open-swe/tests/e2e/fake_llm.py
Ramon Nogueira 3a0e2b4672
feat: plan mode with model-driven entry and collaborative review (#1580)
* feat: add plan mode for read-only research and planning

Adds a per-run plan_mode flag that puts the agent in a read-only
research phase: a strong prompt section is injected and mutating tools
are stripped via ExcludeToolsMiddleware so the agent proposes a
reviewable implementation plan before any edits. Surfaced in the
dashboard UI with a Plan toggle (Shift+Tab) wired through the thread API.

Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>

* fix: enforce plan-mode read-only at tool layer and disable subagents

Addresses PR review: plan mode previously relied on prompt text to keep
the shell read-only and left the task subagent (built with its own
write/PR/Linear tools) unrestricted. Now `task` is excluded so research
cannot be delegated to a mutating subagent, and a new
PlanModeShellGuardMiddleware enforces a read-only command allowlist on
`execute`, blocking writes, git state changes, installs, redirection,
and command substitution regardless of model/prompt-injection compliance.

Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>

* fix: harden plan-mode shell guard against wrapped mutations

Block git global options that take values (-C, --git-dir, ...) from being
misread as the subcommand, reject config-injection options (-c,
--config-env, --exec-path), and drop the env command wrapper that could
run arbitrary commands.

Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>

* feat: add plan mode with enter_plan_mode tool, profile/team defaults, Slack commands and approval flow

- enter_plan_mode tool: agent self-activates plan mode via Command(update={'plan_mode': True})
- Plan mode resolution: per-thread > profile default > team default > False
- PLAN_MODE_GUIDANCE_SECTION: always-present prompt section telling agent about the tool
- profile_plan_mode_default and team plan_mode_default settings
- Slack plan on/off/status commands with thread metadata persistence
- slack_thread_reply plan_approval=True renders Approve/Revise/Cancel buttons
- Interactivity handler: approve triggers implementation run, cancel posts confirmation
- Frontend: plan_mode_default in Profile/ProfileUpdate/TeamSettings types and UI toggles

Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>

* test: add tests for enter_plan_mode tool, profile/team defaults, Slack plan commands, approval blocks

Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>

* refactor(plan-mode): drop shell guard, rely on prompt for read-only discipline

Remove PlanModeShellGuardMiddleware and its enforcement of read-only shell
commands during plan mode. Plan mode now relies on the system prompt to
instruct the agent not to run mutating commands; the mutating-tool exclusion
(ExcludeToolsMiddleware) is retained.

* test(open-swe): add Playwright E2E for the Slack → PR → web handoff

Local, secrets-free end-to-end suite that drives the full happy path through mock Slack/GitHub control panels and the real dashboard UI. Only the LLM and external SaaS HTTP boundaries (GitHub/Slack APIs, OAuth token mint) are faked — the real process_slack_mention, get_agent, deepagents loop, tools, middleware, and dashboard authorization all run under `langgraph dev` with a scripted fake chat model and a local temp-dir sandbox.

- full_flow: a Slack mention runs the agent, which implements a change in the sandbox, opens a PR against a fake GitHub remote, and replies with the PR link in the same thread.
- dashboard: clicking the bot's real "Open in Web" link loads the built ui/ app (served same-origin); the thread owner can continue the conversation, while a different user sees the same thread read-only (no composer).

Wired into Agent CI as a `Playwright E2E` job that runs on pull requests.

* fix(open-swe): serve E2E UI assets via explicit route; pin Playwright

The dashboard E2E served the built ui/ SPA's /assets via app.mount(StaticFiles), but LangGraph's custom-app loader serves APIRoutes and drops sub-app Mounts, so /assets 404'd under `langgraph dev` in CI — the React app never booted and the composer/transcript never rendered. Serve assets via an explicit route instead.

Also pin @playwright/test to the latest (1.61.0) for reproducible runs, and make the owner composer assertion tolerant of either hydration state.

* test(open-swe): record Playwright trace + video on every E2E run

Capture a replayable trace (DOM snapshots, network, console, source) and a screen recording for every test, not just retries, plus a screenshot on failure. The CI job already uploads playwright-report/ and test-results/, so each run now has a downloadable replay; documented how to open it.

* feat(plan-mode): collaborative plan review with BlockNote + Yjs

When the agent enters plan mode it writes the plan as a markdown file in the
sandbox (save_plan tool), publishes it, and posts a review link to the source
channel. Reviewers open the plan inside the dashboard (under the /agents shell),
read it rendered in a BlockNote editor, and leave inline comments synced live
over Yjs. Only the thread owner can approve; any reviewer can request changes.
On approve/reject the comments are harvested and handed to the agent for the
follow-up run; the agent never sees comments mid-review.

