refactor: centralize host evidence actions (#194)

runners/agent-runner/src/host-evidence.ts

@@ -1,54 +1,22 @@
 import fs from 'fs';
 import path from 'path';
+import {
+  ARTIFACT_EVIDENCE_KINDS,
+  DB_EVIDENCE_ACTIONS,
+  DEPLOY_EVIDENCE_ACTIONS,
+  GITHUB_EVIDENCE_ACTIONS,
+  HOST_EVIDENCE_ACTIONS,
+  type HostEvidenceAction,
+} from 'ejclaw-runners-shared';
 
-export const HOST_EVIDENCE_ACTIONS = [
-  'ejclaw_service_status',
-  'ejclaw_service_logs',
-  'ejclaw_role_runtime_config',
-  'ejclaw_deploy_state',
-  'ejclaw_artifact_metadata',
-  'db_paired_task_status',
-  'db_paired_task_flow',
-  'db_recent_paired_failures',
-  'db_recent_scheduled_tasks',
-  'db_scheduled_task_runs',
-  'github_pr_status',
-  'github_pr_diff_stat',
-  'github_run_status',
-  'github_run_jobs',
-  'github_workflow_file',
-] as const;
-
-export const DB_EVIDENCE_ACTIONS = [
-  'db_paired_task_status',
-  'db_paired_task_flow',
-  'db_recent_paired_failures',
-  'db_recent_scheduled_tasks',
-  'db_scheduled_task_runs',
-] as const;
-
-export const DEPLOY_EVIDENCE_ACTIONS = [
-  'ejclaw_deploy_state',
-  'ejclaw_artifact_metadata',
-] as const;
-
-export const GITHUB_EVIDENCE_ACTIONS = [
-  'github_pr_status',
-  'github_pr_diff_stat',
-  'github_run_status',
-  'github_run_jobs',
-  'github_workflow_file',
-] as const;
-
-export const ARTIFACT_EVIDENCE_KINDS = [
-  'build_outputs',
-  'dashboard_dist',
-  'runner_dist',
-  'android_debug_apk',
-  'attachments_dir',
-] as const;
-
-export type HostEvidenceAction = (typeof HOST_EVIDENCE_ACTIONS)[number];
+export {
+  ARTIFACT_EVIDENCE_KINDS,
+  DB_EVIDENCE_ACTIONS,
+  DEPLOY_EVIDENCE_ACTIONS,
+  GITHUB_EVIDENCE_ACTIONS,
+  HOST_EVIDENCE_ACTIONS,
+  type HostEvidenceAction,
+};
 
 export interface HostEvidenceResponse {
   requestId: string;

runners/shared/src/evidence-actions.ts

@@ -0,0 +1,78 @@
+export const DB_EVIDENCE_ACTIONS = [
+  'db_paired_task_status',
+  'db_paired_task_flow',
+  'db_recent_paired_failures',
+  'db_recent_scheduled_tasks',
+  'db_scheduled_task_runs',
+] as const;
+
+export const DEPLOY_EVIDENCE_ACTIONS = [
+  'ejclaw_deploy_state',
+  'ejclaw_artifact_metadata',
+] as const;
+
+export const GITHUB_EVIDENCE_ACTIONS = [
+  'github_pr_status',
+  'github_pr_diff_stat',
+  'github_run_status',
+  'github_run_jobs',
+  'github_workflow_file',
+] as const;
+
+export const HOST_EVIDENCE_ACTIONS = [
+  'ejclaw_service_status',
+  'ejclaw_service_logs',
+  'ejclaw_role_runtime_config',
+  ...DEPLOY_EVIDENCE_ACTIONS,
+  ...DB_EVIDENCE_ACTIONS,
+  ...GITHUB_EVIDENCE_ACTIONS,
+] as const;
+
+export const ARTIFACT_EVIDENCE_KINDS = [
+  'build_outputs',
+  'dashboard_dist',
+  'runner_dist',
+  'android_debug_apk',
+  'attachments_dir',
+] as const;
+
+export type DbEvidenceAction = (typeof DB_EVIDENCE_ACTIONS)[number];
+export type DeployEvidenceAction = (typeof DEPLOY_EVIDENCE_ACTIONS)[number];
+export type GitHubEvidenceAction = (typeof GITHUB_EVIDENCE_ACTIONS)[number];
+export type HostEvidenceAction = (typeof HOST_EVIDENCE_ACTIONS)[number];
+export type ArtifactEvidenceKind = (typeof ARTIFACT_EVIDENCE_KINDS)[number];
+
+function includesEvidenceValue<T extends readonly string[]>(
+  values: T,
+  value: unknown,
+): value is T[number] {
+  return typeof value === 'string' && values.includes(value as T[number]);
+}
+
+export function isDbEvidenceAction(value: unknown): value is DbEvidenceAction {
+  return includesEvidenceValue(DB_EVIDENCE_ACTIONS, value);
+}
+
+export function isDeployEvidenceAction(
+  value: unknown,
+): value is DeployEvidenceAction {
+  return includesEvidenceValue(DEPLOY_EVIDENCE_ACTIONS, value);
+}
+
+export function isGitHubEvidenceAction(
+  value: unknown,
+): value is GitHubEvidenceAction {
+  return includesEvidenceValue(GITHUB_EVIDENCE_ACTIONS, value);
+}
+
+export function isHostEvidenceAction(
+  value: unknown,
+): value is HostEvidenceAction {
+  return includesEvidenceValue(HOST_EVIDENCE_ACTIONS, value);
+}
+
+export function isArtifactEvidenceKind(
+  value: unknown,
+): value is ArtifactEvidenceKind {
+  return includesEvidenceValue(ARTIFACT_EVIDENCE_KINDS, value);
+}

