@amg555/frameforge-mcp 2.7.6 → 2.7.7

package/.agent/skills/gstack-ios-qa/daemon/test/audit.test.ts

@@ -1,111 +0,0 @@
-// Audit + attempts logging tests. Codex-flagged: identity must be hashed in
-// attempts.jsonl (no raw identity leak), rotation works, sanitize-replacer
-// strips lone surrogates.
-
-import { describe, test, expect, beforeEach, afterEach } from 'bun:test';
-import { mkdtempSync, rmSync, readFileSync, writeFileSync, statSync } from 'fs';
-import { tmpdir } from 'os';
-import { join } from 'path';
-import { writeAudit, writeAttempt, sanitizeReplacer } from '../src/audit';
-
-let tmpDir: string;
-
-beforeEach(() => {
-  tmpDir = mkdtempSync(join(tmpdir(), 'ios-qa-audit-'));
-});
-
-afterEach(() => {
-  rmSync(tmpDir, { recursive: true, force: true });
-});
-
-describe('writeAudit', () => {
-  test('appends a JSONL row', async () => {
-    const path = join(tmpDir, 'audit.jsonl');
-    await writeAudit({
-      ts: '2026-05-18T00:00:00Z',
-      identity: 'u@e.com',
-      device_udid: 'UDID-1',
-      endpoint: 'POST /tap',
-      session_id: 'S1',
-      capability: 'interact',
-      request_id: 'req-1',
-      status: 200,
-    }, path);
-    const lines = readFileSync(path, 'utf-8').trim().split('\n');
-    expect(lines).toHaveLength(1);
-    expect(JSON.parse(lines[0]!).identity).toBe('u@e.com');
-  });
-});
-
-describe('writeAttempt', () => {
-  test('hashes raw identity with the device salt (no raw leak)', async () => {
-    const auditPath = join(tmpDir, 'attempts.jsonl');
-    await writeAttempt({
-      rawIdentity: 'attacker@evil.com',
-      endpoint: 'POST /auth/mint',
-      reason: 'identity_not_allowed',
-      path: auditPath,
-    });
-    const lines = readFileSync(auditPath, 'utf-8').trim().split('\n');
-    expect(lines).toHaveLength(1);
-    const row = JSON.parse(lines[0]!);
-    expect(row.reason).toBe('identity_not_allowed');
-    expect(row.identity_canon).not.toBe('attacker@evil.com');
-    expect(row.identity_canon).toMatch(/^[a-f0-9]{16}$/); // 16-char hex
-  });
-
-  test('does NOT log the raw identity anywhere in the row', async () => {
-    const path = join(tmpDir, 'attempts.jsonl');
-    await writeAttempt({
-      rawIdentity: 'secret@example.com',
-      endpoint: 'POST /auth/mint',
-      reason: 'identity_not_allowed',
-      path,
-    });
-    const raw = readFileSync(path, 'utf-8');
-    expect(raw).not.toContain('secret@example.com');
-  });
-});
-
-describe('sanitizeReplacer', () => {
-  // Helper: check every UTF-16 code unit in a string. Returns true iff any
-  // unpaired surrogate is present. More reliable than .toContain('\uD800')
-  // since Bun's matcher does UTF-8 byte comparison for non-ASCII.
-  const hasUnpairedSurrogate = (s: string): boolean => {
-    for (let i = 0; i < s.length; i++) {
-      const c = s.charCodeAt(i);
-      if (c >= 0xD800 && c <= 0xDBFF) {
-        const next = s.charCodeAt(i + 1);
-        if (!(next >= 0xDC00 && next <= 0xDFFF)) return true;
-        i++; // skip the valid pair
-      } else if (c >= 0xDC00 && c <= 0xDFFF) {
-        return true;
-      }
-    }
-    return false;
-  };
-
-  test('replaces lone high surrogates with U+FFFD', () => {
-    const out = JSON.stringify({ s: 'before\uD800after' }, sanitizeReplacer);
-    expect(hasUnpairedSurrogate(out)).toBe(false);
-    expect(out.includes('�')).toBe(true);
-  });
-
-  test('replaces lone low surrogates with U+FFFD', () => {
-    const out = JSON.stringify({ s: 'before\uDC00after' }, sanitizeReplacer);
-    expect(hasUnpairedSurrogate(out)).toBe(false);
-    expect(out.includes('�')).toBe(true);
-  });
-
-  test('preserves valid surrogate pairs', () => {
-    // 😀 = U+1F600 = surrogate pair D83D DE00. Must stay intact.
-    const out = JSON.stringify({ s: '😀' }, sanitizeReplacer);
-    expect(out.includes('😀')).toBe(true);
-    expect(hasUnpairedSurrogate(out)).toBe(false);
-    expect(out.includes('�')).toBe(false);
-  });
-
-  test('passes through non-string values', () => {
-    expect(JSON.stringify({ n: 42, b: true, x: null }, sanitizeReplacer)).toBe('{"n":42,"b":true,"x":null}');
-  });
-});

