@bryan-thompson/inspector-assessment-cli 1.43.1 → 1.43.3

package/build/__tests__/static-only-mode.test.js

@@ -0,0 +1,439 @@
+/**
+ * Static-Only Mode Unit Tests
+ *
+ * Tests for Issue #213: Static/manifest-only validation mode.
+ *
+ * Tests cover:
+ * - CLI flag parsing for --static-only and --fallback-static
+ * - Mutual exclusivity validation
+ * - Static module configuration
+ * - Config builder static mode handling
+ */
+import { describe, it, expect, jest, beforeEach, afterEach, } from "@jest/globals";
+import { parseArgs } from "../lib/cli-parser.js";
+import { STATIC_MODULES, RUNTIME_MODULES, isStaticModule, isRuntimeModule, filterToStaticModules, filterToRuntimeModules, } from "../lib/static-modules.js";
+import { buildConfig } from "../lib/assessment-runner/config-builder.js";
+describe("Static-Only Mode CLI Parsing", () => {
+    // Suppress console output during tests
+    let consoleErrorSpy;
+    let consoleWarnSpy;
+    let consoleLogSpy;
+    let processExitSpy;
+    beforeEach(() => {
+        consoleErrorSpy = jest.spyOn(console, "error").mockImplementation(() => { });
+        consoleWarnSpy = jest.spyOn(console, "warn").mockImplementation(() => { });
+        consoleLogSpy = jest.spyOn(console, "log").mockImplementation(() => { });
+        processExitSpy = jest
+            .spyOn(process, "exit")
+            .mockImplementation(() => undefined);
+    });
+    afterEach(() => {
+        jest.restoreAllMocks();
+    });
+    describe("--static-only flag", () => {
+        it("should parse --static-only flag", () => {
+            const result = parseArgs([
+                "--server",
+                "test-server",
+                "--source",
+                "/path/to/source",
+                "--static-only",
+            ]);
+            expect(result.staticOnly).toBe(true);
+        });
+        it("should set staticOnly to undefined when not provided", () => {
+            const result = parseArgs([
+                "--server",
+                "test-server",
+                "--http",
+                "http://localhost:8080",
+            ]);
+            expect(result.staticOnly).toBeUndefined();
+        });
+    });
+    describe("--fallback-static flag", () => {
+        it("should parse --fallback-static flag", () => {
+            const result = parseArgs([
+                "--server",
+                "test-server",
+                "--http",
+                "http://localhost:8080",
+                "--source",
+                "/path/to/source",
+                "--fallback-static",
+            ]);
+            expect(result.fallbackStatic).toBe(true);
+        });
+        it("should set fallbackStatic to undefined when not provided", () => {
+            const result = parseArgs([
+                "--server",
+                "test-server",
+                "--http",
+                "http://localhost:8080",
+            ]);
+            expect(result.fallbackStatic).toBeUndefined();
+        });
+    });
+    describe("Mutual Exclusivity", () => {
+        it("should reject --static-only with --fallback-static", () => {
+            const result = parseArgs([
+                "--server",
+                "test-server",
+                "--source",
+                "/path/to/source",
+                "--static-only",
+                "--fallback-static",
+            ]);
+            expect(result.helpRequested).toBe(true);
+            expect(consoleErrorSpy).toHaveBeenCalledWith(expect.stringContaining("mutually exclusive"));
+        });
+        it("should reject --static-only without --source", () => {
+            const result = parseArgs(["--server", "test-server", "--static-only"]);
+            expect(result.helpRequested).toBe(true);
+            expect(consoleErrorSpy).toHaveBeenCalledWith(expect.stringContaining("requires --source"));
+        });
+        it("should reject --static-only with --http", () => {
+            const result = parseArgs([
+                "--server",
+                "test-server",
+                "--source",
+                "/path/to/source",
+                "--static-only",
+                "--http",
+                "http://localhost:8080",
+            ]);
+            expect(result.helpRequested).toBe(true);
+            expect(consoleErrorSpy).toHaveBeenCalledWith(expect.stringContaining("cannot be used with --http"));
+        });
+        it("should reject --static-only with --sse", () => {
+            const result = parseArgs([
+                "--server",
+                "test-server",
+                "--source",
+                "/path/to/source",
+                "--static-only",
+                "--sse",
+                "http://localhost:8080/sse",
+            ]);
+            expect(result.helpRequested).toBe(true);
+            expect(consoleErrorSpy).toHaveBeenCalledWith(expect.stringContaining("cannot be used with --http"));
+        });
+        it("should reject --static-only with --config", () => {
+            const result = parseArgs([
