test: add docker cli-backend smoke

2026-05-03 23:20:21 +00:00 · 2026-03-26 16:47:57 +00:00
parent e1f0a85128
commit f0991aab57
5 changed files with 172 additions and 4 deletions
--- a/docs/help/testing.md
+++ b/docs/help/testing.md
@@ -296,6 +296,19 @@ OPENCLAW_LIVE_CLI_BACKEND=1 \
  pnpm test:live src/gateway/gateway-cli-backend.live.test.ts
 ```

+Docker recipe:
+
+```bash
+pnpm test:docker:live-cli-backend
+```
+
+Notes:
+
+- The Docker runner lives at `scripts/test-live-cli-backend-docker.sh`.
+- It runs the live CLI-backend smoke inside the repo Docker image as the non-root `node` user, because Claude CLI rejects `bypassPermissions` when invoked as root.
+- For `claude-cli`, it installs the Linux `@anthropic-ai/claude-code` package into a cached writable prefix at `OPENCLAW_DOCKER_CLI_TOOLS_DIR` (default: `~/.cache/openclaw/docker-cli-tools`).
+- It copies `~/.claude` into the container when available, but on machines where Claude auth is backed by `ANTHROPIC_API_KEY`, it also preserves `ANTHROPIC_API_KEY` / `ANTHROPIC_API_KEY_OLD` for the child Claude CLI via `OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV`.
+
 ### Recommended live recipes

 Narrow, explicit allowlists are fastest and least flaky:
@@ -433,6 +446,7 @@ These Docker runners split into two buckets:
 The live-model Docker runners also bind-mount only the needed CLI auth homes (or all supported ones when the run is not narrowed), then copy them into the container home before the run so external-CLI OAuth can refresh tokens without mutating the host auth store:

 - Direct models: `pnpm test:docker:live-models` (script: `scripts/test-live-models-docker.sh`)
+- CLI backend smoke: `pnpm test:docker:live-cli-backend` (script: `scripts/test-live-cli-backend-docker.sh`)
 - Gateway + dev agent: `pnpm test:docker:live-gateway` (script: `scripts/test-live-gateway-models-docker.sh`)
 - Open WebUI live smoke: `pnpm test:docker:openwebui` (script: `scripts/e2e/openwebui-docker.sh`)
 - Onboarding wizard (TTY, full scaffolding): `pnpm test:docker:onboard` (script: `scripts/e2e/onboard-docker.sh`)
@@ -469,6 +483,7 @@ Useful env vars:
 - `OPENCLAW_CONFIG_DIR=...` (default: `~/.openclaw`) mounted to `/home/node/.openclaw`
 - `OPENCLAW_WORKSPACE_DIR=...` (default: `~/.openclaw/workspace`) mounted to `/home/node/.openclaw/workspace`
 - `OPENCLAW_PROFILE_FILE=...` (default: `~/.profile`) mounted to `/home/node/.profile` and sourced before running tests
+- `OPENCLAW_DOCKER_CLI_TOOLS_DIR=...` (default: `~/.cache/openclaw/docker-cli-tools`) mounted to `/home/node/.npm-global` for cached CLI installs inside Docker
 - External CLI auth dirs under `$HOME` are mounted read-only under `/host-auth/...`, then copied into `/home/node/...` before tests start
  - Default: mount all supported dirs (`.codex`, `.claude`, `.minimax`)
  - Narrowed provider runs mount only the needed dirs inferred from `OPENCLAW_LIVE_PROVIDERS` / `OPENCLAW_LIVE_GATEWAY_PROVIDERS`
--- a/package.json
