open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-20 16:07:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): observe package installations in console

Browse Source
This commit is contained in:
whyour
2026-08-20 14:42:54 +08:00
parent 344680d64a
commit ffa4b4e7cb
29 changed files with 1259 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/ql3-cluster-admin/test/copilotConsole.test.cjs
+73
View File
@@ -265,6 +265,23 @@ test('normalizes Copilot and fixed Project observation operations without arbitr
assert.throws(() => clusterCopilotConsoleProjectReadPath(workerList), {
code: 'QL3_CLUSTER_COPILOT_CONSOLE_READ_REQUEST_INVALID',
});
const packageList = normalizeClusterCopilotConsoleReadRequest({
schema: CLUSTER_COPILOT_CONSOLE_READ_REQUEST_SCHEMA,
operation: 'package_list',
projectId: 'project-main',
requestId: 'console-package-list',
afterPackageName: 'ops-package',
});
assert.deepEqual(packageList, {
schema: CLUSTER_COPILOT_CONSOLE_READ_REQUEST_SCHEMA,
operation: 'package_list',
projectId: 'project-main',
requestId: 'console-package-list',
afterPackageName: 'ops-package',
});
assert.throws(() => clusterCopilotConsoleProjectReadPath(packageList), {
code: 'QL3_CLUSTER_COPILOT_CONSOLE_READ_REQUEST_INVALID',
});
assert.throws(
() =>
normalizeClusterCopilotConsoleReadRequest({
@@ -690,6 +707,62 @@ test('routes only fixed Worker list and inspect reads with a bounded cursor', as
assert.equal(reads.length, 2);
});
test('routes only fixed Package installation list and inspect reads', async (t) => {
const reads = [];
const { server, headers } = await fixture(async (read) => {
reads.push(read);
return {
schemaVersion: 1,
requestId: read.requestId,
result: { operation: read.operation },
};
});
t.after(() => server.close());
const cases = [
[
'/api/v1/package-management/installations',
{
schema: CLUSTER_COPILOT_CONSOLE_READ_REQUEST_SCHEMA,
operation: 'package_list',
projectId: 'project-main',
requestId: 'console-package-list-1',
afterPackageName: null,
},
],
[
'/api/v1/package-management/installation',
{
schema: CLUSTER_COPILOT_CONSOLE_READ_REQUEST_SCHEMA,
operation: 'package_inspect',
projectId: 'project-main',
requestId: 'console-package-inspect-1',
packageName: 'ops-package',
},
],
];
for (const [path, body] of cases) {
const response = await request(server.origin, {
method: 'POST',
path,
headers,
body,
});
assert.equal(response.statusCode, 200);
}
assert.deepEqual(
reads,
cases.map(([, body]) => body),
);
const invalidCursor = await request(server.origin, {
method: 'POST',
path: '/api/v1/package-management/installations',
headers,
body: { ...cases[0][1], afterPackageName: 'Contains_underscore' },
});
assert.equal(invalidCursor.statusCode, 400);
assert.equal(reads.length, 2);
});
test('returns model text as JSON data only after an explicit output read', async (t) => {
const { server, headers } = await fixture(async (command) => {
assert.equal(command.operation, 'output');
packages/ql3-cluster-admin/test/copilotConsoleCli.test.cjs
+187 -1
View File
@@ -40,6 +40,7 @@ const runManagementOperations = [
'run_cancellation_inspect',
];
const workerManagementOperations = ['worker_list', 'worker_inspect'];
const packageManagementOperations = ['package_list', 'package_inspect'];
function workerSummary(workerId = 'worker-a') {
return {
@@ -63,6 +64,36 @@ function workerSummary(workerId = 'worker-a') {
};
}
function packageInstallationSummary(packageName = 'ops-package') {
return {
installationId: 'installation-transport-hidden',
projectId: 'project-main',
packageName,
packageVersion: '3.1.0',
operation: 'upgrade',
state: 'active',
