Add the workspace coding agent, launch gate, and composable locks

- run a singleton Codex App Server adapter in each dev workspace - gate Web Studio with a reloadable fragment-token to HttpOnly-session exchange - add ChatGPT device login and streamed chat to Web Studio - isolate authoring access in a declarative NixOS service account - split Web Studio canvas, object, panel, and model concerns - check generated Quixos protocol clients for drift - resolve same-repository quixos.lock fragments deterministically - preserve the collaborative canvas gesture fixes
2026-09-05 12:33:52 -07:00
parent c4d42a0ac5
commit 0c46850973
53 changed files with 5056 additions and 2514 deletions
@@ -1,9 +1,16 @@
 import assert from "node:assert/strict";
+import { mkdtemp, mkdir, rm, symlink, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
 import test from "node:test";
 import {
  formatQuixosLock,
+  formatQuixosLockDocument,
+  loadQuixosLock,
  nixGitInput,
  parseQuixosLock,
+  parseQuixosLockDocument,
+  resolveQuixosLock,
  retentionTagForCommit,
 } from "../src/resource-lock/index.js";

@@ -92,3 +99,152 @@ test("rejects mutable revisions, embedded credentials, and duplicate bindings",
    ]),
  );
 });
+
+test("resolves root-relative lock fragments into one deterministic resource closure", async () => {
+  const root = `quixos-lock version 1 {
+    quixos source {
+      repository "https://gitea.example/quixos/quixos.git";
+      commit "${quixosCommit}";
+    }
+    import "locks/web-studio.lock";
+    import "locks/domain.lock";
+    package RootRuntime source {
+      repository "https://repos.example/alice/package-root.git";
+      commit "${packageCommit}";
+    }
+  }`;
+  const sources = new Map([
+    ["locks/web-studio.lock", `quixos-lock fragment version 1 {
+      import "locks/shared.lock";
+      interface Placeable source {
+        repository "https://repos.example/alice/interface-placeable.git";
+        commit "${namedCommit}";
+      }
+    }`],
+    ["locks/shared.lock", `quixos-lock fragment version 1 {
+      interface Named source {
+        repository "https://repos.example/alice/interface-named.git";
+        commit "${namedCommit}";
+      }
+    }`],
+    ["locks/domain.lock", `quixos-lock fragment version 1 {
+      package TodoRuntime source {
+        repository "https://repos.example/alice/package-todo.git";
+        commit "${packageCommit}";
+      }
+    }`],
+  ]);
+  const result = await resolveQuixosLock(root, async (relativePath) => {
+    const source = sources.get(relativePath);
+    if (!source) throw new Error("missing fixture");
+    return source;
+  });
+  assert.equal(result.ok, true);
+  if (!result.ok) return;
+  assert.deepEqual(result.lock.sourceFiles, [
+    "quixos.lock",
+    "locks/web-studio.lock",
+    "locks/shared.lock",
+    "locks/domain.lock",
+  ]);
+  assert.deepEqual(result.lock.resources.map(({ kind, binding }) => ({ kind, binding })), [
+    { kind: "package", binding: "RootRuntime" },
+    { kind: "interface", binding: "Placeable" },
+    { kind: "interface", binding: "Named" },
+    { kind: "package", binding: "TodoRuntime" },
+  ]);
+});
+
+test("lock fragments format canonically and cannot redeclare the Quixos source", () => {
+  const document = {
+    kind: "fragment" as const,
+    formatVersion: 1 as const,
+    imports: ["locks/shared.lock"],
+    resources: [{
+      kind: "interface" as const,
+      binding: "Named",
+      source: {
+        resolver: "git" as const,
+        repository: "https://repos.example/alice/interface-named.git",
+        commit: namedCommit,
+      },
+    }],
+  };
+  assert.deepEqual(parseQuixosLockDocument(formatQuixosLockDocument(document)), {
+    ok: true,
+    document,
+    diagnostics: [],
+  });
+  const invalid = parseQuixosLockDocument(`quixos-lock fragment version 1 {
+    quixos source {
+      repository "https://gitea.example/quixos/quixos.git";
+      commit "${quixosCommit}";
+    }
+  }`, "bad.lock");
+  assert.equal(invalid.ok, false);
+  if (!invalid.ok) assert.equal(invalid.diagnostics[0]?.code, "fragment-has-quixos-source");
+});
+
+test("lock imports reject traversal, cycles, root documents, and cross-file binding collisions", async () => {
+  const invalidPath = parseQuixosLockDocument(`quixos-lock fragment version 1 {
+    import "../outside.lock";
+  }`, "bad-path.lock");
+  assert.equal(invalidPath.ok, false);
+  if (!invalidPath.ok) assert.equal(invalidPath.diagnostics[0]?.code, "invalid-import-path");
+
+  const root = `quixos-lock version 1 {
+    quixos source {
+      repository "https://gitea.example/quixos/quixos.git";
+      commit "${quixosCommit}";
+    }
+    import "a.lock";
+    import "root-again.lock";
+    interface Named source {
+      repository "https://repos.example/alice/interface-named.git";
+      commit "${namedCommit}";
+    }
+  }`;
+  const sources = new Map([
+    ["a.lock", `quixos-lock fragment version 1 {
+      import "b.lock";
+      interface Named source {
+        repository "https://repos.example/alice/interface-named-copy.git";
+        commit "${namedCommit}";
+      }
+    }`],
+    ["b.lock", `quixos-lock fragment version 1 { import "a.lock"; }`],
+    ["root-again.lock", root],
+  ]);
+  const result = await resolveQuixosLock(root, async (relativePath) => sources.get(relativePath) ?? "");
+  assert.equal(result.ok, false);
+  if (!result.ok) {
+    assert.deepEqual(new Set(result.diagnostics.map(({ code }) => code)), new Set([
+      "duplicate-resource-binding",
+      "import-cycle",
+      "imported-root-lock",
+    ]));
+  }
+});
+
+test("file loading rejects a symlink in any import path component", async (context) => {
+  const directory = await mkdtemp(path.join(os.tmpdir(), "quixos-lock-test-"));
+  context.after(() => rm(directory, { recursive: true, force: true }));
+  const outside = path.join(directory, "outside");
+  await mkdir(outside);
+  await writeFile(path.join(outside, "fragment.lock"), "quixos-lock fragment version 1 {}\n");
+  await symlink(outside, path.join(directory, "linked"), "dir");
+  await writeFile(path.join(directory, "quixos.lock"), `quixos-lock version 1 {
+    quixos source {
+      repository "https://gitea.example/quixos/quixos.git";
+      commit "${quixosCommit}";
+    }
+    import "linked/fragment.lock";
+  }`);
+
+  const result = await loadQuixosLock(path.join(directory, "quixos.lock"));
+  assert.equal(result.ok, false);
+  if (!result.ok) {
+    assert.equal(result.diagnostics[0]?.code, "import-read-failed");
+    assert.match(result.diagnostics[0]?.message ?? "", /symbolic links/);
+  }
+});