@amg555/frameforge-mcp 2.7.6 → 2.7.8

package/.agent/skills/gstack-browse/test/security-classifier-download-cleanup.test.ts

@@ -1,138 +0,0 @@
-/**
- * Regression test for PR #1169 bug #6 — downloadFile opened a WriteStream to
- * `<dest>.tmp.<pid>` but never closed it on error paths. If the reader or
- * writer threw mid-download, the FD leaked and the half-written tmp could
- * be promoted by a retry's renameSync.
- *
- * The fix wraps the read loop in try/catch and runs `writer.destroy()` +
- * `fs.unlinkSync(tmp)` before rethrowing.
- *
- * Per codex's pushback, this test must exercise BOTH the reader-throws path
- * and the non-2xx-response path, and it must NOT assume the specific tmp
- * filename — only that no `<dest>.tmp.*` sibling remains.
- */
-import { describe, expect, test, beforeAll, afterAll, beforeEach, afterEach } from "bun:test";
-import * as fs from "node:fs";
-import * as path from "node:path";
-
-import { downloadFile } from "../src/security-classifier";
-
-function tmpSiblings(destDir: string, destBase: string): string[] {
-  if (!fs.existsSync(destDir)) return [];
-  return fs.readdirSync(destDir).filter((f) =>
-    f.startsWith(destBase + ".tmp.")
-  );
-}
-
-let FIXTURE_DIR = "";
-let originalFetch: typeof fetch;
-
-beforeAll(() => {
-  FIXTURE_DIR = fs.mkdtempSync(path.join(process.cwd(), "pr1169-dl-"));
-});
-
-afterAll(() => {
-  if (FIXTURE_DIR) {
-    fs.rmSync(FIXTURE_DIR, { recursive: true, force: true });
-  }
-});
-
-beforeEach(() => {
-  originalFetch = globalThis.fetch;
-});
-
-afterEach(() => {
-  globalThis.fetch = originalFetch;
-});
-
-describe("downloadFile error-path cleanup (PR #1169 bug #6)", () => {
-  test("reader rejects mid-stream: throws, no dest, no tmp sibling left", async () => {
-    const dest = path.join(FIXTURE_DIR, "reader-fail-model.bin");
-    const destDir = path.dirname(dest);
-    const destBase = path.basename(dest);
-
-    // Build a ReadableStream that emits one chunk then errors on second pull.
-    const body = new ReadableStream<Uint8Array>({
-      start(controller) {
-        controller.enqueue(new Uint8Array([1, 2, 3, 4]));
-      },
-      pull(controller) {
-        // Second pull triggers the failure path the fix protects against.
-        controller.error(new Error("simulated mid-stream read failure"));
-      },
-    });
-
-    // @ts-expect-error — overwrite global fetch for the test
-    globalThis.fetch = async () =>
-      new Response(body, { status: 200, statusText: "OK" });
-
-    await expect(downloadFile("https://example.com/model.bin", dest)).rejects.toThrow(
-      /simulated mid-stream read failure/
-    );
-
-    expect(fs.existsSync(dest)).toBe(false);
-    expect(tmpSiblings(destDir, destBase)).toEqual([]);
-  });
-
-  test("non-2xx response: throws with status, no tmp file created", async () => {
-    const dest = path.join(FIXTURE_DIR, "http500-model.bin");
-    const destDir = path.dirname(dest);
-    const destBase = path.basename(dest);
-
-    // @ts-expect-error — overwrite global fetch for the test
-    globalThis.fetch = async () =>
-      new Response("server boom", { status: 500, statusText: "Server Error" });
-
-    await expect(downloadFile("https://example.com/model.bin", dest)).rejects.toThrow(
-      /Failed to fetch.*500/
-    );
-
-    expect(fs.existsSync(dest)).toBe(false);
-    expect(tmpSiblings(destDir, destBase)).toEqual([]);
-  });
-
-  test("missing body: throws, no tmp file created", async () => {
-    const dest = path.join(FIXTURE_DIR, "nobody-model.bin");
-    const destDir = path.dirname(dest);
-    const destBase = path.basename(dest);
-
-    // Response with null body (some upstreams send this on edge errors).