+++ b/package.json
@@ -716,6 +716,7 @@
    "test:docker:cleanup": "bash scripts/test-cleanup-docker.sh",
    "test:docker:doctor-switch": "bash scripts/e2e/doctor-install-switch-docker.sh",
    "test:docker:gateway-network": "bash scripts/e2e/gateway-network-docker.sh",
+    "test:docker:live-cli-backend": "bash scripts/test-live-cli-backend-docker.sh",
    "test:docker:live-gateway": "bash scripts/test-live-gateway-models-docker.sh",
    "test:docker:live-models": "bash scripts/test-live-models-docker.sh",
    "test:docker:onboard": "bash scripts/e2e/onboard-docker.sh",
--- a/scripts/lib/live-docker-auth.sh
+++ b/scripts/lib/live-docker-auth.sh
@@ -21,7 +21,7 @@ openclaw_live_should_include_auth_dir_for_provider() {
  local provider
  provider="$(openclaw_live_trim "${1:-}")"
  case "$provider" in
-    anthropic)
+    anthropic | claude-cli)
      printf '%s\n' ".claude"
      ;;
    codex-cli | openai-codex)
--- a/scripts/test-live-cli-backend-docker.sh
+++ b/scripts/test-live-cli-backend-docker.sh
@@ -0,0 +1,140 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+source "$ROOT_DIR/scripts/lib/live-docker-auth.sh"
+IMAGE_NAME="${OPENCLAW_IMAGE:-openclaw:local}"
+LIVE_IMAGE_NAME="${OPENCLAW_LIVE_IMAGE:-${IMAGE_NAME}-live}"
+CONFIG_DIR="${OPENCLAW_CONFIG_DIR:-$HOME/.openclaw}"
+WORKSPACE_DIR="${OPENCLAW_WORKSPACE_DIR:-$HOME/.openclaw/workspace}"
+PROFILE_FILE="${OPENCLAW_PROFILE_FILE:-$HOME/.profile}"
+CLI_TOOLS_DIR="${OPENCLAW_DOCKER_CLI_TOOLS_DIR:-$HOME/.cache/openclaw/docker-cli-tools}"
+DEFAULT_MODEL="claude-cli/claude-sonnet-4-6"
+CLI_MODEL="${OPENCLAW_LIVE_CLI_BACKEND_MODEL:-$DEFAULT_MODEL}"
+CLI_PROVIDER="${CLI_MODEL%%/*}"
+CLI_DISABLE_MCP_CONFIG="${OPENCLAW_LIVE_CLI_BACKEND_DISABLE_MCP_CONFIG:-}"
+
+if [[ -z "$CLI_PROVIDER" || "$CLI_PROVIDER" == "$CLI_MODEL" ]]; then
+  CLI_PROVIDER="claude-cli"
+fi
+if [[ "$CLI_PROVIDER" == "claude-cli" && -z "$CLI_DISABLE_MCP_CONFIG" ]]; then
+  CLI_DISABLE_MCP_CONFIG="0"
+fi
+
+mkdir -p "$CLI_TOOLS_DIR"
+
+PROFILE_MOUNT=()
+if [[ -f "$PROFILE_FILE" ]]; then
+  PROFILE_MOUNT=(-v "$PROFILE_FILE":/home/node/.profile:ro)
+fi
+
+AUTH_DIRS=()
+if [[ -n "${OPENCLAW_DOCKER_AUTH_DIRS:-}" ]]; then
+  while IFS= read -r auth_dir; do
+    [[ -n "$auth_dir" ]] || continue
+    AUTH_DIRS+=("$auth_dir")
+  done < <(openclaw_live_collect_auth_dirs)
+else
+  while IFS= read -r auth_dir; do
+    [[ -n "$auth_dir" ]] || continue
+    AUTH_DIRS+=("$auth_dir")
+  done < <(openclaw_live_collect_auth_dirs_from_csv "$CLI_PROVIDER")
+fi
+AUTH_DIRS_CSV="$(openclaw_live_join_csv "${AUTH_DIRS[@]}")"
+
+EXTERNAL_AUTH_MOUNTS=()
+for auth_dir in "${AUTH_DIRS[@]}"; do
+  host_path="$HOME/$auth_dir"
+  if [[ -d "$host_path" ]]; then
+    EXTERNAL_AUTH_MOUNTS+=(-v "$host_path":/host-auth/"$auth_dir":ro)
+  fi
+done
+
+read -r -d '' LIVE_TEST_CMD <<'EOF' || true
+set -euo pipefail
+[ -f "$HOME/.profile" ] && source "$HOME/.profile" || true
+export PATH="$HOME/.npm-global/bin:$PATH"