+                "--server",
+                "test-server",
+                "--source",
+                "/path/to/source",
+                "--static-only",
+                "--config",
+                "/path/to/config.json",
+            ]);
+            expect(result.helpRequested).toBe(true);
+            expect(consoleErrorSpy).toHaveBeenCalledWith(expect.stringContaining("cannot be used with"));
+        });
+        it("should reject --static-only with --module", () => {
+            const result = parseArgs([
+                "--server",
+                "test-server",
+                "--source",
+                "/path/to/source",
+                "--static-only",
+                "--module",
+                "security",
+            ]);
+            expect(result.helpRequested).toBe(true);
+            expect(consoleErrorSpy).toHaveBeenCalledWith(expect.stringContaining("cannot be used with --module"));
+        });
+        it("should allow --static-only with --only-modules", () => {
+            const result = parseArgs([
+                "--server",
+                "test-server",
+                "--source",
+                "/path/to/source",
+                "--static-only",
+                "--only-modules",
+                "manifestValidation,prohibitedLibraries",
+            ]);
+            // Should not error - this is allowed for filtering static modules
+            expect(result.staticOnly).toBe(true);
+            expect(result.onlyModules).toEqual([
+                "manifestValidation",
+                "prohibitedLibraries",
+            ]);
+        });
+        it("should allow --static-only with --skip-modules", () => {
+            const result = parseArgs([
+                "--server",
+                "test-server",
+                "--source",
+                "/path/to/source",
+                "--static-only",
+                "--skip-modules",
+                "portability",
+            ]);
+            // Should not error - this is allowed for filtering static modules
+            expect(result.staticOnly).toBe(true);
+            expect(result.skipModules).toEqual(["portability"]);
+        });
+    });
+});
+describe("Static Modules Definition", () => {
+    describe("STATIC_MODULES constant", () => {
+        it("should contain expected static-capable modules", () => {
+            expect(STATIC_MODULES).toContain("manifestValidation");
+            expect(STATIC_MODULES).toContain("documentation"); // Legacy name for DeveloperExperience
+            expect(STATIC_MODULES).toContain("usability"); // Legacy name for DeveloperExperience
+            expect(STATIC_MODULES).toContain("prohibitedLibraries");
+            expect(STATIC_MODULES).toContain("portability");
+            expect(STATIC_MODULES).toContain("externalAPIScanner");
+            expect(STATIC_MODULES).toContain("fileModularization");
+            expect(STATIC_MODULES).toContain("conformance");
+            expect(STATIC_MODULES).toContain("toolAnnotations");
+            expect(STATIC_MODULES).toContain("authentication");
+            expect(STATIC_MODULES).toContain("aupCompliance");
+        });
+        it("should not contain runtime-only modules", () => {
+            expect(STATIC_MODULES).not.toContain("functionality");
+            expect(STATIC_MODULES).not.toContain("security");
+            expect(STATIC_MODULES).not.toContain("temporal");
+            expect(STATIC_MODULES).not.toContain("protocolCompliance");
+        });
+        it("should have exactly 11 static modules", () => {
+            // documentation + usability (both legacy names for DeveloperExperience)
+            expect(STATIC_MODULES.length).toBe(11);
+        });
+    });
+    describe("RUNTIME_MODULES constant", () => {
+        it("should contain expected runtime-only modules", () => {
+            expect(RUNTIME_MODULES).toContain("functionality");
+            expect(RUNTIME_MODULES).toContain("security");
+            expect(RUNTIME_MODULES).toContain("temporal");
+            expect(RUNTIME_MODULES).toContain("protocolCompliance");
+            expect(RUNTIME_MODULES).toContain("resources");
+            expect(RUNTIME_MODULES).toContain("prompts");
+            expect(RUNTIME_MODULES).toContain("crossCapability");
+            expect(RUNTIME_MODULES).toContain("errorHandling");
+            expect(RUNTIME_MODULES).toContain("dependencyVulnerability");
+        });
+        it("should not contain static-capable modules", () => {
+            expect(RUNTIME_MODULES).not.toContain("manifestValidation");
+            expect(RUNTIME_MODULES).not.toContain("prohibitedLibraries");
+            expect(RUNTIME_MODULES).not.toContain("portability");
+            expect(RUNTIME_MODULES).not.toContain("documentation");
+        });
+        it("should have exactly 9 runtime modules", () => {
+            // Includes dependencyVulnerability (requires live server for npm/yarn audit)
+            expect(RUNTIME_MODULES.length).toBe(9);
+        });
+    });
+    describe("isStaticModule helper", () => {
