, every harness.
|
||||
|
||||
## Engineering Skills
|
||||
|
||||
@@ -493,11 +417,7 @@ the routing pod; brain tools moved to the brain MCP.
|
||||
|
||||
The brain HTTP REST API (`/query`, `/write`, `/ingest`, `/ingest-raw`,
|
||||
`/ingest-path`, `/backfill-refs`, `/pass-rate`) remains available on port 3300
|
||||
for shell scripts and non-MCP clients, **with the same bearer token as `/mcp`**
|
||||
(`BRAIN_MCP_TOKEN`; hyperguild#149). It is not served on the public host
|
||||
(infra#517): use the tailnet (`koala:8443`) or in-cluster
|
||||
`ingestion.supervisor.svc:3300`. `/ingest-path` and `brain_ingest` `path`
|
||||
accept only paths inside `brain/raw/`.
|
||||
for shell scripts and non-MCP clients.
|
||||
|
||||
`brain_answer(query)` performs BM25 retrieval + LLM synthesis (berget.ai
|
||||
gemma4:31b → iguana fallback). `brain_classify(text)` infers doc type, title,
|
||||
|
||||
@@ -73,27 +73,6 @@ These rules apply to every task across every project, regardless of harness.
|
||||
when a human reviewer outside the project is required. Document the reason in
|
||||
PROJECT.md.
|
||||
|
||||
**Exception — a GitOps repo where a branch cannot be reconciled.** In a repo whose
|
||||
deployment watches one branch (`mathias/infra`: Flux watches `main`), a branch is
|
||||
invisible to the thing that applies it. A `risk/medium` change to `alerts.yaml` or
|
||||
`litellm-config.yaml` can be linted on a branch but never *exercised* there, so a
|
||||
PR would buy a review of a state that was never deployed.
|
||||
|
||||
There, `risk/medium`+ work stays on `main` and instead requires a **recorded
|
||||
adversarial review pass before the push** — `skills:pr-gatekeeper` or equivalent,
|
||||
reviewing the staged diff. **The reviewer's verdict goes in the issue, not a PR
|
||||
thread.** No verdict recorded means the lane was not used, and saying "the gate was
|
||||
green" is not the same claim.
|
||||
|
||||
Be honest about what this is: a recorded *independent* pass, not four-eyes in the
|
||||
sense `assessor-loop` §4.1 means for a regulated organisation, because the reviewer
|
||||
is an agent. It is more than the repo had and less than the model it mirrors; do not
|
||||
describe it as the stronger property. (infra#470, decided 2026-09-29.)
|
||||
|
||||
This lane depends on the `risk/` label being right. A label that triggers a heavier
|
||||
lane is load-bearing, not cosmetic — if work that belongs in it is unlabelled, the
|
||||
lane silently does not apply.
|
||||
|
||||
6. **Close the loop — every substantive task ends with the same ritual.** Shipping
|
||||
the code is not the end of the task; capturing it is. Run this unprompted:
|
||||
- **Tag + bump SemVer** on the change (annotated tag; minor for a feature or
|
||||
@@ -122,43 +101,6 @@ These rules apply to every task across every project, regardless of harness.
|
||||
revisit Y". Those are exactly the items that need a locator. If it is worth
|
||||
saying in a summary, it is worth writing where it can be found again without you.
|
||||
|
||||
7. **Finish what's closable — only involve me for a genuine call.** If a
|
||||
tracker issue, PR, or checklist item is demonstrably resolved — the fix
|
||||
landed, the state changed, you verified it live — close/merge/check it off
|
||||
in the same turn. Don't leave it open "for the record" or park it waiting
|
||||
on me to confirm something that already happened; that's bookkeeping, not
|
||||
a decision. Reserve asking me (`AskUserQuestion`, a `DECISION NEEDED`
|
||||
comment, or otherwise pausing) for when it's genuinely mine to call:
|
||||
irreversible or prod/host-impacting actions, a real judgment call with no
|
||||
clearly-better option, ambiguous intent, or anything secret-writes/
|
||||
destructive-git already gate. Before claiming something is closable,
|
||||
verify it live (re-check the issue, re-run the command) rather than
|
||||
trusting your own earlier summary (brain: `filed-issue-not-same-as-fixed`).
|
||||
|
||||
8. **Control code needs an adversary, not a checklist.** Code whose job is to
|
||||
refuse, deny, gate or contain is not adequately verified by a green gate.
|
||||
Rule 5 makes CI the quality gate and that holds for ordinary work — but a
|
||||
passing suite only asserts what its author already thought of, and for a
|
||||
control the author is precisely the person whose imagination just failed.
|
||||
Measured on `dispatch#75`: five review rounds, five real escapes verified by
|
||||
execution, and **CI was green on every one of them** while `git rm
|
||||
././.dispatch-allow` deleted the file the control existed to protect. So
|
||||
route this work through a review with authority to block, instructed to
|
||||
verify by execution rather than by reading the implementation. Expect to be
|
||||
blocked more than once; that is the control working, not the reviewer being
|
||||
difficult. (brain: `a-green-gate-is-not-evidence-for-control-code`; the
|
||||
practices live in the `pr-gatekeeper` agent.)
|
||||
|
||||
9. **A test's name must not claim more than its assertions prove.** Name a test
|
||||
after the mechanism it observes, not the goal it serves.
|
||||
`DoesNotInheritEnv` is honest; `IsContained` is a claim the test cannot
|
||||
support. This is not pedantry about naming — when name and assertion
|
||||
diverge, the name wins in the reader's head and the gap becomes invisible,
|
||||
which is what lets the defect survive review. Found three times in one PR,
|
||||
twice in tests written to fix the previous instance of it; each passed while
|
||||
the thing it was named for was exploitable. If you cannot name the mechanism,
|
||||
you do not yet know what the test observes.
|
||||
|
||||
## CAD sprint patterns
|
||||
|
||||
Two CAD sprint archetypes (defs: brain `wiki/homelab/decisions/continuous-agentic-development-cad-concept-2026-06-16`):
|
||||
@@ -299,16 +241,10 @@ entries that age well are about *why*, *how to avoid*, and *what to do when*.
|
||||
|---------|-------|-------|
|
||||
| **Claude Code, Claude Desktop** | `brain_query` (BM25), `brain_answer` (LLM-synth + sources) MCP tools | `brain_write` MCP tool |
|
||||
| **Crush, Pi, Antigravity, other MCP-capable** | same MCP server: `ingestion-brain` (via the `mcp__*_brain__*` namespace once authenticated) | same |
|
||||
| **Anything HTTP-only (curl, scripts)** | Tailnet only: `POST https://koala.tail30472e.ts.net:8443/query` with `{"query":"..."}`, sending `BRAIN_MCP_TOKEN` (not yet enforced on REST, hyperguild#149). The public `brain-mcp.d-ma.be` serves `/mcp` only (infra#517). | `POST .../write` with `{"content":"...","wing":"...","hall":"..."}` |
|
||||
| **Anything HTTP-only (curl, scripts)** | `POST https://brain-mcp.d-ma.be/query` with `{"query":"..."}` (auth via `BRAIN_MCP_TOKEN`) | `POST .../write` with `{"content":"...","filename":"..."}` |
|
||||
| **Browser / human inspection** | `https://git.d-ma.be/mathias/hyperguild` → `knowledge/` and `wiki/` markdown files |
|
||||
|
||||
- **Scoping — the brain holds no confidential client content.** Nothing on the read path
|
||||
filters by client: every token holder can read every wing, and `wing` on `brain_query`
|
||||
is an optional argument, not an access control. Client confidentiality is enforced only
|
||||
at write time (`capture`'s I1 gate refuses internal/confidential). So never `brain_write`
|
||||
client material; generalise it first or keep it in the client's own repo. (hyperguild#144,
|
||||
decided 2026-10-01. This line previously claimed client projects were filtered; they
|
||||
were not.)
|
||||
- **Scoping**: defaults to `public` collection; client projects filter to `{client}` + `public`.
|
||||
- **Routing**: brain_answer's LLM uses berget.ai as primary, iguana ollama as
|
||||
fallback. Both are configurable in the `supervisor/ingestion-deployment.yaml`
|
||||
on the koala k3s cluster; don't hardcode local-only model names into the
|
||||
@@ -378,20 +314,8 @@ Workflow:
|
||||
and missing-untracked adapters). A drift fails the check with a
|
||||
message telling you to stage the regenerated files.
|
||||
|
||||
Behavior rules in this file and per-project rules in `PROJECT.md` apply on every
|
||||
host and every harness.
|
||||
|
||||
**Where a project rule contradicts a rule here, the project rule governs — and it
|
||||
must state its reason.** Both halves matter: the project file wins because it knows
|
||||
something this file cannot (infra's Flux constraint is real and not visible from
|
||||
here), and it must say why because a bare override is indistinguishable from drift.
|
||||
|
||||
This replaces the previous wording, which said rules here and in `PROJECT.md` both
|
||||
apply *"unconditionally"*. That was not a tiebreak but a contradiction, and it went
|
||||
unnoticed until rule 5 and infra's "never create feature branches" had to be obeyed
|
||||
at the same time (infra#470). A standard can hold two individually sensible clauses
|
||||
that are jointly unsatisfiable, and survive for as long as everyone reads it
|
||||
charitably — the same failure the Inception Sprint Oath's G6 had.
|
||||
Behavior rules in this file and per-project rules in `PROJECT.md` apply
|
||||
unconditionally on every host, every harness.
|
||||
|
||||
## Engineering Skills
|
||||
|
||||
@@ -488,11 +412,7 @@ the routing pod; brain tools moved to the brain MCP.
|
||||
|
||||
The brain HTTP REST API (`/query`, `/write`, `/ingest`, `/ingest-raw`,
|
||||
`/ingest-path`, `/backfill-refs`, `/pass-rate`) remains available on port 3300
|
||||
for shell scripts and non-MCP clients, **with the same bearer token as `/mcp`**
|
||||
(`BRAIN_MCP_TOKEN`; hyperguild#149). It is not served on the public host
|
||||
(infra#517): use the tailnet (`koala:8443`) or in-cluster
|
||||
`ingestion.supervisor.svc:3300`. `/ingest-path` and `brain_ingest` `path`
|
||||
accept only paths inside `brain/raw/`.
|
||||
for shell scripts and non-MCP clients.
|
||||
|
||||
`brain_answer(query)` performs BM25 retrieval + LLM synthesis (berget.ai
|
||||
gemma4:31b → iguana fallback). `brain_classify(text)` infers doc type, title,
|
||||
|
||||
@@ -64,11 +64,7 @@ the routing pod; brain tools moved to the brain MCP.
|
||||
|
||||
The brain HTTP REST API (`/query`, `/write`, `/ingest`, `/ingest-raw`,
|
||||
`/ingest-path`, `/backfill-refs`, `/pass-rate`) remains available on port 3300
|
||||
for shell scripts and non-MCP clients, **with the same bearer token as `/mcp`**
|
||||
(`BRAIN_MCP_TOKEN`; hyperguild#149). It is not served on the public host
|
||||
(infra#517): use the tailnet (`koala:8443`) or in-cluster
|
||||
`ingestion.supervisor.svc:3300`. `/ingest-path` and `brain_ingest` `path`
|
||||
accept only paths inside `brain/raw/`.
|
||||
for shell scripts and non-MCP clients.
|
||||
|
||||
`brain_answer(query)` performs BM25 retrieval + LLM synthesis (berget.ai
|
||||
gemma4:31b → iguana fallback). `brain_classify(text)` infers doc type, title,
|
||||
|
||||
@@ -104,24 +104,6 @@ Two fields are **generator-owned** and do get refreshed on a revise:
|
||||
`last_updated` and `source_hash`. Everything else on disk wins. The boundary is
|
||||
an explicit allowlist, so a field nobody has thought about stays human-owned.
|
||||
|
||||
### Disagreement is reported, not resolved
|
||||
|
||||
When the fresh extraction produces a *different version* of a section that
|
||||
already exists, the on-disk version still wins — but the run now says so:
|
||||
|
||||
```
|
||||
wiki/sources/shape-up.md: source now disagrees on section "Summary" — on-disk version kept
|
||||
```
|
||||
|
||||
That line lands in `log.md` with the rest of the run's warnings. Without it, "the
|
||||
source is unchanged" and "the source changed its mind and we ignored it" look
|
||||
identical from the outside.
|
||||
|
||||
This is deliberately **textual** disagreement, not semantic contradiction: cheap,
|
||||
deterministic, no model on the write path. Deciding whether a disagreement is a
|
||||
genuine contradiction stays with the Judge-gated `brain-enrich` pass, which is
|
||||
approval-gated by design. Detection here, adjudication there.
|
||||
|
||||
## Re-ingesting an unchanged source is skipped
|
||||
|
||||
Ingest stores `source_hash` — sha256 of the ingested **body**, frontmatter
|
||||
|
||||
@@ -55,21 +55,18 @@ Flags:
|
||||
- `--limit N` — max results (default 5)
|
||||
- `--json` — emit the raw response envelope
|
||||
|
||||
### `hyperguild brain write <wing> <hall> <slug>`
|
||||
### `hyperguild brain write <type> <slug>`
|
||||
|
||||
Reads markdown from stdin, writes it to `brain/wiki/<wing>/<hall>/<slug>.md`
|
||||
with `wing`/`hall`/`created_at` frontmatter injected (there is no legacy
|
||||
`brain/knowledge/` fallback — ADR-0012 / #79, both wing and hall are
|
||||
required).
|
||||
Reads markdown from stdin, writes a knowledge entry.
|
||||
|
||||
```bash
|
||||
$ cat <<EOF | hyperguild brain write homelab facts example-lesson
|
||||
$ cat <<EOF | hyperguild brain write knowledge example-lesson
|
||||
# Example lesson
|
||||
|
||||
## Lesson
|
||||
...
|
||||
EOF
|
||||
wiki/homelab/facts/example-lesson.md
|
||||
knowledge/example-lesson.md
|
||||
```
|
||||
|
||||
### `hyperguild brain pass-rate <skill>`
|
||||
|
||||
@@ -60,14 +60,13 @@ func runBrainWrite(ctx context.Context, args []string, stdin io.Reader, stdout,
|
||||
if err := fs.Parse(args); err != nil {
|
||||
return fmt.Errorf("parse flags: %w", err)
|
||||
}
|
||||
if fs.NArg() < 3 {
|
||||
return errors.New("wing, hall and slug required (e.g. brain write homelab facts my-slug)")
|
||||
if fs.NArg() < 2 {
|
||||
return errors.New("type and slug required (e.g. brain write knowledge my-slug)")
|
||||
}
|
||||
wing := fs.Arg(0)
|
||||
hall := fs.Arg(1)
|
||||
slug := fs.Arg(2)
|
||||
kind := fs.Arg(0)
|
||||
slug := fs.Arg(1)
|
||||
|
||||
res, err := newBrainClient().Write(ctx, wing, hall, slug, stdin)
|
||||
res, err := newBrainClient().Write(ctx, kind, slug, stdin)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
@@ -101,7 +101,7 @@ func TestRunBrainWrite_Success(t *testing.T) {
|
||||
var out, errBuf bytes.Buffer
|
||||
err := runBrain(
|
||||
context.Background(),
|
||||
[]string{"write", "homelab", "facts", "test-slug"},
|
||||
[]string{"write", "knowledge", "test-slug"},
|
||||
strings.NewReader("# Test\n\nSome body content.\n"),
|
||||
&out, &errBuf,
|
||||
)
|
||||
@@ -111,9 +111,9 @@ func TestRunBrainWrite_Success(t *testing.T) {
|
||||
|
||||
func TestRunBrainWrite_MissingArgs(t *testing.T) {
|
||||
var out, errBuf bytes.Buffer
|
||||
err := runBrain(context.Background(), []string{"write", "homelab"}, strings.NewReader("x"), &out, &errBuf)
|
||||
err := runBrain(context.Background(), []string{"write", "knowledge"}, strings.NewReader("x"), &out, &errBuf)
|
||||
assert.Error(t, err)
|
||||
assert.Contains(t, err.Error(), "wing, hall and slug required")
|
||||
assert.Contains(t, err.Error(), "type and slug required")
|
||||
}
|
||||
|
||||
func TestRunBrainWrite_BackendError(t *testing.T) {
|
||||
@@ -127,7 +127,7 @@ func TestRunBrainWrite_BackendError(t *testing.T) {
|
||||
var out, errBuf bytes.Buffer
|
||||
err := runBrain(
|
||||
context.Background(),
|
||||
[]string{"write", "homelab", "facts", "bad slug"},
|
||||
[]string{"write", "knowledge", "bad slug"},
|
||||
strings.NewReader("body"),
|
||||
&out, &errBuf,
|
||||
)
|
||||
@@ -150,7 +150,7 @@ func TestRunBrainWrite_EmptyStdin(t *testing.T) {
|
||||
t.Setenv("BRAIN_URL", srv.URL)
|
||||
|
||||
var out, errBuf bytes.Buffer
|
||||
err := runBrain(context.Background(), []string{"write", "homelab", "facts", "empty"}, strings.NewReader(""), &out, &errBuf)
|
||||
err := runBrain(context.Background(), []string{"write", "knowledge", "empty"}, strings.NewReader(""), &out, &errBuf)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, 0, gotLen, "empty stdin should produce empty content payload")
|
||||
}
|
||||
|
||||
+9
-20
@@ -20,7 +20,6 @@ const defaultBrainURL = "http://koala:30330"
|
||||
// shell-friendly client; MCP framing is unnecessary.
|
||||
type brainClient struct {
|
||||
baseURL string
|
||||
token string // BRAIN_MCP_TOKEN; the REST API requires it since hyperguild#149
|
||||
http *http.Client
|
||||
}
|
||||
|
||||
@@ -31,7 +30,6 @@ func newBrainClient() *brainClient {
|
||||
}
|
||||
return &brainClient{
|
||||
baseURL: u,
|
||||
token: os.Getenv("BRAIN_MCP_TOKEN"),
|
||||
http: &http.Client{Timeout: 5 * time.Second},
|
||||
}
|
||||
}
|
||||
@@ -64,7 +62,8 @@ func (c *brainClient) Query(ctx context.Context, topic string, limit int) (*Quer
|
||||
return nil, fmt.Errorf("build request: %w", err)
|
||||
}
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
resp, err := c.do(req)
|
||||
|
||||
resp, err := c.http.Do(req)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("brain POST /query: %w", err)
|
||||
}
|
||||
@@ -85,17 +84,16 @@ type WriteResult struct {
|
||||
Path string `json:"path"`
|
||||
}
|
||||
|
||||
func (c *brainClient) Write(ctx context.Context, wing, hall, filename string, content io.Reader) (*WriteResult, error) {
|
||||
func (c *brainClient) Write(ctx context.Context, kind, slug string, content io.Reader) (*WriteResult, error) {
|
||||
body, err := io.ReadAll(content)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("read content: %w", err)
|
||||
}
|
||||
payload, err := json.Marshal(struct {
|
||||
Wing string `json:"wing"`
|
||||
Hall string `json:"hall"`
|
||||
Filename string `json:"filename"`
|
||||
Type string `json:"type"`
|
||||
Slug string `json:"slug"`
|
||||
Content string `json:"content"`
|
||||
}{Wing: wing, Hall: hall, Filename: filename, Content: string(body)})
|
||||
}{Type: kind, Slug: slug, Content: string(body)})
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("marshal payload: %w", err)
|
||||
}
|
||||
@@ -106,7 +104,8 @@ func (c *brainClient) Write(ctx context.Context, wing, hall, filename string, co
|
||||
return nil, fmt.Errorf("build request: %w", err)
|
||||
}
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
resp, err := c.do(req)
|
||||
|
||||
resp, err := c.http.Do(req)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("brain POST /write: %w", err)
|
||||
}
|
||||
@@ -143,7 +142,7 @@ func (c *brainClient) PassRate(ctx context.Context, skill, window string) (*Pass
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("build request: %w", err)
|
||||
}
|
||||
resp, err := c.do(req)
|
||||
resp, err := c.http.Do(req)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("brain GET /pass-rate: %w", err)
|
||||
}
|
||||
@@ -158,13 +157,3 @@ func (c *brainClient) PassRate(ctx context.Context, skill, window string) (*Pass
|
||||
}
|
||||
return &out, nil
|
||||
}
|
||||
|
||||
// do sends every brain request, adding the bearer token when one is
|
||||
// configured. All methods go through here so none can forget it (PassRate
|
||||
// did, PR #152 review).
|
||||
func (c *brainClient) do(req *http.Request) (*http.Response, error) {
|
||||
if c.token != "" {
|
||||
req.Header.Set("Authorization", "Bearer "+c.token)
|
||||
}
|
||||
return c.http.Do(req)
|
||||
}
|
||||
|
||||
@@ -1,57 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
// hyperguild#149: the ingestion REST API now requires a bearer token; the CLI
|
||||
// sends BRAIN_MCP_TOKEN, or it gets 401 on every brain call.
|
||||
func TestBrainClientSendsBrainMCPTokenOnQueryWriteAndPassRate(t *testing.T) {
|
||||
var got []string
|
||||
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
got = append(got, r.URL.Path+" "+r.Header.Get("Authorization"))
|
||||
switch r.URL.Path {
|
||||
case "/write":
|
||||
_, _ = w.Write([]byte(`{"path":"wiki/x/facts/y.md"}`))
|
||||
return
|
||||
case "/pass-rate":
|
||||
_, _ = w.Write([]byte(`{}`))
|
||||
return
|
||||
}
|
||||
_, _ = w.Write([]byte(`{"results":[]}`))
|
||||
}))
|
||||
defer srv.Close()
|
||||
t.Setenv("BRAIN_URL", srv.URL)
|
||||
t.Setenv("BRAIN_MCP_TOKEN", "cli-test-token")
|
||||
|
||||
c := newBrainClient()
|
||||
_, err := c.Query(context.Background(), "x", 1)
|
||||
require.NoError(t, err)
|
||||
_, err = c.Write(context.Background(), "x", "facts", "y", strings.NewReader("# y"))
|
||||
require.NoError(t, err)
|
||||
// PR #152 review: PassRate sent no token and would 401 in production.
|
||||
_, _ = c.PassRate(context.Background(), "tdd", "7d")
|
||||
assert.Equal(t, []string{"/query Bearer cli-test-token", "/write Bearer cli-test-token",
|
||||
"/pass-rate Bearer cli-test-token"}, got)
|
||||
}
|
||||
|
||||
func TestBrainClientSendsNoAuthorizationWhenTokenUnset(t *testing.T) {
|
||||
var auth string
|
||||
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
auth = r.Header.Get("Authorization")
|
||||
_, _ = w.Write([]byte(`{"results":[]}`))
|
||||
}))
|
||||
defer srv.Close()
|
||||
t.Setenv("BRAIN_URL", srv.URL)
|
||||
t.Setenv("BRAIN_MCP_TOKEN", "")
|
||||
_, err := newBrainClient().Query(context.Background(), "x", 1)
|
||||
require.NoError(t, err)
|
||||
assert.Empty(t, auth)
|
||||
}
|
||||
@@ -65,25 +65,23 @@ func TestBrainClient_Write_Success(t *testing.T) {
|
||||
assert.Equal(t, http.MethodPost, r.Method)
|
||||
body, _ := io.ReadAll(r.Body)
|
||||
var got struct {
|
||||
Wing string `json:"wing"`
|
||||
Hall string `json:"hall"`
|
||||
Filename string `json:"filename"`
|
||||
Type string `json:"type"`
|
||||
Slug string `json:"slug"`
|
||||
Content string `json:"content"`
|
||||
}
|
||||
require.NoError(t, json.Unmarshal(body, &got))
|
||||
assert.Equal(t, "homelab", got.Wing)
|
||||
assert.Equal(t, "facts", got.Hall)
|
||||
assert.Equal(t, "find-h", got.Filename)
|
||||
assert.Equal(t, "knowledge", got.Type)
|
||||
assert.Equal(t, "find-h", got.Slug)
|
||||
assert.Equal(t, "# body\n", got.Content)
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
_, _ = w.Write([]byte(`{"path":"wiki/homelab/facts/find-h.md"}`))
|
||||
_, _ = w.Write([]byte(`{"path":"knowledge/find-h.md"}`))
|
||||
}))
|
||||
defer srv.Close()
|
||||
|
||||
c := &brainClient{baseURL: srv.URL, http: srv.Client()}
|
||||
res, err := c.Write(context.Background(), "homelab", "facts", "find-h", strings.NewReader("# body\n"))
|
||||
res, err := c.Write(context.Background(), "knowledge", "find-h", strings.NewReader("# body\n"))
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "wiki/homelab/facts/find-h.md", res.Path)
|
||||
assert.Equal(t, "knowledge/find-h.md", res.Path)
|
||||
}
|
||||
|
||||
func TestBrainClient_PassRate_Success(t *testing.T) {
|
||||
|
||||
@@ -24,7 +24,7 @@ Only a `tools/call` to the routing pod records a pass/fail.
|
||||
|---------|-----|------|
|
||||
| Routing MCP (local, Tailscale) | `http://koala:30310/mcp` | Bearer `ROUTING_MCP_TOKEN` |
|
||||
| Routing MCP (remote) | `https://routing-mcp.d-ma.be/mcp` | OAuth via `auth.d-ma.be` (audience `claude-ai`) |
|
||||
| Pass-rate readout | `http://koala:30330/pass-rate?skill=<name>` | Bearer `BRAIN_MCP_TOKEN` (since hyperguild#149) |
|
||||
| Pass-rate readout | `http://koala:30330/pass-rate?skill=<name>` | none (read-only) |
|
||||
|
||||
Tools advertised: **`review`**, **`debug`** (the two the #35 gate measures),
|
||||
plus `session_log`, `retrospective`, `trainer`.
|
||||
|
||||
@@ -16,7 +16,7 @@ Three needs converge on a single small Go binary:
|
||||
|
||||
- [ ] `hyperguild tier` returns the same `tier.Info` that `internal/tier.Detect` produces for the same probe URLs, in < 3 s under all three tier conditions, with both human-readable and `--json` output.
|
||||
- [ ] `hyperguild brain query <topic>` returns BM25 results from the brain HTTP REST `/query` endpoint, exit 0 on success and non-zero on transport failure.
|
||||
- [ ] `hyperguild brain write <wing> <hall> <slug>` reads markdown content from stdin, posts to `/write` with wing/hall/filename, and creates `brain/wiki/<wing>/<hall>/<slug>.md`. A round-trip (`hyperguild brain query <slug>` immediately after) finds the entry. (Updated post-ADR-0012/#79: the legacy `<type> <slug>` shape and the `brain/knowledge/` fallback were removed; wing and hall are now required.)
|
||||
- [ ] `hyperguild brain write <type> <slug>` reads markdown content from stdin, posts to `/write` with the type and slug, and creates `brain/knowledge/<slug>.md`. A round-trip (`hyperguild brain query <slug>` immediately after) finds the entry.
|
||||
- [ ] `hyperguild mode <cloud|client-local|sovereign>` writes a parseable JSON file at the target path with the per-mode `mcpServers` entries; `jq -e .mcpServers` succeeds on the output.
|
||||
- [ ] All commands print usage on `--help`, exit 2 on unknown flags, exit non-zero on operational errors.
|
||||
- [ ] `task check` passes (lint + test + vet) on each task and on the merged branch.
|
||||
@@ -50,7 +50,7 @@ Three needs converge on a single small Go binary:
|
||||
|
||||
- **`brain` subcommand calls the HTTP REST API.** Two nested subcommands:
|
||||
- `brain query <topic>` issues `POST /query` with JSON body `{query, limit}` (default `--limit 5`), prints results in human-readable form by default and with `--json` for machine consumption.
|
||||
- `brain write <wing> <hall> <slug>` reads stdin, posts `POST /write` with JSON body `{wing, hall, filename, content}`, prints the resulting path on success. (Updated post-ADR-0012/#79: wing and hall are required, replacing the old `<type> <slug>` shape and the `brain/knowledge/` legacy fallback.)
|
||||
- `brain write <type> <slug>` reads stdin, posts `POST /write` with JSON body `{type, slug, content}`, prints the resulting path on success.
|
||||
Rationale: HTTP REST is simpler than MCP framing for a CLI. Per CLAUDE.md, the REST endpoints are documented as the official non-MCP interface.
|
||||
|
||||
- **`mode <name>` writes a per-mode `.mcp.json` template.** Defaults to writing `./.mcp.json` (cwd); accepts `--out <path>`. Per-mode bodies:
|
||||
|
||||
@@ -1,26 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"log/slog"
|
||||
|
||||
chassisauth "git.d-ma.be/mathias/mcp-chassis/auth"
|
||||
)
|
||||
|
||||
// buildJWTValidator builds the JWT validator for issuer (nil when issuer is
|
||||
// empty: JWT auth disabled). Since mcp-chassis v0.7 construction no longer
|
||||
// fails when OIDC discovery does (mcp-chassis#4): the issuer resolves lazily,
|
||||
// and until it does a JWT is answered 503-and-retry, not 401. That replaces
|
||||
// #83's boot-time retry loop (hyperguild#155). An issuer still unresolved at
|
||||
// boot is logged, so a misconfigured issuer is visible rather than silent.
|
||||
func buildJWTValidator(ctx context.Context, logger *slog.Logger, issuer, audience string) (*chassisauth.JWTValidator, error) {
|
||||
v, err := chassisauth.NewJWTValidator(ctx, issuer, audience)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("build jwt validator: %w", err)
|
||||
}
|
||||
if ok, rerr := v.Ready(ctx); !ok {
|
||||
logger.Warn("jwt issuer not resolved at boot; JWTs answer 503 until it is", "issuer", issuer, "err", rerr)
|
||||
}
|
||||
return v, nil
|
||||
}
|
||||
@@ -1,111 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"io"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"sync/atomic"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/metrics"
|
||||
)
|
||||
|
||||
// fakeIssuer answers OIDC discovery with 502 for the first fail requests, as
|
||||
// ingress does while dex is not yet serving on a cold boot (#83), then with a
|
||||
// real discovery document and an empty JWKS.
|
||||
func fakeIssuer(t *testing.T, fail int32) (*httptest.Server, *atomic.Int32) {
|
||||
t.Helper()
|
||||
var discoveries atomic.Int32
|
||||
mux := http.NewServeMux()
|
||||
var srv *httptest.Server
|
||||
mux.HandleFunc("/.well-known/openid-configuration", func(w http.ResponseWriter, _ *http.Request) {
|
||||
if discoveries.Add(1) <= fail {
|
||||
w.WriteHeader(http.StatusBadGateway)
|
||||
return
|
||||
}
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
_, _ = io.WriteString(w, `{"issuer":"`+srv.URL+`","jwks_uri":"`+srv.URL+`/keys"}`)
|
||||
})
|
||||
mux.HandleFunc("/keys", func(w http.ResponseWriter, _ *http.Request) {
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
_, _ = io.WriteString(w, `{"keys":[]}`)
|
||||
})
|
||||
srv = httptest.NewServer(mux)
|
||||
t.Cleanup(srv.Close)
|
||||
return srv, &discoveries
|
||||
}
|
||||
|
||||
// #83 retried discovery at boot because chassis v0.2.0 failed construction on
|
||||
// a 502. Since chassis v0.7 (mcp-chassis#4) the validator is built anyway and
|
||||
// resolves the issuer lazily, so boot no longer waits or exits on it
|
||||
// (hyperguild#155). An unresolved issuer is logged at boot.
|
||||
func TestBuildJWTValidatorReturnsAValidatorWhileDiscovery502s(t *testing.T) {
|
||||
srv, _ := fakeIssuer(t, 1000)
|
||||
var buf bytes.Buffer
|
||||
v, err := buildJWTValidator(context.Background(), slog.New(slog.NewTextHandler(&buf, nil)), srv.URL, "brain")
|
||||
require.NoError(t, err)
|
||||
assert.NotNil(t, v)
|
||||
assert.Contains(t, buf.String(), "jwt issuer not resolved at boot")
|
||||
}
|
||||
|
||||
func TestBuildJWTValidatorLogsNothingAgainstAHealthyIssuer(t *testing.T) {
|
||||
srv, _ := fakeIssuer(t, 0)
|
||||
var buf bytes.Buffer
|
||||
v, err := buildJWTValidator(context.Background(), slog.New(slog.NewTextHandler(&buf, nil)), srv.URL, "brain")
|
||||
require.NoError(t, err)
|
||||
assert.NotNil(t, v)
|
||||
assert.NotContains(t, buf.String(), "not resolved")
|
||||
}
|
||||
|
||||
func TestBuildJWTValidatorIsNilWithoutAnIssuer(t *testing.T) {
|
||||
v, err := buildJWTValidator(context.Background(), slog.New(slog.DiscardHandler), "", "brain")
|
||||
require.NoError(t, err)
|
||||
assert.Nil(t, v)
|
||||
}
|
||||
|
||||
// With the issuer unresolved, a JWT on a REST route answers 503 (retry), not
|
||||
// 401: the token may be fine, the server just cannot check it yet.
|
||||
func TestBuildMuxAnswers503ToAJWTWhileTheIssuerIsUnresolved(t *testing.T) {
|
||||
srv, _ := fakeIssuer(t, 1000)
|
||||
v, err := buildJWTValidator(context.Background(), slog.New(slog.DiscardHandler), srv.URL, "brain")
|
||||
require.NoError(t, err)
|
||||
mux, err := buildMux(restAuth{token: routesTok, validator: v, realm: "brain"}, testHandler(t),
|
||||
okHandler("mcp"), metrics.New(), nil)
|
||||
require.NoError(t, err)
|
||||
code, _ := do(t, mux, "GET", "/pending", "Bearer aaa.bbb.ccc")
|
||||
assert.Equal(t, http.StatusServiceUnavailable, code)
|
||||
}
|
||||
|
||||
// PR #183 review: /mcp shares REST's bearer, but only the static token was
|
||||
// asserted on it. With the issuer unresolved, a JWT on /mcp answers 503 too,
|
||||
// so /mcp's middleware was built with the JWT validator.
|
||||
func TestBuildMuxAnswers503ToAJWTOnMCPWhileTheIssuerIsUnresolved(t *testing.T) {
|
||||
srv, _ := fakeIssuer(t, 1000)
|
||||
v, err := buildJWTValidator(context.Background(), slog.New(slog.DiscardHandler), srv.URL, "brain")
|
||||
require.NoError(t, err)
|
||||
mux, err := buildMux(restAuth{token: routesTok, validator: v, realm: "brain"}, testHandler(t),
|
||||
okHandler("mcp"), metrics.New(), nil)
|
||||
require.NoError(t, err)
|
||||
code, _ := do(t, mux, "POST", "/mcp", "Bearer aaa.bbb.ccc")
|
||||
assert.Equal(t, http.StatusServiceUnavailable, code)
|
||||
}
|
||||
|
||||
// PR #183 review: a 401 on /mcp names the protected-resource metadata in
|
||||
// WWW-Authenticate (what the claude.ai OAuth connector discovers from), so
|
||||
// /mcp's middleware was built with resourceMetadataURL.
|
||||
func TestBuildMuxMCP401CarriesResourceMetadataInWWWAuthenticate(t *testing.T) {
|
||||
const rm = "https://brain.example/.well-known/oauth-protected-resource"
|
||||
mux, err := buildMux(restAuth{token: routesTok, realm: "brain", resourceMetadataURL: rm}, testHandler(t),
|
||||
okHandler("mcp"), metrics.New(), nil)
|
||||
require.NoError(t, err)
|
||||
rec := httptest.NewRecorder()
|
||||
mux.ServeHTTP(rec, httptest.NewRequest(http.MethodPost, "/mcp", nil))
|
||||
require.Equal(t, http.StatusUnauthorized, rec.Code)
|
||||
assert.Contains(t, rec.Header().Get("WWW-Authenticate"), `resource_metadata="`+rm+`"`)
|
||||
}
|
||||
@@ -32,7 +32,7 @@ import (
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/reranker"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/search"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/symlinkguard"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/startupretry"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/vectorstore"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/watcher"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/webhook"
|
||||
@@ -147,38 +147,6 @@ func envInt(key string, fallback int) int {
|
||||
// buildNotifier returns the ntfy notifier, or a nil interface when
|
||||
// BRAIN_NTFY_URL is unset. A nil *interface* (not a typed-nil) is required so
|
||||
// DegradingSink/Reconcile and the governance observer skip it cleanly.
|
||||
// alertingWarnings names every alert that will not fire under the current
|
||||
// configuration (#107).
|
||||
//
|
||||
// buildNotifier returns a nil interface when BRAIN_NTFY_URL is unset, and every
|
||||
// consumer skips a nil notifier silently — right for an unconfigured homelab,
|
||||
// wrong for an alert whose entire value is that someone finds out. The cost of
|
||||
// the silence is that "configured and working" and "never configured" are
|
||||
// byte-identical in behaviour: no error, no warning, only a message that never
|
||||
// arrives, which nobody notices because nobody is waiting for an alert they
|
||||
// have never seen. Two alerts were dark in production for exactly that reason
|
||||
// (#100), found by firing a real event rather than by reading anything.
|
||||
//
|
||||
// WARN rather than fatal, deliberately. The brain sibling rule
|
||||
// (`empty-credential-must-refuse-to-start-not-switch-modes`) says an empty
|
||||
// credential must be a startup error, never a silent mode switch — but that is
|
||||
// about a control being removed. Here observability is degraded, not a gate
|
||||
// bypassed, and refusing to boot would break the unconfigured-homelab case the
|
||||
// nil notifier exists to support. What the rule does demand, and what this
|
||||
// provides, is that the mode switch stops being silent.
|
||||
//
|
||||
// Pure and env-injected so the message is testable without a running server:
|
||||
// the reason this gap survived is that nothing about it was observable.
|
||||
func alertingWarnings(getenv func(string) string) []string {
|
||||
var out []string
|
||||
if getenv("BRAIN_NTFY_URL") == "" {
|
||||
out = append(out, "alerting DISABLED: BRAIN_NTFY_URL unset — "+
|
||||
"brain_edit_root governance rewrites, capture audit degradation and the "+
|
||||
"brain symlink tripwire (hyperguild#157) will not notify")
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
func buildNotifier() audit.Notifier {
|
||||
if n := audit.NewNtfyNotifier(os.Getenv("BRAIN_NTFY_URL"), os.Getenv("BRAIN_NTFY_TOKEN")); n != nil {
|
||||
return n
|
||||
@@ -235,15 +203,7 @@ func systemHostname() string {
|
||||
func main() {
|
||||
logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
|
||||
|
||||
for _, w := range alertingWarnings(os.Getenv) {
|
||||
logger.Warn(w)
|
||||
}
|
||||
|
||||
brainDir := envOr("INGEST_BRAIN_DIR", "../brain")
|
||||
if err := startupSymlinkCheck(brainDir); err != nil {
|
||||
logger.Error("brain symlink tripwire", "err", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
port := envOr("INGEST_PORT", "3300")
|
||||
|
||||
llmURL := envOr("INGEST_LLM_URL", "http://iguana:4000/v1")
|
||||
@@ -365,18 +325,28 @@ func main() {
|
||||
}
|
||||
|
||||
ctx := context.Background()
|
||||
// hyperguild#157: report a symlink that appears in the brain while running.
|
||||
go symlinkguard.Watch(ctx, brainDir, symlinkScanInterval(os.Getenv), buildNotifier())
|
||||
|
||||
// Never fatal on an unreachable issuer (#83): on a cold cluster boot this
|
||||
// pod can beat dex to serving and get a 502 from ingress, and exiting meant
|
||||
// CrashLoopBackOff redoing the backfill. Since mcp-chassis v0.7 the
|
||||
// validator resolves the issuer lazily and answers JWTs 503-and-retry until
|
||||
// it does (hyperguild#155), so no boot retry is needed. A misconfigured
|
||||
// issuer no longer exits the process: it is logged at boot and every JWT
|
||||
// gets 503; the static bearer keeps working.
|
||||
jwtValidator, err := buildJWTValidator(ctx, logger,
|
||||
os.Getenv("DEX_ISSUER_URL"), os.Getenv("MCP_AUDIENCE"))
|
||||
// Built before the watcher, the graph backfill and session ingestion, and
|
||||
// retried rather than fatal (#83). Two separate reasons:
|
||||
//
|
||||
// - On a cold cluster boot this pod can beat dex to serving and gets a
|
||||
// 502 from ingress. Nothing is misconfigured; it simply started first.
|
||||
// Exiting there meant CrashLoopBackOff redoing the backfill on every
|
||||
// attempt, with exponential backoff stretching the brain outage.
|
||||
// - Constructing it first means a genuine config error (wrong issuer,
|
||||
// bad audience) fails in seconds instead of after all that work.
|
||||
//
|
||||
// The budget stays bounded: retrying forever would turn a misconfiguration
|
||||
// into a process that looks alive and never serves.
|
||||
jwtValidator, err := startupretry.Do(ctx,
|
||||
startupretry.Policy{Attempts: 8, Base: time.Second, Max: 30 * time.Second},
|
||||
func(ctx context.Context) (*chassisauth.JWTValidator, error) {
|
||||
v, err := chassisauth.NewJWTValidator(ctx, os.Getenv("DEX_ISSUER_URL"), os.Getenv("MCP_AUDIENCE"))
|
||||
if err != nil {
|
||||
logger.Warn("oidc discovery not ready, retrying", "err", err)
|
||||
}
|
||||
return v, err
|
||||
})
|
||||
if err != nil {
|
||||
logger.Error("build jwt validator", "err", err)
|
||||
os.Exit(1)
|
||||
@@ -498,10 +468,20 @@ func main() {
|
||||
logger.Info("embed sync started", "interval_s", embedSyncInterval)
|
||||
}
|
||||
|
||||
// Public routes only; buildMux mounts the authenticated REST API (#149).
|
||||
public := map[string]http.Handler{}
|
||||
mux := http.NewServeMux()
|
||||
mux.HandleFunc("POST /query", h.Query)
|
||||
mux.HandleFunc("POST /write", h.Write)
|
||||
mux.HandleFunc("POST /index", h.Index)
|
||||
mux.HandleFunc("POST /ingest", h.Ingest)
|
||||
mux.HandleFunc("POST /ingest-path", h.IngestPath)
|
||||
mux.HandleFunc("POST /ingest-raw", h.IngestRaw)
|
||||
mux.HandleFunc("POST /backfill-refs", h.BackfillRefs)
|
||||
mux.HandleFunc("GET /pending", h.Pending)
|
||||
mux.HandleFunc("POST /promote", h.Promote)
|
||||
mux.HandleFunc("POST /backfill-embeddings", h.BackfillEmbeddings)
|
||||
mux.HandleFunc("GET /pass-rate", h.PassRate)
|
||||
if webhookHandler != nil {
|
||||
public["POST /webhooks/brain-sync"] = webhookHandler
|
||||
mux.Handle("POST /webhooks/brain-sync", webhookHandler)
|
||||
}
|
||||
// Resource-metadata URL is only emitted on 401 when Dex OAuth is
|
||||
// configured. Static-Bearer-only deployments leave this empty so
|
||||
@@ -509,13 +489,15 @@ func main() {
|
||||
var resourceMetadataURL string
|
||||
if dexURL := os.Getenv("DEX_ISSUER_URL"); dexURL != "" {
|
||||
resourceURL := os.Getenv("MCP_RESOURCE_URL")
|
||||
public["GET /.well-known/oauth-protected-resource"] = http.HandlerFunc(
|
||||
mux.HandleFunc("GET /.well-known/oauth-protected-resource",
|
||||
chassisauth.ProtectedResourceHandler(resourceURL, dexURL))
|
||||
if resourceURL != "" {
|
||||
resourceMetadataURL = strings.TrimRight(resourceURL, "/") + "/.well-known/oauth-protected-resource"
|
||||
}
|
||||
}
|
||||
|
||||
mux.Handle("/mcp", chassisauth.BearerMiddleware(mcpToken, jwtValidator, "brain", resourceMetadataURL, mcpSrv))
|
||||
|
||||
// POST /capture (#53/#54): the uniform capture REST door. Needs a ticket
|
||||
// tracker to file action items, so it only mounts when Gitea is
|
||||
// configured. It reuses the MCP server's graph-wired brain store (one
|
||||
@@ -536,10 +518,10 @@ func main() {
|
||||
sovereign := splitList(os.Getenv("BRAIN_CAPTURE_SOVEREIGN_PRINCIPALS"))
|
||||
resolver := capturehttp.NewOriginResolver(sovereign)
|
||||
captureH := capturehttp.New(captureSvc, jwtValidator, mcpToken, "local-cli", resolver)
|
||||
public["POST /capture"] = captureH
|
||||
mux.Handle("POST /capture", captureH)
|
||||
// Same use-case behind the MCP `capture` tool (#55 relay) so MCP-native
|
||||
// harnesses (claude.ai, Crush, Pi, LLM Council) reach capture through
|
||||
// the existing /mcp OAuth connector. buildMux wraps this same mcpSrv;
|
||||
// the existing /mcp OAuth connector. mcpSrv is already wrapped above;
|
||||
// WithCapture mutates the same instance, so the tool appears live.
|
||||
mcpSrv.WithCapture(captureSvc, jwtValidator, mcpToken, "local-cli", resolver)
|
||||
// hyperguild#97: a governance-file rewrite gets the same trail a
|
||||
@@ -566,9 +548,9 @@ func main() {
|
||||
logger.Error("OAUTH_CLIENT_ID/SECRET set but MCP_RESOURCE_URL is empty; cannot derive issuer")
|
||||
os.Exit(1)
|
||||
}
|
||||
public["GET /.well-known/oauth-authorization-server"] = http.HandlerFunc(
|
||||
mux.HandleFunc("GET /.well-known/oauth-authorization-server",
|
||||
oauth.MetadataHandler(issuer))
|
||||
public["POST /oauth/token"] = http.HandlerFunc(oauth.TokenHandler(oauth.TokenConfig{
|
||||
mux.HandleFunc("POST /oauth/token", oauth.TokenHandler(oauth.TokenConfig{
|
||||
ClientID: oauthID,
|
||||
ClientSecret: oauthSecret,
|
||||
AccessToken: mcpToken,
|
||||
@@ -581,22 +563,13 @@ func main() {
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
// /metrics — unauthenticated Prometheus endpoint, scraped via the
|
||||
// ServiceMonitor in k3s/apps/supervisor/. buildMux registers it and wraps
|
||||
// the whole router in the registry's middleware.
|
||||
//
|
||||
// The whole router, /mcp's bearer included, is built in buildMux so its
|
||||
// tests are tests of production wiring (PR #152 review, hyperguild#154).
|
||||
// The REST API's credential is the same as /mcp's. Untested here: the
|
||||
// restAuth fields and the public map this call passes in (e.g. a nil
|
||||
// validator would drop JWT auth on /mcp and REST and the suite stays
|
||||
// green), and ListenAndServe serving the result unchanged (hyperguild#182).
|
||||
handler, err := buildMux(restAuth{token: mcpToken, validator: jwtValidator, realm: "brain",
|
||||
resourceMetadataURL: resourceMetadataURL}, h, mcpSrv, metrics.New(), public)
|
||||
if err != nil {
|
||||
logger.Error("build router", "err", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
// /metrics — unauthenticated Prometheus endpoint. kube-prometheus-stack
|
||||
// scrapes it via the ServiceMonitor in k3s/apps/supervisor/. The metrics
|
||||
// middleware below wraps every other registered handler so it observes
|
||||
// real request latency. /metrics itself is excluded from its own
|
||||
// observation by registering it on the outer mux (post-wrap).
|
||||
reg := metrics.New()
|
||||
mux.HandleFunc("GET /metrics", reg.Handler())
|
||||
logger.Info("metrics endpoint registered", "path", "/metrics")
|
||||
|
||||
addr := ":" + port
|
||||
@@ -613,7 +586,7 @@ func main() {
|
||||
"watch_interval", watchIntervalLog,
|
||||
"mcp_enabled", true,
|
||||
)
|
||||
if err := http.ListenAndServe(addr, handler); err != nil {
|
||||
if err := http.ListenAndServe(addr, reg.Middleware(mux)); err != nil {
|
||||
logger.Error("server stopped", "err", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
@@ -6,7 +6,6 @@ import (
|
||||
"log/slog"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
@@ -37,42 +36,3 @@ func TestClaudeSink_IngestWritesToNonIndexedArchiveNotWiki(t *testing.T) {
|
||||
_, err = os.Stat(filepath.Join(dir, "wiki", "claude-sessions"))
|
||||
assert.True(t, os.IsNotExist(err), "raw transcripts must never land under wiki/ (ai-sessions#10 — BM25 pollution)")
|
||||
}
|
||||
|
||||
// --- #107: an unconfigured alert must announce itself ----------------------
|
||||
|
||||
func TestAlertingWarnings(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
env map[string]string
|
||||
want []string // substrings that must appear across the warnings
|
||||
none bool // true = expect no warnings at all
|
||||
}{
|
||||
{
|
||||
// The failure this exists to prevent: two alerts dark in
|
||||
// production, discovered only by firing a real event and watching
|
||||
// nothing arrive (#100).
|
||||
name: "notifier unconfigured names what will not fire",
|
||||
env: map[string]string{},
|
||||
want: []string{"BRAIN_NTFY_URL", "brain_edit_root", "audit"},
|
||||
},
|
||||
{
|
||||
name: "configured notifier is silent",
|
||||
env: map[string]string{"BRAIN_NTFY_URL": "http://ntfy/brain-alerts"},
|
||||
none: true,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
got := alertingWarnings(func(k string) string { return tt.env[k] })
|
||||
if tt.none {
|
||||
assert.Empty(t, got)
|
||||
return
|
||||
}
|
||||
joined := strings.Join(got, " ")
|
||||
for _, w := range tt.want {
|
||||
assert.Contains(t, joined, w)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,109 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"net/http"
|
||||
|
||||
chassisauth "git.d-ma.be/mathias/mcp-chassis/auth"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/api"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/metrics"
|
||||
)
|
||||
|
||||
// publicRoutes is the complete set of patterns a caller may register on the
|
||||
// outer mux, outside the REST API's auth (hyperguild#149). Each authenticates
|
||||
// itself or is meant to be open: /capture (bearer/JWT), the webhook (HMAC),
|
||||
// /oauth/token (client secret) and OAuth metadata (open). /mcp and /metrics
|
||||
// are not here: buildMux builds them itself (hyperguild#154). A REST pattern
|
||||
// added here would beat the authenticated catch-all by specificity and ship
|
||||
// open, which is why buildMux refuses anything else.
|
||||
var publicRoutes = map[string]bool{
|
||||
"POST /capture": true,
|
||||
"POST /webhooks/brain-sync": true,
|
||||
"GET /.well-known/oauth-protected-resource": true,
|
||||
"GET /.well-known/oauth-authorization-server": true,
|
||||
"POST /oauth/token": true,
|
||||
}
|
||||
|
||||
// restAuth is the credential the REST API checks: the same as /mcp's.
|
||||
type restAuth struct {
|
||||
token string
|
||||
validator *chassisauth.JWTValidator
|
||||
realm string
|
||||
resourceMetadataURL string
|
||||
}
|
||||
|
||||
// buildMux builds the handler main passes to ListenAndServe unchanged. The
|
||||
// REST API is mounted at "/" and /mcp is registered, both behind bearer auth
|
||||
// that buildMux constructs itself from auth (one credential), so a caller
|
||||
// cannot pass a no-op. GET /metrics serves reg, and the whole router is
|
||||
// wrapped in reg's middleware. Other public handlers are registered as given,
|
||||
// and only for patterns on the publicRoutes allowlist. It returns an
|
||||
// http.Handler, not the *ServeMux, so nothing can register a route on the
|
||||
// result. What stays untested is main's call site: the restAuth fields and
|
||||
// the public map main passes in, and ListenAndServe serving this handler
|
||||
// unchanged (hyperguild#182). The tests build their own arguments.
|
||||
func buildMux(
|
||||
auth restAuth, h *api.Handler, mcpHandler http.Handler, reg *metrics.Registry, public map[string]http.Handler,
|
||||
) (http.Handler, error) {
|
||||
if auth.token == "" {
|
||||
return nil, errors.New("buildMux: REST auth needs a token")
|
||||
}
|
||||
if mcpHandler == nil || reg == nil {
|
||||
return nil, errors.New("buildMux: needs the MCP handler and the metrics registry")
|
||||
}
|
||||
mux := http.NewServeMux()
|
||||
for pattern, handler := range public {
|
||||
if !publicRoutes[pattern] {
|
||||
return nil, fmt.Errorf("buildMux: %q is not an allowed public route", pattern)
|
||||
}
|
||||
mux.Handle(pattern, handler)
|
||||
}
|
||||
bearer := func(next http.Handler) http.Handler {
|
||||
return chassisauth.BearerMiddleware(auth.token, auth.validator, auth.realm, auth.resourceMetadataURL, next)
|
||||
}
|
||||
mux.Handle("/mcp", bearer(mcpHandler))
|
||||
// /metrics is registered on the mux and so observed by its own
|
||||
// middleware, like any route.
|
||||
mux.Handle("GET /metrics", reg.Handler())
|
||||
mountREST(mux, h, bearer)
|
||||
return reg.Middleware(mux), nil
|
||||
}
|
||||
|
||||
// mountREST registers the REST API on its own mux and mounts it at "/" behind
|
||||
// auth: anything not registered as public lands here and is authenticated,
|
||||
// including routes added later.
|
||||
func mountREST(mux *http.ServeMux, h *api.Handler, auth func(http.Handler) http.Handler) {
|
||||
rest := http.NewServeMux()
|
||||
rest.HandleFunc("POST /query", h.Query)
|
||||
rest.HandleFunc("POST /write", h.Write)
|
||||
rest.HandleFunc("POST /index", h.Index)
|
||||
rest.HandleFunc("POST /ingest", h.Ingest)
|
||||
rest.HandleFunc("POST /ingest-path", h.IngestPath)
|
||||
rest.HandleFunc("POST /ingest-raw", h.IngestRaw)
|
||||
rest.HandleFunc("POST /backfill-refs", h.BackfillRefs)
|
||||
rest.HandleFunc("GET /pending", h.Pending)
|
||||
rest.HandleFunc("POST /promote", h.Promote)
|
||||
rest.HandleFunc("POST /backfill-embeddings", h.BackfillEmbeddings)
|
||||
rest.HandleFunc("GET /pass-rate", h.PassRate)
|
||||
mux.Handle("/", labelRESTPattern(rest, auth(rest)))
|
||||
}
|
||||
|
||||
// labelRESTPattern sets the request's Pattern to the REST route it addresses
|
||||
// before auth runs, so the metrics middleware (which reads Pattern from the
|
||||
// same *http.Request) labels a refused request by its route rather than by
|
||||
// the "/" mount (hyperguild#155). A refused request to a path no route
|
||||
// matches keeps "/", so for refused requests the label set stays bounded by
|
||||
// the registered routes. That bound does not hold for authenticated
|
||||
// requests: an unregistered path reaches the REST mux, which 404s with an
|
||||
// empty Pattern, and the metrics middleware falls back to the raw URL path
|
||||
// (hyperguild#185).
|
||||
func labelRESTPattern(rest *http.ServeMux, next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
if _, pattern := rest.Handler(r); pattern != "" {
|
||||
r.Pattern = pattern
|
||||
}
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
@@ -1,88 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
// wrongTokSentinel is a presented credential distinctive enough that any
|
||||
// occurrence in a log line is the raw token, not a coincidence.
|
||||
const wrongTokSentinel = "wrong-tok-sentinel-q7zx"
|
||||
|
||||
// hyperguild#155: since #149 every REST route sits behind BearerMiddleware,
|
||||
// and chassis v0.2.0 refused without logging, so an unknown caller got
|
||||
// silent 401s. The chassis now writes an `mcp auth rejected` line, and the
|
||||
// presented token appears nowhere in the log as a bare value (PR #181
|
||||
// review: asserting on the "Bearer " header form could never fail, since
|
||||
// the chassis logs fields, not headers).
|
||||
func TestBuildMuxRejectionLogLineOmitsTheBarePresentedToken(t *testing.T) {
|
||||
var buf bytes.Buffer
|
||||
prev := slog.Default()
|
||||
slog.SetDefault(slog.New(slog.NewTextHandler(&buf, nil)))
|
||||
t.Cleanup(func() { slog.SetDefault(prev) })
|
||||
|
||||
code, _ := do(t, testMux(t), "POST", "/query", "Bearer "+wrongTokSentinel)
|
||||
require.Equal(t, http.StatusUnauthorized, code)
|
||||
assert.Contains(t, buf.String(), "mcp auth rejected")
|
||||
assert.Contains(t, buf.String(), "path=/query")
|
||||
assert.NotContains(t, buf.String(), wrongTokSentinel, "the rejected token is logged as a bare value")
|
||||
assert.NotContains(t, buf.String(), routesTok, "the valid static token is logged")
|
||||
}
|
||||
|
||||
// The `mcp auth accepted` line leaves out the valid static token.
|
||||
func TestBuildMuxAcceptedLogLineOmitsTheBareStaticToken(t *testing.T) {
|
||||
var buf bytes.Buffer
|
||||
prev := slog.Default()
|
||||
slog.SetDefault(slog.New(slog.NewTextHandler(&buf, nil)))
|
||||
t.Cleanup(func() { slog.SetDefault(prev) })
|
||||
|
||||
code, _ := do(t, testMux(t), "GET", "/pending", "Bearer "+routesTok)
|
||||
require.Equal(t, http.StatusOK, code)
|
||||
assert.Contains(t, buf.String(), "mcp auth accepted")
|
||||
assert.NotContains(t, buf.String(), routesTok, "the accepted static token is logged as a bare value")
|
||||
}
|
||||
|
||||
// An authenticated REST request is labelled with the REST mux's pattern:
|
||||
// the inner mux sets it on the same *http.Request the outer middleware reads.
|
||||
func TestMetricsLabelAnAuthenticatedRESTRequestWithItsRoutePattern(t *testing.T) {
|
||||
mux, reg := testMuxAndRegistry(t)
|
||||
code, _ := do(t, mux, "GET", "/pending", "Bearer "+routesTok)
|
||||
require.Equal(t, http.StatusOK, code)
|
||||
|
||||
rec := httptest.NewRecorder()
|
||||
reg.Handler().ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/metrics", nil))
|
||||
assert.Contains(t, rec.Body.String(), `path="GET /pending"`)
|
||||
assert.NotContains(t, rec.Body.String(), `path="/"`)
|
||||
}
|
||||
|
||||
// hyperguild#155: a request refused by REST auth never reaches the REST mux,
|
||||
// so it was labelled path="/" and a 4xx on /query could not be told from one
|
||||
// on /write. It is now labelled with the REST pattern it was addressed to.
|
||||
func TestMetricsLabelARejectedRESTRequestWithItsRoutePattern(t *testing.T) {
|
||||
mux, reg := testMuxAndRegistry(t)
|
||||
code, _ := do(t, mux, "POST", "/query", "")
|
||||
require.Equal(t, http.StatusUnauthorized, code)
|
||||
|
||||
rec := httptest.NewRecorder()
|
||||
reg.Handler().ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/metrics", nil))
|
||||
assert.Contains(t, rec.Body.String(), `path="POST /query",status="4xx"`)
|
||||
}
|
||||
|
||||
// A path no REST route matches keeps the catch-all label, so an attacker
|
||||
// probing random URLs cannot grow the series set.
|
||||
func TestMetricsLabelARejectedUnknownPathWithTheCatchAll(t *testing.T) {
|
||||
mux, reg := testMuxAndRegistry(t)
|
||||
code, _ := do(t, mux, "POST", "/no-such-route-zq", "")
|
||||
require.Equal(t, http.StatusUnauthorized, code)
|
||||
|
||||
rec := httptest.NewRecorder()
|
||||
reg.Handler().ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/metrics", nil))
|
||||
assert.Contains(t, rec.Body.String(), `path="/",status="4xx"`)
|
||||
assert.NotContains(t, rec.Body.String(), "no-such-route-zq")
|
||||
}
|
||||
@@ -1,161 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/api"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/metrics"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
|
||||
)
|
||||
|
||||
const routesTok = "routes-test-token"
|
||||
|
||||
func okHandler(body string) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { _, _ = w.Write([]byte(body)) })
|
||||
}
|
||||
|
||||
// testMux builds the router through buildMux, the function main calls, with
|
||||
// every allowlisted public pattern (stub handlers), a stub MCP server and a
|
||||
// static token only: no JWT validator and no resourceMetadataURL (the tests
|
||||
// in jwt_validator_test.go pass those). It does not use main's own restAuth
|
||||
// or public map (hyperguild#182). hyperguild#149: the REST API is
|
||||
// authenticated as a whole; the PR #152 review showed a test of a COPY of
|
||||
// the router let main.go regress unseen.
