2026-03-22 07:39:50 -07:00
|
|
|
from __future__ import annotations
|
|
|
|
|
|
|
|
|
|
import json
|
|
|
|
|
|
|
|
|
|
import pytest
|
|
|
|
|
from langchain_core.messages import HumanMessage, SystemMessage
|
|
|
|
|
|
|
|
|
|
from deerflow.models.claude_provider import ClaudeChatModel
|
|
|
|
|
from deerflow.models.credential_loader import CodexCliCredential
|
|
|
|
|
from deerflow.models.openai_codex_provider import CodexChatModel
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_codex_provider_rejects_non_positive_retry_attempts():
|
|
|
|
|
with pytest.raises(ValueError, match="retry_max_attempts must be >= 1"):
|
|
|
|
|
CodexChatModel(retry_max_attempts=0)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_codex_provider_requires_credentials(monkeypatch):
|
|
|
|
|
monkeypatch.setattr(CodexChatModel, "_load_codex_auth", lambda self: None)
|
|
|
|
|
|
|
|
|
|
with pytest.raises(ValueError, match="Codex CLI credential not found"):
|
|
|
|
|
CodexChatModel()
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_codex_provider_concatenates_multiple_system_messages(monkeypatch):
|
|
|
|
|
monkeypatch.setattr(
|
|
|
|
|
CodexChatModel,
|
|
|
|
|
"_load_codex_auth",
|
|
|
|
|
lambda self: CodexCliCredential(access_token="token", account_id="acct"),
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
model = CodexChatModel()
|
|
|
|
|
instructions, input_items = model._convert_messages(
|
|
|
|
|
[
|
|
|
|
|
SystemMessage(content="First system prompt."),
|
|
|
|
|
SystemMessage(content="Second system prompt."),
|
|
|
|
|
HumanMessage(content="Hello"),
|
|
|
|
|
]
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
assert instructions == "First system prompt.\n\nSecond system prompt."
|
|
|
|
|
assert input_items == [{"role": "user", "content": "Hello"}]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_codex_provider_flattens_structured_text_blocks(monkeypatch):
|
|
|
|
|
monkeypatch.setattr(
|
|
|
|
|
CodexChatModel,
|
|
|
|
|
"_load_codex_auth",
|
|
|
|
|
lambda self: CodexCliCredential(access_token="token", account_id="acct"),
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
model = CodexChatModel()
|
|
|
|
|
instructions, input_items = model._convert_messages(
|
|
|
|
|
[
|
|
|
|
|
HumanMessage(content=[{"type": "text", "text": "Hello from blocks"}]),
|
|
|
|
|
]
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
assert instructions == "You are a helpful assistant."
|
|
|
|
|
assert input_items == [{"role": "user", "content": "Hello from blocks"}]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_claude_provider_rejects_non_positive_retry_attempts():
|
|
|
|
|
with pytest.raises(ValueError, match="retry_max_attempts must be >= 1"):
|
|
|
|
|
ClaudeChatModel(model="claude-sonnet-4-6", retry_max_attempts=0)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_codex_provider_skips_terminal_sse_markers(monkeypatch):
|
|
|
|
|
monkeypatch.setattr(
|
|
|
|
|
CodexChatModel,
|
|
|
|
|
"_load_codex_auth",
|
|
|
|
|
lambda self: CodexCliCredential(access_token="token", account_id="acct"),
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
model = CodexChatModel()
|
|
|
|
|
|
|
|
|
|
assert model._parse_sse_data_line("data: [DONE]") is None
|
|
|
|
|
assert model._parse_sse_data_line("event: response.completed") is None
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_codex_provider_skips_non_json_sse_frames(monkeypatch):
|
|
|
|
|
monkeypatch.setattr(
|
|
|
|
|
CodexChatModel,
|
|
|
|
|
"_load_codex_auth",
|
|
|
|
|
lambda self: CodexCliCredential(access_token="token", account_id="acct"),
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
model = CodexChatModel()
|
|
|
|
|
|
|
|
|
|
assert model._parse_sse_data_line("data: not-json") is None
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_codex_provider_marks_invalid_tool_call_arguments(monkeypatch):
|
|
|
|
|
monkeypatch.setattr(
|
|
|
|
|
CodexChatModel,
|
|
|
|
|
"_load_codex_auth",
|
|
|
|
|
lambda self: CodexCliCredential(access_token="token", account_id="acct"),
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