package/.agent/skills/gstack-ios-qa/daemon/test/auth-mint.test.ts

@@ -1,106 +0,0 @@
-// /auth/mint endpoint tests. Codex-flagged: identity allowlist, capability
-// cap, rate-limit cap, self-service vs owner-granted distinction.
-
-import { describe, test, expect, beforeEach } from 'bun:test';
-import { mkdtempSync, rmSync } from 'fs';
-import { tmpdir } from 'os';
-import { join } from 'path';
-import { mintForCaller } from '../src/auth-mint';
-import { SessionTokenStore } from '../src/session-tokens';
-import { grantIdentity } from '../src/allowlist';
-import { usePrivateStateRoot } from '../../../test/helpers/private-state-root';
-
-usePrivateStateRoot();
-
-let tmpDir: string;
-let listPath: string;
-
-beforeEach(() => {
-  tmpDir = mkdtempSync(join(tmpdir(), 'ios-qa-mint-'));
-  listPath = join(tmpDir, 'allowlist.json');
-});
-
-describe('mintForCaller', () => {
-  test('rejects unknown identity', async () => {
-    const store = new SessionTokenStore();
-    const r = await mintForCaller({
-      callerIdentity: 'stranger@example.com',
-      request: { capability: 'observe' },
-      tokenStore: store,
-      allowlistPath: listPath,
-    });
-    expect(r).toEqual({ error: 'identity_not_allowed' });
-  });
-
-  test('mints at the requested tier when allowlisted at that tier', async () => {
-    await grantIdentity({ identity: 'u@e.com', capability: 'mutate', path: listPath });
-    const store = new SessionTokenStore();
-    const r = await mintForCaller({
-      callerIdentity: 'u@e.com',
-      request: { capability: 'interact' },
-      tokenStore: store,
-      allowlistPath: listPath,
-    });
-    expect('error' in r).toBe(false);
-    if ('error' in r) throw new Error('unexpected');
-    expect(r.capability).toBe('mutate'); // returns the granted tier (higher covers interact)
-    expect(r.session_token.length).toBeGreaterThan(0);
-  });
-
-  test('refuses to mint above the allowlisted tier', async () => {
-    await grantIdentity({ identity: 'observe-only@e.com', capability: 'observe', path: listPath });
-    const store = new SessionTokenStore();
-    const r = await mintForCaller({
-      callerIdentity: 'observe-only@e.com',
-      request: { capability: 'mutate' },
-      tokenStore: store,
-      allowlistPath: listPath,
-    });
-    expect(r).toEqual({ error: 'capability_insufficient' });
-  });
-
-  test('rate limits hit at 11th mint per identity', async () => {
-    await grantIdentity({ identity: 'spammer@e.com', capability: 'observe', path: listPath });
-    const store = new SessionTokenStore();
-    let lastError: unknown = null;
-    let success = 0;
-    for (let i = 0; i < 11; i++) {
-      const r = await mintForCaller({
-        callerIdentity: 'spammer@e.com',
-        request: { capability: 'observe' },
-        tokenStore: store,
-        allowlistPath: listPath,
-      });
-      if ('error' in r) lastError = r;
-      else success++;
-    }
-    expect(success).toBe(10);
-    expect(lastError).toEqual({ error: 'rate_limited' });
-  });
-
-  test('expired allowlist entries reject the mint', async () => {
-    // Write an expired entry directly.
-    const { saveAllowlist } = await import('../src/allowlist');
-    await saveAllowlist({
-      version: 1,
-      entries: [{
-        identity: 'expired@e.com',
-        capabilities: ['restore'],
-        expires_at: new Date(Date.now() - 60_000).toISOString(),
-      }],
-    }, listPath);
-    const store = new SessionTokenStore();
-    const r = await mintForCaller({
-      callerIdentity: 'expired@e.com',
-      request: { capability: 'observe' },
-      tokenStore: store,
-      allowlistPath: listPath,
-    });
-    expect(r).toEqual({ error: 'identity_not_allowed' });
-  });
-});
-
-import { afterEach } from 'bun:test';
-afterEach(() => {
-  rmSync(tmpDir, { recursive: true, force: true });
-});

