@aria-cli/tools 1.0.0

package/tests/registry.test.ts

@@ -0,0 +1,460 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { ToolRegistry } from "../src/registry/index.js";
+import type { Tool, ToolContext, ToolResult } from "../src/types.js";
+
+// Mock tool for testing
+const createMockTool = (name: string, category: "filesystem" | "shell" = "filesystem"): Tool => ({
+  name,
+  description: `Mock tool: ${name}`,
+  category,
+  parameters: { type: "object", properties: {} },
+  riskLevel: "safe",
+  execute: async (): Promise<ToolResult> => ({ success: true, message: "ok" }),
+});
+
+describe("ToolRegistry", () => {
+  let registry: ToolRegistry;
+
+  beforeEach(() => {
+    registry = new ToolRegistry();
+  });
+
+  describe("register", () => {
+    it("should register a tool", () => {
+      const tool = createMockTool("test_tool");
+      registry.register(tool);
+
+      expect(registry.get("test_tool")).toBe(tool);
+    });
+
+    it("should throw when registering duplicate without override", () => {
+      const tool = createMockTool("test_tool");
+      registry.register(tool);
+
+      expect(() => registry.register(tool)).toThrow("already registered");
+    });
+
+    it("should allow override with option", () => {
+      const tool1 = createMockTool("test_tool");
+      const tool2 = createMockTool("test_tool");
+      tool2.description = "Updated description";
+
+      registry.register(tool1);
+      registry.register(tool2, { override: true });
+
+      expect(registry.get("test_tool")?.description).toBe("Updated description");
+    });
+  });
+
+  describe("get", () => {
+    it("should return undefined for unregistered tool", () => {
+      expect(registry.get("nonexistent")).toBeUndefined();
+    });
+  });
+
+  describe("list", () => {
+    it("should list all tools", () => {
+      registry.register(createMockTool("tool1"));
+      registry.register(createMockTool("tool2"));
+
+      const tools = registry.list();
+      expect(tools).toHaveLength(2);
+    });
+
+    it("should filter by category", () => {
+      registry.register(createMockTool("fs_tool", "filesystem"));
+      registry.register(createMockTool("shell_tool", "shell"));
+
+      const fsTools = registry.list("filesystem");
+      expect(fsTools).toHaveLength(1);
+      expect(fsTools[0].name).toBe("fs_tool");
+    });
+  });
+
+  describe("has", () => {
+    it("should return true for registered tool", () => {
+      registry.register(createMockTool("test_tool"));
+      expect(registry.has("test_tool")).toBe(true);
+    });
+
+    it("should return false for unregistered tool", () => {
+      expect(registry.has("nonexistent")).toBe(false);
+    });
+  });
+
+  describe("unregister", () => {
+    it("should remove a registered tool and return true", () => {
+      registry.register(createMockTool("test_tool"));
+      const result = registry.unregister("test_tool");
+
+      expect(result).toBe(true);
+      expect(registry.has("test_tool")).toBe(false);
+    });
+
+    it("should return false for unregistered tool", () => {
+      expect(registry.unregister("nonexistent")).toBe(false);
+    });
+  });
+
+  describe("size", () => {
+    it("should return 0 for empty registry", () => {
+      expect(registry.size).toBe(0);
+    });
+
+    it("should return correct count after adding tools", () => {
+      registry.register(createMockTool("tool1"));
+      expect(registry.size).toBe(1);
+
+      registry.register(createMockTool("tool2"));
+      expect(registry.size).toBe(2);
+    });
+
+    it("should decrease after unregistering a tool", () => {
+      registry.register(createMockTool("tool1"));
+      registry.register(createMockTool("tool2"));
+      expect(registry.size).toBe(2);
+
+      registry.unregister("tool1");
+      expect(registry.size).toBe(1);
+    });
+  });
+
+  describe("clear", () => {
+    it("should remove all tools from registry", () => {
+      registry.register(createMockTool("tool1"));
+      registry.register(createMockTool("tool2"));
+      registry.register(createMockTool("tool3"));
+      expect(registry.size).toBe(3);
+
+      registry.clear();
+
+      expect(registry.size).toBe(0);
+      expect(registry.has("tool1")).toBe(false);
+      expect(registry.has("tool2")).toBe(false);