|
||||
func testMux(t *testing.T) http.Handler {
|
||||
t.Helper()
|
||||
mux, _ := testMuxAndRegistry(t)
|
||||
return mux
|
||||
}
|
||||
|
||||
func testMuxAndRegistry(t *testing.T) (http.Handler, *metrics.Registry) {
|
||||
t.Helper()
|
||||
public := map[string]http.Handler{}
|
||||
for p := range publicRoutes {
|
||||
public[p] = okHandler("public " + p)
|
||||
}
|
||||
reg := metrics.New()
|
||||
mux, err := buildMux(restAuth{token: routesTok, realm: "brain"}, testHandler(t), okHandler("mcp"), reg, public)
|
||||
require.NoError(t, err)
|
||||
return mux, reg
|
||||
}
|
||||
|
||||
func testHandler(t *testing.T) *api.Handler {
|
||||
t.Helper()
|
||||
return api.NewHandler(t.TempDir(), slog.New(slog.NewTextHandler(os.Stderr, nil)), pipeline.Config{})
|
||||
}
|
||||
|
||||
func do(t *testing.T, h http.Handler, method, path, authz string) (int, string) {
|
||||
t.Helper()
|
||||
req := httptest.NewRequest(method, path, strings.NewReader(`{"query":"x"}`))
|
||||
if authz != "" {
|
||||
req.Header.Set("Authorization", authz)
|
||||
}
|
||||
rec := httptest.NewRecorder()
|
||||
h.ServeHTTP(rec, req)
|
||||
return rec.Code, rec.Body.String()
|
||||
}
|
||||
|
||||
func TestBuildMuxRefusesRESTRoutesWithoutAValidToken(t *testing.T) {
|
||||
r := testMux(t)
|
||||
for _, rt := range []struct{ method, path string }{
|
||||
{"POST", "/query"}, {"POST", "/write"}, {"POST", "/index"}, {"POST", "/ingest"},
|
||||
{"POST", "/ingest-path"}, {"POST", "/ingest-raw"}, {"POST", "/backfill-refs"},
|
||||
{"GET", "/pending"}, {"POST", "/promote"}, {"POST", "/backfill-embeddings"}, {"GET", "/pass-rate"},
|
||||
} {
|
||||
code, _ := do(t, r, rt.method, rt.path, "")
|
||||
assert.Equal(t, http.StatusUnauthorized, code, "%s %s without a token", rt.method, rt.path)
|
||||
code, _ = do(t, r, rt.method, rt.path, "Bearer wrong")
|
||||
assert.Equal(t, http.StatusUnauthorized, code, "%s %s with a wrong token", rt.method, rt.path)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildMuxServesRESTRoutesToAValidToken(t *testing.T) {
|
||||
r := testMux(t)
|
||||
code, _ := do(t, r, "GET", "/pending", "Bearer "+routesTok)
|
||||
assert.Equal(t, http.StatusOK, code)
|
||||
}
|
||||
|
||||
func TestBuildMuxAuthenticatesAnUnregisteredPath(t *testing.T) {
|
||||
code, _ := do(t, testMux(t), "POST", "/some-future-route", "")
|
||||
assert.Equal(t, http.StatusUnauthorized, code)
|
||||
}
|
||||
|
||||
// buildMux registers public handlers as given, without adding auth: each
|
||||
// public route owns its own (bearer/JWT on /capture, HMAC on the webhook,
|
||||
// client secret on /oauth/token) or is meant to be open (OAuth metadata).
|
||||
// /mcp and /metrics are not public routes: buildMux builds them itself.
|
||||
func TestBuildMuxDoesNotWrapPublicRoutes(t *testing.T) {
|
||||
r := testMux(t)
|
||||
for p := range publicRoutes {
|
||||
method, path, ok := strings.Cut(p, " ")
|
||||
if !ok {
|
||||
method, path = "GET", p
|
||||
}
|
||||
code, body := do(t, r, method, path, "")
|
||||
assert.Equal(t, http.StatusOK, code, p)
|
||||
assert.Equal(t, "public "+p, body, p)
|
||||
}
|
||||
}
|
||||
|
||||
// The allowlist is the control: a REST pattern registered as public would win
|
||||
// over the authenticated catch-all (more specific pattern), so it is refused.
|
||||
func TestBuildMuxRefusesAPublicPatternOffTheAllowlist(t *testing.T) {
|
||||
h := api.NewHandler(t.TempDir(), slog.New(slog.NewTextHandler(os.Stderr, nil)), pipeline.Config{})
|
||||
// "/mcp" and "GET /metrics" are built by buildMux itself (hyperguild#154):
|
||||
// passing either as public would register them unauthenticated or twice.
|
||||
for _, p := range []string{"POST /query", "GET /pending", "/", "POST /metrics", "/mcp", "GET /metrics"} {
|
||||
_, err := buildMux(restAuth{token: routesTok, realm: "brain"}, h, okHandler("mcp"), metrics.New(),
|
||||
map[string]http.Handler{p: okHandler("x")})
|
||||
assert.Error(t, err, "public pattern %q must be refused", p)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildMuxRefusesAnEmptyToken(t *testing.T) {
|
||||
h := api.NewHandler(t.TempDir(), slog.New(slog.NewTextHandler(os.Stderr, nil)), pipeline.Config{})
|
||||
_, err := buildMux(restAuth{token: "", realm: "brain"}, h, okHandler("mcp"), metrics.New(), nil)
|
||||
assert.Error(t, err)
|
||||
}
|
||||
|
||||
// hyperguild#154: /mcp's bearer was built in main.go, untested; the buildMux
|
||||
// tests used stubs. buildMux now wraps the MCP handler itself, with the same
|
||||
// credential as the REST API.
|
||||
func TestBuildMuxRefusesMCPWithoutAValidToken(t *testing.T) {
|
||||
r := testMux(t)
|
||||
for _, authz := range []string{"", "Bearer wrong"} {
|
||||
code, body := do(t, r, "POST", "/mcp", authz)
|
||||
assert.Equal(t, http.StatusUnauthorized, code, "authz %q", authz)
|
||||
assert.NotEqual(t, "mcp", body)
|
||||
}
|
||||
code, body := do(t, r, "POST", "/mcp", "Bearer "+routesTok)
|
||||
assert.Equal(t, http.StatusOK, code)
|
||||
assert.Equal(t, "mcp", body)
|
||||
}
|
||||
|
||||
func TestBuildMuxRefusesANilMCPHandlerOrRegistry(t *testing.T) {
|
||||
auth := restAuth{token: routesTok, realm: "brain"}
|
||||
_, err := buildMux(auth, testHandler(t), nil, metrics.New(), nil)
|
||||
assert.Error(t, err)
|
||||
_, err = buildMux(auth, testHandler(t), okHandler("mcp"), nil, nil)
|
||||
assert.Error(t, err)
|
||||
}
|
||||
|
||||
// hyperguild#154: main wrapped buildMux's result in the metrics middleware
|
||||
// before ListenAndServe, untested. buildMux now returns the handler main
|
||||
// serves as-is, metrics included: a request through it is observed and
|
||||
// exposed on its own GET /metrics.
|
||||
func TestBuildMuxObservesRequestsAndServesMetrics(t *testing.T) {
|
||||
r := testMux(t)
|
||||
code, _ := do(t, r, "GET", "/pending", "Bearer "+routesTok)
|
||||
require.Equal(t, http.StatusOK, code)
|
||||
code, body := do(t, r, "GET", "/metrics", "")
|
||||
require.Equal(t, http.StatusOK, code)
|
||||
assert.Contains(t, body, `path="GET /pending"`)
|
||||
}
|
||||
@@ -1,39 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"strconv"
|
||||
"time"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/symlinkguard"
|
||||
)
|
||||
|
||||
// startupSymlinkCheck is the hyperguild#157 tripwire at boot: a symlink in the
|
||||
// brain dir would let brain readers serve a file from outside the brain, so
|
||||
// the server does not start until it is removed. A directory the scan cannot
|
||||
// read could hide one, so it refuses on that too. A missing brain dir (first
|
||||
// boot) is the only case it lets pass.
|
||||
func startupSymlinkCheck(brainDir string) error {
|
||||
r, err := symlinkguard.Scan(brainDir)
|
||||
if err != nil {
|
||||
if errors.Is(err, os.ErrNotExist) {
|
||||
return nil
|
||||
}
|
||||
return fmt.Errorf("refusing to start: cannot scan the brain dir %s (hyperguild#157): %w", brainDir, err)
|
||||
}
|
||||
if !r.Clean() {
|
||||
return fmt.Errorf("refusing to start: brain dir %s has %s (hyperguild#157); fix them first", brainDir, r)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// symlinkScanInterval reads BRAIN_SYMLINK_SCAN_INTERVAL (seconds), falling
|
||||
// back to the default on an unset, non-numeric or non-positive value.
|
||||
func symlinkScanInterval(getenv func(string) string) time.Duration {
|
||||
if s, err := strconv.Atoi(getenv("BRAIN_SYMLINK_SCAN_INTERVAL")); err == nil && s > 0 {
|
||||
return time.Duration(s) * time.Second
|
||||
}
|
||||
return symlinkguard.DefaultInterval
|
||||
}
|
||||
@@ -1,65 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
// hyperguild#157: the server refuses to start while a symlink exists in the
|
||||
// brain dir, or while any part of it cannot be scanned (which could hide
|
||||
// one); a missing brain dir is the only thing it lets pass.
|
||||
func TestStartupSymlinkCheckRefusesABrainWithASymlink(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, "planted")))
|
||||
err := startupSymlinkCheck(brain)
|
||||
require.Error(t, err)
|
||||
assert.Contains(t, err.Error(), "planted")
|
||||
}
|
||||
|
||||
func TestStartupSymlinkCheckRefusesABrainWithAnUnreadableDir(t *testing.T) {
|
||||
if os.Geteuid() == 0 {
|
||||
t.Skip("root reads mode-000 directories")
|
||||
}
|
||||
brain := t.TempDir()
|
||||
locked := filepath.Join(brain, "aaa")
|
||||
require.NoError(t, os.MkdirAll(locked, 0o755))
|
||||
require.NoError(t, os.Chmod(locked, 0o000))
|
||||
t.Cleanup(func() { _ = os.Chmod(locked, 0o755) })
|
||||
err := startupSymlinkCheck(brain)
|
||||
require.Error(t, err)
|
||||
assert.Contains(t, err.Error(), "aaa")
|
||||
}
|
||||
|
||||
func TestStartupSymlinkCheckPassesACleanOrMissingBrain(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
require.NoError(t, os.WriteFile(filepath.Join(brain, "n.md"), []byte("x"), 0o644))
|
||||
assert.NoError(t, startupSymlinkCheck(brain))
|
||||
assert.NoError(t, startupSymlinkCheck(filepath.Join(brain, "missing")))
|
||||
}
|
||||
|
||||
func TestSymlinkScanIntervalFallsBackOnNonPositive(t *testing.T) {
|
||||
for _, v := range []string{"0", "-5", "", "junk"} {
|
||||
got := symlinkScanInterval(func(string) string { return v })
|
||||
assert.Positive(t, got, "env %q", v)
|
||||
}
|
||||
}
|
||||
|
||||
func TestAlertingWarningsNamesTheSymlinkTripwire(t *testing.T) {
|
||||
w := strings.Join(alertingWarnings(func(string) string { return "" }), " ")
|
||||
assert.Contains(t, w, "symlink tripwire")
|
||||
}
|
||||
|
||||
func TestStartupSymlinkCheckRefusesAnUnlistableBrainRoot(t *testing.T) {
|
||||
if os.Geteuid() == 0 {
|
||||
t.Skip("root lists mode-0100 directories")
|
||||
}
|
||||
brain := t.TempDir()
|
||||
require.NoError(t, os.Chmod(brain, 0o100))
|
||||
t.Cleanup(func() { _ = os.Chmod(brain, 0o755) })
|
||||
assert.Error(t, startupSymlinkCheck(brain))
|
||||
}
|
||||
+7
-7
@@ -34,9 +34,9 @@ require (
|
||||
github.com/rogpeppe/go-internal v1.15.0 // indirect
|
||||
github.com/spf13/pflag v1.0.5 // indirect
|
||||
github.com/x448/float16 v0.8.4 // indirect
|
||||
golang.org/x/net v0.55.0 // indirect
|
||||
golang.org/x/net v0.26.0 // indirect
|
||||
golang.org/x/oauth2 v0.21.0 // indirect
|
||||
golang.org/x/term v0.43.0 // indirect
|
||||
golang.org/x/term v0.28.0 // indirect
|
||||
golang.org/x/time v0.3.0 // indirect
|
||||
google.golang.org/protobuf v1.34.2 // indirect
|
||||
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
|
||||
@@ -51,7 +51,7 @@ require (
|
||||
)
|
||||
|
||||
require (
|
||||
git.d-ma.be/mathias/mcp-chassis v0.7.1
|
||||
git.d-ma.be/mathias/mcp-chassis v0.2.0
|
||||
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
||||
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
|
||||
github.com/goccy/go-json v0.10.3 // indirect
|
||||
@@ -66,9 +66,9 @@ require (
|
||||
github.com/lestrrat-go/option v1.0.1 // indirect
|
||||
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
||||
github.com/segmentio/asm v1.2.0 // indirect
|
||||
golang.org/x/crypto v0.51.0 // indirect
|
||||
golang.org/x/sync v0.21.0 // indirect
|
||||
golang.org/x/sys v0.45.0 // indirect
|
||||
golang.org/x/text v0.39.0 // indirect
|
||||
golang.org/x/crypto v0.32.0 // indirect
|
||||
golang.org/x/sync v0.17.0 // indirect
|
||||
golang.org/x/sys v0.31.0 // indirect
|
||||
golang.org/x/text v0.29.0 // indirect
|
||||
gopkg.in/yaml.v3 v3.0.1
|
||||
)
|
||||
|
||||
+16
-16
@@ -1,5 +1,5 @@
|
||||
git.d-ma.be/mathias/mcp-chassis v0.7.1 h1:4h8TOBHTA0L/no4IPcr4tLcQtmKUlhE2/cXyPdNFGmM=
|
||||
git.d-ma.be/mathias/mcp-chassis v0.7.1/go.mod h1:Ks7EK2UnGAN0H3rJjKUxUagX8/ZBdtLrOlcUbv0RwH8=
|
||||
git.d-ma.be/mathias/mcp-chassis v0.2.0 h1:6fLmb7xqRa2nNVWsHaUbbfbArgDXJw/gDhb09clBIjo=
|
||||
git.d-ma.be/mathias/mcp-chassis v0.2.0/go.mod h1:Ks7EK2UnGAN0H3rJjKUxUagX8/ZBdtLrOlcUbv0RwH8=
|
||||
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
|
||||
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
@@ -117,42 +117,42 @@ github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9dec
|
||||
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
|
||||
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
|
||||
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||
golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
|
||||
golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
|
||||
golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
|
||||
golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
|
||||
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
|
||||
golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
|
||||
golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
|
||||
golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
|
||||
golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
|
||||
golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs=
|
||||
golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
|
||||
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
|
||||
golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
|
||||
golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
|
||||
golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
|
||||
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
|
||||
golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
|
||||
golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
|
||||
golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
|
||||
golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
|
||||
golang.org/x/term v0.28.0 h1:/Ts8HFuMR2E6IP/jlo7QVLZHggjKQbhu/7H0LJFr3Gg=
|
||||
golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
|
||||
golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
|
||||
golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
|
||||
golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
|
||||
golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
|
||||
golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
|
||||
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
|
||||
golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
|
||||
golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
|
||||
golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
|
||||
golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
|
||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
|
||||
@@ -1,12 +1,6 @@
|
||||
package api
|
||||
|
||||
import (
|
||||
"strings"
|
||||
|
||||
// Aliased: this package's own frontmatter type (below) would collide
|
||||
// with the imported package's name otherwise.
|
||||
sharedfm "github.com/mathiasbq/hyperguild/ingestion/internal/frontmatter"
|
||||
)
|
||||
import "strings"
|
||||
|
||||
// frontmatter is an ordered, line-preserving view of a note's YAML
|
||||
// frontmatter block. It deliberately avoids a full YAML round-trip: the
|
||||
@@ -31,37 +25,21 @@ type fmLine struct {
|
||||
// frontmatter block is recognised only when the file opens with a `---`
|
||||
// fence and a closing `---` fence follows. Otherwise the whole input is
|
||||
// the body and the returned frontmatter is empty.
|
||||
//
|
||||
// Fence detection itself is frontmatter.Split (hyperguild#138) — this
|
||||
// package's own contribution is purely the ordered, line-preserving fmLine
|
||||
// shape below, which a shared parser has no business owning since it's
|
||||
// specific to how brain_update does a surgical, byte-round-trip edit.
|
||||
func parseFrontmatter(src string) (frontmatter, string) {
|
||||
var fm frontmatter
|
||||
blockBytes, restBytes, ok := sharedfm.Split([]byte(src))
|
||||
if !ok {
|
||||
if !strings.HasPrefix(src, "---\n") {
|
||||
return fm, src
|
||||
}
|
||||
// sharedfm.Split's block/rest boundary sits one byte earlier than this
|
||||
// package's always has: block keeps the "\n" immediately before the
|
||||
// closing fence, and rest keeps the "\n" immediately after it (both by
|
||||
// design, for Fix's own reconstruction). This package's block/body
|
||||
// never included either — TrimSuffix/TrimPrefix restore that exact
|
||||
// boundary. Split guarantees ok=true only when "\n---\n" matched, so
|
||||
// both trims are always exactly one byte, never ambiguous.
|
||||
block := strings.TrimSuffix(string(blockBytes), "\n")
|
||||
body := strings.TrimPrefix(string(restBytes), "\n")
|
||||
rest := src[len("---\n"):]
|
||||
end := strings.Index(rest, "\n---\n")
|
||||
if end < 0 {
|
||||
// Opening fence with no closing fence — treat as bodyless content.
|
||||
return fm, src
|
||||
}
|
||||
block := rest[:end]
|
||||
body := rest[end+len("\n---\n"):]
|
||||
|
||||
for _, line := range strings.Split(block, "\n") {
|
||||
// An indented line is a continuation (a YAML block-list item, a
|
||||
// wrapped value) never a top-level key, regardless of whether it
|
||||
// happens to contain a colon — " - 'Chapter 3: The Reckoning'" is
|
||||
// not a key named "- 'Chapter 3" (hyperguild#128). Checked before
|
||||
// Cut so a colon inside one never reaches the key/value path.
|
||||
if line != "" && (line[0] == ' ' || line[0] == '\t') {
|
||||
fm.lines = append(fm.lines, fmLine{raw: line})
|
||||
continue
|
||||
}
|
||||
key, val, ok := strings.Cut(line, ":")
|
||||
key = strings.TrimSpace(key)
|
||||
if !ok || key == "" || strings.HasPrefix(strings.TrimSpace(line), "#") {
|
||||
@@ -105,19 +83,9 @@ func (f *frontmatter) render() string {
|
||||
var b strings.Builder
|
||||
b.WriteString("---\n")
|
||||
for _, l := range f.lines {
|
||||
switch {
|
||||
case l.key == "":
|
||||
if l.key == "" {
|
||||
b.WriteString(l.raw)
|
||||
case l.value == "":
|
||||
// A key with nothing after the colon (the YAML block-list
|
||||
// shape: "aliases:" followed by indented "- item" lines on
|
||||
// their own raw lines) must stay bare — "key: " with a
|
||||
// trailing space is a different byte sequence than the
|
||||
// original, and this type's whole purpose (see the package
|
||||
// doc) is a byte-preserving round-trip.
|
||||
b.WriteString(l.key)
|
||||
b.WriteByte(':')
|
||||
default:
|
||||
} else {
|
||||
b.WriteString(l.key)
|
||||
b.WriteString(": ")
|
||||
b.WriteString(l.value)
|
||||
|
||||
@@ -59,37 +59,3 @@ func TestFrontmatterRenderRoundTrips(t *testing.T) {
|
||||
fm, _ := parseFrontmatter(src)
|
||||
assert.Equal(t, src, fm.render())
|
||||
}
|
||||
|
||||
func TestParseFrontmatterIndentedListItemWithColonIsNotMisparsedAsKey(t *testing.T) {
|
||||
// hyperguild#128: an indented YAML block-list item that happens to
|
||||
// contain a colon (e.g. a title with a subtitle) is a continuation
|
||||
// line, never a top-level key — strings.Cut doesn't know that just
|
||||
// because TrimSpace(key) happens to be non-empty. Misparsing it as a
|
||||
// key/value pair and re-rendering strips its indentation, de-indenting
|
||||
// it out of the list it belongs to. Same bug class already found and
|
||||
// fixed in the sibling internal/wiki package's parseFrontmatterBlock
|
||||
// (hyperguild#126 review round 3) — this package was the original the
|
||||
// reimplementation was modeled on and had the gap too.
|
||||
src := "---\naliases:\n - 'Chapter 3: The Reckoning'\ntitle: 'X'\n---\nbody\n"
|
||||
fm, _ := parseFrontmatter(src)
|
||||
fm.set("updated_at", "2026-09-23T00:00:00Z")
|
||||
|
||||
out := fm.render()
|
||||
assert.Contains(t, out, " - 'Chapter 3: The Reckoning'",
|
||||
"the indented list item must survive verbatim, not get re-emitted as a de-indented fake key")
|
||||
assert.NotContains(t, out, "\n- 'Chapter 3",
|
||||
"must not be split into a fake key/value pair at column 0 (as opposed to surviving indented, asserted above)")
|
||||
}
|
||||
|
||||
func TestFrontmatterRenderEmptyValueKeyStaysBareNoTrailingSpace(t *testing.T) {
|
||||
// Companion to the indented-list-item fix: "aliases:" (a key with
|
||||
// nothing after the colon, the YAML block-list header) must round-trip
|
||||
// bare, not as "aliases: " with a trailing space — a different byte
|
||||
// sequence than the original, breaking this type's whole reason for
|
||||
// being a line-preserving view rather than a YAML re-marshal.
|
||||
// render() returns only the frontmatter block (see
|
||||
// TestFrontmatterRenderRoundTrips), no trailing body.
|
||||
src := "---\naliases:\n - one\n - two\n---\n"
|
||||
fm, _ := parseFrontmatter(src)
|
||||
assert.Equal(t, src, fm.render())
|
||||
}
|
||||
|
||||
@@ -13,6 +13,7 @@ import (
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/claim"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/extract"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/search"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/vectorstore"
|
||||
@@ -53,6 +54,8 @@ type queryRequest struct {
|
||||
type writeRequest struct {
|
||||
Content string `json:"content"`
|
||||
Filename string `json:"filename,omitempty"`
|
||||
Type string `json:"type,omitempty"`
|
||||
Domain string `json:"domain,omitempty"`
|
||||
Wing string `json:"wing,omitempty"`
|
||||
Hall string `json:"hall,omitempty"`
|
||||
SourceType string `json:"source_type,omitempty"` // "external" opts a hall=facts entry out of the internal default
|
||||
@@ -107,21 +110,20 @@ func (h *Handler) Query(w http.ResponseWriter, r *http.Request) {
|
||||
|
||||
// WriteNoteOptions configures how a brain note is written.
|
||||
//
|
||||
// Wing and Hall are both required: the note routes into the structured
|
||||
// wiki at brain/wiki/<wing>/<hall>/<slug>.md and gets wing/hall/created_at
|
||||
// injected into its YAML frontmatter. There is no other valid destination
|
||||
// (the legacy brain/knowledge/ fallback was removed — ADR-0012 / #79).
|
||||
// When both Wing and Hall are non-empty, the note routes into the
|
||||
// structured wiki at brain/wiki/<wing>/<hall>/<slug>.md and gets
|
||||
// wing/hall/created_at injected into its YAML frontmatter.
|
||||
//
|
||||
// When either is empty, the note falls back to brain/knowledge/<filename>
|
||||
// with optional type/domain frontmatter (legacy behaviour).
|
||||
type WriteNoteOptions struct {
|
||||
Content string
|
||||
Filename string
|
||||
Type string
|
||||
Domain string
|
||||
Wing string
|
||||
Hall string
|
||||
SourceType string // "internal" marks a first-party observation (e.g. claudewatcher) that needs no external citation
|
||||
// Origin/WrittenBy are server-owned provenance (hyperguild#145): any
|
||||
// origin/written_by in Content's own frontmatter is discarded, so a
|
||||
// caller cannot claim a more trusted origin than it authenticated as.
|
||||
Origin string
|
||||
WrittenBy string
|
||||
}
|
||||
|
||||
// WriteNote writes a markdown note into the brain. Returns the path
|
||||
@@ -130,9 +132,6 @@ func WriteNote(brainDir string, opts WriteNoteOptions) (string, error) {
|
||||
if opts.Content == "" {
|
||||
return "", fmt.Errorf("content is required")
|
||||
}
|
||||
if opts.Wing == "" || opts.Hall == "" {
|
||||
return "", fmt.Errorf("wing and hall are required")
|
||||
}
|
||||
|
||||
// In the primitive, not in a caller: POST /write reaches here directly,
|
||||
// without the BrainStore, and a gate one door wide is not a gate.
|
||||
@@ -144,8 +143,14 @@ func WriteNote(brainDir string, opts WriteNoteOptions) (string, error) {
|
||||
}
|
||||
opts.Content = clean
|
||||
|
||||
if opts.Wing != "" && opts.Hall != "" {
|
||||
return writeHallNote(brainDir, opts)
|
||||
}
|
||||
if opts.Wing != "" || opts.Hall != "" {
|
||||
return "", fmt.Errorf("wing and hall must be set together")
|
||||
}
|
||||
return writeLegacyNote(brainDir, opts)
|
||||
}
|
||||
|
||||
// writeHallNote routes a note into brain/wiki/<wing>/<hall>/ and injects
|
||||
// wing/hall/created_at frontmatter.
|
||||
@@ -173,6 +178,9 @@ func writeHallNote(brainDir string, opts WriteNoteOptions) (string, error) {
|
||||
return "", fmt.Errorf("claim envelope: %w", err)
|
||||
}
|
||||
|
||||
if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
|
||||
return "", fmt.Errorf("create hall dir: %w", err)
|
||||
}
|
||||
emitted := make(map[string]bool, 6)
|
||||
|
||||
var fm strings.Builder
|
||||
@@ -199,6 +207,9 @@ func writeHallNote(brainDir string, opts WriteNoteOptions) (string, error) {
|
||||
fmt.Fprintf(&fm, "%s: %s\n", key, fallback)
|
||||
}
|
||||
}
|
||||
writeField("type", opts.Type)
|
||||
writeField("domain", opts.Domain)
|
||||
|
||||
sourceType := opts.SourceType
|
||||
if sourceType == "" && opts.Hall == "facts" {
|
||||
// Most hall=facts entries are first-party (an eval/benchmark the
|
||||
@@ -220,17 +231,7 @@ func writeHallNote(brainDir string, opts WriteNoteOptions) (string, error) {
|
||||
}
|
||||
fm.WriteString("---\n")
|
||||
|
||||
final, err := StampProvenance(fm.String()+body, opts.Origin, opts.WrittenBy)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
// The directory is created only once the note is known to be writable:
|
||||
// a refused write leaves nothing behind, not even an empty hall dir
|
||||
// (brain#21; provenance refusal joins the envelope refusal here).
|
||||
if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
|
||||
return "", fmt.Errorf("create hall dir: %w", err)
|
||||
}
|
||||
if err := os.WriteFile(dest, []byte(final), 0o644); err != nil {
|
||||
if err := os.WriteFile(dest, []byte(fm.String()+body), 0o644); err != nil {
|
||||
return "", fmt.Errorf("write: %w", err)
|
||||
}
|
||||
rel, _ := filepath.Rel(brainDir, dest)
|
||||
@@ -299,33 +300,70 @@ func splitFrontmatter(content string) (fields []frontmatterField, body string) {
|
||||
return fields, body
|
||||
}
|
||||
|
||||
// Write handles POST /write — write a note into brain/wiki/<wing>/<hall>/.
|
||||
// writeLegacyNote preserves the original brain/knowledge/ behaviour for
|
||||
// callers that have not adopted the wing/hall taxonomy.
|
||||
func writeLegacyNote(brainDir string, opts WriteNoteOptions) (string, error) {
|
||||
filename := opts.Filename
|
||||
if filename == "" {
|
||||
filename = fmt.Sprintf("%s-auto.md", time.Now().UTC().Format("2006-01-02-150405"))
|
||||
}
|
||||
|
||||
rawDir := filepath.Join(brainDir, "knowledge")
|
||||
if err := os.MkdirAll(rawDir, 0o755); err != nil {
|
||||
return "", fmt.Errorf("create raw dir: %w", err)
|
||||
}
|
||||
|
||||
finalContent := opts.Content
|
||||
if opts.Type != "" || opts.Domain != "" {
|
||||
var fm strings.Builder
|
||||
fm.WriteString("---\n")
|
||||
if opts.Type != "" {
|
||||
fmt.Fprintf(&fm, "type: %s\n", opts.Type)
|
||||
}
|
||||
if opts.Domain != "" {
|
||||
fmt.Fprintf(&fm, "domain: %s\n", opts.Domain)
|
||||
}
|
||||
fm.WriteString("---\n")
|
||||
finalContent = fm.String() + opts.Content
|
||||
}
|
||||
|
||||
if strings.ContainsAny(filename, `/\`) {
|
||||
return "", fmt.Errorf("invalid filename")
|
||||
}
|
||||
base := filepath.Base(filename)
|
||||
if base == "." || base == ".." || base == "" {
|
||||
return "", fmt.Errorf("invalid filename")
|
||||
}
|
||||
if !strings.HasSuffix(base, ".md") {
|
||||
base += ".md"
|
||||
}
|
||||
dest := filepath.Join(rawDir, base)
|
||||
if err := os.WriteFile(dest, []byte(finalContent), 0o644); err != nil {
|
||||
return "", fmt.Errorf("write: %w", err)
|
||||
}
|
||||
|
||||
rel, _ := filepath.Rel(brainDir, dest)
|
||||
return filepath.ToSlash(rel), nil
|
||||
}
|
||||
|
||||
// Write handles POST /write — write raw content to brain/knowledge/.
|
||||
func (h *Handler) Write(w http.ResponseWriter, r *http.Request) {
|
||||
var req writeRequest
|
||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
||||
writeError(w, http.StatusBadRequest, "invalid JSON")
|
||||
return
|
||||
}
|
||||
// Field by field, not a struct conversion: provenance is server-owned and
|
||||
// this door carries no principal, so it stamps origin: unknown
|
||||
// (hyperguild#145). A JSON body must never be able to set it.
|
||||
relPath, err := WriteNote(h.brainDir, WriteNoteOptions{
|
||||
Content: req.Content,
|
||||
Filename: req.Filename,
|
||||
Wing: req.Wing,
|
||||
Hall: req.Hall,
|
||||
SourceType: req.SourceType,
|
||||
})
|
||||
relPath, err := WriteNote(h.brainDir, WriteNoteOptions(req))
|
||||
if err != nil {
|
||||
h.logger.Error("write failed", "err", err)
|
||||
writeError(w, http.StatusBadRequest, err.Error())
|
||||
return
|
||||
}
|
||||
// WriteNote errors out above unless both are set, so this always runs —
|
||||
// no legacy fallback path left to guard against.
|
||||
if req.Wing != "" && req.Hall != "" {
|
||||
if err := brain.BuildWingIndex(h.brainDir, req.Wing); err != nil {
|
||||
h.logger.Warn("auto-index failed", "wing", req.Wing, "err", err)
|
||||
}
|
||||
}
|
||||
writeJSON(w, map[string]string{"path": relPath})
|
||||
}
|
||||
|
||||
@@ -446,12 +484,6 @@ func (h *Handler) IngestPath(w http.ResponseWriter, r *http.Request) {
|
||||
writeError(w, http.StatusBadRequest, "path is required")
|
||||
return
|
||||
}
|
||||
resolved, err := ResolveIngestPath(h.brainDir, req.Path)
|
||||
if err != nil {
|
||||
writeError(w, http.StatusBadRequest, err.Error())
|
||||
return
|
||||
}
|
||||
req.Path = resolved
|
||||
|
||||
info, err := os.Stat(req.Path)
|
||||
if err != nil {
|
||||
@@ -474,13 +506,7 @@ func (h *Handler) IngestPath(w http.ResponseWriter, r *http.Request) {
|
||||
if !isSupportedExtension(ext) {
|
||||
return nil
|
||||
}
|
||||
// Each walked file is re-resolved: a symlinked file inside raw/
|
||||
// would otherwise lead extract.Text out of the inbox (#149).
|
||||
if _, rerr := ResolveIngestPath(h.brainDir, path); rerr != nil {
|
||||
allWarnings = append(allWarnings, fmt.Sprintf("skipped %s: %v", path, rerr))
|
||||
return nil
|
||||
}
|
||||
content, readErr := ReadIngestFile(h.brainDir, path)
|
||||
content, readErr := extract.Text(path)
|
||||
if readErr != nil {
|
||||
allWarnings = append(allWarnings, fmt.Sprintf("extract %s: %v", path, readErr))
|
||||
return nil
|
||||
@@ -509,7 +535,7 @@ func (h *Handler) IngestPath(w http.ResponseWriter, r *http.Request) {
|
||||
writeError(w, http.StatusBadRequest, fmt.Sprintf("unsupported file extension: %s", ext))
|
||||
return
|
||||
}
|
||||
content, readErr := ReadIngestFile(h.brainDir, req.Path)
|
||||
content, readErr := extract.Text(req.Path)
|
||||
if readErr != nil {
|
||||
writeError(w, http.StatusInternalServerError, fmt.Sprintf("extract text: %v", readErr))
|
||||
return
|
||||
@@ -561,8 +587,7 @@ func (h *Handler) IngestRaw(w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
// No principal on this door: pages are stamped origin: unknown (#145).
|
||||
result, err := pipeline.RunRaw(r.Context(), h.brainDir, req.Source, req.Pages, req.DryRun)
|
||||
result, err := pipeline.RunRaw(h.brainDir, req.Source, req.Pages, req.DryRun)
|
||||
if err != nil {
|
||||
h.logger.Error("ingest-raw failed", "source", req.Source, "err", err)
|
||||
writeError(w, http.StatusInternalServerError, "ingest error")
|
||||
@@ -618,11 +643,7 @@ func (h *Handler) Promote(w http.ResponseWriter, r *http.Request) {
|
||||
writeError(w, http.StatusBadRequest, "invalid JSON")
|
||||
return
|
||||
}
|
||||
// Field by field: this door carries no principal, so the promoted note is
|
||||
// stamped origin: unknown and the body cannot set provenance (#145).
|
||||
rel, err := PromoteNote(h.brainDir, PromoteOptions{
|
||||
Filename: req.Filename, Wing: req.Wing, Hall: req.Hall, Slug: req.Slug,
|
||||
})
|
||||
rel, err := PromoteNote(h.brainDir, PromoteOptions(req))
|
||||
if err != nil {
|
||||
writeError(w, http.StatusBadRequest, err.Error())
|
||||
return
|
||||
|
||||
@@ -65,13 +65,11 @@ func TestQuery_ReturnsResults(t *testing.T) {
|
||||
assert.NotEmpty(t, results)
|
||||
}
|
||||
|
||||
func TestWrite_CreatesWikiFile(t *testing.T) {
|
||||
func TestWrite_CreatesKnowledgeFile(t *testing.T) {
|
||||
dir, h := setup(t)
|
||||
body, _ := json.Marshal(map[string]any{
|
||||
"content": "# Test note\n\nSome content.",
|
||||
"filename": "test-note",
|
||||
"wing": "homelab",
|
||||
"hall": "facts",
|
||||
"filename": "test-note.md",
|
||||
})
|
||||
req := httptest.NewRequest(http.MethodPost, "/write", bytes.NewReader(body))
|
||||
rec := httptest.NewRecorder()
|
||||
@@ -83,25 +81,11 @@ func TestWrite_CreatesWikiFile(t *testing.T) {
|
||||
require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &resp))
|
||||
assert.NotEmpty(t, resp["path"])
|
||||
|
||||
content, err := os.ReadFile(filepath.Join(dir, "wiki", "homelab", "facts", "test-note.md"))
|
||||
content, err := os.ReadFile(filepath.Join(dir, "knowledge", "test-note.md"))
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, string(content), "Some content.")
|
||||
}
|
||||
|
||||
// TestWrite_RequiresWingAndHall is the HTTP-contract counterpart of
|
||||
// TestWriteNote_RequiresWingAndHall: a caller (e.g. the MCP brain_write
|
||||
// handler) that omits wing/hall gets a 400, not a silent legacy write.
|
||||
func TestWrite_RequiresWingAndHall(t *testing.T) {
|
||||
_, h := setup(t)
|
||||
body, _ := json.Marshal(map[string]any{"content": "no destination"})
|
||||
req := httptest.NewRequest(http.MethodPost, "/write", bytes.NewReader(body))
|
||||
rec := httptest.NewRecorder()
|
||||
|
||||
h.Write(rec, req)
|
||||
|
||||
assert.Equal(t, http.StatusBadRequest, rec.Code)
|
||||
}
|
||||
|
||||
func TestQuery_RequiresQuery(t *testing.T) {
|
||||
_, h := setup(t)
|
||||
body, _ := json.Marshal(map[string]any{"limit": 5})
|
||||
@@ -113,6 +97,27 @@ func TestQuery_RequiresQuery(t *testing.T) {
|
||||
assert.Equal(t, http.StatusBadRequest, rec.Code)
|
||||
}
|
||||
|
||||
func TestWrite_IncludesFrontmatterWhenTypeProvided(t *testing.T) {
|
||||
dir, h := setup(t)
|
||||
body, _ := json.Marshal(map[string]any{
|
||||
"content": "Some learning.",
|
||||
"filename": "typed-note.md",
|
||||
"type": "concept",
|
||||
"domain": "software",
|
||||
})
|
||||
req := httptest.NewRequest(http.MethodPost, "/write", bytes.NewReader(body))
|
||||
rec := httptest.NewRecorder()
|
||||
|
||||
h.Write(rec, req)
|
||||
|
||||
assert.Equal(t, http.StatusOK, rec.Code)
|
||||
content, err := os.ReadFile(filepath.Join(dir, "knowledge", "typed-note.md"))
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, string(content), "type: concept")
|
||||
assert.Contains(t, string(content), "domain: software")
|
||||
assert.Contains(t, string(content), "Some learning.")
|
||||
}
|
||||
|
||||
func TestWriteNote_HallRouteIncludesSourceTypeWhenSet(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
|
||||
@@ -121,6 +126,7 @@ func TestWriteNote_HallRouteIncludesSourceTypeWhenSet(t *testing.T) {
|
||||
Filename: "session-koala-abc",
|
||||
Wing: "claude-sessions",
|
||||
Hall: "facts",
|
||||
Type: "source",
|
||||
SourceType: "internal",
|
||||
})
|
||||
require.NoError(t, err)
|
||||
@@ -204,95 +210,37 @@ func TestWriteNote_HallRouteMergesExistingFrontmatterInsteadOfStacking(t *testin
|
||||
assert.Contains(t, body, "# Body")
|
||||
}
|
||||
|
||||
// TestWriteNote_RequiresWingAndHall pins the post-legacy-removal contract
|
||||
// (hyperguild#79 / ADR-0012): with the knowledge/ fallback gone, wing+hall
|
||||
// is the only valid destination, so omitting either is a caller error, not
|
||||
// a silent fallback.
|
||||
func TestWriteNote_RequiresWingAndHall(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
wing string
|
||||
hall string
|
||||
}{
|
||||
{"neither set", "", ""},
|
||||
{"wing only", "homelab", ""},
|
||||
{"hall only", "", "facts"},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
func TestWriteNote_HallRouteExistingTypeWinsOverOptsType(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
_, err := api.WriteNote(dir, api.WriteNoteOptions{
|
||||
Content: "body",
|
||||
Wing: tc.wing,
|
||||
Hall: tc.hall,
|
||||
|
||||
rel, err := api.WriteNote(dir, api.WriteNoteOptions{
|
||||
Content: "---\ntype: hypothesis\n---\n\nBody.\n",
|
||||
Filename: "note",
|
||||
Wing: "agentsquad",
|
||||
Hall: "decisions",
|
||||
Type: "decision", // should lose to content's own "type: hypothesis"
|
||||
})
|
||||
require.Error(t, err)
|
||||
assert.Contains(t, err.Error(), "wing and hall are required")
|
||||
})
|
||||
}
|
||||
require.NoError(t, err)
|
||||
|
||||
got, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(rel)))
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, string(got), "type: hypothesis")
|
||||
assert.NotContains(t, string(got), "type: decision")
|
||||
}
|
||||
|
||||
func TestWrite_GeneratesFilenameIfAbsent(t *testing.T) {
|
||||
dir, h := setup(t)
|
||||
body, _ := json.Marshal(map[string]any{
|
||||
"content": "auto name",
|
||||
"wing": "homelab",
|
||||
"hall": "facts",
|
||||
})
|
||||
body, _ := json.Marshal(map[string]any{"content": "auto name"})
|
||||
req := httptest.NewRequest(http.MethodPost, "/write", bytes.NewReader(body))
|
||||
rec := httptest.NewRecorder()
|
||||
|
||||
h.Write(rec, req)
|
||||
|
||||
assert.Equal(t, http.StatusOK, rec.Code)
|
||||
entries, err := os.ReadDir(filepath.Join(dir, "wiki", "homelab", "facts"))
|
||||
require.NoError(t, err)
|
||||
require.Len(t, entries, 1)
|
||||
assert.True(t, strings.HasSuffix(entries[0].Name(), ".md"))
|
||||
}
|
||||
|
||||
// TestWrite_CLIPayloadRoundTrips exercises the real Handler.Write (not a
|
||||
// hand-rolled mock) over an actual HTTP round trip, POSTing the exact JSON
|
||||
// envelope cmd/hyperguild's brainClient.Write sends: {wing, hall, filename,
|
||||
// content}. cmd/hyperguild lives in a separate Go module from ingestion
|
||||
// (no shared go.work), so a Go-level test can't import brainClient
|
||||
// directly — this test instead pins the wire contract from the server
|
||||
// side and proves a real `hyperguild brain write <wing> <hall> <slug>`
|
||||
// invocation writes a real file with real frontmatter under wiki/<wing>/<hall>/.
|
||||
// A prior version of this contract test on the client side (in
|
||||
// cmd/hyperguild/http_test.go) used only an httptest.NewServer with a
|
||||
// hand-rolled mock body, so it stayed green through a regression where the
|
||||
// server required wing/hall but the client never sent them (hyperguild#79
|
||||
// PR review).
|
||||
func TestWrite_CLIPayloadRoundTrips(t *testing.T) {
|
||||
dir, h := setup(t)
|
||||
srv := httptest.NewServer(http.HandlerFunc(h.Write))
|
||||
defer srv.Close()
|
||||
|
||||
payload, err := json.Marshal(struct {
|
||||
Wing string `json:"wing"`
|
||||
Hall string `json:"hall"`
|
||||
Filename string `json:"filename"`
|
||||
Content string `json:"content"`
|
||||
}{Wing: "homelab", Hall: "facts", Filename: "cli-roundtrip", Content: "# CLI roundtrip\n\nReal write.\n"})
|
||||
require.NoError(t, err)
|
||||
|
||||
resp, err := http.Post(srv.URL+"/write", "application/json", bytes.NewReader(payload)) //nolint:noctx
|
||||
require.NoError(t, err)
|
||||
defer resp.Body.Close() //nolint:errcheck
|
||||
|
||||
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
||||
var out struct {
|
||||
Path string `json:"path"`
|
||||
}
|
||||
require.NoError(t, json.NewDecoder(resp.Body).Decode(&out))
|
||||
assert.Equal(t, "wiki/homelab/facts/cli-roundtrip.md", out.Path)
|
||||
|
||||
written, err := os.ReadFile(filepath.Join(dir, "wiki", "homelab", "facts", "cli-roundtrip.md"))
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, string(written), "wing: homelab")
|
||||
assert.Contains(t, string(written), "hall: facts")
|
||||
assert.Contains(t, string(written), "Real write.")
|
||||
entries, _ := os.ReadDir(filepath.Join(dir, "knowledge"))
|
||||
// +1 because setup already wrote tdd.md
|
||||
assert.Len(t, entries, 2)
|
||||
assert.True(t, strings.HasSuffix(entries[1].Name(), ".md"))
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
@@ -361,11 +309,10 @@ func TestIngestPath_MissingPath(t *testing.T) {
|
||||
}
|
||||
|
||||
func TestIngestPath_File(t *testing.T) {
|
||||
brainDir, h := setup(t)
|
||||
_, h := setup(t)
|
||||
|
||||
// Create a temp file with content
|
||||
dir := filepath.Join(brainDir, "raw", "fixture") // ingest paths must live in brain/raw/ (#149)
|
||||
require.NoError(t, os.MkdirAll(dir, 0o755))
|
||||
dir := t.TempDir()
|
||||
f := filepath.Join(dir, "doc.md")
|
||||
require.NoError(t, os.WriteFile(f, []byte("# Hello\nThis is markdown content."), 0o644))
|
||||
|
||||
@@ -469,11 +416,10 @@ func TestIngestRaw_DryRun(t *testing.T) {
|
||||
}
|
||||
|
||||
func TestIngestPath_Directory(t *testing.T) {
|
||||
brainDir, h := setup(t)
|
||||
_, h := setup(t)
|
||||
|
||||
// Create a temp dir with one .md file
|
||||
dir := filepath.Join(brainDir, "raw", "fixture") // ingest paths must live in brain/raw/ (#149)
|
||||
require.NoError(t, os.MkdirAll(dir, 0o755))
|
||||
dir := t.TempDir()
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, "notes.md"), []byte("# Notes\nSome notes."), 0o644))
|
||||
|
||||
body, _ := json.Marshal(map[string]any{
|
||||
|
||||
@@ -40,10 +40,9 @@ func TestIngestPath_DocxSupportedWhenDocmarkConfigured(t *testing.T) {
|
||||
t.Setenv("DOCMARK_URL", srv.URL+"/mcp")
|
||||
t.Setenv("DOCMARK_BEARER_TOKEN", "tok")
|
||||
|
||||
brainDir, h := setup(t)
|
||||
_, h := setup(t)
|
||||
|
||||
dir := filepath.Join(brainDir, "raw", "fixture") // ingest paths must live in brain/raw/ (#149)
|
||||
require.NoError(t, os.MkdirAll(dir, 0o755))
|
||||
dir := t.TempDir()
|
||||
f := filepath.Join(dir, "doc.docx")
|
||||
require.NoError(t, os.WriteFile(f, []byte("fake docx"), 0o644))
|
||||
|
||||
|
||||
@@ -1,67 +0,0 @@
|
||||
package api
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"os"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/extract"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// ErrOutsideIngestRoot is the one refusal for every bad ingest path. It never
|
||||
// carries the underlying error: "no such file" versus "permission denied"
|
||||
// would let a caller probe which server files exist (PR #152 review).
|
||||
var ErrOutsideIngestRoot = errors.New("ingest path must be an existing file or directory inside brain/raw/")
|
||||
|
||||
// ResolveIngestPath confines a caller-supplied ingest path to brain/raw/, the
|
||||
// inbox the watcher already owns (hyperguild#149). Relative paths resolve
|
||||
// against that root; symlinks are evaluated before the containment check, so
|
||||
// a link inside raw/ that points elsewhere is refused. The path must exist.
|
||||
func ResolveIngestPath(brainDir, p string) (string, error) {
|
||||
if strings.TrimSpace(p) == "" {
|
||||
return "", ErrOutsideIngestRoot
|
||||
}
|
||||
// raw/ itself must be a real directory: if it were a symlink, containment
|
||||
// inside it would mean nothing (hyperguild#153 item 4).
|
||||
if fi, lerr := os.Lstat(filepath.Join(brainDir, "raw")); lerr != nil || fi.Mode()&os.ModeSymlink != 0 || !fi.IsDir() {
|
||||
return "", ErrOutsideIngestRoot
|
||||
}
|
||||
root, err := filepath.EvalSymlinks(filepath.Join(brainDir, "raw"))
|
||||
if err != nil {
|
||||
return "", ErrOutsideIngestRoot
|
||||
}
|
||||
if !filepath.IsAbs(p) {
|
||||
p = filepath.Join(root, p)
|
||||
}
|
||||
real, err := filepath.EvalSymlinks(filepath.Clean(p))
|
||||
if err != nil {
|
||||
return "", ErrOutsideIngestRoot
|
||||
}
|
||||
rel, err := filepath.Rel(root, real)
|
||||
if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) || filepath.IsAbs(rel) {
|
||||
return "", ErrOutsideIngestRoot
|
||||
}
|
||||
return real, nil
|
||||
}
|
||||
|
||||
// ReadIngestFile extracts text from an ingest path already confined by
|
||||
// ResolveIngestPath, reading it through the raw/ root rather than reopening
|
||||
// the path by name (hyperguild#153 item 3): if the file is swapped for a
|
||||
// symlink after the check, the read still cannot leave raw/.
|
||||
func ReadIngestFile(brainDir, resolved string) (string, error) {
|
||||
root, rawPath, err := OpenRawRoot(brainDir)
|
||||
if err != nil {
|
||||
return "", ErrOutsideIngestRoot
|
||||
}
|
||||
defer func() { _ = root.Close() }()
|
||||
realRoot, err := filepath.EvalSymlinks(rawPath)
|
||||
if err != nil {
|
||||
return "", ErrOutsideIngestRoot
|
||||
}
|
||||
rel, err := filepath.Rel(realRoot, resolved)
|
||||
if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) || filepath.IsAbs(rel) {
|
||||
return "", ErrOutsideIngestRoot
|
||||
}
|
||||
return extract.TextIn(root, rel)
|
||||
}
|
||||
@@ -1,88 +0,0 @@
|
||||
package api_test
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/api"
|
||||
)
|
||||
|
||||
// hyperguild#149: /ingest-path and MCP brain_ingest read a caller-chosen
|
||||
// server path, so any file the pod could read (the ServiceAccount token,
|
||||
// /etc/passwd) could be pulled into the brain and read back out. Ingest paths
|
||||
// now resolve inside brain/raw/ — the inbox the watcher already owns — with
|
||||
// symlinks evaluated, or are refused.
|
||||
func TestResolveIngestPathConfinesToRawInbox(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
raw := filepath.Join(brain, "raw")
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(raw, "sub"), 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(raw, "sub", "ok.md"), []byte("x"), 0o644))
|
||||
outside := filepath.Join(t.TempDir(), "secret.txt")
|
||||
require.NoError(t, os.WriteFile(outside, []byte("s"), 0o644))
|
||||
require.NoError(t, os.Symlink(outside, filepath.Join(raw, "link.md")))
|
||||
require.NoError(t, os.Symlink(filepath.Dir(outside), filepath.Join(raw, "dirlink")))
|
||||
|
||||
for _, ok := range []string{filepath.Join(raw, "sub", "ok.md"), "sub/ok.md", raw, "sub"} {
|
||||
_, err := api.ResolveIngestPath(brain, ok)
|
||||
assert.NoError(t, err, ok)
|
||||
}
|
||||
for _, bad := range []string{
|
||||
"/etc/hostname", outside, "../secret.txt", filepath.Join(raw, "..", "wiki"),
|
||||
filepath.Join(raw, "link.md"), filepath.Join(raw, "dirlink", "secret.txt"),
|
||||
raw + "-evil/x.md", "",
|
||||
} {
|
||||
_, err := api.ResolveIngestPath(brain, bad)
|
||||
assert.Error(t, err, "must refuse %q", bad)
|
||||
}
|
||||
}
|
||||
|
||||
func TestIngestPathRefusesAPathOutsideTheInbox(t *testing.T) {
|
||||
_, h := setup(t)
|
||||
body, _ := json.Marshal(map[string]any{"path": "/etc/hostname"})
|
||||
rec := httptest.NewRecorder()
|
||||
h.IngestPath(rec, httptest.NewRequest(http.MethodPost, "/ingest-path", bytes.NewReader(body)))
|
||||
assert.Equal(t, http.StatusBadRequest, rec.Code)
|
||||
assert.Contains(t, rec.Body.String(), "raw")
|
||||
}
|
||||
|
||||
// A directory ingest must not follow a symlinked FILE inside raw/ out of it.
|
||||
func TestIngestPathDirectoryWalkSkipsSymlinksLeavingTheInbox(t *testing.T) {
|
||||
dir, h := setup(t)
|
||||
raw := filepath.Join(dir, "raw", "batch")
|
||||
require.NoError(t, os.MkdirAll(raw, 0o755))
|
||||
outside := filepath.Join(t.TempDir(), "secret.md")
|
||||
require.NoError(t, os.WriteFile(outside, []byte("# secret\n\nSENTINEL-149-OUTSIDE"), 0o644))
|
||||
require.NoError(t, os.Symlink(outside, filepath.Join(raw, "leak.md")))
|
||||
body, _ := json.Marshal(map[string]any{"path": "batch", "source": "walk"})
|
||||
rec := httptest.NewRecorder()
|
||||
h.IngestPath(rec, httptest.NewRequest(http.MethodPost, "/ingest-path", bytes.NewReader(body)))
|
||||
assert.Contains(t, rec.Body.String(), "skipped")
|
||||
assert.NotContains(t, rec.Body.String(), "SENTINEL-149-OUTSIDE")
|
||||
}
|
||||
|
||||
// PR #152 review: the raw EvalSymlinks error told an authenticated caller
|
||||
// whether any server file existed ("no such file") or was unreadable
|
||||
// ("permission denied"), and leaked the brain directory. Every refusal now
|
||||
// reads the same.
|
||||
func TestResolveIngestPathRefusalsAreIndistinguishable(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(brain, "raw"), 0o755))
|
||||
var msgs []string
|
||||
for _, p := range []string{"/etc/hostname", "/etc/definitely-not-here-149", "../x", "nope/missing.md", ""} {
|
||||
_, err := api.ResolveIngestPath(brain, p)
|
||||
require.Error(t, err, p)
|
||||
msgs = append(msgs, err.Error())
|
||||
assert.NotContains(t, err.Error(), brain, "refusal for %q leaks the brain dir", p)
|
||||
}
|
||||
for _, m := range msgs[1:] {
|
||||
assert.Equal(t, msgs[0], m)
|
||||
}
|
||||
}
|
||||
@@ -1,9 +1,7 @@
|
||||
package api
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"io/fs"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
@@ -30,25 +28,25 @@ var datePrefix = regexp.MustCompile(`^\d{4}-\d{2}-\d{2}-`)
|
||||
// (natural review order). An absent raw/ dir yields an empty slice, not an
|
||||
// error. Only .md files are listed; tunnel-candidate files are skipped.
|
||||
func ListPending(brainDir string) ([]PendingNote, error) {
|
||||
root, _, err := OpenRawRoot(brainDir)
|
||||
dir := filepath.Join(brainDir, "raw")
|
||||
entries, err := os.ReadDir(dir)
|
||||
if err != nil {
|
||||
if errors.Is(err, os.ErrNotExist) {
|
||||
if os.IsNotExist(err) {
|
||||
return []PendingNote{}, nil
|
||||
}
|
||||
return nil, fmt.Errorf("read raw dir: %w", err)
|
||||
}
|
||||
defer func() { _ = root.Close() }()
|
||||
entries, err := fs.ReadDir(root.FS(), ".")