model = CodexChatModel()
|
|
|
|
|
result = model._parse_response(
|
|
|
|
|
{
|
|
|
|
|
"model": "gpt-5.4",
|
|
|
|
|
"output": [
|
|
|
|
|
{
|
|
|
|
|
"type": "function_call",
|
|
|
|
|
"name": "bash",
|
|
|
|
|
"arguments": "{invalid",
|
|
|
|
|
"call_id": "tc-1",
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"usage": {},
|
|
|
|
|
}
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
message = result.generations[0].message
|
|
|
|
|
assert message.tool_calls == []
|
|
|
|
|
assert len(message.invalid_tool_calls) == 1
|
|
|
|
|
assert message.invalid_tool_calls[0]["type"] == "invalid_tool_call"
|
|
|
|
|
assert message.invalid_tool_calls[0]["name"] == "bash"
|
|
|
|
|
assert message.invalid_tool_calls[0]["args"] == "{invalid"
|
|
|
|
|
assert message.invalid_tool_calls[0]["id"] == "tc-1"
|
|
|
|
|
assert "Failed to parse tool arguments" in message.invalid_tool_calls[0]["error"]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_codex_provider_parses_valid_tool_arguments(monkeypatch):
|
|
|
|
|
monkeypatch.setattr(
|
|
|
|
|
CodexChatModel,
|
|
|
|
|
"_load_codex_auth",
|
|
|
|
|
lambda self: CodexCliCredential(access_token="token", account_id="acct"),
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
model = CodexChatModel()
|
|
|
|
|
result = model._parse_response(
|
|
|
|
|
{
|
|
|
|
|
"model": "gpt-5.4",
|
|
|
|
|
"output": [
|
|
|
|
|
{
|
|
|
|
|
"type": "function_call",
|
|
|
|
|
"name": "bash",
|
|
|
|
|
"arguments": json.dumps({"cmd": "pwd"}),
|
|
|
|
|
"call_id": "tc-1",
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"usage": {},
|
|
|
|
|
}
|
|
|
|
|
)
|
|
|
|
|
|
feat(harness): integration ACP agent tool (#1344)
* refactor: extract shared utils to break harness→app cross-layer imports
Move _validate_skill_frontmatter to src/skills/validation.py and
CONVERTIBLE_EXTENSIONS + convert_file_to_markdown to src/utils/file_conversion.py.
This eliminates the two reverse dependencies from client.py (harness layer)
into gateway/routers/ (app layer), preparing for the harness/app package split.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: split backend/src into harness (deerflow.*) and app (app.*)
Physically split the monolithic backend/src/ package into two layers:
- **Harness** (`packages/harness/deerflow/`): publishable agent framework
package with import prefix `deerflow.*`. Contains agents, sandbox, tools,
models, MCP, skills, config, and all core infrastructure.
- **App** (`app/`): unpublished application code with import prefix `app.*`.
Contains gateway (FastAPI REST API) and channels (IM integrations).
Key changes:
- Move 13 harness modules to packages/harness/deerflow/ via git mv
- Move gateway + channels to app/ via git mv
- Rename all imports: src.* → deerflow.* (harness) / app.* (app layer)
- Set up uv workspace with deerflow-harness as workspace member
- Update langgraph.json, config.example.yaml, all scripts, Docker files
- Add build-system (hatchling) to harness pyproject.toml
- Add PYTHONPATH=. to gateway startup commands for app.* resolution
- Update ruff.toml with known-first-party for import sorting
- Update all documentation to reflect new directory structure
Boundary rule enforced: harness code never imports from app.
All 429 tests pass. Lint clean.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: add harness→app boundary check test and update docs
Add test_harness_boundary.py that scans all Python files in
packages/harness/deerflow/ and fails if any `from app.*` or
`import app.*` statement is found. This enforces the architectural
rule that the harness layer never depends on the app layer.
Update CLAUDE.md to document the harness/app split architecture,
import conventions, and the boundary enforcement test.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add config versioning with auto-upgrade on startup
When config.example.yaml schema changes, developers' local config.yaml
files can silently become outdated. This adds a config_version field and
auto-upgrade mechanism so breaking changes (like src.* → deerflow.*
renames) are applied automatically before services start.
