@asterxsk/kiln 0.3.0 → 0.4.2

package/agent.bak.20260905-190020/extensions/pi-web-access/test/ssrf-protection.test.mjs

@@ -1,456 +0,0 @@
-import assert from "node:assert/strict";
-import { test } from "node:test";
-
-import { fetchRemoteUrl, validateRemoteUrl } from "../ssrf-protection.ts";
-import { runWithProxy } from "../utils.ts";
-
-const publicLookup = async () => [{ address: "93.184.216.34", family: 4 }];
-
-async function rejectsInternal(url) {
-	await assert.rejects(
-		validateRemoteUrl(url, { lookup: publicLookup }),
-		/internal|Blocked/,
-		`${url} should be blocked`,
-	);
-}
-
-test("validateRemoteUrl blocks localhost, loopback, link-local, private, and metadata targets", async () => {
-	await rejectsInternal("http://localhost/");
-	await rejectsInternal("http://127.0.0.1/");
-	await rejectsInternal("http://10.0.0.1/");
-	await rejectsInternal("http://172.16.0.1/");
-	await rejectsInternal("http://192.168.1.1/");
-	await rejectsInternal("http://169.254.169.254/latest/meta-data/");
-	await rejectsInternal("http://0.0.0.0/");
-	await rejectsInternal("http://[::1]/");
-	await rejectsInternal("http://[fe80::1]/");
-	await rejectsInternal("http://[fd00::1]/");
-	await rejectsInternal("http://[::ffff:127.0.0.1]/");
-});
-
-test("validateRemoteUrl blocks encoded and alternate loopback IPv4 forms", async () => {
-	await rejectsInternal("http://2130706433/");
-	await rejectsInternal("http://0177.0.0.1/");
-	await rejectsInternal("http://0x7f.0.0.1/");
-	await rejectsInternal("http://127.1/");
-});
-
-test("validateRemoteUrl blocks hostnames that resolve to private addresses", async () => {
-	await assert.rejects(
-		validateRemoteUrl("https://example.test/", {
-			lookup: async () => [{ address: "192.168.0.2", family: 4 }],
-		}),
-		/Blocked internal address for example\.test: 192\.168\.0\.2/,
-	);
-
-	await assert.rejects(
-		validateRemoteUrl("https://example.test/", {
-			lookup: async () => [{ address: "93.184.216.34", family: 4 }, { address: "fd00::1", family: 6 }],
-		}),
-		/Blocked internal address for example\.test: fd00::1/,
-	);
-});
-
-test("loopback opt-in does not allow arbitrary hostnames that resolve to loopback", async () => {
-	await assert.rejects(
-		validateRemoteUrl("https://example.test/", {
-			allowLoopback: true,
-			lookup: async () => [{ address: "127.0.0.1", family: 4 }],
-		}),
-		/Blocked internal address for example\.test: 127\.0\.0\.1/,
-	);
-});
-
-test("validateRemoteUrl permits public HTTP and HTTPS targets", async () => {
-	assert.equal((await validateRemoteUrl("https://example.com/path", { lookup: publicLookup })).hostname, "example.com");
-	assert.equal((await validateRemoteUrl("http://93.184.216.34/")).hostname, "93.184.216.34");
-	assert.equal((await validateRemoteUrl("https://[2606:2800:220:1:248:1893:25c8:1946]/")).hostname, "[2606:2800:220:1:248:1893:25c8:1946]");
-});
-
-test("domain policy allows exact and subdomain matches, and is off by default", async () => {
-	assert.equal((await validateRemoteUrl("https://example.com/", { lookup: publicLookup })).hostname, "example.com");
-	assert.equal((await validateRemoteUrl("https://www.example.com/", {
-		lookup: publicLookup,
-		domainPolicy: { allow: ["example.com"], deny: [] },
-	})).hostname, "www.example.com");
-	await assert.rejects(
-		validateRemoteUrl("https://other.test/", {
-			lookup: publicLookup,
-			domainPolicy: { allow: ["example.com"], deny: [] },
-		}),