+      expect(registry.has("tool3")).toBe(false);
+    });
+
+    it("should work on empty registry", () => {
+      expect(registry.size).toBe(0);
+      registry.clear();
+      expect(registry.size).toBe(0);
+    });
+  });
+
+  describe("getAll", () => {
+    it("should return empty array for empty registry", () => {
+      expect(registry.getAll()).toEqual([]);
+    });
+
+    it("should return all registered tools", () => {
+      registry.register(createMockTool("test_tool"));
+      registry.register(createMockTool("another_tool"));
+      const tools = registry.getAll();
+      expect(tools).toHaveLength(2);
+      expect(tools.map((t) => t.name)).toContain("test_tool");
+      expect(tools.map((t) => t.name)).toContain("another_tool");
+    });
+  });
+
+  describe("getToolInfos", () => {
+    it("should return empty array for empty registry", () => {
+      expect(registry.getToolInfos()).toEqual([]);
+    });
+
+    it("should convert tools to ToolInfo format", () => {
+      registry.register(createMockTool("test_tool"));
+      const infos = registry.getToolInfos();
+      expect(infos).toHaveLength(1);
+      expect(infos[0]).toMatchObject({
+        name: "test_tool",
+        description: expect.any(String),
+        requiresConfirmation: expect.any(Boolean),
+        parameters: expect.any(Array),
+      });
+    });
+
+    it("should set requiresConfirmation based on riskLevel", () => {
+      const dangerousTool = createMockTool("dangerous_tool");
+      dangerousTool.riskLevel = "dangerous";
+      registry.register(dangerousTool);
+      const infos = registry.getToolInfos();
+      expect(infos[0].requiresConfirmation).toBe(true);
+    });
+
+    it("should extract parameters from JSON schema", () => {
+      const toolWithParams = createMockTool("params_tool");
+      toolWithParams.parameters = {
+        type: "object",
+        properties: {
+          path: { type: "string", description: "File path" },
+          content: { type: "string" },
+        },
+        required: ["path"],
+      };
+      registry.register(toolWithParams);
+      const infos = registry.getToolInfos();
+      expect(infos[0].parameters).toHaveLength(2);
+      expect(infos[0].parameters).toContainEqual({
+        name: "path",
+        type: "string",
+        required: true,
+        description: "File path",
+      });
+    });
+  });
+
+  describe("Dynamic Memoria tool execution", () => {
+    // Helper to create a mock Memoria instance
+    const createMockMemoria = (knowledge: Array<Record<string, unknown>>) => ({
+      recallTools: vi.fn().mockResolvedValue(knowledge),
+      rememberTool: vi.fn().mockResolvedValue("k1"),
+      rememberSkill: vi.fn().mockResolvedValue("skill-id"),
+      recallSkills: vi.fn().mockResolvedValue([]),
+      getSkill: vi.fn().mockResolvedValue(null),
+      recordSkillExecution: vi.fn().mockResolvedValue({ id: "exec-1", skillId: "s1", success: true, timestamp: new Date() }),
+    });
+
+    // Helper to create a minimal ToolContext for testing
+    const createTestContext = (): ToolContext => ({
+      workingDir: "/tmp/test",
+      env: { NODE_ENV: "test" },
+      confirm: async () => true,
+    });
+
+    it("skips a knowledge-only tool loaded from Memoria", async () => {
+      const toolDef = {
+        description: "Returns deployment checklist",
+        category: "meta",
+        parameters: { type: "object", properties: {} },
+        riskLevel: "safe",
+        knowledge:
+          "1. Run tests\n2. Build artifacts\n3. Deploy to staging\n4. Verify health checks",
+      };
+
+      const mockMemoria = createMockMemoria([
+        {
+          id: "k1",
+          name: "deploy_checklist",
+          ...toolDef,
+        },
+      ]);
+
+      await registry.discoverFromMemoria(mockMemoria);
+      const tool = registry.get("deploy_checklist");
+      expect(tool).toBeUndefined();
+    });
+
+    it("passes input and context to Memoria-loaded tool", async () => {
+      // Tool with a response template that interpolates input fields
+      const toolDef = {
+        description: "Greets a user by name",
+        category: "meta",
+        parameters: {
+          type: "object",
+          properties: {
+            name: { type: "string", description: "User name" },