targetGeneration: 4,
activeLockDigest: 'a'.repeat(64),
previousActiveLockDigest: 'b'.repeat(64),
recoveryAction: 'none',
availability: 'active',
quarantineReason: null,
quarantineAuthorizationMode: null,
quarantineEventDigest: null,
quarantinedAtMs: null,
withdrawalStatus: null,
withdrawalReceiptDigest: null,
withdrawalCommittedAtMs: null,
failureReason: null,
failedFrom: null,
failedAtMs: null,
version: 7,
createdAtMs: 1_000,
updatedAtMs: 1_100,
recordDigest: 'c'.repeat(64),
};
}
function privateFile(directory, name, contents) {
const filePath = path.join(directory, name);
fs.writeFileSync(filePath, contents, { mode: 0o600 });
@@ -201,7 +232,29 @@ async function fixture(t) {
command,
});
const body =
command?.operation === 'worker-session.list'
command?.operation === 'plugin-package.installation.list'
? {
schemaVersion: 1,
requestId: 'package-transport-hidden',
result: {
schemaVersion: 1,
operation: 'plugin-package.installation.list',
installations: [packageInstallationSummary()],
truncated: true,
next: { packageName: 'ops-package' },
},
}
: command?.operation === 'plugin-package.installation.inspect'
? {
schemaVersion: 1,
requestId: 'package-transport-hidden',
result: {
schemaVersion: 1,
operation: 'plugin-package.installation.inspect',
installation: packageInstallationSummary(),
},
}
: command?.operation === 'worker-session.list'
? {
schemaVersion: 1,
requestId: 'worker-transport-hidden',
@@ -341,6 +394,19 @@ async function fixture(t) {
requestTimeoutMs: 2_000,
}),
);
const packageManagementConfigFile = privateFile(
directory,
'package-client.json',
JSON.stringify({
schemaVersion: 1,
endpoint: `https://localhost:${
server.address().port
}/api/v3/plugin-packages/management`,
servername: 'localhost',
caFile,
requestTimeoutMs: 2_000,
}),
);
const sessionToken = randomBytes(32).toString('base64url');
return {
requests,
@@ -360,6 +426,12 @@ async function fixture(t) {
'worker-assertion.jwt',
'eyJhbGciOiJFZERTQSJ9.eyJzdWIiOiJvcGVyYXRvci0xIn0.c2lnbmF0dXJl',
),
packageManagementConfigFile,
packageManagementAssertionFile: privateFile(
directory,
'package-assertion.jwt',
'eyJhbGciOiJFZERTQSJ9.eyJzdWIiOiJvcGVyYXRvci0xIn0.c2lnbmF0dXJl',
),
};
}
@@ -371,6 +443,7 @@ test('CLI exposes deterministic help and a low-sensitive failure surface', async
' ql3-copilot-console --container-published-loopback --port=1024..65535 --config /absolute/client.json --credential /absolute/credential --session /absolute/session [--check]',
' Optional Run reads: --run-management-config /absolute/run-client.json --run-management-assertion /absolute/assertion.jwt',
' Optional Worker reads: --worker-management-config /absolute/worker-client.json --worker-management-assertion /absolute/assertion.jwt',
' Optional Package reads: --package-management-config /absolute/package-client.json --package-management-assertion /absolute/assertion.jwt',
'',
'Native mode binds 127.0.0.1. Container mode requires host-loopback port publication.',
'The browser session key remains in a separate owner-private 0600 file.',
@@ -426,6 +499,7 @@ test('preflight proves private authority and unauthenticated TLS 1.3 readiness',
clusterCredential: 'server_only',
runManagementAuthority: 'disabled',
workerManagementAuthority: 'disabled',
packageManagementAuthority: 'disabled',
operations: consoleOperations,
mutation: false,
});
@@ -521,6 +595,47 @@ test('preflight enables exactly two Worker reads only with canonical config and
assert.equal(incomplete.status, 64);
});
test('preflight enables exactly two Package reads only with canonical config and assertion', async (t) => {