runners/shared/src/index.ts

@@ -10,6 +10,23 @@ export {
   PAIRED_ROOM_ROLES,
   type PairedRoomRole,
 } from './paired-room-role.js';
+export {
+  ARTIFACT_EVIDENCE_KINDS,
+  DB_EVIDENCE_ACTIONS,
+  DEPLOY_EVIDENCE_ACTIONS,
+  GITHUB_EVIDENCE_ACTIONS,
+  HOST_EVIDENCE_ACTIONS,
+  isArtifactEvidenceKind,
+  isDbEvidenceAction,
+  isDeployEvidenceAction,
+  isGitHubEvidenceAction,
+  isHostEvidenceAction,
+  type ArtifactEvidenceKind,
+  type DbEvidenceAction,
+  type DeployEvidenceAction,
+  type GitHubEvidenceAction,
+  type HostEvidenceAction,
+} from './evidence-actions.js';
 export {
   extractMarkdownImageAttachments,
   extractMediaAttachments,

runners/shared/test/evidence-actions.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, it } from 'vitest';
+
+import {
+  ARTIFACT_EVIDENCE_KINDS,
+  DB_EVIDENCE_ACTIONS,
+  DEPLOY_EVIDENCE_ACTIONS,
+  GITHUB_EVIDENCE_ACTIONS,
+  HOST_EVIDENCE_ACTIONS,
+  isArtifactEvidenceKind,
+  isDbEvidenceAction,
+  isDeployEvidenceAction,
+  isGitHubEvidenceAction,
+  isHostEvidenceAction,
+} from '../src/evidence-actions.js';
+
+describe('evidence action constants', () => {
+  it('keeps host evidence actions as the composed allowlist', () => {
+    expect(HOST_EVIDENCE_ACTIONS).toEqual([
+      'ejclaw_service_status',
+      'ejclaw_service_logs',
+      'ejclaw_role_runtime_config',
+      ...DEPLOY_EVIDENCE_ACTIONS,
+      ...DB_EVIDENCE_ACTIONS,
+      ...GITHUB_EVIDENCE_ACTIONS,
+    ]);
+  });
+
+  it('recognizes scoped evidence actions', () => {
+    expect(isHostEvidenceAction('github_run_jobs')).toBe(true);
+    expect(isDbEvidenceAction('db_recent_scheduled_tasks')).toBe(true);
+    expect(isDeployEvidenceAction('ejclaw_artifact_metadata')).toBe(true);
+    expect(isGitHubEvidenceAction('github_workflow_file')).toBe(true);
+    expect(isHostEvidenceAction('cat /etc/shadow')).toBe(false);
+  });
+
+  it('recognizes artifact evidence kinds', () => {
+    expect(ARTIFACT_EVIDENCE_KINDS).toContain('runner_dist');
+    expect(isArtifactEvidenceKind('runner_dist')).toBe(true);
+    expect(isArtifactEvidenceKind('../secret')).toBe(false);
+  });
+});