+        it("should return true for static-capable modules", () => {
+            expect(isStaticModule("manifestValidation")).toBe(true);
+            expect(isStaticModule("prohibitedLibraries")).toBe(true);
+            expect(isStaticModule("toolAnnotations")).toBe(true);
+        });
+        it("should return false for runtime-only modules", () => {
+            expect(isStaticModule("functionality")).toBe(false);
+            expect(isStaticModule("security")).toBe(false);
+            expect(isStaticModule("temporal")).toBe(false);
+        });
+        it("should return false for unknown modules", () => {
+            expect(isStaticModule("unknownModule")).toBe(false);
+        });
+    });
+    describe("isRuntimeModule helper", () => {
+        it("should return true for runtime-only modules", () => {
+            expect(isRuntimeModule("functionality")).toBe(true);
+            expect(isRuntimeModule("security")).toBe(true);
+            expect(isRuntimeModule("temporal")).toBe(true);
+        });
+        it("should return false for static-capable modules", () => {
+            expect(isRuntimeModule("manifestValidation")).toBe(false);
+            expect(isRuntimeModule("prohibitedLibraries")).toBe(false);
+        });
+    });
+    describe("filterToStaticModules helper", () => {
+        it("should filter to only static-capable modules", () => {
+            const input = [
+                "manifestValidation",
+                "functionality",
+                "security",
+                "prohibitedLibraries",
+            ];
+            const result = filterToStaticModules(input);
+            expect(result).toEqual(["manifestValidation", "prohibitedLibraries"]);
+        });
+        it("should return empty array when no static modules present", () => {
+            const input = ["functionality", "security", "temporal"];
+            const result = filterToStaticModules(input);
+            expect(result).toEqual([]);
+        });
+    });
+    describe("filterToRuntimeModules helper", () => {
+        it("should filter to only runtime-only modules", () => {
+            const input = [
+                "manifestValidation",
+                "functionality",
+                "security",
+                "prohibitedLibraries",
+            ];
+            const result = filterToRuntimeModules(input);
+            expect(result).toEqual(["functionality", "security"]);
+        });
+        it("should return empty array when no runtime modules present", () => {
+            const input = [
+                "manifestValidation",
+                "prohibitedLibraries",
+                "portability",
+            ];
+            const result = filterToRuntimeModules(input);
+            expect(result).toEqual([]);
+        });
+    });
+});
+describe("Config Builder Static Mode", () => {
+    // Suppress console output during tests
+    let consoleWarnSpy;
+    let consoleLogSpy;
+    beforeEach(() => {
+        consoleWarnSpy = jest.spyOn(console, "warn").mockImplementation(() => { });
+        consoleLogSpy = jest.spyOn(console, "log").mockImplementation(() => { });
+    });
+    afterEach(() => {
+        jest.restoreAllMocks();
+    });
+    describe("buildConfig with staticOnly option", () => {
+        it("should enable only static-capable modules", () => {
+            const config = buildConfig({
+                serverName: "test-server",
+                sourceCodePath: "/path/to/source",
+                staticOnly: true,
+            });
+            const categories = config.assessmentCategories;
+            // Static modules should be enabled (using legacy property names)
+            expect(categories.manifestValidation).toBe(true);
+            expect(categories.documentation).toBe(true); // Legacy name for DeveloperExperience
+            expect(categories.usability).toBe(true); // Legacy name for DeveloperExperience
+            expect(categories.prohibitedLibraries).toBe(true);
+            expect(categories.portability).toBe(true);
+            expect(categories.externalAPIScanner).toBe(true);
+            expect(categories.toolAnnotations).toBe(true);
+            expect(categories.authentication).toBe(true);
+            expect(categories.aupCompliance).toBe(true);
+            // Runtime modules should be disabled
+            expect(categories.functionality).toBe(false);
+            expect(categories.security).toBe(false);
+            expect(categories.temporal).toBe(false);
+            expect(categories.protocolCompliance).toBe(false);
+        });
+        it("should apply --only-modules filter to static modules", () => {
+            const config = buildConfig({
+                serverName: "test-server",
+                sourceCodePath: "/path/to/source",
+                staticOnly: true,
+                onlyModules: ["manifestValidation", "prohibitedLibraries"],
+            });
+            const categories = config.assessmentCategories;
+            // Only whitelisted static modules should be enabled
