Kevin Veen-BirkenbachandClaude Opus 5.5
3843821674
- Move the council config to ~/.claude/agents-council/config.json, which the sandbox cannot write; the installer adds Edit(~/.claude/agents-council/**) to permissions.deny. - Run every kvb hook as /usr/bin/python3 -I and rewrite old bare python3 entries. - Refuse a council root that is a symlink, another uid's, or group or other writable, in watch, queue and radio. - Run worktree_cleanup entries as argv without a shell in /, only for compose project names. - queue block: tokenize every Bash command like bash (quotes, word-start comments, line continuations), and hold each held command to the Bash deny and ask rules of the managed, user and project settings; refuse a hold it cannot parse. - radio: deliver fields on one line of at most 1000 characters, at most 10 rows. Operator step after install: move ~/.config/agents-council/config.json to ~/.claude/agents-council/config.json. MEDUSA acceptances (kvb-think-criticize 2026-11-06, skeptics A and B): ACP-SCAN-028 load_config (config outside the sandbox, Docker residual 093); CODEGEN-SCAN-004 and LLM06 run_cleanup and worktrees_command shell strings (operator config only); SAST-PATH-001 queue hold Popen (the caller's own command in its sandbox); PA-133 radio hook context (peer rows, clipped); JB-SCAN-641/616/2979 clip and MM-SCAN-058 replace (name matches). 🎯 Fix: 90 % 💥 Break: 5 % 💸 Cost: 100 % ⏱️ Time: 100 % 🛡️ Security: 100 % 💰 Value: ? 🏆 Score: 86 🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 % Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
262 lines
12 KiB
Python
262 lines
12 KiB
Python
"""Exercise the kvb-org-organize resource watch: stages, projection, block, admit, alerts, caches."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import importlib.util
|
|
import json
|
|
import os
|
|
import subprocess
|
|
import sys
|
|
import tempfile
|
|
import time
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
REPO_ROOT = Path(__file__).resolve().parents[1]
|
|
WATCH = REPO_ROOT / "skills" / "kvb-org-organize" / "scripts" / "watch.py"
|
|
LIMITS = {"warn": 40, "stop": 15, "critical": 12}
|
|
|
|
|
|
def _load():
|
|
spec = importlib.util.spec_from_file_location("watch", WATCH)
|
|
module = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(module)
|
|
return module
|
|
|
|
|
|
class TestStage(unittest.TestCase):
|
|
def setUp(self):
|
|
self.watch = _load()
|
|
self.cfg = {"thresholds_gb": LIMITS, "projection_minutes": 30}
|
|
|
|
def test_thresholds(self):
|
|
now = time.time()
|
|
for free, stage in ((50, "ok"), (30, "warn"), (14, "stop"), (5, "critical")):
|
|
self.assertEqual(self.watch.stage_for(free, [], self.cfg, now), stage)
|
|
|
|
def test_cpu_and_ram_percentages(self):
|
|
self.assertEqual(self.watch.cpu_busy_percent((100, 40), (200, 60)), 80.0)
|
|
meminfo = "MemTotal: 1000 kB\nMemFree: 100 kB\nMemAvailable: 250 kB\n"
|
|
self.assertEqual(self.watch.mem_used_percent(meminfo), 75.0)
|
|
|
|
def test_fast_fall_escalates_one_stage(self):
|
|
now = time.time()
|
|
self.assertEqual(self.watch.stage_for(32, [[now - 600, 48]], self.cfg, now), "stop")
|
|
self.assertEqual(self.watch.stage_for(32, [[now - 600, 32.1]], self.cfg, now), "warn")