+            greeting: { type: "string", description: "Greeting word" },
+          },
+        },
+        riskLevel: "safe",
+        responseTemplate: "{{greeting}}, {{name}}! Welcome aboard.",
+      };
+
+      const mockMemoria = createMockMemoria([
+        {
+          id: "k2",
+          name: "greeter",
+          ...toolDef,
+        },
+      ]);
+
+      await registry.discoverFromMemoria(mockMemoria);
+      const tool = registry.get("greeter");
+      expect(tool).toBeDefined();
+
+      const result = await tool!.execute({ name: "Alice", greeting: "Hello" }, createTestContext());
+
+      expect(result.success).toBe(true);
+      expect(result.data).toBe("Hello, Alice! Welcome aboard.");
+    });
+
+    it("skips discovery entries with no executable content", async () => {
+      const toolDef = {
+        description: "",
+        category: "meta",
+        parameters: { type: "object", properties: {} },
+        riskLevel: "safe",
+        knowledge: null,
+        responseTemplate: null,
+      };
+
+      const mockMemoria = createMockMemoria([
+        {
+          id: "k3",
+          name: "broken_tool",
+          ...toolDef,
+        },
+      ]);
+
+      await registry.discoverFromMemoria(mockMemoria);
+      expect(registry.get("broken_tool")).toBeUndefined();
+    });
+
+    it("does not register non-executable description-only entries", async () => {
+      // Tool definition with only description and no knowledge/template fields
+      const toolDef = {
+        description: "This tool helps with code formatting. Use prettier for JS files.",
+        category: "code",
+        parameters: { type: "object", properties: {} },
+        riskLevel: "safe",
+        // No knowledge field, no responseTemplate - just a description
+      };
+
+      const mockMemoria = createMockMemoria([
+        {
+          id: "k4",
+          name: "format_helper",
+          ...toolDef,
+        },
+      ]);
+
+      await registry.discoverFromMemoria(mockMemoria);
+      expect(registry.get("format_helper")).toBeUndefined();
+    });
+
+    it("Memoria tool with JSON schema validates input", async () => {
+      // Tool with required parameters defined in its schema
+      const toolDef = {
+        description: "Looks up a user by ID",
+        category: "data",
+        parameters: {
+          type: "object",
+          properties: {
+            userId: { type: "string", description: "The user ID to look up" },
+          },
+          required: ["userId"],
+        },
+        riskLevel: "safe",
+        responseTemplate: "User {{userId}} lookup succeeded",
+      };
+
+      const mockMemoria = createMockMemoria([
+        {
+          id: "k5",
+          name: "user_lookup",
+          ...toolDef,
+        },
+      ]);
+
+      await registry.discoverFromMemoria(mockMemoria);
+      const tool = registry.get("user_lookup");
+      expect(tool).toBeDefined();
+
+      // Execute without required parameter - should fail validation
+      const resultMissing = await tool!.execute({}, createTestContext());
+      expect(resultMissing.success).toBe(false);
+      expect(resultMissing.message).toContain("userId");
+
+      // Execute with required parameter - should succeed
+      const resultValid = await tool!.execute({ userId: "usr-123" }, createTestContext());
+      expect(resultValid.success).toBe(true);
+      expect(resultValid.data).toBe("User usr-123 lookup succeeded");
+    });
+  });
+
+  describe("dispose", () => {
+    it("should call disconnectAll on the MCP client and clear tools", async () => {
+      // Register some regular tools
+      registry.register(createMockTool("tool1"));
+      registry.register(createMockTool("tool2"));
+      expect(registry.size).toBe(2);
+
+      // Mock an MCPClient with disconnectAll
+      const mockDisconnectAll = vi.fn().mockResolvedValue(undefined);
+      const mockMCPClient = {
+        disconnectAll: mockDisconnectAll,
+        listAllTools: vi.fn().mockResolvedValue([]),
+        listAllResources: vi.fn().mockResolvedValue([]),
+        listAllPrompts: vi.fn().mockResolvedValue([]),
+        on: vi.fn(),
+      };
+
+      // Access private field to inject mock MCP client
+      (registry as unknown as { mcpClient: unknown }).mcpClient = mockMCPClient;
+
+      await registry.dispose();
