feat: complete Nexus mission-control workflows

2026-07-09 23:40:36 +02:00
parent 436ddfee0f
commit aaec3eb4ed
39 changed files with 3281 additions and 97 deletions
@@ -0,0 +1,496 @@
+using System.Reflection;
+using System.Security.Claims;
+using System.Text;
+using System.Text.Json;
+using Microsoft.AspNetCore.Http;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Configuration;
+using Nexus.Api.Data;
+using Nexus.Api.Controllers;
+using Nexus.Api.DTOs;
+using Nexus.Api.Models;
+using Nexus.Api.Repositories;
+using Nexus.Api.Services;
+using Xunit;
+
+namespace Nexus.Api.Tests;
+
+public sealed class MissionControlPhaseTests
+{
+    [Fact]
+    public void AgentConfigSave_IsBaoOwnerOnly()
+    {
+        var method = typeof(AgentsController).GetMethod(nameof(AgentsController.SaveConfigFile), BindingFlags.Instance | BindingFlags.Public);
+
+        Assert.NotNull(method);
+        var authorize = method!.GetCustomAttribute<AuthorizeAttribute>();
+        Assert.NotNull(authorize);
+        Assert.Equal("owner", authorize!.Roles);
+    }
+
+    [Fact]
+    public void TaskApprovalEndpoints_AreOwnerOnly()
+    {
+        var pending = typeof(TasksController).GetMethod(nameof(TasksController.GetPendingApproval), BindingFlags.Instance | BindingFlags.Public);
+        var approve = typeof(TasksController).GetMethod(nameof(TasksController.Approve), BindingFlags.Instance | BindingFlags.Public);
+        var reject = typeof(TasksController).GetMethod(nameof(TasksController.Reject), BindingFlags.Instance | BindingFlags.Public);
+
+        Assert.Equal("owner", pending!.GetCustomAttribute<AuthorizeAttribute>()?.Roles);
+        Assert.Equal("owner", approve!.GetCustomAttribute<AuthorizeAttribute>()?.Roles);
+        Assert.Equal("owner", reject!.GetCustomAttribute<AuthorizeAttribute>()?.Roles);
+    }
+
+    [Fact]
+    public void GatewayActivityRedaction_RemovesSensitiveLines()
+    {
+        var text = OpenClawGatewayClient.RedactSensitiveText("""
+            Status: ok
+            Authorization: Bearer abc.def.ghi
+            Next step ready
+            X-Nexus-Api-Key: secret
+            """);
+
+        Assert.Contains("Status: ok", text);
+        Assert.Contains("Next step ready", text);
+        Assert.DoesNotContain("Bearer abc", text);
+        Assert.DoesNotContain("secret", text);
+        Assert.Equal(2, text.Split("[redacted sensitive line]").Length - 1);
+    }
+
+    [Fact]
+    public void AgentSummaryBuilder_ProducesStructuredNowAndTodaySummary()
+    {
+        var now = DateTimeOffset.UtcNow;
+        var activity = new[]
+        {
+            new ActivityEvent
+            {
+                Type = "agent_task",
+                Message = "programmer completed repo scan",
+                CreatedAt = now.AddHours(-3)
+            }
+        };
+
+        var gateway = new[]
+        {
+            new AgentActivityEntry("5m ago", "Authorization: Bearer hidden\nWorking on redaction", now.AddMinutes(-5)),
+            new AgentActivityEntry("20m ago", "Checking task mapping", now.AddMinutes(-20))
+        };
+
+        var summary = AgentSummaryBuilder.Build(activity, gateway, now);
+
+        Assert.Equal("gateway-session-history", summary.Now.Source);
+        Assert.Equal(now.AddMinutes(-5), summary.Now.Timestamp);
+        Assert.DoesNotContain("Bearer hidden", summary.Now.Text);
+        Assert.Contains("Working on redaction", summary.Now.Text);
+        Assert.Equal("derived-mixed", summary.Today.Source);
+        Assert.Equal(now.AddMinutes(-5), summary.Today.Timestamp);
+        Assert.Contains("Working on redaction", summary.Today.Text);
+        Assert.Contains("Checking task mapping", summary.Today.Text);
+        Assert.Contains("programmer completed repo scan", summary.Today.Text);