-    // @ts-expect-error — overwrite global fetch for the test
-    globalThis.fetch = async () =>
-      new Response(null, { status: 200, statusText: "OK" });
-
-    await expect(downloadFile("https://example.com/model.bin", dest)).rejects.toThrow(
-      /Failed to fetch/
-    );
-
-    expect(fs.existsSync(dest)).toBe(false);
-    expect(tmpSiblings(destDir, destBase)).toEqual([]);
-  });
-
-  test("happy path: 2xx body completes, dest exists, no tmp sibling remains", async () => {
-    const dest = path.join(FIXTURE_DIR, "ok-model.bin");
-    const destDir = path.dirname(dest);
-    const destBase = path.basename(dest);
-
-    const body = new ReadableStream<Uint8Array>({
-      start(controller) {
-        controller.enqueue(new Uint8Array([9, 9, 9, 9]));
-        controller.close();
-      },
-    });
-
-    // @ts-expect-error — overwrite global fetch for the test
-    globalThis.fetch = async () =>
-      new Response(body, { status: 200, statusText: "OK" });
-
-    await downloadFile("https://example.com/model.bin", dest);
-
-    expect(fs.existsSync(dest)).toBe(true);
-    expect(tmpSiblings(destDir, destBase)).toEqual([]);
-    const written = fs.readFileSync(dest);
-    expect(Array.from(written)).toEqual([9, 9, 9, 9]);
-
-    fs.unlinkSync(dest);
-  });
-});
-

package/.agent/skills/gstack-browse/test/security-classifier.test.ts

@@ -1,29 +0,0 @@
-/**
- * Unit tests for browse/src/security-classifier.ts pure functions.
- *
- * Scope: functions that do NOT require model download or network access.
- * Model-dependent behavior (loadTestsavant inference via scanPageContent)
- * is covered by security-bench.test.ts and security-live-playwright.test.ts,
- * which gate on the cached model being present.
- */
-
-import { describe, test, expect } from 'bun:test';
-import { getClassifierStatus } from '../src/security-classifier';
-
-describe('getClassifierStatus — pre-load state', () => {
-  test('returns testsavant=off before loadTestsavant has been called', () => {
-    // Before any warmup has started, the classifier reports off.
-    // (This test runs in fresh-module state; if another test already
-    // loaded the classifier, status would be 'ok' — but this file runs
-    // before model loads in typical CI.)
-    const s = getClassifierStatus();
-    expect(['ok', 'degraded', 'off']).toContain(s.testsavant);
-  });
-
-  test('status shape contract — exactly one key (testsavant)', () => {
-    // The sidecar's `status` op serializes this object verbatim onto the
-    // NDJSON wire — pin the shape so accidental additions are deliberate.
-    const s = getClassifierStatus();
-    expect(Object.keys(s).sort()).toEqual(['testsavant']);
-  });
-});

package/.agent/skills/gstack-browse/test/security-integration.test.ts

@@ -1,184 +0,0 @@
-/**
- * Integration tests — the defense-in-depth contract.
- *
- * Pins the invariant that content-security.ts (L1-L3) and security.ts (L4-L6)
- * layers coexist and fire INDEPENDENTLY. If someone refactors thinking "the
- * ML classifier covers this, we can delete the regex layer," these tests
- * fail and stop the regression.
- *
- * This is the lighter version of CEO plan §E5. The full version requires
- * a live Playwright Page for hidden-element stripping and ARIA regex (those
- * operate on DOM). Here we test the pure-function cross-module surface:
- *   * content-security.ts datamark + envelope wrap + URL blocklist
- *   * security.ts canary + combineVerdict
- *   * Both modules on the same input produce orthogonal signals
- */
-
-import { describe, test, expect } from 'bun:test';
-import {
-  datamarkContent,
-  wrapUntrustedPageContent,
-  urlBlocklistFilter,
-  runContentFilters,
-  resetSessionMarker,
-} from '../src/content-security';
-import {
-  generateCanary,
-  checkCanaryInStructure,
-  combineVerdict,
-  type LayerSignal,
-} from '../src/security';
-
-describe('defense-in-depth — layer coexistence', () => {
-  test('canary survives when content is wrapped by content-security envelope', () => {
-    const c = generateCanary();
-    // Attacker got Claude to echo the canary into tool output text.