- agent: enter_plan_mode persists plan state; new save_plan tool; prompt shares
  the plan-review link.
- dashboard: Yjs WebSocket collab server (pycrdt-websocket) with store-backed
  snapshots; plan content/status store; plan REST API (get/approve/reject,
  owner-only approve, client-harvested comments); planStatus on thread summaries.
- ui: BlockNote native comments (CommentsExtension + YjsThreadStore) plan page
  mounted under the agents shell, with a "Review plan" banner in the thread view
  and a back-link; theme-aware (dark mode) using the dashboard tokens.
- e2e: Playwright coverage of the full Slack -> plan -> review -> approve -> PR
  flow, including cross-user comment sync and owner-only approval.

* fix(plan-mode): address review feedback (authz, overrides, leaks, deps)

- plan-collab WS: authorize per-thread before joining a room (same read gate as
  the REST API) — previously any logged-in user could join any thread (IDOR).
- plan-collab: tie the snapshot flusher to active connections (refcount) so each
  opened plan no longer leaks a permanent 1.5s task on the shared event loop.
- plan decisions: include thread_id in the follow-up run configurable so the run
  resumes the existing thread; set plan_mode explicitly so approve forces it off.
- get_agent: an explicit per-thread plan_mode (Slack `plan off`, approved plan,
  dashboard toggle) now overrides profile/team defaults instead of falling back.
- plan mode tool gating moved to a state-aware PlanModeMiddleware installed
  unconditionally, so a mid-run enter_plan_mode restricts the next model turn;
  before_agent resets stale plan_mode so a later run isn't forced back into it.
- exclude write-capable http_request from plan mode.
- pin pycrdt / pycrdt-websocket with upper bounds.

Includes the latest base (#1583): E2E UI assets served via explicit route
(fixes the Playwright CI failure — LangGraph's app loader drops sub-app mounts).

* style: ruff format plan_collab.py

* fix(plan-mode): owner-gate Slack approval + same-origin check on collab WS

- Slack "Approve & Implement" now verifies the clicking user is the plan
  requester (owner, via the stored triggering_user_id) before implementing —
  matching the dashboard API's owner-only approval. Non-owners are pointed to
  Revise / feedback.
- The plan-collab WebSocket validates the handshake Origin against the dashboard
  allowlist before accept() (no-op when unconfigured, e.g. local/dev), mirroring
  the REST require_same_origin CSRF defense.

* fix(plan-mode): enter plan mode only via the model + local mock dev harness

Plan mode is now entered solely when the model calls enter_plan_mode.
Removed the per-user and team plan_mode_default settings (backend + UI)
and the Slack `plan on/off/status` toggle.

- enter_plan_mode returns a terminating ToolMessage, fixing the missing
  ToolMessage error that silently dropped plan mode mid-run.
- PlanReview: defer Yjs provider/doc teardown so React StrictMode's dev
  remount doesn't destroy and then reuse the collaboration provider.
- e2e plan_review spec asserts plan_mode actually engages.
- LangSmith trace-url resolution is best-effort: bail before any API
  call when the tenant is unset, cache failures, log at debug.
- Add `pnpm run dev:mock`: same-origin Vite HMR harness with a real LLM,
  Alice/Bob mock users, and a GitHub login picker.

* docs(plan-mode): drop stale references to removed profile/team defaults

The plan_mode middleware docstring and the approve/reject dispatch comment
still described the profile/team plan_mode_default resolution that no longer
exists; reword to match model-driven entry + the per-thread carry.

* feat(plan-mode): let any reviewer edit the plan, not just comment

Drop the owner/commenter split for the plan document: everyone with read
access edits and comments alike (DefaultThreadStoreAuth "editor" for all,
editor always editable until a decision, anyone seeds the empty doc). This
matches the collab WS, which already relays frames to every readable user.
Plan approval stays owner-gated.

* test(plan-mode): assert plan-mode entry via the tool's success message

plan_mode lives only in run state for tool gating; it is not a persisted
thread-state channel, so the previous `values.plan_mode === true` poll
could never pass. Assert instead that enter_plan_mode's success ToolMessage
("Plan mode is active …") lands in the thread — which only happens when the
tool's Command applies cleanly, the exact regression this guards.