const value = await fixture(t);
const result = await runCli([
'--check',
'--config',
value.configFile,
'--credential',
value.credentialFile,
'--session',
value.sessionFile,
'--package-management-config',
value.packageManagementConfigFile,
'--package-management-assertion',
value.packageManagementAssertionFile,
]);
assert.equal(result.status, 0, result.stderr);
const fact = JSON.parse(result.stdout);
assert.equal(fact.runManagementAuthority, 'disabled');
assert.equal(fact.workerManagementAuthority, 'disabled');
assert.equal(fact.packageManagementAuthority, 'server_only');
assert.deepEqual(fact.operations, [
'inspect',
'output',
...packageManagementOperations,
...consoleOperations.slice(2),
]);
assert.equal(value.requests.length, 1);
const incomplete = await runCli([
'--config',
value.configFile,
'--credential',
value.credentialFile,
'--session',
value.sessionFile,
'--package-management-config',
value.packageManagementConfigFile,
]);
assert.equal(incomplete.status, 64);
});
test('serve mode starts an ephemeral loopback origin and shuts down cleanly', async (t) => {
const value = await fixture(t);
const child = spawn(
@@ -548,6 +663,7 @@ test('serve mode starts an ephemeral loopback origin and shuts down cleanly', as
assert.equal(started.mutation, false);
assert.equal(started.runManagementAuthority, 'disabled');
assert.equal(started.workerManagementAuthority, 'disabled');
assert.equal(started.packageManagementAuthority, 'disabled');
assert.equal(started.networkBoundary, 'host-loopback');
assert.equal(started.publishedHostAddress, '127.0.0.1');
const shell = await get(started.origin);
@@ -687,6 +803,76 @@ test('serve mode performs one canonical Worker page read without exposing transp
assert.deepEqual(exit, { status: 0, signal: null });
});
test('serve mode performs one canonical Package page read without exposing durable identity', async (t) => {
const value = await fixture(t);
const child = spawn(
process.execPath,
[
cliPath,
'--config',
value.configFile,
'--credential',
value.credentialFile,
'--session',
value.sessionFile,
'--package-management-config',
value.packageManagementConfigFile,
'--package-management-assertion',
value.packageManagementAssertionFile,
'--port=0',
],
{ cwd: packageRoot, stdio: ['ignore', 'pipe', 'pipe'] },
);
t.after(() => {
if (child.exitCode === null && child.signalCode === null)
child.kill('SIGKILL');
});
const started = JSON.parse(await firstLine(child.stdout));
assert.equal(started.packageManagementAuthority, 'server_only');
const response = await post(
started.origin,
value.sessionToken,
'/api/v1/package-management/installations',
{
schema: 'qinglong/cluster-copilot-console-read-request@v1',
operation: 'package_list',
projectId: 'project-main',
requestId: 'console-package-list-1',
afterPackageName: null,
},
);
assert.equal(response.statusCode, 200);
assert.equal(
response.body.result.result.schema,
'qinglong/plugin-package-installation-list@v1',
);
assert.equal(response.body.result.result.count, 1);
assert.equal(response.body.result.result.nextAfterPackageName, 'ops-package');
const encoded = JSON.stringify(response.body);
assert.equal(encoded.includes('package-transport-hidden'), false);
assert.equal(encoded.includes('installation-transport-hidden'), false);
assert.equal(encoded.includes('recordDigest'), false);
const management = value.requests.find(
(request) => request.path === '/api/v3/plugin-packages/management',
);
assert.equal(management.method, 'POST');
assert.equal(
management.command.operation,
'plugin-package.installation.list',
);
assert.equal(
management.command.request.inspectionId,
'console-package-list-1',
