Files
nanoclaw/scripts/test-v2-channel-e2e.ts
T
gavrielc 0d3326aae5 feat(v2): user-level privilege model + cold DM infra + init-first-agent skill
Replaces the agent-group-centric "main group" concept with user-level
privileges and adds the cold-DM infrastructure needed for proactive
outbound messaging (pairing, approvals, welcome flows).

Privilege model
- New tables: users, user_roles (owner global-only; admin global or
  scoped to an agent_group), agent_group_members (explicit non-
  privileged access; admin/owner imply membership), user_dms (cold-DM
  resolution cache).
- Removed agent_groups.is_admin, messaging_groups.admin_user_id. Replaced
  with messaging_groups.unknown_sender_policy (strict | request_approval
  | public) for per-chat unknown-sender gating.
- src/access.ts: canAccessAgentGroup, pickApprover, pickApprovalDelivery.
- src/router.ts: access gate on every inbound, honoring
  unknown_sender_policy for unknown senders.
- src/channels/telegram.ts: pairing interceptor upserts the paired user
  and promotes them to owner if hasAnyOwner() is false (first-pair-wins).

Cold DM infrastructure
- ChannelAdapter.openDM?(handle) — optional method. Chat-SDK-bridge wires
  it to chat.openDM() for resolution-required channels (Discord, Slack,
  Teams, Webex, gChat); direct-addressable channels (Telegram, WhatsApp,
  iMessage, Matrix, Resend) fall through to the handle directly.
- src/user-dm.ts: ensureUserDm(userId) — resolves + caches via user_dms.

Approval routing
- onecli-approvals + delivery use pickApprover + pickApprovalDelivery:
  scoped admins → global admins → owners (dedup), first reachable via
  ensureUserDm, same-channel-kind tie-break. Approvals land in the
  approver's DM, not the origin chat.

Delivery fixes
- delivery.ts ACL rejection now throws instead of returning undefined —
  the outer loop previously marked rejected messages as delivered.
- Implicit-origin allow: session.messaging_group_id === target skips the
  destination check.
- createMessagingGroupAgent auto-creates the companion agent_destinations
  row (normalized local_name from the messaging group's name, collision-
  broken within the agent's namespace).

Container
- container-runner.ts: /workspace/global always read-only; drops
  NANOCLAW_IS_ADMIN; adds NANOCLAW_ADMIN_USER_IDS (owners + global admins
  + scoped admins for this agent group). Agent-runner poll-loop gates
  slash commands against that set.

New skill: /init-first-agent
- Walks the operator through standing up the first agent for a channel:
  channel pick → identity lookup (reads each channel SKILL.md's
  ## Channel Info > how-to-find-id) → DM platform_id resolution (direct-
  addressable, cold-DM via "user DMs bot first + sqlite lookup", or
  Telegram pair-code fallback) → run scripts/init-first-agent.ts →
  verify via tail of nanoclaw.log.
- scripts/init-first-agent.ts: parameterized helper that upserts the
  user + grants owner (if none), creates dm-with-<display-name> agent
  group + initGroupFilesystem, reuses/creates the DM messaging_group,
  wires it (auto-creates destination), resolves the session, and writes
  a kind:'chat' / sender:'system' welcome message into inbound.db. Host
  sweep wakes the container and the agent DMs the operator via the
  normal delivery path.

/manage-channels rewrite
- Drops --is-main / --jid / main-vs-non-main isolation references.
- First-channel flow delegates to /init-first-agent.
- Explains createMessagingGroupAgent auto-creates destinations.
- Adds a privileged-users show section.

setup/
- register.ts: drop --is-main, --jid, --local-name, --trigger
  requiresTrigger defaults; call initGroupFilesystem; normalize to
  v2 schema (no is_admin, no admin_user_id, sets unknown_sender_policy
  'strict'); let createMessagingGroupAgent handle the destination row.
- pair-telegram.ts: emit PAIRED_USER_ID (namespaced "telegram:<id>")
  instead of ADMIN_USER_ID; update header comment.
- register.test.ts deleted — was v1-only, tested a registered_groups
  table that no longer exists.

Docs
- v2-architecture-diagram.{md,html}: ER diagram updated to drop
  is_admin/admin_user_id, add unknown_sender_policy, and include
  users/user_roles/agent_group_members/user_dms.
- v2-architecture-draft.md: approval-routing paragraph rewritten for
  pickApprover/pickApprovalDelivery/ensureUserDm; SQL schema block
  updated; admin-verification paragraph references
  NANOCLAW_ADMIN_USER_IDS.
- v2-setup-wiring.md: entity-model sketch rewritten.
- v2-checklist.md: marked privilege refactor / container filtering /
  approval routing / unknown-sender gating done; removed obsolete
  admin_user_id and main-vs-non-main items.