-    // content-security wraps that text in an envelope — canary still detectable.
-    const leakedText = `Here's my session token: ${c}`;
-    const wrapped = wrapUntrustedPageContent(leakedText, 'text');
-    expect(wrapped).toContain(c);
-    expect(checkCanaryInStructure(wrapped, c)).toBe(true);
-  });
-
-  test('datamarking does not corrupt canary detection', () => {
-    resetSessionMarker();
-    const c = generateCanary();
-    // datamarkContent inserts zero-width watermarks after every 3rd period.
-    // It must not break canary detection on text that contains the canary.
-    const leakedText = `Intro sentence. Middle sentence. Third sentence. Here is the token ${c}. More. More.`;
-    const marked = datamarkContent(leakedText);
-    expect(checkCanaryInStructure(marked, c)).toBe(true);
-  });
-
-  test('URL blocklist + canary are orthogonal — both can fire', () => {
-    const c = generateCanary();
-    // Attack: URL points to a blocklisted exfil domain AND carries the canary.
-    // content-security's urlBlocklistFilter catches the domain.
-    // security.ts's canary check catches the token.
-    // Neither depends on the other.
-    const attackContent = `See https://requestbin.com/?leak=${c} for details`;
-    const blockResult = urlBlocklistFilter(attackContent, 'https://requestbin.com/abc', 'text');
-    expect(blockResult.safe).toBe(false);
-    expect(blockResult.warnings.length).toBeGreaterThan(0);
-
-    const canaryHit = checkCanaryInStructure({ content: attackContent }, c);
-    expect(canaryHit).toBe(true);
-  });
-
-  test('benign content survives all layers — zero false positives', () => {
-    resetSessionMarker();
-    const c = generateCanary();
-    const benign = 'The Pacific Ocean is the largest ocean on Earth. It contains many islands. Marine biodiversity is rich.';
-
-    // Datamark doesn't add the canary
-    const marked = datamarkContent(benign);
-    expect(checkCanaryInStructure(marked, c)).toBe(false);
-
-    // Envelope wrap doesn't add the canary
-    const wrapped = wrapUntrustedPageContent(benign, 'text');
-    expect(checkCanaryInStructure(wrapped, c)).toBe(false);
-
-    // URL blocklist returns safe on a benign URL
-    const blockResult = urlBlocklistFilter(benign, 'https://wikipedia.org', 'text');
-    expect(blockResult.safe).toBe(true);
-  });
-
-  test('removing one signal does not zero-out the verdict (defense-in-depth)', () => {
-    // Attack scenario: page has hidden injection + exfil URL + canary leak
-    // across three different layers. Remove any ONE signal, other two still
-    // produce a BLOCK-worthy verdict.
-
-    const baseSignals: LayerSignal[] = [
-      // content at 0.95 clears the SOLO_CONTENT_BLOCK threshold (0.92) so
-      // that the "content alone" case below still hits single_layer_high.
-      { layer: 'testsavant_content', confidence: 0.95 },
-      { layer: 'transcript_classifier', confidence: 0.75, meta: { verdict: 'block' } },
-      { layer: 'canary', confidence: 1.0 },
-    ];
-
-    // All 3 signals → BLOCK (canary alone does it, ensemble also fires)
-    expect(combineVerdict(baseSignals).verdict).toBe('block');
-
-    // Remove canary → BLOCK via ensemble_agreement
-    expect(combineVerdict(baseSignals.slice(0, 2)).verdict).toBe('block');
-
-    // Remove transcript → BLOCK via canary still
-    expect(
-      combineVerdict([baseSignals[0], baseSignals[2]]).verdict,
-    ).toBe('block');
-
-    // Remove content → BLOCK via canary still
-    expect(
-      combineVerdict([baseSignals[1], baseSignals[2]]).verdict,
-    ).toBe('block');
-
-    // Remove canary AND transcript → only content WARN (single_layer_high
-    // — but content is 0.88 which is just above BLOCK threshold 0.85)
-    const contentOnly = combineVerdict([baseSignals[0]]);
-    expect(contentOnly.verdict).toBe('warn');
-    expect(contentOnly.reason).toBe('single_layer_high');
-  });
-
-  test('content-security filter runs through the registered pipeline', () => {
-    // Verify runContentFilters picks up the built-in url blocklist filter.
