feat: implement durable authenticated chat run coordinator

tests/unit/test_chat_api.py

@@ -0,0 +1,100 @@
+"""Offline durable API qualification using injected Hermes runs adapter."""
+import asyncio
+import time
+import pytest
+from fastapi.testclient import TestClient
+from control.app import Settings, create_app
+
+PASSWORD = 'offline-chat-password'
+
+class Provisioner:
+    async def ensure(self, user):
+        return {'container_name': user['container_name'], 'hermes_url': 'http://127.0.0.1:12345', 'hermes_api_key': 'secret-never-public'}
+    async def ready(self, user):
+        return True
+    async def remove(self, user):
+        pass
+
+class FakeRuns:
+    available = True
+    approvals = False
+    def __init__(self):
+        self.started = []
+        self.stopped = []
+    async def start(self, owner, rid, payload):
+        self.started.append((owner, rid, payload))
+        return {'run_id': 'upstream-' + rid, 'status': 'started'}
+    async def status(self, owner, upstream):
+        return {'status': 'running'}
+    async def events(self, owner, upstream):
+        yield {'event': 'reasoning.delta', 'delta': 'hidden-secret'}
+        yield {'event': 'tool.completed', 'result': 'tool-secret', 'error': 'credential'}
+        yield {'event': 'message.delta', 'delta': 'Hello'}
+        yield {'event': 'run.completed', 'output': 'Hello world'}
+    async def stop(self, owner, upstream):
+        self.stopped.append(upstream)
+
+@pytest.fixture
+def env(tmp_path):
+    adapter = FakeRuns()
+    app = create_app(Settings(db_path=str(tmp_path/'chat.sqlite'), admin_password=PASSWORD, allowed_origins=('https://testserver',), reconcile_interval=3600), Provisioner(), chat_adapter=adapter)
+    with TestClient(app, base_url='https://testserver') as client:
+        result = client.post('/api/auth/login', headers={'Origin':'https://testserver'}, json={'username':'admin','password':PASSWORD})
+        headers = {'Authorization':'Bearer '+result.json()['token']}
+        yield client, app, adapter, headers
+
+def wait_run(client, headers, rid):
+    deadline = time.monotonic()+3
+    while time.monotonic() < deadline:
+        value = client.get('/api/runs/'+rid, headers=headers).json()
+        if value['run']['status'] in ('completed','failed','cancelled'):
+            return value
+    raise AssertionError('Run did not finish')
+
+def test_metadata_crud_revision_and_sync(env):
+    client, app, adapter, headers = env
+    client.cookies.clear()
+    assert client.get('/api/conversations').status_code == 401
+    workspace = client.post('/api/workspaces', headers=headers, json={'name':'Work'}).json()['workspace']
+    conversation = client.post('/api/conversations', headers=headers, json={'title':'Durable','workspace_id':workspace['id']}).json()['conversation']
+    cid = conversation['id']
+    patch = {'revision':conversation['revision'],'pinned':True}
+    assert client.patch('/api/conversations/'+cid, headers=headers, json=patch).status_code == 200
+    assert client.patch('/api/conversations/'+cid, headers=headers, json=patch).status_code == 409
+    assert client.delete('/api/workspaces/'+workspace['id'], headers=headers).status_code == 200
+    assert client.get('/api/conversations/'+cid, headers=headers).json()['conversation']['workspace_id'] is None
+    assert client.delete('/api/conversations/'+cid, headers=headers).status_code == 200
+    assert client.get('/api/conversations/'+cid, headers=headers).status_code == 404
+    assert client.get('/api/sync', headers=headers).json()['changes']
+
+def test_idempotent_send_final_output_and_redacted_replay(env):
+    client, app, adapter, headers = env
+    cid = client.post('/api/conversations', headers=headers, json={}).json()['conversation']['id']
+    url = '/api/conversations/'+cid+'/messages'
+    value = {'content':'Hi','idempotency_key':'same-key'}
+    response = client.post(url, headers=headers, json=value)
+    assert response.status_code == 202, response.text
+    rid = response.json()['run']['id']
+    final = wait_run(client, headers, rid)
+    assert final['run']['status'] == 'completed', final
+    assert any(m['content']=='Hello world' for m in final['messages'])
+    repeat = client.post(url, headers=headers, json=value)
+    assert repeat.json()['run']['id'] == rid
+    assert client.post(url, headers=headers, json={**value,'content':'changed'}).status_code == 409
+    assert len(adapter.started) == 1
+    payload = adapter.started[0][2]
+    assert payload['input'] == 'Hi'
+    assert 'conversation_history' not in payload
+    stream = client.get('/api/runs/'+rid+'/events', headers=headers)
+    assert stream.status_code == 200
+    assert 'event: done' in stream.text
+    assert 'hidden-secret' not in stream.text and 'tool-secret' not in stream.text
+    assert 'secret-never-public' not in stream.text
+
+def test_body_validation_and_honest_capabilities(env):
+    client, app, adapter, headers = env
+    caps = client.get('/api/capabilities', headers=headers).json()
+    assert caps['features']['text_chat'] is True
+    assert caps['features']['attachments'] is True
+    assert client.post('/api/conversations', headers=headers, json={'user_id':'fabricated'}).status_code == 400
+    assert client.put('/api/preferences', headers=headers, json={'revision':True,'palette':'opal','appearance':'dark'}).status_code == 400

