Files
Triple-C/app/src/components/projects/home/ContainerMigrationBanner.test.tsx
T
shadow-testandClaude Opus 5 d42b741337 Migrate a project onto a new base image without losing its volumes
Projects were pinned to the image they were first created from. Both
create paths preferred triple-c-snapshot-<id>:latest whenever it
existed, and container_needs_recreation compared the container's live
image against the triple-c.image label — which create_container wrote
from the same image it created from. A tautology that could never fire.
The only escape was Reset, which calls remove_project_volumes and
destroys the login, skills and transcripts.

Measured consequences on this host: real projects are missing socat (so
the auth bridge cannot tunnel) and bubblewrap (so sandbox mode does not
work), plus Mission Control and triple-c-sso-refresh, and sit 61
packages behind the base including ca-certificates, openssl and curl.

Detection. create_container now writes triple-c.base-image-id (the image
ID, not RepoDigests, which local-built and custom images do not have)
and triple-c.create-image. container_needs_recreation takes the expected
create-image and compares against the latter, so the check means
something. base-image-id is deliberately NOT compared: a base bump would
otherwise silently recreate from the snapshot, consuming the "you should
migrate" signal without migrating. Staleness is surfaced, never acted on
automatically.

Migration keeps the volumes. /home/claude and ~/.claude are volumes and
the image's copy is seed-only — permanently masked after first mount —
so the login, ~/.claude.json, skills, transcripts, scheduler tasks, SSH
keys, cargo, uv, ruff and Claude Code itself re-attach untouched. Only
root-level state is rebuilt: apt packages are replayed against the new
base rather than copied, so no stale libc is dragged forward, and
/usr/local, /opt and the non-bind-mounted parts of /workspace are copied
verbatim with tar --skip-old-files so they can never clobber a newer
base binary.

docker diff is not used: on a snapshot-derived container it reports only
changes since the last commit. Raw image-vs-image diffing is filtered
through dpkg ownership because it otherwise lies — 8,677 raw path
differences on a real project reduced to 2 genuinely user-authored
files, both loose /workspace-root files.

Crash safety. snapshot:latest keeps pointing at the old image until the
final commit, so any crash before it self-heals on next start. Later
crashes are caught by reconcile_project_statuses. The rollback pin is a
docker tag: 0.057s and 0 bytes. Rollback restores the system layer only
— volumes are never touched — and the UI says so rather than implying a
time machine.

Fixes an infinite recreation loop shipped with the MCP removal. docker
commit propagates labels to the image, so a container created from a
snapshot inherited its non-empty triple-c.mcp-fingerprint and the
one-shot shim recreated it again on every start, forever. Lineage labels
are now always written explicitly.

Documents the second, separate bug this uncovered: Dockerfile changes
under /home/claude never reach an existing project, migration or not,
because the volume masks them. Anything that must stay upgradable
belongs in /usr/local/bin or /opt, or must be seeded by entrypoint.sh.

145 Rust tests, 227 frontend tests, both builds clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-09 18:19:12 -07:00