-		/Hostname not allowed by fetch_content domain policy/,
-	);
-});
-
-test("domain policy deny wins over allow", async () => {
-	await assert.rejects(
-		validateRemoteUrl("https://private.example.com/", {
-			lookup: publicLookup,
-			domainPolicy: { allow: ["example.com"], deny: ["private.example.com"] },
-		}),
-		/Blocked hostname by fetch_content domain policy/,
-	);
-});
-
-test("domain policy validates redirect targets before following", async () => {
-	const requested = [];
-	const fetchImpl = async (url) => {
-		requested.push(url.toString());
-		return new Response("", { status: 302, headers: { location: "https://denied.example/next" } });
-	};
-
-	await assert.rejects(
-		fetchRemoteUrl("https://allowed.example/", {}, {
-			lookup: publicLookup,
-			fetch: fetchImpl,
-			domainPolicy: { allow: ["allowed.example"], deny: ["denied.example"] },
-		}),
-		/Blocked hostname by fetch_content domain policy/,
-	);
-	assert.deepEqual(requested, ["https://allowed.example/"]);
-});
-
-test("domain policy never relaxes SSRF protection", async () => {
-	await assert.rejects(
-		validateRemoteUrl("http://127.0.0.1/", {
-			domainPolicy: { allow: ["127.0.0.1"], deny: [] },
-		}),
-		/Blocked internal address/,
-	);
-	await assert.rejects(
-		validateRemoteUrl("https://internal.example/", {
-			lookup: async () => [{ address: "10.0.0.5", family: 4 }],
-			domainPolicy: { allow: ["example"], deny: [] },
-		}),
-		/Blocked internal address/,
-	);
-});
-
-test("fetchRemoteUrl validates redirect targets before following", async () => {
-	const requested = [];
-	const fetchImpl = async (url) => {
-		requested.push(url.toString());
-		return new Response("", {
-			status: 302,
-			headers: { location: "http://127.0.0.1/admin" },
-		});
-	};
-
-	await assert.rejects(
-		fetchRemoteUrl("https://example.com/", {}, { lookup: publicLookup, fetch: fetchImpl }),
-		/Blocked internal address/,
-	);
-	assert.deepEqual(requested, ["https://example.com/"]);
-});
-
-test("fetchRemoteUrl follows validated public redirects manually", async () => {
-	const requested = [];
-	const fetchImpl = async (url) => {
-		requested.push(url.toString());
-		if (requested.length === 1) {
-			return new Response("", {
-				status: 301,
-				headers: { location: "/next" },
-			});
-		}
-		return new Response("ok", { status: 200 });
-	};
-
-	const response = await fetchRemoteUrl("https://example.com/start", {}, { lookup: publicLookup, fetch: fetchImpl });
-	assert.equal(response.status, 200);
-	assert.equal(await response.text(), "ok");
-	assert.deepEqual(requested, ["https://example.com/start", "https://example.com/next"]);
-});
-
-test("fake-IP block errors point to the allowRanges opt-in", async () => {
-	const fakeIpLookup = async () => [{ address: "198.18.0.56", family: 4 }];
-
-	await assert.rejects(
-		validateRemoteUrl("https://example.test/", { lookup: fakeIpLookup }),
-		/Blocked internal address for example\.test: 198\.18\.0\.56\..*TUN\/fake-IP proxies.*ssrf\.allowRanges.*198\.18\.0\.0\/15/,
-	);
-});
-
-test("allowRanges exempts a synthetic fake-IP range (e.g. 198.18.0.0/15)", async () => {
-	const fakeIpLookup = async () => [{ address: "198.18.0.56", family: 4 }];
-
-	// Without the exemption this is blocked (the fake-IP proxy case).
-	await assert.rejects(
-		validateRemoteUrl("https://example.test/", { lookup: fakeIpLookup }),
-		/Blocked internal address for example\.test: 198\.18\.0\.56/,
-	);
-
-	// With allowRanges it passes.