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("read raw dir: %w", err)
|
||||
}
|
||||
|
||||
out := make([]PendingNote, 0, len(entries))
|
||||
for _, e := range entries {
|
||||
if !e.Type().IsRegular() || !strings.HasSuffix(e.Name(), ".md") || strings.HasPrefix(e.Name(), "tunnel-candidates-") {
|
||||
continue // directories, and symlinks whose target may be anywhere (#153)
|
||||
if e.IsDir() || !strings.HasSuffix(e.Name(), ".md") || strings.HasPrefix(e.Name(), "tunnel-candidates-") {
|
||||
continue
|
||||
}
|
||||
raw, info, readErr := readRawNote(root, e.Name())
|
||||
info, statErr := e.Info()
|
||||
if statErr != nil {
|
||||
continue
|
||||
}
|
||||
raw, readErr := os.ReadFile(filepath.Join(dir, e.Name()))
|
||||
if readErr != nil {
|
||||
continue
|
||||
}
|
||||
@@ -74,10 +72,6 @@ type PromoteOptions struct {
|
||||
Wing string
|
||||
Hall string
|
||||
Slug string // optional; defaults to Filename minus date prefix + .md
|
||||
// Origin/WrittenBy re-attribute the promoted note to the promoter: the raw
|
||||
// note's own frontmatter claims are not provenance (hyperguild#145).
|
||||
Origin string
|
||||
WrittenBy string
|
||||
}
|
||||
|
||||
// PromoteNote moves a note from brain/raw/ into the structured wiki: it
|
||||
@@ -107,9 +101,12 @@ func PromoteNote(brainDir string, opts PromoteOptions) (string, error) {
|
||||
}
|
||||
|
||||
src := filepath.Join(brainDir, "raw", base)
|
||||
raw, err := readRawSource(brainDir, base)
|
||||
raw, err := os.ReadFile(src)
|
||||
if err != nil {
|
||||
return "", err
|
||||
if os.IsNotExist(err) {
|
||||
return "", fmt.Errorf("pending note %q does not exist in raw/", base)
|
||||
}
|
||||
return "", fmt.Errorf("read source: %w", err)
|
||||
}
|
||||
|
||||
// Collision: never silently overwrite an existing promoted note.
|
||||
@@ -131,11 +128,7 @@ func PromoteNote(brainDir string, opts PromoteOptions) (string, error) {
|
||||
return "", fmt.Errorf("create wing dir: %w", err)
|
||||
}
|
||||
// Write-then-delete: the source survives any write failure.
|
||||
promoted, err := StampProvenance(fm.render()+body, opts.Origin, opts.WrittenBy)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
if err := os.WriteFile(dest, []byte(promoted), 0o644); err != nil {
|
||||
if err := os.WriteFile(dest, []byte(fm.render()+body), 0o644); err != nil {
|
||||
return "", fmt.Errorf("write promoted note: %w", err)
|
||||
}
|
||||
if err := os.Remove(src); err != nil {
|
||||
@@ -152,65 +145,6 @@ func PromoteNote(brainDir string, opts PromoteOptions) (string, error) {
|
||||
return relSlash, nil
|
||||
}
|
||||
|
||||
// RejectOptions identifies a raw note to reject and why.
|
||||
type RejectOptions struct {
|
||||
Filename string // basename in brain/raw/
|
||||
Reason string // optional
|
||||
}
|
||||
|
||||
// RejectNote records a human decision not to promote a brain/raw/ note,
|
||||
// without silently losing it: it stamps rejected_at (+ reject_reason when
|
||||
// given) into frontmatter and moves the file to brain/raw/rejected/, using
|
||||
// the same write-then-delete safety PromoteNote uses — the source survives
|
||||
// any write failure — and the same basename-only filename validation.
|
||||
//
|
||||
// A rejected note never entered the wiki, so no index rebuild or
|
||||
// auto-tunnel run: unlike PromoteNote, this is the end of the note's
|
||||
// journey, not the start of a new one. It stays out of ListPending's view
|
||||
// (raw/rejected/ is a subdirectory, and ListPending's os.ReadDir on raw/
|
||||
// does not recurse), so a rejected note is never re-surfaced as pending —
|
||||
// the human decision, once made, stays made, the same principle behind
|
||||
// this estate's "issue status is surfaced, not auto-closed, but once a
|
||||
// human decides, the decision is recorded" rule applied one level earlier.
|
||||
func RejectNote(brainDir string, opts RejectOptions) (string, error) {
|
||||
base := filepath.Base(opts.Filename)
|
||||
if base != opts.Filename || base == "." || base == ".." || strings.ContainsAny(opts.Filename, `/\`) {
|
||||
return "", fmt.Errorf("invalid filename %q", opts.Filename)
|
||||
}
|
||||
|
||||
src := filepath.Join(brainDir, "raw", base)
|
||||
raw, err := readRawSource(brainDir, base)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
dest := filepath.Join(brainDir, "raw", "rejected", base)
|
||||
if _, statErr := os.Stat(dest); statErr == nil {
|
||||
rel, _ := filepath.Rel(brainDir, dest)
|
||||
return "", fmt.Errorf("a rejected note named %s already exists", filepath.ToSlash(rel))
|
||||
}
|
||||
|
||||
fm, body := parseFrontmatter(string(raw))
|
||||
fm.set("rejected_at", time.Now().UTC().Format(time.RFC3339))
|
||||
if opts.Reason != "" {
|
||||
fm.set("reject_reason", opts.Reason)
|
||||
}
|
||||
|
||||
if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
|
||||
return "", fmt.Errorf("create rejected dir: %w", err)
|
||||
}
|
||||
// Write-then-delete: the source survives any write failure.
|
||||
if err := os.WriteFile(dest, []byte(fm.render()+body), 0o644); err != nil {
|
||||
return "", fmt.Errorf("write rejected note: %w", err)
|
||||
}
|
||||
if err := os.Remove(src); err != nil {
|
||||
return "", fmt.Errorf("rejected note written but source removal failed: %w", err)
|
||||
}
|
||||
|
||||
rel, _ := filepath.Rel(brainDir, dest)
|
||||
return filepath.ToSlash(rel), nil
|
||||
}
|
||||
|
||||
// excerpt returns the first n runes of s, trimmed, single-spaced.
|
||||
func excerpt(s string, n int) string {
|
||||
s = strings.TrimSpace(s)
|
||||
@@ -220,24 +154,3 @@ func excerpt(s string, n int) string {
|
||||
}
|
||||
return strings.TrimSpace(string(r))
|
||||
}
|
||||
|
||||
// readRawSource reads a pending note for promote/reject through the raw root,
|
||||
// refusing symlinks and a symlinked raw/ (hyperguild#153).
|
||||
func readRawSource(brainDir, base string) ([]byte, error) {
|
||||
root, _, err := OpenRawRoot(brainDir)
|
||||
if err != nil {
|
||||
if errors.Is(err, os.ErrNotExist) {
|
||||
return nil, fmt.Errorf("pending note %q does not exist in raw/", base)
|
||||
}
|
||||
return nil, fmt.Errorf("read source: %w", err)
|
||||
}
|
||||
defer func() { _ = root.Close() }()
|
||||
raw, _, err := readRawNote(root, base)
|
||||
if err != nil {
|
||||
if errors.Is(err, os.ErrNotExist) {
|
||||
return nil, fmt.Errorf("pending note %q does not exist in raw/", base)
|
||||
}
|
||||
return nil, fmt.Errorf("read source: %w", err)
|
||||
}
|
||||
return raw, nil
|
||||
}
|
||||
|
||||
@@ -119,85 +119,3 @@ func TestPromoteRebuildsWingIndex(t *testing.T) {
|
||||
require.NoError(t, err, "wing _index regenerated")
|
||||
assert.Contains(t, string(idx), "x", "promoted note appears in the index")
|
||||
}
|
||||
|
||||
// --- RejectNote (hyperguild#81) ---------------------------------------------
|
||||
|
||||
func TestRejectHappyPath(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
writeRaw(t, dir, "2026-04-23-fed-sentiment-scrape.md",
|
||||
"---\ncreated_at: 2026-04-23T13:20:07Z\n---\n# Sentiment scrape\n\nbody.\n")
|
||||
|
||||
rel, err := RejectNote(dir, RejectOptions{
|
||||
Filename: "2026-04-23-fed-sentiment-scrape.md", Reason: "generic scrape, not homelab-relevant",
|
||||
})
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "raw/rejected/2026-04-23-fed-sentiment-scrape.md", rel)
|
||||
|
||||
// Source removed from the pending queue.
|
||||
_, statErr := os.Stat(filepath.Join(dir, "raw", "2026-04-23-fed-sentiment-scrape.md"))
|
||||
assert.True(t, os.IsNotExist(statErr), "source removed from raw/ after reject")
|
||||
|
||||
got, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(rel)))
|
||||
require.NoError(t, err)
|
||||
s := string(got)
|
||||
assert.Contains(t, s, "created_at: 2026-04-23T13:20:07Z", "original created_at preserved")
|
||||
assert.Contains(t, s, "rejected_at:")
|
||||
assert.Contains(t, s, "reject_reason: generic scrape, not homelab-relevant")
|
||||
assert.Contains(t, s, "# Sentiment scrape", "body preserved for later reference")
|
||||
|
||||
// Rejected notes never entered the wiki, and are no longer pending.
|
||||
pending, err := ListPending(dir)
|
||||
require.NoError(t, err)
|
||||
assert.Empty(t, pending)
|
||||
}
|
||||
|
||||
func TestRejectWithoutReason(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
writeRaw(t, dir, "2026-06-01-x.md", "body\n")
|
||||
rel, err := RejectNote(dir, RejectOptions{Filename: "2026-06-01-x.md"})
|
||||
require.NoError(t, err)
|
||||
got, _ := os.ReadFile(filepath.Join(dir, filepath.FromSlash(rel)))
|
||||
assert.NotContains(t, string(got), "reject_reason:", "no reason given, none stamped")
|
||||
}
|
||||
|
||||
func TestRejectMissingSourceErrors(t *testing.T) {
|
||||
_, err := RejectNote(t.TempDir(), RejectOptions{Filename: "ghost.md"})
|
||||
require.Error(t, err)
|
||||
}
|
||||
|
||||
func TestRejectRejectsTraversalFilename(t *testing.T) {
|
||||
_, err := RejectNote(t.TempDir(), RejectOptions{Filename: "../escape.md"})
|
||||
require.Error(t, err)
|
||||
}
|
||||
|
||||
func TestRejectCollisionNoOverwrite(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
dest := filepath.Join(dir, "raw", "rejected", "x.md")
|
||||
require.NoError(t, os.MkdirAll(filepath.Dir(dest), 0o755))
|
||||
require.NoError(t, os.WriteFile(dest, []byte("EXISTING\n"), 0o644))
|
||||
writeRaw(t, dir, "x.md", "NEW\n")
|
||||
|
||||
_, err := RejectNote(dir, RejectOptions{Filename: "x.md"})
|
||||
require.Error(t, err, "collision must error, not overwrite")
|
||||
|
||||
got, _ := os.ReadFile(dest)
|
||||
assert.Equal(t, "EXISTING\n", string(got), "target not overwritten")
|
||||
_, statErr := os.Stat(filepath.Join(dir, "raw", "x.md"))
|
||||
assert.NoError(t, statErr, "source preserved on collision (atomic: no delete without write)")
|
||||
}
|
||||
|
||||
func TestRejectedNotesAreNotListedAsPendingAgain(t *testing.T) {
|
||||
// ListPending already skips tunnel-candidates-*.md; confirm raw/rejected/
|
||||
// (a subdirectory) doesn't leak into the top-level pending listing either
|
||||
// — os.ReadDir on raw/ doesn't recurse, but pin it so a future change to
|
||||
// ListPending can't silently start surfacing rejected notes as pending
|
||||
// again.
|
||||
dir := t.TempDir()
|
||||
writeRaw(t, dir, "2026-06-01-x.md", "body\n")
|
||||
_, err := RejectNote(dir, RejectOptions{Filename: "2026-06-01-x.md"})
|
||||
require.NoError(t, err)
|
||||
|
||||
pending, err := ListPending(dir)
|
||||
require.NoError(t, err)
|
||||
assert.Empty(t, pending, "a rejected note must not still appear as pending")
|
||||
}
|
||||
|
||||
@@ -1,21 +0,0 @@
|
||||
package api
|
||||
|
||||
import (
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/provenance"
|
||||
)
|
||||
|
||||
// StampProvenance applies server-owned provenance (hyperguild#145) to note
|
||||
// content. See package provenance for the rule; an error means the stamped
|
||||
// note would not read back as stamped, and the write must be refused.
|
||||
func StampProvenance(content, origin, writtenBy string) (string, error) {
|
||||
return provenance.Apply(content, provenance.Stamp{Origin: origin, WrittenBy: writtenBy})
|
||||
}
|
||||
|
||||
// StampProvenanceFile applies StampProvenance to a brain-relative note path.
|
||||
func StampProvenanceFile(brainDir, relPath, origin, writtenBy string) error {
|
||||
_, abs, err := resolveWithin(brainDir, relPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return provenance.ApplyFile(abs, provenance.Stamp{Origin: origin, WrittenBy: writtenBy})
|
||||
}
|
||||
@@ -1,122 +0,0 @@
|
||||
package api_test
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"gopkg.in/yaml.v3"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/api"
|
||||
)
|
||||
|
||||
// REST POST /write carries no principal: it stamps origin: unknown, and no
|
||||
// spelling of provenance in its body reaches the note (hyperguild#145).
|
||||
func TestRESTWriteStampsUnknownAndIgnoresBodyProvenance(t *testing.T) {
|
||||
dir, h := setup(t)
|
||||
body, _ := json.Marshal(map[string]any{
|
||||
"content": "---\norigin: static\n---\n# R\n\nbody", "filename": "rest-prov", "wing": "homelab", "hall": "facts",
|
||||
"origin": "static", "written_by": "local-cli", "Origin": "static", "WrittenBy": "local-cli",
|
||||
})
|
||||
rec := httptest.NewRecorder()
|
||||
h.Write(rec, httptest.NewRequest(http.MethodPost, "/write", bytes.NewReader(body)))
|
||||
require.Equal(t, http.StatusOK, rec.Code, rec.Body.String())
|
||||
b, err := os.ReadFile(filepath.Join(dir, "wiki", "homelab", "facts", "rest-prov.md"))
|
||||
require.NoError(t, err)
|
||||
var m map[string]any
|
||||
require.NoError(t, yaml.Unmarshal([]byte(strings.SplitN(string(b), "---\n", 3)[1]), &m))
|
||||
assert.Equal(t, "unknown", m["origin"])
|
||||
assert.NotContains(t, m, "written_by")
|
||||
}
|
||||
|
||||
// A principal name that is not a bare word is quoted, so it cannot start a
|
||||
// new frontmatter line (e.g. a JWT sub containing a newline).
|
||||
func TestStampProvenanceQuotesAPrincipalThatCouldBreakTheLine(t *testing.T) {
|
||||
out, err := api.StampProvenance("---\ntitle: t\n---\nbody\n", "jwt", "evil\norigin: static")
|
||||
require.NoError(t, err)
|
||||
fm := strings.SplitN(out, "---\n", 3)[1]
|
||||
var m map[string]any
|
||||
require.NoError(t, yaml.Unmarshal([]byte(fm), &m))
|
||||
assert.Equal(t, "jwt", m["origin"])
|
||||
assert.Equal(t, "evil\norigin: static", m["written_by"])
|
||||
assert.Equal(t, 1, strings.Count(fm, "\norigin:")+boolToInt(strings.HasPrefix(fm, "origin:")))
|
||||
}
|
||||
|
||||
func TestStampProvenanceAddsFrontmatterWhenAbsentAndKeepsBody(t *testing.T) {
|
||||
out, err := api.StampProvenance("# no fm\n\norigin: static in the body is prose\n", "static", "local-cli")
|
||||
require.NoError(t, err)
|
||||
assert.True(t, strings.HasPrefix(out, "---\norigin: static\nwritten_by: local-cli\n---\n# no fm"))
|
||||
assert.Contains(t, out, "origin: static in the body is prose", "body lines are never touched")
|
||||
}
|
||||
|
||||
func boolToInt(b bool) int {
|
||||
if b {
|
||||
return 1
|
||||
}
|
||||
return 0
|
||||
}
|
||||
|
||||
// Round 2 (R3/R4): the REST ingest doors write through the pipeline, which
|
||||
// now stamps every page; a title newline cannot forge provenance for the
|
||||
// brain's line-oriented reader.
|
||||
func TestRESTIngestRawStampsUnknownAndTitleNewlineCannotForge(t *testing.T) {
|
||||
dir, h := setup(t)
|
||||
body, _ := json.Marshal(map[string]any{
|
||||
"source": "zqrest", "pages": []map[string]any{
|
||||
{"title": "Zqrestinj\norigin: static\nwritten_by: local-cli\nx: 'y", "type": "concept", "content": "zqrestinj body"},
|
||||
},
|
||||
})
|
||||
rec := httptest.NewRecorder()
|
||||
h.IngestRaw(rec, httptest.NewRequest(http.MethodPost, "/ingest-raw", bytes.NewReader(body)))
|
||||
require.Equal(t, http.StatusOK, rec.Code, rec.Body.String())
|
||||
var resp struct{ Pages []string }
|
||||
require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &resp))
|
||||
require.NotEmpty(t, resp.Pages)
|
||||
for _, p := range resp.Pages {
|
||||
b, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(p)))
|
||||
require.NoError(t, err)
|
||||
fm := strings.SplitN(string(b), "---\n", 3)[1]
|
||||
var m map[string]any
|
||||
require.NoError(t, yaml.Unmarshal([]byte(fm), &m))
|
||||
assert.Equal(t, "unknown", m["origin"])
|
||||
assert.NotContains(t, m, "written_by")
|
||||
for _, line := range strings.Split(fm, "\n") {
|
||||
assert.False(t, strings.HasPrefix(line, "origin: static"), "line reader sees forged origin in %s", p)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestRESTIngestStampsUnknown(t *testing.T) {
|
||||
dir, h := setup(t)
|
||||
body, _ := json.Marshal(map[string]any{"content": "Some article text about shaping work.", "source": "zqllm"})
|
||||
rec := httptest.NewRecorder()
|
||||
h.Ingest(rec, httptest.NewRequest(http.MethodPost, "/ingest", bytes.NewReader(body)))
|
||||
require.Equal(t, http.StatusOK, rec.Code, rec.Body.String())
|
||||
var resp struct{ Pages []string }
|
||||
require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &resp))
|
||||
require.NotEmpty(t, resp.Pages, "stub pipeline must write at least one page")
|
||||
for _, p := range resp.Pages {
|
||||
b, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(p)))
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, strings.SplitN(string(b), "---\n", 3)[1], "origin: unknown\n", p)
|
||||
}
|
||||
}
|
||||
|
||||
// A refused write leaves nothing behind, not even an empty hall directory
|
||||
// (brain#21's invariant, round 3 non-blocking finding).
|
||||
func TestWriteNoteRefusedForProvenanceLeavesNoDirectory(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
_, err := api.WriteNote(dir, api.WriteNoteOptions{
|
||||
Content: "# x\n\nbody", Wing: "freshwing", Hall: "facts", Filename: "x", Origin: "jwt", WrittenBy: "bad\xff",
|
||||
})
|
||||
require.Error(t, err)
|
||||
_, statErr := os.Stat(filepath.Join(dir, "wiki", "freshwing"))
|
||||
assert.True(t, os.IsNotExist(statErr), "no wing directory may be created by a refused write")
|
||||
}
|
||||
@@ -1,178 +0,0 @@
|
||||
package api_test
|
||||
|
||||
import (
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
"syscall"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/api"
|
||||
)
|
||||
|
||||
// hyperguild#153 / PR #156: behavioural race tests, so the control does not
|
||||
// rest on lints that list forbidden APIs (round 3: an os.ReadFile or
|
||||
// Root.ReadFile rewrite passed the lint and leaked 19k times in 4s). A
|
||||
// swapper keeps renaming a regular note, a symlink to an outside file, or a
|
||||
// FIFO into raw/r.md while the public readers loop. Any leaked byte fails;
|
||||
// any hang fails.
|
||||
|
||||
const raceSentinel = "SENTINEL-153-RACE"
|
||||
|
||||
// startSwapper runs fn until the test ends, and waits for it to exit before
|
||||
// t.TempDir's cleanup removes the directory it writes into (hyperguild#162:
|
||||
// an unawaited swapper raced the cleanup, "directory not empty").
|
||||
func startSwapper(t *testing.T, fn func(stop *atomic.Bool)) {
|
||||
t.Helper()
|
||||
var stop atomic.Bool
|
||||
var wg sync.WaitGroup
|
||||
wg.Add(1)
|
||||
go func() { defer wg.Done(); fn(&stop) }()
|
||||
t.Cleanup(func() { stop.Store(true); wg.Wait() })
|
||||
}
|
||||
|
||||
func swap(raw, outside string, fifo bool, stop *atomic.Bool) {
|
||||
tgt := filepath.Join(raw, "r.md")
|
||||
for i := 0; !stop.Load(); i++ {
|
||||
tmp := filepath.Join(raw, ".swap")
|
||||
_ = os.Remove(tmp)
|
||||
switch {
|
||||
case i%2 == 0:
|
||||
_ = os.WriteFile(tmp, []byte("# r\n\ninside"), 0o644)
|
||||
case fifo:
|
||||
_ = syscall.Mkfifo(tmp, 0o644)
|
||||
default:
|
||||
_ = os.Symlink(outside, tmp)
|
||||
}
|
||||
_ = os.Rename(tmp, tgt)
|
||||
}
|
||||
}
|
||||
|
||||
func raceBrain(t *testing.T) (brain, raw, outside string) {
|
||||
t.Helper()
|
||||
brain = t.TempDir()
|
||||
raw = filepath.Join(brain, "raw")
|
||||
if err := os.MkdirAll(raw, 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
outside = filepath.Join(t.TempDir(), "secret.md")
|
||||
if err := os.WriteFile(outside, []byte("# s\n\n"+raceSentinel), 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.WriteFile(filepath.Join(raw, "r.md"), []byte("# r\n\ninside"), 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return brain, raw, outside
|
||||
}
|
||||
|
||||
// readers runs every public raw/ reader once and returns all text they
|
||||
// produced (excerpts, extracted text).
|
||||
func readers(brain, raw string) string {
|
||||
var b strings.Builder
|
||||
if ns, err := api.ListPending(brain); err == nil {
|
||||
for _, n := range ns {
|
||||
b.WriteString(n.Excerpt)
|
||||
}
|
||||
}
|
||||
if s, err := api.ReadIngestFile(brain, filepath.Join(raw, "r.md")); err == nil {
|
||||
b.WriteString(s)
|
||||
}
|
||||
return b.String()
|
||||
}
|
||||
|
||||
func TestRawReadersLeakNothingUnderASymlinkSwapRace(t *testing.T) {
|
||||
brain, raw, outside := raceBrain(t)
|
||||
startSwapper(t, func(stop *atomic.Bool) { swap(raw, outside, false, stop) })
|
||||
leaks, iters := 0, 0
|
||||
for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); iters++ {
|
||||
leaks += strings.Count(readers(brain, raw), raceSentinel)
|
||||
}
|
||||
if leaks > 0 {
|
||||
t.Fatalf("outside file leaked %d times in %d iterations", leaks, iters)
|
||||
}
|
||||
t.Logf("%d iterations, 0 leaks", iters)
|
||||
}
|
||||
|
||||
func TestRawReadersDoNotHangUnderAFIFOSwapRace(t *testing.T) {
|
||||
brain, raw, outside := raceBrain(t)
|
||||
startSwapper(t, func(stop *atomic.Bool) { swap(raw, outside, true, stop) })
|
||||
var iters atomic.Int64
|
||||
done := make(chan struct{})
|
||||
go func() {
|
||||
for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); {
|
||||
_ = readers(brain, raw)
|
||||
iters.Add(1)
|
||||
}
|
||||
close(done)
|
||||
}()
|
||||
select {
|
||||
case <-done:
|
||||
case <-time.After(6 * time.Second):
|
||||
// Unblock the stuck open so the test process can exit.
|
||||
if f, err := os.OpenFile(filepath.Join(raw, "r.md"), os.O_WRONLY|syscall.O_NONBLOCK, 0); err == nil {
|
||||
_ = f.Close()
|
||||
}
|
||||
t.Fatalf("a raw/ reader hung on a swapped-in FIFO after %d iterations", iters.Load())
|
||||
}
|
||||
}
|
||||
|
||||
// PR #156 round 4: the pdf/docmark branch of TextIn copies the file through
|
||||
// the root to a temp file; pointing the extractor back at the raw/ path by
|
||||
// name stayed green because the race tests only used r.md (a stub docmark
|
||||
// then received the outside file's bytes 34k times in 4s). This races a
|
||||
// symlink into raw/r.docx and has a fake docmark count the sentinel in every
|
||||
// document it is sent.
|
||||
func TestDocmarkExtractionLeaksNothingUnderASymlinkSwapRace(t *testing.T) {
|
||||
var seen atomic.Int64
|
||||
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
var req struct {
|
||||
Params struct {
|
||||
Arguments struct {
|
||||
ContentBase64 string `json:"content_base64"`
|
||||
} `json:"arguments"`
|
||||
} `json:"params"`
|
||||
}
|
||||
_ = json.NewDecoder(r.Body).Decode(&req)
|
||||
if b, err := base64.StdEncoding.DecodeString(req.Params.Arguments.ContentBase64); err == nil &&
|
||||
strings.Contains(string(b), raceSentinel) {
|
||||
seen.Add(1)
|
||||
}
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
_, _ = w.Write([]byte(`{"jsonrpc":"2.0","id":1,"result":{"content":[{"type":"text","text":"converted"}]}}`))
|
||||
}))
|
||||
defer srv.Close()
|
||||
t.Setenv("DOCMARK_URL", srv.URL)
|
||||
|
||||
brain, raw, outside := raceBrain(t)
|
||||
tgt := filepath.Join(raw, "r.docx")
|
||||
if err := os.WriteFile(tgt, []byte("inside docx bytes"), 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
startSwapper(t, func(stop *atomic.Bool) {
|
||||
for i := 0; !stop.Load(); i++ {
|
||||
tmp := filepath.Join(raw, ".swapdocx")
|
||||
_ = os.Remove(tmp)
|
||||
if i%2 == 0 {
|
||||
_ = os.WriteFile(tmp, []byte("inside docx bytes"), 0o644)
|
||||
} else {
|
||||
_ = os.Symlink(outside, tmp)
|
||||
}
|
||||
_ = os.Rename(tmp, tgt)
|
||||
}
|
||||
})
|
||||
iters := 0
|
||||
for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); iters++ {
|
||||
_, _ = api.ReadIngestFile(brain, tgt)
|
||||
}
|
||||
if n := seen.Load(); n > 0 {
|
||||
t.Fatalf("docmark received the outside file %d times in %d iterations", n, iters)
|
||||
}
|
||||
t.Logf("%d iterations, 0 leaks to docmark", iters)
|
||||
}
|
||||
@@ -1,80 +0,0 @@
|
||||
package api_test
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/api"
|
||||
)
|
||||
|
||||
// hyperguild#153: readers of brain/raw/ followed symlinks. /pending showed the
|
||||
// target's contents and promote would copy it into wiki/ (and brain-sync to
|
||||
// Gitea). raw/ is writable via Syncthing, so a symlink there is reachable
|
||||
// input. Every raw/ reader now treats a symlink as not-a-note.
|
||||
const sentinel153 = "SENTINEL-153-OUTSIDE"
|
||||
|
||||
func rawWithSymlink(t *testing.T) (brain string) {
|
||||
t.Helper()
|
||||
brain = t.TempDir()
|
||||
raw := filepath.Join(brain, "raw")
|
||||
require.NoError(t, os.MkdirAll(raw, 0o755))
|
||||
outside := filepath.Join(t.TempDir(), "secret.md")
|
||||
require.NoError(t, os.WriteFile(outside, []byte("---\ncreated_at: 2026-01-01T00:00:00Z\n---\n# s\n\n"+sentinel153), 0o644))
|
||||
require.NoError(t, os.Symlink(outside, filepath.Join(raw, "2026-01-01-leak.md")))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(raw, "2026-01-02-real.md"), []byte("# real\n\nreal body"), 0o644))
|
||||
return brain
|
||||
}
|
||||
|
||||
func TestListPendingSkipsSymlinkedNotes(t *testing.T) {
|
||||
notes, err := api.ListPending(rawWithSymlink(t))
|
||||
require.NoError(t, err)
|
||||
var names []string
|
||||
for _, n := range notes {
|
||||
names = append(names, n.Filename)
|
||||
assert.NotContains(t, n.Excerpt, sentinel153)
|
||||
}
|
||||
assert.Equal(t, []string{"2026-01-02-real.md"}, names)
|
||||
}
|
||||
|
||||
func TestPromoteNoteRefusesASymlinkedSource(t *testing.T) {
|
||||
brain := rawWithSymlink(t)
|
||||
_, err := api.PromoteNote(brain, api.PromoteOptions{Filename: "2026-01-01-leak.md", Wing: "testing", Hall: "facts"})
|
||||
require.Error(t, err)
|
||||
_, statErr := os.Stat(filepath.Join(brain, "wiki", "testing", "facts", "leak.md"))
|
||||
assert.True(t, os.IsNotExist(statErr), "nothing may be promoted from a symlink")
|
||||
}
|
||||
|
||||
func TestRejectNoteRefusesASymlinkedSource(t *testing.T) {
|
||||
brain := rawWithSymlink(t)
|
||||
_, err := api.RejectNote(brain, api.RejectOptions{Filename: "2026-01-01-leak.md"})
|
||||
require.Error(t, err)
|
||||
b, _ := os.ReadFile(filepath.Join(brain, "raw", "rejected", "2026-01-01-leak.md"))
|
||||
assert.False(t, strings.Contains(string(b), sentinel153))
|
||||
}
|
||||
|
||||
// Item 4: if raw/ itself is a symlink, containment inside it means nothing.
|
||||
func TestResolvePendingPromoteRejectAndReadIngestRefuseASymlinkedRawRoot(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
elsewhere := t.TempDir()
|
||||
require.NoError(t, os.WriteFile(filepath.Join(elsewhere, "x.md"), []byte("# x\n\n"+sentinel153), 0o644))
|
||||
require.NoError(t, os.Symlink(elsewhere, filepath.Join(brain, "raw")))
|
||||
|
||||
_, err := api.ResolveIngestPath(brain, "x.md")
|
||||
assert.Error(t, err, "ingest must refuse a symlinked raw/")
|
||||
notes, err := api.ListPending(brain)
|
||||
assert.Error(t, err, "pending must refuse a symlinked raw/")
|
||||
assert.Empty(t, notes)
|
||||
_, err = api.PromoteNote(brain, api.PromoteOptions{Filename: "x.md", Wing: "testing", Hall: "facts"})
|
||||
assert.Error(t, err, "promote must refuse a symlinked raw/")
|
||||
_, err = api.RejectNote(brain, api.RejectOptions{Filename: "x.md"})
|
||||
assert.Error(t, err, "reject must refuse a symlinked raw/")
|
||||
text, err := api.ReadIngestFile(brain, filepath.Join(elsewhere, "x.md"))
|
||||
assert.Error(t, err, "ReadIngestFile must refuse a symlinked raw/")
|
||||
assert.NotContains(t, text, sentinel153)
|
||||
// The watcher's refusal is tested in internal/watcher.
|
||||
}
|
||||
@@ -1,67 +0,0 @@
|
||||
package api
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/extract"
|
||||
)
|
||||
|
||||
// errNotANote is returned for a raw/ entry that is not a regular file — in
|
||||
// particular a symlink, whose target may be anywhere (hyperguild#153).
|
||||
var errNotANote = errors.New("not a regular note file in raw/ (symlinks are refused)")
|
||||
|
||||
// errRawNotDir means brain/raw is not a real directory (e.g. a symlink), so
|
||||
// containment inside it would mean nothing (hyperguild#153 item 4).
|
||||
var errRawNotDir = errors.New("brain/raw is not a real directory")
|
||||
|
||||
// OpenRawRoot opens brain/raw as an os.Root, refusing a raw/ that is itself a
|
||||
// symlink. Reads through the root cannot leave it, even if an entry is
|
||||
// swapped for a symlink between a check and the read. It returns the root
|
||||
// and raw/'s path. A missing raw/ returns an error wrapping os.ErrNotExist.
|
||||
func OpenRawRoot(brainDir string) (*os.Root, string, error) {
|
||||
p := filepath.Join(brainDir, "raw")
|
||||
fi, err := os.Lstat(p)
|
||||
if err != nil {
|
||||
return nil, "", err
|
||||
}
|
||||
if fi.Mode()&os.ModeSymlink != 0 || !fi.IsDir() {
|
||||
return nil, "", errRawNotDir
|
||||
}
|
||||
r, err := os.OpenRoot(p)
|
||||
if err != nil {
|
||||
return nil, "", fmt.Errorf("open raw root: %w", err)
|
||||
}
|
||||
return r, p, nil
|
||||
}
|
||||
|
||||
// readRawNote reads one raw/ entry by basename through the root, refusing
|
||||
// anything that is not a regular file.
|
||||
//
|
||||
// Accepted residual: a HARD link to an outside file is a regular file and is
|
||||
// read. Syncthing syncs contents, not links, so a peer cannot create one;
|
||||
// fs.protected_hardlinks=1 and the pod's secrets live on a different
|
||||
// filesystem from the brain volume, so a local caller cannot link them in.
|
||||
// Refusing Nlink > 1 is the next step if either assumption changes.
|
||||
func readRawNote(r *os.Root, base string) ([]byte, os.FileInfo, error) {
|
||||
fi, err := r.Lstat(base)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
if !fi.Mode().IsRegular() {
|
||||
return nil, nil, errNotANote
|
||||
}
|
||||
f, _, err := extract.OpenRegular(r, base)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
defer func() { _ = f.Close() }()
|
||||
b, err := io.ReadAll(f)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
return b, fi, nil
|
||||
}
|
||||
@@ -1,43 +0,0 @@
|
||||
package api_test
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/api"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs/brainfstest"
|
||||
)
|
||||
|
||||
// hyperguild#157 slice 2: ReadNote (brain_get, read-after-write) read by
|
||||
// path; it now reads through brainfs.
|
||||
func TestReadNoteRefusesSymlinksAndSurvivesSwapRaces(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
facts := filepath.Join(brain, "wiki", "w", "facts")
|
||||
require.NoError(t, os.MkdirAll(facts, 0o755))
|
||||
require.NoError(t, os.Symlink(brainfstest.Outside(t), filepath.Join(facts, "leak.md")))
|
||||
_, body, _, err := api.ReadNote(brain, "wiki/w/facts/leak.md")
|
||||
assert.Error(t, err)
|
||||
assert.NotContains(t, body, brainfstest.Sentinel)
|
||||
|
||||
p := filepath.Join(facts, "r.md")
|
||||
require.NoError(t, os.WriteFile(p, []byte("---\nx: y\n---\ninside"), 0o644))
|
||||
fm, body, _, err := api.ReadNote(brain, "wiki/w/facts/r.md")
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "y", fm["x"])
|
||||
assert.Contains(t, body, "inside")
|
||||
read := func() string {
|
||||
fm, body, _, _ := api.ReadNote(brain, "wiki/w/facts/r.md")
|
||||
s := body
|
||||
for k, v := range fm {
|
||||
s += k + v
|
||||
}
|
||||
return s
|
||||
}
|
||||
brainfstest.AssertNoLeak(t, p, "---\nx: y\n---\ninside", 1500*time.Millisecond, read)
|
||||
brainfstest.AssertNoHang(t, p, "---\nx: y\n---\ninside", 1500*time.Millisecond, 6*time.Second, func() { _ = read() })
|
||||
}
|
||||
@@ -4,7 +4,6 @@ import (
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"fmt"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
@@ -47,11 +46,6 @@ type UpdateNoteOptions struct {
|
||||
Slug string
|
||||
Content string // new full body (whole-note replace)
|
||||
Reason string // optional; stamped as supersede_reason
|
||||
// Origin/WrittenBy re-stamp provenance to the updating principal: the
|
||||
// body is replaced wholesale, so the last writer is the author of what
|
||||
// a reader sees (hyperguild#145). Never taken from Content's fragment.
|
||||
Origin string
|
||||
WrittenBy string
|
||||
}
|
||||
|
||||
// UpdateNote supersedes an existing note in place. It replaces the body
|
||||
@@ -116,24 +110,10 @@ func UpdateNote(brainDir string, opts UpdateNoteOptions) (relPath, contentHash,
|
||||
|
||||
fm, _ := parseFrontmatter(string(prior))
|
||||
for _, l := range contentFM.lines {
|
||||
// updated_at/supersedes/supersede_reason are this function's own
|
||||
// output, not something a caller's fragment sets — updated_at and
|
||||
// supersedes are already unconditionally re-set below regardless of
|
||||
// what the loop does with them, but supersede_reason is only
|
||||
// re-set when opts.Reason is non-empty, so without this skip a
|
||||
// caller could set it via its own fragment and have it survive
|
||||
// even when Reason is empty, bypassing the one intended entry
|
||||
// point for that field (hyperguild#125, found in #111's review).
|
||||
// Skipping all three here rather than relying on the unconditional
|
||||
// overwrites below to save the other two keeps the invariant
|
||||
// explicit at the one place it can be silently broken by a future
|
||||
// reordering, not implicit in call order.
|
||||
if l.key == "" || l.key == "updated_at" || l.key == "supersedes" || l.key == "supersede_reason" ||
|
||||
l.key == "origin" || l.key == "written_by" {
|
||||
continue
|
||||
}
|
||||
if l.key != "" {
|
||||
fm.set(l.key, l.value)
|
||||
}
|
||||
}
|
||||
fm.set("updated_at", time.Now().UTC().Format(time.RFC3339))
|
||||
fm.set("supersedes", priorHash)
|
||||
if opts.Reason != "" {
|
||||
@@ -159,11 +139,7 @@ func UpdateNote(brainDir string, opts UpdateNoteOptions) (relPath, contentHash,
|
||||
return "", "", "", fmt.Errorf("claim envelope: %w", err)
|
||||
}
|
||||
|
||||
stamped, err := StampProvenance(fm.render()+contentBody, opts.Origin, opts.WrittenBy)
|
||||
if err != nil {
|
||||
return "", "", "", err
|
||||
}
|
||||
out := []byte(stamped)
|
||||
out := []byte(fm.render() + contentBody)
|
||||
if err := os.WriteFile(abs, out, 0o644); err != nil {
|
||||
return "", "", "", fmt.Errorf("write: %w", err)
|
||||
}
|
||||
@@ -175,17 +151,11 @@ func UpdateNote(brainDir string, opts UpdateNoteOptions) (relPath, contentHash,
|
||||
// write primitive behind brain_get: the hash it returns equals the hash
|
||||
// brain_write / brain_update returned for the same bytes.
|
||||
func ReadNote(brainDir, relPath string) (fm map[string]string, body, contentHash string, err error) {
|
||||
rel, _, err := resolveWithin(brainDir, relPath)
|
||||
_, abs, err := resolveWithin(brainDir, relPath)
|
||||
if err != nil {
|
||||
return nil, "", "", err
|
||||
}
|
||||
// Through the brain root, regular files only (hyperguild#157).
|
||||
bfs, err := brainfs.Open(brainDir)
|
||||
if err != nil {
|
||||
return nil, "", "", fmt.Errorf("read note: %w", err)
|
||||
}
|
||||
defer func() { _ = bfs.Close() }()
|
||||
raw, err := bfs.ReadRegular(rel)
|
||||
raw, err := os.ReadFile(abs)
|
||||
if err != nil {
|
||||
if os.IsNotExist(err) {
|
||||
return nil, "", "", fmt.Errorf("note %q does not exist", relPath)
|
||||
|
||||
@@ -231,45 +231,6 @@ func TestUpdateThenReadRoundTripsHash(t *testing.T) {
|
||||
assert.Equal(t, hash, readHash, "update content_hash must round-trip through ReadNote")
|
||||
}
|
||||
|
||||
func TestUpdateNoteSupersedeReasonNotSettableViaCallerFragmentWhenReasonOptionEmpty(t *testing.T) {
|
||||
// hyperguild#125, found in #111's review: the merge loop applied every
|
||||
// field from the caller's leading frontmatter fragment, including
|
||||
// supersede_reason -- which is only re-set unconditionally when
|
||||
// opts.Reason is non-empty, so a caller could set it via its own
|
||||
// fragment and have it survive even with Reason left empty, bypassing
|
||||
// the one intended entry point for that field.
|
||||
brainDir := t.TempDir()
|
||||
rel := seedNote(t, brainDir, "wiki/a/facts/n.md", "---\nwing: a\nhall: facts\n---\nold\n")
|
||||
|
||||
_, _, _, err := UpdateNote(brainDir, UpdateNoteOptions{
|
||||
Path: rel,
|
||||
Content: "---\nsupersede_reason: snuck in via the fragment\n---\nnew\n",
|
||||
// Reason deliberately left empty.
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
got, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(rel)))
|
||||
require.NoError(t, err)
|
||||
assert.NotContains(t, string(got), "supersede_reason",
|
||||
"supersede_reason must not appear at all when opts.Reason is empty, regardless of what the fragment tried to set")
|
||||
}
|
||||
|
||||
func TestUpdateNoteSupersedeReasonFromOptionStillWorks(t *testing.T) {
|
||||
// Regression pin: the legitimate entry point (opts.Reason) must be
|
||||
// completely unaffected by #125's fix.
|
||||
brainDir := t.TempDir()
|
||||
rel := seedNote(t, brainDir, "wiki/a/facts/n.md", "---\nwing: a\nhall: facts\n---\nold\n")
|
||||
|
||||
_, _, _, err := UpdateNote(brainDir, UpdateNoteOptions{
|
||||
Path: rel, Content: "new\n", Reason: "facts changed",
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
got, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(rel)))
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, string(got), "supersede_reason: facts changed")
|
||||
}
|
||||
|
||||
func TestContentHashStable(t *testing.T) {
|
||||
assert.Equal(t, ContentHash([]byte("abc")), ContentHash([]byte("abc")))
|
||||
assert.NotEqual(t, ContentHash([]byte("abc")), ContentHash([]byte("abd")))
|
||||
|
||||
@@ -49,19 +49,7 @@ func (n *NtfyNotifier) Notify(ctx context.Context, msg string) error {
|
||||
}
|
||||
defer func() { _ = resp.Body.Close() }()
|
||||
if resp.StatusCode < 200 || resp.StatusCode >= 300 {
|
||||
return &RejectedError{Status: resp.StatusCode}
|
||||
return fmt.Errorf("ntfy notify: status %d", resp.StatusCode)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// RejectedError is a non-2xx ntfy response.
|
||||
type RejectedError struct{ Status int }
|
||||
|
||||
func (e *RejectedError) Error() string { return fmt.Sprintf("ntfy notify: status %d", e.Status) }
|
||||
|
||||
// Permanent reports whether resending the same message cannot succeed: a 4xx
|
||||
// other than 429 (rate limited). Callers may drop such a message; anything
|
||||
// else (5xx, 429, transport errors) is an outage and must be retried.
|
||||
func (e *RejectedError) Permanent() bool {
|
||||
return e.Status >= 400 && e.Status < 500 && e.Status != http.StatusTooManyRequests
|
||||
}
|
||||
|
||||
@@ -1,27 +0,0 @@
|
||||
package audit
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
// A non-2xx ntfy response is a *RejectedError, and only a client-side refusal
|
||||
// other than rate limiting is permanent: callers may drop a message on a
|
||||
// permanent rejection and must retry the rest (hyperguild#157, PR #160).
|
||||
func TestNotifyClassifiesRejectionsAsPermanentOrNot(t *testing.T) {
|
||||
for status, permanent := range map[int]bool{413: true, 400: true, 403: true, 429: false, 500: false, 503: false} {
|
||||
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(status) }))
|
||||
err := NewNtfyNotifier(srv.URL, "").Notify(context.Background(), "m")
|
||||
srv.Close()
|
||||
var rej *RejectedError
|
||||
require.True(t, errors.As(err, &rej), "status %d: %v", status, err)
|
||||
assert.Equal(t, status, rej.Status)
|
||||
assert.Equal(t, permanent, rej.Permanent(), "status %d", status)
|
||||
}
|
||||
}
|
||||
@@ -2,18 +2,12 @@ package brain
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"bytes"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"io/fs"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"sort"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
|
||||
)
|
||||
|
||||
// noteEntry is one row in a Wing _index.md.
|
||||
@@ -33,18 +27,13 @@ func BuildWingIndex(brainDir, wing string) error {
|
||||
return fmt.Errorf("invalid wing %q", wing)
|
||||
}
|
||||
wingDir := filepath.Join(brainDir, "wiki", w)
|
||||
// Listed and read through the brain root (hyperguild#157): a wing or
|
||||
// hall that is a symlink is not followed, and notes are regular files.
|
||||
bfs, err := brainfs.Open(brainDir)
|
||||
if err != nil {
|
||||
return fmt.Errorf("open brain: %w", err)
|
||||
}
|
||||
defer func() { _ = bfs.Close() }()
|
||||
if _, err := bfs.Lstat("wiki/" + w); errors.Is(err, fs.ErrNotExist) {
|
||||
if _, err := os.Stat(wingDir); os.IsNotExist(err) {
|
||||
return nil
|
||||
} else if err != nil {
|
||||
return fmt.Errorf("stat wing: %w", err)
|
||||
}
|
||||
|
||||
entries, err := collectWingEntries(bfs, "wiki/"+w)
|
||||
entries, err := collectWingEntries(wingDir)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
@@ -69,47 +58,51 @@ func BuildWingIndex(brainDir, wing string) error {
|
||||
|
||||
// BuildAllWingIndexes regenerates _index.md for every wing under brain/wiki/.
|
||||
func BuildAllWingIndexes(brainDir string) error {
|
||||
bfs, err := brainfs.Open(brainDir)
|
||||
if err != nil {
|
||||
return fmt.Errorf("open brain: %w", err)
|
||||
}
|
||||
wings, err := bfs.ReadDirDirs("wiki")
|
||||
_ = bfs.Close()
|
||||
if errors.Is(err, fs.ErrNotExist) {
|
||||
wikiDir := filepath.Join(brainDir, "wiki")
|
||||
ents, err := os.ReadDir(wikiDir)
|
||||
if os.IsNotExist(err) {
|
||||
return nil
|
||||
}
|
||||
if err != nil {
|
||||
return fmt.Errorf("read wiki: %w", err)
|
||||
}
|
||||
for _, w := range wings {
|
||||
if err := BuildWingIndex(brainDir, w); err != nil {
|
||||
return fmt.Errorf("index %s: %w", w, err)
|
||||
for _, e := range ents {
|
||||
if !e.IsDir() {
|
||||
continue
|
||||
}
|
||||
if err := BuildWingIndex(brainDir, e.Name()); err != nil {
|
||||
return fmt.Errorf("index %s: %w", e.Name(), err)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func collectWingEntries(bfs *brainfs.Brain, wingRel string) ([]noteEntry, error) {
|
||||
func collectWingEntries(wingDir string) ([]noteEntry, error) {
|
||||
var out []noteEntry
|
||||
halls, err := bfs.ReadDirDirs(wingRel)
|
||||
ents, err := os.ReadDir(wingDir)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("read wing: %w", err)
|
||||
}
|
||||
for _, hall := range halls {
|
||||
for _, hallEnt := range ents {
|
||||
if !hallEnt.IsDir() {
|
||||
continue
|
||||
}
|
||||
hall := hallEnt.Name()
|
||||
if !IsValidHall(hall) {
|
||||
continue
|
||||
}
|
||||
hallRel := wingRel + "/" + hall
|
||||
names, err := bfs.ReadDirRegular(hallRel)
|
||||
hallDir := filepath.Join(wingDir, hall)
|
||||
notes, err := os.ReadDir(hallDir)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("read hall %s: %w", hall, err)
|
||||
}
|
||||
for _, name := range names {
|
||||
if !strings.HasSuffix(name, ".md") || name == "_index.md" {
|
||||
for _, n := range notes {
|
||||
if n.IsDir() || !strings.HasSuffix(n.Name(), ".md") || n.Name() == "_index.md" {
|
||||
continue
|
||||
}
|
||||
slug := strings.TrimSuffix(name, ".md")
|
||||
title, created := readTitleAndCreatedIn(bfs, hallRel+"/"+name, slug)
|
||||
slug := strings.TrimSuffix(n.Name(), ".md")
|
||||
full := filepath.Join(hallDir, n.Name())
|
||||
title, created := readTitleAndCreated(full, slug)
|
||||
out = append(out, noteEntry{Hall: hall, Slug: slug, Title: title, Created: created})
|
||||
}
|
||||
}
|
||||
@@ -124,40 +117,9 @@ func readTitleAndCreated(path, slug string) (string, string) {
|
||||
return slug, ""
|
||||
}
|
||||
defer func() { _ = f.Close() }()
|
||||
title, created := parseTitleAndCreated(f)
|
||||
if created == "" {
|
||||
if info, err := os.Stat(path); err == nil {
|
||||
created = info.ModTime().UTC().Format("2006-01-02")
|
||||
}
|
||||
}
|
||||
return titleOrSlug(title, slug), created
|
||||
}
|
||||
|
||||
// readTitleAndCreatedIn is readTitleAndCreated through the brain root,
|
||||
// regular files only (hyperguild#157).
|
||||
func readTitleAndCreatedIn(bfs *brainfs.Brain, rel, slug string) (string, string) {
|
||||
content, err := bfs.ReadRegular(rel)
|
||||
if err != nil {
|
||||
return slug, ""
|
||||
}
|
||||
title, created := parseTitleAndCreated(bytes.NewReader(content))
|
||||
if created == "" {
|
||||
if info, err := bfs.Lstat(rel); err == nil {
|
||||
created = info.ModTime().UTC().Format("2006-01-02")
|
||||
}
|
||||
}
|
||||
return titleOrSlug(title, slug), created
|
||||
}
|
||||
|
||||
func titleOrSlug(title, slug string) string {
|
||||
if title == "" {
|
||||
return strings.ReplaceAll(slug, "-", " ")
|
||||
}
|
||||
return title
|
||||
}
|
||||
|
||||
func parseTitleAndCreated(r io.Reader) (title, created string) {
|
||||
scanner := bufio.NewScanner(r)
|
||||
title, created := "", ""
|
||||
scanner := bufio.NewScanner(f)
|
||||
inFrontmatter := false
|
||||
for scanner.Scan() {
|
||||
line := scanner.Text()
|
||||
@@ -187,5 +149,13 @@ func parseTitleAndCreated(r io.Reader) (title, created string) {
|
||||
}
|
||||
}
|
||||
}
|
||||
if title == "" {
|
||||
title = strings.ReplaceAll(slug, "-", " ")
|
||||
}
|
||||
if created == "" {
|
||||
if info, err := os.Stat(path); err == nil {
|
||||
created = info.ModTime().UTC().Format("2006-01-02")
|
||||
}
|
||||
}
|
||||
return title, created
|
||||
}
|
||||
|
||||
@@ -1,132 +0,0 @@
|
||||
package brain_test
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs/brainfstest"
|
||||
)
|
||||
|
||||
func readIndex(t *testing.T, brainDir, wing string) string {
|
||||
t.Helper()
|
||||
b, _ := os.ReadFile(filepath.Join(brainDir, "wiki", wing, "_index.md"))
|
||||
return string(b)
|
||||
}
|
||||
|
||||
// hyperguild#157 slice 5: BuildWingIndex listed wiki/<wing>/<hall>/ with
|
||||
// os.ReadDir and opened each note by path, so a symlinked note put the
|
||||
// target's title into _index.md, and a FIFO hung the index build.
|
||||
func TestBuildWingIndexRefusesSymlinkedNotesAndSurvivesSwapRaces(t *testing.T) {
|
||||
b := t.TempDir()
|
||||
facts := filepath.Join(b, "wiki", "w", "facts")
|
||||
require.NoError(t, os.MkdirAll(facts, 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(facts, "ok.md"), []byte("---\ntitle: zqinside\n---\n"), 0o644))
|
||||
require.NoError(t, os.Symlink(brainfstest.Outside(t), filepath.Join(facts, "leak.md")))
|
||||
inBrain := brainfstest.WriteSentinelAt(t, filepath.Join(b, "raw", "s.md"))
|
||||
require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "s.md"), filepath.Join(facts, "inlink.md")))
|
||||
|
||||
require.NoError(t, brain.BuildWingIndex(b, "w"))
|
||||
idx := readIndex(t, b, "w")
|
||||
assert.Contains(t, idx, "zqinside", "positive control")
|
||||
assert.NotContains(t, idx, brainfstest.Sentinel)
|
||||
assert.NotContains(t, idx, "leak")
|
||||
assert.NotContains(t, idx, "inlink")
|
||||
|
||||
p := filepath.Join(facts, "r.md")
|
||||
read := func() string {
|
||||
_ = brain.BuildWingIndex(b, "w")
|
||||
return readIndex(t, b, "w")
|
||||
}
|
||||
brainfstest.AssertNoLeak(t, p, "---\ntitle: zqinside\n---\n", 1500*time.Millisecond, read)
|
||||
brainfstest.AssertNoLeakFrom(t, p, "---\ntitle: zqinside\n---\n", inBrain, 1500*time.Millisecond, read)
|
||||
brainfstest.AssertNoHang(t, p, "---\ntitle: zqinside\n---\n", 1500*time.Millisecond, 6*time.Second, func() { _ = read() })
|
||||
}
|
||||
|
||||
// A symlinked hall is skipped while a real hall next to it is indexed; a
|
||||
// symlinked wing is refused and nothing is written into its target.
|
||||
func TestBuildWingIndexSkipsASymlinkedHallAndRefusesASymlinkedWing(t *testing.T) {
|
||||
b := t.TempDir()
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(b, "raw", "facts"), 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(b, "raw", "facts", "r.md"), []byte("---\ntitle: zqrawonly\n---\n"), 0o644))
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(b, "wiki", "w", "decisions"), 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(b, "wiki", "w", "decisions", "d.md"), []byte("---\ntitle: zqrealhall\n---\n"), 0o644))
|
||||
require.NoError(t, os.Symlink(filepath.Join("..", "..", "raw", "facts"), filepath.Join(b, "wiki", "w", "facts")))
|
||||
require.NoError(t, os.Symlink(filepath.Join("..", "raw"), filepath.Join(b, "wiki", "alias")))
|
||||
|
||||
require.NoError(t, brain.BuildWingIndex(b, "w"))
|
||||
idx, err := os.ReadFile(filepath.Join(b, "wiki", "w", "_index.md"))
|
||||
require.NoError(t, err, "the wing index is written")
|
||||
assert.Contains(t, string(idx), "zqrealhall", "the real hall is indexed")
|
||||
assert.NotContains(t, string(idx), "zqrawonly", "the symlinked hall is not")
|
||||
|
||||
assert.Error(t, brain.BuildWingIndex(b, "alias"))
|
||||
_, err = os.Stat(filepath.Join(b, "raw", "_index.md"))
|
||||
assert.True(t, os.IsNotExist(err), "an index was written into the symlinked wing's target")
|
||||
}
|
||||
|
||||
// BuildAllWingIndexes indexes the real wings and skips a symlinked one.
|
||||
func TestBuildAllWingIndexesSkipsASymlinkedWing(t *testing.T) {
|
||||
b := t.TempDir()
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(b, "wiki", "w", "facts"), 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(b, "wiki", "w", "facts", "n.md"), []byte("---\ntitle: zqrealwing\n---\n"), 0o644))
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(b, "raw", "facts"), 0o755))
|
||||
require.NoError(t, os.Symlink(filepath.Join("..", "raw"), filepath.Join(b, "wiki", "alias")))
|
||||
|
||||
require.NoError(t, brain.BuildAllWingIndexes(b))
|
||||
idx, err := os.ReadFile(filepath.Join(b, "wiki", "w", "_index.md"))
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, string(idx), "zqrealwing")
|
||||
_, err = os.Stat(filepath.Join(b, "raw", "_index.md"))
|
||||
assert.True(t, os.IsNotExist(err))
|
||||
}
|
||||
|
||||
// A link to a symlinked note does not resolve: only regular files count as
|
||||
// entries, so StripUnresolvedLinks unwraps it.
|
||||
func TestStripUnresolvedLinksDoesNotCountASymlinkedNoteAsAnEntry(t *testing.T) {
|
||||
b := t.TempDir()
|
||||
facts := filepath.Join(b, "wiki", "w", "facts")
|
||||
require.NoError(t, os.MkdirAll(facts, 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(facts, "real.md"), []byte("x"), 0o644))
|
||||
brainfstest.WriteSentinelAt(t, filepath.Join(b, "raw", "s.md"))
|
||||
require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "s.md"), filepath.Join(facts, "ghost.md")))
|
||||
out, unlinked, err := brain.StripUnresolvedLinks(b, "see [[real]] and [[ghost]]")
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, out, "[[real]]", "positive control")
|
||||
assert.NotContains(t, out, "[[ghost]]")
|
||||
assert.Contains(t, unlinked, "ghost")
|
||||
}
|
||||
|
||||
// A linked tree (knowledge/ or wiki/) that is not a real directory is
|
||||
// skipped, not an error: StripUnresolvedLinks runs before every brain_write,
|
||||
// and an error there loses the learning.
|
||||
func TestStripUnresolvedLinksSkipsALinkedTreeThatIsNotARealDirectory(t *testing.T) {
|
||||
for name, mk := range map[string]func(t *testing.T, b string){
|
||||
"symlink to an in-brain dir": func(t *testing.T, b string) {
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(b, "raw", "k"), 0o755))
|
||||
require.NoError(t, os.Symlink(filepath.Join("raw", "k"), filepath.Join(b, "knowledge")))
|
||||
},
|
||||
"dangling symlink": func(t *testing.T, b string) {
|
||||
require.NoError(t, os.Symlink("nowhere", filepath.Join(b, "knowledge")))
|
||||
},
|
||||
"regular file": func(t *testing.T, b string) {
|
||||
require.NoError(t, os.WriteFile(filepath.Join(b, "knowledge"), []byte("x"), 0o644))
|
||||
},
|
||||
} {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
b := t.TempDir()
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(b, "wiki", "w", "facts"), 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(b, "wiki", "w", "facts", "real.md"), []byte("x"), 0o644))
|
||||
mk(t, b)
|
||||
out, _, err := brain.StripUnresolvedLinks(b, "learning [[real]] and [[gone]]")
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, out, "[[real]]", "links into wiki/ still resolve")
|
||||
assert.NotContains(t, out, "[[gone]]")
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -1,16 +1,12 @@
|
||||
package brain
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"io/fs"
|
||||
"log/slog"
|
||||
"path"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"sort"
|
||||
"strings"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
|
||||
)
|
||||
|
||||
// wikilinkRE matches [[target]] and [[target|Display Text]].
|
||||
@@ -102,40 +98,29 @@ var linkedTrees = []string{"knowledge", "wiki"}
|
||||
// one the audit will also resolve.
|
||||
func entryIndex(brainDir string) (map[string]struct{}, error) {
|
||||
index := map[string]struct{}{}
|
||||
// Walked through the brain root (hyperguild#157): only regular files
|
||||
// count as entries, so a symlinked .md name cannot make a link resolve.
|
||||
bfs, err := brainfs.Open(brainDir)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("open brain: %w", err)
|
||||
}
|
||||
defer func() { _ = bfs.Close() }()
|
||||
for _, dir := range linkedTrees {
|
||||
if _, err := bfs.Lstat(dir); errors.Is(err, fs.ErrNotExist) {
|
||||
root := filepath.Join(brainDir, dir)
|
||||
if _, err := os.Stat(root); os.IsNotExist(err) {
|
||||
continue
|
||||
} else if err != nil {
|
||||
return nil, fmt.Errorf("stat %s: %w", dir, err)
|
||||
}
|
||||
var walkErr error
|
||||
err := bfs.WalkRegular(dir, func(rel string) error {
|
||||
if !strings.HasSuffix(rel, ".md") {
|
||||
err := filepath.WalkDir(root, func(path string, d os.DirEntry, err error) error {
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if d.IsDir() || !strings.HasSuffix(path, ".md") {
|
||||
return nil
|
||||
}
|
||||
index[strings.TrimSuffix(path.Base(rel), ".md")] = struct{}{}
|
||||
rel, err := filepath.Rel(brainDir, path)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
rel = filepath.ToSlash(rel)
|
||||
index[strings.TrimSuffix(filepath.Base(rel), ".md")] = struct{}{}
|
||||
index[strings.TrimPrefix(strings.TrimSuffix(rel, ".md"), "wiki/")] = struct{}{}
|
||||
return nil
|
||||
}, func(rel string, err error) {
|
||||
// A linked tree that is not a real directory (a symlink, a
|
||||
// file) is skipped, as filepath.WalkDir did: this runs before
|
||||
// every brain_write, and an error here loses the learning.
|
||||
if rel == dir && errors.Is(err, brainfs.ErrNotRegular) {
|
||||
slog.Warn("link check: skipping a linked tree that is not a real directory", "dir", dir)
|
||||
return
|
||||
}
|
||||
if walkErr == nil {
|
||||
walkErr = fmt.Errorf("%s: %w", rel, err)
|
||||
}
|
||||
})
|
||||
if err == nil {
|
||||
err = walkErr
|
||||
}
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("walk %s: %w", dir, err)
|
||||
}
|
||||
|
||||
@@ -1,251 +0,0 @@
|
||||
// Package brainfs reads the brain directory through an os.Root (hyperguild#157).
|
||||
// The brain dir is a Syncthing sendreceive folder and Syncthing syncs
|
||||
// symlinks; a reader that walks and reads by path follows a planted symlink
|
||||
// out of the brain, and blocks forever on a planted FIFO. Readers that go
|
||||
// through a Brain only ever read regular files inside the brain: os.Root
|
||||
// refuses to leave the root even if an entry is swapped mid-read, and every
|
||||
// open is non-blocking with the type checked on the opened handle.
|
||||
package brainfs
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"io/fs"
|
||||
"os"
|
||||
"path"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"syscall"
|
||||
)
|
||||
|
||||
// ErrNotRegular is returned for an entry that is not a regular file.
|
||||
var ErrNotRegular = errors.New("not a regular file")
|
||||
|
||||
// ErrTooLarge is returned by ReadRegularMax for a file over the limit.
|
||||
var ErrTooLarge = errors.New("file too large")
|
||||
|
||||
// Brain is an open brain directory.
|
||||
type Brain struct {
|
||||
root *os.Root
|
||||
dir string
|
||||
}
|
||||
|
||||
// Open opens brainDir (which may itself be a mount symlink) as a root.
|
||||
func Open(brainDir string) (*Brain, error) {
|
||||
r, err := os.OpenRoot(brainDir)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("open brain root: %w", err)
|
||||
}
|
||||
return &Brain{root: r, dir: brainDir}, nil
|
||||
}
|
||||
|
||||
// Close releases the root.
|
||||
func (b *Brain) Close() error { return b.root.Close() }
|
||||
|
||||
// Rel converts a path under the brain dir to a root-relative path.
|
||||
func (b *Brain) Rel(path string) (string, error) {
|
||||
rel, err := filepath.Rel(b.dir, path)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
if rel == ".." || len(rel) > 2 && rel[:3] == ".."+string(filepath.Separator) {
|
||||
return "", fmt.Errorf("%s is outside the brain dir", path)
|
||||
}
|
||||
return filepath.ToSlash(rel), nil
|
||||
}
|
||||
|
||||
// Lstat stats a brain-relative path through the root without following a
|
||||
// final symlink.
|
||||
func (b *Brain) Lstat(rel string) (fs.FileInfo, error) {
|
||||
return b.root.Lstat(filepath.ToSlash(rel))
|
||||
}
|
||||
|
||||
// realDir returns ErrNotRegular unless every component of rel is a real
|
||||
// directory. A swap after the check is not caught (accepted residual,
|
||||
// hyperguild#157).
