refactor: simplify paired review system and add reviewer container isolation
Phase 1 — Strip over-engineering (-3,665 lines): - DB tables: 7 → 3 (remove executions, approvals, artifacts, events) - Task statuses: 11 → 5 (active, review_ready, in_review, merge_ready, completed) - Remove plan governance, event sourcing, gate/verdict, freshness guards - paired-execution-context: 980 → 299 lines - Session commands: remove /risk, /plan, /approve-plan, /request-plan-changes Phase 2 — Container isolation for reviewers: - Add container-runtime.ts (Docker abstraction) - Add credential-proxy.ts (API key injection without container exposure) - Add container-runner.ts (reviewer-specific read-only mount + tmpfs) - Add container/Dockerfile + agent-runner (Chromium, Claude Code, Codex) - agent-runner.ts: auto-route reviewer execution to container mode
This commit is contained in:
Eyejoker
@@ -38,12 +38,6 @@ vi.mock('./paired-execution-context.js', () => ({
|
||||
completePairedExecutionContext: vi.fn(),
|
||||
markRoomReviewReady: vi.fn(() => null),
|
||||
formatRoomReviewReadyMessage: vi.fn(() => null),
|
||||
planPairedExecutionRecovery: vi.fn(() => null),
|
||||
finalizeRoomDeployment: vi.fn(() => null),
|
||||
setRoomTaskRiskLevel: vi.fn(() => null),
|
||||
recordRoomPlan: vi.fn(() => null),
|
||||
approveRoomPlan: vi.fn(() => null),
|
||||
requestRoomPlanChanges: vi.fn(() => null),
|
||||
}));
|
||||
|
||||
vi.mock('./db.js', () => {
|
||||
@@ -271,11 +265,9 @@ describe('createMessageRuntime', () => {
|
||||
reviewer_service_id: 'codex-main',
|
||||
title: null,
|
||||
source_ref: 'HEAD',
|
||||
task_policy: 'autonomous',
|
||||
risk_level: 'low',
|
||||
plan_status: 'not_requested',
|
||||
plan_notes: null,
|
||||
review_requested_at: '2026-03-29T00:00:00.000Z',
|
||||
status: 'review_pending',
|
||||
status: 'review_ready',
|
||||
created_at: '2026-03-29T00:00:00.000Z',
|
||||
updated_at: '2026-03-29T00:00:00.000Z',
|
||||
},
|
||||
@@ -356,7 +348,7 @@ describe('createMessageRuntime', () => {
|
||||
actualSessionCommands.handleSessionCommand(opts),
|
||||
);
|
||||
vi.mocked(pairedExecutionContext.markRoomReviewReady).mockReturnValue({
|
||||
status: 'blocked',
|
||||
status: 'pending',
|
||||
task: {
|
||||
id: 'paired-task-1',
|
||||
chat_jid: chatJid,
|
||||
@@ -365,15 +357,13 @@ describe('createMessageRuntime', () => {
|
||||
reviewer_service_id: 'codex-main',
|
||||
title: null,
|
||||
source_ref: 'HEAD',
|
||||
task_policy: 'autonomous',
|
||||
risk_level: 'high',
|
||||
plan_status: 'pending',
|
||||
plan_notes: null,
|
||||
review_requested_at: null,
|
||||
status: 'plan_review_pending',
|
||||
status: 'active',
|
||||
created_at: '2026-03-29T00:00:00.000Z',
|
||||
updated_at: '2026-03-29T00:00:00.000Z',
|
||||
},
|
||||
blockedReason: 'plan-review-required',
|
||||
pendingReason: 'owner-workspace-not-ready',
|
||||
});
|
||||
vi.mocked(
|
||||
pairedExecutionContext.formatRoomReviewReadyMessage,
|
||||
@@ -410,228 +400,6 @@ describe('createMessageRuntime', () => {
|
||||
expect(channel.sendMessage).toHaveBeenCalledWith(chatJid, blockedMessage);
|
||||
});
|
||||
|
||||
it('surfaces the deploy-complete message through the message-runtime path', async () => {
|
||||
const chatJid = 'group@test';
|
||||
const group = {
|
||||
...makeGroup('codex'),
|
||||
workDir: '/repo/canonical',
|
||||
};
|
||||
const channel = makeChannel(chatJid);
|
||||
const saveState = vi.fn();
|
||||
const lastAgentTimestamps: Record<string, string> = {};
|
||||
const deployMessage = [
|
||||
'Deployment finalized.',
|
||||
