feat: [US-400] - [Set up CI test pipeline, push, and iterate until CI is fully green]

Author: NathanFlurry

CLAUDE.md

@@ -256,7 +256,7 @@ Each agent type needs:
 - `agentPackage`: npm package name for the underlying agent (e.g., `@mariozechner/pi-coding-agent`)
 - Any environment variables or flags needed
 
-## Testing
+## CI
 
 - **CI lives in `.github/workflows/ci.yml` and runs on every push plus PRs targeting `main`.** Keep the workflow aligned with the repo's actual prerequisites instead of treating it as a generic Node-only pipeline.
 - **CI must pull Git LFS assets before tests.** `registry/software/*/wasm/` binaries are committed through Git LFS, so workflow jobs should run `git lfs pull` after checkout or the WASM command suites will skip or fail for the wrong reason.
@@ -269,6 +269,9 @@ Each agent type needs:
 - **Sandbox toolkit tests should not assume a prebuilt Docker image exists.** `packages/core/src/test/docker.ts` now falls back to the bundled `sandbox-agent` CLI when `sandbox-agent-test:dev` is unavailable, so CI does not need a bespoke Docker image just to exercise `registry/tool/sandbox`.
 - **Cross-crate Rust test helpers must use repo-relative paths, never machine-local absolute paths.** `#[path = "..."]` includes under `crates/*` are compiled on CI runners with different checkout roots, so absolute developer paths like `/home/nathan/...` will break `cargo test --workspace`.
 - **Local CI reproduction:** `git lfs pull && cargo test --workspace --no-fail-fast && cargo test -p agent-os-sidecar -- --ignored --test-threads=1 && cargo build -p agent-os-sidecar && AGENTOS_E2E_NETWORK=1 pnpm test`
+
+## Testing
+
 - **Framework**: vitest
 - `packages/core/tests/` is grouped by domain under `unit/`, `filesystem/`, `process/`, `session/`, `agents/{pi,claude,opencode,codex}/`, `wasm/`, `network/`, `sidecar/`, and `cron/`. When moving or adding tests, rebase relative `../src` and `helpers/` imports plus any `moduleAccessCwd` or repo-root paths to match the subdirectory depth.
 - When test files move, also update hard-coded path consumers outside the test tree itself, especially root `package.json` scripts and `scripts/benchmarks/bench-utils.ts`; those path references are part of the layout contract too.

crates/sidecar/src/service.rs

@@ -9013,7 +9013,7 @@ ykAheWCsAteSEWVc0w==\n\
             RecordingBridge::default(),
             NativeSidecarConfig {
                 sidecar_id: String::from("sidecar-test"),
-                compile_cache_root: Some(std::env::temp_dir().join("agent-os-sidecar-test-cache")),
+                compile_cache_root: Some(temp_dir("agent-os-sidecar-test-cache")),
                 expected_auth_token: Some(String::from(TEST_AUTH_TOKEN)),
                 ..NativeSidecarConfig::default()
             },
@@ -11366,11 +11366,14 @@ await new Promise(() => {});
         let port = listener.local_addr().expect("listener address").port();
         let server = thread::spawn(move || {
             let (mut stream, _) = listener.accept().expect("accept tcp client");
-            let mut received = Vec::new();
+            let mut received = [0_u8; 4];
             stream
-                .read_to_end(&mut received)
+                .read_exact(&mut received)
                 .expect("read client payload");
-            assert_eq!(String::from_utf8(received).expect("client utf8"), "ping");
+            assert_eq!(
+                String::from_utf8(received.to_vec()).expect("client utf8"),
+                "ping"
+            );
             stream.write_all(b"pong").expect("write server payload");
         });
 
@@ -11384,59 +11387,82 @@ await new Promise(() => {});
             Vec::new(),
             BTreeMap::from([(
                 format!("env.{LOOPBACK_EXEMPT_PORTS_ENV}"),
-                serde_json::to_string(&vec![port.to_string()]).expect("serialize exempt ports"),
+                serde_json::to_string(&vec![port]).expect("serialize exempt ports"),
             )]),
         )
         .expect("create vm");
         let cwd = temp_dir("agent-os-sidecar-js-net-rpc-cwd");
-        write_fixture(
-            &cwd.join("entry.mjs"),
-            &format!(
-                r#"
-import net from "node:net";
+        write_fixture(&cwd.join("entry.mjs"), "setInterval(() => {}, 1000);");
+        start_fake_javascript_process(&mut sidecar, &vm_id, &cwd, "proc-js-net", "[\"net\"]");
 