|
|
|
|
|
|
class TestWatchCommands(unittest.TestCase):
|
|
def setUp(self):
|
|
self.tmp = tempfile.TemporaryDirectory()
|
|
self.addCleanup(self.tmp.cleanup)
|
|
self.base = Path(self.tmp.name)
|
|
self.root = self.base / "council"
|
|
self.config = self.base / "config.json"
|
|
self.cache = self.base / "cache"
|
|
self.cache.mkdir()
|
|
self.cfg = {
|
|
"disk": str(self.base),
|
|
"thresholds_gb": LIMITS,
|
|
"projection_minutes": 30,
|
|
"interval_seconds": 0,
|
|
"cache_interval_seconds": 86400,
|
|
"heavy_commands": ["^make compose-deploy", "^make swarm-"],
|
|
"never_block": ["^make swarm-down"],
|
|
"cleanup": [],
|
|
"worktree_cleanup": [],
|
|
"worktrees_command": "true",
|
|
"worktree_marker": "Makefile",
|
|
"busy_processes": ["sleep"],
|
|
"cache_dirs": [str(self.cache)],
|
|
"cache_budget_percent": 3,
|
|
"slot_need_gb": {"swarm": 30, "test": 0.001},
|
|
"notify": ["true"],
|
|
"load_limits": {"cpu_percent": 101, "mem_percent": 101, "sample_seconds": 0.1, "kinds": ["test"]},
|
|
}
|
|
self._write_config()
|
|
|
|
def _write_config(self):
|
|
self.config.write_text(json.dumps(self.cfg), encoding="utf-8")
|
|
|
|
def _run(self, *args: str, stdin: str = "") -> subprocess.CompletedProcess:
|
|
env = {
|
|
"PATH": str(self.base),
|
|
"HOME": str(self.base),
|
|
"AGENTS_COUNCIL_ROOT": str(self.root),
|
|
"AGENTS_COUNCIL_CONFIG": str(self.config),
|
|
}
|
|
return subprocess.run(
|
|
[sys.executable, str(WATCH), *args],
|
|
capture_output=True, text=True, env=env, input=stdin, check=False,
|
|
)
|
|
|
|
def _stage(self, stage: str) -> None:
|
|
self.root.mkdir(exist_ok=True)
|
|
(self.root / "watch.json").write_text(json.dumps({"stage": stage}), encoding="utf-8")
|
|
|
|
def _bash(self, command: str) -> str:
|
|
return json.dumps({"tool_input": {"command": command}})
|
|
|
|
def test_block_only_heavy_jobs_at_stop_and_never_teardown(self):
|
|
self._stage("stop")
|
|
self.assertEqual(self._run("block", stdin=self._bash("make compose-deploy apps=x")).returncode, 2)
|
|
self.assertEqual(self._run("block", stdin=self._bash("make swarm-down")).returncode, 0)
|
|
self.assertEqual(self._run("block", stdin=self._bash("ls")).returncode, 0)
|
|
self._stage("warn")
|
|
self.assertEqual(self._run("block", stdin=self._bash("make compose-deploy")).returncode, 0)
|
|
|
|
def test_block_heavy_jobs_while_a_mayday_holds_radio_silence(self):
|
|
self._stage("ok")
|
|
self.root.mkdir(exist_ok=True)
|
|
silence = self.root / "radio-silence.json"
|
|
now = time.time()
|
|
silence.write_text(json.dumps({"since": now, "until": now + 60, "by": "One", "text": "fire"}), encoding="utf-8")
|
|
blocked = self._run("block", stdin=self._bash("make compose-deploy"))
|
|
self.assertEqual(blocked.returncode, 2)
|
|
self.assertIn("mayday by One", blocked.stderr)
|
|
self.assertEqual(self._run("block", stdin=self._bash("make swarm-down")).returncode, 0)
|
|
silence.write_text(json.dumps({"since": now - 120, "until": now - 60, "by": "One", "text": "fire"}), encoding="utf-8")
|
|
self.assertEqual(self._run("block", stdin=self._bash("make compose-deploy")).returncode, 0)
|
|
|
|
def test_block_ignores_heavy_words_inside_quotes_and_heredocs(self):