+IFS=',' read -r -a auth_dirs <<<"${OPENCLAW_DOCKER_AUTH_DIRS_RESOLVED:-}"
+for auth_dir in "${auth_dirs[@]}"; do
+  [ -n "$auth_dir" ] || continue
+  if [ -d "/host-auth/$auth_dir" ]; then
+    mkdir -p "$HOME/$auth_dir"
+    cp -R "/host-auth/$auth_dir/." "$HOME/$auth_dir"
+    chmod -R u+rwX "$HOME/$auth_dir" || true
+  fi
+done
+provider="${OPENCLAW_DOCKER_CLI_BACKEND_PROVIDER:-claude-cli}"
+if [ "$provider" = "claude-cli" ]; then
+  if [ -z "${OPENCLAW_LIVE_CLI_BACKEND_COMMAND:-}" ]; then
+    export OPENCLAW_LIVE_CLI_BACKEND_COMMAND="$HOME/.npm-global/bin/claude"
+  fi
+  if [ ! -x "${OPENCLAW_LIVE_CLI_BACKEND_COMMAND}" ]; then
+    npm_config_prefix="$HOME/.npm-global" npm install -g @anthropic-ai/claude-code
+  fi
+  if [ -z "${OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV:-}" ]; then
+    export OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV='["ANTHROPIC_API_KEY","ANTHROPIC_API_KEY_OLD"]'
+  fi
+  claude auth status || true
+fi
+tmp_dir="$(mktemp -d)"
+cleanup() {
+  rm -rf "$tmp_dir"
+}
+trap cleanup EXIT
+tar -C /src \
+  --exclude=.git \
+  --exclude=node_modules \
+  --exclude=dist \
+  --exclude=ui/dist \
+  --exclude=ui/node_modules \
+  -cf - . | tar -C "$tmp_dir" -xf -
+ln -s /app/node_modules "$tmp_dir/node_modules"
+ln -s /app/dist "$tmp_dir/dist"
+if [ -d /app/dist-runtime/extensions ]; then
+  export OPENCLAW_BUNDLED_PLUGINS_DIR=/app/dist-runtime/extensions
+elif [ -d /app/dist/extensions ]; then
+  export OPENCLAW_BUNDLED_PLUGINS_DIR=/app/dist/extensions
+fi
+cd "$tmp_dir"
+pnpm test:live src/gateway/gateway-cli-backend.live.test.ts
+EOF
+
+echo "==> Build live-test image: $LIVE_IMAGE_NAME (target=build)"
+docker build --target build -t "$LIVE_IMAGE_NAME" -f "$ROOT_DIR/Dockerfile" "$ROOT_DIR"
+
+echo "==> Run CLI backend live test in Docker"
+echo "==> Model: $CLI_MODEL"
+echo "==> Provider: $CLI_PROVIDER"
+echo "==> External auth dirs: ${AUTH_DIRS_CSV:-none}"
+docker run --rm -t \
+  -u node \
+  --entrypoint bash \
+  -e ANTHROPIC_API_KEY \
+  -e ANTHROPIC_API_KEY_OLD \
+  -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \
+  -e HOME=/home/node \
+  -e NODE_OPTIONS=--disable-warning=ExperimentalWarning \
+  -e OPENCLAW_SKIP_CHANNELS=1 \
+  -e OPENCLAW_VITEST_FS_MODULE_CACHE=0 \
+  -e OPENCLAW_DOCKER_AUTH_DIRS_RESOLVED="$AUTH_DIRS_CSV" \
+  -e OPENCLAW_DOCKER_CLI_BACKEND_PROVIDER="$CLI_PROVIDER" \
+  -e OPENCLAW_LIVE_TEST=1 \
+  -e OPENCLAW_LIVE_CLI_BACKEND=1 \
+  -e OPENCLAW_LIVE_CLI_BACKEND_MODEL="$CLI_MODEL" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_COMMAND="${OPENCLAW_LIVE_CLI_BACKEND_COMMAND:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_ARGS="${OPENCLAW_LIVE_CLI_BACKEND_ARGS:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_CLEAR_ENV="${OPENCLAW_LIVE_CLI_BACKEND_CLEAR_ENV:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV="${OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_DISABLE_MCP_CONFIG="$CLI_DISABLE_MCP_CONFIG" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_RESUME_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_RESUME_PROBE:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_IMAGE_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_IMAGE_PROBE:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_IMAGE_ARG="${OPENCLAW_LIVE_CLI_BACKEND_IMAGE_ARG:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_IMAGE_MODE="${OPENCLAW_LIVE_CLI_BACKEND_IMAGE_MODE:-}" \