+    }
+
+    [Fact]
+    public async Task ActivityRepository_RedactsBeforePersistenceAndPublishesAgentIds()
+    {
+        var options = new DbContextOptionsBuilder<NexusDbContext>()
+            .UseInMemoryDatabase(Guid.NewGuid().ToString())
+            .Options;
+
+        await using var db = new NexusDbContext(options);
+        await db.Database.EnsureCreatedAsync();
+
+        var liveUpdates = new LiveUpdateService();
+        var subscription = await liveUpdates.SubscribeAsync();
+        var repository = new ActivityRepository(db, liveUpdates);
+
+        await repository.AddAsync(new ActivityEvent
+        {
+            Type = "agent",
+            Message = "Command sent to agent programmer: Authorization: Bearer secret-token"
+        });
+
+        var stored = await repository.GetRecentAsync(1);
+        Assert.Single(stored);
+        Assert.DoesNotContain("secret-token", stored[0].Message);
+        Assert.Contains("programmer", stored[0].Message);
+        Assert.Contains("Authorization: Bearer [redacted]", stored[0].Message);
+
+        var envelope = await subscription.Reader.ReadAsync();
+        Assert.Equal("activity.created", envelope.Type);
+
+        var payloadJson = JsonSerializer.Serialize(envelope.Payload);
+        using var doc = JsonDocument.Parse(payloadJson);
+        Assert.Equal("agent", doc.RootElement.GetProperty("Type").GetString());
+        Assert.DoesNotContain("secret-token", doc.RootElement.GetProperty("Message").GetString());
+        var agentIds = doc.RootElement.GetProperty("agentIds").EnumerateArray().Select(x => x.GetString()).ToArray();
+        Assert.Contains("programmer", agentIds);
+    }
+
+    [Fact]
+    public async Task ActivityRepository_GetByAgentAsync_UsesMappedAgentIds()
+    {
+        var options = new DbContextOptionsBuilder<NexusDbContext>()
+            .UseInMemoryDatabase(Guid.NewGuid().ToString())
+            .Options;
+
+        await using var db = new NexusDbContext(options);
+        await db.Database.EnsureCreatedAsync();
+
+        var repository = new ActivityRepository(db, new LiveUpdateService());
+        await repository.AddAsync(new ActivityEvent
+        {
+            Type = "agent",
+            Message = "Command sent to agent programmer: compile module"
+        });
+        await repository.AddAsync(new ActivityEvent
+        {
+            Type = "agent",
+            Message = "Command sent to agent reviewer: inspect module"
+        });
+
+        var programmerEvents = await repository.GetByAgentAsync("programmer", 10);
+
+        Assert.Single(programmerEvents);
+        Assert.True(programmerEvents[0].Message.Contains("programmer", StringComparison.OrdinalIgnoreCase));
+        Assert.False(programmerEvents[0].Message.Contains("reviewer", StringComparison.OrdinalIgnoreCase));
+    }
+
+    [Fact]
+    public async Task GatewayInfo_ReportsVersionDrift()
+    {
+        var client = CreateClient(_ => new HttpResponseMessage(System.Net.HttpStatusCode.OK)
+        {
+            Content = new StringContent("""{"version":"2026.07.08"}""", Encoding.UTF8, "application/json")
+        }, requiredVersion: "2026.07.09");
+
+        var info = await client.GetGatewayInfoAsync();
+
+        Assert.True(info.Reachable);
+        Assert.Equal("2026.07.08", info.Version);
+        Assert.Equal("2026.07.09", info.RequiredVersion);
+        Assert.Equal("drift", info.VersionStatus);
+        Assert.False(info.VersionMatches);
+        Assert.NotNull(info.Warning);
+        Assert.Contains("2026.07.08", info.Warning!);
+    }
+
+    [Fact]
+    public async Task GatewayInfo_ReportsMissingVersionWhenPinned()
+    {
