#!/usr/bin/env node "use strict"; const assert = require("node:assert"); const { chromium } = require("playwright"); const { BASE_URL, UI_TIMEOUT_MS, cleanupDocuments, createTempDocument, ensureAuthenticated, openDocument, renameDocument, requestJson, } = require("./tree-shell-smoke-helpers"); async function assertPageAiPermissionFailureUi(page, target, suffix) { const sessionId = `mnote_smoke_permission_${suffix}`; const runId = `run_smoke_permission_${suffix}`; const sessionRoute = "**/api/hermes/client/sessions"; const sessionDetailRoute = `**/api/hermes/client/sessions/${sessionId}`; const runsRoute = "**/api/hermes/client/runs"; const eventsRoute = `**/api/hermes/client/events/${runId}`; await page.route(sessionRoute, async (route) => { await route.fulfill({ status: 200, headers: { "content-type": "application/json" }, body: JSON.stringify({ ok: true, sessionId, title: "权限失败 UI 验证", traceId: `trace_permission_${suffix}`, }), }); }); await page.route(sessionDetailRoute, async (route) => { await route.fulfill({ status: 200, headers: { "content-type": "application/json" }, body: JSON.stringify({ ok: true, sessionId, session: { sessionId, messages: [] }, }), }); }); await page.route(runsRoute, async (route) => { await route.fulfill({ status: 200, headers: { "content-type": "application/json" }, body: JSON.stringify({ ok: true, upstream: { run_id: runId, status: "started" }, traceId: `trace_permission_${suffix}`, }), }); }); await page.route(eventsRoute, async (route) => { await route.fulfill({ status: 200, headers: { "content-type": "text/event-stream; charset=utf-8" }, body: `data: ${JSON.stringify({ event: "tool.started", run_id: runId, session_id: sessionId, tool: "mnote.page.save" })}\n\n` + `data: ${JSON.stringify({ event: "tool.failed", run_id: runId, session_id: sessionId, tool: "mnote.page.save", error: { code: "permission_denied" } })}\n\n` + `data: ${JSON.stringify({ event: "run.completed", run_id: runId, session_id: sessionId, output: "permission_denied" })}\n\n`, }); }); try { await openDocument(page, target.workspaceId, target.documentId); await page.getByTestId("wolai-floating-ai").click({ timeout: UI_TIMEOUT_MS }); await page.locator("[data-page-ai-input]").fill("权限失败 UI 验证", { timeout: UI_TIMEOUT_MS }); await page.locator('[data-page-ai-action="send"]').click({ timeout: UI_TIMEOUT_MS }); await page.waitForFunction( () => { const text = document.querySelector('[data-testid="wolai-page-ai-drawer"]')?.textContent || ""; return text.includes("mnote.page.save") && text.includes("permission_denied"); }, null, { timeout: UI_TIMEOUT_MS }, ); } finally { await page.unroute(sessionRoute).catch(() => undefined); await page.unroute(sessionDetailRoute).catch(() => undefined); await page.unroute(runsRoute).catch(() => undefined); await page.unroute(eventsRoute).catch(() => undefined); } } async function main() { const suffix = Date.now().toString(36); const title = `TEST-HERMES-AI-write-${suffix}`; const marker = `TEST-HERMES-AI-WRITEBACK-${suffix}`; const createdIds = []; const browser = await chromium.launch({ headless: true }); const context = await browser.newContext({ viewport: { width: 1280, height: 900 } }); const page = await context.newPage(); try { await ensureAuthenticated(page, context.request); const target = await createTempDocument(context.request); createdIds.push(target.documentId); await renameDocument(context.request, target.workspaceId, target.documentId, title); const baseTool = { toolName: "mnote.page.save", workspaceId: target.workspaceId, documentId: target.documentId, actorId: "smoke-user", sessionId: `mnote_smoke_write_${suffix}`, runId: `run_smoke_write_${suffix}`, toolCallId: `call_smoke_write_${suffix}`, traceId: `trace_smoke_write_${suffix}`, idempotencyKey: `idem_smoke_write_${suffix}`, capabilityScope: ["page.write"], args: { mode: "replace", content: [ { id: `block_${suffix}`, type: "paragraph", content: [{ type: "text", text: marker }], }, ], }, }; const deniedResponse = await context.request.fetch(`${BASE_URL}/api/hermes/tools/mnote/call`, { method: "POST", headers: { "content-type": "application/json", "x-mnote-actor-id": "smoke-user", "x-mnote-workspace-id": "ws_denied", }, data: JSON.stringify({ ...baseTool, traceId: `trace_smoke_write_denied_${suffix}`, toolCallId: `call_smoke_write_denied_${suffix}`, idempotencyKey: `idem_smoke_write_denied_${suffix}`, }), }); const deniedText = await deniedResponse.text(); assert.equal(deniedResponse.status(), 403, "workspace 上下文冲突应返回 403"); assert(deniedText.includes("workspace_context_conflict"), "权限失败应返回稳定 workspace_context_conflict"); assert(!deniedText.includes(title), "权限失败响应不应泄露页面标题"); assert(!deniedText.includes(marker), "权限失败响应不应泄露正文内容"); await assertPageAiPermissionFailureUi(page, target, suffix); const dryRun = await requestJson(context.request, "/api/hermes/tools/mnote/call", { method: "POST", headers: { "x-mnote-actor-id": "smoke-user" }, data: { ...baseTool, dryRun: true, idempotencyKey: `idem_smoke_write_dry_${suffix}` }, }); assert.equal(dryRun.result.dryRun, true, "dryRun 不应写入"); const dryRunContent = await requestJson( context.request, `/api/documents/content?documentId=${encodeURIComponent(target.documentId)}&workspaceId=${encodeURIComponent(target.workspaceId)}`, { method: "GET" }, ); assert(!JSON.stringify(dryRunContent).includes(marker), "dryRun 后不应读到 AI 写入标记"); await openDocument(page, target.workspaceId, target.documentId); await page .locator('[data-testid="mnote-leptos-tiptap-island-editor-root"]') .waitFor({ state: "attached", timeout: UI_TIMEOUT_MS }) .catch(() => undefined); const write = await requestJson(context.request, "/api/hermes/tools/mnote/call", { method: "POST", headers: { "x-mnote-actor-id": "smoke-user" }, data: { ...baseTool, dryRun: false }, }); assert.equal(write.ok, true, "写入 tool call 应成功"); assert.equal(write.audit.effect, "write", "写入 audit effect 应为 write"); assert.equal(write.result.commandName, "page.body.save", "写入必须走 page.body.save"); assert(write.result.commandId, "写入结果必须包含 Rust commandId"); assert.equal(write.audit.commandId, write.result.commandId, "audit commandId 必须指向 Rust commandId"); await page.waitForFunction((expected) => (document.body.textContent || "").includes(expected), marker, { timeout: UI_TIMEOUT_MS, }); const retry = await requestJson(context.request, "/api/hermes/tools/mnote/call", { method: "POST", headers: { "x-mnote-actor-id": "smoke-user" }, data: { ...baseTool, dryRun: false }, }); assert.equal(retry.ok, true, "幂等重试 tool call 应成功"); assert.equal(retry.result.commandId, write.result.commandId, "同一 idempotencyKey 重试必须返回同一个 commandId"); assert.equal(retry.audit.commandId, write.audit.commandId, "同一 idempotencyKey 重试必须返回同一个 audit commandId"); const content = await requestJson( context.request, `/api/documents/content?documentId=${encodeURIComponent(target.documentId)}&workspaceId=${encodeURIComponent(target.workspaceId)}`, { method: "GET" }, ); assert(JSON.stringify(content).includes(marker), "刷新读取内容后未找到 AI 写入标记"); console.log( JSON.stringify( { ok: true, baseUrl: BASE_URL, documentId: target.documentId, workspaceId: target.workspaceId, marker, commandName: write.result.commandName, audit: write.audit, }, null, 2, ), ); } finally { await cleanupDocuments(context.request, createdIds).catch(() => undefined); await context.close().catch(() => undefined); await browser.close().catch(() => undefined); } } main().catch((error) => { console.error(error instanceof Error ? error.stack || error.message : String(error)); process.exit(1); });