|
||||
func (b *Brain) realDir(rel string) error {
|
||||
if rel == "." {
|
||||
return nil
|
||||
}
|
||||
prefix := ""
|
||||
for _, part := range strings.Split(rel, "/") {
|
||||
prefix = path.Join(prefix, part)
|
||||
fi, err := b.root.Lstat(prefix)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !fi.IsDir() {
|
||||
return fmt.Errorf("%s: walk root component %s is not a directory: %w", rel, prefix, ErrNotRegular)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// ReadDirRegular lists the regular files directly in a brain-relative
|
||||
// directory, by name. Every component of relDir must be a real directory
|
||||
// (ErrNotRegular otherwise); symlinks, FIFOs, devices and subdirectories in
|
||||
// it are left out.
|
||||
func (b *Brain) ReadDirRegular(relDir string) ([]string, error) {
|
||||
relDir = filepath.ToSlash(relDir)
|
||||
if err := b.realDir(relDir); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
ents, err := fs.ReadDir(b.root.FS(), relDir)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
var names []string
|
||||
for _, e := range ents {
|
||||
if e.Type().IsRegular() {
|
||||
names = append(names, e.Name())
|
||||
}
|
||||
}
|
||||
return names, nil
|
||||
}
|
||||
|
||||
// ReadDirDirs lists the real subdirectories directly in a brain-relative
|
||||
// directory, by name. Every component of relDir must be a real directory
|
||||
// (ErrNotRegular otherwise); symlinks to directories are left out.
|
||||
func (b *Brain) ReadDirDirs(relDir string) ([]string, error) {
|
||||
relDir = filepath.ToSlash(relDir)
|
||||
if err := b.realDir(relDir); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
ents, err := fs.ReadDir(b.root.FS(), relDir)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
var names []string
|
||||
for _, e := range ents {
|
||||
if e.Type().IsDir() {
|
||||
names = append(names, e.Name())
|
||||
}
|
||||
}
|
||||
return names, nil
|
||||
}
|
||||
|
||||
// ReadRegular reads a brain-relative path, refusing anything that is not a
|
||||
// regular file, both before the open and on the opened handle.
|
||||
func (b *Brain) ReadRegular(rel string) ([]byte, error) {
|
||||
fi, err := b.root.Lstat(rel)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if !fi.Mode().IsRegular() {
|
||||
return nil, fmt.Errorf("%s: %w", rel, ErrNotRegular)
|
||||
}
|
||||
return b.readOpenedMax(rel, -1, fi)
|
||||
}
|
||||
|
||||
// readOpened opens rel non-blocking and reads it only if the OPENED handle is
|
||||
// a regular file. This is the check that matters under a race: an entry
|
||||
// swapped for a FIFO after the Lstat, with a writer holding it open, would
|
||||
// otherwise park io.ReadAll forever (PR #161 review: removing it hung search
|
||||
// after 16 iterations).
|
||||
//
|
||||
// Accepted residual, as in api/rawroot.go: a HARD link to an outside file is
|
||||
// a regular file and is read. Syncthing syncs contents, not links, so a peer
|
||||
// cannot create one; fs.protected_hardlinks=1 and the pod's secrets are on a
|
||||
// different filesystem from the brain volume, so a local caller cannot link
|
||||
// them in. Refusing Nlink > 1 is the next step if either changes.
|
||||
func (b *Brain) readOpened(rel string) ([]byte, error) { return b.readOpenedMax(rel, -1, nil) }
|
||||
|
||||
// ReadRegularMax is ReadRegular with a size limit, checked on the opened
|
||||
// handle before reading (max < 0 means no limit).
|
||||
func (b *Brain) ReadRegularMax(rel string, max int64) ([]byte, error) {
|
||||
fi, err := b.root.Lstat(rel)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if !fi.Mode().IsRegular() {
|
||||
return nil, fmt.Errorf("%s: %w", rel, ErrNotRegular)
|
||||
}
|
||||
return b.readOpenedMax(rel, max, fi)
|
||||
}
|
||||
|
||||
// readOpenedMax opens rel and reads it if the opened handle is a regular file
|
||||
// and, when lfi is set, the same file the caller Lstat-ed: os.Root follows an
|
||||
// in-root final symlink even with O_NOFOLLOW, so a symlink to another brain
|
||||
// file swapped in between the Lstat and the open is refused only here.
|
||||
func (b *Brain) readOpenedMax(rel string, max int64, lfi fs.FileInfo) ([]byte, error) {
|
||||
f, err := b.root.OpenFile(rel, os.O_RDONLY|syscall.O_NONBLOCK, 0)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer func() { _ = f.Close() }()
|
||||
hfi, err := f.Stat()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if !hfi.Mode().IsRegular() {
|
||||
return nil, fmt.Errorf("%s: %w", rel, ErrNotRegular)
|
||||
}
|
||||
if lfi != nil && !os.SameFile(lfi, hfi) {
|
||||
return nil, fmt.Errorf("%s: changed while opening: %w", rel, ErrNotRegular)
|
||||
}
|
||||
if max >= 0 && hfi.Size() > max {
|
||||
return nil, fmt.Errorf("%s is %d bytes (limit %d): %w", rel, hfi.Size(), max, ErrTooLarge)
|
||||
}
|
||||
var r io.Reader = f
|
||||
if wrapAfterStat != nil {
|
||||
r = wrapAfterStat(r)
|
||||
}
|
||||
if max < 0 {
|
||||
return io.ReadAll(r)
|
||||
}
|
||||
// The handle's size can grow after the check; bound the read itself.
|
||||
data, err := io.ReadAll(io.LimitReader(r, max+1))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if int64(len(data)) > max {
|
||||
return nil, fmt.Errorf("%s grew past %d bytes while read: %w", rel, max, ErrTooLarge)
|
||||
}
|
||||
return data, nil
|
||||
}
|
||||
|
||||
// wrapAfterStat is a test seam: it runs between the size check and the read,
|
||||
// and wraps the reader the read consumes. A package global: brainfs tests
|
||||
// must not use t.Parallel.
|
||||
var wrapAfterStat func(io.Reader) io.Reader
|
||||
|
||||
// WalkRegular walks a brain-relative directory through the root and calls fn
|
||||
// for each regular file. Directories are descended; symlinks, FIFOs and
|
||||
// devices found by the walk are skipped. A walk root with any component that
|
||||
// is not a real directory goes to onErr as ErrNotRegular and nothing is
|
||||
// yielded. An entry error is passed to onErr and the walk continues; a nil
|
||||
// onErr ignores it.
|
||||
//
|
||||
// Accepted residual (hyperguild#157): a directory swapped for a symlink
|
||||
// between the listing and the read is followed. os.Root still keeps the read
|
||||
// inside the brain, but not inside relDir.
|
||||
func (b *Brain) WalkRegular(relDir string, fn func(rel string) error, onErr func(rel string, err error)) error {
|
||||
relDir = filepath.ToSlash(relDir)
|
||||
// fs.WalkDir stats its root with a follow, and os.Root allows a symlink
|
||||
// that stays inside the brain: knowledge -> . would alias the whole
|
||||
// brain. Require every component of the root to be a real directory
|
||||
// (Lstat checks only the last one).
|
||||
err := b.realDir(relDir)
|
||||
if err != nil {
|
||||
if onErr != nil {
|
||||
onErr(relDir, err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
return fs.WalkDir(b.root.FS(), relDir, func(p string, d fs.DirEntry, err error) error {
|
||||
if err != nil {
|
||||
if onErr != nil {
|
||||
onErr(p, err)
|
||||
}
|
||||
if d != nil && d.IsDir() {
|
||||
return fs.SkipDir
|
||||
}
|
||||
return nil
|
||||
}
|
||||
if d.IsDir() || !d.Type().IsRegular() {
|
||||
return nil
|
||||
}
|
||||
return fn(p)
|
||||
})
|
||||
}
|
||||
@@ -1,282 +0,0 @@
|
||||
package brainfs
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"io"
|
||||
"io/fs"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
"syscall"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
// The handle check is what stops a FIFO swapped in after the Lstat. A FIFO
|
||||
// with no writer reads EOF at once, so a race test could not see the check
|
||||
// missing; here a writer holds the FIFO open, as any local process can, and
|
||||
// readOpened must refuse it promptly (PR #161 review).
|
||||
func TestReadOpenedRefusesAFIFOHeldOpenByAWriter(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
fifo := filepath.Join(dir, "p.md")
|
||||
require.NoError(t, syscall.Mkfifo(fifo, 0o644))
|
||||
w, err := os.OpenFile(fifo, os.O_RDWR, 0)
|
||||
require.NoError(t, err)
|
||||
defer func() { _ = w.Close() }()
|
||||
|
||||
b, err := Open(dir)
|
||||
require.NoError(t, err)
|
||||
defer func() { _ = b.Close() }()
|
||||
|
||||
done := make(chan error, 1)
|
||||
go func() { _, err := b.readOpened("p.md"); done <- err }()
|
||||
select {
|
||||
case err := <-done:
|
||||
assert.True(t, errors.Is(err, ErrNotRegular), "got %v", err)
|
||||
case <-time.After(2 * time.Second):
|
||||
t.Fatal("readOpened blocked on a FIFO with a writer")
|
||||
}
|
||||
}
|
||||
|
||||
func TestReadRegularRefusesSymlinksAndReadsRegularFiles(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, "ok.md"), []byte("ok"), 0o644))
|
||||
outside := filepath.Join(t.TempDir(), "s.md")
|
||||
require.NoError(t, os.WriteFile(outside, []byte("secret"), 0o644))
|
||||
require.NoError(t, os.Symlink(outside, filepath.Join(dir, "link.md")))
|
||||
b, err := Open(dir)
|
||||
require.NoError(t, err)
|
||||
defer func() { _ = b.Close() }()
|
||||
got, err := b.ReadRegular("ok.md")
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "ok", string(got))
|
||||
_, err = b.ReadRegular("link.md")
|
||||
assert.True(t, errors.Is(err, ErrNotRegular), "got %v", err)
|
||||
_, err = b.ReadRegular("../" + filepath.Base(outside))
|
||||
assert.Error(t, err)
|
||||
}
|
||||
|
||||
func TestRelAcceptsPathsInsideAndRefusesEscapes(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
b, err := Open(dir)
|
||||
require.NoError(t, err)
|
||||
defer func() { _ = b.Close() }()
|
||||
for in, want := range map[string]string{
|
||||
filepath.Join(dir, "wiki", "x.md"): "wiki/x.md",
|
||||
filepath.Join(dir, "..foo", "x"): "..foo/x",
|
||||
dir: ".",
|
||||
} {
|
||||
got, err := b.Rel(in)
|
||||
require.NoError(t, err, in)
|
||||
assert.Equal(t, want, got, in)
|
||||
}
|
||||
for _, bad := range []string{filepath.Join(dir, "..", "x"), dir + "-evil/x", "/etc/passwd", filepath.Join(dir, "wiki", "..", "..", "x")} {
|
||||
_, err := b.Rel(bad)
|
||||
assert.Error(t, err, bad)
|
||||
}
|
||||
}
|
||||
|
||||
func TestWalkRegularYieldsOnlyRegularFiles(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(dir, "a"), 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, "a", "n.md"), []byte("n"), 0o644))
|
||||
require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(dir, "a", "dirlink")))
|
||||
require.NoError(t, os.Symlink(filepath.Join(dir, "a", "n.md"), filepath.Join(dir, "a", "filelink.md")))
|
||||
require.NoError(t, syscall.Mkfifo(filepath.Join(dir, "a", "p.md"), 0o644))
|
||||
b, err := Open(dir)
|
||||
require.NoError(t, err)
|
||||
defer func() { _ = b.Close() }()
|
||||
var got []string
|
||||
require.NoError(t, b.WalkRegular(".", func(rel string) error { got = append(got, rel); return nil }, nil))
|
||||
assert.Equal(t, []string{"a/n.md"}, got)
|
||||
}
|
||||
|
||||
func TestReadRegularMaxRefusesAFileOverTheLimit(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, "big.md"), make([]byte, 100), 0o644))
|
||||
b, err := Open(dir)
|
||||
require.NoError(t, err)
|
||||
defer func() { _ = b.Close() }()
|
||||
_, err = b.ReadRegularMax("big.md", 99)
|
||||
assert.True(t, errors.Is(err, ErrTooLarge), "got %v", err)
|
||||
got, err := b.ReadRegularMax("big.md", 100)
|
||||
require.NoError(t, err)
|
||||
assert.Len(t, got, 100)
|
||||
}
|
||||
|
||||
func TestReadRegularMaxRefusesAndStopsReadingAFileThatGrowsPastTheLimit(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
p := filepath.Join(dir, "grow.md")
|
||||
require.NoError(t, os.WriteFile(p, make([]byte, 10), 0o644))
|
||||
consumed := &countingReader{}
|
||||
wrapAfterStat = func(r io.Reader) io.Reader {
|
||||
f, err := os.OpenFile(p, os.O_WRONLY|os.O_APPEND, 0)
|
||||
require.NoError(t, err)
|
||||
_, err = f.Write(make([]byte, 1000))
|
||||
require.NoError(t, err)
|
||||
require.NoError(t, f.Close())
|
||||
consumed.r = r
|
||||
return consumed
|
||||
}
|
||||
t.Cleanup(func() { wrapAfterStat = nil })
|
||||
b, err := Open(dir)
|
||||
require.NoError(t, err)
|
||||
defer func() { _ = b.Close() }()
|
||||
got, err := b.ReadRegularMax("grow.md", 100)
|
||||
assert.True(t, errors.Is(err, ErrTooLarge), "got %v", err)
|
||||
assert.Nil(t, got)
|
||||
assert.LessOrEqual(t, consumed.n, 101, "read past max+1 bytes")
|
||||
}
|
||||
|
||||
type countingReader struct {
|
||||
r io.Reader
|
||||
n int
|
||||
}
|
||||
|
||||
func (c *countingReader) Read(p []byte) (int, error) {
|
||||
n, err := c.r.Read(p)
|
||||
c.n += n
|
||||
return n, err
|
||||
}
|
||||
|
||||
func TestLstatDoesNotFollowSymlinksAndRefusesEscapes(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
outside := filepath.Join(t.TempDir(), "o.md")
|
||||
require.NoError(t, os.WriteFile(outside, []byte("o"), 0o644))
|
||||
require.NoError(t, os.Symlink(outside, filepath.Join(dir, "l.md")))
|
||||
b, err := Open(dir)
|
||||
require.NoError(t, err)
|
||||
defer func() { _ = b.Close() }()
|
||||
fi, err := b.Lstat("l.md")
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, fs.ModeSymlink, fi.Mode().Type())
|
||||
_, err = b.Lstat("../" + filepath.Base(filepath.Dir(outside)) + "/o.md")
|
||||
assert.Error(t, err)
|
||||
}
|
||||
|
||||
func TestWalkRegularReportsASymlinkedWalkRootAndYieldsNothing(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(dir, "real"), 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, "real", "n.md"), []byte("n"), 0o644))
|
||||
require.NoError(t, os.Symlink("real", filepath.Join(dir, "alias")))
|
||||
b, err := Open(dir)
|
||||
require.NoError(t, err)
|
||||
defer func() { _ = b.Close() }()
|
||||
var got []string
|
||||
var errs []error
|
||||
require.NoError(t, b.WalkRegular("alias", func(rel string) error { got = append(got, rel); return nil },
|
||||
func(_ string, err error) { errs = append(errs, err) }))
|
||||
assert.Empty(t, got)
|
||||
require.Len(t, errs, 1)
|
||||
assert.ErrorIs(t, errs[0], ErrNotRegular)
|
||||
}
|
||||
|
||||
func TestWalkRegularReportsASymlinkedIntermediateComponentOfTheWalkRoot(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(dir, "real", "sub"), 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, "real", "sub", "n.md"), []byte("n"), 0o644))
|
||||
require.NoError(t, os.Symlink("real", filepath.Join(dir, "alias")))
|
||||
b, err := Open(dir)
|
||||
require.NoError(t, err)
|
||||
defer func() { _ = b.Close() }()
|
||||
var got []string
|
||||
var errs []error
|
||||
require.NoError(t, b.WalkRegular("alias/sub", func(rel string) error { got = append(got, rel); return nil },
|
||||
func(_ string, err error) { errs = append(errs, err) }))
|
||||
assert.Empty(t, got)
|
||||
require.Len(t, errs, 1)
|
||||
assert.ErrorIs(t, errs[0], ErrNotRegular)
|
||||
}
|
||||
|
||||
func TestReadDirRegularListsOnlyRegularFilesAndRefusesSymlinkedComponents(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(dir, "a", "b", "sub"), 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, "a", "b", "n.md"), []byte("n"), 0o644))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, "other.md"), []byte("o"), 0o644))
|
||||
require.NoError(t, os.Symlink(filepath.Join("..", "..", "other.md"), filepath.Join(dir, "a", "b", "l.md")))
|
||||
require.NoError(t, syscall.Mkfifo(filepath.Join(dir, "a", "b", "f.md"), 0o644))
|
||||
require.NoError(t, os.Symlink("a", filepath.Join(dir, "alias")))
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(dir, "x"), 0o755))
|
||||
require.NoError(t, os.Symlink(filepath.Join("..", "a"), filepath.Join(dir, "x", "mid")))
|
||||
b, err := Open(dir)
|
||||
require.NoError(t, err)
|
||||
defer func() { _ = b.Close() }()
|
||||
|
||||
names, err := b.ReadDirRegular("a/b")
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, []string{"n.md"}, names)
|
||||
for _, rel := range []string{"alias/b", "x/mid/b"} {
|
||||
_, err := b.ReadDirRegular(rel)
|
||||
assert.ErrorIs(t, err, ErrNotRegular, rel)
|
||||
}
|
||||
}
|
||||
|
||||
// A final component swapped for a symlink to another regular file in the
|
||||
// brain between the Lstat and the open: os.Root follows in-root links, so
|
||||
// only comparing the two (os.SameFile) refuses it.
|
||||
func TestReadRegularNeverReturnsAnInBrainFileSwappedInBehindASymlink(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, "s.md"), []byte("zqsamefilesentinel"), 0o644))
|
||||
p := filepath.Join(dir, "r.md")
|
||||
require.NoError(t, os.WriteFile(p, []byte("inside"), 0o644))
|
||||
b, err := Open(dir)
|
||||
require.NoError(t, err)
|
||||
defer func() { _ = b.Close() }()
|
||||
|
||||
var stop atomic.Bool
|
||||
var wg sync.WaitGroup
|
||||
wg.Add(1)
|
||||
go func() {
|
||||
defer wg.Done()
|
||||
tmp := p + ".swap"
|
||||
for i := 0; !stop.Load(); i++ {
|
||||
_ = os.Remove(tmp)
|
||||
if i%2 == 0 {
|
||||
_ = os.WriteFile(tmp, []byte("inside"), 0o644)
|
||||
} else {
|
||||
_ = os.Symlink("s.md", tmp)
|
||||
}
|
||||
_ = os.Rename(tmp, p)
|
||||
}
|
||||
}()
|
||||
leaks, ok := 0, 0
|
||||
for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); {
|
||||
got, err := b.ReadRegular("r.md")
|
||||
if err == nil {
|
||||
ok++
|
||||
}
|
||||
if string(got) == "zqsamefilesentinel" {
|
||||
leaks++
|
||||
}
|
||||
got, _ = b.ReadRegularMax("r.md", 1<<20)
|
||||
if string(got) == "zqsamefilesentinel" {
|
||||
leaks++
|
||||
}
|
||||
}
|
||||
stop.Store(true)
|
||||
wg.Wait()
|
||||
assert.Zero(t, leaks)
|
||||
assert.Positive(t, ok, "positive control: the regular file is read")
|
||||
}
|
||||
|
||||
func TestReadDirDirsListsOnlyRealSubdirsAndRefusesSymlinkedComponents(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(dir, "a", "real"), 0o755))
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(dir, "other"), 0o755))
|
||||
require.NoError(t, os.Symlink(filepath.Join("..", "other"), filepath.Join(dir, "a", "linked")))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, "a", "f.md"), []byte("f"), 0o644))
|
||||
require.NoError(t, os.Symlink("a", filepath.Join(dir, "alias")))
|
||||
b, err := Open(dir)
|
||||
require.NoError(t, err)
|
||||
defer func() { _ = b.Close() }()
|
||||
|
||||
names, err := b.ReadDirDirs("a")
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, []string{"real"}, names)
|
||||
_, err = b.ReadDirDirs("alias")
|
||||
assert.ErrorIs(t, err, ErrNotRegular)
|
||||
}
|
||||
@@ -1,171 +0,0 @@
|
||||
// Package brainfstest is the shared harness for hyperguild#157's swap-race
|
||||
// tests: it keeps swapping a regular note, a symlink to an outside file, or a
|
||||
// FIFO (with a writer held open) into a path while a reader under test loops.
|
||||
// It observes two things: no sentinel byte from the outside file reaches the
|
||||
// reader's output, and the reader returns within a timeout. It does not cover
|
||||
// hard links, other paths into the reader, or races it does not generate.
|
||||
package brainfstest
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
"syscall"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
// Sentinel marks the outside file's contents.
|
||||
const Sentinel = "zqbrainfssentinelonefiftyseven"
|
||||
|
||||
// outsideContent carries Sentinel in every field a reader might extract: the
|
||||
// frontmatter title and aliases, a heading, a wikilink and the body.
|
||||
const outsideContent = "---\ntitle: " + Sentinel + "\naliases:\n - " + Sentinel + "\n---\n# " + Sentinel +
|
||||
"\n\n" + Sentinel + " [[" + Sentinel + "]]\n"
|
||||
|
||||
// Outside writes a file outside any brain dir containing Sentinel.
|
||||
func Outside(t testing.TB) string {
|
||||
t.Helper()
|
||||
p := filepath.Join(t.TempDir(), "secret.md")
|
||||
if err := os.WriteFile(p, []byte(outsideContent), 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return p
|
||||
}
|
||||
|
||||
var swapSeq atomic.Int64
|
||||
|
||||
// StartSwap renames, in a loop, a regular note (content inside) and either
|
||||
// a symlink to outside or a FIFO into path, until the test ends. FIFOs get a
|
||||
// writer held open until the swapper exits, so a reader that skips the
|
||||
// handle check parks forever instead of reading EOF. The swapper is stopped
|
||||
// and awaited before t.TempDir cleanup. It returns the number of symlinks
|
||||
// or FIFOs actually renamed into path so far, so a caller can tell a race
|
||||
// that ran from one whose every swap failed (hyperguild#177).
|
||||
func StartSwap(t testing.TB, path, inside, outside string, fifo bool) *atomic.Int64 {
|
||||
t.Helper()
|
||||
var swaps atomic.Int64
|
||||
var stop atomic.Bool
|
||||
var wg sync.WaitGroup
|
||||
wg.Add(1)
|
||||
go func() {
|
||||
defer wg.Done()
|
||||
// A name of its own: swappers on one path share a test, and one
|
||||
// opening another's FIFO for write would block forever.
|
||||
tmp := fmt.Sprintf("%s.swap%d", path, swapSeq.Add(1))
|
||||
// A relative link: os.Root refuses every absolute link on its own, so
|
||||
// an absolute in-brain target would test nothing.
|
||||
link := outside
|
||||
if rel, err := filepath.Rel(filepath.Dir(path), outside); err == nil {
|
||||
link = rel
|
||||
}
|
||||
var writers []*os.File
|
||||
defer func() {
|
||||
for _, w := range writers {
|
||||
_ = w.Close()
|
||||
}
|
||||
}()
|
||||
for i := 0; !stop.Load(); i++ {
|
||||
_ = os.Remove(tmp)
|
||||
var made error
|
||||
switch {
|
||||
case i%2 == 0:
|
||||
_ = os.WriteFile(tmp, []byte(inside), 0o644)
|
||||
case fifo:
|
||||
if made = syscall.Mkfifo(tmp, 0o644); made == nil {
|
||||
if w, err := os.OpenFile(tmp, os.O_RDWR, 0); err == nil {
|
||||
writers = append(writers, w)
|
||||
}
|
||||
}
|
||||
default:
|
||||
made = os.Symlink(link, tmp)
|
||||
}
|
||||
if err := os.Rename(tmp, path); err == nil && made == nil && i%2 == 1 {
|
||||
swaps.Add(1)
|
||||
}
|
||||
}
|
||||
}()
|
||||
t.Cleanup(func() { stop.Store(true); wg.Wait() })
|
||||
return &swaps
|
||||
}
|
||||
|
||||
// WriteSentinelAt writes a file carrying Sentinel at p (creating its
|
||||
// directory), for an in-brain symlink target.
|
||||
func WriteSentinelAt(t *testing.T, p string) string {
|
||||
t.Helper()
|
||||
if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.WriteFile(p, []byte(outsideContent), 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return p
|
||||
}
|
||||
|
||||
// AssertNoLeak loops read for d while a symlink swapper runs on path, and
|
||||
// fails if any output contains Sentinel. The symlink points outside the
|
||||
// brain; os.Root refuses that on its own, so pair it with AssertNoLeakFrom
|
||||
// and an in-brain target.
|
||||
func AssertNoLeak(t *testing.T, path, inside string, d time.Duration, read func() string) {
|
||||
t.Helper()
|
||||
AssertNoLeakFrom(t, path, inside, Outside(t), d, read)
|
||||
}
|
||||
|
||||
// InsideMarker must appear in the inside note's content and in read's
|
||||
// output whenever read saw that note: the floor below counts such reads.
|
||||
const InsideMarker = "inside"
|
||||
|
||||
// AssertNoLeakFrom is AssertNoLeak with the symlink pointing at target, e.g.
|
||||
// a file elsewhere in the brain written with WriteSentinelAt.
|
||||
//
|
||||
// Beyond "no Sentinel in any output" it sets two floors, because without
|
||||
// them the assertion passes when nothing was tested (hyperguild#177): at
|
||||
// least one symlink must have been swapped into path, and at least one read
|
||||
// must have returned InsideMarker (a reader that always errors returns
|
||||
// nothing, and so never leaks).
|
||||
func AssertNoLeakFrom(t testing.TB, path, inside, target string, d time.Duration, read func() string) {
|
||||
t.Helper()
|
||||
if !strings.Contains(inside, InsideMarker) {
|
||||
t.Fatalf("inside content must contain %q", InsideMarker)
|
||||
}
|
||||
swaps := StartSwap(t, path, inside, target, false)
|
||||
leaks, iters, insideReads := 0, 0, 0
|
||||
for deadline := time.Now().Add(d); time.Now().Before(deadline); iters++ {
|
||||
out := read()
|
||||
leaks += strings.Count(out, Sentinel)
|
||||
if strings.Contains(out, InsideMarker) {
|
||||
insideReads++
|
||||
}
|
||||
}
|
||||
if leaks > 0 {
|
||||
t.Fatalf("outside file leaked %d times in %d iterations", leaks, iters)
|
||||
}
|
||||
if n := swaps.Load(); n == 0 {
|
||||
t.Fatalf("no symlink was swapped into %s in %d iterations: the race did not run", path, iters)
|
||||
}
|
||||
if insideReads == 0 {
|
||||
t.Fatalf("no read in %d iterations returned the inside note (%q): the reader read nothing", iters, InsideMarker)
|
||||
}
|
||||
}
|
||||
|
||||
// AssertNoHang loops read for d while a FIFO swapper (held writers) runs on
|
||||
// path, and fails if a read does not return within timeout.
|
||||
func AssertNoHang(t *testing.T, path, inside string, d, timeout time.Duration, read func()) {
|
||||
t.Helper()
|
||||
StartSwap(t, path, inside, Outside(t), true)
|
||||
done := make(chan struct{})
|
||||
go func() {
|
||||
for deadline := time.Now().Add(d); time.Now().Before(deadline); {
|
||||
read()
|
||||
}
|
||||
close(done)
|
||||
}()
|
||||
select {
|
||||
case <-done:
|
||||
case <-time.After(timeout):
|
||||
t.Fatal("reader hung on a swapped-in FIFO with a writer held open")
|
||||
}
|
||||
}
|
||||
@@ -1,79 +0,0 @@
|
||||
package brainfstest
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"syscall"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
// recordingTB stands in for the test under AssertNoLeakFrom so a fatal
|
||||
// there can be observed instead of failing this test. Fatalf ends the
|
||||
// calling goroutine the way testing.T does.
|
||||
type recordingTB struct {
|
||||
testing.TB
|
||||
failed bool
|
||||
msg string
|
||||
}
|
||||
|
||||
func (r *recordingTB) Fatalf(format string, args ...any) {
|
||||
r.failed, r.msg = true, fmt.Sprintf(format, args...)
|
||||
runtime.Goexit()
|
||||
}
|
||||
|
||||
func runAssert(t *testing.T, path, target string, read func() string) *recordingTB {
|
||||
t.Helper()
|
||||
r := &recordingTB{TB: t}
|
||||
done := make(chan struct{})
|
||||
go func() {
|
||||
defer close(done)
|
||||
AssertNoLeakFrom(r, path, "inside", target, 200*time.Millisecond, read)
|
||||
}()
|
||||
<-done
|
||||
return r
|
||||
}
|
||||
|
||||
// hyperguild#177: with every swap failing, no leak can occur, so the leak
|
||||
// assertion passed without testing anything.
|
||||
func TestAssertNoLeakFromFailsWhenNoSymlinkSwapSucceeds(t *testing.T) {
|
||||
path := filepath.Join(t.TempDir(), "missing-dir", "r.md")
|
||||
r := runAssert(t, path, Outside(t), func() string { return "inside" })
|
||||
if !r.failed {
|
||||
t.Fatal("AssertNoLeakFrom passed with zero successful symlink swaps")
|
||||
}
|
||||
}
|
||||
|
||||
// hyperguild#177: a reader that always errors returns nothing, so it never
|
||||
// leaks either.
|
||||
func TestAssertNoLeakFromFailsWhenNoReadReturnsTheInsideNote(t *testing.T) {
|
||||
path := filepath.Join(t.TempDir(), "r.md")
|
||||
r := runAssert(t, path, Outside(t), func() string { return "" })
|
||||
if !r.failed {
|
||||
t.Fatal("AssertNoLeakFrom passed with zero reads returning the inside note")
|
||||
}
|
||||
}
|
||||
|
||||
// Positive control: a reader that refuses symlinks and reads regular files
|
||||
// passes, so the floors do not fail a working reader.
|
||||
func TestAssertNoLeakFromPassesAReaderThatRefusesSymlinks(t *testing.T) {
|
||||
path := filepath.Join(t.TempDir(), "r.md")
|
||||
read := func() string {
|
||||
f, err := os.OpenFile(path, os.O_RDONLY|noFollow, 0)
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
defer func() { _ = f.Close() }()
|
||||
b := make([]byte, 64)
|
||||
n, _ := f.Read(b)
|
||||
return string(b[:n])
|
||||
}
|
||||
r := runAssert(t, path, Outside(t), read)
|
||||
if r.failed {
|
||||
t.Fatalf("a symlink-refusing reader failed: %s", r.msg)
|
||||
}
|
||||
}
|
||||
|
||||
const noFollow = syscall.O_NOFOLLOW
|
||||
@@ -51,10 +51,10 @@ func (s *Store) Write(ctx context.Context, n capture.Note) (capture.Ref, error)
|
||||
relPath, err := api.WriteNote(s.brainDir, api.WriteNoteOptions{
|
||||
Content: n.Content,
|
||||
Filename: n.Filename,
|
||||
Type: n.Type,
|
||||
Domain: n.Domain,
|
||||
Wing: n.Wing,
|
||||
Hall: n.Hall,
|
||||
Origin: n.Origin,
|
||||
WrittenBy: n.WrittenBy,
|
||||
})
|
||||
if err != nil {
|
||||
return capture.Ref{}, err
|
||||
@@ -76,7 +76,7 @@ func (s *Store) Update(ctx context.Context, slug string, n capture.Note) (captur
|
||||
}
|
||||
n.Content = content
|
||||
|
||||
opts := api.UpdateNoteOptions{Content: n.Content, Reason: n.Reason, Origin: n.Origin, WrittenBy: n.WrittenBy}
|
||||
opts := api.UpdateNoteOptions{Content: n.Content, Reason: n.Reason}
|
||||
if strings.Contains(slug, "/") {
|
||||
opts.Path = slug
|
||||
} else {
|
||||
|
||||
@@ -60,7 +60,6 @@ type CaptureContext struct {
|
||||
Classification string // caller-declared level token ("" = unspecified)
|
||||
Principal string // server-derived (auth); audit identity
|
||||
Origin Zone // server-derived trust zone; the I1 gate input
|
||||
AuthPath string // server-derived: "static" or "jwt"; stamped as note provenance (#145)
|
||||
}
|
||||
|
||||
// Insight is one piece of session knowledge bound for the brain. A
|
||||
|
||||
@@ -31,20 +31,18 @@ type StoredNote struct {
|
||||
Body string
|
||||
}
|
||||
|
||||
// Note is the brain-write payload: wing+hall are the only routing fields
|
||||
// (the legacy type/domain params were removed — ADR-0012 / #79). Reason is
|
||||
// Note is the brain-write payload. It carries both the wing/hall taxonomy
|
||||
// and the legacy type/domain fields so a single BrainStore serves both
|
||||
// capture insights and the existing MCP brain_write surface. Reason is
|
||||
// the supersede rationale, used only by Update.
|
||||
type Note struct {
|
||||
Content string
|
||||
Filename string
|
||||
Wing string
|
||||
Hall string
|
||||
Type string
|
||||
Domain string
|
||||
Reason string
|
||||
// Provenance (hyperguild#145) is stamped by the server from the
|
||||
// authenticated principal, never taken from Content's frontmatter.
|
||||
// Origin is "static", "jwt" or "unknown"; empty means "unknown".
|
||||
Origin string
|
||||
WrittenBy string
|
||||
}
|
||||
|
||||
// BrainStore is the brain persistence port — the shared implementation of
|
||||
|
||||
@@ -142,7 +142,7 @@ func (s *Service) Capture(ctx context.Context, in CaptureInput) (CaptureReceipt,
|
||||
var landed []string
|
||||
|
||||
for i, ins := range in.Insights {
|
||||
res, item, err := s.persistInsight(ctx, ins, in.Context)
|
||||
res, item, err := s.persistInsight(ctx, ins)
|
||||
receipt.Insights = append(receipt.Insights, res)
|
||||
if err != nil {
|
||||
receipt.Errors = append(receipt.Errors, ItemError{Item: fmt.Sprintf("insight[%d]", i), Error: err.Error()})
|
||||
@@ -278,11 +278,8 @@ func escalationReason(escalators []string) string {
|
||||
return "required by: " + strings.Join(escalators, ", ")
|
||||
}
|
||||
|
||||
func (s *Service) persistInsight(ctx context.Context, ins Insight, cc CaptureContext) (InsightResult, string, error) {
|
||||
note := Note{
|
||||
Content: ins.Text, Wing: ins.Wing, Hall: ins.Hall, Filename: brain.Sanitise(firstLine(ins.Text)),
|
||||
Origin: cc.AuthPath, WrittenBy: cc.Principal,
|
||||
}
|
||||
func (s *Service) persistInsight(ctx context.Context, ins Insight) (InsightResult, string, error) {
|
||||
note := Note{Content: ins.Text, Wing: ins.Wing, Hall: ins.Hall, Filename: brain.Sanitise(firstLine(ins.Text))}
|
||||
var ref Ref
|
||||
var err error
|
||||
if ins.SupersedeSlug != "" {
|
||||
|
||||
@@ -104,10 +104,6 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
// caller may have tried to put in the body.
|
||||
in.Context.Principal = principal
|
||||
in.Context.Origin = h.resolver.Resolve(principal, viaStatic)
|
||||
in.Context.AuthPath = "jwt"
|
||||
if viaStatic {
|
||||
in.Context.AuthPath = "static"
|
||||
}
|
||||
|
||||
rec, err := h.svc.Capture(r.Context(), in)
|
||||
switch {
|
||||
|
||||
@@ -1,51 +0,0 @@
|
||||
package capturehttp_test
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/audit"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainstore"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/capturehttp"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/classification"
|
||||
)
|
||||
|
||||
// The REST capture door derives AuthPath itself (hyperguild#145); a body
|
||||
// field cannot set it, and static vs JWT are told apart.
|
||||
func TestRESTCaptureStampsAuthPathFromAuthentication(t *testing.T) {
|
||||
for _, tc := range []struct {
|
||||
name, authz, wantOrigin, wantBy string
|
||||
v capturehttp.Validator
|
||||
sovereign []string
|
||||
}{
|
||||
{"static", "Bearer " + staticTok, "origin: static\n", "written_by: local-cli\n", nil, nil},
|
||||
{"jwt", "Bearer jwt", "origin: jwt\n", "written_by: koala-cli\n", fakeValidator{subject: "koala-cli"}, []string{"koala-cli"}},
|
||||
} {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
brainDir := t.TempDir()
|
||||
cfg, err := classification.Load(t.TempDir())
|
||||
require.NoError(t, err)
|
||||
svc := capture.NewService(brainstore.New(brainDir), fakeTracker{}, cfg, audit.NewSlogSink(nil))
|
||||
h := capturehttp.New(svc, tc.v, staticTok, "local-cli", capturehttp.NewOriginResolver(tc.sovereign))
|
||||
rr := do(t, h, tc.authz, map[string]any{
|
||||
"context": map[string]any{
|
||||
"harness": "claude-code", "actor": "mathias", "classification": "internal",
|
||||
"AuthPath": "static", "auth_path": "static", "principal": "local-cli",
|
||||
},
|
||||
"insights": []map[string]any{{"text": "rest provenance probe", "wing": "hyperguild", "hall": "facts"}},
|
||||
})
|
||||
require.Equal(t, 200, rr.Code, rr.Body.String())
|
||||
matches, _ := filepath.Glob(filepath.Join(brainDir, "wiki/hyperguild/facts/*.md"))
|
||||
require.Len(t, matches, 1)
|
||||
b, err := os.ReadFile(matches[0])
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, string(b), tc.wantOrigin)
|
||||
assert.Contains(t, string(b), tc.wantBy)
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -43,26 +43,6 @@ var DefaultRules = []Rule{
|
||||
// JSON, so both segments begin with "eyJ".
|
||||
{Name: "jwt", RE: regexp.MustCompile(`eyJ[A-Za-z0-9_\-]{8,}\.eyJ[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{8,}`)},
|
||||
{Name: "postgres-uri-with-password", RE: regexp.MustCompile(`postgres(?:ql)?://[^:\s/]+:[^@\s/]+@`)},
|
||||
// Any credential embedded in a URL's userinfo, which is what a git credential
|
||||
// store holds: `https://<user>:<token>@host`. The postgres rule above is the
|
||||
// same shape narrowed to one scheme, and is kept ahead of this one only so a
|
||||
// DSN reports the more specific name -- same ordering convention as
|
||||
// authorization-header before bearer-token.
|
||||
//
|
||||
// Added after this shape passed ALL rules and was therefore ingested rather
|
||||
// than dropped (hyperguild#142). It reached ~/.claude/projects -- this
|
||||
// watcher's own input -- because a test suite in mathias/infra executed a
|
||||
// script that configures git while inheriting the operator's real $HOME, read
|
||||
// koala's live credential store, and printed it. Two credentials were rotated
|
||||
// (infra#466). The scrubber is the control that decides whether that class of
|
||||
// mistake is survivable, and for this shape it was failing open.
|
||||
//
|
||||
// The {8,} floor on the secret half is what keeps `https://host:443/path` and
|
||||
// `https://user:@host` out; the `[^:\s/@]+` user half stops a host:port pair
|
||||
// being read as userinfo. Both directions are covered by
|
||||
// TestScrub_URLUserinfoCredential, because a rule that dropped every URL with
|
||||
// a colon in it would discard most of the signal this watcher exists to keep.
|
||||
{Name: "url-userinfo-credential", RE: regexp.MustCompile(`[a-zA-Z][a-zA-Z0-9+.\-]*://[^:\s/@]+:[^@\s/]{8,}@`)},
|
||||
{Name: "private-key", RE: regexp.MustCompile(`-----BEGIN[^-]*PRIVATE KEY-----`)},
|
||||
{Name: "ssh-key", RE: regexp.MustCompile(`ssh-(?:rsa|ed25519|ecdsa)\s+[A-Za-z0-9+/=]{40,}`)},
|
||||
{Name: "github-pat", RE: regexp.MustCompile(`\b(?:ghp|gho|ghu|ghr|gha)_[A-Za-z0-9]{30,}\b`)},
|
||||
|
||||
@@ -46,64 +46,6 @@ func TestScrub_PoisonedFixtures(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
// A credential embedded in a URL's userinfo is the shape a git credential store
|
||||
// holds -- `https://<user>:<token>@host` -- and it walked past every rule until
|
||||
// hyperguild#142. There was a rule for `postgres://user:pass@` and nothing for the
|
||||
// general form, so `~/.git-credentials` content was ingested rather than dropped.
|
||||
//
|
||||
// Found the hard way: a test suite in mathias/infra executed a script that
|
||||
// configures git while inheriting the operator's real $HOME, read koala's live
|
||||
// credential store, and printed two live credentials into a session transcript.
|
||||
// ~/.claude/projects is this watcher's own input, so the scrubber was the last
|
||||
// line of defence for that mistake and it failed open. Two credentials were
|
||||
// rotated (infra#466).
|
||||
//
|
||||
// The lesson is not "do not read the credential file" -- that mistake will recur.
|
||||
// It is that this shape must fail closed, because the scrubber is what decides
|
||||
// whether such a mistake is survivable.
|
||||
func TestScrub_URLUserinfoCredential(t *testing.T) {
|
||||
// Every secret below is INVENTED. None is or was a real credential.
|
||||
mustScrub := []struct {
|
||||
name string
|
||||
content string
|
||||
}{
|
||||
{"git-credential-store-user", "https://mathias:0123456789abcdef0123456789abcdef01234567@git.d-ma.be"},
|
||||
{"git-credential-store-oauth2", "https://oauth2:0123456789abcdef0123456789abcdef01234567@git.d-ma.be"},
|
||||
{"in-context-payload-line", `payload line: https://mathias:0123456789abcdef0123456789abcdef01234567@git.d-ma.be`},
|
||||
{"clone-url-in-argv", "git clone https://oauth2:abcdefghijklmnopqrstuvwx@git.d-ma.be/mathias/infra.git"},
|
||||
{"http-not-https", "http://admin:supersecretvalue123@10.0.1.20/api"},
|
||||
{"git-plus-ssh-scheme", "git+ssh://deploy:abcdefghijklmnop@example.com/repo"},
|
||||
{"redis-scheme", "redis://default:abcdefghijklmnopqrst@10.0.1.20:6379/0"},
|
||||
}
|
||||
for _, tc := range mustScrub {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
assert.NotEmpty(t, Scrub(tc.content),
|
||||
"a credential in URL userinfo must be dropped, not ingested")
|
||||
})
|
||||
}
|
||||
|
||||
// The other direction matters as much: a rule that scrubs every URL with a
|
||||
// colon in it would drop most of the signal this watcher exists to keep.
|
||||
mustNotScrub := []struct {
|
||||
name string
|
||||
content string
|
||||
}{
|
||||
{"host-with-port", "cloning https://git.d-ma.be:443/mathias/infra.git"},
|
||||
{"postgres-no-password", "postgres://localhost:5432/brain"},
|
||||
{"url-with-colon-in-query", "GET https://example.com/path?filter=a:b&x=1"},
|
||||
{"plain-url", "see https://git.d-ma.be/mathias/infra/issues/466"},
|
||||
{"userinfo-no-secret", "https://user:@example.com"},
|
||||
{"format-string-placeholder", `printf 'https://oauth2:%s@%s\n' "$TOKEN" "$HOST"`},
|
||||
{"scheme-relative-time", "duration https://example.com took 00:03:22"},
|
||||
}
|
||||
for _, tc := range mustNotScrub {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
assert.Empty(t, Scrub(tc.content),
|
||||
"this is not a credential and must pass through")
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestScrub_CleanContentPassesThrough(t *testing.T) {
|
||||
cases := []string{
|
||||
"",
|
||||
|
||||
@@ -1,130 +0,0 @@
|
||||
package extract
|
||||
|
||||
import (
|
||||
"go/ast"
|
||||
"go/parser"
|
||||
"go/token"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strconv"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
const extractPkg = "github.com/mathiasbq/hyperguild/ingestion/internal/extract"
|
||||
|
||||
// parseNonTest parses every non-test Go file under the module.
|
||||
func parseNonTest(t *testing.T) map[string]*ast.File {
|
||||
t.Helper()
|
||||
fset := token.NewFileSet()
|
||||
out := map[string]*ast.File{}
|
||||
err := filepath.WalkDir(filepath.Join("..", ".."), func(p string, d os.DirEntry, err error) error {
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if d.IsDir() && (d.Name() == "vendor" || d.Name() == ".git") {
|
||||
return filepath.SkipDir
|
||||
}
|
||||
if d.IsDir() || !strings.HasSuffix(p, ".go") || strings.HasSuffix(p, "_test.go") {
|
||||
return nil
|
||||
}
|
||||
f, perr := parser.ParseFile(fset, p, nil, 0)
|
||||
if perr != nil {
|
||||
return perr
|
||||
}
|
||||
out[filepath.ToSlash(p)] = f
|
||||
return nil
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// PR #156 review: reading a caller-chosen path by name reopens it after the
|
||||
// containment check (hyperguild#153 item 3). Outside this package, nothing
|
||||
// may reference extract.Text — called OR taken as a value — under whatever
|
||||
// name the package is imported (round 2: an alias and a func value slipped
|
||||
// past a plain text search).
|
||||
func TestNoPackageReferencesExtractTextOutsideExtract(t *testing.T) {
|
||||
for path, f := range parseNonTest(t) {
|
||||
if strings.Contains(path, "internal/extract/") {
|
||||
continue
|
||||
}
|
||||
names := map[string]bool{}
|
||||
for _, imp := range f.Imports {
|
||||
if p, _ := strconv.Unquote(imp.Path.Value); p == extractPkg {
|
||||
name := "extract"
|
||||
if imp.Name != nil {
|
||||
name = imp.Name.Name
|
||||
}
|
||||
if name == "." {
|
||||
t.Errorf("%s dot-imports extract; import it by name so its use stays checkable", path)
|
||||
}
|
||||
names[name] = true
|
||||
}
|
||||
}
|
||||
if len(names) == 0 {
|
||||
continue
|
||||
}
|
||||
ast.Inspect(f, func(n ast.Node) bool {
|
||||
if sel, ok := n.(*ast.SelectorExpr); ok {
|
||||
if id, ok := sel.X.(*ast.Ident); ok && names[id.Name] && sel.Sel.Name == "Text" {
|
||||
t.Errorf("%s references %s.Text; use extract.TextIn through an os.Root", path, id.Name)
|
||||
}
|
||||
}
|
||||
return true
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// PR #156 review round 2: the FIFO fix (open non-blocking, check the handle)
|
||||
// lives in OpenRegular, and reverting any caller to a plain Root.Open stayed
|
||||
// green. In the three raw/ reader FILES parsed below (and only those: a
|
||||
// wrapper in another file is not seen), no Open/OpenFile/ReadFile selector
|
||||
// may appear outside OpenRegular, called or taken as a method value. This is
|
||||
// a second layer; the behavioural race tests in internal/api and
|
||||
// internal/watcher are what catch a rewrite through any API (round 3).
|
||||
// osOpenAllowed names the functions in guarded files that may call os.Open*
|
||||
// on a path that is not a raw/ read.
|
||||
var osOpenAllowed = map[string]bool{
|
||||
"internal/watcher/watcher.go:appendWatcherLog": true, // ingest log append, not a raw/ read
|
||||
// Text reads by path; outside this package only TextIn's temp copy reaches
|
||||
// it (TestNoPackageReferencesExtractTextOutsideExtract enforces that).
|
||||
"internal/extract/extract.go:Text": true,
|
||||
}
|
||||
|
||||
func TestRawReaderFilesUseNoOpenOrReadFileOutsideOpenRegular(t *testing.T) {
|
||||
guarded := []string{"internal/api/rawroot.go", "internal/extract/extract.go", "internal/watcher/watcher.go"}
|
||||
files := parseNonTest(t)
|
||||
for _, g := range guarded {
|
||||
var f *ast.File
|
||||
for p, af := range files {
|
||||
if strings.HasSuffix(p, g) {
|
||||
f = af
|
||||
}
|
||||
}
|
||||
if f == nil {
|
||||
t.Fatalf("guarded file %s not found", g)
|
||||
}
|
||||
for _, decl := range f.Decls {
|
||||
fn, ok := decl.(*ast.FuncDecl)
|
||||
if !ok || fn.Name.Name == "OpenRegular" {
|
||||
continue
|
||||
}
|
||||
ast.Inspect(fn, func(n ast.Node) bool {
|
||||
sel, ok := n.(*ast.SelectorExpr)
|
||||
if !ok {
|
||||
return true
|
||||
}
|
||||
if sel.Sel.Name == "Open" || sel.Sel.Name == "OpenFile" || sel.Sel.Name == "ReadFile" {
|
||||
if id, ok := sel.X.(*ast.Ident); ok && id.Name == "os" && osOpenAllowed[g+":"+fn.Name.Name] {
|
||||
return true // a named non-raw write (the ingest log append)
|
||||
}
|
||||
t.Errorf("%s: %s calls .%s; raw/ reads must go through OpenRegular", g, fn.Name.Name, sel.Sel.Name)
|
||||
}
|
||||
return true
|
||||
})
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -3,10 +3,8 @@ package extract
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"strings"
|
||||
"syscall"
|
||||
)
|
||||
|
||||
// Text reads the file at path and returns its plain-text content.
|
||||
@@ -43,70 +41,3 @@ func fileExt(path string) string {
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
// TextIn is Text for a file read through an os.Root (hyperguild#153): the
|
||||
// read cannot leave the root, so a path checked earlier cannot be swapped
|
||||
// for a symlink pointing elsewhere before it is read. Formats that need an
|
||||
// external tool (pdf, docmark) are copied to a temp file from the handle
|
||||
// opened through the root, then extracted from the copy.
|
||||
func TextIn(r *os.Root, rel string) (string, error) {
|
||||
fi, err := r.Lstat(rel)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("stat %s: %w", rel, err)
|
||||
}
|
||||
if !fi.Mode().IsRegular() {
|
||||
return "", fmt.Errorf("%s: not a regular file", rel)
|
||||
}
|
||||
f, _, err := OpenRegular(r, rel)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("open %s: %w", rel, err)
|
||||
}
|
||||
defer func() { _ = f.Close() }()
|
||||
ext := strings.ToLower(fileExt(rel))
|
||||
switch ext {
|
||||
case ".md", ".txt":
|
||||
b, err := io.ReadAll(f)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("read %s: %w", rel, err)
|
||||
}
|
||||
return string(b), nil
|
||||
case ".pdf", ".docx", ".xlsx", ".pptx", ".png", ".jpg", ".jpeg":
|
||||
tmp, err := os.CreateTemp("", "ingest-*"+ext)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("temp copy: %w", err)
|
||||
}
|
||||
defer func() { _ = os.Remove(tmp.Name()) }()
|
||||
if _, err := io.Copy(tmp, f); err != nil {
|
||||
_ = tmp.Close()
|
||||
return "", fmt.Errorf("copy %s: %w", rel, err)
|
||||
}
|
||||
if err := tmp.Close(); err != nil {
|
||||
return "", fmt.Errorf("copy %s: %w", rel, err)
|
||||
}
|
||||
return Text(tmp.Name())
|
||||
default:
|
||||
return "", fmt.Errorf("unsupported file extension: %s", ext)
|
||||
}
|
||||
}
|
||||
|
||||
// OpenRegular opens rel inside r and returns it only if the OPENED handle is
|
||||
// a regular file. The open is non-blocking, so a FIFO swapped in after an
|
||||
// Lstat (PR #156 review: it hung open(2) forever) is refused promptly rather
|
||||
// than stalling the reader. Callers keep their Lstat check, which refuses
|
||||
// symlinks outright; this closes the race between that check and the open.
|
||||
func OpenRegular(r *os.Root, rel string) (*os.File, os.FileInfo, error) {
|
||||
f, err := r.OpenFile(rel, os.O_RDONLY|syscall.O_NONBLOCK, 0)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
fi, err := f.Stat()
|
||||
if err != nil {
|
||||
_ = f.Close()
|
||||
return nil, nil, err
|
||||
}
|
||||
if !fi.Mode().IsRegular() {
|
||||
_ = f.Close()
|
||||
return nil, nil, fmt.Errorf("%s: not a regular file", rel)
|
||||
}
|
||||
return f, fi, nil
|
||||
}
|
||||
|
||||
@@ -1,64 +0,0 @@
|
||||
package extract
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"syscall"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
// hyperguild#153 item 3: ingest checked a path, then extract.Text reopened it
|
||||
// by name, so a file swapped for a symlink in between was followed out of
|
||||
// raw/. TextIn reads through an os.Root, which refuses to leave the root.
|
||||
func TestTextInReadsInsideTheRootAndRefusesEscapes(t *testing.T) {
|
||||
root := t.TempDir()
|
||||
require.NoError(t, os.WriteFile(filepath.Join(root, "ok.md"), []byte("inside"), 0o644))
|
||||
outside := filepath.Join(t.TempDir(), "secret.md")
|
||||
require.NoError(t, os.WriteFile(outside, []byte("SENTINEL-153-TEXTIN"), 0o644))
|
||||
require.NoError(t, os.Symlink(outside, filepath.Join(root, "leak.md")))
|
||||
|
||||
r, err := os.OpenRoot(root)
|
||||
require.NoError(t, err)
|
||||
defer func() { _ = r.Close() }()
|
||||
|
||||
got, err := TextIn(r, "ok.md")
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "inside", got)
|
||||
|
||||
got, err = TextIn(r, "leak.md")
|
||||
assert.Error(t, err)
|
||||
assert.NotContains(t, got, "SENTINEL-153-TEXTIN")
|
||||
|
||||
_, err = TextIn(r, "../"+filepath.Base(outside))
|
||||
assert.Error(t, err)
|
||||
}
|
||||
|
||||
// PR #156 review: a regular file swapped for a FIFO between Lstat and Open
|
||||
// blocked open(2) forever. OpenRegular opens non-blocking and checks the type
|
||||
// on the opened handle, so a FIFO is refused promptly instead of hanging.
|
||||
func TestOpenRegularRefusesAFIFOWithoutBlocking(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
require.NoError(t, syscall.Mkfifo(filepath.Join(dir, "pipe.md"), 0o644))
|
||||
r, err := os.OpenRoot(dir)
|
||||
require.NoError(t, err)
|
||||
defer func() { _ = r.Close() }()
|
||||
|
||||
done := make(chan error, 1)
|
||||
go func() {
|
||||
f, _, err := OpenRegular(r, "pipe.md")
|
||||
if f != nil {
|
||||
_ = f.Close()
|
||||
}
|
||||
done <- err
|
||||
}()
|
||||
select {
|
||||
case err := <-done:
|
||||
assert.Error(t, err)
|
||||
case <-time.After(2 * time.Second):
|
||||
t.Fatal("OpenRegular blocked on a FIFO")
|
||||
}
|
||||
}
|
||||
@@ -66,7 +66,7 @@ func Fix(doc []byte) ([]byte, bool, error) {
|
||||
return doc, false, fmt.Errorf("frontmatter: quoting did not repair the block: %w", err)
|
||||
}
|
||||
|
||||
_, rest, _ := Split(doc)
|
||||
_, rest, _ := split(doc)
|
||||
out := []byte(fence + "\n")
|
||||
out = append(out, fixed...)
|
||||
out = append(out, []byte(fence)...)
|
||||
@@ -122,25 +122,14 @@ func needsQuoting(value string) bool {
|
||||
|
||||
// block returns the raw YAML between the opening and closing fences.
|
||||
func block(doc []byte) ([]byte, bool) {
|
||||
b, _, ok := Split(doc)
|
||||
b, _, ok := split(doc)
|
||||
return b, ok
|
||||
}
|
||||
|
||||
// Split returns doc's frontmatter block and everything from the closing
|
||||
// fence onward (the closing fence itself excluded, its trailing newline
|
||||
// included), or ok=false if doc has no properly-fenced frontmatter.
|
||||
//
|
||||
// The canonical fence detector for this codebase (hyperguild#138): three
|
||||
// independent reimplementations of this same logic each grew their own gap
|
||||
// through separate bug-fixing before being consolidated here —
|
||||
// internal/mcp's needed a CRLF/BOM guard added after both silently defeated
|
||||
// its own HasPrefix check, and internal/api's closing-fence match had no
|
||||
// trailing-newline requirement, so a document ending in "\n---extra" with no
|
||||
// real newline after the fence was treated as validly closed. Both classes
|
||||
// are closed here, once, for every caller.
|
||||
func Split(doc []byte) (block, rest []byte, ok bool) {
|
||||
s := strings.TrimPrefix(string(doc), "\xef\xbb\xbf")
|
||||
s = strings.ReplaceAll(s, "\r\n", "\n")
|
||||
// split returns the frontmatter block and everything from the closing fence
|
||||
// onward (the closing fence itself excluded, its trailing newline included).
|
||||
func split(doc []byte) (block, rest []byte, ok bool) {
|
||||
s := string(doc)
|
||||
if !strings.HasPrefix(s, fence+"\n") {
|
||||
return nil, nil, false
|
||||
}
|
||||
@@ -150,18 +139,5 @@ func Split(doc []byte) (block, rest []byte, ok bool) {
|
||||
if idx < 0 {
|
||||
return nil, nil, false
|
||||
}
|
||||
// What follows the closing fence must be either a newline (a real body
|
||||
// follows) or nothing at all (the fence is the literal end of the
|
||||
// document — no body, not a bypass attempt). Anything else, e.g.
|
||||
// "\n---extra", is not a valid close: an earlier version of this check
|
||||
// accepted it, which is exactly the looser match hyperguild#138 closes.
|
||||
after := idx + 1 + len(fence)
|
||||
switch {
|
||||
case after == len(body):
|
||||
return []byte(body[:idx+1]), nil, true
|
||||
case body[after] == '\n':
|
||||
return []byte(body[:idx+1]), []byte(body[after:]), true
|
||||
default:
|
||||
return nil, nil, false
|
||||
}
|
||||
return []byte(body[:idx+1]), []byte(body[idx+1+len(fence):]), true
|
||||
}
|
||||
|
||||
@@ -168,9 +168,9 @@ func TestFix_PreservesBodyExactly(t *testing.T) {
|
||||
require.True(t, changed)
|
||||
assert.True(t, len(got) > 0)
|
||||
|
||||
_, rest, ok := Split([]byte(doc))
|
||||
_, rest, ok := split([]byte(doc))
|
||||
require.True(t, ok)
|
||||
_, gotRest, ok := Split(got)
|
||||
_, gotRest, ok := split(got)
|
||||
require.True(t, ok)
|
||||
assert.Equal(t, string(rest), string(gotRest), "the body must not be touched")
|
||||
}
|
||||
@@ -186,55 +186,3 @@ func TestFix_RefusesToReturnAnUnparseableResult(t *testing.T) {
|
||||
assert.False(t, changed)
|
||||
assert.Equal(t, doc, string(got), "an unfixable document must come back byte-identical")
|
||||
}
|
||||
|
||||
// TestSplit_NormalizesCRLFBeforeFenceDetection is hyperguild#138: a note
|
||||
// whose fence lines use CRLF ("---\r\n") failed strings.HasPrefix(doc,
|
||||
// "---\n") on the precondition read in internal/mcp's independent
|
||||
// reimplementation -- encoding alone, no adversarial input, silently
|
||||
// defeated fence detection there before this consolidation. Split must
|
||||
// never repeat that.
