mirror of
https://github.com/rennf93/roboco.git
synced 2026-08-03 07:23:24 +02:00
Renn F
a402de61bc
A 7-dimension adversarial review (find -> independently refute) surfaced 14 real issues; fixed each: Runtime bugs - GrokCliSession.send drained stdout fully BEFORE stderr — a >64KB stderr burst would deadlock the turn forever (spinner never clears). Drain stderr concurrently, and add a per-turn watchdog (ROBOCO_GROK_TURN_TIMEOUT_SECONDS, default 600s) that kills a wedged process and emits error+turn_end. - Crash-restarted grok agents launched `grok -p ""` (empty prompt) — Claude gets a scan-for-work fallback. Default the prompt in _spawn_container so every dedicated provider gets it too. - _grok_usage_json read /data/grok-usage unconditionally while its writers branch compose-vs-local, so a local-mode agent finalized at $0 and the cost-cap was inert. Single-source the path in a new _grok_usage_dir helper (read == write). - GrokCliSession secretary role fell through to "unknown" (get_agent_role returns a truthy sentinel, never None), defeating the ROBOCO_AGENT_ROLE fallback. Parity / hardening - --deny set was missing `git tag -d` / `git reflog delete` that the Claude bash-guard blocks — added them (the "same set" claim is now true). - Interactive mains now install the bash-guard hook too (defense-in-depth). - Compose: collapse the GROK_AUTH_DIR / ROBOCO_HOST_GROK_DIR auth-mount pair into one canonical var so a partial override can't silently break agent auth. Docs / comments - Panel routing card + architecture security doc no longer say Grok runs on the deleted opencode runtime; orchestrator comments point at the renamed entrypoint. Tests - Cover the interactive _render_grok_config MCP wiring (ModuleNotFound guard + secretary HMAC env), the cost-cap kill-failure + interactive relay-close paths, the local-mode usage read, the role fallback, the turn timeout, and the new git denies. (#13 — a separate grok "Write" tool — investigated: grok's only built-in file-mutation tool is search_replace, already removed; no gap.) Gate green: ruff, mypy, xenon, tests.
128 lines
4.3 KiB
Python
128 lines
4.3 KiB
Python
"""GROK cost budget kill-switch: kill a live container over the cost ceiling.
|
|
|
|
The grok CLI exposes no live usage hook, so the budget kill-switch lives in the
|
|
orchestrator: it reads each live GROK container's captured cost (from its
|
|
usage.json, via ``_grok_cost_usd``) and kills + evicts it past
|
|
ROBOCO_GROK_MAX_COST_USD (also catching runaway-loop token burn). The usage.json
|
|
read is covered in the grok usage tests; here ``_grok_cost_usd`` is stubbed so the
|
|
kill DECISION is exercised deterministically.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from unittest.mock import AsyncMock
|
|
|
|
import pytest
|
|
from roboco.models.runtime import AgentInstance
|
|
from roboco.runtime.orchestrator import (
|
|
INTAKE_AGENT_ID,
|
|
AgentOrchestrator,
|
|
AgentState,
|
|
)
|
|
|
|
|
|
def _grok_instance(
|
|
provider_type: str = "grok", agent_id: str = "be-dev-1"
|
|
) -> AgentInstance:
|
|
cfg = type("C", (), {"provider_type": provider_type, "model": "grok-build"})()
|
|
return AgentInstance(agent_id=agent_id, state=AgentState.ACTIVE, config=cfg)
|
|
|
|
|
|
def _orch(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
*,
|
|
cap: float,
|
|
cost: float,
|
|
provider_type: str = "grok",
|
|
agent_id: str = "be-dev-1",
|
|
) -> tuple[AgentOrchestrator, AsyncMock]:
|
|
"""A bare orchestrator with the cost reader + container removal stubbed."""
|
|
orch = AgentOrchestrator.__new__(AgentOrchestrator)
|
|
orch._grok_max_cost_usd = cap
|
|
orch._instances = {agent_id: _grok_instance(provider_type, agent_id)}
|
|
monkeypatch.setattr(orch, "_grok_cost_usd", lambda _agent_id: cost)
|
|
remove_mock = AsyncMock()
|
|
monkeypatch.setattr(orch, "_remove_container", remove_mock)
|
|
return orch, remove_mock
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_cost_over_cap_kills_and_evicts(monkeypatch: pytest.MonkeyPatch) -> None:
|
|
orch, remove_mock = _orch(monkeypatch, cap=5.0, cost=7.5)
|
|
|
|
await orch._enforce_grok_cost_budget()
|
|
|
|
remove_mock.assert_awaited_once_with("roboco-agent-be-dev-1")
|
|
assert "be-dev-1" not in orch._instances
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_cost_under_cap_spares(monkeypatch: pytest.MonkeyPatch) -> None:
|
|
orch, remove_mock = _orch(monkeypatch, cap=5.0, cost=1.0)
|
|
|
|
await orch._enforce_grok_cost_budget()
|
|
|
|
remove_mock.assert_not_awaited()
|
|
assert "be-dev-1" in orch._instances
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_cap_zero_disables_the_sweep(monkeypatch: pytest.MonkeyPatch) -> None:
|
|
orch, remove_mock = _orch(monkeypatch, cap=0.0, cost=999.0)
|
|
|
|
await orch._enforce_grok_cost_budget()
|
|
|
|
remove_mock.assert_not_awaited()
|
|
assert "be-dev-1" in orch._instances
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_non_grok_container_is_ignored(monkeypatch: pytest.MonkeyPatch) -> None:
|
|
orch, remove_mock = _orch(
|
|
monkeypatch, cap=5.0, cost=999.0, provider_type="anthropic"
|
|
)
|
|
|
|
await orch._enforce_grok_cost_budget()
|
|
|
|
remove_mock.assert_not_awaited()
|
|
assert "be-dev-1" in orch._instances
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_kill_failure_keeps_instance_for_retry(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
) -> None:
|
|
# If `docker rm` raises, the over-budget container must STAY registered so the
|
|
# sweep retries next tick (the except `continue` resilience contract).
|
|
orch, remove_mock = _orch(monkeypatch, cap=5.0, cost=7.5)
|
|
remove_mock.side_effect = RuntimeError("docker rm failed")
|
|
|
|
await orch._enforce_grok_cost_budget()
|
|
|
|
remove_mock.assert_awaited_once()
|
|
assert "be-dev-1" in orch._instances # not evicted -> retried next tick
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_interactive_kill_closes_the_relay(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
) -> None:
|
|
# Killing an interactive (intake/secretary) container over budget must close
|
|
# its panel relay with a reason so the chat ends cleanly, not a frozen SSE.
|
|
orch, remove_mock = _orch(monkeypatch, cap=5.0, cost=9.0, agent_id=INTAKE_AGENT_ID)
|
|
registry = type("R", (), {"calls": []})()
|
|
registry.close_by_agent = lambda agent_id, error: registry.calls.append(
|
|
(agent_id, error)
|
|
)
|
|
monkeypatch.setattr(
|
|
"roboco.services.prompter_live.get_live_registry", lambda: registry
|
|
)
|
|
|
|
await orch._enforce_grok_cost_budget()
|
|
|
|
remove_mock.assert_awaited_once_with(f"roboco-agent-{INTAKE_AGENT_ID}")
|
|
assert INTAKE_AGENT_ID not in orch._instances
|
|
assert len(registry.calls) == 1
|
|
assert registry.calls[0][0] == INTAKE_AGENT_ID
|
|
assert "cost" in registry.calls[0][1].lower()
|