hatchery_node/
lib.rs

1//! Native Gate4Agent node server and runtime.
2
3mod bundle_catalog;
4
5mod context_pack;
6
7mod harness_mcp_proxy;
8
9mod bundle_provider;
10
11mod git_worktree;
12pub mod plugins;
13pub mod session_signals;
14
15mod host_directory_browser;
16
17mod environment_profiles;
18
19mod session_environment;
20
21mod worktree_service;
22
23pub(crate) use gate4agent_node_core::session_registry;
24
25mod standalone_workspace;
26
27#[cfg(windows)]
28mod workspace_file_windows;
29
30#[cfg(unix)]
31mod workspace_file_unix;
32
33#[cfg(feature = "dig2-station-probe")]
34mod dig2_station_lease;
35#[cfg(feature = "dig2-station-probe")]
36mod dig2_station_probe;
37mod kit;
38#[cfg(feature = "wireguard")]
39pub(crate) use gate4agent_node_core::kit_wireguard;
40mod network_allowlist_catalog;
41pub(crate) use gate4agent_node_core::platform;
42pub mod enroll_client;
43pub mod uplink_journal;
44pub mod restream_session;
45pub mod uplink_calls;
46pub mod machine_env;
47pub use machine_env::collect as collect_machine_environment;
48pub mod restream_g4a_bridge;
49#[cfg(feature = "d2b")]
50pub mod browser_capture;
51pub mod m4a_accounts;
52pub mod door;
53#[cfg(feature = "local-server")]
54pub mod local_server;
55pub mod wake_pipeline;
56#[cfg(unix)]
57pub mod isolation;
58pub use kit::{force_link, linked_core_names};
59#[cfg(feature = "m4a")]
60pub use kit::start_mailbox;
61#[cfg(feature = "m4a")]
62pub use kit::MailboxHandle;
63#[cfg(feature = "wireguard")]
64pub use kit_wireguard::{
65    bring_up_node_wireguard, node_wg_from_env, NodeWgPeerConfig, NodeWgPeerError,
66    LINK_TAG as WIREGUARD_LINK_TAG, WG_ADDRESS_ENV, WG_INTERFACE_ENV, WG_KEEPALIVE_ENV,
67    WG_LISTEN_PORT_ENV, WG_PEER_ADDRESS_ENV, WG_PEER_ENDPOINT_ENV, WG_PEER_KEY_ENV,
68    WG_PRIVATE_KEY_ENV,
69};
70mod provider_runtime;
71mod server;
72pub(crate) use gate4agent_node_core::spawn_spec;
73
74#[cfg(feature = "fixture")]
75pub use bundle_catalog::protect_bundle_source_tree_fixture;
76pub use bundle_catalog::{
77    BundleCatalog, BundleCatalogError, NodeBundle, NodeBundleError, NodeBundleFile,
78    MAX_BUNDLE_CATALOG_ENTRIES, MAX_BUNDLE_FILES, MAX_BUNDLE_FILE_BYTES, MAX_BUNDLE_PATH_BYTES,
79    MAX_BUNDLE_TOTAL_BYTES,
80};
81pub use environment_profiles::{
82    NodeEnvironmentProfile, NodeEnvironmentProfileError, MAX_NODE_ENVIRONMENT_PROFILES,
83};
84pub use gate4agent_node_protocol::WorktreeServiceMode;
85pub use gate4agent_runtime_native::{
86    orca_home_roots, HistorySourceLayout, NativeHistoryConfig, NativeHistoryRoot,
87};
88pub use network_allowlist_catalog::{
89    claude_allowed_domains_from_permits, claude_bash_sandbox_network_os_supported,
90    claude_settings_network_overlay_args, claude_station_network_settings_json,
91    codex_network_access_config_overlay, load_network_allowlist_catalog_file,