|
||||
func TestSplit_NormalizesCRLFBeforeFenceDetection(t *testing.T) {
|
||||
doc := "---\r\ntitle: 'n'\r\nhalf_life: durable\r\n---\r\n\r\nbody\r\n"
|
||||
block, rest, ok := Split([]byte(doc))
|
||||
require.True(t, ok)
|
||||
assert.Contains(t, string(block), "half_life: durable")
|
||||
assert.Contains(t, string(rest), "body")
|
||||
}
|
||||
|
||||
// TestSplit_StripsALeadingUTF8BOM is the same mechanism one layer earlier:
|
||||
// a leading BOM (Notepad's default "UTF-8" save, PowerShell's pre-v6
|
||||
// Out-File/Set-Content) defeats the same HasPrefix check before CRLF
|
||||
// normalization even applies.
|
||||
func TestSplit_StripsALeadingUTF8BOM(t *testing.T) {
|
||||
doc := "\xef\xbb\xbf---\ntitle: 'n'\n---\n\nbody\n"
|
||||
block, rest, ok := Split([]byte(doc))
|
||||
require.True(t, ok)
|
||||
assert.Contains(t, string(block), "title: 'n'")
|
||||
assert.Contains(t, string(rest), "body")
|
||||
}
|
||||
|
||||
// TestSplit_RequiresANewlineAfterTheClosingFence closes the looser match
|
||||
// internal/api's independent reimplementation carried (strings.Index(body,
|
||||
// "\n"+fence) with no trailing-newline requirement): a document ending in
|
||||
// "\n---extra" with no newline separating the fence from what follows it is
|
||||
// not a valid closing fence and must not be treated as one.
|
||||
func TestSplit_RequiresANewlineAfterTheClosingFence(t *testing.T) {
|
||||
doc := "---\ntitle: 'n'\n---extra-not-a-real-close"
|
||||
_, _, ok := Split([]byte(doc))
|
||||
assert.False(t, ok, "a fence line not followed by a newline is not a valid closing fence")
|
||||
}
|
||||
|
||||
// TestSplit_AcceptsAClosingFenceThatIsTheLastBytesOfTheDocument is a
|
||||
// regression pin found in review of hyperguild#138: the fix for the
|
||||
// "\n---extra" bypass above must not also reject the legitimate case of a
|
||||
// closing fence with nothing after it at all (no trailing newline because
|
||||
// there's no body, not because a bypass is being attempted) -- this
|
||||
// package's own private split() accepted that shape before the
|
||||
// consolidation, and cmd/frontmatterlint's Lint/Fix relied on it.
|
||||
func TestSplit_AcceptsAClosingFenceThatIsTheLastBytesOfTheDocument(t *testing.T) {
|
||||
doc := "---\ntitle: 'n'\n---"
|
||||
block, rest, ok := Split([]byte(doc))
|
||||
require.True(t, ok, "a closing fence at literal end-of-file, with nothing after it, is valid -- there is no body to require a newline before")
|
||||
assert.Contains(t, string(block), "title: 'n'")
|
||||
assert.Equal(t, "", string(rest))
|
||||
}
|
||||
|
||||
@@ -12,14 +12,10 @@ package graphsync
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io/fs"
|
||||
"path"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/graph"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/graphstore"
|
||||
)
|
||||
@@ -50,25 +46,8 @@ func IndexDoc(ctx context.Context, store Store, brainDir, relPath string) error
|
||||
if relPath == "" {
|
||||
return nil
|
||||
}
|
||||
// Callers pass caller-supplied paths (brain_tunnel, brain_update): index
|
||||
// only a clean path under wiki/ or knowledge/.
|
||||
if path.Clean(relPath) != relPath || !filepath.IsLocal(relPath) ||
|
||||
(!strings.HasPrefix(relPath, "wiki/") && !strings.HasPrefix(relPath, "knowledge/")) {
|
||||
return fmt.Errorf("index %q: not a clean wiki/ or knowledge/ path", relPath)
|
||||
}
|
||||
bfs, err := brainfs.Open(brainDir)
|
||||
if err != nil {
|
||||
return fmt.Errorf("open brain: %w", err)
|
||||
}
|
||||
defer func() { _ = bfs.Close() }()
|
||||
return indexDoc(ctx, store, bfs, relPath)
|
||||
}
|
||||
|
||||
// indexDoc reads relPath through the brain root, regular files only
|
||||
// (hyperguild#157): the brain is a Syncthing folder, and os.ReadFile
|
||||
// followed a synced symlink into the graph and blocked on a FIFO.
|
||||
func indexDoc(ctx context.Context, store Store, bfs *brainfs.Brain, relPath string) error {
|
||||
content, err := bfs.ReadRegular(relPath)
|
||||
abs := filepath.Join(brainDir, filepath.FromSlash(relPath))
|
||||
content, err := os.ReadFile(abs)
|
||||
if err != nil {
|
||||
return fmt.Errorf("read %q: %w", relPath, err)
|
||||
}
|
||||
@@ -98,34 +77,33 @@ func BackfillFromBrainDir(ctx context.Context, store Store, brainDir string) (in
|
||||
if store == nil {
|
||||
return 0, nil
|
||||
}
|
||||
bfs, err := brainfs.Open(brainDir)
|
||||
if err != nil {
|
||||
return 0, fmt.Errorf("open brain: %w", err)
|
||||
}
|
||||
defer func() { _ = bfs.Close() }()
|
||||
for _, root := range []string{"wiki", "knowledge"} {
|
||||
if _, err := bfs.Lstat(root); errors.Is(err, fs.ErrNotExist) {
|
||||
roots := []string{"wiki", "knowledge"}
|
||||
for _, root := range roots {
|
||||
base := filepath.Join(brainDir, root)
|
||||
if _, err := os.Stat(base); os.IsNotExist(err) {
|
||||
continue
|
||||
}
|
||||
// Any walk error, including a root that is a symlink, aborts.
|
||||
var walkErr error
|
||||
err := bfs.WalkRegular(root, func(rel string) error {
|
||||
if path.Ext(rel) != ".md" {
|
||||
err := filepath.WalkDir(base, func(path string, d os.DirEntry, walkErr error) error {
|
||||
if walkErr != nil {
|
||||
return walkErr
|
||||
}
|
||||
if d.IsDir() {
|
||||
return nil
|
||||
}
|
||||
if err := indexDoc(ctx, store, bfs, rel); err != nil {
|
||||
if filepath.Ext(path) != ".md" {
|
||||
return nil
|
||||
}
|
||||
rel, relErr := filepath.Rel(brainDir, path)
|
||||
if relErr != nil {
|
||||
return fmt.Errorf("rel %q: %w", path, relErr)
|
||||
}
|
||||
rel = filepath.ToSlash(rel)
|
||||
if err := IndexDoc(ctx, store, brainDir, rel); err != nil {
|
||||
return fmt.Errorf("index %q: %w", rel, err)
|
||||
}
|
||||
indexed++
|
||||
return nil
|
||||
}, func(rel string, err error) {
|
||||
if walkErr == nil {
|
||||
walkErr = fmt.Errorf("%s: %w", rel, err)
|
||||
}
|
||||
})
|
||||
if err == nil {
|
||||
err = walkErr
|
||||
}
|
||||
if err != nil {
|
||||
return indexed, fmt.Errorf("walk %s: %w", root, err)
|
||||
}
|
||||
|
||||
@@ -1,92 +0,0 @@
|
||||
package graphsync
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs/brainfstest"
|
||||
)
|
||||
|
||||
func (f *fakeStore) dump() string {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
return fmt.Sprintf("%+v %+v", f.upserts, f.replaces)
|
||||
}
|
||||
|
||||
// hyperguild#157 slice 4: IndexDoc and BackfillFromBrainDir read notes with
|
||||
// os.ReadFile, so a symlinked note put the target's title and wikilinks into
|
||||
// the graph, and a FIFO hung the read.
|
||||
func TestIndexDocRefusesSymlinksAndSurvivesSwapRaces(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
facts := filepath.Join(brain, "wiki", "w", "facts")
|
||||
require.NoError(t, os.MkdirAll(facts, 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(facts, "ok.md"), []byte("---\ntitle: zqinside\n---\nbody [[other]]\n"), 0o644))
|
||||
require.NoError(t, os.Symlink(brainfstest.Outside(t), filepath.Join(facts, "leak.md")))
|
||||
|
||||
store := newFakeStore()
|
||||
require.NoError(t, IndexDoc(context.Background(), store, brain, "wiki/w/facts/ok.md"))
|
||||
assert.Contains(t, store.dump(), "zqinside", "positive control: a regular note is indexed")
|
||||
assert.Error(t, IndexDoc(context.Background(), store, brain, "wiki/w/facts/leak.md"))
|
||||
// A link to a file elsewhere in the brain: os.Root allows it, only the
|
||||
// regular-file check refuses it.
|
||||
inBrain := brainfstest.WriteSentinelAt(t, filepath.Join(brain, "raw", "s.md"))
|
||||
require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "s.md"), filepath.Join(facts, "inlink.md")))
|
||||
assert.Error(t, IndexDoc(context.Background(), store, brain, "wiki/w/facts/inlink.md"))
|
||||
assert.NotContains(t, store.dump(), brainfstest.Sentinel)
|
||||
|
||||
p := filepath.Join(facts, "r.md")
|
||||
read := func() string {
|
||||
s := newFakeStore()
|
||||
_ = IndexDoc(context.Background(), s, brain, "wiki/w/facts/r.md")
|
||||
return s.dump()
|
||||
}
|
||||
brainfstest.AssertNoLeak(t, p, "---\ntitle: zqinside\n---\n", 1500*time.Millisecond, read)
|
||||
brainfstest.AssertNoLeakFrom(t, p, "---\ntitle: zqinside\n---\n", inBrain, 1500*time.Millisecond, read)
|
||||
brainfstest.AssertNoHang(t, p, "---\ntitle: zqinside\n---\n", 1500*time.Millisecond, 6*time.Second, func() { _ = read() })
|
||||
}
|
||||
|
||||
func TestBackfillSkipsSymlinkedNotesAndAbortsOnASymlinkedRoot(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
facts := filepath.Join(brain, "wiki", "w", "facts")
|
||||
require.NoError(t, os.MkdirAll(facts, 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(facts, "ok.md"), []byte("---\ntitle: zqinside\n---\n"), 0o644))
|
||||
require.NoError(t, os.Symlink(brainfstest.Outside(t), filepath.Join(facts, "leak.md")))
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(brain, "raw"), 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(brain, "raw", "r.md"), []byte("---\ntitle: zqrawonly\n---\n"), 0o644))
|
||||
require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "r.md"), filepath.Join(facts, "inlink.md")))
|
||||
require.NoError(t, os.Symlink(".", filepath.Join(brain, "knowledge")))
|
||||
|
||||
store := newFakeStore()
|
||||
_, err := BackfillFromBrainDir(context.Background(), store, brain)
|
||||
assert.Error(t, err, "a symlinked root aborts the backfill")
|
||||
assert.NotContains(t, store.dump(), brainfstest.Sentinel)
|
||||
assert.NotContains(t, store.dump(), "zqrawonly")
|
||||
|
||||
require.NoError(t, os.Remove(filepath.Join(brain, "knowledge")))
|
||||
store = newFakeStore()
|
||||
n, err := BackfillFromBrainDir(context.Background(), store, brain)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, 1, n, "only the regular note is indexed")
|
||||
assert.Contains(t, store.dump(), "zqinside")
|
||||
assert.NotContains(t, store.dump(), brainfstest.Sentinel)
|
||||
}
|
||||
|
||||
// IndexDoc gets caller-supplied paths (brain_tunnel, brain_update): only a
|
||||
// clean path under wiki/ or knowledge/ is indexed.
|
||||
func TestIndexDocRefusesPathsOutsideWikiAndKnowledgeAndUncleanPaths(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
brainfstest.WriteSentinelAt(t, filepath.Join(brain, "raw", "secret.md"))
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(brain, "wiki", "w"), 0o755))
|
||||
for _, p := range []string{"raw/secret.md", "wiki/w/../../raw/secret.md", "./raw/secret.md", "/raw/secret.md"} {
|
||||
store := newFakeStore()
|
||||
assert.Error(t, IndexDoc(context.Background(), store, brain, p), p)
|
||||
assert.NotContains(t, store.dump(), brainfstest.Sentinel, p)
|
||||
}
|
||||
}
|
||||
@@ -1,48 +0,0 @@
|
||||
package mcp
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"log/slog"
|
||||
"time"
|
||||
)
|
||||
|
||||
// logToolCall emits one structured record per tools/call (hyperguild#144,
|
||||
// OWASP MCP08): who called which tool, against which wing/hall, and how it
|
||||
// ended. Brain content is never copied into the record — only its size — so
|
||||
// the audit trail does not become a second, unscrubbed copy of the brain.
|
||||
func logToolCall(ctx context.Context, name string, args json.RawMessage, start time.Time, err error) {
|
||||
origin, principal := provenanceFrom(ctx)
|
||||
attrs := []any{
|
||||
"tool", name,
|
||||
"principal", principal,
|
||||
"origin", origin,
|
||||
"duration_ms", time.Since(start).Milliseconds(),
|
||||
}
|
||||
var a struct {
|
||||
Wing string `json:"wing"`
|
||||
Hall string `json:"hall"`
|
||||
Content string `json:"content"`
|
||||
}
|
||||
if json.Unmarshal(args, &a) == nil {
|
||||
if a.Wing != "" {
|
||||
attrs = append(attrs, "wing", a.Wing)
|
||||
}
|
||||
if a.Hall != "" {
|
||||
attrs = append(attrs, "hall", a.Hall)
|
||||
}
|
||||
if a.Content != "" {
|
||||
attrs = append(attrs, "content_bytes", len(a.Content))
|
||||
}
|
||||
}
|
||||
// The outcome is a class, never the error text: handler errors echo
|
||||
// argument values (a rejected half_life, a requested path), which would
|
||||
// make the audit line a copy of what the caller sent (PR #147 review E6).
|
||||
// The caller already received the full error in the tool response.
|
||||
outcome := "ok"
|
||||
if err != nil {
|
||||
outcome = "error"
|
||||
}
|
||||
attrs = append(attrs, "outcome", outcome)
|
||||
slog.InfoContext(ctx, "mcp tool call", attrs...)
|
||||
}
|
||||
@@ -1,83 +0,0 @@
|
||||
package mcp_test
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"log/slog"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
// captureToolCallLog routes slog to a buffer for fn and returns the decoded
|
||||
// "mcp tool call" records.
|
||||
func captureToolCallLog(t *testing.T, fn func()) []map[string]any {
|
||||
t.Helper()
|
||||
var buf bytes.Buffer
|
||||
prev := slog.Default()
|
||||
slog.SetDefault(slog.New(slog.NewJSONHandler(&buf, nil)))
|
||||
t.Cleanup(func() { slog.SetDefault(prev) })
|
||||
fn()
|
||||
var out []map[string]any
|
||||
for _, l := range strings.Split(strings.TrimSpace(buf.String()), "\n") {
|
||||
var rec map[string]any
|
||||
if json.Unmarshal([]byte(l), &rec) == nil && rec["msg"] == "mcp tool call" {
|
||||
out = append(out, rec)
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// hyperguild#144: brain_query/brain_read left no record of who read what.
|
||||
func TestToolsCallLogsOneRecordWithToolPrincipalOriginAndScope(t *testing.T) {
|
||||
srv, _, _, _ := govServer(t)
|
||||
recs := captureToolCallLog(t, func() {
|
||||
authCall(t, srv, "Bearer "+capStaticTok, "brain_query",
|
||||
map[string]any{"query": "anything", "wing": "homelab", "hall": "facts"})
|
||||
})
|
||||
require.Len(t, recs, 1)
|
||||
r := recs[0]
|
||||
assert.Equal(t, "brain_query", r["tool"])
|
||||
assert.Equal(t, "local-cli", r["principal"])
|
||||
assert.Equal(t, "static", r["origin"])
|
||||
assert.Equal(t, "homelab", r["wing"])
|
||||
assert.Equal(t, "facts", r["hall"])
|
||||
assert.Equal(t, "ok", r["outcome"])
|
||||
assert.Contains(t, r, "duration_ms")
|
||||
}
|
||||
|
||||
func TestToolsCallWithoutDerivablePrincipalLogsOriginUnknown(t *testing.T) {
|
||||
srv, _, _, _ := govServer(t)
|
||||
recs := captureToolCallLog(t, func() {
|
||||
authCall(t, srv, "", "brain_query", map[string]any{"query": "x"})
|
||||
})
|
||||
require.Len(t, recs, 1)
|
||||
assert.Equal(t, "unknown", recs[0]["origin"])
|
||||
assert.Equal(t, "", recs[0]["principal"])
|
||||
}
|
||||
|
||||
func TestToolsCallLogsErrorOutcome(t *testing.T) {
|
||||
srv, _, _, _ := govServer(t)
|
||||
recs := captureToolCallLog(t, func() {
|
||||
authCall(t, srv, "Bearer "+capStaticTok, "brain_query", map[string]any{})
|
||||
})
|
||||
require.Len(t, recs, 1)
|
||||
assert.Equal(t, "error", recs[0]["outcome"])
|
||||
}
|
||||
|
||||
// The audit line must not become a second copy of brain content.
|
||||
func TestToolsCallLogOmitsContentButRecordsItsSize(t *testing.T) {
|
||||
const sentinel = "SENTINEL-BRAIN-CONTENT-91c2"
|
||||
srv, _, _, _ := govServer(t)
|
||||
recs := captureToolCallLog(t, func() {
|
||||
authCall(t, srv, "Bearer "+capStaticTok, "brain_write", map[string]any{
|
||||
"content": "# t\n\n" + sentinel, "wing": "testing", "hall": "facts", "filename": "audit-sentinel",
|
||||
})
|
||||
})
|
||||
require.Len(t, recs, 1)
|
||||
raw, _ := json.Marshal(recs[0])
|
||||
assert.NotContains(t, string(raw), sentinel)
|
||||
assert.EqualValues(t, len("# t\n\n"+sentinel), recs[0]["content_bytes"])
|
||||
}
|
||||
@@ -12,10 +12,10 @@ import (
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/api"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/extract"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/graphsync"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/notes"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/provenance"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/search"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/session"
|
||||
)
|
||||
@@ -53,12 +53,14 @@ func (s *Server) tools() []map[string]any {
|
||||
},
|
||||
{
|
||||
"name": "brain_write",
|
||||
"description": "Write a markdown note to brain/wiki/<wing>/<hall>/ with wing/hall/created_at frontmatter. Both wing and hall are required.",
|
||||
"inputSchema": schema([]string{"content", "wing", "hall"}, map[string]any{
|
||||
"description": "Write a markdown note to the brain. With wing+hall set, routes to brain/wiki/<wing>/<hall>/ with wing/hall/created_at frontmatter; otherwise writes to brain/knowledge/ (legacy).",
|
||||
"inputSchema": schema([]string{"content"}, map[string]any{
|
||||
"content": str("markdown content"),
|
||||
"filename": str("optional filename or slug"),
|
||||
"wing": str("topic domain, e.g. jepa-fx"),
|
||||
"hall": enum("memory type", halls...),
|
||||
"type": str("optional frontmatter type (legacy)"),
|
||||
"domain": str("optional frontmatter domain (legacy)"),
|
||||
"wing": str("optional topic domain, e.g. jepa-fx"),
|
||||
"hall": enum("optional memory type (requires wing)", halls...),
|
||||
}),
|
||||
},
|
||||
{
|
||||
@@ -96,14 +98,6 @@ func (s *Server) tools() []map[string]any {
|
||||
"slug": str("optional target slug; defaults to filename minus date prefix"),
|
||||
}),
|
||||
},
|
||||
{
|
||||
"name": "brain_reject",
|
||||
"description": "Reject a brain/raw/ note: stamps rejected_at (+ reject_reason if given) into frontmatter and moves it to brain/raw/rejected/ — never deleted outright, and never re-surfaced by brain_pending. The third option alongside promote/leave-pending; a human decision, never automatic. Returns {path}.",
|
||||
"inputSchema": schema([]string{"filename"}, map[string]any{
|
||||
"filename": str("basename in brain/raw/, e.g. 2026-04-23-fed-sentiment-scrape.md"),
|
||||
"reason": str("optional; why this isn't worth promoting"),
|
||||
}),
|
||||
},
|
||||
noteToolDescriptors()[0],
|
||||
noteToolDescriptors()[1],
|
||||
{
|
||||
@@ -233,6 +227,8 @@ func (s *Server) brainQuery(ctx context.Context, args json.RawMessage) (json.Raw
|
||||
type brainWriteArgs struct {
|
||||
Content string `json:"content"`
|
||||
Filename string `json:"filename,omitempty"`
|
||||
Type string `json:"type,omitempty"`
|
||||
Domain string `json:"domain,omitempty"`
|
||||
Wing string `json:"wing,omitempty"`
|
||||
Hall string `json:"hall,omitempty"`
|
||||
}
|
||||
@@ -255,14 +251,13 @@ func (s *Server) brainWrite(ctx context.Context, args json.RawMessage) (json.Raw
|
||||
// one implementation (capture uses the same store). The read-after-write
|
||||
// handle {id, path, content_hash} comes back from the store; path is kept
|
||||
// for backward compatibility.
|
||||
origin, writtenBy := provenanceFrom(ctx)
|
||||
ref, err := s.store.Write(ctx, capture.Note{
|
||||
Content: a.Content,
|
||||
Filename: a.Filename,
|
||||
Type: a.Type,
|
||||
Domain: a.Domain,
|
||||
Wing: a.Wing,
|
||||
Hall: a.Hall,
|
||||
Origin: origin,
|
||||
WrittenBy: writtenBy,
|
||||
})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
@@ -307,14 +302,11 @@ func (s *Server) brainUpdate(ctx context.Context, args json.RawMessage) (json.Ra
|
||||
if a.Path != "" {
|
||||
slug = a.Path
|
||||
}
|
||||
origin, writtenBy := provenanceFrom(ctx)
|
||||
ref, err := s.store.Update(ctx, slug, capture.Note{
|
||||
Content: a.Content,
|
||||
Wing: a.Wing,
|
||||
Hall: a.Hall,
|
||||
Reason: a.Reason,
|
||||
Origin: origin,
|
||||
WrittenBy: writtenBy,
|
||||
})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
@@ -393,10 +385,8 @@ func (s *Server) brainPromote(ctx context.Context, args json.RawMessage) (json.R
|
||||
if err := json.Unmarshal(args, &a); err != nil {
|
||||
return nil, fmt.Errorf("parse args: %w", err)
|
||||
}
|
||||
origin, writtenBy := provenanceFrom(ctx)
|
||||
relPath, err := api.PromoteNote(s.brainDir, api.PromoteOptions{
|
||||
Filename: a.Filename, Wing: a.Wing, Hall: a.Hall, Slug: a.Slug,
|
||||
Origin: origin, WrittenBy: writtenBy,
|
||||
})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
@@ -405,26 +395,6 @@ func (s *Server) brainPromote(ctx context.Context, args json.RawMessage) (json.R
|
||||
return json.Marshal(map[string]string{"path": relPath})
|
||||
}
|
||||
|
||||
type brainRejectArgs struct {
|
||||
Filename string `json:"filename"`
|
||||
Reason string `json:"reason,omitempty"`
|
||||
}
|
||||
|
||||
// brainReject records a decision not to promote a raw/ note (api.RejectNote:
|
||||
// frontmatter-stamp + move to raw/rejected/). No graph indexing — a rejected
|
||||
// note never entered the wiki, so there's nothing to index.
|
||||
func (s *Server) brainReject(_ context.Context, args json.RawMessage) (json.RawMessage, error) {
|
||||
var a brainRejectArgs
|
||||
if err := json.Unmarshal(args, &a); err != nil {
|
||||
return nil, fmt.Errorf("parse args: %w", err)
|
||||
}
|
||||
relPath, err := api.RejectNote(s.brainDir, api.RejectOptions{Filename: a.Filename, Reason: a.Reason})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return json.Marshal(map[string]string{"path": relPath})
|
||||
}
|
||||
|
||||
// indexInGraph is a best-effort wrapper around graphsync.IndexDoc that
|
||||
// logs failures but never propagates them — the underlying write/ingest
|
||||
// has already succeeded and the graph is an augmentation, not a
|
||||
@@ -499,7 +469,7 @@ func (s *Server) brainIngestRaw(ctx context.Context, args json.RawMessage) (json
|
||||
if len(a.Pages) == 0 {
|
||||
return nil, fmt.Errorf("pages must be non-empty")
|
||||
}
|
||||
result, err := pipeline.RunRaw(withCallerStamp(ctx), s.brainDir, a.Source, a.Pages, a.DryRun)
|
||||
result, err := pipeline.RunRaw(s.brainDir, a.Source, a.Pages, a.DryRun)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("ingest: %w", err)
|
||||
}
|
||||
@@ -542,13 +512,7 @@ func (s *Server) brainIngest(ctx context.Context, args json.RawMessage) (json.Ra
|
||||
}
|
||||
|
||||
if a.Path != "" {
|
||||
// Confined to brain/raw/ with symlinks evaluated (hyperguild#149).
|
||||
resolved, err := api.ResolveIngestPath(s.brainDir, a.Path)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
a.Path = resolved
|
||||
text, err := api.ReadIngestFile(s.brainDir, a.Path)
|
||||
text, err := extract.Text(a.Path)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("extract: %w", err)
|
||||
}
|
||||
@@ -604,7 +568,7 @@ func (s *Server) sessionLog(ctx context.Context, args json.RawMessage) (json.Raw
|
||||
}
|
||||
|
||||
func (s *Server) runIngest(ctx context.Context, content, source string, dryRun bool) (json.RawMessage, error) {
|
||||
result, err := pipeline.Run(withCallerStamp(ctx), s.pipeline, s.brainDir, content, source, dryRun)
|
||||
result, err := pipeline.Run(ctx, s.pipeline, s.brainDir, content, source, dryRun)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("ingest: %w", err)
|
||||
}
|
||||
@@ -623,10 +587,3 @@ func (s *Server) runIngest(ctx context.Context, content, source string, dryRun b
|
||||
}
|
||||
return json.Marshal(map[string]any{"pages": pages, "warnings": warnings})
|
||||
}
|
||||
|
||||
// withCallerStamp attaches the caller's provenance for the ingest pipeline,
|
||||
// which stamps every page it writes or merges into (hyperguild#145).
|
||||
func withCallerStamp(ctx context.Context) context.Context {
|
||||
origin, writtenBy := provenanceFrom(ctx)
|
||||
return provenance.WithStamp(ctx, provenance.Stamp{Origin: origin, WrittenBy: writtenBy})
|
||||
}
|
||||
|
||||
@@ -51,50 +51,25 @@ func TestBrainQueryReturnsResults(t *testing.T) {
|
||||
assert.Contains(t, text, "tdd.md")
|
||||
}
|
||||
|
||||
// TestBrainWriteIgnoresLegacyTypeAndDomainParams pins the post-#79 contract:
|
||||
// domain/type were removed from the schema and the handler's arg struct, so
|
||||
// a caller that still sends them (the old MCP surface) gets a normal wing+
|
||||
// hall write with no error and no effect from the stale fields — silently
|
||||
// dropped by json.Unmarshal, not rejected. Only content in its OWN
|
||||
// frontmatter (unrelated to these params) can set type/domain, per
|
||||
// TestWriteNote_HallRouteMergesExistingFrontmatterInsteadOfStacking in the
|
||||
// api package.
|
||||
func TestBrainWriteIgnoresLegacyTypeAndDomainParams(t *testing.T) {
|
||||
func TestBrainWriteCreatesFile(t *testing.T) {
|
||||
brainDir := t.TempDir()
|
||||
srv := mcp.NewServer(brainDir, nil, nil, nil)
|
||||
|
||||
resp := toolCall(t, srv, "brain_write", map[string]any{
|
||||
"content": "# Test\n\nbody",
|
||||
"filename": "test",
|
||||
"wing": "homelab",
|
||||
"hall": "facts",
|
||||
"filename": "test.md",
|
||||
"type": "note",
|
||||
"domain": "personal",
|
||||
})
|
||||
require.Nil(t, resp["error"])
|
||||
|
||||
got, err := os.ReadFile(filepath.Join(brainDir, "wiki", "homelab", "facts", "test.md"))
|
||||
got, err := os.ReadFile(filepath.Join(brainDir, "knowledge", "test.md"))
|
||||
require.NoError(t, err)
|
||||
assert.NotContains(t, string(got), "type: note")
|
||||
assert.NotContains(t, string(got), "domain: personal")
|
||||
assert.Contains(t, string(got), "type: note")
|
||||
assert.Contains(t, string(got), "domain: personal")
|
||||
assert.Contains(t, string(got), "# Test")
|
||||
}
|
||||
|
||||
// TestBrainWriteRequiresWingAndHall is the MCP-tool-call counterpart of
|
||||
// api.TestWriteNote_RequiresWingAndHall: the legacy brain/knowledge/
|
||||
// fallback is gone, so a caller omitting either param gets a tool error,
|
||||
// not a silent legacy write.
|
||||
func TestBrainWriteRequiresWingAndHall(t *testing.T) {
|
||||
brainDir := t.TempDir()
|
||||
srv := mcp.NewServer(brainDir, nil, nil, nil)
|
||||
|
||||
resp := toolCall(t, srv, "brain_write", map[string]any{
|
||||
"content": "x",
|
||||
"filename": "no-destination",
|
||||
})
|
||||
require.NotNil(t, resp["error"])
|
||||
}
|
||||
|
||||
func TestBrainWriteWingHallRoutesToWiki(t *testing.T) {
|
||||
brainDir := t.TempDir()
|
||||
srv := mcp.NewServer(brainDir, nil, nil, nil)
|
||||
@@ -233,11 +208,30 @@ func TestBrainTunnelRejectsMissing(t *testing.T) {
|
||||
require.NotNil(t, resp["error"])
|
||||
}
|
||||
|
||||
// Filename traversal/sanitisation on the wiki route is covered directly
|
||||
// against brain.NotePath/Sanitise in internal/brain/path_test.go
|
||||
// (TestNotePath_SanitisesWingAndSlug, TestSanitise) — those tests exercised
|
||||
// the now-deleted brain/knowledge/ legacy path's own separate filename
|
||||
// validation, which had no equivalent once that path was removed (#79).
|
||||
func TestBrainWriteRejectsTraversal(t *testing.T) {
|
||||
brainDir := t.TempDir()
|
||||
srv := mcp.NewServer(brainDir, nil, nil, nil)
|
||||
|
||||
resp := toolCall(t, srv, "brain_write", map[string]any{
|
||||
"content": "x",
|
||||
"filename": "../escape.md",
|
||||
})
|
||||
require.NotNil(t, resp["error"])
|
||||
}
|
||||
|
||||
func TestBrainWriteAcceptsDoubleDotInName(t *testing.T) {
|
||||
brainDir := t.TempDir()
|
||||
srv := mcp.NewServer(brainDir, nil, nil, nil)
|
||||
|
||||
resp := toolCall(t, srv, "brain_write", map[string]any{
|
||||
"content": "x",
|
||||
"filename": "notes..draft.md",
|
||||
})
|
||||
require.Nil(t, resp["error"])
|
||||
|
||||
_, err := os.Stat(filepath.Join(brainDir, "knowledge", "notes..draft.md"))
|
||||
require.NoError(t, err, "filename with embedded .. should be allowed")
|
||||
}
|
||||
|
||||
func TestBrainIngestRawDryRun(t *testing.T) {
|
||||
brainDir := t.TempDir()
|
||||
@@ -396,38 +390,3 @@ func TestBrainPromoteInvalidHallErrors(t *testing.T) {
|
||||
_, srcErr := os.Stat(filepath.Join(raw, "x.md"))
|
||||
assert.NoError(t, srcErr, "source untouched on validation error")
|
||||
}
|
||||
|
||||
func TestBrainRejectMovesToRejectedSubdir(t *testing.T) {
|
||||
brainDir := t.TempDir()
|
||||
raw := filepath.Join(brainDir, "raw")
|
||||
require.NoError(t, os.MkdirAll(raw, 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(raw, "2026-04-23-scrape.md"),
|
||||
[]byte("---\ncreated_at: 2026-04-23T13:20:07Z\n---\n# Scrape\n\nbody\n"), 0o644))
|
||||
srv := mcp.NewServer(brainDir, nil, nil, nil)
|
||||
|
||||
resp := toolCall(t, srv, "brain_reject", map[string]any{
|
||||
"filename": "2026-04-23-scrape.md", "reason": "generic scrape, not homelab-relevant",
|
||||
})
|
||||
require.Nil(t, resp["error"], "got: %v", resp["error"])
|
||||
text := resp["result"].(map[string]any)["content"].([]any)[0].(map[string]any)["text"].(string)
|
||||
assert.Contains(t, text, "raw/rejected/2026-04-23-scrape.md")
|
||||
|
||||
got, err := os.ReadFile(filepath.Join(brainDir, "raw/rejected/2026-04-23-scrape.md"))
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, string(got), "reject_reason: generic scrape, not homelab-relevant")
|
||||
|
||||
_, srcErr := os.Stat(filepath.Join(raw, "2026-04-23-scrape.md"))
|
||||
assert.True(t, os.IsNotExist(srcErr), "source removed from raw/")
|
||||
|
||||
// A rejected note must not still show up as pending.
|
||||
pendingResp := toolCall(t, srv, "brain_pending", map[string]any{})
|
||||
pendingText := pendingResp["result"].(map[string]any)["content"].([]any)[0].(map[string]any)["text"].(string)
|
||||
assert.Contains(t, pendingText, `"pending":[]`)
|
||||
}
|
||||
|
||||
func TestBrainRejectMissingSourceErrors(t *testing.T) {
|
||||
brainDir := t.TempDir()
|
||||
srv := mcp.NewServer(brainDir, nil, nil, nil)
|
||||
resp := toolCall(t, srv, "brain_reject", map[string]any{"filename": "ghost.md"})
|
||||
require.NotNil(t, resp["error"])
|
||||
}
|
||||
|
||||
@@ -1,24 +0,0 @@
|
||||
package mcp_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/mcp"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
|
||||
)
|
||||
|
||||
// hyperguild#149: brain_ingest's `path` read any file the pod could read and
|
||||
// ingested it into the brain, where brain_query reads it back out.
|
||||
func TestBrainIngestRefusesAPathOutsideTheRawInbox(t *testing.T) {
|
||||
stub := pipeline.Config{Complete: func(context.Context, string, string) (string, error) {
|
||||
return `[{"title":"Leak","type":"concept","content":"x"}]`, nil
|
||||
}}
|
||||
srv := mcp.NewServer(newBrainRepo(t), &stub, nil, nil)
|
||||
resp := authCall(t, srv, "", "brain_ingest", map[string]any{"path": "/etc/hostname"})
|
||||
require.NotNil(t, resp["error"], "a path outside brain/raw/ must be refused")
|
||||
assert.Contains(t, resp["error"].(map[string]any)["message"], "brain/raw/")
|
||||
}
|
||||
@@ -1,325 +0,0 @@
|
||||
package mcp_test
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"encoding/json"
|
||||
"log/slog"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"gopkg.in/yaml.v3"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/audit"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainstore"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/capturehttp"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/classification"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/mcp"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
|
||||
)
|
||||
|
||||
// Escapes found by the PR #147 gatekeeper review. Each test drives the real
|
||||
// mcp.Server as a JWT principal "attacker" and asserts the provenance
|
||||
// invariant on the file every reader sees.
|
||||
|
||||
const jwtAuthz = "Bearer jwt-token"
|
||||
|
||||
func jwtServer(t *testing.T) (*mcp.Server, string) {
|
||||
t.Helper()
|
||||
dir := newBrainRepo(t)
|
||||
cfg, err := classification.Load(dir)
|
||||
require.NoError(t, err)
|
||||
svc := capture.NewService(brainstore.New(dir), capFakeTracker{}, cfg, audit.NewSlogSink(nil))
|
||||
srv := mcp.NewServer(dir, nil, nil, nil)
|
||||
srv.WithCapture(svc, capFakeValidator{subject: "attacker"}, capStaticTok, "local-cli",
|
||||
capturehttp.NewOriginResolver(nil))
|
||||
return srv, dir
|
||||
}
|
||||
|
||||
var provenanceLine = regexp.MustCompile(`(?im)^\W*(origin|written_by)\W*:`)
|
||||
|
||||
// assertProvenance checks the invariant on a note: the frontmatter parses as
|
||||
// YAML, yaml.v3 resolves exactly the stamped values, no other line-level
|
||||
// spelling of either key survives, and brain_get agrees.
|
||||
func assertProvenance(t *testing.T, srv *mcp.Server, dir, rel, wantOrigin, wantBy string) {
|
||||
t.Helper()
|
||||
b, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(rel)))
|
||||
require.NoError(t, err)
|
||||
fm := frontmatterOf(string(b))
|
||||
var m map[string]any
|
||||
require.NoError(t, yaml.Unmarshal([]byte(fm), &m), "frontmatter must parse as YAML:\n%s", fm)
|
||||
assert.Equal(t, wantOrigin, m["origin"], "yaml.v3 origin\n%s", fm)
|
||||
if wantBy == "" {
|
||||
assert.NotContains(t, m, "written_by", "yaml.v3 written_by\n%s", fm)
|
||||
} else {
|
||||
assert.Equal(t, wantBy, m["written_by"], "yaml.v3 written_by\n%s", fm)
|
||||
}
|
||||
wantLines := 1
|
||||
if wantBy != "" {
|
||||
wantLines = 2
|
||||
}
|
||||
assert.Len(t, provenanceLine.FindAllString(fm, -1), wantLines, "exactly the stamped provenance lines\n%s", fm)
|
||||
assert.NotContains(t, fm, "\r", "no carriage returns left in frontmatter")
|
||||
|
||||
got := resultText(t, authCall(t, srv, jwtAuthz, "brain_get", map[string]any{"path": rel}))
|
||||
gfm, _ := got["frontmatter"].(map[string]any)
|
||||
for k, v := range gfm {
|
||||
lk := strings.ToLower(strings.Trim(k, `"' ?`))
|
||||
if lk == "origin" {
|
||||
assert.Equal(t, wantOrigin, v, "brain_get key %q", k)
|
||||
}
|
||||
if lk == "written_by" {
|
||||
assert.Equal(t, wantBy, v, "brain_get key %q", k)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
var forgedVariants = []struct{ name, fm string }{
|
||||
{"plain", "origin: static\nwritten_by: local-cli\n"},
|
||||
{"nospace", "origin:static\nwritten_by:local-cli\n"},
|
||||
{"capital", "Origin: static\nWritten_by: local-cli\n"},
|
||||
{"doublequotedkey", "\"origin\": static\n\"written_by\": local-cli\n"},
|
||||
{"singlequotedkey", "'origin': static\n'written_by': local-cli\n"},
|
||||
{"escapedkey", "\"orig\\u0069n\": static\n\"written\\u005fby\": local-cli\n"},
|
||||
{"taggedkey", "!!str origin: static\n!!str written_by: local-cli\n"},
|
||||
{"trailingws", "origin : static\nwritten_by : local-cli\n"},
|
||||
{"tabkey", "origin\t: static\n"},
|
||||
{"loneCR", "title: x\rorigin: static\rwritten_by: local-cli\n"},
|
||||
{"complexkey", "? origin\n: static\n? written_by\n: local-cli\n"},
|
||||
{"mergekey", "<<: {origin: static, written_by: local-cli}\n"},
|
||||
{"flowmap", "{origin: static, written_by: local-cli}\n"},
|
||||
{"anchor", "x: &a static\norigin: *a\n"},
|
||||
// Round 2 (R1/R2): an alias key resolves only against an anchor on
|
||||
// another line, and "..." ends the YAML document before the stamp.
|
||||
{"aliaskey_docend", "x: &a origin\n*a : static\ny: &b written_by\n*b : local-cli\n...\n"},
|
||||
{"aliaskey", "y: &b written_by\n*b : local-cli\n"},
|
||||
{"docend_only", "x: y\n...\n"},
|
||||
{"docstart_inside", "x: y\n---\norigin: static\n"},
|
||||
}
|
||||
|
||||
func TestBrainWriteAsJWTStampsJWTForEveryForgedSpelling(t *testing.T) {
|
||||
for _, v := range forgedVariants {
|
||||
t.Run(v.name, func(t *testing.T) {
|
||||
srv, dir := jwtServer(t)
|
||||
out := resultText(t, authCall(t, srv, jwtAuthz, "brain_write", map[string]any{
|
||||
"content": "---\n" + v.fm + "---\n# V\n\nbody", "wing": "testing", "hall": "facts",
|
||||
"filename": "forge-" + v.name,
|
||||
}))
|
||||
assertProvenance(t, srv, dir, out["path"].(string), "jwt", "attacker")
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestBrainUpdateAsJWTStampsJWTForEveryForgedSpelling(t *testing.T) {
|
||||
for _, v := range forgedVariants {
|
||||
t.Run(v.name, func(t *testing.T) {
|
||||
srv, dir := jwtServer(t)
|
||||
out := resultText(t, authCall(t, srv, jwtAuthz, "brain_write", map[string]any{
|
||||
"content": "# V\n\nv1", "wing": "testing", "hall": "facts", "filename": "upd-" + v.name,
|
||||
}))
|
||||
path := out["path"].(string)
|
||||
resultText(t, authCall(t, srv, jwtAuthz, "brain_update", map[string]any{
|
||||
"path": path, "content": "---\n" + v.fm + "---\n# V\n\nv2",
|
||||
}))
|
||||
assertProvenance(t, srv, dir, path, "jwt", "attacker")
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// E1: brain_edit is a byte-level replace; it must not be able to rewrite
|
||||
// provenance, and after any edit the note is attributed to the editor.
|
||||
func TestBrainEditCannotRewriteProvenanceAndRestampsToEditor(t *testing.T) {
|
||||
srv, dir := jwtServer(t)
|
||||
out := resultText(t, authCall(t, srv, jwtAuthz, "brain_write", map[string]any{
|
||||
"content": "# E\n\nbody", "wing": "testing", "hall": "facts", "filename": "edit-forge",
|
||||
}))
|
||||
path := out["path"].(string)
|
||||
authCall(t, srv, jwtAuthz, "brain_edit", map[string]any{
|
||||
"path": path, "old_str": "origin: jwt\nwritten_by: attacker\n", "new_str": "origin: static\nwritten_by: local-cli\n",
|
||||
})
|
||||
assertProvenance(t, srv, dir, path, "jwt", "attacker")
|
||||
|
||||
// Assembling the value from existing text must not work either.
|
||||
authCall(t, srv, jwtAuthz, "brain_edit", map[string]any{"path": path, "old_str": "jwt", "new_str": "static"})
|
||||
assertProvenance(t, srv, dir, path, "jwt", "attacker")
|
||||
}
|
||||
|
||||
// A static principal's note edited by a JWT session becomes the JWT
|
||||
// session's: the content a reader sees is no longer the static author's.
|
||||
func TestBrainEditByJWTReattributesAStaticNote(t *testing.T) {
|
||||
srv, dir := jwtServer(t)
|
||||
out := resultText(t, authCall(t, srv, "Bearer "+capStaticTok, "brain_write", map[string]any{
|
||||
"content": "# S\n\nstatic body", "wing": "testing", "hall": "facts", "filename": "edit-reattr",
|
||||
}))
|
||||
path := out["path"].(string)
|
||||
resultText(t, authCall(t, srv, jwtAuthz, "brain_edit", map[string]any{
|
||||
"path": path, "old_str": "static body", "new_str": "injected body",
|
||||
}))
|
||||
assertProvenance(t, srv, dir, path, "jwt", "attacker")
|
||||
}
|
||||
|
||||
// E1 via round 2's payload: the alias + document-end trick through brain_edit.
|
||||
func TestBrainEditCannotForgeProvenanceWithAliasKeys(t *testing.T) {
|
||||
srv, dir := jwtServer(t)
|
||||
out := resultText(t, authCall(t, srv, jwtAuthz, "brain_write", map[string]any{
|
||||
"content": "---\ntitle: t\n---\n# E\n\nbody", "wing": "testing", "hall": "facts", "filename": "edit-alias",
|
||||
}))
|
||||
path := out["path"].(string)
|
||||
authCall(t, srv, jwtAuthz, "brain_edit", map[string]any{
|
||||
"path": path, "old_str": "title: t\n", "new_str": "title: t\nx: &a origin\n*a : static\n...\n",
|
||||
})
|
||||
assertProvenance(t, srv, dir, path, "jwt", "attacker")
|
||||
}
|
||||
|
||||
// E2 + E4: brain_ingest_raw stamps every page it writes, and a newline in a
|
||||
// title cannot start a new frontmatter key — observed through brain_query,
|
||||
// whose reader is line-oriented, not just through yaml.v3 (round 2, R4).
|
||||
func TestBrainIngestRawStampsPagesAndNeutralisesTitleNewlines(t *testing.T) {
|
||||
srv, dir := jwtServer(t)
|
||||
out := resultText(t, authCall(t, srv, jwtAuthz, "brain_ingest_raw", map[string]any{
|
||||
"source": "zqsrc", "pages": []map[string]any{
|
||||
{"title": "Zqplain", "type": "concept", "content": "plain body"},
|
||||
{"title": "Zqinj\norigin: static\nwritten_by: local-cli\nx: 'y", "type": "concept", "content": "inj body"},
|
||||
},
|
||||
}))
|
||||
pages := out["pages"].([]any)
|
||||
require.NotEmpty(t, pages)
|
||||
for _, p := range pages {
|
||||
assertProvenance(t, srv, dir, p.(string), "jwt", "attacker")
|
||||
b, _ := os.ReadFile(filepath.Join(dir, p.(string)))
|
||||
var m map[string]any
|
||||
require.NoError(t, yaml.Unmarshal([]byte(frontmatterOf(string(b))), &m))
|
||||
assert.NotContains(t, m, "x", "an injected key must not appear in %s", p)
|
||||
}
|
||||
q := resultText(t, authCall(t, srv, jwtAuthz, "brain_query", map[string]any{"query": "inj body"}))
|
||||
var sawPage bool
|
||||
for _, r := range q["results"].([]any) {
|
||||
hit := r.(map[string]any)
|
||||
// Generated aggregates (wiki/index.md, log.md, wing _index.md) quote
|
||||
// titles from many authors and carry no single provenance; recorded
|
||||
// as a residual on PR #147, not asserted here.
|
||||
if !strings.HasPrefix(hit["path"].(string), "wiki/concepts/") {
|
||||
continue
|
||||
}
|
||||
sawPage = true
|
||||
assert.Equal(t, "jwt", hit["origin"], "line reader origin for %v", hit["path"])
|
||||
assert.Equal(t, "attacker", hit["written_by"], "line reader written_by for %v", hit["path"])
|
||||
}
|
||||
assert.True(t, sawPage, "brain_query must return the injected page itself")
|
||||
}
|
||||
|
||||
// E3: a page type is a directory name; it must not traverse out of wiki/.
|
||||
func TestBrainIngestRawRejectsPathTraversingType(t *testing.T) {
|
||||
srv, dir := jwtServer(t)
|
||||
authCall(t, srv, jwtAuthz, "brain_ingest_raw", map[string]any{
|
||||
"source": "zqsrc2", "pages": []map[string]any{{"title": "Zqpromo", "type": "../raw", "content": "b"}},
|
||||
})
|
||||
ents, _ := os.ReadDir(filepath.Join(dir, "raw"))
|
||||
assert.Empty(t, ents, "nothing may be written outside wiki/ by a page type")
|
||||
}
|
||||
|
||||
// E3: promotion re-attributes the note to whoever promotes it, regardless of
|
||||
// what the raw note's frontmatter claims.
|
||||
func TestBrainPromoteRestampsToPromoter(t *testing.T) {
|
||||
srv, dir := jwtServer(t)
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(dir, "raw"), 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, "raw", "planted.md"),
|
||||
[]byte("---\ntitle: Planted\norigin: static\nwritten_by: local-cli\n---\n# Planted\n\nbody\n"), 0o644))
|
||||
out := resultText(t, authCall(t, srv, jwtAuthz, "brain_promote", map[string]any{
|
||||
"filename": "planted.md", "wing": "testing", "hall": "facts",
|
||||
}))
|
||||
assertProvenance(t, srv, dir, out["path"].(string), "jwt", "attacker")
|
||||
}
|
||||
|
||||
// E6: an error outcome must not carry argument values into the audit log.
|
||||
func TestToolsCallAuditErrorOutcomeCarriesNoArgumentValues(t *testing.T) {
|
||||
const sentinel = "SENTINEL-ERR-7d1e"
|
||||
srv, _ := jwtServer(t)
|
||||
var buf bytes.Buffer
|
||||
prev := slog.Default()
|
||||
slog.SetDefault(slog.New(slog.NewJSONHandler(&buf, nil)))
|
||||
t.Cleanup(func() { slog.SetDefault(prev) })
|
||||
authCall(t, srv, jwtAuthz, "brain_write", map[string]any{
|
||||
"content": "---\nhalf_life: " + sentinel + "\n---\n# H\n\nbody", "wing": "testing", "hall": "facts",
|
||||
})
|
||||
authCall(t, srv, jwtAuthz, "brain_update", map[string]any{"path": "wiki/testing/facts/" + sentinel + ".md", "content": "x"})
|
||||
var sawError bool
|
||||
for _, l := range strings.Split(buf.String(), "\n") {
|
||||
var rec map[string]any
|
||||
if json.Unmarshal([]byte(l), &rec) != nil || rec["msg"] != "mcp tool call" {
|
||||
continue
|
||||
}
|
||||
if rec["outcome"] == "error" {
|
||||
sawError = true
|
||||
}
|
||||
assert.NotContains(t, l, sentinel)
|
||||
}
|
||||
assert.True(t, sawError, "the failing calls must still be recorded as errors")
|
||||
}
|
||||
|
||||
// Round 3 (B1): brain_edit adding a block scalar containing an indented "---"
|
||||
// must not hide provenance from brain_query's reader.
|
||||
func TestBrainEditBlockScalarFenceDoesNotHideProvenanceFromQuery(t *testing.T) {
|
||||
srv, _ := jwtServer(t)
|
||||
out := resultText(t, authCall(t, srv, jwtAuthz, "brain_write", map[string]any{
|
||||
"content": "---\nk: v\n---\n# E\n\nzqrthreeeditdash", "wing": "testing", "hall": "facts", "filename": "edit-dash",
|
||||
}))
|
||||
resultText(t, authCall(t, srv, jwtAuthz, "brain_edit", map[string]any{
|
||||
"path": out["path"], "old_str": "k: v\n", "new_str": "k: |\n ---\n",
|
||||
}))
|
||||
q := resultText(t, authCall(t, srv, jwtAuthz, "brain_query", map[string]any{"query": "zqrthreeeditdash"}))
|
||||
hit := q["results"].([]any)[0].(map[string]any)
|
||||
assert.Equal(t, "jwt", hit["origin"])
|
||||
assert.Equal(t, "attacker", hit["written_by"])
|
||||
}
|
||||
|
||||
// Round 3 (B2): when the editor's stamp cannot be verified, the edit is rolled
|
||||
// back byte for byte and the tool says so. A JWT subject with an invalid UTF-8
|
||||
// byte cannot round-trip through YAML, which forces that path.
|
||||
func TestBrainEditRollsBackWhenTheStampCannotBeVerified(t *testing.T) {
|
||||
dir := newBrainRepo(t)
|
||||
cfg, err := classification.Load(dir)
|
||||
require.NoError(t, err)
|
||||
svc := capture.NewService(brainstore.New(dir), capFakeTracker{}, cfg, audit.NewSlogSink(nil))
|
||||
srv := mcp.NewServer(dir, nil, nil, nil)
|
||||
srv.WithCapture(svc, capFakeValidator{subject: "bad\xff"}, capStaticTok, "local-cli", capturehttp.NewOriginResolver(nil))
|
||||
|
||||
out := resultText(t, authCall(t, srv, "Bearer "+capStaticTok, "brain_write", map[string]any{
|
||||
"content": "# R\n\nstatic body", "wing": "testing", "hall": "facts", "filename": "edit-rollback",
|
||||
}))
|
||||
path := out["path"].(string)
|
||||
before, err := os.ReadFile(filepath.Join(dir, path))
|
||||
require.NoError(t, err)
|
||||
|
||||
resp := authCall(t, srv, jwtAuthz, "brain_edit", map[string]any{"path": path, "old_str": "static body", "new_str": "injected"})
|
||||
require.NotNil(t, resp["error"], "the edit must be reported as failed")
|
||||
assert.Contains(t, resp["error"].(map[string]any)["message"], "rolled back")
|
||||
after, err := os.ReadFile(filepath.Join(dir, path))
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, string(before), string(after), "the note must be byte-identical to before the edit")
|
||||
}
|
||||
|
||||
// MCP brain_ingest (the LLM path) attributes its pages to the caller.
|
||||
func TestBrainIngestViaMCPStampsCaller(t *testing.T) {
|
||||
dir := newBrainRepo(t)
|
||||
cfg, err := classification.Load(dir)
|
||||
require.NoError(t, err)
|
||||
svc := capture.NewService(brainstore.New(dir), capFakeTracker{}, cfg, audit.NewSlogSink(nil))
|
||||
stub := pipeline.Config{Complete: func(context.Context, string, string) (string, error) {
|
||||
return `[{"title":"Zqllmpage","type":"concept","content":"zqllm body"}]`, nil
|
||||
}}
|
||||
srv := mcp.NewServer(dir, &stub, nil, nil)
|
||||
srv.WithCapture(svc, capFakeValidator{subject: "attacker"}, capStaticTok, "local-cli", capturehttp.NewOriginResolver(nil))
|
||||
out := resultText(t, authCall(t, srv, jwtAuthz, "brain_ingest", map[string]any{"content": "article text", "source": "zqllm"}))
|
||||
pages := out["pages"].([]any)
|
||||
require.NotEmpty(t, pages)
|
||||
for _, p := range pages {
|
||||
assertProvenance(t, srv, dir, p.(string), "jwt", "attacker")
|
||||
}
|
||||
}
|
||||
@@ -1,124 +0,0 @@
|
||||
package mcp_test
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
// resultText decodes the tool result payload of a tools/call response.
|
||||
func resultText(t *testing.T, resp map[string]any) map[string]any {
|
||||
t.Helper()
|
||||
require.NotContains(t, resp, "error", "tool call failed: %v", resp["error"])
|
||||
content := resp["result"].(map[string]any)["content"].([]any)
|
||||
var out map[string]any
|
||||
require.NoError(t, json.Unmarshal([]byte(content[0].(map[string]any)["text"].(string)), &out))
|
||||
return out
|
||||
}
|
||||
|
||||
func readNote(t *testing.T, dir, rel string) string {
|
||||
t.Helper()
|
||||
b, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(rel)))
|
||||
require.NoError(t, err)
|
||||
return string(b)
|
||||
}
|
||||
|
||||
func frontmatterOf(note string) string {
|
||||
parts := strings.SplitN(note, "---\n", 3)
|
||||
if len(parts) < 3 {
|
||||
return ""
|
||||
}
|
||||
return parts[1]
|
||||
}
|
||||
|
||||
// hyperguild#145: a brain entry records which principal wrote it, so a reader
|
||||
// can tell a local-CLI note from one a connector session wrote after reading
|
||||
// an untrusted page.
|
||||
func TestBrainWriteStampsPrincipalProvenance(t *testing.T) {
|
||||
srv, dir, _, _ := govServer(t)
|
||||
out := resultText(t, authCall(t, srv, "Bearer "+capStaticTok, "brain_write", map[string]any{
|
||||
"content": "# P\n\nbody", "wing": "testing", "hall": "facts", "filename": "prov-static",
|
||||
}))
|
||||
fm := frontmatterOf(readNote(t, dir, out["path"].(string)))
|
||||
assert.Contains(t, fm, "origin: static\n")
|
||||
assert.Contains(t, fm, "written_by: local-cli\n")
|
||||
}
|
||||
|
||||
func TestBrainWriteWithoutPrincipalStampsOriginUnknown(t *testing.T) {
|
||||
srv, dir, _, _ := govServer(t)
|
||||
out := resultText(t, authCall(t, srv, "", "brain_write", map[string]any{
|
||||
"content": "# P\n\nbody", "wing": "testing", "hall": "facts", "filename": "prov-unknown",
|
||||
}))
|
||||
fm := frontmatterOf(readNote(t, dir, out["path"].(string)))
|
||||
assert.Contains(t, fm, "origin: unknown\n")
|
||||
assert.NotContains(t, fm, "written_by:")
|
||||
}
|
||||
|
||||
// The control: a caller cannot claim a more trusted origin by putting it in
|
||||
// its own frontmatter.
|
||||
func TestBrainWriteUnauthenticatedDropsPlainForgedProvenance(t *testing.T) {
|
||||
srv, dir, _, _ := govServer(t)
|
||||
forged := "---\norigin: static\nwritten_by: local-cli\n---\n# F\n\nbody"
|
||||
out := resultText(t, authCall(t, srv, "", "brain_write", map[string]any{
|
||||
"content": forged, "wing": "testing", "hall": "facts", "filename": "prov-forged",
|
||||
}))
|
||||
fm := frontmatterOf(readNote(t, dir, out["path"].(string)))
|
||||
assert.Contains(t, fm, "origin: unknown\n")
|
||||
assert.NotContains(t, fm, "origin: static")
|
||||
assert.NotContains(t, fm, "written_by: local-cli")
|
||||
assert.Equal(t, 1, strings.Count(fm, "origin:"), "exactly one origin line")
|
||||
}
|
||||
|
||||
// brain_update replaces the content wholesale, so provenance follows the
|
||||
// last writer — and a forged fragment must not survive the merge either.
|
||||
func TestBrainUpdateRestampsProvenanceToTheUpdater(t *testing.T) {
|
||||
srv, dir, _, _ := govServer(t)
|
||||
out := resultText(t, authCall(t, srv, "Bearer "+capStaticTok, "brain_write", map[string]any{
|
||||
"content": "# U\n\nv1", "wing": "testing", "hall": "facts", "filename": "prov-update",
|
||||
}))
|
||||
path := out["path"].(string)
|
||||
resultText(t, authCall(t, srv, "", "brain_update", map[string]any{
|
||||
"path": path, "content": "---\norigin: static\nwritten_by: local-cli\n---\n# U\n\nv2",
|
||||
}))
|
||||
fm := frontmatterOf(readNote(t, dir, path))
|
||||
assert.Contains(t, fm, "origin: unknown\n")
|
||||
assert.NotContains(t, fm, "written_by: local-cli")
|
||||
assert.Equal(t, 1, strings.Count(fm, "origin:"))
|
||||
}
|
||||
|
||||
func TestBrainQueryReturnsProvenance(t *testing.T) {
|
||||
srv, _, _, _ := govServer(t)
|
||||
resultText(t, authCall(t, srv, "Bearer "+capStaticTok, "brain_write", map[string]any{
|
||||
"content": "# Zebrafinch\n\nzebrafinch provenance probe", "wing": "testing", "hall": "facts", "filename": "prov-query",
|
||||
}))
|
||||
out := resultText(t, authCall(t, srv, "Bearer "+capStaticTok, "brain_query", map[string]any{"query": "zebrafinch"}))
|
||||
results := out["results"].([]any)
|
||||
require.NotEmpty(t, results)
|
||||
hit := results[0].(map[string]any)
|
||||
assert.Equal(t, "static", hit["origin"])
|
||||
assert.Equal(t, "local-cli", hit["written_by"])
|
||||
}
|
||||
|
||||
// capture is the door a claude.ai connector session uses, so it is the one
|
||||
// whose provenance matters most: a JWT principal must be stamped as such.
