chore: import upstream snapshot with attribution

2026-07-13 13:12:00 +08:00
commit 3de48288cb
2986 changed files with 1131193 additions and 0 deletions
@@ -0,0 +1,155 @@
+"""Guard: importing the OSS Docker entrypoint has no side effects.
+
+The Docker image runs ``python /app/entrypoint.py`` (see
+``deploy/docker/Dockerfile``), so all of the boot work — config load,
+Alembic migrations, store construction, ``create_app`` — lives behind
+``main()`` and must not fire at import time. This test enforces that:
+the module must import cleanly with ``DATABASE_URL`` unset and without
+ever touching the database (``sqlalchemy.create_engine`` is wired to
+blow up if called during import).
+"""
+
+from __future__ import annotations
+
+import importlib
+import sys
+from pathlib import Path
+from typing import NoReturn
+
+import pytest
+
+from omnigent.stores.artifact_store.local import LocalArtifactStore
+from omnigent.stores.artifact_store.s3 import S3ArtifactStore
+
+_ENTRYPOINT_MODULE = "deploy.docker.entrypoint"
+_BOOT_MODULES = (
+    "fastapi",
+    "omnigent.db.utils",
+    "omnigent.runtime",
+    "omnigent.server.app",
+    "omnigent.server.server_config",
+    "omnigent.stores.agent_store.sqlalchemy_store",
+    "omnigent.stores.artifact_store.local",
+    "uvicorn",
+)
+
+
+@pytest.fixture
+def _fresh_entrypoint_import(monkeypatch: pytest.MonkeyPatch) -> list[str]:
+    """Force a from-scratch import of the entrypoint, DB-unset.
+
+    Drops any cached copy of the module, clears ``DATABASE_URL`` so the
+    import can't lean on an ambient one, and trip-wires
+    ``sqlalchemy.create_engine`` so any import-time DB access fails the
+    test loudly rather than silently connecting.
+    """
+    monkeypatch.delenv("DATABASE_URL", raising=False)
+    monkeypatch.delitem(sys.modules, _ENTRYPOINT_MODULE, raising=False)
+    for module_name in _BOOT_MODULES:
+        monkeypatch.delitem(sys.modules, module_name, raising=False)
+
+    import sqlalchemy
+
+    create_engine_calls: list[str] = []
+
+    def _no_engine_at_import(*args: object, **kwargs: object) -> NoReturn:
+        create_engine_calls.append(repr((args, kwargs)))
+        raise AssertionError(
+            "sqlalchemy.create_engine() must not be called while importing "
+            f"{_ENTRYPOINT_MODULE} — DB work belongs in main()/build_app()."
+        )
+
+    monkeypatch.setattr(sqlalchemy, "create_engine", _no_engine_at_import)
+    return create_engine_calls
+
+
+def test_entrypoint_imports_without_side_effects(
+    _fresh_entrypoint_import: list[str],
+) -> None:
+    # Importing must not raise (the old module-level code raised
+    # RuntimeError here because DATABASE_URL was unset) and must not
+    # have created an engine (the monkeypatched create_engine would
+    # have raised AssertionError).
+    module = importlib.import_module(_ENTRYPOINT_MODULE)
+
+    # The boot entry points exist and the module is inert until called.
+    assert callable(module.main)
+    assert callable(module.build_app)
+    assert callable(module.run_migrations)
+    # No app was built at import time.
+    assert not hasattr(module, "app")
+    assert _fresh_entrypoint_import == []
+    # Config, migrations, runtime/store wiring, and create_app all stay behind
+    # build_app()/main() rather than being imported or executed at module import.
+    for module_name in _BOOT_MODULES:
+        assert module_name not in sys.modules
+
+
+# ── artifact-store resolution + selection ────────────────────────────────
+# OMNIGENT_ARTIFACT_URI=s3://… selects the remote S3ArtifactStore (durable on an
+# ephemeral/multi-replica deploy); anything else falls back to local. The URI is
+# validated up front (must be s3://), mirroring how DATABASE_URL picks the DB.
+
+
+@pytest.fixture
+def _entrypoint_env(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    """Minimal env for ``_resolve_config``: a DB URL and a tmp artifact dir,
+    auth disabled so it doesn't mint accounts secrets, and no ambient
+    artifact-store URI (each test sets it as needed)."""
+    # Point config at an empty file so the resolver doesn't read the developer's
+    # ambient ~/.omnigent/config.yaml (keeps the test hermetic; CI has none).