+        var client = CreateClient(_ => new HttpResponseMessage(System.Net.HttpStatusCode.OK)
+        {
+            Content = new StringContent("""{"status":"ok"}""", Encoding.UTF8, "application/json")
+        }, requiredVersion: "2026.07.09");
+
+        var info = await client.GetGatewayInfoAsync();
+
+        Assert.True(info.Reachable);
+        Assert.Null(info.Version);
+        Assert.Equal("missing", info.VersionStatus);
+        Assert.False(info.VersionMatches);
+        Assert.NotNull(info.Warning);
+        Assert.Contains("2026.07.09", info.Warning!);
+    }
+
+    [Fact]
+    public async Task GatewayInfo_ReportsMatchedPinnedVersion()
+    {
+        var client = CreateClient(request =>
+        {
+            var response = new HttpResponseMessage(System.Net.HttpStatusCode.OK)
+            {
+                Content = new StringContent("""{"status":"ok"}""", Encoding.UTF8, "application/json")
+            };
+            response.Headers.Add("X-OpenClaw-Version", "2026.07.09");
+            return response;
+        }, requiredVersion: "2026.07.09");
+
+        var info = await client.GetGatewayInfoAsync();
+
+        Assert.True(info.Reachable);
+        Assert.Equal("matched", info.VersionStatus);
+        Assert.True(info.VersionMatches);
+        Assert.Null(info.Warning);
+    }
+
+    [Fact]
+    public async Task GetAgentsAsync_MapsRuntimeStatesFromGatewayStatus()
+    {
+        var staleTimestamp = DateTimeOffset.UtcNow.AddMinutes(-40).ToString("o");
+        var client = CreateClient(request =>
+        {
+            if (request.RequestUri?.AbsolutePath == "/tools/invoke")
+            {
+                using var doc = JsonDocument.Parse(request.Content!.ReadAsStringAsync().GetAwaiter().GetResult());
+                var agentId = doc.RootElement.GetProperty("args").GetProperty("sessionKey").GetString()!
+                    .Split(':', StringSplitOptions.RemoveEmptyEntries)[1];
+
+                object status = agentId switch
+                {
+                    "iris" => new { status = "active", isActive = true, currentTask = "Coordinate launch", model = "openai/gpt-5.5" },
+                    "programmer" => new { status = "idle", lastActivity = staleTimestamp, model = "openai/gpt-5.4" },
+                    "reviewer" => new { status = "failed", error = "gateway timeout", model = "openai/gpt-5.5" },
+                    "architekt" => new { status = "unsupported", message = "tool not available", model = "openai/gpt-5.5" },
+                    _ => new { status = "ready", model = "openai/gpt-5.5" }
+                };
+
+                return ToolResult(status);
+            }
+
+            return new HttpResponseMessage(System.Net.HttpStatusCode.NotFound);
+        }, agentIds: ["iris", "programmer", "reviewer", "architekt"]);
+
+        var agents = await client.GetAgentsAsync();
+
+        Assert.Collection(agents.OrderBy(a => a.Id),
+            architekt =>
+            {
+                Assert.Equal("architekt", architekt.Id);
+                Assert.Equal("unsupported", architekt.StatusKind);
+                Assert.Equal("Unsupported", architekt.StatusLabel);
+                Assert.Equal("tool not available", architekt.StatusDetail);
+            },
+            iris =>
+            {
+                Assert.Equal("iris", iris.Id);
+                Assert.Equal("connected", iris.StatusKind);
+                Assert.Equal("Arbeitet", iris.StatusLabel);
+            },
+            programmer =>
+            {
+                Assert.Equal("programmer", programmer.Id);
+                Assert.Equal("stale", programmer.StatusKind);
+                Assert.Equal("Stale", programmer.StatusLabel);
+                Assert.NotNull(programmer.StatusDetail);