- Add config_version: 1 to config.example.yaml
- Add startup version check warning in AppConfig.from_file()
- Add scripts/config-upgrade.sh with migration registry for value replacements
- Add `make config-upgrade` target
- Auto-run config-upgrade in serve.sh and start-daemon.sh before starting services
- Add config error hints in service failure messages
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix comments
* fix: update src.* import in test_sandbox_tools_security to deerflow.*
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: handle empty config and search parent dirs for config.example.yaml
Address Copilot review comments on PR #1131:
- Guard against yaml.safe_load() returning None for empty config files
- Search parent directories for config.example.yaml instead of only
looking next to config.yaml, fixing detection in common setups
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: correct skills root path depth and config_version type coercion
- loader.py: fix get_skills_root_path() to use 5 parent levels (was 3)
after harness split, file lives at packages/harness/deerflow/skills/
so parent×3 resolved to backend/packages/harness/ instead of backend/
- app_config.py: coerce config_version to int() before comparison in
_check_config_version() to prevent TypeError when YAML stores value
as string (e.g. config_version: "1")
- tests: add regression tests for both fixes
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: update test imports from src.* to deerflow.*/app.* after harness refactor
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(harness): add tool-first ACP agent invocation (#37)
* feat(harness): add tool-first ACP agent invocation
* build(harness): make ACP dependency required
* fix(harness): address ACP review feedback
* feat(harness): decouple ACP agent workspace from thread data
ACP agents (codex, claude-code) previously used per-thread workspace
directories, causing path resolution complexity and coupling task
execution to DeerFlow's internal thread data layout. This change:
- Replace _resolve_cwd() with a fixed _get_work_dir() that always uses
{base_dir}/acp-workspace/, eliminating virtual path translation and
thread_id lookups
- Introduce /mnt/acp-workspace virtual path for lead agent read-only
access to ACP agent output files (same pattern as /mnt/skills)
- Add security guards: read-only validation, path traversal prevention,
command path allowlisting, and output masking for acp-workspace
- Update system prompt and tool description to guide LLM: send
self-contained tasks to ACP agents, copy results via /mnt/acp-workspace
- Add 11 new security tests for ACP workspace path handling
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor(prompt): inject ACP section only when ACP agents are configured
The ACP agent guidance in the system prompt is now conditionally built
by _build_acp_section(), which checks get_acp_agents() and returns an
empty string when no ACP agents are configured. This avoids polluting
the prompt with irrelevant instructions for users who don't use ACP.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix lint
* fix(harness): address Copilot review comments on sandbox path handling and ACP tool
- local_sandbox: fix path-segment boundary bug in _resolve_path (== or startswith +"/")
and add lookahead in _resolve_paths_in_command regex to prevent /mnt/skills matching
inside /mnt/skills-extra
- local_sandbox_provider: replace print() with logger.warning(..., exc_info=True)
- invoke_acp_agent_tool: guard getattr(option, "optionId") with None default + continue;
move full prompt from INFO to DEBUG level (truncated to 200 chars)
- sandbox/tools: fix _get_acp_workspace_host_path docstring to match implementation;
remove misleading "read-only" language from validate_local_bash_command_paths
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(acp): thread-isolated workspaces, permission guardrail, and ContextVar registry
P1.1 – ACP workspace thread isolation
- Add `Paths.acp_workspace_dir(thread_id)` for per-thread paths
- `_get_work_dir(thread_id)` in invoke_acp_agent_tool now uses
`{base_dir}/threads/{thread_id}/acp-workspace/`; falls back to
global workspace when thread_id is absent or invalid
- `_invoke` extracts thread_id from `RunnableConfig` via
`Annotated[RunnableConfig, InjectedToolArg]`
- `sandbox/tools.py`: `_get_acp_workspace_host_path(thread_id)`,
`_resolve_acp_workspace_path(path, thread_id)`, and all callers
(`replace_virtual_paths_in_command`, `mask_local_paths_in_output`,
`ls_tool`, `read_file_tool`) now resolve ACP paths per-thread
P1.2 – ACP permission guardrail
- New `auto_approve_permissions: bool = False` field in `ACPAgentConfig`
- `_build_permission_response(options, *, auto_approve: bool)` now
defaults to deny; only approves when `auto_approve=True`
- Document field in `config.example.yaml`
P2 – Deferred tool registry race condition
- Replace module-level `_registry` global with `contextvars.ContextVar`
- Each asyncio request context gets its own registry; worker threads
inherit the context automatically via `loop.run_in_executor`
- Expose `get_deferred_registry` / `set_deferred_registry` /
`reset_deferred_registry` helpers
Tests: 831 pass (57 for affected modules, 3 new tests)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(sandbox): mount /mnt/acp-workspace in docker sandbox container
The AioSandboxProvider was not mounting the ACP workspace into the
sandbox container, so /mnt/acp-workspace was inaccessible when the lead
agent tried to read ACP results in docker mode.
Changes:
- `ensure_thread_dirs`: also create `acp-workspace/` (chmod 0o777) so
the directory exists before the sandbox container starts — required
for Docker volume mounts
- `_get_thread_mounts`: add read-only `/mnt/acp-workspace` mount using
the per-thread host path (`host_paths.acp_workspace_dir(thread_id)`)
- Update stale CLAUDE.md description (was "fixed global workspace")
Tests: `test_aio_sandbox_provider.py` (4 new tests)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(lint): remove unused imports in test_aio_sandbox_provider
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix config
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-26 14:20:18 +08:00
|
|
|
assert result.generations[0].message.tool_calls == [{"name": "bash", "args": {"cmd": "pwd"}, "id": "tc-1", "type": "tool_call"}]
|