+    config_file = tmp_path / "config.yaml"
+    config_file.write_text("{}\n")
+    monkeypatch.setenv("OMNIGENT_CONFIG", str(config_file))
+    monkeypatch.setenv("DATABASE_URL", "postgresql://u:p@localhost:5432/omnigent")
+    monkeypatch.setenv("ARTIFACT_DIR", str(tmp_path / "artifacts"))
+    monkeypatch.setenv("OMNIGENT_AUTH_ENABLED", "0")
+    monkeypatch.delenv("OMNIGENT_ARTIFACT_URI", raising=False)
+
+
+def test_resolve_config_captures_s3_artifact_uri(
+    _entrypoint_env: None, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    from deploy.docker.entrypoint import _resolve_config
+
+    monkeypatch.setenv("OMNIGENT_ARTIFACT_URI", "s3://my-bucket/artifacts")
+    assert _resolve_config().artifact_store_uri == "s3://my-bucket/artifacts"
+
+
+def test_resolve_config_defaults_to_no_remote_store(_entrypoint_env: None) -> None:
+    from deploy.docker.entrypoint import _resolve_config
+
+    assert _resolve_config().artifact_store_uri is None
+
+
+def test_resolve_config_rejects_non_s3_artifact_uri(
+    _entrypoint_env: None, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    from deploy.docker.entrypoint import _resolve_config
+
+    monkeypatch.setenv("OMNIGENT_ARTIFACT_URI", "gs://my-bucket")
+    with pytest.raises(RuntimeError, match="s3://"):
+        _resolve_config()
+
+
+@pytest.mark.parametrize(
+    ("artifact_store_uri", "expected_type"),
+    [
+        ("s3://my-bucket/artifacts", S3ArtifactStore),
+        (None, LocalArtifactStore),
+    ],
+)
+def test_select_artifact_store(
+    tmp_path: Path, artifact_store_uri: str | None, expected_type: type
+) -> None:
+    from deploy.docker.entrypoint import _ResolvedConfig, _select_artifact_store
+
+    resolved = _ResolvedConfig(
+        cfg={},
+        database_url="postgresql://u:p@localhost/omnigent",
+        artifact_dir=tmp_path,
+        artifact_store_uri=artifact_store_uri,
+        host="0.0.0.0",
+        port=8000,
+    )
+    assert isinstance(_select_artifact_store(resolved), expected_type)
@@ -0,0 +1,54 @@
+"""Regression tests for managed host image CLI availability."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+_ROOT = Path(__file__).resolve().parents[2]
+
+
+@pytest.mark.parametrize(
+    "dockerfile",
+    [
+        _ROOT / "deploy/docker/Dockerfile",
+        _ROOT / "deploy/docker/Dockerfile.ubi",
+    ],
+)
+def test_host_images_install_pinned_kiro_cli(dockerfile: Path) -> None:
+    """Managed host images must preinstall a *pinned* Kiro CLI binary.
+
+    The public npm package named ``kiro-cli`` is unrelated and exposes no
+    ``kiro-cli`` binary. Kiro's ``curl …/install`` script has no version flag
+    (it always fetches ``latest``), so the images instead pull the immutable,
+    versioned per-arch zip from the CDN, verify its sha256, and copy the binary
+    onto the global PATH (see the pinning rationale in the Dockerfiles). This
+    guards both that the pin stays in place and that the old unpinned installer
+    never creeps back.
+    """
+    text = dockerfile.read_text()
+
+    # Pinned to an explicit version, fetched from the immutable versioned CDN
+    # path — not the unpinned ``cli.kiro.dev/install`` script, not ``…/latest/``.
+    assert "ARG KIRO_CLI_VERSION=" in text
+    assert "https://prod.download.cli.kiro.dev/stable/${KIRO_CLI_VERSION}/" in text
+    assert "https://cli.kiro.dev/install" not in text
+    # Integrity-checked, then copied onto the global PATH for all sandbox users.
+    assert "sha256sum -c" in text
+    assert "install -m 0755 /root/.local/bin/kiro-cli /usr/local/bin/kiro-cli" in text
+    # kiro-cli is not an npm package, so it must not appear in the npm install list.
+    assert "      kiro-cli \\" not in text
+
+
+@pytest.mark.parametrize(
+    "dockerfile",
+    [
+        _ROOT / "deploy/docker/Dockerfile",
+        _ROOT / "deploy/docker/Dockerfile.ubi",
+    ],
+)
+def test_host_images_include_kiro_installer_dependency(dockerfile: Path) -> None:
+    """Kiro's installer needs ``unzip`` on Linux."""
+    text = dockerfile.read_text()
+    assert "unzip" in text