Scripts
- scripts/init-first-agent.ts (new) replaces scripts/welcome-owner-dm.ts
  (removed; welcome-owner was a Discord-specific one-off).
- test-v2-host.ts, test-v2-channel-e2e.ts, seed-discord.ts: drop
  is_admin + admin_user_id, use unknown_sender_policy.

Tests
- src/access.test.ts (new): 14 tests for canAccessAgentGroup, role
  helpers, pickApprover, ensureUserDm, pickApprovalDelivery.
- src/db/db-v2.test.ts: adds 3 tests for the auto-created
  agent_destinations row (normalized name, no duplicates, collision
  break within an agent group).
- host-core.test.ts, channel-registry.test.ts: updated fixtures to
  use unknown_sender_policy: 'public' where the test exercises routing
  rather than the access gate.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-15 00:03:51 +03:00

257 lines
8.5 KiB
TypeScript

/**
* End-to-end test of v2 channel adapter pipeline:
*
* Mock adapter → onInbound → router → session DB → Docker container →
* agent-runner → Claude → messages_out → delivery → mock adapter.deliver()
*
* Usage: npx tsx scripts/test-v2-channel-e2e.ts
*/
import Database from 'better-sqlite3';
import fs from 'fs';
import path from 'path';
const TEST_DIR = '/tmp/nanoclaw-v2-channel-e2e';
if (fs.existsSync(TEST_DIR)) fs.rmSync(TEST_DIR, { recursive: true });
fs.mkdirSync(TEST_DIR, { recursive: true });
// --- Step 1: Init central DB ---
console.log('\n=== Step 1: Init central DB ===');
import { initDb } from '../src/db/connection.js';
import { runMigrations } from '../src/db/migrations/index.js';
import { createAgentGroup } from '../src/db/agent-groups.js';
import { createMessagingGroup, createMessagingGroupAgent } from '../src/db/messaging-groups.js';
const centralDb = initDb(path.join(TEST_DIR, 'v2.db'));
runMigrations(centralDb);
// Create groups dir for agent folder mount
const groupsDir = path.resolve(process.cwd(), 'groups');
const testGroupDir = path.join(groupsDir, 'test-channel-e2e');
fs.mkdirSync(testGroupDir, { recursive: true });
fs.writeFileSync(path.join(testGroupDir, 'CLAUDE.md'), '# Test Agent\nYou are a test agent. Be brief.\n');
createAgentGroup({
id: 'ag-chan',
name: 'Channel E2E Agent',
folder: 'test-channel-e2e',
agent_provider: 'claude',
container_config: null,
created_at: new Date().toISOString(),
});
createMessagingGroup({
id: 'mg-chan',
channel_type: 'mock',
platform_id: 'mock-channel-1',
name: 'Mock Channel',
is_group: 0,
unknown_sender_policy: 'public',
created_at: new Date().toISOString(),
});
createMessagingGroupAgent({
id: 'mga-chan',
messaging_group_id: 'mg-chan',
agent_group_id: 'ag-chan',
trigger_rules: null,
response_scope: 'all',
session_mode: 'shared',
priority: 0,
created_at: new Date().toISOString(),
});
console.log('✓ Central DB initialized');
// --- Step 2: Set up mock channel adapter + delivery ---
console.log('\n=== Step 2: Set up mock channel adapter & delivery ===');
import { routeInbound } from '../src/router.js';
import { setDeliveryAdapter, startActiveDeliveryPoll, stopDeliveryPolls } from '../src/delivery.js';
import { getChannelAdapter, registerChannelAdapter, initChannelAdapters } from '../src/channels/channel-registry.js';
import { findSession } from '../src/db/sessions.js';
import { sessionDbPath } from '../src/session-manager.js';
import type { ChannelAdapter, ChannelSetup, OutboundMessage } from '../src/channels/adapter.js';
// Track delivered messages
const deliveredMessages: Array<{ platformId: string; threadId: string | null; message: OutboundMessage }> = [];
let lastDeliveryTime = 0;
const startTime = Date.now();
// Create mock adapter
const mockAdapter: ChannelAdapter = {
name: 'mock',
channelType: 'mock',
async setup(config: ChannelSetup) {
console.log(` ✓ Mock adapter setup with ${config.conversations.length} conversations`);
},
async deliver(platformId, threadId, message) {
deliveredMessages.push({ platformId, threadId, message });
lastDeliveryTime = Date.now();
const elapsed = Math.floor((Date.now() - startTime) / 1000);
const content = message.content as Record<string, unknown>;
const text = ((content.text as string) || '').slice(0, 120);
console.log(` ✓ [${elapsed}s] Delivered #${deliveredMessages.length}: ${text}...`);
},
async setTyping() {},
async teardown() {},
isConnected() { return true; },
};
// Register mock adapter
registerChannelAdapter('mock', { factory: () => mockAdapter });
// Init channel adapters — this calls setup() with conversation configs from central DB
await initChannelAdapters((adapter) => ({