92    parse_network_allowlist_catalog_text, permit_peer_to_allowed_domain,
93    provider_native_mapping_supported, resolve_network_allowlist_catalog,
94    resolve_provider_native_launch_overlay, NetworkAllowlistCatalog, NetworkAllowlistCatalogError,
95    NetworkAllowlistEntry, NetworkPermitProtocol, NetworkPermitSketch, ProviderNativeNetworkSketch,
96    CLAUDE_STATION_NETWORK_SETTINGS_FILE, MAX_NETWORK_ALLOWLIST_CATALOG_ENTRIES,
97    MAX_NETWORK_PERMITS_PER_ENTRY, NETWORK_ALLOWLIST_CATALOG_ENV,
98    NETWORK_ALLOWLIST_CATALOG_SCHEMA_VERSION,
99};
100#[cfg(feature = "fixture")]
101pub use server::SpawnManagedWorktreeV2FailureProbe;
102pub use server::{
103    default_node_endpoint, default_state_path, NodeServer, NodeServerConfig, NodeServerError,
104    NodeShutdownHandle, WorkspaceConfig,
105};
106pub use session_environment::{
107    NodeSecretReference, NodeSecretResolveError, NodeSecretResolver, NodeSecretValue,
108    NodeSecretValueError, NodeSessionEnvironmentMutation, NodeSessionFile,
109    NodeSessionMaterializationProfile, NodeSessionMaterializationProfileError,
110    NodeSessionPathBinding, NodeSessionPathClass, MAX_NODE_SECRET_REFERENCE_BYTES,
111    MAX_NODE_SECRET_VALUE_BYTES, MAX_SESSION_ENVIRONMENT_ENTRIES,
112    MAX_SESSION_MATERIALIZATION_FILES, MAX_SESSION_MATERIALIZATION_FILE_BYTES,
113    MAX_SESSION_MATERIALIZATION_RELATIVE_PATH_BYTES,
114};
115pub use spawn_spec::{
116    SpawnProfileRegistry, SpawnProfileRegistryError, DEFAULT_SPAWN_PROFILE_ID, MAX_SPAWN_PROFILES,
117};
118pub use worktree_service::ManagedWorktreeProfile;
119
120#[cfg(windows)]
121pub use server::DEFAULT_NODE_ENDPOINT;
122
123pub use gate4agent_node_protocol as protocol;
124
125#[cfg(test)]
126mod kit_manifest {
127    #[test]
128    fn default_features_are_the_full_kit() {
129        let manifest = include_str!("../Cargo.toml");
130        let features = manifest
131            .split("[features]")
132            .nth(1)
133            .expect("features section")
134            .split("\n[")
135            .next()
136            .expect("features body");
137        assert!(
138            features.contains("default = [\"kit\"]"),
139            "default build must include the kit"
140        );
141        let kit = feature_array(features, "kit");
142        for core in ["m4a", "d2b", "session-restore", "wireguard", "memory"] {
143            assert!(
144                kit.iter().any(|item| item == core),
145                "kit feature missing {core}: {kit:?}"
146            );
147        }
148        assert!(
149            !features.contains("bare = "),
150            "there is no light mode"
151        );
152        let m4a = feature_array(features, "m4a");
153        assert_eq!(m4a, ["dep:mail4agent"]);
154        let d2b = feature_array(features, "d2b");
155        // The browser stream (websocket + frame encoding) rides with dig2browser.
