rein-aharness/tests/native_cli_fixture.py

"""Runs inside a network namespace: deterministic HTTP responses, no inference."""

import http.server
import json
import os
import subprocess
import threading
from pathlib import Path

root = Path("/work")
settings = json.loads((root / "case.json").read_text())
seen = []
guard_attempts = []


class Handler(http.server.BaseHTTPRequestHandler):
    def log_message(self, *args):
        pass

    def do_POST(self):
        body = json.loads(self.rfile.read(int(self.headers.get("Content-Length", 0))))
        results = []
        for message in body.get("messages", []):
            if isinstance(message.get("content"), list):
                results.extend(
                    {
                        "id": block.get("tool_use_id"),
                        "is_error": block.get("is_error", False),
                    }
                    for block in message["content"]
                    if block.get("type") == "tool_result"
                )
        seen.append(
            {
                "path": self.path,
                "model": body.get("model"),
                "max_tokens": body.get("max_tokens"),
                "tools": [tool.get("name") for tool in body.get("tools", [])],
                "tool_results": results,
                "ambient_context_loaded": "AMBIENT_CONTEXT_SENTINEL"
                in json.dumps(body),
            }
        )
        if "count_tokens" in self.path:
            self.send_response(200)
            self.send_header("Content-Type", "application/json")
            self.end_headers()
            self.wfile.write(b'{"input_tokens":100}')
            return
        message_number = sum("count_tokens" not in request["path"] for request in seen)
        if settings["case"] in ("tools", "guarded-tools") and message_number == 1:
            blocks = [
                {
                    "type": "tool_use",
                    "id": "tool_allowed",
                    "name": "Bash",
                    "input": {
                        "command": "git status",
                        "description": "Read fixture status",
                    },
                },
                {
                    "type": "tool_use",
                    "id": "tool_create",
                    "name": "Edit",
                    "input": {
                        "file_path": "/work/target/result.txt",
                        "old_string": "",
                        "new_string": "fixture-created\n",
                    },
                },
                {
                    "type": "tool_use",
                    "id": "tool_denied",
                    "name": "Bash",
                    "input": {
                        "command": "printf bypass > /work/denied-ran",
                        "description": "Fixture forbidden operation",
                    },
                },
            ]
            stop = "tool_use"
        else:
            blocks = [{"type": "text", "text": "fixture complete"}]
            stop = "end_turn"
        usage = {
            "input_tokens": 60000
            if settings["case"] in ("overrun", "guarded-overrun")
            else 100,
            "output_tokens": 0,
            "cache_creation_input_tokens": 0,
            "cache_read_input_tokens": 0,
        }
        events = [
            (
                "message_start",
                {
                    "type": "message_start",
                    "message": {
                        "id": "msg_fixture_" + str(message_number),
                        "type": "message",
                        "role": "assistant",
                        "model": "claude-sonnet-4-6",
                        "content": [],
                        "stop_reason": None,
                        "stop_sequence": None,
                        "usage": usage,
                    },
                },
            )
        ]
        for index, block in enumerate(blocks):
            if block["type"] == "text":
                start = {"type": "text", "text": ""}
                delta = {"type": "text_delta", "text": block["text"]}
            else:
                start = {**block, "input": {}}
                delta = {
                    "type": "input_json_delta",
                    "partial_json": json.dumps(block["input"]),
                }
            events += [
                (
                    "content_block_start",
                    {
                        "type": "content_block_start",
                        "index": index,
                        "content_block": start,
                    },
                ),
                (
                    "content_block_delta",
                    {"type": "content_block_delta", "index": index, "delta": delta},
                ),
                ("content_block_stop", {"type": "content_block_stop", "index": index}),
            ]
        events += [
            (
                "message_delta",
                {
                    "type": "message_delta",
                    "delta": {"stop_reason": stop, "stop_sequence": None},
                    "usage": {**usage, "output_tokens": 10},
                },
            ),
            ("message_stop", {"type": "message_stop"}),
        ]
        encoded = "".join(
            "event: " + name + "\ndata: " + json.dumps(value) + "\n\n"
            for name, value in events
        ).encode()
        self.send_response(200)
        self.send_header("Content-Type", "text/event-stream")
        self.send_header("Content-Length", str(len(encoded)))
        self.end_headers()
        self.wfile.write(encoded)


server = http.server.ThreadingHTTPServer(("127.0.0.1", 0), Handler)
threading.Thread(target=server.serve_forever, daemon=True).start()
gate = meter = None
route_token = "fixture-no-provider-secret"
base_url = "http://127.0.0.1:" + str(server.server_port)
if settings["case"].startswith("guarded-"):
    from datetime import UTC, datetime, timedelta
    from types import SimpleNamespace

    from llm_connect.messages_gate import MessagesPolicy, MessagesServer, RequestRefused
    from rein_aharness.request_admission import RequestLedger
    from rein_aharness.spend_admission import SpendLedger, SpendPolicy

    class ObservedPolicy(MessagesPolicy):
        def validate(self, data, betas):
            row = {
                "fields": sorted(data),
                "betas": betas,
                "context_management": data.get("context_management"),
                "thinking": data.get("thinking"),
                "output_config": data.get("output_config"),
            }
            guard_attempts.append(row)
            try:
                value = super().validate(data, betas)
                row["liability_microusd"] = value
                return value
            except RequestRefused as exc:
                row["refusal"] = str(exc)
                raise