307 lines
11 KiB
TypeScript

import { describe, it, expect, vi } from "vitest";
import { fireEvent, render, screen } from "@testing-library/react";
import ContainerMigrationBanner from "./ContainerMigrationBanner";
import type { ContainerMigration } from "../../../hooks/useContainerMigration";
import type {
ContainerStaleness,
MigrationReport,
} from "../../../lib/types";
const FRESH: ContainerStaleness = {
stale: false,
known: true,
base_image_id: "sha256:aaa",
current_base_image_id: "sha256:aaa",
snapshot_created_at: "2026-03-01T09:00:00Z",
missing_paths: [],
missing_features: [],
apt_delta: [],
npm_global_delta: [],
verbatim_paths: [],
outdated_package_count: 0,
probe_error: null,
};
const STALE: ContainerStaleness = {
...FRESH,
stale: true,
current_base_image_id: "sha256:bbb",
missing_paths: ["/usr/bin/socat", "/usr/bin/bwrap"],
missing_features: [
"Host-browser opening",
"Auth bridge tunnel (socat)",
"Mission Control",
],
apt_delta: ["socat", "bubblewrap"],
outdated_package_count: 61,
};
function migration(overrides: Partial<ContainerMigration> = {}): ContainerMigration {
return {
staleness: null,
probing: false,
running: false,
recovered: false,
interrupted: null,
report: null,
log: [],
phaseMessage: null,
busy: false,
start: vi.fn(async () => {}),
resume: vi.fn(async () => {}),
keep: vi.fn(async () => {}),
rollback: vi.fn(async () => {}),
dismiss: vi.fn(),
refresh: vi.fn(async () => {}),
...overrides,
};
}
function renderBanner(m: ContainerMigration, canMigrate = true) {
const onOpen = vi.fn();
const { container } = render(
<ContainerMigrationBanner migration={m} canMigrate={canMigrate} onOpen={onOpen} />,
);
return { onOpen, container };
}
describe("ContainerMigrationBanner", () => {
it("renders nothing when the container is on the current base", () => {
const { container } = renderBanner(migration({ staleness: FRESH }));
expect(container).toBeEmptyDOMElement();
});
it("renders nothing before the probe has returned", () => {
const { container } = renderBanner(migration({ staleness: null }));
expect(container).toBeEmptyDOMElement();
});
it("leads with the missing features rather than image digests", () => {
renderBanner(migration({ staleness: STALE }));
expect(screen.getByText(/Container base is out of date/i)).toBeInTheDocument();
expect(
screen.getByText(
/Host-browser opening, Auth bridge tunnel \(socat\) and Mission Control/,
),
).toBeInTheDocument();
expect(
screen.getByText(/61 packages differ from the versions on the current base/i),
).toBeInTheDocument();
// Digests are evidence, not the message.
expect(screen.queryByText(/sha256/)).not.toBeInTheDocument();
});
it("does not claim the packages are behind, only that they differ", () => {
renderBanner(migration({ staleness: STALE }));
// `outdated_package_count` is a drift measure; the backend explicitly does
// not promise every one of them is newer.
expect(screen.queryByText(/behind on security updates/i)).not.toBeInTheDocument();
});
it("says the container was probed when there is no base-image label", () => {
// `stale` is always false when `known` is false — an unknown lineage is not
// a claim of staleness — but the probe's own findings still have to show.
renderBanner(
migration({ staleness: { ...STALE, known: false, stale: false } }),
);
expect(screen.getByText(/probed directly/i)).toBeInTheDocument();
expect(screen.getByText(/The probe found these missing/i)).toBeInTheDocument();
// No version comparison happened, so none is implied.
expect(screen.queryByText(/Running on a saved image/i)).not.toBeInTheDocument();
expect(screen.queryByText(/out of date/i)).not.toBeInTheDocument();
});
it("stays quiet for an unlabelled container the probe found nothing wrong with", () => {
const { container } = renderBanner(
migration({
staleness: {
...FRESH,
known: false,
stale: false,
outdated_package_count: 3,
},
}),
);
expect(container).toBeEmptyDOMElement();
});
it("disables the action and explains why while the container is running", () => {
renderBanner(migration({ staleness: STALE }), false);
expect(
screen.getByRole("button", { name: /Update container base/i }),
).toBeDisabled();
expect(screen.getByText(/Stop the container to update its base/i)).toBeInTheDocument();
});
it("keeps reporting an in-flight run after the modal is closed", () => {
renderBanner(
migration({
staleness: STALE,
running: true,
phaseMessage: "Reinstalling socat…",
}),
);
expect(screen.getByText(/Updating container base/i)).toBeInTheDocument();
expect(screen.getByText("Reinstalling socat…")).toBeInTheDocument();
expect(screen.getByRole("button", { name: /Show progress/i })).toBeInTheDocument();
});
it("surfaces a run recovered from a crash", () => {
renderBanner(migration({ staleness: STALE, running: true, recovered: true }));
expect(