156        assert_eq!(d2b, ["dep:dig2browser", "dep:tokio-tungstenite", "dep:futures-util", "dep:image"]);
157        let wg = feature_array(features, "wireguard");
158        assert_eq!(wg, ["gate4agent-node-core/wireguard"]);
159        let code = manifest
160            .lines()
161            .map(|line| line.split('#').next().unwrap_or(""))
162            .collect::<Vec<_>>()
163            .join("\n");
164        assert!(
165            !code.contains("hatchery-tui") && !code.contains("hatchery_tui"),
166            "node must not depend on the hatchery TUI"
167        );
168        assert!(manifest.contains("dig2browser = { version = \"0.5.3\""));
169        assert!(manifest.contains("mail4agent = { version = \"0.4.10\""));
170        assert!(!manifest.contains("[patch.crates-io]"), "published state has no patch table");
171        assert!(!manifest.contains("../../../"), "no path dependency leaves the workspace");
172        assert!(manifest.contains("claude-session-restore = { version = \"0.1.3\""));
173        assert!(manifest.contains("codex-session-restore = { version = \"0.1.3\""));
174        assert!(manifest.contains("grok-session-restore"));
175        assert!(manifest.contains("kimi-session-restore"));
176    }
177
178    fn feature_array(features: &str, name: &str) -> Vec<String> {
179        let line_start = features
180            .find(&format!("{name} = "))
181            .unwrap_or_else(|| panic!("missing feature {name}"));
182        let rest = &features[line_start + name.len() + 3..];
183        if rest.starts_with("[]") {
184            return Vec::new();
185        }
186        assert!(rest.starts_with("["), "{name} must be an array");
187        let end = rest.find(']').unwrap_or_else(|| panic!("{name} array"));
188        rest[1..end]
189            .split(',')
190            .map(|item| item.trim().trim_matches('"').to_owned())
191            .filter(|item| !item.is_empty())
192            .collect()
193    }
194}
195
196
197#[cfg(test)]
198mod deploy_artifacts {
199    //! Static checks for the three kit deploy modes. No Docker build, no
200    //! QEMU boot, no network. Lives in `--lib` so the ordinary node test
201    //! cycle refuses missing or gutted deploy entry points.
202
203    #[test]
204    fn service_unit_is_mode1_kit_entry() {
205        let unit = include_str!("../deploy/node/gate4agent-node.service");
206        assert!(unit.contains("ExecStart=/usr/local/bin/gate4agent-node"));
207        assert!(unit.contains("gate4agent node (standard kit)"));
208        assert!(
209            !unit.contains("INSTALL_PROVIDER_CLIS"),
210            "mode 1 unit must not install provider CLIs"
211        );
212        assert!(
213            unit.contains("GATE4AGENT_WG_INTERFACE") || unit.contains("WireGuard"),
214            "unit must document optional WG env"
215        );
216    }
217
218    #[test]
219    fn dockerfile_and_build_script_are_mode2() {
220        let dockerfile = include_str!("../deploy/node/Dockerfile");
221        assert!(dockerfile.contains("cargo build --locked --release -p hatchery-node"));
222        assert!(dockerfile.contains("ENTRYPOINT [\"gate4agent-node\"]"));
223        assert!(!dockerfile.contains("COPY mail4agent"));
224        assert!(!dockerfile.contains("COPY gate4agent"), "crates.io only: no sibling checkouts");
225        assert!(
226            !dockerfile.contains("GATE4AGENT_NODE_TOKEN"),
227            "image must not bake a node token"
228        );
229        let build = include_str!("../deploy/node/docker-build.sh");
230        assert!(build.contains("docker build"));
231        assert!(build.contains("gate4agent-node:kit"));
232        assert!(!build.contains("copy_tree \"$WS/mail4agent\""));
233    }
234
235    #[test]
236    fn qemu_guest_script_is_mode3_underlay_only() {
237        let script = include_str!("../deploy/node/qemu-guest.sh");
238        assert!(script.contains("Mode 3"));
239        assert!(script.contains("QEMU_NET"));
240        assert!(script.contains("tap") && script.contains("user"));
241        assert!(
242            script.contains("Kernel WireGuard is not a QEMU network"),
243            "script must keep WG out of the QEMU NIC story"
244        );
245        assert!(script.contains("GATE4AGENT_WG_"));
246        assert!(script.contains("gate4agent-node"));
247        // Guest boot stays opt-in: this test only reads the script text.
248        assert!(
249            !script.contains("cargo test"),
250            "qemu guest script must not be wired into cargo test"
251        );
252    }
253
254    #[test]
255    fn deploy_readme_names_three_modes() {
256        let readme = include_str!("../deploy/node/README.md");
257        assert!(readme.contains("Mode 1 — service"));
258        assert!(readme.contains("Mode 2 — container"));
259        assert!(readme.contains("Mode 3 — QEMU guest"));
260        assert!(readme.contains("no light mode"));
261    }
262}
hatchery_node/lib.rs

hatchery_node/
lib.rs