    # Synthetic accepted bounds ONLY, never a live price/FX/authority packet.
    policy = ObservedPolicy(
        "fixture:no-live-tariff",
        "claude-sonnet-4-6",
        200000,
        32000,
        3,
        15,
        allowed_betas=(
            "claude-code-20250219",
            "interleaved-thinking-2025-05-14",
            "thinking-token-count-2026-05-13",
            "context-management-2025-06-27",
            "prompt-caching-scope-2026-01-05",
            "effort-2025-11-24",
        ),
    )
    cap = "0.01" if settings["case"] == "guarded-overrun" else "5"
    private = root / "private"
    private.mkdir(mode=0o700)
    now = datetime.now(UTC)
    expiry = (now + timedelta(minutes=5)).isoformat()
    parent_policy = SpendPolicy(
        "1",
        "fixture",
        "fixture:no-live-authority",
        (now - timedelta(minutes=1)).isoformat(),
        expiry,
        "UTC",
        "fixture-worker",
        "fixture-definition",
        "/work/target",
        "fixture",
        "harness.fixture@1.0.0",
        "a" * 64,
        "b" * 64,
        "fixture-grant",
        cap,
        cap,
        4,
        "1",
        cap,
        cap,
        cap,
    )
    parent = SpendLedger(private / "spend.sqlite3", parent_policy)
    parent.initialize()
    meter = RequestLedger(parent)
    meter.initialize()
    parent.reserve(
        SimpleNamespace(
            id="fixture-run",
            activity_definition_id="fixture-definition",
            idempotency_key="fixture",
            attempt=1,
        )
    )
    route_token = meter.bind_route(
        "fixture-run", policy.sha256, lease_id="fixture-lease", expires_at=expiry
    )
    gate = MessagesServer(
        policy,
        meter,
        provider_key="fixture-owner-only-key",
        upstream_url=base_url,
        allow_test_http=True,
    )
    gate.start()
    base_url = "http://127.0.0.1:" + str(gate.port)
(root / "target" / ".claude").mkdir(parents=True)
(root / "target" / ".claude" / "settings.json").write_text(
    json.dumps(
        {
            "permissions": {"allow": ["Bash"]},
            "hooks": {
                "SessionStart": [
                    {"hooks": [{"type": "command", "command": "touch /work/hook-ran"}]}
                ]
            },
        }
    )
)
(root / "target" / ".mcp.json").write_text(
    json.dumps(
        {
            "mcpServers": {
                "fixture": {"command": "/bin/sh", "args": ["-c", "touch /work/mcp-ran"]}
            }
        }
    )
)
(root / "target" / "CLAUDE.md").write_text("AMBIENT_CONTEXT_SENTINEL\n")
subprocess.run(["git", "init", "-q", str(root / "target")], check=True)
env = dict(
    os.environ,
    ANTHROPIC_BASE_URL=base_url,
    ANTHROPIC_API_KEY=route_token,
    CLAUDE_CONFIG_DIR="/work/config",
    CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC="1",
    DISABLE_AUTOUPDATER="1",
)
try:
    proc = subprocess.run(
        settings["argv"],
        input="Run the deterministic fixture.",
        text=True,
        capture_output=True,
        check=False,
        env=env,
        cwd="/work/target",
        timeout=45,
    )
    terminal = json.loads(proc.stdout)
    output = {
        "returncode": proc.returncode,
        "terminal": {
            key: terminal.get(key)
            for key in (
                "type",
                "subtype",
                "is_error",
                "total_cost_usd",
                "num_turns",
                "usage",
                "permission_denials",
            )
        },
        "requests": seen,
        "markers": {
            name: (root / name).exists()
            for name in ("hook-ran", "mcp-ran", "denied-ran")
        },
        "created_file": (root / "target" / "result.txt").read_text()
        if (root / "target" / "result.txt").exists()
        else None,
        "network_namespace": os.readlink("/proc/self/ns/net"),
        "guard_attempts": guard_attempts,
        "request_reservations": meter.status() if meter else [],
    }
    print(json.dumps(output))
finally:
    if gate:
        gate.stop()
    server.shutdown()