+                Assert.Contains("40m", programmer.StatusDetail!);
+            },
+            reviewer =>
+            {
+                Assert.Equal("reviewer", reviewer.Id);
+                Assert.Equal("error", reviewer.StatusKind);
+                Assert.Equal("Fehler", reviewer.StatusLabel);
+                Assert.Equal("gateway timeout", reviewer.StatusDetail);
+            });
+    }
+
+    [Fact]
+    public async Task AgentConfigService_RejectsNullBytesBeforeReplacingFile()
+    {
+        var agentId = $"phase-p4-{Guid.NewGuid():N}";
+        var workspacePath = Path.Combine("/mnt", $"workspace-{agentId}");
+        Directory.CreateDirectory(workspacePath);
+        var configPath = Path.Combine(workspacePath, "TOOLS.md");
+        await File.WriteAllTextAsync(configPath, "original");
+
+        try
+        {
+            var service = new AgentConfigService();
+            var attempt = await service.SaveConfigFileAsync(agentId, "TOOLS.md", "bad\0content");
+
+            Assert.NotNull(attempt.Failure);
+            Assert.Equal("validation_failed", attempt.Failure!.Code);
+            Assert.Equal("failed", attempt.Failure.Validation.Status);
+            Assert.Contains(attempt.Failure.Validation.Errors, error => error.Contains("null bytes", StringComparison.OrdinalIgnoreCase));
+            Assert.Equal("original", await File.ReadAllTextAsync(configPath));
+        }
+        finally
+        {
+            Directory.Delete(workspacePath, recursive: true);
+        }
+    }
+
+    [Fact]
+    public async Task AgentConfigService_ReturnsBackupAndReloadShape_OnSuccessfulSave()
+    {
+        var agentId = $"phase-p4-{Guid.NewGuid():N}";
+        var workspacePath = Path.Combine("/mnt", $"workspace-{agentId}");
+        Directory.CreateDirectory(workspacePath);
+        var configPath = Path.Combine(workspacePath, "TOOLS.md");
+        await File.WriteAllTextAsync(configPath, "before");
+
+        try
+        {
+            var service = new AgentConfigService();
+            var attempt = await service.SaveConfigFileAsync(agentId, "TOOLS.md", "after");
+
+            Assert.NotNull(attempt.SaveResult);
+            var result = attempt.SaveResult!;
+            Assert.Equal("passed", result.Validation.Status);
+            Assert.Equal("markdown", result.Validation.FileKind);
+            Assert.Equal("created", result.Backup.Status);
+            Assert.True(result.Backup.BackupCreated);
+            Assert.Equal("not_supported", result.ReloadCheck.Status);
+            Assert.False(string.IsNullOrWhiteSpace(result.ReloadCheck.Message));
+            Assert.Equal("before", await File.ReadAllTextAsync(configPath + ".bak"));
+            Assert.Equal("after", await File.ReadAllTextAsync(configPath));
+        }
+        finally
+        {
+            Directory.Delete(workspacePath, recursive: true);
+        }
+    }
+
+    [Fact]
+    public async Task AgentConfigSave_AuditsFailureWithoutLeakingContent()
+    {
+        var configService = new FakeAgentConfigService(new AgentConfigSaveAttempt(
+            null,
+            new AgentConfigSaveFailure(
+                "validation_failed",
+                new AgentConfigValidationResult("failed", "markdown", ["Content contains null bytes."]),
+                new AgentConfigBackupResult("not_applicable", false),
+                new AgentConfigReloadCheckResult("not_supported", "No hot reload available."))));
+        var activityRepo = new CapturingActivityRepository();
+
+        var controller = new AgentsController(
+            new FakeAgentService(),
+            new FakeAgentRuntime(),
+            activityRepo,
+            configService,
+            new FakeDashboardService(),