+  -v "$ROOT_DIR":/src:ro \
+  -v "$CONFIG_DIR":/home/node/.openclaw \
+  -v "$WORKSPACE_DIR":/home/node/.openclaw/workspace \
+  -v "$CLI_TOOLS_DIR":/home/node/.npm-global \
+  "${EXTERNAL_AUTH_MOUNTS[@]}" \
+  "${PROFILE_MOUNT[@]}" \
+  "$LIVE_IMAGE_NAME" \
+  -lc "$LIVE_TEST_CMD"
--- a/src/gateway/gateway-cli-backend.live.test.ts
+++ b/src/gateway/gateway-cli-backend.live.test.ts
@@ -167,6 +167,13 @@ async function connectClient(params: { url: string; token: string }) {

 describeLive("gateway live (cli backend)", () => {
  it("runs the agent pipeline against the local CLI backend", async () => {
+    const preservedEnv = new Set(
+      parseJsonStringArray(
+        "OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV",
+        process.env.OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV,
+      ) ?? [],
+    );
+
    clearRuntimeConfigSnapshot();
    const previous = {
      configPath: process.env.OPENCLAW_CONFIG_PATH,
@@ -183,8 +190,12 @@ describeLive("gateway live (cli backend)", () => {
    process.env.OPENCLAW_SKIP_GMAIL_WATCHER = "1";
    process.env.OPENCLAW_SKIP_CRON = "1";
    process.env.OPENCLAW_SKIP_CANVAS_HOST = "1";
-    delete process.env.ANTHROPIC_API_KEY;
-    delete process.env.ANTHROPIC_API_KEY_OLD;
+    if (!preservedEnv.has("ANTHROPIC_API_KEY")) {
+      delete process.env.ANTHROPIC_API_KEY;
+    }
+    if (!preservedEnv.has("ANTHROPIC_API_KEY_OLD")) {
+      delete process.env.ANTHROPIC_API_KEY_OLD;
+    }

    const token = `test-${randomUUID()}`;
    process.env.OPENCLAW_GATEWAY_TOKEN = token;
@@ -225,6 +236,7 @@ describeLive("gateway live (cli backend)", () => {
        "OPENCLAW_LIVE_CLI_BACKEND_CLEAR_ENV",
        process.env.OPENCLAW_LIVE_CLI_BACKEND_CLEAR_ENV,
      ) ?? (providerId === "claude-cli" ? DEFAULT_CLEAR_ENV : []);
+    const filteredCliClearEnv = cliClearEnv.filter((name) => !preservedEnv.has(name));
    const cliImageArg = process.env.OPENCLAW_LIVE_CLI_BACKEND_IMAGE_ARG?.trim() || undefined;
    const cliImageMode = parseImageMode(process.env.OPENCLAW_LIVE_CLI_BACKEND_IMAGE_MODE);

@@ -260,7 +272,7 @@ describeLive("gateway live (cli backend)", () => {
            [providerId]: {
              command: cliCommand,
              args: cliArgs,
-              clearEnv: cliClearEnv.length > 0 ? cliClearEnv : undefined,
+              clearEnv: filteredCliClearEnv.length > 0 ? filteredCliClearEnv : undefined,
              systemPromptWhen: "never",
              ...(cliImageArg ? { imageArg: cliImageArg, imageMode: cliImageMode } : {}),
            },