|
|
self.cfg["heavy_commands"] = [r"\bmake\s+(-C\s+\S+\s+)?(compose-deploy|test|swarm-\S+)(\s|$)"]
|
|
self._write_config()
|
|
self._stage("stop")
|
|
message = "$(cat <<'EOF'\nfix: run \"make test\" and make swarm-zombie\nEOF\n)"
|
|
for command in (
|
|
'git commit --no-verify -m "fix: passes the vars to make swarm-zombie app=x"',
|
|
"grep -n 'make test' Makefile",
|
|
f'git commit --no-verify -m "{message}"',
|
|
):
|
|
self.assertEqual(self._run("block", stdin=self._bash(command)).returncode, 0, command)
|
|
for command in (
|
|
"make -C x swarm-zombie app=y",
|
|
"env FOO=1 make swarm-zombie",
|
|
'make compose-deploy apps="web-app-x"',
|
|
):
|
|
self.assertEqual(self._run("block", stdin=self._bash(command)).returncode, 2, command)
|
|
|
|
def test_admit_keeps_the_stop_floor(self):
|
|
self.cfg["thresholds_gb"] = {"warn": 0, "stop": 0, "critical": 0}
|
|
self._write_config()
|
|
self.assertEqual(self._run("admit", "--need-gb", "0.001").returncode, 0)
|
|
self.assertEqual(self._run("admit", "--need-gb", "1e9").returncode, 3)
|
|
|
|
def test_admit_for_a_load_kind_also_needs_cpu_and_ram_below_the_limits(self):
|
|
self.cfg["thresholds_gb"] = {"warn": 0, "stop": 0, "critical": 0}
|
|
self._write_config()
|
|
self.assertEqual(self._run("admit", "--kind", "test").returncode, 0)
|
|
self.cfg["load_limits"]["cpu_percent"] = 0
|
|
self._write_config()
|
|
denied = self._run("admit", "--kind", "test")
|
|
self.assertEqual(denied.returncode, 3)
|
|
self.assertIn("cpu", denied.stdout)
|
|
self.assertEqual(self._run("admit", "--need-gb", "0.001").returncode, 0)
|
|
|
|
def test_warn_alert_reaches_each_session_once(self):
|
|
self.cfg["thresholds_gb"] = {"warn": 1e9, "stop": -1, "critical": -2}
|
|
self._write_config()
|
|
|
|
def hook(session: str) -> str:
|
|
payload = {"session_id": session, "hook_event_name": "UserPromptSubmit"}
|
|
return self._run("watch", stdin=json.dumps(payload)).stdout
|
|
|
|
self.assertIn("RESOURCE WARN", hook("s1"))
|
|
self.assertEqual(hook("s1"), "")
|
|
self.assertIn("RESOURCE WARN", hook("s2"))
|
|
|
|
def test_watch_keeps_each_new_queue_history_row_once(self):
|
|
self.cfg["thresholds_gb"] = {"warn": 0, "stop": 0, "critical": 0}
|
|
self._write_config()
|
|
self.root.mkdir()
|
|
source = self.root / "queue-history.jsonl"
|
|
kept = self.base / ".local" / "state" / "agents-council" / "queue-history.jsonl"
|
|
kept.parent.mkdir(parents=True)
|
|
kept.write_text('{"id": "old"}\n', encoding="utf-8")
|
|
source.write_text('{"id": "old"}\n{"id": "a"}\n{broken\n', encoding="utf-8")
|
|
payload = json.dumps({"session_id": "s1", "hook_event_name": "PostToolUse"})
|
|
|
|
def kept_ids() -> list[str]:
|
|
self.assertEqual(self._run("watch", stdin=payload).returncode, 0)
|
|
return [json.loads(line)["id"] for line in kept.read_text(encoding="utf-8").splitlines()]
|
|
|
|
self.assertEqual(kept_ids(), ["old", "a"])
|
|
self.assertEqual(kept_ids(), ["old", "a"])
|
|
with source.open("a", encoding="utf-8") as handle:
|
|
handle.write('{"id": "b"}\n')
|
|
self.assertEqual(kept_ids(), ["old", "a", "b"])
|
|
|
|
def test_cache_trim_evicts_least_recently_used_first(self):
|
|
old, new = self.cache / "old", self.cache / "new"