);
assert.equal(management.command.request.limit, 16);
child.kill('SIGTERM');
const exit = await new Promise((resolve, reject) => {
child.once('error', reject);
child.once('close', (status, signal) => resolve({ status, signal }));
});
assert.deepEqual(exit, { status: 0, signal: null });
});
test('container mode requires an explicit publish port before any authority read', async () => {
const result = await runCli([
'--container-published-loopback',
packages/ql3-cluster-admin/test/copilotConsoleEvidenceBundle.test.cjs
+59
View File
@@ -294,6 +294,65 @@ test('redacts Worker identity and preserves only bounded placement and capacity
);
});
test('redacts Package transport identity and keeps bounded installation state', async () => {
const bundle = await createClusterConsoleEvidenceBundle(
[
{
operation: 'package_list',
observedAtMs: 1_700_000_005_000,
request: {
schema: requestSchema,
operation: 'package_list',
afterPackageName: null,
projectId: 'project-sensitive',
requestId: 'package-request-sensitive',
},
fact: {
schema: 'qinglong/plugin-package-installation-list@v1',
projectId: 'project-sensitive',
count: 1,
installations: [
{
packageName: 'ops-package-sensitive',
packageVersion: '3.1.0',
installOperation: 'upgrade',
state: 'active',
targetGeneration: 4,
recoveryAction: 'none',
availability: 'active',
quarantineReason: null,
failureReason: null,
version: 7,
createdAtMs: 1_700_000_001_000,
updatedAtMs: 1_700_000_004_000,
installationId: 'must-not-export',
recordDigest: 'a'.repeat(64),
},
],
truncated: true,
nextAfterPackageName: 'ops-package-sensitive',
},
},
],
1_700_000_006_000,
webcrypto,
);
const entry = bundle.entries[0];
assert.equal(entry.operation, 'package_list');
assert.equal(entry.fact.installations[0].packageName, 'package-001');
assert.equal(entry.fact.nextAfterPackageName, 'package-001');
assert.equal(entry.fact.installations[0].installOperation, 'upgrade');
assert.equal(entry.fact.installations[0].state, 'active');
assert.equal(entry.fact.installations[0].targetGeneration, 4);
assert.equal(entry.fact.installations[0].installationId, undefined);
assert.equal(entry.fact.installations[0].recordDigest, 'digest-001');
assert.equal(entry.fact.installations[0].packageVersion, undefined);
assert.doesNotMatch(
JSON.stringify(bundle),
/ops-package-sensitive|package-request-sensitive|project-sensitive|must-not-export/,
);
});
test('fails closed on widened records, unsafe JSON and every capacity ceiling', async () => {
const error = { code: 'QL3_CLUSTER_CONSOLE_EVIDENCE_BUNDLE_INVALID' };
assert.throws(() => measureClusterConsoleEvidenceRecord(null), error);
packages/ql3-cluster-admin/test/copilotConsoleEvidenceVerifier.test.cjs
+11 -1
View File
@@ -147,6 +147,16 @@ test('cross-verifies every fixed Console read operation', async (t) => {
requestId: 'q-worker-inspect',
workerId: 'worker-1',
},
package_list: {
afterPackageName: null,
projectId: 'p-package',
requestId: 'q-package-list',
},
package_inspect: {
packageName: 'ops-package',
projectId: 'p-package',
requestId: 'q-package-inspect',
},
run_list: {
afterCreatedAtMs: null,
afterRunId: null,
@@ -247,7 +257,7 @@ test('cross-verifies every fixed Console read operation', async (t) => {
assert.equal(result.status, 'verified');
verified += result.bundle.entryCount;
}
assert.equal(verified, 18);
assert.equal(verified, 20);
});
test('CLI is secret-free on success, invalid input and usage errors', async (t) => {
packages/ql3-cluster-admin/test/pluginPackageInstallationProduct.test.cjs
+170
View File
@@ -0,0 +1,170 @@
'use strict';
const assert = require('node:assert/strict');