-    // If a future refactor accidentally unregisters it, this test fails.
-    const result = runContentFilters(
-      'page content',
-      'https://requestbin.com/webhook',
-      'text',
-    );
-    // urlBlocklistFilter is auto-registered on module load (content-security.ts:347)
-    expect(result.safe).toBe(false);
-    expect(result.warnings.some(w => w.includes('requestbin.com'))).toBe(true);
-  });
-
-  test('canary in envelope-escaped content still detectable', () => {
-    // The envelope uses "═══ BEGIN UNTRUSTED WEB CONTENT ═══" markers and
-    // escapes occurrences in content via zero-width space. This must NOT
-    // break canary detection — the canary isn't special to the escape logic.
-    const c = generateCanary();
-    const contentWithEnvelopeChars = `═══ BEGIN UNTRUSTED WEB CONTENT ═══ real payload: ${c}`;
-    const wrapped = wrapUntrustedPageContent(contentWithEnvelopeChars, 'text');
-    // The inner "BEGIN" gets escaped to "BEGIN UNTRUSTED WEB C{zwsp}ONTENT"
-    // but the canary remains intact
-    expect(checkCanaryInStructure(wrapped, c)).toBe(true);
-  });
-});
-
-describe('defense-in-depth — regression guards', () => {
-  test('combineVerdict cannot be bypassed via signal starvation', () => {
-    // Attacker might try to suppress classifier calls to avoid signals.
-    // Empty signals still yields safe verdict — fail-open is intentional.
-    // This is not a regression; it's the documented contract.
-    // Test asserts that a ZERO-confidence-everywhere state IS explicitly safe.
-    const allZeros: LayerSignal[] = [
-      { layer: 'testsavant_content', confidence: 0 },
-      { layer: 'transcript_classifier', confidence: 0 },
-      { layer: 'canary', confidence: 0 },
-      { layer: 'aria_regex', confidence: 0 },
-    ];
-    expect(combineVerdict(allZeros).verdict).toBe('safe');
-  });
-
-  test('negative confidences cannot trigger block', () => {
-    // Defensive: if some future refactor returns negative scores (bug),
-    // combineVerdict must not misinterpret them. Math-wise, negative values
-    // never exceed WARN/BLOCK thresholds, so this falls through to safe.
-    const weird: LayerSignal[] = [
-      { layer: 'testsavant_content', confidence: -0.5 },
-      { layer: 'transcript_classifier', confidence: -1.0 },
-    ];
-    expect(combineVerdict(weird).verdict).toBe('safe');
-  });
-
-  test('huge confidences (> 1.0) still behave predictably', () => {
-    // If a classifier ever returns > 1.0 (bug), we want the verdict to
-    // still be BLOCK, not crash or produce nonsense. Canary uses >= 1.0
-    // which matches; ML layers also register.
-    const overflow: LayerSignal[] = [
-      { layer: 'testsavant_content', confidence: 5.5 }, // above BLOCK, block-vote
-      { layer: 'transcript_classifier', confidence: 3.2, meta: { verdict: 'block' } }, // label-first block-vote
-    ];
-    expect(combineVerdict(overflow).verdict).toBe('block');
-  });
-});

package/.agent/skills/gstack-browse/test/security-live-playwright.test.ts

@@ -1,195 +0,0 @@
-/**
- * Live Playwright integration — defense-in-depth contract.
- *
- * Loads the existing injection-combined.html fixture in a real Chromium
- * instance and verifies BOTH module layers detect the attack independently:
- *
- *   L1-L3 (content-security.ts):
- *     * Hidden element stripping removes the .sneaky div
- *     * ARIA regex catches the aria-label injection
- *     * URL blocklist catches webhook.site / pipedream / requestbin
- *
- *   L4 (security.ts via security-classifier.ts):
- *     * ML classifier scores extracted text as INJECTION
- *
- * If content-security.ts ever gets refactored to remove a layer thinking
- * "the ML classifier covers it now," this test fails — the ML signal and
- * the deterministic signal must BOTH be present.