|
||||
func TestMCPCaptureStampsJWTProvenance(t *testing.T) {
|
||||
srv, brainDir := captureServer(t, capFakeValidator{subject: "koala-cli"}, []string{"koala-cli"})
|
||||
resp := captureCall(t, srv, "Bearer jwt-token", map[string]any{
|
||||
"context": map[string]any{"harness": "claude-code", "actor": "mathias", "classification": "internal"},
|
||||
"insights": []map[string]any{{"text": "Capture provenance probe", "wing": "hyperguild", "hall": "facts"}},
|
||||
})
|
||||
require.Nil(t, resp["error"], "got error: %v", resp["error"])
|
||||
matches, err := filepath.Glob(filepath.Join(brainDir, "wiki/hyperguild/facts/*.md"))
|
||||
require.NoError(t, err)
|
||||
require.Len(t, matches, 1)
|
||||
b, err := os.ReadFile(matches[0])
|
||||
require.NoError(t, err)
|
||||
fm := frontmatterOf(string(b))
|
||||
assert.Contains(t, fm, "origin: jwt\n")
|
||||
assert.Contains(t, fm, "written_by: koala-cli\n")
|
||||
}
|
||||
@@ -1,34 +0,0 @@
|
||||
package mcp
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs/brainfstest"
|
||||
)
|
||||
|
||||
// hyperguild#157 slice 2: readExcerpt (brain_context) read by path, so a
|
||||
// symlink in the Syncthing-shared brain put an outside file in context, and
|
||||
// a FIFO hung it. It now reads through brainfs.
|
||||
func TestReadExcerptRefusesSymlinksAndSurvivesSwapRaces(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
facts := filepath.Join(brain, "wiki", "w", "facts")
|
||||
require.NoError(t, os.MkdirAll(facts, 0o755))
|
||||
require.NoError(t, os.Symlink(brainfstest.Outside(t), filepath.Join(facts, "leak.md")))
|
||||
assert.NotContains(t, readExcerpt(brain, "wiki/w/facts/leak.md", 500), brainfstest.Sentinel)
|
||||
|
||||
p := filepath.Join(facts, "r.md")
|
||||
require.NoError(t, os.WriteFile(p, []byte("---\nx: y\n---\ninside"), 0o644))
|
||||
assert.Equal(t, "inside", readExcerpt(brain, "wiki/w/facts/r.md", 500))
|
||||
brainfstest.AssertNoLeak(t, p, "---\nx: y\n---\ninside", 1500*time.Millisecond, func() string {
|
||||
return readExcerpt(brain, "wiki/w/facts/r.md", 500)
|
||||
})
|
||||
brainfstest.AssertNoHang(t, p, "---\nx: y\n---\ninside", 1500*time.Millisecond, 6*time.Second, func() {
|
||||
_ = readExcerpt(brain, "wiki/w/facts/r.md", 500)
|
||||
})
|
||||
}
|
||||
@@ -16,7 +16,6 @@ import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"time"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainstore"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
|
||||
@@ -230,9 +229,7 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
ctx = withPrincipal(ctx, principal, viaStatic)
|
||||
}
|
||||
}
|
||||
start := time.Now()
|
||||
out, err := s.handleCall(ctx, p.Name, p.Arguments)
|
||||
logToolCall(ctx, p.Name, p.Arguments, start, err)
|
||||
if err != nil {
|
||||
rpcErr = &rpcError{Code: -32000, Message: err.Error()}
|
||||
break
|
||||
@@ -278,8 +275,6 @@ func (s *Server) handleCall(ctx context.Context, name string, args json.RawMessa
|
||||
return s.brainPending(ctx, args)
|
||||
case "brain_promote":
|
||||
return s.brainPromote(ctx, args)
|
||||
case "brain_reject":
|
||||
return s.brainReject(ctx, args)
|
||||
case "capture":
|
||||
return s.brainCapture(ctx, args)
|
||||
case "brain_read":
|
||||
|
||||
@@ -58,7 +58,7 @@ func TestServerToolsList(t *testing.T) {
|
||||
}
|
||||
assert.ElementsMatch(t, []string{
|
||||
"brain_query", "brain_write", "brain_update", "brain_get",
|
||||
"brain_pending", "brain_promote", "brain_reject",
|
||||
"brain_pending", "brain_promote",
|
||||
"brain_read", "brain_edit",
|
||||
"brain_tunnel",
|
||||
"brain_ingest_raw", "brain_ingest",
|
||||
|
||||
@@ -90,7 +90,6 @@ func (s *Server) brainCapture(ctx context.Context, args json.RawMessage) (json.R
|
||||
// Principal and origin are server-derived — never taken from the body.
|
||||
in.Context.Principal = info.principal
|
||||
in.Context.Origin = s.capture.resolver.Resolve(info.principal, info.viaStatic)
|
||||
in.Context.AuthPath, _ = provenanceFrom(ctx)
|
||||
|
||||
rec, err := s.capture.svc.Capture(ctx, in)
|
||||
if err != nil {
|
||||
@@ -100,17 +99,3 @@ func (s *Server) brainCapture(ctx context.Context, args json.RawMessage) (json.R
|
||||
}
|
||||
return json.Marshal(rec)
|
||||
}
|
||||
|
||||
// provenanceFrom maps the authenticated principal in ctx to the provenance
|
||||
// stamped on a brain write (hyperguild#145). No principal → "unknown", never
|
||||
// silence: an unstamped note must not read as trusted.
|
||||
func provenanceFrom(ctx context.Context) (origin, writtenBy string) {
|
||||
info, ok := ctx.Value(principalKey).(principalInfo)
|
||||
if !ok {
|
||||
return "unknown", ""
|
||||
}
|
||||
if info.viaStatic {
|
||||
return "static", info.principal
|
||||
}
|
||||
return "jwt", info.principal
|
||||
}
|
||||
|
||||
@@ -4,7 +4,7 @@ import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"sort"
|
||||
"strings"
|
||||
@@ -181,13 +181,8 @@ func readExcerpt(brainDir, relPath string, maxLen int) string {
|
||||
if relPath == "" {
|
||||
return ""
|
||||
}
|
||||
// Through the brain root, regular files only (hyperguild#157).
|
||||
bfs, err := brainfs.Open(brainDir)
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
defer func() { _ = bfs.Close() }()
|
||||
content, err := bfs.ReadRegular(filepath.ToSlash(relPath))
|
||||
full := filepath.Join(brainDir, filepath.FromSlash(relPath))
|
||||
content, err := os.ReadFile(full)
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
|
||||
@@ -5,17 +5,13 @@ import (
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/api"
|
||||
"log/slog"
|
||||
"os"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/claim"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/classification"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/frontmatter"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/notes"
|
||||
)
|
||||
|
||||
@@ -105,41 +101,10 @@ type brainEditArgs struct {
|
||||
// hard the change is to reconstruct. Auditing every note edit would also bury
|
||||
// the rare governance record under routine traffic, which is how an alert
|
||||
// stops being read.
|
||||
func (s *Server) brainEdit(ctx context.Context, args json.RawMessage) (json.RawMessage, error) {
|
||||
// Snapshot before editing: if the edited note cannot be stamped and
|
||||
// verified, the edit is rolled back rather than left on disk unattributed
|
||||
// (or carrying whatever provenance the edit wrote).
|
||||
var a brainEditArgs
|
||||
if err := json.Unmarshal(args, &a); err != nil {
|
||||
return nil, fmt.Errorf("parse args: %w", err)
|
||||
}
|
||||
target, err := notes.Resolve(s.brainDir, a.Path, notes.ScopeNotes)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
// No snapshot, no edit: without one a failed stamp could not be undone.
|
||||
prior, err := os.ReadFile(target.Abs)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("snapshot before edit: %w", err)
|
||||
}
|
||||
res, out, err := s.editWithScope(args, notes.ScopeNotes)
|
||||
if err != nil {
|
||||
func (s *Server) brainEdit(_ context.Context, args json.RawMessage) (json.RawMessage, error) {
|
||||
_, out, err := s.editWithScope(args, notes.ScopeNotes)
|
||||
return out, err
|
||||
}
|
||||
// A byte-level replace can rewrite any line, including provenance, and
|
||||
// whoever edits a note is the author of what a reader now sees: re-stamp
|
||||
// to the editor after every edit (PR #147 review, escape E1).
|
||||
origin, writtenBy := provenanceFrom(ctx)
|
||||
if serr := api.StampProvenanceFile(s.brainDir, res.Path, origin, writtenBy); serr != nil {
|
||||
if werr := os.WriteFile(target.Abs, prior, 0o644); werr != nil {
|
||||
// Say exactly what state the note is in: edited, unverified.
|
||||
return nil, fmt.Errorf("stamp provenance failed (%v) AND the edit could NOT be rolled back: %w; "+
|
||||
"%s carries the edit under its previous attribution", serr, werr, res.Path)
|
||||
}
|
||||
return nil, fmt.Errorf("edit rolled back, stamp provenance: %w", serr)
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
// brainEditRoot edits a governance file (CLAUDE.md). De-surfaced AND gated on
|
||||
// the authenticated principal: only the static local-CLI token may call it, so
|
||||
@@ -214,20 +179,6 @@ func (s *Server) editWithScope(args json.RawMessage, scope notes.Scope) (notes.R
|
||||
if err := json.Unmarshal(args, &a); err != nil {
|
||||
return notes.Result{}, nil, fmt.Errorf("parse args: %w", err)
|
||||
}
|
||||
|
||||
// hyperguild#123: brain_write/brain_update both validate the claim
|
||||
// envelope before writing (hyperguild#111: "same rules when a note
|
||||
// changes as when it's born"); brain_edit didn't — a byte-level string
|
||||
// replace has no frontmatter awareness at all, so it could rewrite an
|
||||
// existing half_life:/applies:/claim_provenance: line straight past the
|
||||
// validator entirely. Scoped to notes only (governance files have no
|
||||
// claim-envelope concept).
|
||||
if scope == notes.ScopeNotes {
|
||||
if verr := checkClaimEnvelope(s.brainDir, a.Path, a.OldStr, a.NewStr); verr != nil {
|
||||
return notes.Result{}, nil, fmt.Errorf("claim envelope: %w", verr)
|
||||
}
|
||||
}
|
||||
|
||||
res, err := notes.Edit(s.brainDir, a.Path, a.OldStr, a.NewStr, scope)
|
||||
if err != nil {
|
||||
if errors.Is(err, notes.ErrDegenerate) && a.OldStr == "" {
|
||||
@@ -277,156 +228,3 @@ func touchesFrontmatter(oldStr, newStr string) bool {
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// checkClaimEnvelope previews what old_str->new_str would produce — the
|
||||
// exact strings.Replace(before, oldStr, newStr, 1) formula notes.Edit
|
||||
// itself uses internally — and validates the resulting frontmatter's claim
|
||||
// envelope before the real edit is allowed to run. Fail-closed: an invalid
|
||||
// result blocks the edit entirely, the same posture writeHallNote/UpdateNote
|
||||
// already apply on create/supersede.
|
||||
//
|
||||
// Gated on old_str appearing within the note's frontmatter BLOCK, not on
|
||||
// old_str/new_str mentioning a claim-envelope field NAME — found in review:
|
||||
// a field-name-substring gate misses a value-only edit like
|
||||
// "asserted"->"guessed" on a claim_provenance line, which never mentions
|
||||
// the field name at all. That is exactly the shape of edit a minimal,
|
||||
// natural diff produces, so a field-name gate was closing the issue in
|
||||
// name only. Checking block containment instead means any edit that
|
||||
// couldn't possibly touch the frontmatter (its target text only exists in
|
||||
// the body) is still skipped cheaply, while nothing inside the fence can
|
||||
// slip through unvalidated regardless of which token it targets.
|
||||
//
|
||||
// This does not replicate notes.Edit's uniqueness/CRLF/conflict-marker
|
||||
// checks — if old_str is absent or ambiguous, this preview may not match
|
||||
// what Edit ultimately does, but Edit independently and correctly rejects
|
||||
// those cases at write time regardless of what this function decides, so
|
||||
// the only thing riding on this preview's accuracy is the envelope check
|
||||
// itself, not write safety.
|
||||
// checkClaimEnvelope previews what old_str->new_str would produce and
|
||||
// validates the resulting claim envelope before the real edit runs
|
||||
// (hyperguild#123). Seven review rounds closed every plausible bypass in the
|
||||
// fence-detection family (field-name substring, block-containment,
|
||||
// fence-stripping, CRLF, UTF-8 BOM) and the first instance of a
|
||||
// value-extraction gap (a folded YAML block scalar hiding a value behind an
|
||||
// empty inline colon).
|
||||
//
|
||||
// Known, accepted v1 gap: frontmatterScalars's block-scalar fold is a
|
||||
// best-effort approximation, not a YAML parser — a blank line interrupting a
|
||||
// folded continuation, or other contrived multi-line YAML shapes not yet
|
||||
// probed (block-scalar indicators `|`/`>`, inline comments on a key line,
|
||||
// quoted multi-line values), can still hide an invalid value from
|
||||
// ValidateEnvelope. Accepted deliberately rather than chased indefinitely:
|
||||
// every bypass found so far requires the caller to already hold brain_edit
|
||||
// write access and to deliberately construct a specific malformed-YAML shape
|
||||
// with knowledge of this exact gap — a narrow, low-likelihood threat next to
|
||||
// the diminishing returns of another incremental patch round. The real fix
|
||||
// (a shared, tested, encoding-normalized frontmatter parser used by all
|
||||
// three independent implementations in this codebase) is tracked separately
|
||||
// as hyperguild#138, not bolted on here piece by piece.
|
||||
func checkClaimEnvelope(brainDir, path, oldStr, newStr string) error {
|
||||
if oldStr == "" {
|
||||
// hyperguild#115: strings.Replace treats "" as matching position 0,
|
||||
// which would make an empty old_str look like an edit that inserts
|
||||
// text before the fence — a degenerate-input case that belongs to
|
||||
// notes.Edit's own "old_str is empty" refusal, not to the envelope
|
||||
// check.
|
||||
return nil
|
||||
}
|
||||
before, err := notes.Read(brainDir, path)
|
||||
if err != nil {
|
||||
// Let notes.Edit itself produce the real error (missing file, etc.)
|
||||
// — this function's job is the envelope, not read failures.
|
||||
return nil
|
||||
}
|
||||
// No gate on where old_str falls relative to the frontmatter fence:
|
||||
// round 2 found that requiring old_str to be fully contained in the
|
||||
// extracted block was itself bypassable by an old_str disambiguated
|
||||
// across the closing "---" into the body. Simpler and bypass-proof:
|
||||
// always compute what the edit would produce and validate that
|
||||
// resulting state's envelope. A body-only edit leaves the frontmatter
|
||||
// (and thus the validation outcome) unchanged, so this is a no-op for
|
||||
// the common case and fail-closed for every case that touches the
|
||||
// envelope, regardless of how old_str is phrased.
|
||||
_, hadFence := frontmatterBlock(string(before))
|
||||
after := strings.Replace(string(before), oldStr, newStr, 1)
|
||||
_, hasFence := frontmatterBlock(after)
|
||||
if hadFence && !hasFence {
|
||||
// Round 3: an edit that drops the closing fence degrades `after`
|
||||
// to "unfenced" — frontmatterScalars then sees an empty map and
|
||||
// ValidateEnvelope({}) is nil by design (absent fields are valid),
|
||||
// so an invalid value would otherwise land with zero error while
|
||||
// also corrupting the note's structure. A previously-fenced note
|
||||
// must stay fenced, full stop.
|
||||
return fmt.Errorf("edit would remove the frontmatter fence")
|
||||
}
|
||||
return claim.ValidateEnvelope(frontmatterScalars(after))
|
||||
}
|
||||
|
||||
// frontmatterBlock returns the raw text between doc's opening and closing
|
||||
// `---` fences, or ok=false if doc has no (properly closed) fence.
|
||||
func frontmatterBlock(doc string) (block string, ok bool) {
|
||||
// hyperguild#138: fence detection itself is frontmatter.Split, shared
|
||||
// with internal/api and internal/frontmatter — the CRLF/BOM guards that
|
||||
// used to live here (added piecemeal across rounds 4 and 5 of #123's
|
||||
// review) are now the shared parser's job, so every caller inherits a
|
||||
// fix instead of needing bug-for-bug parity edits.
|
||||
b, _, ok := frontmatter.Split([]byte(doc))
|
||||
if !ok {
|
||||
return "", false
|
||||
}
|
||||
// Split's block keeps the "\n" immediately before the closing fence
|
||||
// (by design — see its own doc comment); this function never included
|
||||
// it. Split guarantees ok=true only when "\n---\n" matched, so this is
|
||||
// always exactly one byte, never ambiguous.
|
||||
return strings.TrimSuffix(string(b), "\n"), true
|
||||
}
|
||||
|
||||
// frontmatterScalars extracts top-level "key: value" scalar pairs from
|
||||
// doc's leading fence block, for the claim-envelope check only — not a
|
||||
// general frontmatter parser. Indented lines (YAML block-list items,
|
||||
// wrapped values) are skipped rather than misparsed as keys, same fix as
|
||||
// hyperguild#126/#128 in the sibling packages this mirrors.
|
||||
func frontmatterScalars(doc string) map[string]string {
|
||||
out := map[string]string{}
|
||||
block, ok := frontmatterBlock(doc)
|
||||
if !ok {
|
||||
return out
|
||||
}
|
||||
lines := strings.Split(block, "\n")
|
||||
for i := 0; i < len(lines); i++ {
|
||||
line := lines[i]
|
||||
if line != "" && (line[0] == ' ' || line[0] == '\t') {
|
||||
continue
|
||||
}
|
||||
key, val, ok := strings.Cut(line, ":")
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
val = strings.TrimSpace(val)
|
||||
if val == "" {
|
||||
// Round 6: a colon with nothing after it is ambiguous — it can
|
||||
// be a genuinely empty/omitted value, or the start of a YAML
|
||||
// block scalar whose real value lives on the indented
|
||||
// continuation line(s) that follow (e.g. "half_life:\n
|
||||
// durable"). Treating the latter as absent let an edit smuggle
|
||||
// an invalid value straight past ValidateEnvelope: the field
|
||||
// read as unset while the disk actually carried a value. Fold
|
||||
// the continuation in as a best-effort join so oneOf() still
|
||||
// sees it. A genuinely empty value (no indented line follows)
|
||||
// still folds to "", preserving present()'s existing
|
||||
// placeholder-not-assertion contract.
|
||||
var cont []string
|
||||
for i+1 < len(lines) {
|
||||
next := lines[i+1]
|
||||
if next == "" || (next[0] != ' ' && next[0] != '\t') {
|
||||
break
|
||||
}
|
||||
cont = append(cont, strings.TrimSpace(next))
|
||||
i++
|
||||
}
|
||||
val = strings.Join(cont, " ")
|
||||
}
|
||||
out[strings.TrimSpace(key)] = val
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
@@ -66,11 +66,8 @@ func TestBrainReadAndEdit_RoundTripThroughJSONRPC(t *testing.T) {
|
||||
|
||||
got, err := os.ReadFile(filepath.Join(dir, "wiki/homelab/facts/n.md"))
|
||||
require.NoError(t, err)
|
||||
// Only the matched bytes change in the body; the one deliberate addition
|
||||
// is the editor's provenance stamp (hyperguild#145 — no principal here,
|
||||
// so origin: unknown).
|
||||
assert.Equal(t, "---\ntitle: 'n'\norigin: unknown\n---\n\nalpha\nBETA\n", string(got),
|
||||
"only the matched bytes and the provenance stamp may change")
|
||||
assert.Equal(t, "---\ntitle: 'n'\n---\n\nalpha\nBETA\n", string(got),
|
||||
"only the matched bytes may change")
|
||||
}
|
||||
|
||||
func TestBrainEdit_EmptyOldStrErrorNamesRawArgumentBytes(t *testing.T) {
|
||||
@@ -96,243 +93,6 @@ func TestBrainEdit_EmptyOldStrErrorNamesRawArgumentBytes(t *testing.T) {
|
||||
assert.Contains(t, errMsg, "raw arguments were", "%v", errMsg)
|
||||
}
|
||||
|
||||
func TestBrainEdit_RejectsAnInvalidClaimEnvelopeWrittenViaStringReplace(t *testing.T) {
|
||||
// hyperguild#123: brain_write/brain_update both validate the claim
|
||||
// envelope (half_life/applies/claim_provenance) before writing —
|
||||
// brain_edit didn't, even though it's the one live, model-facing path
|
||||
// that can rewrite an existing envelope line directly via raw string
|
||||
// replace, no parsing involved. "same rules when a note changes as when
|
||||
// it's born" (hyperguild#111's own framing) applies here too.
|
||||
dir := newBrainRepo(t)
|
||||
note := filepath.Join(dir, "wiki/homelab/facts/n.md")
|
||||
require.NoError(t, os.WriteFile(note,
|
||||
[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
|
||||
srv := mcp.NewServer(dir, nil, nil, nil)
|
||||
|
||||
resp := call(t, srv, "brain_edit", map[string]any{
|
||||
"path": "wiki/homelab/facts/n.md", "old_str": "claim_provenance: asserted", "new_str": "claim_provenance: guessed",
|
||||
})
|
||||
require.Contains(t, resp, "error", "%v", resp)
|
||||
|
||||
got, err := os.ReadFile(note)
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, string(got), "claim_provenance: asserted", "rejected edit must leave the note byte-identical")
|
||||
}
|
||||
|
||||
func TestBrainEdit_RejectsAValueOnlyEditThatBreaksTheEnvelope(t *testing.T) {
|
||||
// Found in review: the original gate (touchesClaimEnvelope) checked
|
||||
// whether old_str/new_str mention the FIELD NAME — but a minimal diff
|
||||
// (the natural shape of any real edit, model-generated or human) can
|
||||
// target just the VALUE token and never mention the field name at all.
|
||||
// "asserted" -> "guessed" on a claim_provenance line walked straight
|
||||
// past the field-name substring check and wrote an invalid enum value
|
||||
// with no error — the exact bypass #123 was supposed to close, closed
|
||||
// in name only.
|
||||
dir := newBrainRepo(t)
|
||||
note := filepath.Join(dir, "wiki/homelab/facts/n.md")
|
||||
require.NoError(t, os.WriteFile(note,
|
||||
[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
|
||||
srv := mcp.NewServer(dir, nil, nil, nil)
|
||||
|
||||
resp := call(t, srv, "brain_edit", map[string]any{
|
||||
"path": "wiki/homelab/facts/n.md", "old_str": "asserted", "new_str": "guessed",
|
||||
})
|
||||
require.Contains(t, resp, "error", "%v", resp)
|
||||
|
||||
got, err := os.ReadFile(note)
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, string(got), "claim_provenance: asserted", "rejected edit must leave the note byte-identical")
|
||||
}
|
||||
|
||||
func TestBrainEdit_RejectsAnOldStrThatCrossesTheClosingFence(t *testing.T) {
|
||||
// Found in round-2 review: the position-based gate required old_str to
|
||||
// be fully CONTAINED in the extracted frontmatter block (which excludes
|
||||
// both "---" fence lines). An old_str disambiguated by extending past
|
||||
// the closing fence into the body — a natural choice, since notes.Edit
|
||||
// requires old_str to be unique in the file — fails that containment
|
||||
// test, so checkClaimEnvelope skips validation entirely while
|
||||
// notes.Edit still applies the replace verbatim. Same invalid-enum
|
||||
// outcome as the original two bypasses, reached a third way.
|
||||
dir := newBrainRepo(t)
|
||||
note := filepath.Join(dir, "wiki/homelab/facts/n.md")
|
||||
require.NoError(t, os.WriteFile(note,
|
||||
[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
|
||||
srv := mcp.NewServer(dir, nil, nil, nil)
|
||||
|
||||
resp := call(t, srv, "brain_edit", map[string]any{
|
||||
"path": "wiki/homelab/facts/n.md",
|
||||
"old_str": "asserted\n---\n\nbody",
|
||||
"new_str": "guessed\n---\n\nbody",
|
||||
})
|
||||
require.Contains(t, resp, "error", "%v", resp)
|
||||
|
||||
got, err := os.ReadFile(note)
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, string(got), "claim_provenance: asserted", "rejected edit must leave the note byte-identical")
|
||||
}
|
||||
|
||||
func TestBrainEdit_RejectsAnEditThatRemovesTheClosingFence(t *testing.T) {
|
||||
// Found in round-3 review: checkClaimEnvelope always validates the
|
||||
// resulting frontmatter of `after` — but an edit whose new_str drops
|
||||
// the closing "---" degrades `after` to "unfenced" in the same call.
|
||||
// frontmatterBlock(after) then returns ok=false, frontmatterScalars
|
||||
// returns an empty map, and claim.ValidateEnvelope({}) is nil by
|
||||
// design (absent fields are valid) — so an invalid enum value lands on
|
||||
// disk with zero error, and the note is left permanently unfenced.
|
||||
// Structural fix: a note that had a valid fence before the edit must
|
||||
// still have one after, or the edit is rejected outright.
|
||||
dir := newBrainRepo(t)
|
||||
note := filepath.Join(dir, "wiki/homelab/facts/n.md")
|
||||
require.NoError(t, os.WriteFile(note,
|
||||
[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
|
||||
srv := mcp.NewServer(dir, nil, nil, nil)
|
||||
|
||||
resp := call(t, srv, "brain_edit", map[string]any{
|
||||
"path": "wiki/homelab/facts/n.md",
|
||||
"old_str": "claim_provenance: asserted\n---\n",
|
||||
"new_str": "claim_provenance: not-a-real-value\n",
|
||||
})
|
||||
require.Contains(t, resp, "error", "%v", resp)
|
||||
|
||||
got, err := os.ReadFile(note)
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, string(got), "claim_provenance: asserted\n---\n", "rejected edit must leave the note byte-identical, fence intact")
|
||||
}
|
||||
|
||||
func TestBrainEdit_RejectsAnInvalidEnvelopeOnACRLFFencedNote(t *testing.T) {
|
||||
// Found in round-4 review: frontmatterBlock's fence detection matches
|
||||
// the literal byte sequence "---\n" / "\n---\n". A note whose fence
|
||||
// lines use CRLF ("---\r\n") fails strings.HasPrefix(doc, "---\n") on
|
||||
// the BEFORE read, so hadFence is false — not because the fence is
|
||||
// missing, but because \r sits in front of every \n. hadFence&&!hasFence
|
||||
// can then never fire, frontmatterScalars falls back to an empty map,
|
||||
// and claim.ValidateEnvelope({}) is nil by design. No adversarial
|
||||
// old_str/new_str crafting needed: encoding alone silently disables the
|
||||
// whole envelope check for this note. Zero CRLF-fenced notes exist in
|
||||
// the live corpus today, but nothing in the code prevents one.
|
||||
dir := newBrainRepo(t)
|
||||
note := filepath.Join(dir, "wiki/homelab/facts/n.md")
|
||||
require.NoError(t, os.WriteFile(note,
|
||||
[]byte("---\r\ntitle: 'n'\r\nhalf_life: durable\r\napplies: universal\r\nclaim_provenance: asserted\r\n---\r\n\r\nbody\r\n"), 0o644))
|
||||
srv := mcp.NewServer(dir, nil, nil, nil)
|
||||
|
||||
resp := call(t, srv, "brain_edit", map[string]any{
|
||||
"path": "wiki/homelab/facts/n.md", "old_str": "asserted", "new_str": "guessed",
|
||||
})
|
||||
require.Contains(t, resp, "error", "%v", resp)
|
||||
|
||||
got, err := os.ReadFile(note)
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, string(got), "claim_provenance: asserted", "rejected edit must leave the note byte-identical")
|
||||
}
|
||||
|
||||
func TestBrainEdit_RejectsAnInvalidEnvelopeOnABOMPrefixedNote(t *testing.T) {
|
||||
// Found in round-5 review: the same "encoding property empties
|
||||
// frontmatterScalars's map" mechanism as the CRLF bypass, one layer
|
||||
// earlier — a leading UTF-8 BOM (EF BB BF) defeats
|
||||
// strings.HasPrefix(doc, "---\n") exactly like CRLF did, before that
|
||||
// prefix is even reached. Notepad's default "UTF-8" save and
|
||||
// PowerShell's pre-v6 Out-File/Set-Content both emit a BOM, so this is
|
||||
// a live, plausible authoring path, not an exotic one — same severity
|
||||
// and same one-line cost as the CRLF fix, fixed the same way rather
|
||||
// than deferred to hyperguild#138.
|
||||
dir := newBrainRepo(t)
|
||||
note := filepath.Join(dir, "wiki/homelab/facts/n.md")
|
||||
require.NoError(t, os.WriteFile(note,
|
||||
[]byte("\xef\xbb\xbf---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
|
||||
srv := mcp.NewServer(dir, nil, nil, nil)
|
||||
|
||||
resp := call(t, srv, "brain_edit", map[string]any{
|
||||
"path": "wiki/homelab/facts/n.md", "old_str": "asserted", "new_str": "guessed",
|
||||
})
|
||||
require.Contains(t, resp, "error", "%v", resp)
|
||||
|
||||
got, err := os.ReadFile(note)
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, string(got), "claim_provenance: asserted", "rejected edit must leave the note byte-identical")
|
||||
}
|
||||
|
||||
func TestBrainEdit_RejectsAFoldedScalarThatHidesAnInvalidValue(t *testing.T) {
|
||||
// Found in round-6 review: a different mechanism from the encoding
|
||||
// family (rounds 1-6 were all about fence detection; this is the field
|
||||
// extractor). old_str="half_life: durable", new_str="half_life:\n
|
||||
// garbage-value" turns the field into a YAML block-scalar shape: the
|
||||
// top-level line is now "half_life:" with an empty inline value, and
|
||||
// the real value lives on the indented continuation line that follows.
|
||||
// frontmatterScalars's indentation guard skips that continuation line
|
||||
// outright, so the field reads as present-with-empty-value —
|
||||
// present()'s own contract then treats that as absent (a placeholder,
|
||||
// not an assertion) — and claim.ValidateEnvelope never sees the
|
||||
// invalid value at all. No encoding quirk needed: one ordinary
|
||||
// brain_edit call smuggles an out-of-enum value straight past the
|
||||
// check the field was supposed to be validated by.
|
||||
dir := newBrainRepo(t)
|
||||
note := filepath.Join(dir, "wiki/homelab/facts/n.md")
|
||||
require.NoError(t, os.WriteFile(note,
|
||||
[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
|
||||
srv := mcp.NewServer(dir, nil, nil, nil)
|
||||
|
||||
resp := call(t, srv, "brain_edit", map[string]any{
|
||||
"path": "wiki/homelab/facts/n.md",
|
||||
"old_str": "half_life: durable",
|
||||
"new_str": "half_life:\n garbage-value",
|
||||
})
|
||||
require.Contains(t, resp, "error", "%v", resp)
|
||||
|
||||
got, err := os.ReadFile(note)
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, string(got), "half_life: durable", "rejected edit must leave the note byte-identical")
|
||||
}
|
||||
|
||||
func TestBrainEdit_AllowsAValidClaimEnvelopeEdit(t *testing.T) {
|
||||
dir := newBrainRepo(t)
|
||||
note := filepath.Join(dir, "wiki/homelab/facts/n.md")
|
||||
require.NoError(t, os.WriteFile(note,
|
||||
[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
|
||||
srv := mcp.NewServer(dir, nil, nil, nil)
|
||||
|
||||
resp := call(t, srv, "brain_edit", map[string]any{
|
||||
"path": "wiki/homelab/facts/n.md", "old_str": "half_life: durable", "new_str": "half_life: seasonal",
|
||||
})
|
||||
require.NotContains(t, resp, "error", "%v", resp)
|
||||
|
||||
got, err := os.ReadFile(note)
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, string(got), "half_life: seasonal")
|
||||
}
|
||||
|
||||
func TestBrainEdit_UnrelatedEditsSkipTheEnvelopeCheckEntirely(t *testing.T) {
|
||||
// The gate only engages when old_str/new_str actually mention an
|
||||
// envelope field name — an ordinary body edit on a note that happens to
|
||||
// carry a valid envelope must not pay for (or be affected by) a check
|
||||
// that has nothing to do with it.
|
||||
dir := newBrainRepo(t)
|
||||
note := filepath.Join(dir, "wiki/homelab/facts/n.md")
|
||||
require.NoError(t, os.WriteFile(note,
|
||||
[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nold body\n"), 0o644))
|
||||
srv := mcp.NewServer(dir, nil, nil, nil)
|
||||
|
||||
resp := call(t, srv, "brain_edit", map[string]any{
|
||||
"path": "wiki/homelab/facts/n.md", "old_str": "old body", "new_str": "new body",
|
||||
})
|
||||
require.NotContains(t, resp, "error", "%v", resp)
|
||||
|
||||
got, err := os.ReadFile(note)
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, string(got), "new body")
|
||||
}
|
||||
|
||||
func TestBrainEditRoot_GovernanceFilesAreNeverEnvelopeChecked(t *testing.T) {
|
||||
// CLAUDE.md has no claim-envelope concept at all — the check must be
|
||||
// scoped to notes (ScopeNotes), never applied on the governance path.
|
||||
srv, _, _, _ := govServer(t)
|
||||
|
||||
resp := authCall(t, srv, "Bearer "+capStaticTok, "brain_edit_root", map[string]any{
|
||||
"path": "CLAUDE.md", "old_str": "# rules", "new_str": "half_life: durable",
|
||||
})
|
||||
require.NotContains(t, resp, "error", "%v", resp)
|
||||
}
|
||||
|
||||
func TestBrainEdit_RefusesGovernanceFilesFromTheModelFacingTool(t *testing.T) {
|
||||
dir := newBrainRepo(t)
|
||||
srv := mcp.NewServer(dir, nil, nil, nil)
|
||||
|
||||
@@ -5,7 +5,6 @@ import (
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"fmt"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
@@ -72,18 +71,14 @@ func ReadScoped(brainDir, path string, scope Scope) ([]byte, error) {
|
||||
}
|
||||
|
||||
func readContained(t Target) ([]byte, error) {
|
||||
// Through the brain root, regular files only, size checked on the opened
|
||||
// handle (hyperguild#157): Resolve's Lstat could be raced by a swap, and
|
||||
// os.ReadFile blocked on a FIFO.
|
||||
bfs, err := brainfs.Open(t.Brain)
|
||||
fi, err := os.Stat(t.Abs)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("notes: %w", err)
|
||||
return nil, fmt.Errorf("notes: stat %s: %w", t.Rel, err)
|
||||
}
|
||||
defer func() { _ = bfs.Close() }()
|
||||
b, err := bfs.ReadRegularMax(t.Rel, maxNoteBytes)
|
||||
if errors.Is(err, brainfs.ErrTooLarge) {
|
||||
return nil, fmt.Errorf("%w: %s (limit %d)", ErrTooLarge, t.Rel, maxNoteBytes)
|
||||
if fi.Size() > maxNoteBytes {
|
||||
return nil, fmt.Errorf("%w: %s is %d bytes (limit %d)", ErrTooLarge, t.Rel, fi.Size(), maxNoteBytes)
|
||||
}
|
||||
b, err := os.ReadFile(t.Abs)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("notes: read %s: %w", t.Rel, err)
|
||||
}
|
||||
|
||||
@@ -60,7 +60,6 @@ var (
|
||||
type Target struct {
|
||||
Rel string // brain-relative, cleaned
|
||||
Abs string // absolute, symlink-checked
|
||||
Brain string // the brain root Rel is relative to
|
||||
}
|
||||
|
||||
// Resolve canonicalises path, then checks it against the scope's allowlist,
|
||||
@@ -110,7 +109,7 @@ func Resolve(brainDir, path string, scope Scope) (Target, error) {
|
||||
return Target{}, err
|
||||
}
|
||||
|
||||
return Target{Rel: clean, Abs: abs, Brain: brainDir}, nil
|
||||
return Target{Rel: clean, Abs: abs}, nil
|
||||
}
|
||||
|
||||
// allow enforces the scope's allowlist. The two scopes are DISJOINT, not
|
||||
|
||||
@@ -1,40 +0,0 @@
|
||||
package notes
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs/brainfstest"
|
||||
)
|
||||
|
||||
// hyperguild#157 slice 2: ReadScoped (brain_read) Lstat-checked the final
|
||||
// component, then reopened by name with os.ReadFile: a swap after the check
|
||||
// was followed, and a FIFO blocked the read. It now reads through brainfs.
|
||||
func TestReadScopedRefusesSymlinksAndSurvivesSwapRaces(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
facts := filepath.Join(brain, "wiki", "w", "facts")
|
||||
require.NoError(t, os.MkdirAll(facts, 0o755))
|
||||
p := filepath.Join(facts, "r.md")
|
||||
read := func() string {
|
||||
b, _ := ReadScoped(brain, "wiki/w/facts/r.md", ScopeNotes)
|
||||
return string(b)
|
||||
}
|
||||
require.NoError(t, os.WriteFile(p, []byte("inside"), 0o644))
|
||||
assert.Equal(t, "inside", read())
|
||||
brainfstest.AssertNoLeak(t, p, "inside", 1500*time.Millisecond, read)
|
||||
brainfstest.AssertNoHang(t, p, "inside", 1500*time.Millisecond, 6*time.Second, func() { _ = read() })
|
||||
}
|
||||
|
||||
func TestReadScopedRefusesANoteOverMaxNoteBytes(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
facts := filepath.Join(brain, "wiki", "w", "facts")
|
||||
require.NoError(t, os.MkdirAll(facts, 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(facts, "big.md"), make([]byte, maxNoteBytes+1), 0o644))
|
||||
_, err := ReadScoped(brain, "wiki/w/facts/big.md", ScopeNotes)
|
||||
assert.ErrorIs(t, err, ErrTooLarge)
|
||||
}
|
||||
@@ -3,7 +3,6 @@ package pipeline
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"regexp"
|
||||
"strings"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/wiki"
|
||||
@@ -17,12 +16,6 @@ func BuildPages(rawPages []RawPage, sourceSlug, date string) ([]wiki.Page, []str
|
||||
out := make([]wiki.Page, 0, len(rawPages))
|
||||
var warnings []string
|
||||
for _, rp := range rawPages {
|
||||
// The type becomes a directory under wiki/; "../raw" wrote outside it
|
||||
// (PR #147 review). Only a plain lower-case name is a page type.
|
||||
if !validPageType.MatchString(rp.Type) {
|
||||
warnings = append(warnings, fmt.Sprintf("skipped page with invalid type %q", rp.Type))
|
||||
continue
|
||||
}
|
||||
slug := computeSlug(rp, sourceSlug)
|
||||
if slug == "" {
|
||||
warnings = append(warnings, fmt.Sprintf("skipped page with empty title (type: %s)", rp.Type))
|
||||
@@ -33,8 +26,6 @@ func BuildPages(rawPages []RawPage, sourceSlug, date string) ([]wiki.Page, []str
|
||||
return out, warnings
|
||||
}
|
||||
|
||||
var validPageType = regexp.MustCompile(`^[a-z][a-z0-9-]*$`)
|
||||
|
||||
func computeSlug(rp RawPage, sourceSlug string) string {
|
||||
if rp.Type == "source" {
|
||||
return sourceSlug
|
||||
@@ -123,9 +114,5 @@ func buildFrontmatter(rp RawPage, date string) string {
|
||||
}
|
||||
|
||||
func yamlScalar(s string) string {
|
||||
// A raw newline or CR would end the scalar for every line-oriented
|
||||
// frontmatter reader and start a new key (PR #147 review: a title of
|
||||
// "x\norigin: static" forged provenance). Fold all line breaks to spaces.
|
||||
s = strings.NewReplacer("\r\n", " ", "\r", " ", "\n", " ").Replace(s)
|
||||
return "'" + strings.ReplaceAll(s, "'", "''") + "'"
|
||||
}
|
||||
|
||||
@@ -11,7 +11,6 @@ import (
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/provenance"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/wiki"
|
||||
)
|
||||
|
||||
@@ -63,20 +62,13 @@ func Run(ctx context.Context, cfg Config, brainDir, content, source string, dryR
|
||||
}}, nil
|
||||
}
|
||||
|
||||
// The source's own page path is deterministic (sourceSlug, computed above)
|
||||
// even before extraction runs, unlike a concept/entity page's path, which
|
||||
// only exists once the model has produced a title. So page-aware
|
||||
// extraction (#106) is scoped to the source page: it's the one page every
|
||||
// chunk's prompt can be given in advance.
|
||||
existingPage := readSourcePage(brainDir, sourceSlug)
|
||||
|
||||
chunks := Chunk(content, cfg.ChunkSize)
|
||||
|
||||
var allRaw []RawPage
|
||||
var allWarnings []string
|
||||
|
||||
for _, chunk := range chunks {
|
||||
userPrompt := BuildPrompt(schema, source, chunk, inventory, existingPage)
|
||||
userPrompt := BuildPrompt(schema, source, chunk, inventory)
|
||||
output, err := cfg.Complete(ctx, systemPrompt, userPrompt)
|
||||
if err != nil {
|
||||
return Result{}, fmt.Errorf("LLM call: %w", err)
|
||||
@@ -90,17 +82,13 @@ func Run(ctx context.Context, cfg Config, brainDir, content, source string, dryR
|
||||
meta.BodyHash = bodyHash
|
||||
applySourceMeta(allRaw, meta)
|
||||
|
||||
return buildAndWrite(ctx, allRaw, sourceSlug, date, brainDir, source, inventory, allWarnings, dryRun)
|
||||
return buildAndWrite(allRaw, sourceSlug, date, brainDir, source, inventory, allWarnings, dryRun)
|
||||
}
|
||||
|
||||
// RunRaw runs the pipeline on pre-parsed RawPages, skipping the LLM extraction
|
||||
// step. Use this when the caller has already produced the structured RawPage data
|
||||
// (e.g. from a more capable model or manual curation).
|
||||
//
|
||||
// Every page written is stamped with provenance.FromContext(ctx)
|
||||
// (hyperguild#145); a caller that knows the principal attaches it with
|
||||
// provenance.WithStamp, everyone else stamps origin: unknown.
|
||||
func RunRaw(ctx context.Context, brainDir, source string, rawPages []RawPage, dryRun bool) (Result, error) {
|
||||
func RunRaw(brainDir, source string, rawPages []RawPage, dryRun bool) (Result, error) {
|
||||
inventory, err := wiki.LoadInventory(brainDir)
|
||||
if err != nil {
|
||||
return Result{}, fmt.Errorf("load inventory: %w", err)
|
||||
@@ -109,11 +97,11 @@ func RunRaw(ctx context.Context, brainDir, source string, rawPages []RawPage, dr
|
||||
sourceSlug := wiki.Slug(source)
|
||||
date := time.Now().UTC().Format("2006-01-02")
|
||||
|
||||
return buildAndWrite(ctx, rawPages, sourceSlug, date, brainDir, source, inventory, nil, dryRun)
|
||||
return buildAndWrite(rawPages, sourceSlug, date, brainDir, source, inventory, nil, dryRun)
|
||||
}
|
||||
|
||||
// buildAndWrite runs BuildPages through write for both Run and RunRaw.
|
||||
func buildAndWrite(ctx context.Context, rawPages []RawPage, sourceSlug, date, brainDir, source string, inventory map[wiki.PageType][]wiki.Entry, warnings []string, dryRun bool) (Result, error) {
|
||||
func buildAndWrite(rawPages []RawPage, sourceSlug, date, brainDir, source string, inventory map[wiki.PageType][]wiki.Entry, warnings []string, dryRun bool) (Result, error) {
|
||||
pages, buildWarnings := BuildPages(rawPages, sourceSlug, date)
|
||||
warnings = append(warnings, buildWarnings...)
|
||||
resolved := Resolve(pages, inventory)
|
||||
@@ -129,25 +117,11 @@ func buildAndWrite(ctx context.Context, rawPages []RawPage, sourceSlug, date, br
|
||||
if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
|
||||
return Result{}, fmt.Errorf("mkdir for %s: %w", page.Path, err)
|
||||
}
|
||||
content, conflicts, err := reviseOrCreate(dest, page)
|
||||
content, err := reviseOrCreate(dest, page)
|
||||
if err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
for _, heading := range conflicts {
|
||||
// Reported, not resolved. The on-disk version stands; whether
|
||||
// the disagreement is a genuine contradiction is the
|
||||
// Judge-gated enrich pass's call, not the write path's.
|
||||
warnings = append(warnings, fmt.Sprintf(
|
||||
"%s: source now disagrees on section %q — on-disk version kept",
|
||||
page.Path, heading))
|
||||
}
|
||||
// Stamped as the last step, after merge/revise, so a page that
|
||||
// was merged into is re-attributed to this ingest too.
|
||||
stamped, err := provenance.Apply(content, provenance.FromContext(ctx))
|
||||
if err != nil {
|
||||
return Result{}, fmt.Errorf("stamp %s: %w", page.Path, err)
|
||||
}
|
||||
if err := os.WriteFile(dest, []byte(stamped), 0o644); err != nil {
|
||||
if err := os.WriteFile(dest, []byte(content), 0o644); err != nil {
|
||||
return Result{}, fmt.Errorf("write %s: %w", page.Path, err)
|
||||
}
|
||||
}
|
||||
@@ -186,16 +160,6 @@ func hashBody(content string) string {
|
||||
return hex.EncodeToString(sum[:])
|
||||
}
|
||||
|
||||
// readSourcePage returns the full on-disk content of the source page at
|
||||
// wiki/sources/<sourceSlug>.md, or "" when it doesn't exist yet.
|
||||
func readSourcePage(brainDir, sourceSlug string) string {
|
||||
raw, err := os.ReadFile(filepath.Join(brainDir, "wiki", "sources", sourceSlug+".md"))
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
return string(raw)
|
||||
}
|
||||
|
||||
// storedSourceHash reads source_hash from the source page a previous ingest
|
||||
// wrote, or "" when there is no such page or no such field.
|
||||
//
|
||||
@@ -203,7 +167,11 @@ func readSourcePage(brainDir, sourceSlug string) string {
|
||||
// skip costs one extraction, while a wrong skip loses an update silently — and
|
||||
// silence is the failure mode this repo keeps paying for.
|
||||
func storedSourceHash(brainDir, sourceSlug string) string {
|
||||
for _, line := range strings.Split(readSourcePage(brainDir, sourceSlug), "\n") {
|
||||
raw, err := os.ReadFile(filepath.Join(brainDir, "wiki", "sources", sourceSlug+".md"))
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
for _, line := range strings.Split(string(raw), "\n") {
|
||||
if key, value, found := strings.Cut(line, ":"); found && strings.TrimSpace(key) == "source_hash" {
|
||||
return strings.TrimSpace(value)
|
||||
}
|
||||
@@ -230,16 +198,15 @@ func storedSourceHash(brainDir, sourceSlug string) string {
|
||||
// its first-ingest date on a revised page. Left deliberately — the alternative
|
||||
// is this function editing frontmatter it does not own, and no lint reads that
|
||||
// field today.
|
||||
func reviseOrCreate(dest string, page wiki.Page) (string, []string, error) {
|
||||
func reviseOrCreate(dest string, page wiki.Page) (string, error) {
|
||||
existing, err := os.ReadFile(dest)
|
||||
switch {
|
||||
case os.IsNotExist(err):
|
||||
return page.Content, nil, nil
|
||||
return page.Content, nil
|
||||
case err != nil:
|
||||
return "", nil, fmt.Errorf("read existing %s: %w", page.Path, err)
|
||||
return "", fmt.Errorf("read existing %s: %w", page.Path, err)
|
||||
}
|
||||
merged, conflicts := wiki.MergeReport(wiki.Page{Path: page.Path, Content: string(existing)}, page)
|
||||
return merged.Content, conflicts, nil
|
||||
return wiki.Merge(wiki.Page{Path: page.Path, Content: string(existing)}, page).Content, nil
|
||||
}
|
||||
|
||||
// mergeAll deduplicates pages by path, merging content from later occurrences.
|
||||
|
||||
@@ -8,7 +8,6 @@ import (
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
@@ -196,7 +195,7 @@ A book about shaping product work.
|
||||
Read this before the next planning cycle.
|
||||
`), 0o644))
|
||||
|
||||
_, err := RunRaw(context.Background(), dir, "shape-up", []RawPage{{
|
||||
_, err := RunRaw(dir, "shape-up", []RawPage{{
|
||||
Title: "Shape Up", Type: "source", Subtype: "book", Domain: "product-strategy",
|
||||
Content: "## Summary\n\nA book about shaping product work.\n\n## Key Claims\n\n- Appetite beats estimation.\n",
|
||||
}}, false)
|
||||
@@ -221,12 +220,12 @@ func TestRunRaw_ReIngestingUnchangedContentIsByteIdentical(t *testing.T) {
|
||||
Content: "## Summary\n\nA book about shaping product work.\n\n## Open Questions\n\n- Does appetite scale?\n",
|
||||
}}
|
||||
|
||||
_, err := RunRaw(context.Background(), dir, "shape-up", raw, false)
|
||||
_, err := RunRaw(dir, "shape-up", raw, false)
|
||||
require.NoError(t, err)
|
||||
first, err := os.ReadFile(filepath.Join(dir, "wiki", "sources", "shape-up.md"))
|
||||
require.NoError(t, err)
|
||||
|
||||
_, err = RunRaw(context.Background(), dir, "shape-up", raw, false)
|
||||
_, err = RunRaw(dir, "shape-up", raw, false)
|
||||
require.NoError(t, err)
|
||||
second, err := os.ReadFile(filepath.Join(dir, "wiki", "sources", "shape-up.md"))
|
||||
require.NoError(t, err)
|
||||
@@ -277,107 +276,6 @@ func TestRun_ReExtractsWhenTheSourceBodyChanged(t *testing.T) {
|
||||
assert.Equal(t, 2, calls, "changed content must be re-extracted")
|
||||
}
|
||||
|
||||
// --- #106: page-aware extraction — the model sees the page it is revising --
|
||||
|
||||
func TestRun_ExistingSourcePageIsIncludedInTheExtractionPrompt(t *testing.T) {
|
||||
// #103 made the merge asymmetric (on-disk wins); #106 is the other half —
|
||||
// the extraction itself gets to see what's already there instead of
|
||||
// producing a page blind and letting the merge reconcile it afterwards.
|
||||
// This only proves the existing page reaches the prompt; the byte-identical
|
||||
// guarantee for an echoed-back revision is a separate test below.
|
||||
dir := t.TempDir()
|
||||
for _, sub := range []string{"wiki/concepts", "wiki/entities", "wiki/sources"} {
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(dir, sub), 0o755))
|
||||
}
|
||||
|
||||
seeded := "---\ntitle: 'Shape Up'\n---\n\n## Summary\n\nA book about shaping product work.\n\n## Key Claims\n\n- Appetite beats estimation.\n"
|
||||
page := filepath.Join(dir, "wiki", "sources", "shape-up.md")
|
||||
require.NoError(t, os.WriteFile(page, []byte(seeded), 0o644))
|
||||
|
||||
var gotPrompt string
|
||||
cfg := Config{Complete: func(_ context.Context, _, user string) (string, error) {
|
||||
gotPrompt = user
|
||||
return mustJSON([]RawPage{{
|
||||
Title: "Shape Up", Type: "source", Subtype: "book",
|
||||
Content: "## Summary\n\nA book about shaping product work.\n",
|
||||
}}), nil
|
||||
}}
|
||||
|
||||
// Deliberately does not mention "Appetite beats estimation." — that phrase
|
||||
// can only reach the prompt via the existing on-disk page, not the source
|
||||
// content, so its presence proves the page was threaded through.
|
||||
content := "A short editorial update to the book's listing. No new claims here."
|
||||
_, err := Run(context.Background(), cfg, dir, content, "shape-up", false)
|
||||
require.NoError(t, err)
|
||||
|
||||
assert.Contains(t, gotPrompt, "Appetite beats estimation.",
|
||||
"the existing page's content must be visible to the extraction prompt")
|
||||
assert.Contains(t, gotPrompt, "revis", "the prompt must ask for a revision, not a fresh page")
|
||||
}
|
||||
|
||||
func TestRun_NewSourceHasNoExistingPageInThePrompt(t *testing.T) {
|
||||
// The other side of the same behavior: a source with no page on disk yet
|
||||
// must not get an "existing page" section injected into its prompt at all.
|
||||
dir := t.TempDir()
|
||||
for _, sub := range []string{"wiki/concepts", "wiki/entities", "wiki/sources"} {
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(dir, sub), 0o755))
|
||||
}
|
||||
|
||||
var gotPrompt string
|
||||
cfg := Config{Complete: func(_ context.Context, _, user string) (string, error) {
|
||||
gotPrompt = user
|
||||
return mustJSON([]RawPage{{
|
||||
Title: "New Thing", Type: "source", Subtype: "article",
|
||||
Content: "## Summary\n\nBrand new.\n",
|
||||
}}), nil
|
||||
}}
|
||||
|
||||
_, err := Run(context.Background(), cfg, dir, "Brand new content.", "new-thing", false)
|
||||
require.NoError(t, err)
|
||||
|
||||
assert.NotContains(t, gotPrompt, "Current page",
|
||||
"a source with no page on disk yet must not get a revision section in its prompt")
|
||||
}
|
||||
|
||||
func TestRun_RevisionEchoingExistingPageStaysByteIdentical(t *testing.T) {
|
||||
// The issue's explicit risk: a model given the current page will sometimes
|
||||
// echo it back verbatim. That must not duplicate content or otherwise
|
||||
// perturb the page — the deterministic merge is still the backstop.
|
||||
dir := t.TempDir()
|
||||
for _, sub := range []string{"wiki/concepts", "wiki/entities", "wiki/sources"} {
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(dir, sub), 0o755))
|
||||
}
|
||||
|
||||
seeded := "---\ntitle: 'Shape Up'\n---\n\n## Summary\n\nA book about shaping product work.\n\n## Key Claims\n\n- Appetite beats estimation.\n"
|
||||
page := filepath.Join(dir, "wiki", "sources", "shape-up.md")
|
||||
require.NoError(t, os.WriteFile(page, []byte(seeded), 0o644))
|
||||
|
||||
cfg := Config{Complete: func(_ context.Context, _, _ string) (string, error) {
|
||||
return mustJSON([]RawPage{{
|
||||
Title: "Shape Up", Type: "source", Subtype: "book",
|
||||
Content: "## Summary\n\nA book about shaping product work.\n\n## Key Claims\n\n- Appetite beats estimation.\n",
|
||||
}}), nil
|
||||
}}
|
||||
|
||||
content := "A short editorial update to the book's listing. No new claims here."
|
||||
result, err := Run(context.Background(), cfg, dir, content, "shape-up", false)
|
||||
require.NoError(t, err)
|
||||
require.False(t, result.Skipped)
|
||||
|
||||
got, err := os.ReadFile(page)
|
||||
require.NoError(t, err)
|
||||
|
||||
want := "---\ntitle: 'Shape Up'\nlast_updated: " + time.Now().UTC().Format("2006-01-02") +
|
||||
"\nsource_hash: " + hashBody(content) +
|
||||
// Every page an ingest writes carries provenance (hyperguild#145);
|
||||
// no stamp in ctx here, so origin: unknown.
|
||||
"\norigin: unknown\n---\n\n" +
|
||||
"## Summary\n\nA book about shaping product work.\n\n" +
|
||||
"## Key Claims\n\n- Appetite beats estimation.\n"
|
||||
assert.Equal(t, want, string(got),
|
||||
"a revision pass that echoes the existing page back must not duplicate or alter its content")
|
||||
}
|
||||
|
||||
func TestRun_FrontmatterOnlyChangeIsNotDrift(t *testing.T) {
|
||||
// The hash covers the body, so re-fetching a page whose metadata moved
|
||||
// (a re-crawl stamping a new date) is not treated as the source changing.
|
||||
@@ -395,34 +293,3 @@ func TestRun_FrontmatterOnlyChangeIsNotDrift(t *testing.T) {
|
||||
|
||||
assert.Equal(t, 1, calls, "only the body counts as the source")
|
||||
}
|
||||
|
||||
func TestRunRaw_ReportsWhenTheSourceDisagreesWithWhatIsOnDisk(t *testing.T) {
|
||||
// The on-disk version still wins — that is what makes unattended ingest
|
||||
// safe. But the run must say that the source now claims something else,
|
||||
// or a changed source is indistinguishable from an unchanged one.
|
||||
dir := t.TempDir()
|
||||
page := filepath.Join(dir, "wiki", "sources", "shape-up.md")
|
||||
require.NoError(t, os.MkdirAll(filepath.Dir(page), 0o755))
|
||||
require.NoError(t, os.WriteFile(page, []byte(`---
|
||||
title: 'Shape Up'
|
||||
---
|
||||
|
||||
## Summary
|
||||
|
||||
Appetite is fixed, scope is variable.
|
||||
`), 0o644))
|
||||
|
||||
res, err := RunRaw(context.Background(), dir, "shape-up", []RawPage{{
|
||||
Title: "Shape Up", Type: "source", Subtype: "book", Domain: "product",
|
||||
Content: "## Summary\n\nAppetite is negotiable and scope is fixed.\n",
|
||||
}}, false)
|
||||
require.NoError(t, err)
|
||||
|
||||
got, err := os.ReadFile(page)
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, string(got), "Appetite is fixed", "on-disk version wins")
|
||||
|
||||
joined := strings.Join(res.Warnings, " ")
|
||||
assert.Contains(t, joined, "Summary", "the disagreeing section must be named")
|
||||
assert.Contains(t, joined, "shape-up", "and the page it happened on")
|
||||
}
|
||||
|
||||
@@ -22,18 +22,8 @@ Each element must have exactly these fields:
|
||||
Wikilinks in content: [[Display Name]] — just the display name, no slug, no pipe separator.
|
||||
Only link to pages listed in the inventory or pages you are creating in this response.`
|
||||
|
||||
// BuildPrompt constructs the user prompt for a single chunk. existingPage is
|
||||
// the full current content (frontmatter + body) of the source's own wiki page
|
||||
// when one already exists on disk, or "" for a source being ingested for the
|
||||
// first time. When non-empty, the model is asked to revise that page rather
|
||||
// than write a fresh one — see hyperguild#106. The deterministic merge in
|
||||
// wiki.Merge remains the backstop regardless of what the model returns: an
|
||||
// on-disk section the model doesn't touch survives untouched, and a section
|
||||
// it does touch only takes effect where Merge's strategy allows the fresh
|
||||
// side to change anything (bullet union, append) — never for an ordinary
|
||||
// section, so the model proposing a revision is never how a page gets
|
||||
// overwritten.
|
||||
func BuildPrompt(schema, source, content string, inventory map[wiki.PageType][]wiki.Entry, existingPage string) string {
|
||||
// BuildPrompt constructs the user prompt for a single chunk.
|
||||
func BuildPrompt(schema, source, content string, inventory map[wiki.PageType][]wiki.Entry) string {
|
||||
var sb strings.Builder
|
||||
|
||||
fmt.Fprintf(&sb, "Today's date is %s.\n\n", time.Now().UTC().Format("2006-01-02"))
|
||||
@@ -59,18 +49,6 @@ func BuildPrompt(schema, source, content string, inventory map[wiki.PageType][]w
|
||||
sb.WriteString("\n")
|
||||
}
|
||||
|
||||
if existingPage != "" {
|
||||
sb.WriteString("## Current page for this source — revise it, don't restart\n\n")
|
||||
sb.WriteString("This source has already been ingested and has the wiki page shown below.\n")
|
||||
sb.WriteString("You are revising that page, not writing a fresh one:\n")
|
||||
sb.WriteString(" - Add sections or claims the source below supports that this page doesn't have yet.\n")
|
||||
sb.WriteString(" - Strengthen a claim where the source gives more detail, evidence, or nuance than what's already there.\n")
|
||||
sb.WriteString(" - Leave unchanged whatever the source doesn't affect — reuse the existing wording verbatim rather than paraphrasing it, so an unchanged claim is recognized as unchanged.\n")
|
||||
sb.WriteString(" - A merge step keeps this page's on-disk content for any section you don't return, so it's fine to omit a section you aren't revising.\n\n")
|
||||
sb.WriteString(existingPage)
|
||||
sb.WriteString("\n\n")
|
||||
}
|
||||
|
||||
sb.WriteString("## Non-negotiable rules\n\n")
|
||||
sb.WriteString("1. Output ONLY a valid JSON array — no prose, no fences.\n")
|
||||
sb.WriteString("2. Fields: title, type, subtype (if applicable), domain (if applicable), content.\n")
|
||||
|
||||
@@ -1,226 +0,0 @@
|
||||
// Package provenance stamps server-owned write provenance (hyperguild#145)
|
||||
// into a brain note's frontmatter: origin (static | jwt | unknown) and
|
||||
// written_by (the authenticated principal), so a reader can discount what a
|
||||
// connector session wrote after reading an untrusted page.