|
|
old.write_bytes(b"x" * 4096)
|
|
new.write_bytes(b"y" * 4096)
|
|
os.utime(old, (1_000_000, 1_000_000))
|
|
os.utime(new, (2_000_000, 2_000_000))
|
|
st = os.statvfs(self.base)
|
|
self.cfg["cache_budget_percent"] = (4096 + 100) / (st.f_blocks * st.f_frsize) * 100
|
|
self._write_config()
|
|
self.assertEqual(self._run("cleanup", "--caches").returncode, 0)
|
|
self.assertFalse(old.exists())
|
|
self.assertTrue(new.exists())
|
|
|
|
def _mark_cleaned(self) -> list[str]:
|
|
return [sys.executable, "-c", "import sys; open(sys.argv[1], 'a').write('x')", str(self.base / "cleaned-{project}")]
|
|
|
|
def test_full_cleanup_reaches_only_marked_running_worktrees_with_a_compose_project(self):
|
|
marked, foreign, odd = self.base / "marked", self.base / "foreign", self.base / "odd"
|
|
for tree in (marked, foreign, odd):
|
|
tree.mkdir()
|
|
for tree in (marked, odd):
|
|
(tree / "Makefile").write_text("", encoding="utf-8")
|
|
self.cfg["worktrees_command"] = (
|
|
f"printf '%s\\t%s\\n' {marked} stack-a {foreign} stack-b {marked} stack-a {odd} 'x;touch y' {odd}"
|
|
)
|
|
self.cfg["worktree_cleanup"] = [self._mark_cleaned()]
|
|
self._write_config()
|
|
self.assertEqual(self._run("cleanup", "--full").returncode, 0)
|
|
self.assertEqual(sorted(p.name for p in self.base.glob("cleaned-*")), ["cleaned-stack-a"])
|
|
self.assertEqual((self.base / "cleaned-stack-a").read_text(encoding="utf-8"), "x")
|
|
|
|
def test_full_cleanup_skips_a_worktree_where_a_busy_process_runs(self):
|
|
idle, gated = self.base / "idle", self.base / "gated"
|
|
for tree in (idle, gated):
|
|
(tree / "sub").mkdir(parents=True)
|
|
(tree / "Makefile").write_text("", encoding="utf-8")
|
|
gate = subprocess.Popen(["sleep", "60"], cwd=gated / "sub")
|
|
self.addCleanup(gate.wait)
|
|
self.addCleanup(gate.kill)
|
|
self.cfg["worktrees_command"] = f"printf '%s\\t%s\\n' {idle} idle {gated} gated"
|
|
self.cfg["worktree_cleanup"] = [self._mark_cleaned()]
|
|
self._write_config()
|
|
self.assertEqual(self._run("cleanup", "--full").returncode, 0)
|
|
self.assertTrue((self.base / "cleaned-idle").exists())
|
|
self.assertFalse((self.base / "cleaned-gated").exists())
|
|
|
|
def test_a_group_writable_council_root_stops_commands_and_silences_hooks(self):
|
|
self.root.mkdir()
|
|
self.root.chmod(0o777)
|
|
result = self._run("status")
|
|
self.assertEqual(result.returncode, 2)
|
|
self.assertIn("cannot write", result.stderr)
|
|
for hook in ("watch", "block"):
|
|
with self.subTest(hook=hook):
|
|
quiet = self._run(hook, stdin=self._bash("make compose-deploy"))
|
|
self.assertEqual(quiet.returncode, 0)
|
|
self.assertIn("council hooks stay off", quiet.stdout)
|
|
self.assertFalse((self.root / "watch.json").exists())
|
|
|
|
def test_a_symlinked_council_root_stops_every_command(self):
|
|
target = self.base / "elsewhere"
|
|
target.mkdir()
|
|
self.root.symlink_to(target)
|
|
self.assertEqual(self._run("status").returncode, 2)
|
|
|
|
def test_without_config_every_command_is_a_no_op(self):
|
|
self.config.unlink()
|
|
result = self._run("status")
|
|
self.assertEqual((result.returncode, result.stdout), (0, ""))
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|