+            Microsoft.Extensions.Logging.Abstractions.NullLogger<AgentsController>.Instance)
+        {
+            ControllerContext = new ControllerContext
+            {
+                HttpContext = new DefaultHttpContext
+                {
+                    User = new ClaimsPrincipal(new ClaimsIdentity(
+                    [
+                        new Claim(ClaimTypes.NameIdentifier, "bao"),
+                        new Claim(ClaimTypes.Role, "owner")
+                    ], "TestAuth"))
+                }
+            }
+        };
+
+        var result = await controller.SaveConfigFile("programmer", "TOOLS.md", new SaveConfigRequest("secret\0payload"), CancellationToken.None);
+
+        var statusResult = Assert.IsAssignableFrom<IStatusCodeHttpResult>(result);
+        Assert.Equal(StatusCodes.Status400BadRequest, statusResult.StatusCode);
+        var audit = Assert.Single(activityRepo.Added);
+        Assert.Equal("config_audit", audit.Type);
+        Assert.Contains("validation=failed", audit.Message);
+        Assert.DoesNotContain("secret", audit.Message, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("payload", audit.Message, StringComparison.OrdinalIgnoreCase);
+    }
+
+    private static OpenClawGatewayClient CreateClient(
+        Func<HttpRequestMessage, HttpResponseMessage> responder,
+        string? requiredVersion = null,
+        string[]? agentIds = null)
+    {
+        var configValues = new Dictionary<string, string?>
+        {
+            ["Integrations:OpenClaw:RequiredVersion"] = requiredVersion
+        };
+
+        if (agentIds is not null)
+        {
+            var configPath = Path.GetTempFileName();
+            File.WriteAllText(configPath, JsonSerializer.Serialize(new
+            {
+                agents = new
+                {
+                    list = agentIds.Select(id => new { id }).ToArray()
+                }
+            }));
+            configValues["AgentConfigPath"] = configPath;
+        }
+
+        var configuration = new ConfigurationBuilder()
+            .AddInMemoryCollection(configValues)
+            .Build();
+
+        var httpClient = new HttpClient(new StubHttpMessageHandler(responder))
+        {
+            BaseAddress = new Uri("http://gateway.local")
+        };
+
+        return new OpenClawGatewayClient(httpClient, configuration);
+    }
+
+    private static HttpResponseMessage ToolResult(object payload)
+        => new(System.Net.HttpStatusCode.OK)
+        {
+            Content = new StringContent(
+                JsonSerializer.Serialize(new { ok = true, result = payload }),
+                Encoding.UTF8,
+                "application/json")
+        };
+}
+
+file sealed class StubHttpMessageHandler(Func<HttpRequestMessage, HttpResponseMessage> responder) : HttpMessageHandler
+{
+    protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
+        => Task.FromResult(responder(request));
+}
+
+file sealed class FakeAgentConfigService(AgentConfigSaveAttempt attempt) : IAgentConfigService
+{
+    public IReadOnlyList<AgentConfigFileInfo> GetConfigFiles(string agentId) => [];
+
+    public Task<AgentConfigFileContent?> GetConfigFileAsync(string agentId, string fileName, CancellationToken ct = default)
+        => Task.FromResult<AgentConfigFileContent?>(null);
+
+    public Task<AgentConfigSaveAttempt> SaveConfigFileAsync(string agentId, string fileName, string content, CancellationToken ct = default)
+        => Task.FromResult(attempt);
+}
+
+file sealed class CapturingActivityRepository : IActivityRepository
+{
+    public List<ActivityEvent> Added { get; } = [];
+
+    public Task<List<ActivityEvent>> GetRecentAsync(int take, CancellationToken ct = default) => Task.FromResult(new List<ActivityEvent>());