+
+      expect(mockDisconnectAll).toHaveBeenCalledOnce();
+      expect(registry.size).toBe(0);
+      expect(registry.getMCPClient()).toBeUndefined();
+    });
+
+    it("should be safe to call multiple times (idempotent)", async () => {
+      registry.register(createMockTool("tool1"));
+
+      const mockDisconnectAll = vi.fn().mockResolvedValue(undefined);
+      const mockMCPClient = {
+        disconnectAll: mockDisconnectAll,
+        listAllTools: vi.fn().mockResolvedValue([]),
+        listAllResources: vi.fn().mockResolvedValue([]),
+        listAllPrompts: vi.fn().mockResolvedValue([]),
+        on: vi.fn(),
+      };
+      (registry as unknown as { mcpClient: unknown }).mcpClient = mockMCPClient;
+
+      await registry.dispose();
+      // Second call - mcpClient is already undefined, should not throw
+      await registry.dispose();
+
+      expect(mockDisconnectAll).toHaveBeenCalledOnce();
+      expect(registry.size).toBe(0);
+    });
+
+    it("should handle registry with no MCP connections gracefully", async () => {
+      registry.register(createMockTool("tool1"));
+
+      // No MCP client set - dispose should still clear tools without error
+      await registry.dispose();
+
+      expect(registry.size).toBe(0);
+      expect(registry.getMCPClient()).toBeUndefined();
+    });
+
+    it("should be callable via Symbol.asyncDispose", async () => {
+      registry.register(createMockTool("tool1"));
+
+      const mockDisconnectAll = vi.fn().mockResolvedValue(undefined);
+      const mockMCPClient = {
+        disconnectAll: mockDisconnectAll,
+        listAllTools: vi.fn().mockResolvedValue([]),
+        listAllResources: vi.fn().mockResolvedValue([]),
+        listAllPrompts: vi.fn().mockResolvedValue([]),
+        on: vi.fn(),
+      };
+      (registry as unknown as { mcpClient: unknown }).mcpClient = mockMCPClient;
+
+      // Call via Symbol.asyncDispose directly
+      await registry[Symbol.asyncDispose]();
+
+      expect(mockDisconnectAll).toHaveBeenCalledOnce();
+      expect(registry.size).toBe(0);
+    });
+
+    it("should handle MCP disconnectAll rejection gracefully", async () => {
+      registry.register(createMockTool("tool1"));
+
+      const mockDisconnectAll = vi.fn().mockRejectedValue(new Error("connection already dead"));
+      const mockMCPClient = {
+        disconnectAll: mockDisconnectAll,
+        listAllTools: vi.fn().mockResolvedValue([]),
+        listAllResources: vi.fn().mockResolvedValue([]),
+        listAllPrompts: vi.fn().mockResolvedValue([]),
+        on: vi.fn(),
+      };
+      (registry as unknown as { mcpClient: unknown }).mcpClient = mockMCPClient;
+
+      // Should propagate the error - caller handles it
+      await expect(registry.dispose()).rejects.toThrow("connection already dead");
+    });
+  });
+});

package/tests/security/dns-pinning.test.ts

@@ -0,0 +1,162 @@
+import * as dns from "node:dns";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const hoisted = vi.hoisted(() => ({
+  mockAgentInstances: [] as Array<{ options: any; close: ReturnType<typeof vi.fn> }>,
+}));
+
+vi.mock("undici", () => {
+  class MockAgent {
+    options: any;
+    close = vi.fn().mockResolvedValue(undefined);
+
+    constructor(options: any) {
+      this.options = options;
+      hoisted.mockAgentInstances.push(this);
+    }
+  }
+
+  return {
+    Agent: MockAgent,
+  };
+});
+
+import { createPinnedAgent, fetchWithDnsPinning } from "../../src/security/dns-pinning.js";
+
+describe("createPinnedAgent", () => {
+  it("returns an Agent-like object for a valid IPv4 address", () => {
+    const agent = createPinnedAgent("93.184.216.34", 4);
+    expect(agent).toBeDefined();
+    expect(typeof agent).toBe("object");
+  });
+
+  it("handles IPv6 address with family 6", () => {
+    const agent = createPinnedAgent("2001:4860:4860::8888", 6);
+    expect(agent).toBeDefined();
+    expect(typeof agent).toBe("object");
+  });
+});
+
+describe("fetchWithDnsPinning", () => {
+  let originalFetch: typeof globalThis.fetch;
+
+  beforeEach(() => {
+    originalFetch = globalThis.fetch;
+    vi.restoreAllMocks();
+    vi.clearAllMocks();
+    hoisted.mockAgentInstances.length = 0;
+    vi.stubGlobal("fetch", vi.fn().mockResolvedValue(new Response("ok", { status: 200 })));