-	const url = await validateRemoteUrl("https://example.test/", {
-		lookup: fakeIpLookup,
-		allowRanges: ["198.18.0.0/15"],
-	});
-	assert.equal(url.hostname, "example.test");
-
-	// A bare literal IP in the range is also exempted.
-	assert.equal((await validateRemoteUrl("http://198.18.0.99/", { allowRanges: ["198.18.0.0/15"] })).hostname, "198.18.0.99");
-});
-
-test("allowRanges works for IPv6 ranges", async () => {
-	const fakeIp6Lookup = async () => [{ address: "fd00::1", family: 6 }];
-
-	await assert.rejects(
-		validateRemoteUrl("https://example.test/", { lookup: fakeIp6Lookup }),
-		/Blocked internal address for example\.test: fd00::1/,
-	);
-
-	const url = await validateRemoteUrl("https://example.test/", {
-		lookup: fakeIp6Lookup,
-		allowRanges: ["fd00::/8"],
-	});
-	assert.equal(url.hostname, "example.test");
-});
-
-test("allowRanges does not relax protection outside the listed range", async () => {
-	// 10.0.0.1 is private; an unrelated exemption must NOT cover it.
-	await assert.rejects(
-		validateRemoteUrl("https://example.test/", {
-			lookup: async () => [{ address: "10.0.0.1", family: 4 }],
-			allowRanges: ["198.18.0.0/15"],
-		}),
-		/Blocked internal address for example\.test: 10\.0\.0\.1/,
-	);
-
-	// Exact /32 boundary: allowed in-range, blocked just outside.
-	assert.equal((await validateRemoteUrl("http://198.18.0.0/", { allowRanges: ["198.18.0.0/31"] })).hostname, "198.18.0.0");
-	assert.equal((await validateRemoteUrl("http://198.18.0.1/", { allowRanges: ["198.18.0.0/31"] })).hostname, "198.18.0.1");
-	await assert.rejects(
-		validateRemoteUrl("http://198.18.0.2/", { allowRanges: ["198.18.0.0/31"] }),
-		/Blocked internal address/,
-	);
-});
-
-test("allowRanges accepts a bare host (no prefix) and treats it as /32", async () => {
-	assert.equal((await validateRemoteUrl("http://198.18.1.2/", { allowRanges: ["198.18.1.2"] })).hostname, "198.18.1.2");
-});
-
-test("allowRanges rejects an empty or non-numeric CIDR prefix instead of treating it as /0", async () => {
-	// Regression: a trailing slash with no prefix (e.g. "198.18.0.0/") must NOT
-	// become /0, which would exempt every address from the SSRF guard.
-	for (const bad of ["198.18.0.0/", "198.18.0.0/ ", "fd00::/", "10.0.0.0/abc", "10.0.0.0/ 8"]) {
-		await assert.rejects(
-			validateRemoteUrl("http://198.18.0.5/", { allowRanges: [bad] }),
-			/Invalid CIDR notation in ssrf\.allowRanges/,
-			`${bad} should be rejected`,
-		);
-	}
-
-	// The dangerous outcome is prevented: a metadata/private IP is not exempted
-	// by a malformed "/" entry; the misconfiguration surfaces as an error.