+    public Task<List<ActivityEvent>> GetRecentForTasksAsync(IEnumerable<Guid> taskIds, CancellationToken ct = default) => Task.FromResult(new List<ActivityEvent>());
+    public Task<(List<ActivityEvent> Items, int TotalCount)> GetPagedAsync(string? type, string? sort, int page, int pageSize, CancellationToken ct = default)
+        => Task.FromResult((new List<ActivityEvent>(), 0));
+    public Task<List<ActivityEvent>> GetByAgentAsync(string agentId, int take, CancellationToken ct = default) => Task.FromResult(new List<ActivityEvent>());
+    public Task<ActivityEvent> AddAsync(ActivityEvent activity, CancellationToken ct = default)
+    {
+        Added.Add(activity);
+        return Task.FromResult(activity);
+    }
+}
+
+file sealed class FakeAgentService : IAgentService
+{
+    public Task<IReadOnlyCollection<AgentInfo>> GetAgentsAsync(CancellationToken cancellationToken)
+        => Task.FromResult<IReadOnlyCollection<AgentInfo>>([]);
+
+    public Task<AgentDetail?> GetAgentAsync(string id, CancellationToken cancellationToken)
+        => Task.FromResult<AgentDetail?>(null);
+
+    public Task<IReadOnlySet<string>> GetAllowedAgentIdsAsync(CancellationToken cancellationToken)
+        => Task.FromResult<IReadOnlySet<string>>(new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "iris", "bao", "programmer" });
+}
+
+file sealed class FakeAgentRuntime : Nexus.Api.Integrations.IAgentRuntime
+{
+    public string Name => "fake";
+
+    public Task<Nexus.Api.Integrations.AgentRuntimeStatus> GetStatusAsync(CancellationToken cancellationToken)
+        => Task.FromResult(new Nexus.Api.Integrations.AgentRuntimeStatus("fake", OperationalStatus.Online, TimeSpan.Zero, null));
+
+    public Task<Nexus.Api.Integrations.AgentChatResult> ChatAsync(string message, string conversationId, string agentId, CancellationToken cancellationToken)
+        => Task.FromResult(new Nexus.Api.Integrations.AgentChatResult("fake", agentId, conversationId, "ok"));
+}
+
+file sealed class FakeDashboardService : IDashboardService
+{
+    public Task<DashboardStatus> GetStatusAsync() => Task.FromResult(new DashboardStatus(true, "online", 1, 0));
+    public Task<List<DashboardAgentInfo>> GetAgentsAsync() => Task.FromResult(new List<DashboardAgentInfo>());
+    public Task<List<FeedEntry>> GetOperationsAsync(int limit, string? agentFilter) => Task.FromResult(new List<FeedEntry>());
+    public Task<ChatResponse> SendChatAsync(string agentId, string message) => Task.FromResult(new ChatResponse(true, "", null));
+    public Task<List<MessageEntry>> GetMessagesAsync(string? sessionKey, int limit, int offset) => Task.FromResult(new List<MessageEntry>());
+    public Task<List<QueueItem>> GetQueueAsync(CancellationToken ct) => Task.FromResult(new List<QueueItem>());
+    public Task<GatewayRuntimeInfo> GetGatewayInfoAsync(CancellationToken ct) => Task.FromResult(new GatewayRuntimeInfo(true, "http://gateway", "test", "test", true, true, "matched", DateTimeOffset.UtcNow, "ok"));
+    public Task<QueueDeleteResult> DeleteQueueItemAsync(string id, string? source, CancellationToken ct) => Task.FromResult(new QueueDeleteResult(QueueDeleteOutcome.Ignored));
+    public Task<QueuePriorityResult> CycleQueuePriorityAsync(string id, CancellationToken ct) => Task.FromResult(new QueuePriorityResult(QueuePriorityOutcome.Ignored));
+    public Task<AgentModelInfo?> GetAgentModelAsync(string agentId) => Task.FromResult<AgentModelInfo?>(null);
+    public Task<bool> SetAgentModelAsync(string agentId, string model) => Task.FromResult(false);
+    public Task<List<AgentActivityEntry>> GetAgentActivityAsync(string agentId, int limit) => Task.FromResult(new List<AgentActivityEntry>());
+    public List<ModelOption> GetAvailableModels() => [];
+}