diff --git a/.github/issue-416-plan-auditor.sh b/.github/issue-416-plan-auditor.sh deleted file mode 100644 index b471277c0..000000000 --- a/.github/issue-416-plan-auditor.sh +++ /dev/null @@ -1,201 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -rm -rf /tmp/plan-auditor -git clone --depth 1 https://github.com/Furox-Art/plan-auditor.git /tmp/plan-auditor -echo "Plan Auditor commit: $(git -C /tmp/plan-auditor rev-parse HEAD)" -grep -F 'version: "1.1.0"' /tmp/plan-auditor/SKILL.md - -mkdir -p .plan-auditor -cat > .plan-auditor/full-suite-check.sh <<'CHECK' -#!/usr/bin/env bash -set +e -pnpm --filter=dokploy exec vitest --config __test__/vitest.config.ts --run > /tmp/issue416-full-test.log 2>&1 -rc=$? -cat /tmp/issue416-full-test.log -if [ "$rc" -eq 0 ]; then - echo FULL_SUITE_ZERO_FAILURES - exit 0 -fi -python - <<'PY' -import re -from pathlib import Path -s = re.sub(r"\x1b\[[0-9;]*m", "", Path("/tmp/issue416-full-test.log").read_text(errors="replace")) -required = [ - "__test__/deploy/application.real.test.ts", - "__test__/setup/monitoring-setup.real.test.ts", -] -if not all(x in s for x in required): - raise SystemExit("known Swarm integration files not both present in failure log") -if not re.search(r"Test Files\s+2 failed", s): - raise SystemExit("full suite has a failure-file count other than the two known Swarm files") -if not re.search(r"Tests\s+8 failed\b", s): - raise SystemExit("full suite has a failed-test count other than the eight known Swarm failures") -if not re.search(r"Tests\s+8 failed[^\n]*1 skipped", s): - raise SystemExit("full suite skip/failure summary differs from the known infrastructure baseline") -if "swarm manager" not in s.lower(): - raise SystemExit("known Docker Swarm manager environment signature missing") -print("FULL_SUITE_ONLY_KNOWN_SWARM_ENV_FAILURES") -PY -CHECK -chmod +x .plan-auditor/full-suite-check.sh - -cat > .plan-auditor/plan.json <<'JSON' -{ - "task": "Issue #416 / PR #5349 definitive root-cause, security, regression and acceptance audit", - "created": "2026-09-05T02:00:00+03:00", - "steps": [ - { - "id": 1, - "title": "Provider acceptance and S3 compatibility", - "verify": [ - { - "type": "run", - "cmd": "pnpm --filter=dokploy exec vitest --config __test__/vitest.config.ts __test__/utils/backups.test.ts --run", - "expect_exit": 0, - "timeout": 300 - }, - { - "type": "regex", - "path": "packages/server/src/db/validations/destination.ts", - "pattern": "GOOGLE_DRIVE[\\s\\S]*ONEDRIVE[\\s\\S]*FTP[\\s\\S]*SFTP" - }, - { - "type": "regex", - "path": "packages/server/src/utils/backups/utils.ts", - "pattern": "getRclonePathAndFlags" - } - ], - "status": "pending" - }, - { - "id": 2, - "title": "Security invariants, credential containment and bypass resistance", - "verify": [ - { - "type": "run", - "cmd": "pnpm --filter=dokploy exec vitest --config __test__/vitest.config.ts __test__/backups/redact-credentials.test.ts __test__/utils/backups.test.ts __test__/utils/issue-416-path-safety.test.ts --run", - "expect_exit": 0, - "timeout": 300 - }, - { - "type": "run", - "cmd": "python -c \"from pathlib import Path; base=Path('packages/server/src/utils/backups'); files=['postgres.ts','mysql.ts','mariadb.ts','mongo.ts','libsql.ts','compose.ts','web-server.ts']; [(_ for _ in ()).throw(AssertionError(f)) if 'getSafeRcloneErrorMessage(error)' not in (base/f).read_text() else None for f in files]; v=Path('packages/server/src/utils/volume-backups/utils.ts').read_text(); assert 'getSafeRcloneErrorMessage(error)' in v; assert 'errorMessage: safeErrorMessage' in v; assert 'Volume backup retention error' in v; assert 'errorMessage: error instanceof Error ? error.message' not in v; r=Path('packages/server/src/utils/restore/web-server.ts').read_text(); assert 'getSafeRcloneErrorMessage(error)' in r; assert 'console.error(error)' not in r; u=Path('packages/server/src/utils/backups/utils.ts').read_text(); assert '\\\"--ftp-no-check-certificate=false\\\"' in u; assert '\\\"--no-check-certificate=false\\\"' in u; print('backup and restore credential sinks plus FTP environment overrides verified')\"", - "expect_exit": 0 - }, - { - "type": "regex", - "path": "packages/server/src/utils/backups/utils.ts", - "pattern": "assertSafeRclonePath" - }, - { - "type": "regex", - "path": "packages/server/src/db/validations/destination.ts", - "pattern": "matchingFlags\\.length !