- *
- * ML portion is skipped gracefully if the model cache is absent (first-run
- * CI). To prime: `bun run browse/src/sidebar-agent.ts` for ~30s and kill it.
- */
-
-import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
-import * as fs from 'fs';
-import * as os from 'os';
-import * as path from 'path';
-import { startTestServer } from './test-server';
-import { BrowserManager } from '../src/browser-manager';
-
-// Per-FILE Chromium profile: this file launches an in-process persistent
-// context (BrowserManager.launch()), and sharing a profile dir with the
-// long-lived browse daemon a sibling file may have spawned kills one side's
-// Chromium (ProcessSingleton on user-data-dir). Scoped via hooks, never
-// module scope (see test/gstack-home-module-scope.test.ts's rationale).
-const ORIGINAL_CHROMIUM_PROFILE = process.env.CHROMIUM_PROFILE;
-let CHROMIUM_PROFILE_DIR: string | undefined;
-beforeAll(() => {
-  CHROMIUM_PROFILE_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-test-profile-'));
-  process.env.CHROMIUM_PROFILE = CHROMIUM_PROFILE_DIR;
-});
-afterAll(() => {
-  if (ORIGINAL_CHROMIUM_PROFILE === undefined) delete process.env.CHROMIUM_PROFILE;
-  else process.env.CHROMIUM_PROFILE = ORIGINAL_CHROMIUM_PROFILE;
-  if (CHROMIUM_PROFILE_DIR) { try { fs.rmSync(CHROMIUM_PROFILE_DIR, { recursive: true, force: true }); } catch {} }
-});
-
-import {
-  markHiddenElements,
-  getCleanTextWithStripping,
-  cleanupHiddenMarkers,
-  urlBlocklistFilter,
-} from '../src/content-security';
-
-// Check if TestSavantAI model cache exists. If missing, ML tests skip.
-const MODEL_CACHE = path.join(
-  os.homedir(),
-  '.gstack',
-  'models',
-  'testsavant-small',
-  'onnx',
-  'model.onnx',
-);
-// Opt-in only (SECURITY_BENCH=1), same rationale as security-bench.test.ts:
-// gating on model-cache existence alone auto-ran ONNX inference on any dev box
-// that ever warmed the classifier — and dlopen'ing onnxruntime inside a
-// `bun test --parallel` worker segfaults Bun intermittently (observed twice:
-// "panic: Segmentation fault ... a bug in Bun" followed by a crashed-worker
-// retry, sometimes wedging the run).
-const ML_AVAILABLE = process.env.SECURITY_BENCH === '1' && fs.existsSync(MODEL_CACHE);
-
-describe('defense-in-depth — live Playwright fixture', () => {
-  let testServer: ReturnType<typeof startTestServer>;
-  let bm: BrowserManager;
-  let baseUrl: string;
-
-  beforeAll(async () => {
-    testServer = startTestServer(0);
-    baseUrl = testServer.url;
-    bm = new BrowserManager();
-    await bm.launch();
-  });
-
-  afterAll(async () => {
-    try { testServer.server.stop(); } catch {}
-    // Close only this file's own browser — never process.exit(): bun test
-    // runs all files in one process, so a delayed exit kills the whole suite
-    // (see test/no-suicide-exit.test.ts). close() can hang when the browser
-    // already died, and its internal 5s timeout ties bun's 5s hook timeout —
-    // so race it at 3s and abandon; the child is reaped at process exit.
