Publish curated Unraid-AppOps-Gateway source from c61e0e1e292914893b40354f904f23dd9fd4a958

backend/tests/test_runner_resource_envelope.py

@@ -4,6 +4,7 @@ import copy
 import importlib.util
 import json
 import os
+import subprocess
 import sys
 from pathlib import Path
 from types import SimpleNamespace
@@ -649,7 +650,11 @@ def test_inherited_image_labels_are_exact_and_owned_probe_cleanup_is_bounded(mon
     inspected = iter([probe, copy.deepcopy(probe), None])
     monkeypatch.setattr(envelope, "_inspect_host_probe_by_name", lambda: next(inspected))
     calls = []
-    monkeypatch.setattr(envelope, "_run", lambda args, **kw: calls.append(args))
+    def remove(args, **kw):
+        calls.append(args)
+        assert kw == {"check": False, "capture_output": True, "timeout": 10}
+        return SimpleNamespace(returncode=0, stderr=b"")
+    monkeypatch.setattr(envelope.subprocess, "run", remove)
     assert envelope.cleanup_stopped_host_probe(image_id=image_id, code_source=code_source)
     assert calls == [["docker", "rm", probe["Id"]]]
 
@@ -671,10 +676,85 @@ def test_probe_cleanup_refuses_foreign_running_or_changed_identity(monkeypatch,
     inspected = iter([probe, fresh])
     monkeypatch.setattr(envelope, "_inspect_host_probe_by_name", lambda: next(inspected))
     monkeypatch.setattr(envelope, "_run", lambda *a, **kw: pytest.fail("No removal or probe execution"))
+    monkeypatch.setattr(envelope, "_remove_cleanup_probe", lambda *a: pytest.fail("No removal"))
     with pytest.raises(RuntimeError, match="resource_cgroup_probe_cleanup_identity_"):
         envelope.cleanup_stopped_host_probe(image_id=image_id, code_source=code_source)
 
 
+@pytest.mark.parametrize("stderr,condition", [
+    (b"private-canary: no space left on device", "remove_storage_full"),
+    (b"private-canary: read-only file system", "remove_read_only"),
+    (b"private-canary: permission denied", "remove_permission_denied"),
+    (b"Cannot connect to the Docker daemon at private-canary", "remove_daemon_unavailable"),
+    (b"private-canary: device or resource busy", "remove_busy"),
+    (b"Removal of container private-canary is already in progress", "remove_busy"),
+    (b"No such container: private-canary", "remove_container_missing"),
+    (b"private-canary: client version is too old", "remove_api_version_unsupported"),
+    (b"removal of container private-canary failed unexpectedly", "remove_failed"),
+    (b"private-canary", "remove_failed"),
+    (b"no space left on device" + b"x" * 4096, "remove_failed"),
+])
+def test_probe_removal_has_finite_diagnostics_and_never_forces(monkeypatch, stderr, condition):
+    envelope = _module()
+    identifier = "d" * 64
+    def run(args, **kw):
+        assert args == ["docker", "rm", identifier]
+        assert kw == {"check": False, "capture_output": True, "timeout": 10}
+        return SimpleNamespace(returncode=1, stderr=stderr, stdout=b"private-canary")
+    monkeypatch.setattr(envelope.subprocess, "run", run)
+    with pytest.raises(envelope.HostProbeCleanupError) as error:
+        envelope._remove_cleanup_probe(identifier)
+    assert str(error.value) == "resource_cgroup_probe_cleanup_" + condition
+    assert "private-canary" not in str(error.value)
+    assert error.value.__cause__ is None
+
+
+@pytest.mark.parametrize("identifier", ["probe", "d" * 12, "d" * 64 + " --force", "../private-canary"])
+def test_probe_removal_rejects_selectors_before_any_command(monkeypatch, identifier):
+    envelope = _module()
+    monkeypatch.setattr(envelope.subprocess, "run", lambda *a, **kw: pytest.fail("No command"))
+    with pytest.raises(envelope.HostProbeCleanupError, match="cleanup_identity_invalid"):
+        envelope._remove_cleanup_probe(identifier)
+
+
+@pytest.mark.parametrize("stage", ["image_metadata_failed", "inspect_failed", "reinspect_failed", "absence_failed"])
+def test_probe_read_failures_drop_untrusted_exception_text(stage):
+    envelope = _module()
+    def fail():
+        raise RuntimeError("Bearer private-canary")
+    with pytest.raises(envelope.HostProbeCleanupError) as error:
+        envelope._cleanup_probe_read(stage, fail)
+    assert str(error.value) == "resource_cgroup_probe_cleanup_" + stage
+    assert error.value.__cause__ is None
+
+
+@pytest.mark.skipif(os.name == "nt", reason="Docker CLI shim uses POSIX executable semantics")
+@pytest.mark.parametrize("failure,condition", [("read-only file system private-canary", "remove_read_only"),
+                                               ("Bearer private-canary", "remove_failed")])
+def test_real_probe_cleanup_cli_exposes_only_finite_child_failure(tmp_path, failure, condition):
+    envelope = _module()
+    probe, image_id, code_source = _host_probe_fixture(envelope)
+    fixture = tmp_path / "fixture.json"
+    fixture.write_text(json.dumps({"probe": probe, "image": image_id, "failure": failure}))
+    shim = tmp_path / "docker"
+    shim.write_text("#!" + sys.executable + "\n" +
+                    "import json,sys,pathlib\n" +
+                    "v=json.loads(pathlib.Path(" + repr(str(fixture)) + ").read_text())\n" +
+                    "a=sys.argv[1:]\n" +
+                    "if a[:2]==['image','inspect']: print(json.dumps([{'Id':v['image'],'Config':{'Labels':{}}}]))\n" +
+                    "elif a[:2]==['ps','-a']: print(v['probe']['Id'])\n" +
+                    "elif a[0]=='inspect': print(json.dumps([v['probe']]))\n" +
+                    "elif a==['rm',v['probe']['Id']]: print(v['failure'],file=sys.stderr); sys.exit(1)\n" +
+                    "else: sys.exit(99)\n")
+    shim.chmod(0o700)
+    result = subprocess.run([sys.executable, str(ENVELOPE_PATH), "--cleanup-stopped-host-probe",
+                             image_id, code_source], capture_output=True, timeout=15,
+                            env={**os.environ, "PATH": str(tmp_path) + os.pathsep + os.environ.get("PATH", "")})
+    assert result.returncode == 1
+    assert result.stdout == b""
+    assert result.stderr == ("resource_cgroup_probe_cleanup_" + condition + "\n").encode()
+
+
 @pytest.mark.parametrize("labels", [None, {}, {"org.opencontainers.image.title": "runner"}])
 def test_probe_label_metadata_comes_from_exact_image(monkeypatch, labels):
     envelope = _module()