-	await assert.rejects(
-		validateRemoteUrl("http://169.254.169.254/", { allowRanges: ["198.18.0.0/"] }),
-		/Invalid CIDR notation in ssrf\.allowRanges/,
-	);
-});
-
-test("allowRanges rejects all-address /0 CIDRs", async () => {
-	await assert.rejects(
-		validateRemoteUrl("http://169.254.169.254/", { allowRanges: ["0.0.0.0/0"] }),
-		/Invalid CIDR notation in ssrf\.allowRanges/,
-	);
-	await assert.rejects(
-		validateRemoteUrl("http://[fd00::1]/", { allowRanges: ["::/0"] }),
-		/Invalid CIDR notation in ssrf\.allowRanges/,
-	);
-});
-
-test("invalid allowRanges entries throw a descriptive error", async () => {
-	for (const bad of ["not-an-ip", "198.18.0.0/33", "198.18.0.0/-1", "999.0.0.0/8", "fd00::/129"]) {
-		await assert.rejects(
-			validateRemoteUrl("http://198.18.0.5/", { allowRanges: [bad] }),
-			new RegExp(`Invalid CIDR notation in ssrf\.allowRanges: "${bad.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\\$&")}"`),
-		);
-	}
-	await assert.rejects(
-		validateRemoteUrl("http://198.18.0.5/", { allowRanges: "198.18.0.0/15" }),
-		/ssrf\.allowRanges must be an array/,
-	);
-});
-
-test("allowRanges flows through fetchRemoteUrl and its redirect targets", async () => {
-	const requested = [];
-	const fetchImpl = async (url) => {
-		requested.push(url.toString());
-		if (requested.length === 1) {
-			return new Response("", { status: 302, headers: { location: "http://198.18.0.99/admin" } });
-		}
-		return new Response("ok", { status: 200 });
-	};
-
-	const response = await fetchRemoteUrl(
-		"https://example.com/",
-		{},
-		{ lookup: publicLookup, fetch: fetchImpl, allowRanges: ["198.18.0.0/15"] },
-	);
-	assert.equal(response.status, 200);
-	assert.deepEqual(requested, ["https://example.com/", "http://198.18.0.99/admin"]);
-});
-
-test("trustEnvProxy skips hostname DNS only for a configured proxy", async () => {
-	const previous = {
-		HTTP_PROXY: process.env.HTTP_PROXY,
-		http_proxy: process.env.http_proxy,
-		HTTPS_PROXY: process.env.HTTPS_PROXY,
-		https_proxy: process.env.https_proxy,
-		ALL_PROXY: process.env.ALL_PROXY,
-		all_proxy: process.env.all_proxy,
-		NO_PROXY: process.env.NO_PROXY,
-		no_proxy: process.env.no_proxy,
-	};
-	try {
-		for (const key of Object.keys(previous)) delete process.env[key];
-		process.env.HTTPS_PROXY = "http://proxy.example.test:8080";
-		let lookups = 0;
-		const lookup = async () => {
-			lookups++;
-			throw new Error("DNS should not run for proxied host");
-		};
-
-		await validateRemoteUrl("https://public.example.test/", { trustEnvProxy: true, lookup });
-		assert.equal(lookups, 0);
-
-		await assert.rejects(
-			validateRemoteUrl("https://127.0.0.1/", { trustEnvProxy: true, lookup }),
-			/Blocked internal address/,
-		);
-		await assert.rejects(
-			validateRemoteUrl("https://localhost/", { trustEnvProxy: true, lookup }),
-			/Blocked internal hostname/,
-		);
-	} finally {
-		for (const [key, value] of Object.entries(previous)) {
-			if (value === undefined) delete process.env[key];
-			else process.env[key] = value;
-		}
-	}
-});
-
-test("trustEnvProxy still validates DNS when a curl proxy is active", async () => {
-	const previous = {
-		HTTPS_PROXY: process.env.HTTPS_PROXY,
-		NO_PROXY: process.env.NO_PROXY,
-		no_proxy: process.env.no_proxy,
-	};
-	try {
-		process.env.HTTPS_PROXY = "http://env-proxy.example.test:8080";
-		delete process.env.NO_PROXY;
-		delete process.env.no_proxy;
-		let lookups = 0;
-		await assert.rejects(
-			runWithProxy("http://curl-proxy.example.test:8080", () => validateRemoteUrl("https://public.example.test/", {