|
||||
//
|
||||
// The control is a post-condition applied by every write path a model can
|
||||
// reach. Two review rounds on PR #147 showed that deciding line by line which
|
||||
// lines are provenance loses to YAML's context-dependent features — an alias
|
||||
// key resolves only against an anchor elsewhere, and a `...` line ends the
|
||||
// document before the stamp. So Apply does not try to recognise provenance.
|
||||
// It keeps only frontmatter it can prove is plain:
|
||||
//
|
||||
// - a top-level line `key: value` whose key is a bare identifier,
|
||||
// - together with that key's continuation lines (indented, or `- ` items
|
||||
// after an empty value),
|
||||
// - where the group decodes ON ITS OWN, with yaml.v3, to a mapping with
|
||||
// exactly that one key,
|
||||
// - and the key is not origin/written_by and has not been seen before.
|
||||
//
|
||||
// Everything else — aliases, anchors used as keys, document markers, complex
|
||||
// keys, merge keys, flow maps, tags, quoted keys, duplicates — is dropped.
|
||||
// Then the stamp is appended and the whole result is decoded by yaml.v3 as a
|
||||
// backstop: if it does not decode to exactly the stamped values, Apply fails
|
||||
// and the caller refuses the write.
|
||||
package provenance
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"regexp"
|
||||
"strings"
|
||||
|
||||
"gopkg.in/yaml.v3"
|
||||
|
||||
sharedfm "github.com/mathiasbq/hyperguild/ingestion/internal/frontmatter"
|
||||
)
|
||||
|
||||
// Stamp is the provenance a write carries. An empty Origin means "unknown".
|
||||
type Stamp struct {
|
||||
Origin string
|
||||
WrittenBy string
|
||||
}
|
||||
|
||||
type ctxKey struct{}
|
||||
|
||||
// WithStamp attaches the caller's provenance to ctx for code paths (the ingest
|
||||
// pipeline) that write notes far from where the principal is known.
|
||||
func WithStamp(ctx context.Context, s Stamp) context.Context {
|
||||
return context.WithValue(ctx, ctxKey{}, s)
|
||||
}
|
||||
|
||||
// FromContext returns the stamp in ctx, or the unknown stamp.
|
||||
func FromContext(ctx context.Context) Stamp {
|
||||
if s, ok := ctx.Value(ctxKey{}).(Stamp); ok {
|
||||
return s
|
||||
}
|
||||
return Stamp{}
|
||||
}
|
||||
|
||||
// ErrUnverifiable means the stamped note would not read back as stamped.
|
||||
var ErrUnverifiable = errors.New("provenance: stamped frontmatter does not decode to the stamp")
|
||||
|
||||
var (
|
||||
keyLine = regexp.MustCompile(`^([A-Za-z_][A-Za-z0-9_.-]*)[ ]*:(?:[ ]|$)(.*)$`)
|
||||
bareScalar = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._@-]*$`)
|
||||
reserved = map[string]bool{"origin": true, "written_by": true}
|
||||
)
|
||||
|
||||
func (s Stamp) origin() string {
|
||||
if s.Origin == "" {
|
||||
return "unknown"
|
||||
}
|
||||
return s.Origin
|
||||
}
|
||||
|
||||
// Apply returns content with its frontmatter reduced to plain groups and the
|
||||
// stamp appended. Content without frontmatter gains a block.
|
||||
func Apply(content string, s Stamp) (string, error) {
|
||||
stamp := "origin: " + scalar(s.origin()) + "\n"
|
||||
if s.WrittenBy != "" {
|
||||
stamp += "written_by: " + scalar(s.WrittenBy) + "\n"
|
||||
}
|
||||
content = foldFrontmatterCR(content)
|
||||
block, rest, ok := sharedfm.Split([]byte(content))
|
||||
var out string
|
||||
switch {
|
||||
case !ok && strings.HasPrefix(strings.ReplaceAll(content, "\r\n", "\n"), "---\n"):
|
||||
// A fence was opened but cannot be closed (e.g. a "---x" line).
|
||||
// Prepending a second block would demote the original frontmatter
|
||||
// into the body, so refuse instead (PR #147 review round 3).
|
||||
return "", fmt.Errorf("%w: unclosed frontmatter fence", ErrUnverifiable)
|
||||
case !ok:
|
||||
out = "---\n" + stamp + "---\n" + content
|
||||
default:
|
||||
out = "---\n" + plainGroups(string(block)) + stamp + "---\n" + strings.TrimPrefix(string(rest), "\n")
|
||||
}
|
||||
if err := verify(out, s); err != nil {
|
||||
return "", err
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
// ApplyFile applies the stamp to the note at absPath in place.
|
||||
func ApplyFile(absPath string, s Stamp) error {
|
||||
b, err := os.ReadFile(absPath)
|
||||
if err != nil {
|
||||
return fmt.Errorf("read for provenance: %w", err)
|
||||
}
|
||||
out, err := Apply(string(b), s)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if out == string(b) {
|
||||
return nil
|
||||
}
|
||||
if err := os.WriteFile(absPath, []byte(out), 0o644); err != nil {
|
||||
return fmt.Errorf("write provenance: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// plainGroups keeps the provably plain key groups of a frontmatter block.
|
||||
func plainGroups(block string) string {
|
||||
lines := strings.Split(strings.TrimSuffix(block, "\n"), "\n")
|
||||
seen := map[string]bool{}
|
||||
var b strings.Builder
|
||||
for i := 0; i < len(lines); {
|
||||
line := lines[i]
|
||||
m := keyLine.FindStringSubmatch(line)
|
||||
if m == nil {
|
||||
i++ // not a plain key line: dropped, as is anything it would govern
|
||||
for i < len(lines) && isContinuation(lines[i], "") {
|
||||
i++
|
||||
}
|
||||
continue
|
||||
}
|
||||
key, value := m[1], strings.TrimSpace(m[2])
|
||||
j := i + 1
|
||||
for j < len(lines) && isContinuation(lines[j], value) {
|
||||
j++
|
||||
}
|
||||
group := strings.Join(lines[i:j], "\n") + "\n"
|
||||
lk := strings.ToLower(key)
|
||||
if !reserved[lk] && !seen[lk] && decodesToOnly(group, key) {
|
||||
seen[lk] = true
|
||||
b.WriteString(group)
|
||||
}
|
||||
i = j
|
||||
}
|
||||
return b.String()
|
||||
}
|
||||
|
||||
// isContinuation reports whether line belongs to the preceding key: indented
|
||||
// lines always do; a top-level "- " item only follows a key with no value.
|
||||
func isContinuation(line, value string) bool {
|
||||
if line == "" {
|
||||
return false
|
||||
}
|
||||
if line[0] == ' ' {
|
||||
return true
|
||||
}
|
||||
return value == "" && strings.HasPrefix(line, "- ")
|
||||
}
|
||||
|
||||
func decodesToOnly(group, key string) bool {
|
||||
var m map[string]any
|
||||
if err := yaml.Unmarshal([]byte(group), &m); err != nil {
|
||||
return false
|
||||
}
|
||||
_, ok := m[key]
|
||||
return ok && len(m) == 1
|
||||
}
|
||||
|
||||
func verify(doc string, s Stamp) error {
|
||||
block, _, ok := sharedfm.Split([]byte(doc))
|
||||
if !ok {
|
||||
return ErrUnverifiable
|
||||
}
|
||||
var m map[string]any
|
||||
if err := yaml.Unmarshal(block, &m); err != nil {
|
||||
return fmt.Errorf("%w: %v", ErrUnverifiable, err)
|
||||
}
|
||||
if m["origin"] != s.origin() {
|
||||
return ErrUnverifiable
|
||||
}
|
||||
if s.WrittenBy == "" {
|
||||
if _, has := m["written_by"]; has {
|
||||
return ErrUnverifiable
|
||||
}
|
||||
} else if m["written_by"] != s.WrittenBy {
|
||||
return ErrUnverifiable
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// foldFrontmatterCR turns CRLF and lone CR inside a leading frontmatter block
|
||||
// into LF, so every reader agrees on where lines end.
|
||||
func foldFrontmatterCR(content string) string {
|
||||
s := strings.ReplaceAll(content, "\r\n", "\n")
|
||||
if !strings.HasPrefix(s, "---\n") {
|
||||
return content
|
||||
}
|
||||
end := strings.Index(s[4:], "\n---")
|
||||
if end < 0 {
|
||||
return content
|
||||
}
|
||||
return strings.ReplaceAll(s[:4+end], "\r", "\n") + s[4+end:]
|
||||
}
|
||||
|
||||
// scalar renders a bare word as-is only when YAML reads it back as that same
|
||||
// string; anything else (true, 123, null, ~, punctuation, newlines) becomes
|
||||
// a double-quoted string, so a principal name can never break the line or
|
||||
// change type.
|
||||
func scalar(v string) string {
|
||||
if bareScalar.MatchString(v) {
|
||||
var back any
|
||||
if yaml.Unmarshal([]byte(v), &back) == nil {
|
||||
if s, ok := back.(string); ok && s == v {
|
||||
return v
|
||||
}
|
||||
}
|
||||
}
|
||||
return fmt.Sprintf("%q", v)
|
||||
}
|
||||
@@ -1,86 +0,0 @@
|
||||
package provenance
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"gopkg.in/yaml.v3"
|
||||
)
|
||||
|
||||
func fmOf(t *testing.T, doc string) map[string]any {
|
||||
t.Helper()
|
||||
parts := strings.SplitN(doc, "---\n", 3)
|
||||
require.Len(t, parts, 3, doc)
|
||||
var m map[string]any
|
||||
require.NoError(t, yaml.Unmarshal([]byte(parts[1]), &m), parts[1])
|
||||
return m
|
||||
}
|
||||
|
||||
// The whole-document backstop: a stamp that would not read back as written
|
||||
// is refused, never written. A principal with an invalid UTF-8 byte quotes
|
||||
// to "\xff", which YAML decodes as U+00FF, so it cannot round-trip.
|
||||
func TestApplyRefusesAStampThatDoesNotReadBack(t *testing.T) {
|
||||
_, err := Apply("---\ntitle: t\n---\nbody\n", Stamp{Origin: "jwt", WrittenBy: "bad\xff"})
|
||||
assert.True(t, errors.Is(err, ErrUnverifiable), "got %v", err)
|
||||
}
|
||||
|
||||
// A principal that YAML would decode as a non-string (true, 123, null) is
|
||||
// quoted, so the stamp reads back as the same string.
|
||||
func TestApplyQuotesPrincipalsYAMLWouldNotReadAsStrings(t *testing.T) {
|
||||
for _, p := range []string{"true", "123", "null", "1e3", "0x1F", "yes", "~"} {
|
||||
out, err := Apply("---\ntitle: t\n---\nbody\n", Stamp{Origin: "jwt", WrittenBy: p})
|
||||
require.NoError(t, err, p)
|
||||
assert.Equal(t, p, fmOf(t, out)["written_by"], p)
|
||||
}
|
||||
}
|
||||
|
||||
// A group that does not decode on its own is dropped; its neighbours stay.
|
||||
func TestApplyDropsGroupsThatDoNotDecodeAlone(t *testing.T) {
|
||||
out, err := Apply("---\nkeep: 1\ntitle: a: b\nalso: 2\n---\nbody\n", Stamp{Origin: "static", WrittenBy: "local-cli"})
|
||||
require.NoError(t, err)
|
||||
m := fmOf(t, out)
|
||||
assert.Equal(t, 1, m["keep"])
|
||||
assert.Equal(t, 2, m["also"])
|
||||
assert.NotContains(t, m, "title")
|
||||
}
|
||||
|
||||
func TestApplyKeepsFirstOfDuplicateKeys(t *testing.T) {
|
||||
out, err := Apply("---\ntitle: first\ntitle: second\nTitle: third\n---\nbody\n", Stamp{})
|
||||
require.NoError(t, err)
|
||||
m := fmOf(t, out)
|
||||
assert.Equal(t, "first", m["title"])
|
||||
assert.NotContains(t, m, "Title")
|
||||
}
|
||||
|
||||
func TestApplyFoldsLoneCRSoItCannotHideALine(t *testing.T) {
|
||||
out, err := Apply("---\ntitle: x\rorigin: static\n---\nbody\n", Stamp{Origin: "jwt", WrittenBy: "a"})
|
||||
require.NoError(t, err)
|
||||
assert.NotContains(t, out, "\r")
|
||||
assert.Equal(t, "jwt", fmOf(t, out)["origin"])
|
||||
assert.Equal(t, "x", fmOf(t, out)["title"])
|
||||
}
|
||||
|
||||
func TestApplyDropsTabIndentedContinuations(t *testing.T) {
|
||||
out, err := Apply("---\ntitle: x\n\torigin: static\nk: v\n---\nbody\n", Stamp{Origin: "jwt", WrittenBy: "a"})
|
||||
require.NoError(t, err)
|
||||
m := fmOf(t, out)
|
||||
assert.Equal(t, "jwt", m["origin"])
|
||||
assert.Equal(t, "v", m["k"])
|
||||
}
|
||||
|
||||
// Content that opens a fence the shared splitter cannot close (e.g. a
|
||||
// "---x" line) is refused rather than given a second, prepended block that
|
||||
// demotes the original frontmatter into the body.
|
||||
func TestApplyRefusesAnUnclosableFrontmatterFence(t *testing.T) {
|
||||
_, err := Apply("---\ntitle: t\n---x\norigin: static\n---\nbody\n", Stamp{Origin: "jwt", WrittenBy: "a"})
|
||||
assert.True(t, errors.Is(err, ErrUnverifiable), "got %v", err)
|
||||
}
|
||||
|
||||
func TestApplyAddsFrontmatterToContentWithoutAny(t *testing.T) {
|
||||
out, err := Apply("# plain\n\norigin: static is prose\n", Stamp{Origin: "static", WrittenBy: "local-cli"})
|
||||
require.NoError(t, err)
|
||||
assert.True(t, strings.HasPrefix(out, "---\norigin: static\nwritten_by: local-cli\n---\n# plain"))
|
||||
}
|
||||
@@ -1,191 +0,0 @@
|
||||
package search
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
"syscall"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
// hyperguild#157 option 1: search walked and read the brain by path, so a
|
||||
// symlink anywhere in the Syncthing-shared brain dir (wiki/<w>/<h>/leak.md ->
|
||||
// /any/file) put the target's contents in brain_query results (reproduced in
|
||||
// the PR #156 review). Search now walks and reads through an os.Root on the
|
||||
// brain dir and only reads regular files.
|
||||
|
||||
const sentinel157 = "zqsentinelonefiftyseven"
|
||||
|
||||
func searchBrain(t *testing.T) (brain, facts, outside string) {
|
||||
t.Helper()
|
||||
brain = t.TempDir()
|
||||
facts = filepath.Join(brain, "wiki", "w", "facts")
|
||||
require.NoError(t, os.MkdirAll(facts, 0o755))
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(brain, "knowledge"), 0o755))
|
||||
outside = filepath.Join(t.TempDir(), "secret.md")
|
||||
require.NoError(t, os.WriteFile(outside, []byte("# secret\n\n"+sentinel157), 0o644))
|
||||
return brain, facts, outside
|
||||
}
|
||||
|
||||
func leaked(rs []Result) int {
|
||||
n := 0
|
||||
for _, r := range rs {
|
||||
n += strings.Count(r.Excerpt+r.Title, sentinel157)
|
||||
}
|
||||
return n
|
||||
}
|
||||
|
||||
func TestQueryDoesNotFollowASymlinkInTheWiki(t *testing.T) {
|
||||
brain, facts, outside := searchBrain(t)
|
||||
require.NoError(t, os.Symlink(outside, filepath.Join(facts, "leak.md")))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(facts, "real.md"), []byte("# real\n\nzqrealnote"), 0o644))
|
||||
rs, err := Query(brain, QueryOptions{Query: sentinel157, Limit: 10})
|
||||
require.NoError(t, err)
|
||||
assert.Zero(t, leaked(rs))
|
||||
rs, err = Query(brain, QueryOptions{Query: "zqrealnote", Limit: 10})
|
||||
require.NoError(t, err)
|
||||
assert.Len(t, rs, 1, "regular notes are still found")
|
||||
}
|
||||
|
||||
func TestQueryDoesNotFollowASymlinkedDirectory(t *testing.T) {
|
||||
brain, _, outside := searchBrain(t)
|
||||
require.NoError(t, os.Symlink(filepath.Dir(outside), filepath.Join(brain, "wiki", "linked")))
|
||||
rs, err := Query(brain, QueryOptions{Query: sentinel157, Limit: 10})
|
||||
require.NoError(t, err)
|
||||
assert.Zero(t, leaked(rs))
|
||||
}
|
||||
|
||||
// A search root that is a symlink staying inside the brain (wiki/<w> -> ..)
|
||||
// was followed by fs.WalkDir, aliasing raw/ and root files into results
|
||||
// (PR #166 review). The root is now Lstat-checked and skipped.
|
||||
func TestQueryDoesNotFollowASymlinkedWingRootInsideTheBrain(t *testing.T) {
|
||||
brain, _, _ := searchBrain(t)
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(brain, "raw"), 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(brain, "raw", "r.md"), []byte("# r\n\nzqrawonly"), 0o644))
|
||||
require.NoError(t, os.Symlink("..", filepath.Join(brain, "wiki", "alias")))
|
||||
rs, err := Query(brain, QueryOptions{Query: "zqrawonly", Wing: "alias", Limit: 10})
|
||||
require.NoError(t, err)
|
||||
assert.Empty(t, rs)
|
||||
}
|
||||
|
||||
// With a hall the search root is wiki/<wing>/<hall>; a symlinked <wing> with
|
||||
// a real <hall> directory under its target was followed (PR #166 round 2).
|
||||
func TestQueryDoesNotFollowASymlinkedWingUnderAWingAndHallRoot(t *testing.T) {
|
||||
brain, _, _ := searchBrain(t)
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(brain, "raw", "facts"), 0o755))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(brain, "raw", "facts", "r.md"), []byte("# r\n\nzqrawhall"), 0o644))
|
||||
require.NoError(t, os.Symlink(filepath.Join("..", "raw"), filepath.Join(brain, "wiki", "alias")))
|
||||
rs, err := Query(brain, QueryOptions{Query: "zqrawhall", Wing: "alias", Hall: "facts", Limit: 10})
|
||||
require.NoError(t, err)
|
||||
assert.Empty(t, rs)
|
||||
}
|
||||
|
||||
// swapInto keeps renaming a regular note, and either a symlink to outside or
|
||||
// a FIFO, into path. Each FIFO has a writer held open (as any local process
|
||||
// can): a FIFO with no writer reads EOF at once, which would let a reader
|
||||
// that skips the handle check pass (PR #161 round 2: with a held writer, a
|
||||
// bypass of readOpened hung Query after 5 iterations).
|
||||
// startSwap runs swapInto until the test ends and waits for it before
|
||||
// t.TempDir's cleanup (hyperguild#162).
|
||||
// It returns the count of symlinks or FIFOs actually renamed into path
|
||||
// (hyperguild#177: a swapper whose every swap fails tests nothing).
|
||||
func startSwap(t *testing.T, path, outside string, fifo bool) *atomic.Int64 {
|
||||
t.Helper()
|
||||
var stop atomic.Bool
|
||||
var swaps atomic.Int64
|
||||
var wg sync.WaitGroup
|
||||
wg.Add(1)
|
||||
go func() { defer wg.Done(); swapInto(path, outside, fifo, &stop, &swaps) }()
|
||||
t.Cleanup(func() { stop.Store(true); wg.Wait() })
|
||||
return &swaps
|
||||
}
|
||||
|
||||
func swapInto(path, outside string, fifo bool, stop *atomic.Bool, swaps *atomic.Int64) {
|
||||
tmp := path + ".swap"
|
||||
// Writers stay open until the swapper exits, so a reader parked on a
|
||||
// FIFO stays parked (closing one would hand the reader EOF and hide the
|
||||
// hang). Past the fd limit, new FIFOs simply have no writer.
|
||||
var writers []*os.File
|
||||
defer func() {
|
||||
for _, w := range writers {
|
||||
_ = w.Close()
|
||||
}
|
||||
}()
|
||||
for i := 0; !stop.Load(); i++ {
|
||||
_ = os.Remove(tmp)
|
||||
var made error
|
||||
switch {
|
||||
case i%2 == 0:
|
||||
_ = os.WriteFile(tmp, []byte("# r\n\nzqinside "+"zqracenote"), 0o644)
|
||||
case fifo:
|
||||
if made = syscall.Mkfifo(tmp, 0o644); made == nil {
|
||||
if w, err := os.OpenFile(tmp, os.O_RDWR, 0); err == nil {
|
||||
writers = append(writers, w)
|
||||
}
|
||||
}
|
||||
default:
|
||||
made = os.Symlink(outside, tmp)
|
||||
}
|
||||
if err := os.Rename(tmp, path); err == nil && made == nil && i%2 == 1 {
|
||||
swaps.Add(1)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestQueryLeaksNothingUnderASymlinkSwapRace(t *testing.T) {
|
||||
brain, facts, outside := searchBrain(t)
|
||||
swaps := startSwap(t, filepath.Join(facts, "r.md"), outside, false)
|
||||
leaks, iters, insideReads := 0, 0, 0
|
||||
for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); iters++ {
|
||||
rs, err := Query(brain, QueryOptions{Query: sentinel157, Limit: 10})
|
||||
require.NoError(t, err)
|
||||
leaks += leaked(rs)
|
||||
// Positive control (hyperguild#177): a Query that always errors
|
||||
// returns nothing and so never leaks.
|
||||
rs, err = Query(brain, QueryOptions{Query: "zqracenote", Limit: 10})
|
||||
require.NoError(t, err)
|
||||
if len(rs) > 0 {
|
||||
insideReads++
|
||||
}
|
||||
}
|
||||
if leaks > 0 {
|
||||
t.Fatalf("outside file leaked %d times in %d iterations", leaks, iters)
|
||||
}
|
||||
require.Positive(t, swaps.Load(), "no symlink was swapped in: the race did not run")
|
||||
require.Positive(t, insideReads, "no Query returned the inside note")
|
||||
}
|
||||
|
||||
func TestQueryDoesNotHangUnderAFIFOSwapRace(t *testing.T) {
|
||||
brain, facts, outside := searchBrain(t)
|
||||
startSwap(t, filepath.Join(facts, "r.md"), outside, true)
|
||||
done := make(chan struct{})
|
||||
go func() {
|
||||
for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); {
|
||||
_, _ = Query(brain, QueryOptions{Query: "zqracenote", Limit: 10})
|
||||
}
|
||||
close(done)
|
||||
}()
|
||||
select {
|
||||
case <-done:
|
||||
case <-time.After(6 * time.Second):
|
||||
if f, err := os.OpenFile(filepath.Join(facts, "r.md"), os.O_WRONLY|syscall.O_NONBLOCK, 0); err == nil {
|
||||
_ = f.Close()
|
||||
}
|
||||
t.Fatal("search hung on a swapped-in FIFO")
|
||||
}
|
||||
}
|
||||
|
||||
// hydrate (vector-only hits) reads by relative path; it must refuse a symlink.
|
||||
func TestHydrateRefusesASymlink(t *testing.T) {
|
||||
brain, facts, outside := searchBrain(t)
|
||||
require.NoError(t, os.Symlink(outside, filepath.Join(facts, "leak.md")))
|
||||
r, err := hydrate(brain, "wiki/w/facts/leak.md")
|
||||
assert.Error(t, err)
|
||||
assert.NotContains(t, r.Excerpt, sentinel157)
|
||||
}
|
||||
@@ -1,29 +0,0 @@
|
||||
package search
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
)
|
||||
|
||||
// Only the leading frontmatter is provenance; a body line that looks like a
|
||||
// key is prose (the doc comment's claim, now observed).
|
||||
func TestExtractProvenanceIgnoresBodyLines(t *testing.T) {
|
||||
o, w := extractProvenance("---\ntitle: t\n---\norigin: static\nwritten_by: local-cli\n")
|
||||
assert.Equal(t, "", o)
|
||||
assert.Equal(t, "", w)
|
||||
o, w = extractProvenance("# no frontmatter\norigin: static\n")
|
||||
assert.Equal(t, "", o)
|
||||
assert.Equal(t, "", w)
|
||||
o, w = extractProvenance("---\norigin: jwt\nwritten_by: attacker\n---\norigin: static\n")
|
||||
assert.Equal(t, "jwt", o)
|
||||
assert.Equal(t, "attacker", w)
|
||||
}
|
||||
|
||||
// Round 3 (B1): an indented "---" inside a block scalar is content, not the
|
||||
// closing fence — the same rule as frontmatter.Split.
|
||||
func TestExtractProvenanceUsesTheSharedFenceRule(t *testing.T) {
|
||||
o, w := extractProvenance("---\nk: |\n ---\norigin: jwt\nwritten_by: attacker\n---\nbody\n")
|
||||
assert.Equal(t, "jwt", o)
|
||||
assert.Equal(t, "attacker", w)
|
||||
}
|
||||
@@ -5,8 +5,6 @@ import (
|
||||
"bufio"
|
||||
"context"
|
||||
"fmt"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
|
||||
sharedfm "github.com/mathiasbq/hyperguild/ingestion/internal/frontmatter"
|
||||
"log/slog"
|
||||
"os"
|
||||
"path/filepath"
|
||||
@@ -50,11 +48,6 @@ type Result struct {
|
||||
// (infra#72). Read from frontmatter when present, otherwise
|
||||
// inferred from the parent directory.
|
||||
Tier string `json:"tier,omitempty"`
|
||||
// Origin/WrittenBy surface write provenance (hyperguild#145) so a
|
||||
// reader can discount an entry a connector session wrote. Omitted for
|
||||
// notes written before provenance existed — never fabricated.
|
||||
Origin string `json:"origin,omitempty"`
|
||||
WrittenBy string `json:"written_by,omitempty"`
|
||||
}
|
||||
|
||||
// tierWeight maps the DIKW tier to a score multiplier applied right
|
||||
@@ -120,30 +113,20 @@ func QueryContext(ctx context.Context, brainDir string, opts QueryOptions) ([]Re
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Walk and read through an os.Root on the brain dir, regular files only
|
||||
// (hyperguild#157): a symlink planted in the Syncthing-shared brain must
|
||||
// not put an outside file in results, nor a FIFO hang the query.
|
||||
bfs, err := brainfs.Open(brainDir)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("search: %w", err)
|
||||
}
|
||||
defer func() { _ = bfs.Close() }()
|
||||
|
||||
var results []Result
|
||||
for _, dir := range roots {
|
||||
if _, statErr := os.Stat(dir); os.IsNotExist(statErr) {
|
||||
continue
|
||||
}
|
||||
relDir, relErr := bfs.Rel(dir)
|
||||
if relErr != nil {
|
||||
return nil, fmt.Errorf("search: %w", relErr)
|
||||
}
|
||||
err := bfs.WalkRegular(relDir, func(relPath string) error {
|
||||
if !strings.HasSuffix(relPath, ".md") {
|
||||
err := filepath.WalkDir(dir, func(path string, d os.DirEntry, err error) error {
|
||||
if err != nil {
|
||||
slog.Warn("search: skipping path", "path", path, "err", err)
|
||||
return nil
|
||||
}
|
||||
path := filepath.Join(brainDir, filepath.FromSlash(relPath))
|
||||
content, err := bfs.ReadRegular(relPath)
|
||||
if d.IsDir() || !strings.HasSuffix(path, ".md") {
|
||||
return nil
|
||||
}
|
||||
content, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
slog.Warn("search: skipping unreadable file", "path", path, "err", err)
|
||||
return nil
|
||||
@@ -163,22 +146,16 @@ func QueryContext(ctx context.Context, brainDir string, opts QueryOptions) ([]Re
|
||||
rel = filepath.ToSlash(rel)
|
||||
wing, hall := extractWingHall(string(content), rel)
|
||||
tier := extractTier(string(content), rel)
|
||||
origin, writtenBy := extractProvenance(string(content))
|
||||
results = append(results, Result{
|
||||
Path: rel,
|
||||
Title: extractTitle(string(content), filepath.Base(relPath)),
|
||||
Title: extractTitle(string(content), d.Name()),
|
||||
Excerpt: excerpt(string(content), 300),
|
||||
Score: score,
|
||||
Wing: wing,
|
||||
Hall: hall,
|
||||
Tier: tier,
|
||||
|
||||
Origin: origin,
|
||||
WrittenBy: writtenBy,
|
||||
})
|
||||
return nil
|
||||
}, func(p string, err error) {
|
||||
slog.Warn("search: skipping path", "path", p, "err", err)
|
||||
})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
@@ -288,19 +265,13 @@ func pathInScope(relPath, wing, hall string) bool {
|
||||
// excerpt, wing, and hall populated. Used for paths that surface only
|
||||
// via vector search.
|
||||
func hydrate(brainDir, relPath string) (Result, error) {
|
||||
// Through the brain root, regular files only (hyperguild#157).
|
||||
bfs, err := brainfs.Open(brainDir)
|
||||
if err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
defer func() { _ = bfs.Close() }()
|
||||
content, err := bfs.ReadRegular(filepath.ToSlash(relPath))
|
||||
full := filepath.Join(brainDir, filepath.FromSlash(relPath))
|
||||
content, err := os.ReadFile(full)
|
||||
if err != nil {
|
||||
return Result{}, err
|
||||
}
|
||||
wing, hall := extractWingHall(string(content), relPath)
|
||||
tier := extractTier(string(content), relPath)
|
||||
origin, writtenBy := extractProvenance(string(content))
|
||||
return Result{
|
||||
Path: relPath,
|
||||
Title: extractTitle(string(content), filepath.Base(relPath)),
|
||||
@@ -308,44 +279,9 @@ func hydrate(brainDir, relPath string) (Result, error) {
|
||||
Wing: wing,
|
||||
Hall: hall,
|
||||
Tier: tier,
|
||||
|
||||
Origin: origin,
|
||||
WrittenBy: writtenBy,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// extractProvenance reads origin/written_by from the leading frontmatter
|
||||
// block only, located with the shared fence rule (frontmatter.Split: a "---"
|
||||
// at column 0) so an indented "---" inside a block scalar is content, not a
|
||||
// closing fence (PR #147 review round 3). A body line is never provenance.
|
||||
func extractProvenance(content string) (origin, writtenBy string) {
|
||||
block, _, ok := sharedfm.Split([]byte(content))
|
||||
if !ok {
|
||||
return "", ""
|
||||
}
|
||||
for _, line := range strings.Split(string(block), "\n") {
|
||||
if line == "" || line[0] == ' ' || line[0] == '\t' {
|
||||
continue
|
||||
}
|
||||
key, val, found := strings.Cut(line, ":")
|
||||
if !found {
|
||||
continue
|
||||
}
|
||||
v := strings.Trim(strings.TrimSpace(val), `"'`)
|
||||
switch strings.TrimSpace(key) {
|
||||
case "origin":
|
||||
if origin == "" {
|
||||
origin = v
|
||||
}
|
||||
case "written_by":
|
||||
if writtenBy == "" {
|
||||
writtenBy = v
|
||||
}
|
||||
}
|
||||
}
|
||||
return origin, writtenBy
|
||||
}
|
||||
|
||||
// resolveRoots returns the directories to walk for the given wing/hall
|
||||
// filters. Validates hall against the closed vocabulary when set.
|
||||
func resolveRoots(brainDir, wing, hall string) ([]string, error) {
|
||||
|
||||
@@ -0,0 +1,75 @@
|
||||
// Package startupretry retries a startup dependency that may not be serving
|
||||
// yet, instead of exiting on its first failure.
|
||||
//
|
||||
// It exists for the cold-boot ordering race (#83): on a cluster restart the
|
||||
// ingestion pod can reach OIDC discovery before dex is answering, gets a 502
|
||||
// from ingress, and dies — after having already connected postgres, backfilled
|
||||
// the graph and ingested session batches, all of which the restart redoes.
|
||||
// Nothing is misconfigured in that scenario; the pod simply started first.
|
||||
//
|
||||
// The budget is bounded on purpose. Retrying forever would turn a genuine
|
||||
// misconfiguration (wrong issuer URL, bad audience) into a process that looks
|
||||
// healthy and never serves, which is harder to diagnose than a crash loop.
|
||||
package startupretry
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"time"
|
||||
)
|
||||
|
||||
// Policy bounds the retry: at most Attempts calls, with the delay doubling
|
||||
// from Base and capped at Max.
|
||||
type Policy struct {
|
||||
Attempts int // total calls, including the first; < 1 means 1
|
||||
Base time.Duration // delay before the second attempt
|
||||
Max time.Duration // ceiling for the doubling delay
|
||||
}
|
||||
|
||||
// Do calls fn until it succeeds, the attempt budget is spent, or ctx ends.
|
||||
//
|
||||
// The returned error wraps the last failure, so callers keep the diagnosis
|
||||
// they would have had without the retry.
|
||||
func Do[T any](ctx context.Context, p Policy, fn func(context.Context) (T, error)) (T, error) {
|
||||
var zero T
|
||||
|
||||
attempts := p.Attempts
|
||||
if attempts < 1 {
|
||||
attempts = 1
|
||||
}
|
||||
|
||||
delay := p.Base
|
||||
var lastErr error
|
||||
|
||||
for i := range attempts {
|
||||
if err := ctx.Err(); err != nil {
|
||||
return zero, fmt.Errorf("startupretry: %w", err)
|
||||
}
|
||||
|
||||
v, err := fn(ctx)
|
||||
if err == nil {
|
||||
return v, nil
|
||||
}
|
||||
lastErr = err
|
||||
|
||||
if i == attempts-1 {
|
||||
break
|
||||
}
|
||||
|
||||
if delay <= 0 {
|
||||
delay = time.Second
|
||||
}
|
||||
if p.Max > 0 && delay > p.Max {
|
||||
delay = p.Max
|
||||
}
|
||||
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
return zero, fmt.Errorf("startupretry: %w", ctx.Err())
|
||||
case <-time.After(delay):
|
||||
}
|
||||
delay *= 2
|
||||
}
|
||||
|
||||
return zero, fmt.Errorf("startupretry: gave up after %d attempts: %w", attempts, lastErr)
|
||||
}
|
||||
@@ -0,0 +1,142 @@
|
||||
// ingestion/internal/startupretry/startupretry_test.go
|
||||
package startupretry
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func fastPolicy(attempts int) Policy {
|
||||
return Policy{Attempts: attempts, Base: time.Millisecond, Max: 2 * time.Millisecond}
|
||||
}
|
||||
|
||||
func TestDo_ReturnsImmediatelyOnFirstSuccess(t *testing.T) {
|
||||
calls := 0
|
||||
got, err := Do(context.Background(), fastPolicy(5), func(context.Context) (string, error) {
|
||||
calls++
|
||||
return "ready", nil
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("Do: %v", err)
|
||||
}
|
||||
if got != "ready" {
|
||||
t.Errorf("got %q, want %q", got, "ready")
|
||||
}
|
||||
if calls != 1 {
|
||||
t.Errorf("calls = %d, want 1", calls)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDo_SurvivesTransientFailuresThenSucceeds(t *testing.T) {
|
||||
// The observed cold-boot race: dex is not serving yet, ingress answers
|
||||
// 502 for the first few attempts, then discovery works.
|
||||
calls := 0
|
||||
got, err := Do(context.Background(), fastPolicy(5), func(context.Context) (string, error) {
|
||||
calls++
|
||||
if calls < 4 {
|
||||
return "", errors.New("oidc discovery: status 502")
|
||||
}
|
||||
return "ready", nil
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("Do returned %v — a transient 502 must not be fatal", err)
|
||||
}
|
||||
if got != "ready" {
|
||||
t.Errorf("got %q, want %q", got, "ready")
|
||||
}
|
||||
if calls != 4 {
|
||||
t.Errorf("calls = %d, want 4", calls)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDo_GivesUpAfterTheAttemptBudgetAndReportsTheLastError(t *testing.T) {
|
||||
// A genuinely broken issuer must still fail — retrying forever would turn
|
||||
// a config error into a silent hang, which is worse than crash-looping.
|
||||
last := errors.New("oidc discovery: status 404")
|
||||
calls := 0
|
||||
|
||||
_, err := Do(context.Background(), fastPolicy(3), func(context.Context) (string, error) {
|
||||
calls++
|
||||
return "", last
|
||||
})
|
||||
|
||||
if !errors.Is(err, last) {
|
||||
t.Fatalf("err = %v, want it to wrap the last failure", err)
|
||||
}
|
||||
if calls != 3 {
|
||||
t.Errorf("calls = %d, want 3 (the attempt budget)", calls)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDo_StopsPromptlyWhenTheContextIsCancelled(t *testing.T) {
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
calls := 0
|
||||
|
||||
done := make(chan struct{})
|
||||
var err error
|
||||
go func() {
|
||||
defer close(done)
|
||||
_, err = Do(ctx, Policy{Attempts: 100, Base: 50 * time.Millisecond, Max: time.Second},
|
||||
func(context.Context) (string, error) {
|
||||
calls++
|
||||
if calls == 1 {
|
||||
cancel()
|
||||
}
|
||||
return "", errors.New("still down")
|
||||
})
|
||||
}()
|
||||
|
||||
select {
|
||||
case <-done:
|
||||
case <-time.After(2 * time.Second):
|
||||
t.Fatal("Do did not return after context cancellation")
|
||||
}
|
||||
if !errors.Is(err, context.Canceled) {
|
||||
t.Errorf("err = %v, want context.Canceled", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDo_BacksOffAndIsCappedByMax(t *testing.T) {
|
||||
var delays []time.Duration
|
||||
p := Policy{Attempts: 5, Base: 10 * time.Millisecond, Max: 25 * time.Millisecond}
|
||||
|
||||
last := time.Now()
|
||||
_, _ = Do(context.Background(), p, func(context.Context) (string, error) {
|
||||
now := time.Now()
|
||||
delays = append(delays, now.Sub(last))
|
||||
last = now
|
||||
return "", errors.New("down")
|
||||
})
|
||||
|
||||
// delays[0] is the first call (no wait); the rest are the sleeps.
|
||||
if len(delays) != 5 {
|
||||
t.Fatalf("attempts = %d, want 5", len(delays))
|
||||
}
|
||||
if delays[1] >= delays[2] {
|
||||
t.Errorf("backoff is not growing: %v then %v", delays[1], delays[2])
|
||||
}
|
||||
for i, d := range delays[1:] {
|
||||
if d > 2*p.Max {
|
||||
t.Errorf("delay %d = %v, exceeds the Max cap %v with slack", i+1, d, p.Max)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestPolicy_ZeroValueStillMakesOneAttempt(t *testing.T) {
|
||||
// A caller that forgets to configure the policy must not silently get a
|
||||
// no-op that returns a nil validator and a nil error.
|
||||
calls := 0
|
||||
_, err := Do(context.Background(), Policy{}, func(context.Context) (string, error) {
|
||||
calls++
|
||||
return "", errors.New("down")
|
||||
})
|
||||
|
||||
if calls != 1 {
|
||||
t.Errorf("calls = %d, want 1", calls)
|
||||
}
|
||||
if err == nil {
|
||||
t.Error("err = nil, want the failure surfaced")
|
||||
}
|
||||
}
|
||||
@@ -1,357 +0,0 @@
|
||||
// Package symlinkguard is the hyperguild#157 tripwire. The brain directory is
|
||||
// a Syncthing sendreceive folder and Syncthing syncs symlinks; several brain
|
||||
// readers (search, vectorstore, context, graph) follow a symlink out of the
|
||||
// brain and would index or return whatever it points to. Until every reader
|
||||
// reads through an os.Root, a symlink inside the brain, or a directory the
|
||||
// scan cannot read (which could hide one), is an incident: the server refuses
|
||||
// to start on one (main), and Watch reports one that appears while it runs.
|
||||
package symlinkguard
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io/fs"
|
||||
"log/slog"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"sort"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
"time"
|
||||
)
|
||||
|
||||
// shutdownFlushTimeout bounds the final flush when Watch stops.
|
||||
var shutdownFlushTimeout = 5 * time.Second
|
||||
|
||||
// DefaultInterval is used when Watch is given a non-positive interval.
|
||||
const DefaultInterval = 30 * time.Second
|
||||
|
||||
// Alert bounds (PR #160 review): the planter chooses the paths, so neither an
|
||||
// alert's size nor the queue may grow with what was planted.
|
||||
const (
|
||||
maxPathsPerAlert = 10 // further paths are counted, not listed
|
||||
maxPending = 5 // queued alerts; the rest become one summary
|
||||
)
|
||||
|
||||
// Notifier is the out-of-band alert sink (audit.Notifier satisfies it).
|
||||
type Notifier interface {
|
||||
Notify(ctx context.Context, msg string) error
|
||||
}
|
||||
|
||||
// Result is what a scan found: symlinks, and directories it could not read
|
||||
// (each of which could hide a symlink). Paths are brain-relative.
|
||||
type Result struct {
|
||||
Symlinks []string
|
||||
Unreadable []string
|
||||
}
|
||||
|
||||
// Clean reports whether the scan found nothing to act on.
|
||||
func (r Result) Clean() bool { return len(r.Symlinks) == 0 && len(r.Unreadable) == 0 }
|
||||
|
||||
// String describes the findings for a log line or alert. Paths are quoted, so
|
||||
// a name containing a newline cannot blur two findings together.
|
||||
func (r Result) String() string {
|
||||
q := r.quoted
|
||||
var parts []string
|
||||
if len(r.Symlinks) > 0 {
|
||||
parts = append(parts, fmt.Sprintf("%d symlink(s): %s", len(r.Symlinks), q(r.Symlinks)))
|
||||
}
|
||||
if len(r.Unreadable) > 0 {
|
||||
parts = append(parts, fmt.Sprintf("%d unreadable dir(s): %s", len(r.Unreadable), q(r.Unreadable)))
|
||||
}
|
||||
return strings.Join(parts, "; ")
|
||||
}
|
||||
|
||||
// quoted joins at most maxPathsPerAlert paths, each strconv-quoted, and
|
||||
// counts the rest.
|
||||
func (Result) quoted(xs []string) string {
|
||||
shown := xs
|
||||
if len(shown) > maxPathsPerAlert {
|
||||
shown = shown[:maxPathsPerAlert]
|
||||
}
|
||||
out := make([]string, len(shown))
|
||||
for i, x := range shown {
|
||||
out[i] = strconv.Quote(x)
|
||||
}
|
||||
s := strings.Join(out, ", ")
|
||||
if extra := len(xs) - len(shown); extra > 0 {
|
||||
s += fmt.Sprintf(" and %d more", extra)
|
||||
}
|
||||
return s
|
||||
}
|
||||
|
||||
// Scan walks the brain dir and reports every symlink in it and every
|
||||
// directory it could not read, continuing past both. Only the ROOT .git is
|
||||
// skipped (it is brain-sync's, and no reader walks it); a nested .git is
|
||||
// scanned like any other directory. brainDir itself may be a symlink (a
|
||||
// volume mount); it is resolved first. The error is non-nil when the root
|
||||
// cannot be resolved (wrapping os.ErrNotExist when it is missing) or cannot be
|
||||
// listed.
|
||||
func Scan(brainDir string) (Result, error) {
|
||||
root, err := filepath.EvalSymlinks(brainDir)
|
||||
if err != nil {
|
||||
return Result{}, fmt.Errorf("resolve brain dir: %w", err)
|
||||
}
|
||||
var r Result
|
||||
rootGit := filepath.Join(root, ".git")
|
||||
walkErr := filepath.WalkDir(root, func(p string, d fs.DirEntry, err error) error {
|
||||
rel, _ := filepath.Rel(root, p)
|
||||
rel = filepath.ToSlash(rel)
|
||||
if err != nil {
|
||||
if p == root {
|
||||
return err
|
||||
}
|
||||
r.Unreadable = append(r.Unreadable, rel)
|
||||
if d != nil && d.IsDir() {
|
||||
return filepath.SkipDir
|
||||
}
|
||||
return nil
|
||||
}
|
||||
if d.IsDir() && p == rootGit {
|
||||
return filepath.SkipDir
|
||||
}
|
||||
if d.Type()&os.ModeSymlink != 0 {
|
||||
r.Symlinks = append(r.Symlinks, rel)
|
||||
}
|
||||
return nil
|
||||
})
|
||||
sort.Strings(r.Symlinks)
|
||||
sort.Strings(r.Unreadable)
|
||||
if walkErr != nil {
|
||||
// Only the root's own error reaches here (deeper errors are recorded
|
||||
// as Unreadable). A root that cannot be listed cannot be shown clean
|
||||
// (PR #159 round 2: discarding this reported clean while search
|
||||
// served a planted symlink).
|
||||
return r, fmt.Errorf("scan brain dir: %w", walkErr)
|
||||
}
|
||||
return r, nil
|
||||
}
|
||||
|
||||
// Watch rescans every interval (DefaultInterval if non-positive) until ctx
|
||||
// ends. Every symlink found is removed (the link, never its target:
|
||||
// hyperguild#157 decision), so one is readable for at most one interval.
|
||||
// Each removal is an alert; a persistent finding (a link it could not remove,
|
||||
// an unreadable dir, a scan error) alerts once per distinct state. Alerts
|
||||
// queue until Notify succeeds (see alertQueue): an outage delays them, and
|
||||
// any that do not fit the bounded queue, or are undeliverable, are counted in
|
||||
// a summary that is never dropped, so every incident is delivered or counted.
|
||||
//
|
||||
// Delivery runs in its own goroutine (hyperguild#164): a hung notifier, with
|
||||
// a full queue, blocked one flush for several notify timeouts, and while the
|
||||
// scan waited on it a planted link stayed readable for several intervals.
|
||||
// The scan hands alerts over without blocking; any that do not fit are
|
||||
// counted in the summary. When ctx ends, Watch returns after a final flush
|
||||
// of what was handed over (bounded by shutdownFlushTimeout); alerts that
|
||||
// flush cannot deliver are counted in one error log line instead. That
|
||||
// shutdown path only runs for a caller that cancels ctx: cmd/server passes
|
||||
// context.Background(), so in production the flush on handoff is what keeps
|
||||
// alerts from waiting on a restart.
|
||||
func Watch(ctx context.Context, brainDir string, interval time.Duration, n Notifier) {
|
||||
if interval <= 0 {
|
||||
interval = DefaultInterval
|
||||
}
|
||||
t := time.NewTicker(interval)
|
||||
defer t.Stop()
|
||||
alerts := make(chan string, maxPending)
|
||||
var overflow atomic.Int64
|
||||
var wg sync.WaitGroup
|
||||
wg.Add(1)
|
||||
go func() { defer wg.Done(); deliver(ctx, interval, n, alerts, &overflow) }()
|
||||
// The scan is the only sender: closing alerts tells deliver to drain and
|
||||
// flush once more, and Watch returns only after it has.
|
||||
defer func() { close(alerts); wg.Wait() }()
|
||||
q := alertSender{alerts: alerts, overflow: &overflow}
|
||||
reported := ""
|
||||
for {
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
return
|
||||
case <-t.C:
|
||||
}
|
||||
r, err := Scan(brainDir)
|
||||
key := ""
|
||||
if err != nil {
|
||||
key = "cannot scan the brain dir: " + err.Error()
|
||||
} else {
|
||||
removed, failed := removeSymlinks(brainDir, r.Symlinks)
|
||||
if len(removed) > 0 {
|
||||
slog.Error("brain symlink tripwire removed symlinks", "count", len(removed))
|
||||
q.push(fmt.Sprintf("brain symlink tripwire (hyperguild#157): removed %d symlink(s) from the brain dir: %s",
|
||||
len(removed), Result{}.quoted(removed)))
|
||||
}
|
||||
key = Result{Symlinks: failed, Unreadable: r.Unreadable}.String()
|
||||
}
|
||||
if key != reported {
|
||||
reported = key
|
||||
if key != "" {
|
||||
slog.Error("brain symlink tripwire", "finding", key)
|
||||
q.push("brain symlink tripwire (hyperguild#157): " + key +
|
||||
". Readers may follow symlinks out of the brain; fix them.")
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// alertSender hands alerts to deliver without ever blocking the scan; an
|
||||
// alert that does not fit is counted in overflow, which deliver adds to the
|
||||
// summary.
|
||||
type alertSender struct {
|
||||
alerts chan<- string
|
||||
overflow *atomic.Int64
|
||||
}
|
||||
|
||||
func (s alertSender) push(msg string) {
|
||||
select {
|
||||
case s.alerts <- msg:
|
||||
default:
|
||||
s.overflow.Add(1)
|
||||
}
|
||||
}
|
||||
|
||||
// deliver owns the alertQueue. It flushes as soon as an alert is handed
|
||||
// over, and again every interval while any are pending (outage retries).
|
||||
// When alerts is closed (Watch is stopping) it drains it and flushes once
|
||||
// more, bounded by shutdownFlushTimeout, so an alert handed over just before
|
||||
// shutdown is not lost (PR #180 review). Whatever that flush cannot deliver
|
||||
// is logged as one error with its counts, never dropped silently.
|
||||
func deliver(ctx context.Context, interval time.Duration, n Notifier, alerts <-chan string, overflow *atomic.Int64) {
|
||||
t := time.NewTicker(interval)
|
||||
defer t.Stop()
|
||||
q := &alertQueue{}
|
||||
// drain moves everything handed over into the queue; it reports false
|
||||
// once alerts is closed.
|
||||
drain := func() bool {
|
||||
defer func() { q.suppressed += int(overflow.Swap(0)) }()
|
||||
for {
|
||||
select {
|
||||
case msg, ok := <-alerts:
|
||||
if !ok {
|
||||
return false
|
||||
}
|
||||
q.push(msg)
|
||||
default:
|
||||
return true
|
||||
}
|
||||
}
|
||||
}
|
||||
for {
|
||||
select {
|
||||
case msg, ok := <-alerts:
|
||||
if ok {
|
||||
q.push(msg)
|
||||
ok = drain()
|
||||
}
|
||||
if !ok {
|
||||
q.suppressed += int(overflow.Swap(0))
|
||||
fctx, cancel := context.WithTimeout(context.WithoutCancel(ctx), shutdownFlushTimeout)
|
||||
q.flush(fctx, n)
|
||||
cancel()
|
||||
if len(q.items) > 0 || q.suppressed > 0 {
|
||||
slog.Error("symlink tripwire alerts not delivered at shutdown",
|
||||
"undelivered", len(q.items), "suppressed", q.suppressed)
|
||||
}
|
||||
return
|
||||
}
|
||||
q.flush(ctx, n)
|
||||
case <-t.C:
|
||||
if !drain() {
|
||||
continue // the closed channel is handled by the case above
|
||||
}
|
||||
q.flush(ctx, n)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// alertQueue holds alerts until Notify accepts them. It is bounded (at most
|
||||
// maxPending queued) and loses nothing from the record: every overflow and
|
||||
// every dropped message increments suppressed, sent as a summary that is
|
||||
// retried every tick and never dropped.
|
||||
//
|
||||
// A message is dropped only when the notifier rejects it permanently (an
|
||||
// error with Permanent() == true, e.g. ntfy 413). Every other failure is an
|
||||
// outage, and nothing is dropped however long it lasts (PR #160 round 2:
|
||||
// dropping after N raw failures lost the only incident of a long outage).
|
||||
// Each flush tries every queued message, so one undeliverable message cannot
|
||||
// block the others.
|
||||
type alertQueue struct {
|
||||
items []string
|
||||
suppressed int
|
||||
}
|
||||
|
||||
func (q *alertQueue) push(msg string) {
|
||||
if len(q.items) >= maxPending {
|
||||
q.suppressed++
|
||||
return
|
||||
}
|
||||
q.items = append(q.items, msg)
|
||||
}
|
||||
|
||||
func (q *alertQueue) flush(ctx context.Context, n Notifier) {
|
||||
if n == nil {
|
||||
q.items, q.suppressed = nil, 0
|
||||
return
|
||||
}
|
||||
kept := q.items[:0]
|
||||
for _, msg := range q.items {
|
||||
err := n.Notify(ctx, msg)
|
||||
switch {
|
||||
case err == nil:
|
||||
case permanent(err):
|
||||
slog.Error("symlink tripwire alert rejected permanently; counted in the summary", "err", err)
|
||||
q.suppressed++
|
||||
default:
|
||||
slog.Warn("symlink tripwire notify failed; will retry", "err", err)
|
||||
kept = append(kept, msg)
|
||||
}
|
||||
}
|
||||
q.items = kept
|
||||
if q.suppressed > 0 {
|
||||
msg := fmt.Sprintf("brain symlink tripwire (hyperguild#157): %d further alert(s) were suppressed or undeliverable; check the ingestion logs", q.suppressed)
|
||||
if err := n.Notify(ctx, msg); err == nil {
|
||||
q.suppressed = 0
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// permanent reports whether err says the message itself can never be sent.
|
||||
func permanent(err error) bool {
|
||||
var p interface{ Permanent() bool }
|
||||
return errors.As(err, &p) && p.Permanent()
|
||||
}
|
||||
|
||||
// removeSymlinks unlinks each brain-relative symlink through an os.Root on
|
||||
// the brain dir, after re-checking it is still a symlink. Removing a symlink
|
||||
// never touches its target. It returns what was removed and what was not.
|
||||
func removeSymlinks(brainDir string, rels []string) (removed, failed []string) {
|
||||
if len(rels) == 0 {
|
||||
return nil, nil
|
||||
}
|
||||
resolved, err := filepath.EvalSymlinks(brainDir)
|
||||
if err != nil {
|
||||
return nil, rels
|
||||
}
|
||||
root, err := os.OpenRoot(resolved)
|
||||
if err != nil {
|
||||
return nil, rels
|
||||
}
|
||||
defer func() { _ = root.Close() }()
|
||||
for _, rel := range rels {
|
||||
fi, err := root.Lstat(rel)
|
||||
if err != nil || fi.Mode()&os.ModeSymlink == 0 {
|
||||
failed = append(failed, rel)
|
||||
continue
|
||||
}
|
||||
// root.Remove, not os.RemoveAll: if the link is swapped for a
|
||||
// non-empty directory after the Lstat, Remove refuses rather than
|
||||
// deleting it recursively, and it cannot act outside the root.
|
||||
if err := root.Remove(rel); err != nil {
|
||||
failed = append(failed, rel)
|
||||
continue
|
||||
}
|
||||
removed = append(removed, rel)
|
||||
}
|
||||
return removed, failed
|
||||
}
|
||||
@@ -1,774 +0,0 @@
|
||||
package symlinkguard
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"log/slog"
|
||||
"path/filepath"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
// hyperguild#157: the brain dir is a Syncthing sendreceive folder and
|
||||
// Syncthing syncs symlinks; several readers follow them out of the brain.
|
||||
// Until every reader goes through an os.Root, a symlink anywhere in the brain,
|
||||
// or a directory the scan cannot read (which could hide one), is an incident.
|
||||
|
||||
func TestScanReportsSymlinksAtEveryDepthIncludingNestedGit(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
outside := t.TempDir()
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(brain, "wiki", "w", "facts", ".git"), 0o755))
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(brain, ".git", "objects"), 0o755))
|
||||
require.NoError(t, os.Symlink(filepath.Join(outside, "f"), filepath.Join(brain, "wiki", "w", "facts", "leak.md")))
|
||||
require.NoError(t, os.Symlink(outside, filepath.Join(brain, "wiki", "dirlink")))
|
||||
// PR #159 review: only the ROOT .git is skipped; a nested .git is not
|
||||
// special to the brain readers, which walk into it.
|
||||
require.NoError(t, os.Symlink(filepath.Join(outside, "g"), filepath.Join(brain, "wiki", "w", "facts", ".git", "leak.md")))
|
||||
require.NoError(t, os.Symlink(outside, filepath.Join(brain, ".git", "objects", "alt")))
|
||||
|
||||
r, err := Scan(brain)
|
||||
require.NoError(t, err)
|
||||
assert.ElementsMatch(t, []string{"wiki/w/facts/leak.md", "wiki/dirlink", "wiki/w/facts/.git/leak.md"}, r.Symlinks)
|
||||
assert.Empty(t, r.Unreadable)
|
||||
}
|
||||
|
||||
// PR #159 review: WalkDir stopped at the first unreadable directory and the
|
||||
// startup check passed, while search (which keeps walking) served a planted
|
||||
// symlink. Scan now records the unreadable dir and keeps going.
|
||||
func TestScanReportsUnreadableDirsAndKeepsWalkingPastThem(t *testing.T) {
|
||||
if os.Geteuid() == 0 {
|
||||
t.Skip("root reads mode-000 directories")
|
||||
}
|
||||
brain := t.TempDir()
|
||||
locked := filepath.Join(brain, "aaa")
|
||||
require.NoError(t, os.MkdirAll(locked, 0o755))
|
||||
require.NoError(t, os.Chmod(locked, 0o000))
|
||||
t.Cleanup(func() { _ = os.Chmod(locked, 0o755) })
|
||||
require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, "zzz-planted")))
|
||||
|
||||
r, err := Scan(brain)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, []string{"aaa"}, r.Unreadable)
|
||||
assert.Equal(t, []string{"zzz-planted"}, r.Symlinks, "the walk continues past the unreadable dir")
|
||||
}
|
||||
|
||||
func TestScanResolvesASymlinkedRootAndReportsSymlinkedEntriesInsideIt(t *testing.T) {
|
||||
real := t.TempDir()
|
||||
link := filepath.Join(t.TempDir(), "brain")
|
||||
require.NoError(t, os.Symlink(real, link))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(real, "n.md"), []byte("x"), 0o644))
|
||||
require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(real, "inner")))
|
||||
r, err := Scan(link)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, []string{"inner"}, r.Symlinks)
|
||||
}
|
||||
|
||||
func TestScanOfAMissingRootIsErrNotExist(t *testing.T) {
|
||||
_, err := Scan(filepath.Join(t.TempDir(), "nope"))
|
||||
assert.True(t, errors.Is(err, os.ErrNotExist), "got %v", err)
|
||||
}
|
||||
|
||||
type recNotifier struct {
|
||||
mu sync.Mutex
|
||||
msgs []string
|
||||
fail int // fail the first N calls
|
||||
}
|
||||
|
||||
func (r *recNotifier) Notify(_ context.Context, m string) error {
|
||||
r.mu.Lock()
|
||||
defer r.mu.Unlock()
|
||||
r.msgs = append(r.msgs, m)
|
||||
if r.fail > 0 {
|
||||
r.fail--
|
||||
return errors.New("ntfy down")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (r *recNotifier) count() int { r.mu.Lock(); defer r.mu.Unlock(); return len(r.msgs) }
|
||||
|
||||
func TestWatchNotifiesOncePerDistinctSetAndAgainForANewSet(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
n := &recNotifier{}
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
go Watch(ctx, brain, 10*time.Millisecond, n)
|
||||
|
||||
time.Sleep(50 * time.Millisecond)
|
||||
assert.Zero(t, n.count(), "a clean brain raises nothing")
|
||||
require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, "first")))
|
||||
require.Eventually(t, func() bool { return n.count() == 1 }, 2*time.Second, 10*time.Millisecond)
|
||||
time.Sleep(60 * time.Millisecond)
|
||||
assert.Equal(t, 1, n.count(), "the same set is reported once, not every tick")
|
||||
require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, "second")))
|
||||
require.Eventually(t, func() bool { return n.count() == 2 }, 2*time.Second, 10*time.Millisecond)
|
||||
}
|
||||
|
||||
// PR #159 review: last was recorded before Notify, so an alert lost to an
|
||||
// ntfy outage was never retried while the symlink stayed.