---------

Co-authored-by: Johannes du Plessis <51395795+johannes117@users.noreply.github.com>
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
2026-06-23 12:06:58 -07:00

303 lines
9.7 KiB
Python

"""A scripted fake chat model — the ONLY faked piece of the agent.
It drives the real deepagents loop with a fixed sequence of tool calls that
implement a tiny feature, push a branch to the fake-GitHub remote, open a PR via
the real ``open_pull_request`` tool, and post the result back with the real
``slack_thread_reply`` tool. The final Slack step reads the actual PR URL out of
the preceding tool result, exactly as a real model would.
"""
from __future__ import annotations
import re
from typing import Any
from e2e_env import (
BASE_BRANCH,
FEATURE_BRANCH,
FEATURE_FILE,
OWNER,
PR_TITLE,
REPO,
)
from langchain_core.callbacks import CallbackManagerForLLMRun
from langchain_core.language_models import BaseChatModel
from langchain_core.messages import AIMessage, BaseMessage, HumanMessage, ToolMessage
from langchain_core.outputs import ChatGeneration, ChatResult
# One shell command that does the whole git workflow. Each execute() runs in a
# fresh shell rooted at the sandbox dir, so the clone+commit+push is bundled.
_IMPLEMENT_SCRIPT = f"""
set -e
rm -rf repo
git clone "$E2E_REMOTE" repo
cd repo
git config user.email "dev@example.com"
git config user.name "Dev User"
git checkout -b {FEATURE_BRANCH}
cat > {FEATURE_FILE} <<'EOF'
def greet(name):
return f"Hello, {{name}}!"
EOF
git add -A
git commit -m "{PR_TITLE}"
git push origin {FEATURE_BRANCH}
echo PUSHED_OK
""".strip()
_PLAN_URL_RE = re.compile(r"https?://[^\s\"'<>)\]|]+/plan\b")
def _text(content: Any) -> str:
if isinstance(content, str):
return content
if isinstance(content, list):
return " ".join(
part.get("text", "") if isinstance(part, dict) else str(part) for part in content
)
return str(content)
def _pr_url_from_messages(messages: list[BaseMessage]) -> str | None:
for msg in reversed(messages):
if isinstance(msg, ToolMessage):
text = msg.content if isinstance(msg.content, str) else str(msg.content)
match = re.search(r"https?://[^\s\"']+/pull/\d+", text)
if match:
return match.group(0)
return None
def _plan_url_from_messages(messages: list[BaseMessage]) -> str | None:
"""The plan-review URL is injected into the system prompt; a real model would
read it the same way."""
for msg in messages:
match = _PLAN_URL_RE.search(_text(msg.content))
if match:
return match.group(0).rstrip(".,")
return None
def _reviewer_feedback(messages: list[BaseMessage]) -> str | None:
"""The harvested reviewer comments the backend hands the agent on approval."""
humans = [m for m in messages if isinstance(m, HumanMessage)]
if not humans:
return None
text = _text(humans[-1].content)
idx = text.lower().find("feedback")
if "approved" in text.lower() and idx != -1:
return text[idx:].strip()
return None
def _step_implement(_messages: list[BaseMessage]) -> AIMessage:
return AIMessage(
content="Setting up the repo and implementing the change.",
tool_calls=[{"name": "execute", "args": {"command": _IMPLEMENT_SCRIPT}, "id": "call-impl"}],
)
def _step_open_pr(_messages: list[BaseMessage]) -> AIMessage:
return AIMessage(
content="Opening a pull request.",
tool_calls=[
{
"name": "open_pull_request",
"args": {
"owner": OWNER,
"repo": REPO,
"head": FEATURE_BRANCH,
"base": BASE_BRANCH,
"title": PR_TITLE,
"body": "Adds a `greet()` helper as requested.",
"draft": True,
},
"id": "call-pr",
}
],
)
def _step_reply(messages: list[BaseMessage]) -> AIMessage:
url = _pr_url_from_messages(messages) or "(PR url unavailable)"
feedback = _reviewer_feedback(messages)
extra = f"\n\nReviewer feedback I addressed:\n{feedback}" if feedback else ""
text = (
f"✅ Done! I implemented the change and opened a PR: <{url}|{PR_TITLE}>\n\n"
f"• Added `{FEATURE_FILE}` with a `greet()` helper.{extra}\n"
"Let me know if you'd like any changes."
)
return AIMessage(
content="Replying in the Slack thread with the PR link.",
tool_calls=[{"name": "slack_thread_reply", "args": {"message": text}, "id": "call-reply"}],
)
# --- plan-mode flow --------------------------------------------------------
PLAN_MARKDOWN = """## Plan: Add greet() helper
### Overview
Add a tiny greeting helper to the demo repo.
### Files to change
- `greet.py` — new module exposing a `greet(name)` function.