screen.getByText(/A container base update was already running/i),
).toBeInTheDocument();
expect(
screen.getByText(/still in progress when the app last closed/i),
).toBeInTheDocument();
});
it("does not let an interrupted migration hide behind a plain staleness notice", () => {
const m = migration({
staleness: STALE,
interrupted: {
phase: "interrupted",
from_image_id: "sha256:aaa",
to_base_id: "sha256:bbb",
started_at: "2026-08-09T10:00:00Z",
report: null,
rollback_image: "triple-c-snapshot-p1:pre-migration-1754733600",
staging_path: null,
options: { replay_packages: true, copy_paths: false, keep_rollback: true },
plan: null,
},
});
renderBanner(m);
expect(
screen.getByText(/A container base update was interrupted/i),
).toBeInTheDocument();
expect(screen.getByText(/part-way onto the new base/i)).toBeInTheDocument();
// The plain "Update container base…" call to action must not be what is
// offered here — the container is mid-swap, so it is resume or roll back.
expect(
screen.queryByRole("button", { name: /Update container base/i }),
).not.toBeInTheDocument();
fireEvent.click(screen.getByRole("button", { name: "Resume update" }));
expect(m.resume).toHaveBeenCalledTimes(1);
expect(screen.getByRole("button", { name: "Roll back" })).toBeInTheDocument();
});
it("offers no rollback for an interrupted run that kept no rollback image", () => {
renderBanner(
migration({
staleness: STALE,
interrupted: {
phase: "interrupted",
from_image_id: "sha256:aaa",
to_base_id: "sha256:bbb",
started_at: "2026-08-09T10:00:00Z",
report: null,
rollback_image: null,
staging_path: null,
options: { replay_packages: true, copy_paths: false, keep_rollback: false },
plan: null,
},
}),
);
expect(screen.queryByRole("button", { name: "Roll back" })).not.toBeInTheDocument();
expect(screen.getByRole("button", { name: "Resume update" })).toBeInTheDocument();
});
describe("the report", () => {
const CLEAN: MigrationReport = {
phase: "succeeded",
packages_requested: ["socat", "bubblewrap"],
packages_installed: [
"socat",
"bubblewrap",
"ca-certificates",
"openssl",
"curl",
"jq",
"ripgrep",
"unzip",
],
packages_failed: [],
paths_copied: [],
features_restored: [
"Host-browser opening",
"Auth bridge tunnel (socat)",
"Sandbox mode (bubblewrap)",
"Mission Control",
],
rollback_available: true,
message: "",
};
const PARTIAL: MigrationReport = {
phase: "partial",
packages_requested: ["socat", "bubblewrap", "libfoo-dev"],
packages_installed: ["socat"],
packages_failed: [
{ name: "bubblewrap", reason: "held back by apt-mark" },
{ name: "libfoo-dev", reason: "no installation candidate in noble" },
],
paths_copied: [],
features_restored: ["Auth bridge tunnel (socat)"],
rollback_available: true,
message: "",
};
it("reports a clean run with counts and both choices", () => {
renderBanner(migration({ staleness: FRESH, report: CLEAN }));
expect(screen.getByText(/8 packages reinstalled/i)).toBeInTheDocument();
expect(screen.getByText(/4 features restored/i)).toBeInTheDocument();
expect(screen.getByRole("button", { name: "Keep" })).toBeInTheDocument();
expect(screen.getByRole("button", { name: "Roll back" })).toBeInTheDocument();
});
it("names every failed package and why, and does not read as a success", () => {
renderBanner(migration({ staleness: STALE, report: PARTIAL }));
expect(screen.getByText(/Updated, but not completely/i)).toBeInTheDocument();
expect(screen.getByText("bubblewrap")).toBeInTheDocument();
expect(screen.getByText(/held back by apt-mark/)).toBeInTheDocument();
expect(screen.getByText("libfoo-dev")).toBeInTheDocument();
expect(
screen.getByText(/no installation candidate in noble/),
).toBeInTheDocument();
// And the exact line that finishes the job by hand.
expect(
screen.getByText("sudo apt-get install -y bubblewrap libfoo-dev"),
).toBeInTheDocument();
expect(
screen.getByRole("button", { name: /Copy apt-get line/i }),
).toBeInTheDocument();
});
it("says a failed run has already been restored, and offers no rollback", () => {
renderBanner(
migration({
staleness: STALE,
report: {
phase: "failed",
packages_requested: [],
packages_installed: [],
packages_failed: [],
paths_copied: [],
features_restored: [],
rollback_available: false,
message:
"Update failed at replay. Your container has been restored to its previous state.",
},
}),
);
expect(screen.getByText(/Update failed at replay/i)).toBeInTheDocument();
expect(screen.queryByRole("button", { name: "Roll back" })).not.toBeInTheDocument();
expect(screen.getByRole("button", { name: "Dismiss" })).toBeInTheDocument();
});
it("does not describe rollback as a time machine", () => {
renderBanner(migration({ staleness: FRESH, report: CLEAN }));
expect(
screen.getByText(/Rollback restores the system layer only/i),
).toBeInTheDocument();
expect(screen.getByText(/Volumes are never touched/i)).toBeInTheDocument();
});
});
});