-    try { await Promise.race([bm?.close(), new Promise((resolve) => setTimeout(resolve, 3000))]); } catch {}
-  });
-
-  test('L2 — content-security.ts hidden-element stripper detects the .sneaky div', async () => {
-    const page = bm.getPage();
-    await page.goto(`${baseUrl}/injection-combined.html`, { waitUntil: 'domcontentloaded' });
-    const stripped = await markHiddenElements(page);
-    // Expect at least the sneaky div + the ARIA-injection link
-    expect(stripped.length).toBeGreaterThanOrEqual(1);
-    const sneakyMatch = stripped.some(s =>
-      s.toLowerCase().includes('opacity') || s.toLowerCase().includes('off-screen'),
-    );
-    expect(sneakyMatch).toBe(true);
-    await cleanupHiddenMarkers(page);
-  });
-
-  test('L2b — content-security.ts ARIA regex catches the injected aria-label', async () => {
-    const page = bm.getPage();
-    await page.goto(`${baseUrl}/injection-combined.html`, { waitUntil: 'domcontentloaded' });
-    const stripped = await markHiddenElements(page);
-    const ariaHits = stripped.filter(s => s.toLowerCase().includes('aria injection'));
-    expect(ariaHits.length).toBeGreaterThanOrEqual(1);
-    await cleanupHiddenMarkers(page);
-  });
-
-  test('L3 — content-security.ts URL blocklist fires on multiple exfil domains', async () => {
-    const page = bm.getPage();
-    await page.goto(`${baseUrl}/injection-combined.html`, { waitUntil: 'domcontentloaded' });
-    const html = await page.content();
-    const result = urlBlocklistFilter(html, `${baseUrl}/injection-combined.html`, 'html');
-    expect(result.safe).toBe(false);
-    // The fixture has webhook.site, pipedream.com, AND requestbin.com — expect at least 2 distinct hits
-    const distinctDomains = new Set(
-      result.warnings.map(w => (w.match(/(webhook\.site|pipedream\.com|requestbin\.com)/) ?? [])[1]).filter(Boolean),
-    );
-    expect(distinctDomains.size).toBeGreaterThanOrEqual(2);
-  });
-
-  test('L1 — stripped clean text excludes the .sneaky injection', async () => {
-    const page = bm.getPage();
-    await page.goto(`${baseUrl}/injection-combined.html`, { waitUntil: 'domcontentloaded' });
-    await markHiddenElements(page);
-    const cleanText = await getCleanTextWithStripping(page);
-    // Visible content preserved
-    expect(cleanText).toContain('Premium Widget');
-    // Hidden injection removed
-    expect(cleanText).not.toContain('SYSTEM OVERRIDE');
-    expect(cleanText).not.toContain('webhook.site/malicious');
-    await cleanupHiddenMarkers(page);
-  });
-
-  test('defense-in-depth — all deterministic layers (L1-L3) fire on the combined fixture', async () => {
-    // Pins the contract: removing any one content-security.ts layer breaks
-    // at least one signal in this test. This is the E5 regression anchor.
-    const page = bm.getPage();
-    await page.goto(`${baseUrl}/injection-combined.html`, { waitUntil: 'domcontentloaded' });
-    const stripped = await markHiddenElements(page);
-    const html = await page.content();
-    const urlResult = urlBlocklistFilter(html, `${baseUrl}/injection-combined.html`, 'html');
-
-    // L2: hidden element stripper
-    const hiddenCount = stripped.filter(s =>
-      s.toLowerCase().includes('opacity') || s.toLowerCase().includes('off-screen'),
-    ).length;
-    expect(hiddenCount).toBeGreaterThanOrEqual(1);
-
-    // L2b: ARIA regex
-    const ariaCount = stripped.filter(s => s.toLowerCase().includes('aria injection')).length;
-    expect(ariaCount).toBeGreaterThanOrEqual(1);
-
-    // L3: URL blocklist
-    expect(urlResult.safe).toBe(false);
-
-    await cleanupHiddenMarkers(page);
-  });
-
-  // L4 ML tests — skipped if model cache is absent
-  test.skipIf(!ML_AVAILABLE)('L4 — security.ts ML classifier flags the combined fixture text', async () => {
-    const page = bm.getPage();
-    await page.goto(`${baseUrl}/injection-combined.html`, { waitUntil: 'domcontentloaded' });
-    // Use RAW text (not stripped) so the ML layer sees what Claude would see
-    // in a naive pipeline — content-security.ts strips hidden content, but
-    // we want to assert the ML layer would ALSO catch it independently.