'- Task: paired-task-1',
|
||||
'- Status: merged',
|
||||
'- Checkpoint: abc123',
|
||||
].join('\n');
|
||||
|
||||
vi.mocked(db.isPairedRoomJid).mockReturnValue(true);
|
||||
vi.mocked(db.getMessagesSince).mockReturnValue([
|
||||
{
|
||||
id: 'msg-deploy',
|
||||
chat_jid: chatJid,
|
||||
sender: 'me@test',
|
||||
sender_name: 'Me',
|
||||
content: '/deploy-complete',
|
||||
timestamp: '2026-03-29T00:00:00.000Z',
|
||||
is_from_me: true,
|
||||
},
|
||||
]);
|
||||
const actualSessionCommands = await vi.importActual<
|
||||
typeof import('./session-commands.js')
|
||||
>('./session-commands.js');
|
||||
vi.mocked(sessionCommands.handleSessionCommand).mockImplementation((opts) =>
|
||||
actualSessionCommands.handleSessionCommand(opts),
|
||||
);
|
||||
vi.mocked(pairedExecutionContext.finalizeRoomDeployment).mockReturnValue(
|
||||
deployMessage,
|
||||
);
|
||||
|
||||
const runtime = createMessageRuntime({
|
||||
assistantName: 'Andy',
|
||||
idleTimeout: 1_000,
|
||||
pollInterval: 1_000,
|
||||
timezone: 'UTC',
|
||||
triggerPattern: /^@Andy\b/i,
|
||||
channels: [channel],
|
||||
queue: {
|
||||
registerProcess: vi.fn(),
|
||||
closeStdin: vi.fn(),
|
||||
notifyIdle: vi.fn(),
|
||||
} as any,
|
||||
getRegisteredGroups: () => ({ [chatJid]: group }),
|
||||
getSessions: () => ({}),
|
||||
getLastTimestamp: () => '',
|
||||
setLastTimestamp: vi.fn(),
|
||||
getLastAgentTimestamps: () => lastAgentTimestamps,
|
||||
saveState,
|
||||
persistSession: vi.fn(),
|
||||
clearSession: vi.fn(),
|
||||
});
|
||||
|
||||
const result = await runtime.processGroupMessages(chatJid, {
|
||||
runId: 'run-deploy-complete',
|
||||
reason: 'messages',
|
||||
});
|
||||
|
||||
expect(result).toBe(true);
|
||||
expect(sessionCommands.handleSessionCommand).toHaveBeenCalled();
|
||||
expect(pairedExecutionContext.finalizeRoomDeployment).toHaveBeenCalled();
|
||||
expect(channel.sendMessage).toHaveBeenCalledWith(chatJid, deployMessage);
|
||||
});
|
||||
|
||||
it('routes /approve-plan through reviewer context in the message-runtime path', async () => {
|
||||
const chatJid = 'group@test';
|
||||
const group = {
|
||||
...makeGroup('codex'),
|
||||
workDir: '/repo/canonical',
|
||||
};
|
||||
const channel = makeChannel(chatJid);
|
||||
const saveState = vi.fn();
|
||||
const lastAgentTimestamps: Record<string, string> = {};
|
||||
|
||||
vi.mocked(db.isPairedRoomJid).mockReturnValue(true);
|
||||
vi.mocked(db.getMessagesSince).mockReturnValue([
|
||||
{
|
||||
id: 'msg-approve-plan',
|
||||
chat_jid: chatJid,
|
||||
sender: 'me@test',
|
||||
sender_name: 'Me',
|
||||
content: '/approve-plan',
|
||||
timestamp: '2026-03-29T00:00:00.000Z',
|
||||
is_from_me: true,
|
||||
},
|
||||
]);
|
||||
const actualSessionCommands = await vi.importActual<
|
||||
typeof import('./session-commands.js')
|
||||
>('./session-commands.js');
|
||||
vi.mocked(sessionCommands.handleSessionCommand).mockImplementation((opts) =>
|
||||
actualSessionCommands.handleSessionCommand(opts),
|
||||
);
|
||||
vi.mocked(pairedExecutionContext.approveRoomPlan).mockReturnValue(
|
||||
'Plan approved.\n- Task: paired-task-1',
|
||||
);
|
||||
|
||||
const runtime = createMessageRuntime({
|
||||
assistantName: 'Andy',
|
||||
idleTimeout: 1_000,
|
||||
pollInterval: 1_000,
|
||||
timezone: 'UTC',
|
||||
triggerPattern: /^@Andy\b/i,
|
||||
channels: [channel],
|
||||
queue: {
|
||||
registerProcess: vi.fn(),
|
||||
closeStdin: vi.fn(),
|
||||
notifyIdle: vi.fn(),
|
||||
} as any,
|
||||
getRegisteredGroups: () => ({ [chatJid]: group }),
|
||||
getSessions: () => ({}),