tests/unit/test_chat_runs.py

@@ -0,0 +1,52 @@
+"""Trusted transport protocol tests; HTTP mocked with no network."""
+import json
+import asyncio
+import functools
+
+def async_test(func):
+    @functools.wraps(func)
+    def wrapper(*args, **kwargs):
+        return asyncio.run(func(*args, **kwargs))
+    return wrapper
+import pytest
+import httpx
+from control.accounts import Accounts
+from control.chat_runs import HermesRuns
+
+@async_test
+async def test_native_runs_transport_exact_idempotency_and_session(tmp_path):
+    accounts = Accounts(str(tmp_path/'accounts.db'))
+    user = accounts.create('test-user','Test','admin','offline-password')
+    accounts.update(user['id'], status='ready', hermes_url='http://127.0.0.1:20000', hermes_api_key='private-key')
+    seen = []
+    def handler(request):
+        seen.append(request)
+        if request.url.path.endswith('/events'):
+            return httpx.Response(200, text='data: {"event":"message.delta","delta":"Hi"}\n\ndata: {"event":"run.completed","output":"Hi"}\n\n')
+        return httpx.Response(202, json={'run_id':'native-run','status':'started'})
+    async with httpx.AsyncClient(transport=httpx.MockTransport(handler)) as client:
+        adapter = HermesRuns(accounts, client)
+        payload = {'input':'Hi','session_id':'stable-session'}
+        assert (await adapter.start(user['id'],'hope-run',payload))['run_id'] == 'native-run'
+        assert seen[0].url.path == '/v1/runs'
+        assert seen[0].headers['authorization'] == 'Bearer private-key'
+        assert seen[0].headers['idempotency-key'] == 'hope-run'
+        assert json.loads(seen[0].content) == payload
+        events = [e async for e in adapter.events(user['id'],'native-run')]
+        assert [e['event'] for e in events] == ['message.delta','run.completed']
+        await adapter.stop(user['id'],'native-run')
+        assert seen[-1].url.path == '/v1/runs/native-run/stop'
+        await adapter.approve(user['id'],'native-run','approval-1','approve')
+        assert json.loads(seen[-1].content) == {'request_id':'approval-1','choice':'once'}
+    accounts.close()
+
+@async_test
+async def test_transport_rejects_deleted_account_and_bad_trusted_url(tmp_path):
+    accounts = Accounts(str(tmp_path/'accounts.db'))
+    user = accounts.create('test-user','Test','admin','offline-password')
+    accounts.update(user['id'], status='ready', hermes_url='http://evil:password@localhost:2', hermes_api_key='private-key')
+    async with httpx.AsyncClient(transport=httpx.MockTransport(lambda request: pytest.fail('Network requested'))) as client:
+        adapter = HermesRuns(accounts, client)
+        with pytest.raises(RuntimeError):
+            await adapter.start(user['id'],'rid',{'input':'Hi'})
+    accounts.close()

tests/unit/test_chat_runs_limits.py

@@ -0,0 +1,33 @@
+"""Offline storage-limit stop intent regression."""
+import asyncio
+from control.accounts import Accounts, token_hash
+from control.chat_store import ChatStore
+from control.chat_runs import ChatRuns
+
+def test_event_capacity_failure_persists_stop_and_reserved_terminal(tmp_path):
+    async def scenario():
+        accounts = Accounts(str(tmp_path/'limit.db'))
+        owner = accounts.create('test','Test','admin','offline-test-password')
+        store = ChatStore(accounts)
+        cid = store.create_conversation(owner['id'])['id']
+        rid = store.send(owner['id'],cid,'Hi','key')['run']['id']
+        store.update_run(owner['id'],rid,'running')
+        runs = ChatRuns(accounts,store,adapter=object())
+        runs.metadata(owner['id'],rid,{'conversation_id':cid,'payload':{},'upstream_id':'upstream','assistant_id':None})
+        original = store.append_event
+        def limited(owner,rid,event,data):
+            if event == 'progress':
+                raise ValueError('storage limit')
+            return original(owner,rid,event,data)
+        store.append_event = limited
+        try:
+            await runs.emit(owner['id'],rid,'progress',{'status':'working'})
+        except ValueError:
+            pass
+        metadata = runs.metadata(owner['id'],rid)
+        assert metadata['stop_requested'] and metadata['storage_failed']
+        assert await runs.consume_status(owner['id'],rid,metadata,{'status':'cancelled'})
+        assert store.get_run(owner['id'],rid)['run']['status'] == 'failed'
+        assert store.events(owner['id'],rid)[-1]['event'] == 'done'
+        accounts.close()
+    asyncio.run(scenario())