-    const rawText = await page.evaluate(() => document.body.innerText);
-
-    const { loadTestsavant, scanPageContent } = await import('../src/security-classifier');
-    await loadTestsavant();
-    const signal = await scanPageContent(rawText);
-    // Expect the classifier to flag some confidence > 0 (INJECTION label).
-    // The combined fixture has instruction-heavy content which TestSavantAI
-    // reliably flags at >= 0.5.
-    expect(signal.confidence).toBeGreaterThan(0);
-    expect(signal.layer).toBe('testsavant_content');
-  }, 60000); // allow WASM cold-start up to 60s
-
-  test.skipIf(!ML_AVAILABLE)('L4 — ML classifier does NOT flag the benign product description alone', async () => {
-    const benign = 'Premium Widget. $29.99. High-quality widget with premium features. Add to Cart.';
-    const { loadTestsavant, scanPageContent } = await import('../src/security-classifier');
-    await loadTestsavant();
-    const signal = await scanPageContent(benign);
-    // Product-catalog content should score low. Give generous headroom
-    // to avoid flakiness on model version drift — the contract is just
-    // "doesn't false-positive on obviously-clean ecommerce copy."
-    expect(signal.confidence).toBeLessThan(0.5);
-  }, 60000);
-});

package/.agent/skills/gstack-browse/test/security-sidecar-client.test.ts

@@ -1,66 +0,0 @@
-/**
- * Unit tests for browse/src/security-sidecar-client.ts.
- *
- * Tests the IPC client's behavior against a fake sidecar (a tiny Node
- * script we spawn) — verifies request/response id correlation, timeout,
- * payload cap, malformed-response handling, and circuit-breaker tripping.
- *
- * Does NOT exercise the real classifier — that lives behind the model
- * download and is covered by the existing security-classifier tests + the
- * E2E browser security suite.
- */
-
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { mkdtempSync, rmSync, writeFileSync } from "fs";
-import { tmpdir } from "os";
-import { join } from "path";
-
-let tmp: string;
-
-beforeEach(() => {
-  tmp = mkdtempSync(join(tmpdir(), "sidecar-client-test-"));
-});
-
-afterEach(async () => {
-  const mod = await import("../src/security-sidecar-client");
-  mod.resetSidecarForTests();
-  rmSync(tmp, { recursive: true, force: true });
-});
-
-describe("security-sidecar-client — payload cap", () => {
-  test("rejects requests over 64KB without spawning", async () => {
-    const { scanWithSidecar } = await import("../src/security-sidecar-client");
-    const huge = "a".repeat(65 * 1024);
-    await expect(scanWithSidecar(huge)).rejects.toThrow(/payload-too-large/);
-  });
-});
-
-describe("security-sidecar-client — availability probe", () => {
-  test("isSidecarAvailable returns a shape regardless of platform", async () => {
-    const { isSidecarAvailable } = await import("../src/security-sidecar-client");
-    const result = isSidecarAvailable();
-    expect(typeof result.available).toBe("boolean");
-    if (!result.available) {
-      // When unavailable, reason must explain why
-      expect(typeof result.reason).toBe("string");
-    }
-  });
-});
-
-describe("security-sidecar-client — circuit breaker after repeated failures", () => {
-  test("trips after RESPAWN_LIMIT failures and stays unavailable", async () => {
-    // We can simulate the breaker tripping by repeatedly calling against an
-    // invalid sidecar entry. The cleanest way without faking spawn() is to
-    // exercise the payload-too-large path which doesn't trip the breaker
-    // (it short-circuits before spawn), so this is an indirect proof:
-    // verify the timeout path can be exercised by an oversized small text
-    // and that retries don't crash.
-    const { scanWithSidecar } = await import("../src/security-sidecar-client");
-    const oversized = "x".repeat(70 * 1024);
-    for (let i = 0; i < 5; i += 1) {
-      await expect(scanWithSidecar(oversized)).rejects.toThrow(/payload-too-large/);
-    }
-    // Sentinel — if the loop above silently passed, fail fast.
-    expect(true).toBe(true);
-  });
-});