|
||||
func TestWatchRetriesAnAlertThatFailedToSend(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, "planted")))
|
||||
n := &recNotifier{fail: 2}
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
go Watch(ctx, brain, 10*time.Millisecond, n)
|
||||
require.Eventually(t, func() bool { return n.count() == 3 }, 2*time.Second, 10*time.Millisecond)
|
||||
time.Sleep(60 * time.Millisecond)
|
||||
assert.Equal(t, 3, n.count(), "after one successful send, no more")
|
||||
}
|
||||
|
||||
func TestWatchAlertsOnAnUnreadableDir(t *testing.T) {
|
||||
if os.Geteuid() == 0 {
|
||||
t.Skip("root reads mode-000 directories")
|
||||
}
|
||||
brain := t.TempDir()
|
||||
locked := filepath.Join(brain, "locked")
|
||||
require.NoError(t, os.MkdirAll(locked, 0o755))
|
||||
require.NoError(t, os.Chmod(locked, 0o000))
|
||||
t.Cleanup(func() { _ = os.Chmod(locked, 0o755) })
|
||||
n := &recNotifier{}
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
go Watch(ctx, brain, 10*time.Millisecond, n)
|
||||
require.Eventually(t, func() bool { return n.count() == 1 }, 2*time.Second, 10*time.Millisecond)
|
||||
assert.Contains(t, n.msgs[0], "locked")
|
||||
}
|
||||
|
||||
// PR #159 review: a non-positive interval panicked time.NewTicker inside the
|
||||
// goroutine and crashlooped the server.
|
||||
func TestWatchToleratesANonPositiveInterval(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
done := make(chan struct{})
|
||||
go func() { Watch(ctx, brain, 0, nil); close(done) }()
|
||||
cancel()
|
||||
select {
|
||||
case <-done:
|
||||
case <-time.After(2 * time.Second):
|
||||
t.Fatal("Watch did not return on cancel")
|
||||
}
|
||||
}
|
||||
|
||||
// PR #159 round 2: a brain root that can be entered but not listed (mode
|
||||
// 0100) made WalkDir fail at the root; the error was discarded and Scan
|
||||
// reported clean, while search (which goes straight into wiki/) still served
|
||||
// a planted symlink. A root that cannot be listed is now an error.
|
||||
func TestScanOfAnUnlistableRootIsAnError(t *testing.T) {
|
||||
if os.Geteuid() == 0 {
|
||||
t.Skip("root lists mode-0100 directories")
|
||||
}
|
||||
brain := t.TempDir()
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(brain, "wiki"), 0o755))
|
||||
require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, "wiki", "leak.md")))
|
||||
require.NoError(t, os.Chmod(brain, 0o100))
|
||||
t.Cleanup(func() { _ = os.Chmod(brain, 0o755) })
|
||||
_, err := Scan(brain)
|
||||
require.Error(t, err)
|
||||
assert.False(t, errors.Is(err, os.ErrNotExist), "an unlistable root is not a missing root")
|
||||
}
|
||||
|
||||
// The same set that disappears and comes back is reported again.
|
||||
func TestWatchReportsASetAgainAfterItWasCleared(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
link := filepath.Join(brain, "planted")
|
||||
n := &recNotifier{}
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
go Watch(ctx, brain, 10*time.Millisecond, n)
|
||||
require.NoError(t, os.Symlink(t.TempDir(), link))
|
||||
require.Eventually(t, func() bool { return n.count() == 1 }, 2*time.Second, 10*time.Millisecond)
|
||||
// The tripwire removed it; planting it again is a new event.
|
||||
require.Eventually(t, func() bool { _, err := os.Lstat(link); return os.IsNotExist(err) }, 2*time.Second, 10*time.Millisecond)
|
||||
require.NoError(t, os.Symlink(t.TempDir(), link))
|
||||
require.Eventually(t, func() bool { return n.count() == 2 }, 2*time.Second, 10*time.Millisecond)
|
||||
}
|
||||
|
||||
// hyperguild#157 decision: the runtime tripwire removes a symlink it finds
|
||||
// (the link, never its target), so it is readable for at most one interval
|
||||
// instead of until a human acts, and the alert says what was removed.
|
||||
func TestWatchRemovesAnOutsideFileLinkButNotItsTargetOrRegularFiles(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
outside := filepath.Join(t.TempDir(), "target.md")
|
||||
require.NoError(t, os.WriteFile(outside, []byte("keep me"), 0o644))
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(brain, "wiki"), 0o755))
|
||||
link := filepath.Join(brain, "wiki", "leak.md")
|
||||
require.NoError(t, os.Symlink(outside, link))
|
||||
regular := filepath.Join(brain, "wiki", "note.md")
|
||||
require.NoError(t, os.WriteFile(regular, []byte("note"), 0o644))
|
||||
|
||||
n := &recNotifier{}
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
go Watch(ctx, brain, 10*time.Millisecond, n)
|
||||
|
||||
require.Eventually(t, func() bool {
|
||||
_, err := os.Lstat(link)
|
||||
return os.IsNotExist(err)
|
||||
}, 2*time.Second, 10*time.Millisecond, "the symlink is removed")
|
||||
require.Eventually(t, func() bool { return n.count() >= 1 }, 2*time.Second, 10*time.Millisecond)
|
||||
b, err := os.ReadFile(outside)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "keep me", string(b), "the target is untouched")
|
||||
b, err = os.ReadFile(regular)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "note", string(b), "regular files are untouched")
|
||||
n.mu.Lock()
|
||||
defer n.mu.Unlock()
|
||||
assert.Contains(t, n.msgs[0], "removed")
|
||||
assert.Contains(t, n.msgs[0], "wiki/leak.md")
|
||||
}
|
||||
|
||||
func TestDefaultIntervalIsThirtySeconds(t *testing.T) {
|
||||
assert.Equal(t, 30*time.Second, DefaultInterval)
|
||||
}
|
||||
|
||||
// PR #160 review: the Lstat re-check and the os.Root confinement in
|
||||
// removeSymlinks had no test. Anything that is not a symlink inside the brain
|
||||
// is reported failed and nothing is deleted.
|
||||
func TestRemoveSymlinksRefusesNonSymlinksEscapesAndPathsThroughLinks(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(brain, "wiki", "real"), 0o755))
|
||||
regular := filepath.Join(brain, "wiki", "note.md")
|
||||
require.NoError(t, os.WriteFile(regular, []byte("note"), 0o644))
|
||||
inLinked := filepath.Join(brain, "wiki", "real", "x.md")
|
||||
require.NoError(t, os.WriteFile(inLinked, []byte("x"), 0o644))
|
||||
require.NoError(t, os.Symlink(filepath.Join(brain, "wiki", "real"), filepath.Join(brain, "wiki", "linkdir")))
|
||||
outside := filepath.Join(filepath.Dir(brain), "outside-157.md")
|
||||
require.NoError(t, os.WriteFile(outside, []byte("o"), 0o644))
|
||||
t.Cleanup(func() { _ = os.Remove(outside) })
|
||||
|
||||
removed, failed := removeSymlinks(brain, []string{
|
||||
"wiki/note.md", "wiki/linkdir/x.md", "../outside-157.md", "wiki/missing.md",
|
||||
})
|
||||
assert.Empty(t, removed)
|
||||
assert.ElementsMatch(t, []string{"wiki/note.md", "wiki/linkdir/x.md", "../outside-157.md", "wiki/missing.md"}, failed)
|
||||
for _, p := range []string{regular, inLinked, outside} {
|
||||
_, err := os.Stat(p)
|
||||
assert.NoError(t, err, "%s must not be deleted", p)
|
||||
}
|
||||
}
|
||||
|
||||
// Dir targets and in-brain targets survive too, not only an outside file.
|
||||
func TestWatchRemovesDirAndInBrainLinksButNotTheirTargets(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
outsideDir := t.TempDir()
|
||||
require.NoError(t, os.WriteFile(filepath.Join(outsideDir, "keep.md"), []byte("keep"), 0o644))
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(brain, "wiki"), 0o755))
|
||||
inBrain := filepath.Join(brain, "wiki", "target.md")
|
||||
require.NoError(t, os.WriteFile(inBrain, []byte("t"), 0o644))
|
||||
require.NoError(t, os.Symlink(outsideDir, filepath.Join(brain, "wiki", "dirlink")))
|
||||
require.NoError(t, os.Symlink(inBrain, filepath.Join(brain, "wiki", "inlink.md")))
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
go Watch(ctx, brain, 10*time.Millisecond, nil)
|
||||
require.Eventually(t, func() bool {
|
||||
r, err := Scan(brain)
|
||||
return err == nil && len(r.Symlinks) == 0
|
||||
}, 2*time.Second, 10*time.Millisecond)
|
||||
for _, p := range []string{filepath.Join(outsideDir, "keep.md"), inBrain} {
|
||||
_, err := os.Stat(p)
|
||||
assert.NoError(t, err, "%s must survive", p)
|
||||
}
|
||||
}
|
||||
|
||||
// PR #160 review: the planter chooses the paths. An alert names at most
|
||||
// maxPathsPerAlert of them and counts the rest, so its size stays bounded.
|
||||
func TestWatchAlertNamesBoundedPathsAndCountsTheRest(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
for i := 0; i < 50; i++ {
|
||||
require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, strings.Repeat("n", 100)+strconv.Itoa(i))))
|
||||
}
|
||||
n := &recNotifier{}
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
go Watch(ctx, brain, 10*time.Millisecond, n)
|
||||
require.Eventually(t, func() bool { return n.count() >= 1 }, 2*time.Second, 10*time.Millisecond)
|
||||
n.mu.Lock()
|
||||
msg := n.msgs[0]
|
||||
n.mu.Unlock()
|
||||
assert.Contains(t, msg, "removed 50 symlink(s)")
|
||||
assert.Contains(t, msg, "and 40 more")
|
||||
assert.Less(t, len(msg), 2500, "alert size is bounded regardless of how many links were planted")
|
||||
}
|
||||
|
||||
// rejectNotifier refuses every message containing a marker, forever.
|
||||
type rejectNotifier struct {
|
||||
recNotifier
|
||||
reject string
|
||||
}
|
||||
|
||||
// permanentErr is a rejection the notifier says can never succeed (like ntfy 413).
|
||||
type permanentErr struct{}
|
||||
|
||||
func (permanentErr) Error() string { return "413 payload too large" }
|
||||
func (permanentErr) Permanent() bool { return true }
|
||||
|
||||
func (r *rejectNotifier) Notify(ctx context.Context, m string) error {
|
||||
if strings.Contains(m, r.reject) {
|
||||
r.mu.Lock()
|
||||
r.msgs = append(r.msgs, "REJECTED")
|
||||
r.mu.Unlock()
|
||||
return permanentErr{}
|
||||
}
|
||||
return r.recNotifier.Notify(ctx, m)
|
||||
}
|
||||
|
||||
// PR #160 review: one message the server will never accept blocked every
|
||||
// later alert forever (head-of-line). It is dropped after maxAttempts.
|
||||
func TestWatchDropsAMessageThatNeverSendsSoLaterAlertsFlow(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
n := &rejectNotifier{reject: "POISON"}
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
go Watch(ctx, brain, 10*time.Millisecond, n)
|
||||
require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, "POISON")))
|
||||
time.Sleep(30 * time.Millisecond)
|
||||
require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, "later")))
|
||||
require.Eventually(t, func() bool {
|
||||
n.mu.Lock()
|
||||
defer n.mu.Unlock()
|
||||
for _, m := range n.msgs {
|
||||
if strings.Contains(m, "later") {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}, 3*time.Second, 10*time.Millisecond, "a later alert is delivered despite a poison message")
|
||||
}
|
||||
|
||||
// toggleNotifier fails while down is set. Like the real audit.NtfyNotifier
|
||||
// (http.NewRequestWithContext), it also fails, without recording, when its
|
||||
// ctx is already done (PR #180 round 2: notifiers that ignored ctx let a
|
||||
// final flush on the cancelled ctx pass).
|
||||
type toggleNotifier struct {
|
||||
recNotifier
|
||||
down atomic.Bool
|
||||
}
|
||||
|
||||
func (r *toggleNotifier) Notify(ctx context.Context, m string) error {
|
||||
if err := ctx.Err(); err != nil {
|
||||
return err
|
||||
}
|
||||
if r.down.Load() {
|
||||
return errors.New("ntfy down")
|
||||
}
|
||||
return r.recNotifier.Notify(ctx, m)
|
||||
}
|
||||
|
||||
// PR #160 review: an outage queued one message per removal, unbounded. The
|
||||
// queue holds at most maxPending messages; the rest become one summary.
|
||||
func TestWatchQueueIsBoundedDuringAnOutage(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
n := &toggleNotifier{}
|
||||
n.down.Store(true)
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
go Watch(ctx, brain, 5*time.Millisecond, n)
|
||||
for i := 0; i < 30; i++ {
|
||||
link := filepath.Join(brain, "p"+strconv.Itoa(i))
|
||||
require.NoError(t, os.Symlink(t.TempDir(), link))
|
||||
require.Eventually(t, func() bool { _, err := os.Lstat(link); return os.IsNotExist(err) }, 2*time.Second, 2*time.Millisecond)
|
||||
}
|
||||
n.down.Store(false)
|
||||
require.Eventually(t, func() bool { return n.count() >= 1 }, 2*time.Second, 5*time.Millisecond)
|
||||
time.Sleep(100 * time.Millisecond)
|
||||
assert.LessOrEqual(t, n.count(), maxPending+1, "queued alerts plus at most one suppression summary")
|
||||
n.mu.Lock()
|
||||
defer n.mu.Unlock()
|
||||
found := false
|
||||
for _, m := range n.msgs {
|
||||
if strings.Contains(m, "suppressed") {
|
||||
found = true
|
||||
}
|
||||
}
|
||||
assert.True(t, found, "suppressed alerts are counted in a summary")
|
||||
}
|
||||
|
||||
// Within the bound, every alert queued during an outage is delivered after
|
||||
// it, each naming its own removal (PR #160 review: truncating the queue after
|
||||
// the first send stayed green).
|
||||
func TestWatchDeliversEveryQueuedAlertAfterAShortOutage(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
n := &toggleNotifier{}
|
||||
n.down.Store(true)
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
go Watch(ctx, brain, 5*time.Millisecond, n)
|
||||
for _, name := range []string{"qa", "qb", "qc"} {
|
||||
link := filepath.Join(brain, name)
|
||||
require.NoError(t, os.Symlink(t.TempDir(), link))
|
||||
require.Eventually(t, func() bool { _, err := os.Lstat(link); return os.IsNotExist(err) }, 2*time.Second, 2*time.Millisecond)
|
||||
}
|
||||
n.down.Store(false)
|
||||
require.Eventually(t, func() bool { return n.count() == 3 }, 2*time.Second, 5*time.Millisecond)
|
||||
n.mu.Lock()
|
||||
defer n.mu.Unlock()
|
||||
for i, name := range []string{"qa", "qb", "qc"} {
|
||||
assert.Contains(t, n.msgs[i], strconv.Quote(name))
|
||||
}
|
||||
}
|
||||
|
||||
// PR #160 round 2: dropping after N failures could not tell a poison message
|
||||
// from an outage, so a 15-minute outage silently lost the only incident. A
|
||||
// message is only dropped when it keeps failing while others send; through
|
||||
// an outage nothing is dropped, however long.
|
||||
func TestWatchLosesNoAlertThroughALongOutage(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
n := &toggleNotifier{}
|
||||
n.down.Store(true)
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
go Watch(ctx, brain, 2*time.Millisecond, n)
|
||||
link := filepath.Join(brain, "only-incident")
|
||||
require.NoError(t, os.Symlink(t.TempDir(), link))
|
||||
require.Eventually(t, func() bool { _, err := os.Lstat(link); return os.IsNotExist(err) }, 2*time.Second, 2*time.Millisecond)
|
||||
time.Sleep(200 * time.Millisecond) // ~100 ticks of outage, far past any attempt limit
|
||||
n.down.Store(false)
|
||||
require.Eventually(t, func() bool { return n.count() >= 1 }, 2*time.Second, 5*time.Millisecond)
|
||||
n.mu.Lock()
|
||||
defer n.mu.Unlock()
|
||||
assert.Contains(t, n.msgs[0], strconv.Quote("only-incident"))
|
||||
}
|
||||
|
||||
// Every removal is either delivered or counted in the suppression summary:
|
||||
// none disappears from the record (round 2: 74 of 300 were in neither).
|
||||
func TestWatchAccountsForEveryRemovalDuringAnOutage(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
n := &toggleNotifier{}
|
||||
n.down.Store(true)
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
go Watch(ctx, brain, 2*time.Millisecond, n)
|
||||
const plants = 25
|
||||
for i := 0; i < plants; i++ {
|
||||
link := filepath.Join(brain, "acct"+strconv.Itoa(i))
|
||||
require.NoError(t, os.Symlink(t.TempDir(), link))
|
||||
require.Eventually(t, func() bool { _, err := os.Lstat(link); return os.IsNotExist(err) }, 2*time.Second, 1*time.Millisecond)
|
||||
}
|
||||
n.down.Store(false)
|
||||
require.Eventually(t, func() bool {
|
||||
n.mu.Lock()
|
||||
defer n.mu.Unlock()
|
||||
for _, m := range n.msgs {
|
||||
if strings.Contains(m, "suppressed") {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}, 2*time.Second, 5*time.Millisecond)
|
||||
time.Sleep(50 * time.Millisecond)
|
||||
n.mu.Lock()
|
||||
defer n.mu.Unlock()
|
||||
delivered, counted := 0, 0
|
||||
for _, m := range n.msgs {
|
||||
if strings.Contains(m, "removed 1 symlink(s)") {
|
||||
delivered++
|
||||
}
|
||||
if i := strings.Index(m, "): "); i >= 0 && strings.Contains(m, "suppressed") {
|
||||
_, _ = fmt.Sscanf(m[i+3:], "%d", &counted)
|
||||
}
|
||||
}
|
||||
assert.Equal(t, plants, delivered+counted, "delivered %d + counted %d must equal %d removals", delivered, counted, plants)
|
||||
}
|
||||
|
||||
// A poison message is still dropped (others send while it fails), and the
|
||||
// drop is counted in the summary.
|
||||
func TestWatchDropsAPoisonMessageAndCountsIt(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
n := &rejectNotifier{reject: "POISON"}
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
go Watch(ctx, brain, 5*time.Millisecond, n)
|
||||
require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, "POISON")))
|
||||
time.Sleep(20 * time.Millisecond)
|
||||
require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, "fine")))
|
||||
require.Eventually(t, func() bool {
|
||||
n.mu.Lock()
|
||||
defer n.mu.Unlock()
|
||||
for _, m := range n.msgs {
|
||||
if strings.Contains(m, "1 further alert(s)") {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}, 3*time.Second, 5*time.Millisecond, "the dropped poison alert is counted in a summary")
|
||||
}
|
||||
|
||||
// hungNotifier answers every Notify only after latency (or when ctx ends),
|
||||
// with an outage error: an ntfy that accepts connections but never responds
|
||||
// until its timeout.
|
||||
type hungNotifier struct{ latency time.Duration }
|
||||
|
||||
func (h hungNotifier) Notify(ctx context.Context, _ string) error {
|
||||
select {
|
||||
case <-time.After(h.latency):
|
||||
case <-ctx.Done():
|
||||
}
|
||||
return errors.New("ntfy timeout")
|
||||
}
|
||||
|
||||
func waitGone(t *testing.T, link string) {
|
||||
t.Helper()
|
||||
require.Eventually(t, func() bool { _, err := os.Lstat(link); return os.IsNotExist(err) }, 10*time.Second, time.Millisecond)
|
||||
}
|
||||
|
||||
// hyperguild#164: alerts were flushed in the scan goroutine, so with a hung
|
||||
// ntfy and a full queue one flush (6 x notify timeout) delayed the next scan.
|
||||
// The notifier here is slower than the interval, as in production (10 s
|
||||
// timeout vs 30 s interval with 6 messages), so the alert handoff is full:
|
||||
// a scan that waited on it would keep a link for seconds.
|
||||
func TestWatchLinkLifetimeStaysNearOneIntervalWithANotifierSlowerThanTheInterval(t *testing.T) {
|
||||
const interval = 100 * time.Millisecond
|
||||
brain := t.TempDir()
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
go Watch(ctx, brain, interval, hungNotifier{latency: 400 * time.Millisecond})
|
||||
|
||||
for i := 0; i < 2*maxPending+3; i++ { // overfill queue and handoff
|
||||
link := filepath.Join(brain, "fill"+strconv.Itoa(i))
|
||||
require.NoError(t, os.Symlink(t.TempDir(), link))
|
||||
waitGone(t, link)
|
||||
}
|
||||
var worst time.Duration
|
||||
for i := 0; i < 6; i++ {
|
||||
link := filepath.Join(brain, "probe"+strconv.Itoa(i))
|
||||
require.NoError(t, os.Symlink(t.TempDir(), link))
|
||||
planted := time.Now()
|
||||
waitGone(t, link)
|
||||
worst = max(worst, time.Since(planted))
|
||||
}
|
||||
assert.LessOrEqual(t, worst, interval+interval/2, "worst link lifetime %v with a hung notifier", worst)
|
||||
}
|
||||
|
||||
// Review of PR #180: delivery waited for its own tick, about one interval
|
||||
// after the removal. An alert is now flushed as soon as it is handed over.
|
||||
func TestWatchDeliversARemovalAlertWellWithinOneInterval(t *testing.T) {
|
||||
const interval = 400 * time.Millisecond
|
||||
brain := t.TempDir()
|
||||
n := &recNotifier{}
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
go Watch(ctx, brain, interval, n)
|
||||
link := filepath.Join(brain, "prompt")
|
||||
require.NoError(t, os.Symlink(t.TempDir(), link))
|
||||
waitGone(t, link)
|
||||
removed := time.Now()
|
||||
require.Eventually(t, func() bool { return n.count() == 1 }, 2*time.Second, time.Millisecond)
|
||||
assert.Less(t, time.Since(removed), interval/4)
|
||||
}
|
||||
|
||||
// Review of PR #180: on ctx end, deliver returned without draining what the
|
||||
// scan had handed over, so a removal just before shutdown was neither
|
||||
// delivered nor counted. Watch now drains and flushes before returning.
|
||||
func TestWatchDeliversAnAlertHandedOverJustBeforeShutdown(t *testing.T) {
|
||||
for i := 0; i < 20; i++ {
|
||||
brain := t.TempDir()
|
||||
n := &recNotifier{}
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
done := make(chan struct{})
|
||||
go func() { Watch(ctx, brain, 5*time.Millisecond, n); close(done) }()
|
||||
link := filepath.Join(brain, "late")
|
||||
require.NoError(t, os.Symlink(t.TempDir(), link))
|
||||
waitGone(t, link)
|
||||
cancel()
|
||||
<-done
|
||||
require.Equal(t, 1, n.count(), "iteration %d: the removal alert was lost at shutdown", i)
|
||||
}
|
||||
}
|
||||
|
||||
// blockingNotifier holds every Notify until its ctx ends, tracking calls in
|
||||
// flight.
|
||||
type blockingNotifier struct{ inFlight atomic.Int32 }
|
||||
|
||||
func (b *blockingNotifier) Notify(ctx context.Context, _ string) error {
|
||||
b.inFlight.Add(1)
|
||||
defer b.inFlight.Add(-1)
|
||||
<-ctx.Done()
|
||||
return ctx.Err()
|
||||
}
|
||||
|
||||
// Watch does not return while its delivery goroutine is still notifying.
|
||||
func TestWatchReturnsOnlyAfterDeliveryHasStopped(t *testing.T) {
|
||||
prev := shutdownFlushTimeout
|
||||
shutdownFlushTimeout = 50 * time.Millisecond
|
||||
t.Cleanup(func() { shutdownFlushTimeout = prev })
|
||||
brain := t.TempDir()
|
||||
n := &blockingNotifier{}
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
done := make(chan struct{})
|
||||
go func() { Watch(ctx, brain, 5*time.Millisecond, n); close(done) }()
|
||||
link := filepath.Join(brain, "x")
|
||||
require.NoError(t, os.Symlink(t.TempDir(), link))
|
||||
waitGone(t, link)
|
||||
require.Eventually(t, func() bool { return n.inFlight.Load() == 1 }, 2*time.Second, time.Millisecond)
|
||||
cancel()
|
||||
select {
|
||||
case <-done:
|
||||
case <-time.After(5 * time.Second):
|
||||
t.Fatal("Watch did not return after cancel")
|
||||
}
|
||||
assert.Zero(t, n.inFlight.Load(), "Notify still running after Watch returned")
|
||||
}
|
||||
|
||||
// slowToggleNotifier fails slowly (a hung ntfy) while down, then records.
|
||||
type slowToggleNotifier struct {
|
||||
recNotifier
|
||||
down atomic.Bool
|
||||
latency time.Duration
|
||||
}
|
||||
|
||||
func (r *slowToggleNotifier) Notify(ctx context.Context, m string) error {
|
||||
if r.down.Load() {
|
||||
select {
|
||||
case <-time.After(r.latency):
|
||||
case <-ctx.Done():
|
||||
}
|
||||
return errors.New("ntfy timeout")
|
||||
}
|
||||
return r.recNotifier.Notify(ctx, m)
|
||||
}
|
||||
|
||||
// Review of PR #180: with a slow notifier the scan's handoff overflows, and
|
||||
// those alerts exist only in the overflow counter. Every removal is still
|
||||
// delivered or counted in the summary.
|
||||
func TestWatchCountsHandoffOverflowWithASlowNotifier(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
n := &slowToggleNotifier{latency: 30 * time.Millisecond}
|
||||
n.down.Store(true)
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
go Watch(ctx, brain, 2*time.Millisecond, n)
|
||||
const plants = 40
|
||||
for i := 0; i < plants; i++ {
|
||||
link := filepath.Join(brain, "ov"+strconv.Itoa(i))
|
||||
require.NoError(t, os.Symlink(t.TempDir(), link))
|
||||
waitGone(t, link)
|
||||
}
|
||||
n.down.Store(false)
|
||||
delivered, counted := 0, 0
|
||||
require.Eventually(t, func() bool {
|
||||
n.mu.Lock()
|
||||
defer n.mu.Unlock()
|
||||
delivered, counted = 0, 0
|
||||
for _, m := range n.msgs {
|
||||
if strings.Contains(m, "removed 1 symlink(s)") {
|
||||
delivered++
|
||||
}
|
||||
if i := strings.Index(m, "): "); i >= 0 && strings.Contains(m, "suppressed") {
|
||||
var c int
|
||||
_, _ = fmt.Sscanf(m[i+3:], "%d", &c)
|
||||
counted += c
|
||||
}
|
||||
}
|
||||
return delivered+counted == plants
|
||||
}, 5*time.Second, 10*time.Millisecond, "delivered %d + counted %d of %d", delivered, counted, plants)
|
||||
}
|
||||
|
||||
// An alert still queued when Watch stops (its send failed, the notifier has
|
||||
// since recovered, the retry tick has not come) is flushed once more before
|
||||
// Watch returns, on a ctx that is not the cancelled one: toggleNotifier fails
|
||||
// on a done ctx, as the real ntfy notifier does.
|
||||
func TestWatchFinalFlushSendsAQueuedAlertOnACtxThatOutlivesTheCancel(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
n := &toggleNotifier{}
|
||||
n.down.Store(true)
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
done := make(chan struct{})
|
||||
go func() { Watch(ctx, brain, 300*time.Millisecond, n); close(done) }()
|
||||
link := filepath.Join(brain, "queued")
|
||||
require.NoError(t, os.Symlink(t.TempDir(), link))
|
||||
waitGone(t, link)
|
||||
time.Sleep(20 * time.Millisecond) // let the immediate send fail
|
||||
n.down.Store(false)
|
||||
cancel()
|
||||
<-done
|
||||
assert.Equal(t, 1, n.count(), "the queued alert was not flushed at shutdown")
|
||||
}
|
||||
|
||||
// lockedBuffer is a goroutine-safe log sink: Watch goroutines of earlier
|
||||
// tests may still log while one test captures.
|
||||
type lockedBuffer struct {
|
||||
mu sync.Mutex
|
||||
buf bytes.Buffer
|
||||
}
|
||||
|
||||
func (b *lockedBuffer) Write(p []byte) (int, error) {
|
||||
b.mu.Lock()
|
||||
defer b.mu.Unlock()
|
||||
return b.buf.Write(p)
|
||||
}
|
||||
|
||||
func (b *lockedBuffer) String() string { b.mu.Lock(); defer b.mu.Unlock(); return b.buf.String() }
|
||||
|
||||
func captureLog(t *testing.T) *lockedBuffer {
|
||||
t.Helper()
|
||||
b := &lockedBuffer{}
|
||||
prev := slog.Default()
|
||||
slog.SetDefault(slog.New(slog.NewTextHandler(b, nil)))
|
||||
t.Cleanup(func() { slog.SetDefault(prev) })
|
||||
return b
|
||||
}
|
||||
|
||||
// PR #180 round 2: when the final flush fails (ntfy hung at shutdown) the
|
||||
// undelivered alerts vanished with only "will retry" warnings. Watch now logs
|
||||
// one error with both counts.
|
||||
func TestWatchLogsUndeliveredAndSuppressedCountsWhenTheFinalFlushFails(t *testing.T) {
|
||||
prev := shutdownFlushTimeout
|
||||
shutdownFlushTimeout = 50 * time.Millisecond
|
||||
t.Cleanup(func() { shutdownFlushTimeout = prev })
|
||||
logs := captureLog(t)
|
||||
brain := t.TempDir()
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
done := make(chan struct{})
|
||||
go func() { Watch(ctx, brain, 5*time.Millisecond, hungNotifier{latency: time.Hour}); close(done) }()
|
||||
link := filepath.Join(brain, "lost")
|
||||
require.NoError(t, os.Symlink(t.TempDir(), link))
|
||||
waitGone(t, link)
|
||||
cancel()
|
||||
<-done
|
||||
out := logs.String()
|
||||
assert.Contains(t, out, "level=ERROR")
|
||||
assert.Contains(t, out, `msg="symlink tripwire alerts not delivered at shutdown"`)
|
||||
assert.Contains(t, out, "undelivered=1")
|
||||
assert.Contains(t, out, "suppressed=0")
|
||||
}
|
||||
|
||||
// deliver, given a handoff that already holds alerts and is closed, moves them
|
||||
// into the queue and runs the final flush, even though the ctx is cancelled:
|
||||
// the drain-on-close path, without depending on when the close lands.
|
||||
func TestDeliverFlushesAlertsDrainedFromAClosedHandoffOnACancelledCtx(t *testing.T) {
|
||||
alerts := make(chan string, 3)
|
||||
alerts <- "a1"
|
||||
alerts <- "a2"
|
||||
close(alerts)
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
cancel()
|
||||
n := &toggleNotifier{}
|
||||
var overflow atomic.Int64
|
||||
deliver(ctx, time.Hour, n, alerts, &overflow)
|
||||
assert.Equal(t, []string{"a1", "a2"}, n.msgs)
|
||||
}
|
||||
|
||||
// PR #180 round 2: when the first receive after close finds the handoff empty,
|
||||
// overflow counted by the scan was never moved into the summary.
|
||||
func TestDeliverCountsOverflowWhenTheHandoffIsClosedAndEmpty(t *testing.T) {
|
||||
alerts := make(chan string)
|
||||
close(alerts)
|
||||
n := &recNotifier{}
|
||||
var overflow atomic.Int64
|
||||
overflow.Store(3)
|
||||
deliver(context.Background(), time.Hour, n, alerts, &overflow)
|
||||
require.Len(t, n.msgs, 1)
|
||||
assert.Contains(t, n.msgs[0], "3 further alert(s)")
|
||||
}
|
||||
@@ -2,15 +2,12 @@ package vectorstore
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io/fs"
|
||||
"log/slog"
|
||||
"path"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
|
||||
)
|
||||
|
||||
// Embedder produces dense vectors. The embed package's Client satisfies
|
||||
@@ -93,38 +90,31 @@ func Sync(ctx context.Context, brainDir string, store Store, embedder Embedder)
|
||||
}
|
||||
seenParents := make(map[string]struct{})
|
||||
|
||||
// Through the brain root, regular files only (hyperguild#157): the brain
|
||||
// is a Syncthing folder, and os.ReadFile followed a synced symlink into
|
||||
// the embeddings and blocked on a FIFO.
|
||||
bfs, err := brainfs.Open(brainDir)
|
||||
if err != nil {
|
||||
return res, fmt.Errorf("open brain: %w", err)
|
||||
}
|
||||
defer func() { _ = bfs.Close() }()
|
||||
|
||||
for _, sub := range scanDirs {
|
||||
if _, err := bfs.Lstat(sub); errors.Is(err, fs.ErrNotExist) {
|
||||
root := filepath.Join(brainDir, sub)
|
||||
if _, err := os.Stat(root); os.IsNotExist(err) {
|
||||
continue
|
||||
}
|
||||
// Any other walk error, including a scan root that is a symlink,
|
||||
// aborts the run below.
|
||||
var walkErr error
|
||||
onErr := func(rel string, err error) {
|
||||
if walkErr == nil {
|
||||
walkErr = fmt.Errorf("%s: %w", rel, err)
|
||||
|
||||
err = filepath.WalkDir(root, func(path string, d os.DirEntry, err error) error {
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
err = bfs.WalkRegular(sub, func(relSlash string) error {
|
||||
if !strings.HasSuffix(relSlash, ".md") || path.Base(relSlash) == "_index.md" {
|
||||
if d.IsDir() || !strings.HasSuffix(path, ".md") || d.Name() == "_index.md" {
|
||||
return nil
|
||||
}
|
||||
rel, err := filepath.Rel(brainDir, path)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
relSlash := filepath.ToSlash(rel)
|
||||
seenParents[relSlash] = struct{}{}
|
||||
|
||||
if ps, ok := parents[relSlash]; ok {
|
||||
// File already has chunks in the store. Re-embed only when
|
||||
// the file has been edited since the oldest chunk was
|
||||
// written. Tolerate clock skew with a sub-second grace.
|
||||
info, statErr := bfs.Lstat(relSlash)
|
||||
info, statErr := d.Info()
|
||||
if statErr != nil {
|
||||
res.Errors = append(res.Errors, fmt.Errorf("stat %s: %w", relSlash, statErr))
|
||||
return nil
|
||||
@@ -142,7 +132,7 @@ func Sync(ctx context.Context, brainDir string, store Store, embedder Embedder)
|
||||
}
|
||||
}
|
||||
|
||||
content, readErr := bfs.ReadRegular(relSlash)
|
||||
content, readErr := os.ReadFile(path)
|
||||
if readErr != nil {
|
||||
res.Errors = append(res.Errors, fmt.Errorf("read %s: %w", relSlash, readErr))
|
||||
return nil
|
||||
@@ -161,12 +151,7 @@ func Sync(ctx context.Context, brainDir string, store Store, embedder Embedder)
|
||||
res.Added++
|
||||
}
|
||||
return nil
|
||||
}, onErr)
|
||||
if err == nil {
|
||||
err = walkErr
|
||||
}
|
||||
// Abort before the delete pass: an incomplete walk would leave
|
||||
// seenParents short and delete chunks of files that still exist.
|
||||
})
|
||||
if err != nil {
|
||||
return res, fmt.Errorf("walk %s: %w", sub, err)
|
||||
}
|
||||
|
||||
@@ -1,126 +0,0 @@
|
||||
package vectorstore_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"sync"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs/brainfstest"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/vectorstore"
|
||||
)
|
||||
|
||||
// recordingEmbedder keeps every text it was asked to embed.
|
||||
type recordingEmbedder struct {
|
||||
mu sync.Mutex
|
||||
texts []string
|
||||
}
|
||||
|
||||
func (e *recordingEmbedder) Embed(_ context.Context, text string) ([]float32, error) {
|
||||
e.mu.Lock()
|
||||
defer e.mu.Unlock()
|
||||
e.texts = append(e.texts, text)
|
||||
return []float32{1}, nil
|
||||
}
|
||||
|
||||
func (e *recordingEmbedder) all() string {
|
||||
e.mu.Lock()
|
||||
defer e.mu.Unlock()
|
||||
return strings.Join(e.texts, "\n")
|
||||
}
|
||||
|
||||
// hyperguild#157 slice 3: Sync walked wiki/ and knowledge/ and read each .md
|
||||
// with os.ReadFile, so a symlinked note had its target embedded and served by
|
||||
// semantic search, and a FIFO stalled the sync.
|
||||
func TestSyncRefusesSymlinkedNotesAndSurvivesSwapRaces(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
writeNote(t, brain, "wiki/w/facts/ok.md", "inside note")
|
||||
require.NoError(t, os.Symlink(brainfstest.Outside(t), filepath.Join(brain, "wiki", "w", "facts", "leak.md")))
|
||||
|
||||
emb := &recordingEmbedder{}
|
||||
store := &stubStore{}
|
||||
_, err := vectorstore.Sync(context.Background(), brain, store, emb)
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, emb.all(), "inside note", "positive control: the regular note is embedded")
|
||||
assert.NotContains(t, emb.all(), brainfstest.Sentinel)
|
||||
for p := range store.upserts {
|
||||
assert.NotContains(t, p, "leak.md")
|
||||
}
|
||||
|
||||
p := filepath.Join(brain, "knowledge", "r.md")
|
||||
require.NoError(t, os.MkdirAll(filepath.Dir(p), 0o755))
|
||||
sync := func() string {
|
||||
e := &recordingEmbedder{}
|
||||
_, _ = vectorstore.Sync(context.Background(), brain, &stubStore{}, e)
|
||||
return e.all()
|
||||
}
|
||||
brainfstest.AssertNoLeak(t, p, "inside", 1500*time.Millisecond, sync)
|
||||
brainfstest.AssertNoHang(t, p, "inside", 1500*time.Millisecond, 6*time.Second, func() { _ = sync() })
|
||||
}
|
||||
|
||||
// Chunks embedded from a symlinked note before this fix are deleted: the
|
||||
// note is no longer seen, so the delete pass drops its rows.
|
||||
func TestSyncDeletesChunksOfASymlinkedNote(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
writeNote(t, brain, "wiki/w/facts/ok.md", "inside note")
|
||||
require.NoError(t, os.Symlink(brainfstest.Outside(t), filepath.Join(brain, "wiki", "w", "facts", "leak.md")))
|
||||
store := &stubStore{known: map[string]time.Time{
|
||||
"wiki/w/facts/leak.md#0001": {},
|
||||
"wiki/w/facts/ok.md#0001": {},
|
||||
}}
|
||||
_, err := vectorstore.Sync(context.Background(), brain, store, &recordingEmbedder{})
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, []string{"wiki/w/facts/leak.md#0001"}, store.deletes)
|
||||
}
|
||||
|
||||
// A walk error aborts Sync before the delete pass, so chunks of files the
|
||||
// walk could not see are kept.
|
||||
func TestSyncAbortsBeforeDeletingWhenASubdirIsUnreadable(t *testing.T) {
|
||||
if os.Geteuid() == 0 {
|
||||
t.Skip("root ignores directory permissions")
|
||||
}
|
||||
brain := t.TempDir()
|
||||
writeNote(t, brain, "wiki/w/facts/ok.md", "inside note")
|
||||
locked := filepath.Join(brain, "wiki", "w")
|
||||
require.NoError(t, os.Chmod(locked, 0o000))
|
||||
t.Cleanup(func() { _ = os.Chmod(locked, 0o755) })
|
||||
store := &stubStore{known: map[string]time.Time{"wiki/w/facts/ok.md#0001": {}}}
|
||||
_, err := vectorstore.Sync(context.Background(), brain, store, &recordingEmbedder{})
|
||||
assert.Error(t, err)
|
||||
assert.Empty(t, store.deletes)
|
||||
}
|
||||
|
||||
// A scan root that is a symlink inside the brain (knowledge -> .) was
|
||||
// followed by fs.WalkDir, aliasing raw/, sessions/ and root files into the
|
||||
// index. Sync now aborts on it, before embedding or deleting anything.
|
||||
func TestSyncAbortsOnASymlinkedScanRoot(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
writeNote(t, brain, "wiki/w/a.md", "wiki note")
|
||||
writeNote(t, brain, "sessions/s1.md", "session note")
|
||||
require.NoError(t, os.Symlink(".", filepath.Join(brain, "knowledge")))
|
||||
emb := &recordingEmbedder{}
|
||||
store := &stubStore{known: map[string]time.Time{"wiki/w/a.md#0001": {}}}
|
||||
_, err := vectorstore.Sync(context.Background(), brain, store, emb)
|
||||
assert.Error(t, err)
|
||||
assert.NotContains(t, emb.all(), "session note")
|
||||
for p := range store.upserts {
|
||||
assert.False(t, strings.HasPrefix(p, "knowledge/"), "upserted %s", p)
|
||||
}
|
||||
assert.Empty(t, store.deletes)
|
||||
}
|
||||
|
||||
// A missing scan root is skipped; the other root still syncs.
|
||||
func TestSyncSkipsAMissingScanRoot(t *testing.T) {
|
||||
brain := t.TempDir()
|
||||
writeNote(t, brain, "wiki/w/a.md", "wiki note")
|
||||
emb := &recordingEmbedder{}
|
||||
_, err := vectorstore.Sync(context.Background(), brain, &stubStore{}, emb)
|
||||
require.NoError(t, err)
|
||||
assert.Contains(t, emb.all(), "wiki note")
|
||||
}
|
||||
@@ -48,25 +48,8 @@ func Start(ctx context.Context, cfg Config) {
|
||||
func processDir(ctx context.Context, cfg Config, date string) []error {
|
||||
rawDir := filepath.Join(cfg.BrainDir, "raw")
|
||||
|
||||
// Every read goes through an os.Root on raw/ (hyperguild#153): raw/ is
|
||||
// writable via Syncthing, and a file swapped for a symlink between the walk
|
||||
// and the read must not lead out of it. A symlinked raw/ is refused.
|
||||
if fi, lerr := os.Lstat(rawDir); lerr != nil {
|
||||
if os.IsNotExist(lerr) {
|
||||
return nil
|
||||
}
|
||||
return []error{fmt.Errorf("stat raw dir: %w", lerr)}
|
||||
} else if fi.Mode()&os.ModeSymlink != 0 || !fi.IsDir() {
|
||||
return []error{fmt.Errorf("raw dir %s is not a real directory; refusing to ingest from it", rawDir)}
|
||||
}
|
||||
root, err := os.OpenRoot(rawDir)
|
||||
if err != nil {
|
||||
return []error{fmt.Errorf("open raw root: %w", err)}
|
||||
}
|
||||
defer func() { _ = root.Close() }()
|
||||
|
||||
var errs []error
|
||||
err = filepath.WalkDir(rawDir, func(path string, d os.DirEntry, err error) error {
|
||||
err := filepath.WalkDir(rawDir, func(path string, d os.DirEntry, err error) error {
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
@@ -76,16 +59,10 @@ func processDir(ctx context.Context, cfg Config, date string) []error {
|
||||
return nil
|
||||
}
|
||||
|
||||
// Skip processed/, failed/, and rejected/ subdirectories entirely.
|
||||
// rejected/ (hyperguild#81, brain_reject) holds notes a human already
|
||||
// looked at and declined — walking into it would run the extraction
|
||||
// pipeline over a note and publish it to the wiki, the exact opposite
|
||||
// of the human's decision. The whole reason RejectNote moves a note
|
||||
// there instead of leaving it in raw/ was to keep it out of every
|
||||
// path that treats raw/ as "awaiting processing" — this is that path.
|
||||
// Skip processed/ and failed/ subdirectories entirely.
|
||||
if d.IsDir() {
|
||||
name := d.Name()
|
||||
if name == "processed" || name == "failed" || name == "rejected" {
|
||||
if name == "processed" || name == "failed" {
|
||||
return filepath.SkipDir
|
||||
}
|
||||
return nil
|
||||
@@ -103,10 +80,6 @@ func processDir(ctx context.Context, cfg Config, date string) []error {
|
||||
if strings.HasPrefix(d.Name(), "tunnel-candidates-") {
|
||||
return nil
|
||||
}
|
||||
// Only regular files are notes; a symlink's target may be anywhere.
|
||||
if !d.Type().IsRegular() {
|
||||
return nil
|
||||
}
|
||||
|
||||
// Skip files that have already been processed or permanently failed.
|
||||
if _, err := os.Stat(path + ".processed"); err == nil {
|
||||
@@ -116,7 +89,7 @@ func processDir(ctx context.Context, cfg Config, date string) []error {
|
||||
return nil
|
||||
}
|
||||
|
||||
if err := processFile(ctx, cfg, root, rawDir, path, date); err != nil {
|
||||
if err := processFile(ctx, cfg, path, date); err != nil {
|
||||
errs = append(errs, fmt.Errorf("process %s: %w", filepath.Base(path), err))
|
||||
}
|
||||
return nil
|
||||
@@ -130,15 +103,11 @@ func processDir(ctx context.Context, cfg Config, date string) []error {
|
||||
// processFile reads a file, calls pipeline.Run, copies it to processed/ or failed/,
|
||||
// and writes a marker file next to the original so the watcher skips it next poll.
|
||||
// The original file is never deleted, keeping Syncthing-connected vaults (e.g. Obsidian) intact.
|
||||
func processFile(ctx context.Context, cfg Config, root *os.Root, rawDir, path, date string) error {
|
||||
func processFile(ctx context.Context, cfg Config, path, date string) error {
|
||||
filename := filepath.Base(path)
|
||||
source := deriveSource(filename)
|
||||
rel, err := filepath.Rel(rawDir, path)
|
||||
if err != nil {
|
||||
return fmt.Errorf("relative path: %w", err)
|
||||
}
|
||||
|
||||
content, err := extract.TextIn(root, rel)
|
||||
content, err := extract.Text(path)
|
||||
if err != nil {
|
||||
return fmt.Errorf("extract text: %w", err)
|
||||
}
|
||||
@@ -151,7 +120,7 @@ func processFile(ctx context.Context, cfg Config, root *os.Root, rawDir, path, d
|
||||
return fmt.Errorf("mkdir failed dir: %w", mkErr)
|
||||
}
|
||||
dest := filepath.Join(failedDir, filename)
|
||||
if cpErr := copyFromRoot(root, rel, dest); cpErr != nil {
|
||||
if cpErr := copyFile(path, dest); cpErr != nil {
|
||||
return fmt.Errorf("copy to failed: %w", cpErr)
|
||||
}
|
||||
if mkErr := os.WriteFile(path+".failed", []byte(runErr.Error()), 0o644); mkErr != nil {
|
||||
@@ -179,7 +148,7 @@ func processFile(ctx context.Context, cfg Config, root *os.Root, rawDir, path, d
|
||||
base := strings.TrimSuffix(filename, ext)
|
||||
dest = filepath.Join(processedDir, base+"-"+time.Now().UTC().Format("150405")+ext)
|
||||
}
|
||||
if err := copyFromRoot(root, rel, dest); err != nil {
|
||||
if err := copyFile(path, dest); err != nil {
|
||||
return fmt.Errorf("copy to processed: %w", err)
|
||||
}
|
||||
if err := os.WriteFile(path+".processed", []byte(date), 0o644); err != nil {
|
||||
@@ -190,6 +159,26 @@ func processFile(ctx context.Context, cfg Config, root *os.Root, rawDir, path, d
|
||||
return nil
|
||||
}
|
||||
|
||||
// copyFile copies src to dst, creating dst if it doesn't exist.
|
||||
func copyFile(src, dst string) error {
|
||||
in, err := os.Open(src)
|
||||
if err != nil {
|
||||
return fmt.Errorf("open src: %w", err)
|
||||
}
|
||||
defer in.Close() //nolint:errcheck
|
||||
|
||||
out, err := os.Create(dst)
|
||||
if err != nil {
|
||||
return fmt.Errorf("create dst: %w", err)
|
||||
}
|
||||
|
||||
if _, err := io.Copy(out, in); err != nil {
|
||||
out.Close() //nolint:errcheck
|
||||
return fmt.Errorf("copy: %w", err)
|
||||
}
|
||||
return out.Close()
|
||||
}
|
||||
|
||||
// deriveSource turns a filename into a human-readable source name.
|
||||
// "shape-up-book.md" → "Shape Up Book"
|
||||
func deriveSource(filename string) string {
|
||||
@@ -226,30 +215,3 @@ func appendWatcherLog(brainDir, filename string, runErr error, date string) erro
|
||||
}
|
||||
return f.Close()
|
||||
}
|
||||
|
||||
// copyFromRoot archives a raw/ file read through the root, refusing anything
|
||||
// that is not a regular file, so a swapped-in symlink cannot copy an outside
|
||||
// file into raw/processed/ or raw/failed/ (hyperguild#153).
|
||||
func copyFromRoot(root *os.Root, rel, dst string) error {
|
||||
fi, err := root.Lstat(rel)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !fi.Mode().IsRegular() {
|
||||
return fmt.Errorf("%s: not a regular file", rel)
|
||||
}
|
||||
in, _, err := extract.OpenRegular(root, rel)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer func() { _ = in.Close() }()
|
||||
out, err := os.Create(dst)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := io.Copy(out, in); err != nil {
|
||||
_ = out.Close()
|
||||
return err
|
||||
}
|
||||
return out.Close()
|
||||
}
|
||||
|
||||
@@ -7,10 +7,6 @@ import (
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
"syscall"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
@@ -180,20 +176,15 @@ func TestDeriveSource(t *testing.T) {
|
||||
func TestProcessDir_SkipsSubdirs(t *testing.T) {
|
||||
brainDir := setupBrainDir(t)
|
||||
|
||||
// Create processed/, failed/, and rejected/ subdirs with files inside.
|
||||
for _, sub := range []string{"processed/2026-04-22", "failed", "rejected"} {
|
||||
// Create processed/ and failed/ subdirs with files inside.
|
||||
for _, sub := range []string{"processed/2026-04-22", "failed"} {
|
||||
require.NoError(t, os.MkdirAll(filepath.Join(brainDir, "raw", sub), 0o755))
|
||||
}
|
||||
|
||||
processedFile := filepath.Join(brainDir, "raw", "processed", "2026-04-22", "old-file.md")
|
||||
failedFile := filepath.Join(brainDir, "raw", "failed", "broken-file.md")
|
||||
// hyperguild#81/#133: a human already declined this note via brain_reject.
|
||||
// If the watcher walks into rejected/, it re-ingests and publishes it to
|
||||
// the wiki — the exact opposite of the human's decision.
|
||||
rejectedFile := filepath.Join(brainDir, "raw", "rejected", "declined-file.md")
|
||||
require.NoError(t, os.WriteFile(processedFile, []byte("old"), 0o644))
|
||||
require.NoError(t, os.WriteFile(failedFile, []byte("broken"), 0o644))
|
||||
require.NoError(t, os.WriteFile(rejectedFile, []byte("---\nrejected_at: 2026-09-23T00:00:00Z\n---\ndeclined"), 0o644))
|
||||
|
||||
// Also place a valid file in raw/ root that should be processed.
|
||||
validFile := filepath.Join(brainDir, "raw", "valid.md")
|
||||
@@ -232,13 +223,11 @@ func TestProcessDir_SkipsSubdirs(t *testing.T) {
|
||||
// Complete should have been called exactly once (for valid.md, not for files in subdirs).
|
||||
assert.Len(t, processedSources, 1, "only the file in raw/ root should be processed")
|
||||
|
||||
// Files in processed/, failed/, and rejected/ must remain untouched.
|
||||
// Files in processed/ and failed/ must remain untouched.
|
||||
_, err := os.Stat(processedFile)
|
||||
assert.NoError(t, err, "processed subdir file should be untouched")
|
||||
_, err = os.Stat(failedFile)
|
||||
assert.NoError(t, err, "failed subdir file should be untouched")
|
||||
_, err = os.Stat(rejectedFile)
|
||||
assert.NoError(t, err, "rejected subdir file should be untouched, never re-ingested")
|
||||
}
|
||||
|
||||
// TestProcessDir_SkipsTunnelCandidateFiles guards against hyperguild#88:
|
||||
@@ -286,107 +275,3 @@ func TestProcessDir_SkipsTunnelCandidateFiles(t *testing.T) {
|
||||
_, err = os.Stat(filepath.Join(brainDir, "raw", "processed", date, "tunnel-candidates-2026-07-19.md"))
|
||||
assert.True(t, os.IsNotExist(err), "tunnel-candidates file should not be copied to processed/")
|
||||
}
|
||||
|
||||
// hyperguild#153: raw/ is writable via Syncthing, and the watcher ingests
|
||||
// whatever lands there with no API call at all. WalkDir yields symlinked
|
||||
// files, and extract.Text followed them, so a symlink to any pod-readable
|
||||
// file would be extracted into the brain. The watcher now ingests only
|
||||
// regular files, read through an os.Root on raw/.
|
||||
func TestProcessDir_IngestsTheRealNoteAndSkipsTheSymlinkBesideIt(t *testing.T) {
|
||||
brainDir := setupBrainDir(t)
|
||||
outside := filepath.Join(t.TempDir(), "secret.md")
|
||||
require.NoError(t, os.WriteFile(outside, []byte("SENTINEL-153-WATCHER"), 0o644))
|
||||
// "a-" sorts before "real": a walk that stopped at the first symlink
|
||||
// (filepath.SkipAll — one synced link halting all ingestion) would fail
|
||||
// the call count below (PR #156 review).
|
||||
require.NoError(t, os.Symlink(outside, filepath.Join(brainDir, "raw", "a-leak.md")))
|
||||
require.NoError(t, os.WriteFile(filepath.Join(brainDir, "raw", "real.md"), []byte("real note"), 0o644))
|
||||
|
||||
var sawSentinel bool
|
||||
calls := 0
|
||||
cfg := Config{BrainDir: brainDir, Interval: time.Hour, Pipeline: pipeline.Config{
|
||||
Complete: func(_ context.Context, _, user string) (string, error) {
|
||||
calls++
|
||||
if strings.Contains(user, "SENTINEL-153-WATCHER") {
|
||||
sawSentinel = true
|
||||
}
|
||||
b, _ := json.Marshal([]pipeline.RawPage{{Title: "X", Type: "source", Subtype: "article", Content: "## S\n\nx\n"}})
|
||||
return string(b), nil
|
||||
},
|
||||
Schema: "# Schema",
|
||||
}}
|
||||
errs := processDir(context.Background(), cfg, time.Now().UTC().Format("2006-01-02"))
|
||||
assert.Empty(t, errs)
|
||||
assert.False(t, sawSentinel, "the symlink target must never reach the pipeline")
|
||||
assert.Equal(t, 1, calls, "exactly the real note is ingested; the symlink is not a note")
|
||||
}
|
||||
|
||||
// A symlinked raw/ is refused outright: os.OpenRoot would otherwise follow
|
||||
// it and confine reads to wherever it points.
|
||||
func TestProcessDir_RefusesASymlinkedRawDir(t *testing.T) {
|
||||
brainDir := t.TempDir()
|
||||
elsewhere := t.TempDir()
|
||||
require.NoError(t, os.WriteFile(filepath.Join(elsewhere, "x.md"), []byte("SENTINEL-153-RAWLINK"), 0o644))
|
||||
require.NoError(t, os.Symlink(elsewhere, filepath.Join(brainDir, "raw")))
|
||||
calls := 0
|
||||
cfg := Config{BrainDir: brainDir, Interval: time.Hour, Pipeline: pipeline.Config{
|
||||
Complete: func(context.Context, string, string) (string, error) { calls++; return "[]", nil },
|
||||
Schema: "# Schema",
|
||||
}}
|
||||
errs := processDir(context.Background(), cfg, time.Now().UTC().Format("2006-01-02"))
|
||||
assert.NotEmpty(t, errs, "a symlinked raw/ must be reported, not silently ingested")
|
||||
assert.Zero(t, calls)
|
||||
}
|
||||
|
||||
// PR #156: a FIFO swapped into raw/ between the watcher's checks and its
|
||||
// read or archive copy must not hang the watcher, which runs unattended.
|
||||
func TestProcessDir_DoesNotHangUnderAFIFOSwapRace(t *testing.T) {
|
||||
brainDir := setupBrainDir(t)
|
||||
raw := filepath.Join(brainDir, "raw")
|
||||
var stop atomic.Bool
|
||||
var wg sync.WaitGroup
|
||||
wg.Add(1)
|
||||
// Awaited before t.TempDir's cleanup (hyperguild#162).
|
||||
t.Cleanup(func() { stop.Store(true); wg.Wait() })
|
||||
go func() {
|
||||
defer wg.Done()
|
||||
for i := 0; !stop.Load(); i++ {
|
||||
tmp := filepath.Join(raw, ".swap")
|
||||
_ = os.Remove(tmp)
|
||||
if i%2 == 0 {
|
||||
_ = os.WriteFile(tmp, []byte("x"), 0o644)
|
||||
} else {
|
||||
_ = syscall.Mkfifo(tmp, 0o644)
|
||||
}
|
||||
_ = os.Rename(tmp, filepath.Join(raw, "r.md"))
|
||||
}
|
||||
}()
|
||||
cfg := Config{BrainDir: brainDir, Interval: time.Hour, Pipeline: pipeline.Config{
|
||||
Complete: func(context.Context, string, string) (string, error) {
|
||||
b, _ := json.Marshal([]pipeline.RawPage{{Title: "R", Type: "source", Subtype: "article", Content: "## S\n\nx\n"}})
|
||||
return string(b), nil
|
||||
},
|
||||
Schema: "# Schema",
|
||||
}}
|
||||
var iters atomic.Int64
|
||||
done := make(chan struct{})
|
||||
go func() {
|
||||
for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); {
|
||||
_ = os.Remove(filepath.Join(raw, "r.md.processed"))
|
||||
_ = os.Remove(filepath.Join(raw, "r.md.failed"))
|
||||
_ = processDir(context.Background(), cfg, "2026-10-03")
|
||||
iters.Add(1)
|
||||
}
|
||||
close(done)
|
||||
}()
|
||||
select {
|
||||
case <-done:
|
||||
stop.Store(true)
|
||||
case <-time.After(8 * time.Second):
|
||||
stop.Store(true)
|
||||
if f, err := os.OpenFile(filepath.Join(raw, "r.md"), os.O_WRONLY|syscall.O_NONBLOCK, 0); err == nil {
|
||||
_ = f.Close()
|
||||
}
|
||||
t.Fatalf("the watcher hung on a swapped-in FIFO after %d iterations", iters.Load())
|
||||
}
|
||||
}
|
||||
|
||||
@@ -7,7 +7,6 @@ import (
|
||||
"path/filepath"
|
||||
"strings"
|
||||
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
|
||||
"github.com/mathiasbq/hyperguild/ingestion/internal/textutil"
|
||||
)
|
||||
|
||||
@@ -17,11 +16,6 @@ func RebuildIndex(brainDir, date string) error {
|
||||
if err != nil {
|
||||
return fmt.Errorf("load inventory: %w", err)
|
||||
}
|
||||
bfs, err := brainfs.Open(brainDir)
|
||||
if err != nil {
|
||||
return fmt.Errorf("open brain: %w", err)
|
||||
}
|
||||
defer func() { _ = bfs.Close() }()
|
||||
|
||||
total := len(inv[PageTypeConcept]) + len(inv[PageTypeEntity]) + len(inv[PageTypeSource])
|
||||
var sb strings.Builder
|
||||
@@ -40,7 +34,7 @@ func RebuildIndex(brainDir, date string) error {
|
||||
label := strings.ToUpper(string(pt)[:1]) + string(pt)[1:]
|
||||
fmt.Fprintf(&sb, "## %s\n\n", label)
|
||||
for _, e := range entries {
|
||||
summary := pageFirstSentence(bfs, e)
|
||||
summary := pageFirstSentence(brainDir, e)
|
||||
if summary != "" {
|
||||
fmt.Fprintf(&sb, "- [[%s|%s]] — %s\n", e.Slug, e.Title, summary)
|
||||
} else {
|
||||
@@ -54,10 +48,9 @@ func RebuildIndex(brainDir, date string) error {
|
||||
return os.WriteFile(dest, []byte(sb.String()), 0o644)
|
||||
}
|
||||
|
||||
// pageFirstSentence reads the page through the brain root, regular files
|
||||
// only (hyperguild#157).
|
||||
func pageFirstSentence(bfs *brainfs.Brain, e Entry) string {
|
||||
content, err := bfs.ReadRegular("wiki/" + string(e.Type) + "/" + e.Slug + ".md")
|
||||
func pageFirstSentence(brainDir string, e Entry) string {
|
||||
path := filepath.Join(brainDir, "wiki", string(e.Type), e.Slug+".md")
|
||||
content, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user