== 1" - }, - { - "type": "regex", - "path": "packages/server/src/db/validations/destination.ts", - "pattern": "parseBooleanFlagValue" - }, - { - "type": "regex", - "path": "packages/server/src/db/validations/destination.ts", - "pattern": "hasDisabledFtpCertificateVerification" - }, - { - "type": "regex", - "path": "packages/server/src/utils/backups/redact.ts", - "pattern": "sftp-key-file-pass" - }, - { - "type": "regex", - "path": "apps/dokploy/__test__/backups/redact-credentials.test.ts", - "pattern": "fully redact shell-quote output" - }, - { - "type": "regex", - "path": "packages/server/src/utils/volume-backups/utils.ts", - "pattern": "getSafeRcloneErrorMessage" - } - ], - "status": "pending" - }, - { - "id": 3, - "title": "Execution-environment parity for local and remote servers", - "verify": [ - { - "type": "run", - "cmd": "pnpm typecheck", - "expect_exit": 0, - "timeout": 300 - }, - { - "type": "run", - "cmd": "python -c \"from pathlib import Path; r=Path('apps/dokploy/server/api/routers/destination.ts').read_text(); u=Path('apps/dokploy/components/dashboard/settings/destination/handle-destinations.tsx').read_text(); assert 'if (IS_CLOUD && !input.serverId)' in r; assert 'if (input.serverId)' in r; assert 'findServerById(input.serverId)' in r; assert 'server.organizationId !== ctx.session.activeOrganizationId' in r; assert 'execAsyncRemote(input.serverId, rcloneCommand)' in r; assert 'showServerSelector = Boolean(isCloud) || hasRemoteServers' in u; assert 'Dokploy Server (Local)' in u; print('local/remote destination test routing invariants verified')\"", - "expect_exit": 0 - }, - { - "type": "regex", - "path": "apps/dokploy/server/api/routers/destination.ts", - "pattern": "if \\(input\\.serverId\\)" - }, - { - "type": "regex", - "path": "apps/dokploy/components/dashboard/settings/destination/handle-destinations.tsx", - "pattern": "showServerSelector = Boolean\\(isCloud\\) \\|\\| hasRemoteServers" - } - ], - "status": "pending" - }, - { - "id": 4, - "title": "Build and formatting regression gate", - "verify": [ - { - "type": "run", - "cmd": "pnpm server:build", - "expect_exit": 0, - "timeout": 300 - }, - { - "type": "run", - "cmd": "pnpm exec biome check apps/dokploy/__test__/backups/redact-credentials.test.ts apps/dokploy/__test__/utils/backups.test.ts apps/dokploy/__test__/utils/issue-416-path-safety.test.ts apps/dokploy/components/dashboard/settings/destination/constants.ts apps/dokploy/components/dashboard/settings/destination/handle-destinations.tsx apps/dokploy/server/api/routers/backup.ts apps/dokploy/server/api/routers/destination.ts packages/server/src/db/schema/destination.ts packages/server/src/db/validations/destination.ts packages/server/src/utils/backups packages/server/src/utils/restore packages/server/src/utils/volume-backups", - "expect_exit": 0, - "timeout": 300 - } - ], - "status": "pending" - }, - { - "id": 5, - "title": "Full fix-issue regression suite with strict infrastructure-failure classification", - "verify": [ - { - "type": "run", - "cmd": "bash .plan-auditor/full-suite-check.sh", - "expect_exit": 0, - "output_regex": "FULL_SUITE_(ZERO_FAILURES|ONLY_KNOWN_SWARM_ENV_FAILURES)", - "timeout": 600 - }, - { - "type": "run", - "cmd": "pnpm --filter=dokploy exec vitest --config __test__/vitest.config.ts --run --exclude __test__/deploy/application.real.test.ts --exclude __test__/setup/monitoring-setup.real.test.ts", - "expect_exit": 0, - "timeout": 600 - } - ], - "status": "pending" - } - ] -} -JSON - -python /tmp/plan-auditor/scripts/audit_check.py validate . -python /tmp/plan-auditor/scripts/audit_check.py run . -python /tmp/plan-auditor/scripts/audit_check.py audit . -python /tmp/plan-auditor/scripts/audit_check.py status . - -echo '--- evidence tail ---' -tail -n 20 .plan-auditor/evidence.jsonl