+  });
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+  });
+
+  it("rejects non-http protocols before any DNS/fetch work", async () => {
+    await expect(fetchWithDnsPinning("ftp://example.com/file.txt", {})).rejects.toThrow(
+      "Invalid URL protocol",
+    );
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+  });
+
+  it("rejects hostnames when any resolved address is private", async () => {
+    vi.spyOn(dns.promises, "lookup").mockResolvedValue([
+      { address: "93.184.216.34", family: 4 },
+      { address: "169.254.169.254", family: 4 },
+    ] as never);
+
+    await expect(fetchWithDnsPinning("https://mixed.example.com/data", {})).rejects.toThrow(
+      /private network address 169\.254\.169\.254/i,
+    );
+    expect(globalThis.fetch).not.toHaveBeenCalled();
+  });
+
+  it("pins the fetch to the resolved public address", async () => {
+    vi.spyOn(dns.promises, "lookup").mockResolvedValue([
+      { address: "93.184.216.34", family: 4 },
+      { address: "93.184.216.35", family: 4 },
+    ] as never);
+
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockImplementation(async (_url: string, init?: RequestInit) => {
+        const dispatcher = (init as (RequestInit & { dispatcher?: unknown }) | undefined)
+          ?.dispatcher as {
+          options?: {
+            connect?: {
+              lookup?: (
+                hostname: string,
+                options: unknown,
+                callback: (
+                  err: Error | null,
+                  results: Array<{ address: string; family: number }>,
+                ) => void,
+              ) => void;
+            };
+          };
+        };
+        const lookup = dispatcher.options?.connect?.lookup;
+        let pinnedAddress = "";
+        let pinnedFamily = 0;
+        lookup?.("example.com", {}, (_err, results) => {
+          const entry = (results as Array<{ address: string; family: number }>)[0];
+          pinnedAddress = entry.address;
+          pinnedFamily = entry.family;
+        });
+        return new Response(`${pinnedAddress}/${pinnedFamily}`, { status: 200 });
+      }),
+    );
+
+    const response = await fetchWithDnsPinning("https://example.com/data", {});
+    const body = await response.text();
+
+    expect(body).toBe("93.184.216.34/4");
+    expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+    expect(hoisted.mockAgentInstances).toHaveLength(1);
+    expect(hoisted.mockAgentInstances[0]?.close).toHaveBeenCalledTimes(1);
+  });
+
+  it("falls back to another resolved address when the first one is unreachable", async () => {
+    vi.spyOn(dns.promises, "lookup").mockResolvedValue([
+      { address: "2001:db8::1", family: 6 },
+      { address: "93.184.216.34", family: 4 },
+    ] as never);
+
+    const mockFetch = vi.fn().mockImplementation(async (_url: string, init?: RequestInit) => {
+      const dispatcher = (init as (RequestInit & { dispatcher?: unknown }) | undefined)
+        ?.dispatcher as {
+        options?: {
+          connect?: {
+            lookup?: (
+              hostname: string,
+              options: unknown,
+              callback: (err: Error | null, address: string, family: number) => void,
+            ) => void;
+          };
+        };
+      };
+      const lookup = dispatcher.options?.connect?.lookup;
+      let pinnedAddress = "";
+      lookup?.("example.com", {}, (_err, results) => {
+        pinnedAddress = (results as Array<{ address: string; family: number }>)[0].address;
+      });
+
+      if (pinnedAddress === "2001:db8::1") {
+        const cause = Object.assign(new Error("connect ENETUNREACH"), { code: "ENETUNREACH" });
+        const err = new TypeError("fetch failed");
+        (err as Error & { cause?: unknown }).cause = cause;
+        throw err;
+      }
+
+      return new Response("ok", { status: 200 });
+    });
+    vi.stubGlobal("fetch", mockFetch);
+
+    const response = await fetchWithDnsPinning("https://example.com/data", {});
+    expect(response.status).toBe(200);
+    expect(mockFetch).toHaveBeenCalledTimes(2);
+    expect(hoisted.mockAgentInstances).toHaveLength(2);
+    expect(hoisted.mockAgentInstances[0]?.close).toHaveBeenCalledTimes(1);
+    expect(hoisted.mockAgentInstances[1]?.close).toHaveBeenCalledTimes(1);
+  });
+});