### Steps
1. Create `greet.py` with a `greet(name)` function.
2. Open a draft PR with the change.
### Verification
- Import `greet` and confirm it returns the expected string.
"""
def _step_enter_plan(_messages: list[BaseMessage]) -> AIMessage:
return AIMessage(
content="This is worth planning first — entering plan mode.",
tool_calls=[{"name": "enter_plan_mode", "args": {}, "id": "call-enter-plan"}],
)
def _step_plan_link(messages: list[BaseMessage]) -> AIMessage:
url = _plan_url_from_messages(messages) or "(plan link unavailable)"
return AIMessage(
content="Sharing the plan-review link.",
tool_calls=[
{
"name": "slack_thread_reply",
"args": {
"message": f"I'm putting together a plan. Follow along and review it here: <{url}|plan review>"
},
"id": "call-plan-link",
}
],
)
def _step_plan_research(_messages: list[BaseMessage]) -> AIMessage:
return AIMessage(
content="Reading the repo to ground the plan.",
tool_calls=[
{"name": "execute", "args": {"command": "echo planning && ls"}, "id": "call-plan-read"}
],
)
def _step_save_plan(_messages: list[BaseMessage]) -> AIMessage:
return AIMessage(
content="Saving the plan for review.",
tool_calls=[
{"name": "save_plan", "args": {"plan_markdown": PLAN_MARKDOWN}, "id": "call-save-plan"}
],
)
def _step_plan_complete(messages: list[BaseMessage]) -> AIMessage:
url = _plan_url_from_messages(messages) or "(plan link unavailable)"
return AIMessage(
content="Announcing the plan is ready.",
tool_calls=[
{
"name": "slack_thread_reply",
"args": {
"message": f"✅ The plan is ready for review: <{url}|open the plan>. "
"Take a look, leave comments, and approve it when you're happy."
},
"id": "call-plan-done",
}
],
)
def _step_plan_end(_messages: list[BaseMessage]) -> AIMessage:
return AIMessage(content="I'll wait for your review and approval before implementing.")
def build_plan_script() -> list[Any]:
return [
_step_enter_plan,
_step_plan_link,
_step_plan_research,
_step_save_plan,
_step_plan_complete,
_step_plan_end,
]
FOLLOW_UP_REPLY = "Thanks! The PR is ready for review — anything else you'd like changed?"
def _step_followup(_messages: list[BaseMessage]) -> AIMessage:
# A web/Slack follow-up after the PR exists: a plain reply, no new PR. Its
# content lands in the thread transcript the dashboard renders.
return AIMessage(content=FOLLOW_UP_REPLY)
def build_script() -> list[Any]:
return [_step_implement, _step_open_pr, _step_reply]
def build_followup_script() -> list[Any]:
return [_step_followup]
class FakeScriptedChatModel(BaseChatModel):
"""Returns the next scripted AIMessage based on how far the loop has run."""
script: list[Any] = []
@property
def _llm_type(self) -> str:
return "fake-scripted"
def bind_tools(self, tools: Any, **kwargs: Any) -> FakeScriptedChatModel: # noqa: ARG002
return self
def _generate(
self,
messages: list[BaseMessage],
stop: list[str] | None = None, # noqa: ARG002
run_manager: CallbackManagerForLLMRun | None = None, # noqa: ARG002
**kwargs: Any,
) -> ChatResult:
humans = [m for m in messages if isinstance(m, HumanMessage)]
first_text = _text(humans[0].content) if humans else ""
last_text = _text(humans[-1].content) if humans else ""
# Pick the script for the current turn by what the latest human asked.
if _is_approval(last_text):
script = build_script() # implement + open PR + reply
elif _is_revision(last_text):
script = build_plan_script() # re-plan after requested changes
elif _is_plan_request(first_text) and len(humans) <= 1:
script = build_plan_script() # first ask was to plan
elif len(humans) <= 1:
script = build_script()
else:
script = build_followup_script()
# Step within the *current* turn: AIMessages since the last human turn.
last_human = max(
(i for i, m in enumerate(messages) if isinstance(m, HumanMessage)), default=-1
)
step = sum(1 for m in messages[last_human + 1 :] if isinstance(m, AIMessage))
if step < len(script):
message = script[step](messages)
else:
message = AIMessage(content="All set — let me know if you'd like anything else.")
return ChatResult(generations=[ChatGeneration(message=message)])
def _is_plan_request(text: str) -> bool:
return "plan" in text.lower()
def _is_approval(text: str) -> bool:
t = text.lower()
return "approved" in t and "implement" in t
def _is_revision(text: str) -> bool:
t = text.lower()
return "needs changes" in t or "publish an updated plan" in t