conversations: [{ platformId: 'mock-channel-1', agentGroupId: 'ag-chan', requiresTrigger: false, sessionMode: 'shared' }],
onInbound(platformId, threadId, message) {
routeInbound({
channelType: adapter.channelType,
platformId,
threadId,
message: {
id: message.id,
kind: message.kind,
content: JSON.stringify(message.content),
timestamp: message.timestamp,
},
}).catch((err) => console.error('Route error:', err));
},
onMetadata() {},
}));
// Set up delivery adapter bridge
setDeliveryAdapter({
async deliver(channelType, platformId, threadId, kind, content) {
const adapter = getChannelAdapter(channelType);
if (!adapter) return;
await adapter.deliver(platformId, threadId, { kind, content: JSON.parse(content) });
},
});
// Start delivery polling
startActiveDeliveryPoll();
console.log('✓ Mock adapter & delivery configured');
// --- Step 3: Simulate inbound message through adapter ---
console.log('\n=== Step 3: Simulate inbound message ===');
// This is what a real adapter would do when receiving a platform message
const adapterSetup = (mockAdapter as { _setup?: ChannelSetup })._setup;
// Call routeInbound directly (simulating onInbound callback)
await routeInbound({
channelType: 'mock',
platformId: 'mock-channel-1',
threadId: null,
message: {
id: 'msg-chan-1',
kind: 'chat',
content: JSON.stringify({
sender: 'Gavriel',
text: 'Call the send_message tool 3 times: text="Update 1", text="Update 2", text="Update 3". Make each call separately. After all 3, say "Done".',
}),
timestamp: new Date().toISOString(),
},
});
const session = findSession('mg-chan', null);
if (!session) {
console.log('✗ No session created!');
cleanup();
process.exit(1);
}
console.log(`✓ Session: ${session.id}`);
console.log(`✓ Container status: ${session.container_status}`);
import { execSync } from 'child_process';
const checkContainerLogs = () => {
try {
const containers = execSync('docker ps -a --filter name=nanoclaw-v2-test-channel --format "{{.Names}}"').toString().trim();
for (const name of containers.split('\n').filter(Boolean)) {
console.log(`\nContainer logs (${name}):`);
console.log(execSync(`docker logs ${name} 2>&1`).toString());
}
} catch { /* ignore */ }
};
const sessDbPath = sessionDbPath('ag-chan', session.id);
console.log(`✓ Session DB: ${sessDbPath}`);
// --- Step 4: Wait for delivery through mock adapter ---
console.log('\n=== Step 4: Waiting for delivery through mock adapter... ===');
const TIMEOUT_MS = 300_000;
// Wait for deliveries — resolve when no new ones for 30s after first delivery
await new Promise<void>((resolve) => {
const poll = () => {
if (lastDeliveryTime > 0 && Date.now() - lastDeliveryTime > 30_000) {
resolve();
return;
}
if (Date.now() - startTime > TIMEOUT_MS) {
console.log(`\n✗ Timed out after ${TIMEOUT_MS / 1000}s`);
// Check session DB directly
try {
const db = new Database(sessDbPath, { readonly: true });
const out = db.prepare('SELECT * FROM messages_out').all();
console.log(` messages_out rows: ${out.length}`);
if (out.length > 0) console.log(' (messages exist but delivery failed)');
db.close();
} catch { /* ignore */ }
checkContainerLogs();
cleanup();
process.exit(1);
}
const elapsed = Math.floor((Date.now() - startTime) / 1000);
if (elapsed > 0 && elapsed % 10 === 0) {
process.stdout.write(` ${elapsed}s...`);
}
setTimeout(poll, 1000);
};
poll();
});
// --- Step 5: Print results ---
console.log('\n\n=== Results ===');
console.log('\nSession DB:');
try {
const db = new Database(sessDbPath, { readonly: true });
const inRows = db.prepare('SELECT * FROM messages_in').all() as Array<Record<string, unknown>>;
const outRows = db.prepare('SELECT * FROM messages_out').all() as Array<Record<string, unknown>>;
db.close();
console.log(` messages_in: ${inRows.length} row(s)`);
for (const r of inRows) {
console.log(` [${r.id}] status=${r.status} kind=${r.kind}`);
}
console.log(` messages_out: ${outRows.length} row(s)`);
for (const r of outRows) {
const content = JSON.parse(r.content as string);
console.log(` [${r.id}] kind=${r.kind} delivered=${r.delivered}`);
console.log(`${content.text}`);
}
} catch (err) {
console.log(` (could not read session DB: ${err})`);
}
console.log('\nDelivered through mock adapter:');
for (const d of deliveredMessages) {
const content = d.message.content as Record<string, unknown>;
console.log(` → [${d.platformId}] ${content.text}`);
}
console.log('\n✓ Full channel adapter pipeline verified!');
cleanup();
process.exit(0);
function cleanup() {
stopDeliveryPolls();
fs.rmSync(testGroupDir, { recursive: true, force: true });
}