const test = require('node:test');
const {
ClusterPluginPackageInstallationProductError,
createPluginPackageInstallationInspectionCommand,
createPluginPackageInstallationListCommand,
projectPluginPackageInstallationInspection,
projectPluginPackageInstallationList,
} = require('../dist/plugin-package/management/pluginPackageInstallationProduct.js');
function installation(overrides = {}) {
return {
installationId: 'installation-sensitive',
projectId: 'project-main',
packageName: 'ops-package',
packageVersion: '3.1.0',
operation: 'upgrade',
state: 'active',
targetGeneration: 4,
activeLockDigest: 'a'.repeat(64),
previousActiveLockDigest: 'b'.repeat(64),
recoveryAction: 'none',
availability: 'active',
quarantineReason: null,
quarantineAuthorizationMode: null,
quarantineEventDigest: null,
quarantinedAtMs: null,
withdrawalStatus: null,
withdrawalReceiptDigest: null,
withdrawalCommittedAtMs: null,
failureReason: null,
failedFrom: null,
failedAtMs: null,
version: 7,
createdAtMs: 100,
updatedAtMs: 200,
recordDigest: 'c'.repeat(64),
...overrides,
};
}
test('builds fixed bounded installation observation commands', () => {
assert.deepEqual(
createPluginPackageInstallationListCommand(
'project-main',
'after-package',
() => 'inspection-list',
),
{
schemaVersion: 1,
operation: 'plugin-package.installation.list',
request: {
projectId: 'project-main',
limit: 16,
after: { packageName: 'after-package' },
inspectionId: 'inspection-list',
},
},
);
assert.deepEqual(
createPluginPackageInstallationInspectionCommand(
'project-main',
'ops-package',
() => 'inspection-one',
),
{
schemaVersion: 1,
operation: 'plugin-package.installation.inspect',
request: {
projectId: 'project-main',
packageName: 'ops-package',
inspectionId: 'inspection-one',
},
},
);
});
test('projects installation facts without transport or durable identifiers', () => {
const fact = projectPluginPackageInstallationList('project-main', {
schemaVersion: 1,
requestId: 'transport-request-sensitive',
result: {
operation: 'plugin-package.installation.list',
installations: [installation()],
truncated: true,
next: { packageName: 'ops-package' },
},
});
assert.deepEqual(fact, {
schema: 'qinglong/plugin-package-installation-list@v1',
projectId: 'project-main',
count: 1,
installations: [
{
packageName: 'ops-package',
packageVersion: '3.1.0',
installOperation: 'upgrade',
state: 'active',
targetGeneration: 4,
recoveryAction: 'none',
availability: 'active',
quarantineReason: null,
failureReason: null,
version: 7,
createdAtMs: 100,
updatedAtMs: 200,
},
],
truncated: true,
nextAfterPackageName: 'ops-package',
});
const encoded = JSON.stringify(fact);
for (const secret of [
'installation-sensitive',
'transport-request-sensitive',
'activeLockDigest',
'recordDigest',
]) {
assert.equal(encoded.includes(secret), false);
}
});
test('inspection binds the selected package and fails closed on drift', () => {
const response = {
schemaVersion: 1,
requestId: 'request-one',
result: {
operation: 'plugin-package.installation.inspect',
installation: installation(),
},
};
assert.equal(
projectPluginPackageInstallationInspection(
'project-main',
'ops-package',
response,
).found,
true,
);
assert.throws(
() =>
projectPluginPackageInstallationInspection(
'project-main',
'other-package',
response,
),
ClusterPluginPackageInstallationProductError,
);
assert.throws(
() =>
projectPluginPackageInstallationInspection(
'project-main',
'ops-package',
{
...response,
result: {
...response.result,
installation: installation({
recoveryAction: 'run-arbitrary-code',
}),
},
},
),
ClusterPluginPackageInstallationProductError,
);
});