-				trustEnvProxy: true,
-				lookup: async () => {
-					lookups++;
-					return [{ address: "10.0.0.10", family: 4 }];
-				},
-			})),
-			/Blocked internal address/,
-		);
-		assert.equal(lookups, 1);
-	} finally {
-		for (const [key, value] of Object.entries(previous)) {
-			if (value === undefined) delete process.env[key];
-			else process.env[key] = value;
-		}
-	}
-});
-
-test("trustEnvProxy still validates DNS when empty proxy forces direct access", async () => {
-	const previous = {
-		HTTPS_PROXY: process.env.HTTPS_PROXY,
-		NO_PROXY: process.env.NO_PROXY,
-		no_proxy: process.env.no_proxy,
-	};
-	try {
-		process.env.HTTPS_PROXY = "http://env-proxy.example.test:8080";
-		delete process.env.NO_PROXY;
-		delete process.env.no_proxy;
-		let lookups = 0;
-		await assert.rejects(
-			runWithProxy("", () => validateRemoteUrl("https://public.example.test/", {
-				trustEnvProxy: true,
-				lookup: async () => {
-					lookups++;
-					return [{ address: "10.0.0.10", family: 4 }];
-				},
-			})),
-			/Blocked internal address/,
-		);
-		assert.equal(lookups, 1);
-	} finally {
-		for (const [key, value] of Object.entries(previous)) {
-			if (value === undefined) delete process.env[key];
-			else process.env[key] = value;
-		}
-	}
-});
-
-test("trustEnvProxy ignores invalid proxy environment values", async () => {
-	const previous = {
-		HTTP_PROXY: process.env.HTTP_PROXY,
-		http_proxy: process.env.http_proxy,
-		HTTPS_PROXY: process.env.HTTPS_PROXY,
-		https_proxy: process.env.https_proxy,
-		ALL_PROXY: process.env.ALL_PROXY,
-		all_proxy: process.env.all_proxy,
-		NO_PROXY: process.env.NO_PROXY,
-		no_proxy: process.env.no_proxy,
-	};
-	try {
-		for (const key of Object.keys(previous)) delete process.env[key];
-		for (const value of ["garbage", "file:///tmp/proxy", "   "]) {
-			process.env.HTTPS_PROXY = value;
-			let lookups = 0;
-			const url = await validateRemoteUrl("https://public.example.test/", {
-				trustEnvProxy: true,
-				lookup: async () => {
-					lookups++;
-					return [{ address: "93.184.216.34", family: 4 }];
-				},
-			});
-			assert.equal(url.hostname, "public.example.test");
-			assert.equal(lookups, 1);
-		}
-	} finally {
-		for (const [key, value] of Object.entries(previous)) {
-			if (value === undefined) delete process.env[key];
-			else process.env[key] = value;
-		}
-	}
-});
-
-test("trustEnvProxy still performs DNS for NO_PROXY hosts", async () => {
-	const previous = {
-		HTTPS_PROXY: process.env.HTTPS_PROXY,
-		NO_PROXY: process.env.NO_PROXY,
-	};
-	try {
-		process.env.HTTPS_PROXY = "http://proxy.example.test:8080";
-		process.env.NO_PROXY = "public.example.test:443, .internal.example.test";
-		let lookups = 0;
-		const lookup = async () => {
-			lookups++;
-			return [{ address: "93.184.216.34", family: 4 }];
-		};
-
-		await validateRemoteUrl("https://public.example.test/", { trustEnvProxy: true, lookup });
-		await validateRemoteUrl("https://api.internal.example.test/", { trustEnvProxy: true, lookup });
-		assert.equal(lookups, 2);
-
-		await validateRemoteUrl("https://public.example.test:8443/", { trustEnvProxy: true, lookup });
-		assert.equal(lookups, 2);
-
-		await validateRemoteUrl("https://other.example.test/", { trustEnvProxy: true, lookup });
-		assert.equal(lookups, 2);
-	} finally {
-		for (const [key, value] of Object.entries(previous)) {
-			if (value === undefined) delete process.env[key];
-			else process.env[key] = value;
-		}
-	}
-});