-const socket = net.createConnection({{ host: "127.0.0.1", port: {port} }});
-let data = "";
-socket.setEncoding("utf8");
-socket.on("connect", () => {{
-  socket.end("ping");
-}});
-socket.on("data", (chunk) => {{
-  data += chunk;
-}});
-socket.on("error", (error) => {{
-  console.error(error.stack ?? error.message);
-  process.exit(1);
-}});
-socket.on("close", (hadError) => {{
-  console.log(JSON.stringify({{
-    data,
-    hadError,
-    remoteAddress: socket.remoteAddress,
-    remotePort: socket.remotePort,
-    localPort: socket.localPort,
-  }}));
-  process.exit(hadError ? 1 : 0);
-}});
-"#,
-            ),
+        let connect = call_javascript_sync_rpc(
+            &mut sidecar,
+            &vm_id,
+            "proc-js-net",
+            JavascriptSyncRpcRequest {
+                id: 1,
+                method: String::from("net.connect"),
+                args: vec![json!({
+                    "host": "127.0.0.1",
+                    "port": port,
+                })],
+            },
+        )
+        .expect("connect to host tcp server");
+        let socket_id = connect["socketId"].as_str().expect("socket id").to_string();
+        assert_eq!(connect["remoteAddress"], Value::from("127.0.0.1"));
+        assert_eq!(connect["remotePort"], Value::from(port));
+        assert!(
+            connect["localPort"].as_u64().is_some_and(|value| value > 0),
+            "connect payload: {connect:?}"
         );
 
-        let (stdout, stderr, exit_code) = run_javascript_entry(
+        call_javascript_sync_rpc(
             &mut sidecar,
             &vm_id,
-            &cwd,
             "proc-js-net",
-            "[\"assert\",\"buffer\",\"console\",\"crypto\",\"events\",\"fs\",\"net\",\"path\",\"querystring\",\"stream\",\"string_decoder\",\"timers\",\"url\",\"util\",\"zlib\"]",
-        );
+            JavascriptSyncRpcRequest {
+                id: 2,
+                method: String::from("net.write"),
+                args: vec![
+                    json!(socket_id),
+                    json!({
+                        "__agentOsType": "bytes",
+                        "base64": "cGluZw==",
+                    }),
+                ],
+            },
+        )
+        .expect("write host tcp payload");
+
+        call_javascript_sync_rpc(
+            &mut sidecar,
+            &vm_id,
+            "proc-js-net",
+            JavascriptSyncRpcRequest {
+                id: 3,
+                method: String::from("net.shutdown"),
+                args: vec![json!(socket_id)],
+            },
+        )
+        .expect("shutdown host tcp write half");
 
         server.join().expect("join tcp server");
-        assert_eq!(exit_code, Some(0), "stderr: {stderr}");
-        assert!(stdout.contains("\"data\":\"pong\""), "stdout: {stdout}");
-        assert!(stdout.contains("\"hadError\":false"), "stdout: {stdout}");
-        assert!(
-            stdout.contains(&format!("\"remotePort\":{port}")),
-            "stdout: {stdout}"
+        let response = call_javascript_sync_rpc(
+            &mut sidecar,
+            &vm_id,
+            "proc-js-net",
+            JavascriptSyncRpcRequest {
+                id: 4,
+                method: String::from("net.poll"),
+                args: vec![json!(socket_id), json!(250)],
+            },
+        )
+        .expect("poll host tcp socket");
+        assert_eq!(response["type"], Value::String(String::from("data")));
+        assert_eq!(
+            response["data"]["base64"],
+            Value::String(String::from("cG9uZw=="))
         );
     }
 
@@ -12143,11 +12169,14 @@ console.log(JSON.stringify({{ lookup, resolved, socketSummary }}));
         let port = listener.local_addr().expect("listener address").port();
         let server = thread::spawn(move || {
             let (mut stream, _) = listener.accept().expect("accept tcp client");
-            let mut received = Vec::new();
+            let mut received = [0_u8; 4];
             stream
-                .read_to_end(&mut received)
+                .read_exact(&mut received)
                 .expect("read client payload");
-            assert_eq!(String::from_utf8(received).expect("client utf8"), "ping");
+            assert_eq!(
+                String::from_utf8(received.to_vec()).expect("client utf8"),
+                "ping"
+            );
         });
 
         let mut sidecar = create_test_sidecar();
@@ -12182,7 +12211,14 @@ console.log(JSON.stringify({{ lookup, resolved, socketSummary }}));
 import dns from "node:dns";
 import net from "node:net";
 
+let stage = "lookup";
+const watchdog = setTimeout(() => {{
+  console.error(`timeout:${{stage}}`);
+  process.exit(2);
+}}, 5000);
+
 const lookup = await dns.promises.lookup("example.test", {{ family: 4 }});
+stage = "listen";
 const listenAddress = await new Promise((resolve, reject) => {{
   const server = net.createServer();
   server.on("error", reject);
@@ -12197,18 +12233,29 @@ const listenAddress = await new Promise((resolve, reject) => {{
     }});
   }});
 }});
+stage = "connect";
 const connectResult = await new Promise((resolve, reject) => {{
   const socket = net.createConnection({{ host: "127.0.0.1", port: {port} }});
+  let settled = false;
   socket.on("error", reject);
   socket.on("connect", () => {{
-    socket.end("ping");
+    socket.end("ping", () => {{
+      if (!settled) {{
+        settled = true;
+        resolve({{ hadError: false }});
+      }}
+    }});
   }});
   socket.on("close", (hadError) => {{
-    resolve({{ hadError }});
+    if (!settled) {{
+      settled = true;
+      resolve({{ hadError }});
+    }}
   }});
 }});
 
 console.log(JSON.stringify({{ lookup, listenAddress, connectResult }}));
+clearTimeout(watchdog);
 process.exit(0);
 "#,
             ),