|
||||
getLastTimestamp: () => '',
|
||||
setLastTimestamp: vi.fn(),
|
||||
getLastAgentTimestamps: () => lastAgentTimestamps,
|
||||
saveState,
|
||||
persistSession: vi.fn(),
|
||||
clearSession: vi.fn(),
|
||||
});
|
||||
|
||||
const result = await runtime.processGroupMessages(chatJid, {
|
||||
runId: 'run-approve-plan',
|
||||
reason: 'messages',
|
||||
});
|
||||
|
||||
expect(result).toBe(true);
|
||||
expect(pairedExecutionContext.approveRoomPlan).toHaveBeenCalledWith(
|
||||
expect.objectContaining({
|
||||
chatJid,
|
||||
roomRoleContext: expect.objectContaining({
|
||||
role: 'reviewer',
|
||||
serviceId: 'codex-main',
|
||||
}),
|
||||
}),
|
||||
);
|
||||
expect(channel.sendMessage).toHaveBeenCalledWith(
|
||||
chatJid,
|
||||
'Plan approved.\n- Task: paired-task-1',
|
||||
);
|
||||
});
|
||||
|
||||
it('routes /request-plan-changes through reviewer context in the message-runtime path', async () => {
|
||||
const chatJid = 'group@test';
|
||||
const group = {
|
||||
...makeGroup('codex'),
|
||||
workDir: '/repo/canonical',
|
||||
};
|
||||
const channel = makeChannel(chatJid);
|
||||
const saveState = vi.fn();
|
||||
const lastAgentTimestamps: Record<string, string> = {};
|
||||
|
||||
vi.mocked(db.isPairedRoomJid).mockReturnValue(true);
|
||||
vi.mocked(db.getMessagesSince).mockReturnValue([
|
||||
{
|
||||
id: 'msg-request-plan-changes',
|
||||
chat_jid: chatJid,
|
||||
sender: 'me@test',
|
||||
sender_name: 'Me',
|
||||
content: '/request-plan-changes tighten scope',
|
||||
timestamp: '2026-03-29T00:00:00.000Z',
|
||||
is_from_me: true,
|
||||
},
|
||||
]);
|
||||
const actualSessionCommands = await vi.importActual<
|
||||
typeof import('./session-commands.js')
|
||||
>('./session-commands.js');
|
||||
vi.mocked(sessionCommands.handleSessionCommand).mockImplementation((opts) =>
|
||||
actualSessionCommands.handleSessionCommand(opts),
|
||||
);
|
||||
vi.mocked(pairedExecutionContext.requestRoomPlanChanges).mockReturnValue(
|
||||
'Plan changes requested.\n- Task: paired-task-1',
|
||||
);
|
||||
|
||||
const runtime = createMessageRuntime({
|
||||
assistantName: 'Andy',
|
||||
idleTimeout: 1_000,
|
||||
pollInterval: 1_000,
|
||||
timezone: 'UTC',
|
||||
triggerPattern: /^@Andy\b/i,
|
||||
channels: [channel],
|
||||
queue: {
|
||||
registerProcess: vi.fn(),
|
||||
closeStdin: vi.fn(),
|
||||
notifyIdle: vi.fn(),
|
||||
} as any,
|
||||
getRegisteredGroups: () => ({ [chatJid]: group }),
|
||||
getSessions: () => ({}),
|
||||
getLastTimestamp: () => '',
|
||||
setLastTimestamp: vi.fn(),
|
||||
getLastAgentTimestamps: () => lastAgentTimestamps,
|
||||
saveState,
|
||||
persistSession: vi.fn(),
|
||||
clearSession: vi.fn(),
|
||||
});
|
||||
|
||||
const result = await runtime.processGroupMessages(chatJid, {
|
||||
runId: 'run-request-plan-changes',
|
||||
reason: 'messages',
|
||||
});
|
||||
|
||||
expect(result).toBe(true);
|
||||
expect(pairedExecutionContext.requestRoomPlanChanges).toHaveBeenCalledWith(
|
||||
expect.objectContaining({
|
||||
chatJid,
|
||||
roomRoleContext: expect.objectContaining({
|
||||
role: 'reviewer',
|
||||
serviceId: 'codex-main',
|
||||
}),
|
||||
note: 'tighten scope',
|
||||
}),
|
||||
);
|
||||
expect(channel.sendMessage).toHaveBeenCalledWith(
|
||||
chatJid,
|
||||
'Plan changes requested.\n- Task: paired-task-1',
|
||||
);
|
||||
});
|
||||
|
||||
it('ignores generic failure bot messages in paired rooms', async () => {
|
||||
const chatJid = 'group@test';
|
||||
const group = makeGroup('codex');
|
||||
|
||||
Reference in New Issue
Block a user