package/agent.bak.20260905-190020/extensions/pi-web-access/test/summary-model-scope.test.mjs

@@ -1,106 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdir, mkdtemp, writeFile } from "node:fs/promises";
-import { readFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { test } from "node:test";
-
-import { findModelWithProviderRouting, loadEnabledModelPatterns, modelMatchesEnabledPatterns } from "../summary-model-scope.ts";
-
-const queryRewriteSrc = readFileSync(new URL("../query-rewrite.ts", import.meta.url), "utf8");
-
-test("summary model scope matches nested provider model ids and thinking suffixes", () => {
-	assert.equal(
-		modelMatchesEnabledPatterns(
-			{ provider: "openrouter", id: "nvidia/nemotron-3-super-120b-a12b:free" },
-			["openrouter/nvidia/nemotron-3-super-120b-a12b:free"],
-		),
-		true,
-	);
-	assert.equal(
-		modelMatchesEnabledPatterns(
-			{ provider: "openrouter", id: "anthropic/claude-sonnet-4" },
-			["openrouter/*:low"],
-		),
-		true,
-	);
-	assert.equal(
-		modelMatchesEnabledPatterns(
-			{ provider: "openrouter", id: "ai21/jamba-large-1.7" },
-			["openrouter/nvidia/*"],
-		),
-		false,
-	);
-});
-
-test("preferred models resolve through routed providers", () => {
-	const routedModel = { provider: "openrouter", id: "anthropic/claude-haiku-4-5" };
-	const registry = {
-		find: () => undefined,
-		getAvailable: () => [routedModel],
-	};
-
-	assert.equal(
-		findModelWithProviderRouting(registry, "anthropic", "claude-haiku-4-5"),
-		routedModel,
-	);
-});
-
-test("model resolution preserves the direct registry fallback", () => {
-	const configuredModel = { provider: "anthropic", id: "claude-haiku-4-5" };
-	const registry = {
-		find: () => configuredModel,
-		getAvailable: () => [],
-	};
-
-	assert.equal(
-		findModelWithProviderRouting(registry, "anthropic", "claude-haiku-4-5"),
-		configuredModel,
-	);
-});
-
-test("routed model resolution follows available-model ordering", () => {
-	const firstRoute = { provider: "openrouter", id: "anthropic/claude-haiku-4-5" };
-	const secondRoute = { provider: "requesty", id: "anthropic/claude-haiku-4-5" };
-	const registry = {
-		find: () => undefined,
-		getAvailable: () => [firstRoute, secondRoute],
-	};
-
-	assert.equal(
-		findModelWithProviderRouting(registry, "anthropic", "claude-haiku-4-5"),
-		firstRoute,
-	);
-});
-
-test("enabledModels loading uses trusted project settings over global settings", async () => {
-	const agentDir = await mkdtemp(join(tmpdir(), "pi-web-access-agent-"));
-	const projectDir = await mkdtemp(join(tmpdir(), "pi-web-access-project-"));
-	await writeFile(join(agentDir, "settings.json"), JSON.stringify({ enabledModels: ["global/model"] }));
-	await mkdir(join(projectDir, ".pi"));
-	await writeFile(join(projectDir, ".pi", "settings.json"), JSON.stringify({ enabledModels: ["project/model"] }));
-
-	const previous = process.env.PI_CODING_AGENT_DIR;
-	process.env.PI_CODING_AGENT_DIR = agentDir;
-	try {
-		assert.deepEqual(
-			loadEnabledModelPatterns({ cwd: projectDir, isProjectTrusted: () => true }),
-			["project/model"],
-		);
-		assert.deepEqual(
-			loadEnabledModelPatterns({ cwd: projectDir, isProjectTrusted: () => false }),
-			["global/model"],
-		);
-	} finally {
-		if (previous === undefined) {
-			delete process.env.PI_CODING_AGENT_DIR;
-		} else {
-			process.env.PI_CODING_AGENT_DIR = previous;
-		}
-	}
-});
-
-test("query rewrite defaults use the refreshed model order", () => {
-	assert.match(queryRewriteSrc, /id: "gpt-5-mini"/);
-	assert.doesNotMatch(queryRewriteSrc, /gpt-4\.1-mini/);
-});