package/.agent/skills/gstack-ios-qa/daemon/test/cli-mint.test.ts

@@ -1,120 +0,0 @@
-// CLI tests for gstack-ios-qa-mint. Invokes the bash launcher end-to-end
-// so we catch any breakage between bin/, the entry-point resolution, and
-// the underlying allowlist primitives. Runs against a temp allowlist path
-// so the user's real ~/.gstack/ios-qa-allowlist.json is untouched.
-
-import { describe, test, expect, beforeEach } from 'bun:test';
-import { mkdtempSync, rmSync, readFileSync, statSync, existsSync, chmodSync } from 'fs';
-import { tmpdir } from 'os';
-import { join } from 'path';
-import { spawnSync } from 'child_process';
-
-const ROOT = join(import.meta.dir, '..', '..', '..');
-const MINT_BIN = join(ROOT, 'bin', 'gstack-ios-qa-mint');
-const DAEMON_BIN = join(ROOT, 'bin', 'gstack-ios-qa-daemon');
-
-function runMint(args: string[]) {
-  return spawnSync(MINT_BIN, args, { stdio: 'pipe', encoding: 'utf-8', timeout: 30_000 });
-}
-
-describe('bin/gstack-ios-qa-mint launcher', () => {
-  let tmpDir: string;
-  let listPath: string;
-
-  beforeEach(() => {
-    tmpDir = mkdtempSync(join(tmpdir(), 'ios-qa-cli-mint-'));
-    listPath = join(tmpDir, 'allowlist.json');
-  });
-
-  test('--help prints usage without touching allowlist', () => {
-    const r = runMint(['--help']);
-    expect(r.status).toBe(0);
-    expect(r.stdout).toContain('gstack-ios-qa-mint');
-    expect(r.stdout).toContain('grant');
-    expect(r.stdout).toContain('revoke');
-    expect(r.stdout).toContain('list');
-  });
-
-  test('grant + list + revoke roundtrip', () => {
-    const grant = runMint([
-      'grant', '--remote', 'alice@example.com',
-      '--capability', 'interact',
-      '--allowlist-path', listPath,
-    ]);
-    expect(grant.status).toBe(0);
-    expect(grant.stdout).toContain('granted alice@example.com');
-
-    // File must exist and be mode 0600 (owner-only). Mint creates the
-    // parent directory with 0700 + writes the file at 0600.
-    expect(existsSync(listPath)).toBe(true);
-    const mode = statSync(listPath).mode & 0o777;
-    expect(mode).toBe(0o600);
-
-    const list = runMint(['list', '--allowlist-path', listPath]);
-    expect(list.status).toBe(0);
-    expect(list.stdout).toContain('alice@example.com');
-    expect(list.stdout).toContain('cap=interact');
-
-    const revoke = runMint(['revoke', '--remote', 'alice@example.com', '--allowlist-path', listPath]);
-    expect(revoke.status).toBe(0);
-
-    const listAfter = runMint(['list', '--allowlist-path', listPath]);
-    expect(listAfter.status).toBe(0);
-    expect(listAfter.stdout).toContain('(empty allowlist)');
-  });
-
-  test('grant without --remote exits non-zero with clear error', () => {
-    const r = runMint(['grant', '--capability', 'interact', '--allowlist-path', listPath]);
-    expect(r.status).not.toBe(0);
-    expect(r.stderr).toContain('--remote');
-  });
-
-  test('rejects unknown capability', () => {
-    const r = runMint([
-      'grant', '--remote', 'alice@example.com',
-      '--capability', 'godmode',
-      '--allowlist-path', listPath,
-    ]);
-    expect(r.status).not.toBe(0);
-    expect(r.stderr).toContain('unknown capability');
-  });
-
-  test('grant with --ttl persists expires_at', () => {
-    const r = runMint([
-      'grant', '--remote', 'tag:ci',
-      '--capability', 'mutate',
-      '--ttl', '3600',
-      '--note', 'nightly',
-      '--allowlist-path', listPath,
-    ]);
-    expect(r.status).toBe(0);
-    const raw = readFileSync(listPath, 'utf-8');
-    const parsed = JSON.parse(raw);
-    expect(parsed.entries[0].identity).toBe('tag:ci');
-    expect(parsed.entries[0].capabilities).toEqual(['mutate']);
-    expect(parsed.entries[0].expires_at).toBeTruthy();
-    expect(parsed.entries[0].note).toBe('nightly');
-  });
-});
-
-describe('bin/gstack-ios-qa-daemon launcher', () => {
-  test('launcher is executable', () => {
-    expect(existsSync(DAEMON_BIN)).toBe(true);
-    const mode = statSync(DAEMON_BIN).mode & 0o111;
-    expect(mode).not.toBe(0);
-  });
-
-  test('reports missing bun runtime cleanly', () => {
-    // Simulate `bun` missing by giving PATH only /usr/bin + /bin (so bash
-    // resolves but `command -v bun` does not). The launcher's preflight
-    // check should fire BEFORE attempting to exec bun.
-    const r = spawnSync(DAEMON_BIN, [], {
-      stdio: 'pipe',
-      encoding: 'utf-8',
-      env: { PATH: '/usr/bin:/bin' },
-      timeout: 30_000,
-    });
-    expect(r.status).not.toBe(0);
-    expect(r.stderr).toContain('bun');
-  });
-});