+            expect(categories.manifestValidation).toBe(true);
+            expect(categories.prohibitedLibraries).toBe(true);
+            // Other static modules should be disabled
+            expect(categories.portability).toBe(false);
+            expect(categories.toolAnnotations).toBe(false);
+            // Runtime modules still disabled
+            expect(categories.functionality).toBe(false);
+            expect(categories.security).toBe(false);
+        });
+        it("should apply --skip-modules filter to static modules", () => {
+            const config = buildConfig({
+                serverName: "test-server",
+                sourceCodePath: "/path/to/source",
+                staticOnly: true,
+                skipModules: ["portability", "externalAPIScanner"],
+            });
+            const categories = config.assessmentCategories;
+            // Skipped modules should be disabled
+            expect(categories.portability).toBe(false);
+            expect(categories.externalAPIScanner).toBe(false);
+            // Other static modules should still be enabled
+            expect(categories.manifestValidation).toBe(true);
+            expect(categories.prohibitedLibraries).toBe(true);
+        });
+        it("should ignore runtime modules in --only-modules with static mode", () => {
+            const config = buildConfig({
+                serverName: "test-server",
+                sourceCodePath: "/path/to/source",
+                staticOnly: true,
+                onlyModules: ["manifestValidation", "security", "functionality"],
+            });
+            const categories = config.assessmentCategories;
+            // Only static module from whitelist should be enabled
+            expect(categories.manifestValidation).toBe(true);
+            // Runtime modules from whitelist should still be disabled
+            expect(categories.security).toBe(false);
+            expect(categories.functionality).toBe(false);
+        });
+        it("should result in zero enabled modules if only runtime modules in --only-modules", () => {
+            const config = buildConfig({
+                serverName: "test-server",
+                sourceCodePath: "/path/to/source",
+                staticOnly: true,
+                onlyModules: ["functionality", "security", "temporal"],
+            });
+            const categories = config.assessmentCategories;
+            // All runtime modules should be disabled
+            expect(categories.functionality).toBe(false);
+            expect(categories.security).toBe(false);
+            expect(categories.temporal).toBe(false);
+            // Static modules should also be disabled (not in onlyModules)
+            expect(categories.manifestValidation).toBe(false);
+            expect(categories.prohibitedLibraries).toBe(false);
+        });
+        it("should result in zero enabled modules if all static modules skipped", () => {
+            const config = buildConfig({
+                serverName: "test-server",
+                sourceCodePath: "/path/to/source",
+                staticOnly: true,
+                skipModules: [
+                    "manifestValidation",
+                    "documentation",
+                    "usability",
+                    "prohibitedLibraries",
+                    "portability",
+                    "externalAPIScanner",
+                    "fileModularization",
+                    "conformance",
+                    "toolAnnotations",
+                    "authentication",
+                    "aupCompliance",
+                ],
+            });
+            const categories = config.assessmentCategories;
+            // All static modules should be disabled
+            expect(categories.manifestValidation).toBe(false);
+            expect(categories.prohibitedLibraries).toBe(false);
+            expect(categories.portability).toBe(false);
+            expect(categories.toolAnnotations).toBe(false);
+        });
+        it("should log static mode info", () => {
+            buildConfig({
+                serverName: "test-server",
+                sourceCodePath: "/path/to/source",
+                staticOnly: true,
+            });
+            expect(consoleLogSpy).toHaveBeenCalledWith(expect.stringContaining("Static-only mode"));
+        });
+    });
+    describe("buildConfig without staticOnly option", () => {
+        it("should enable runtime modules by default", () => {
+            const config = buildConfig({
+                serverName: "test-server",
+                sourceCodePath: "/path/to/source",
+            });
+            const categories = config.assessmentCategories;
+            // Runtime modules should be enabled by default
+            expect(categories.functionality).toBe(true);
+            expect(categories.security).toBe(true);
+        });
+    });
+});

package/build/__tests__/transport.test.js

@@ -68,6 +68,147 @@ describe("Transport Creation", () => {
             expect(transport).toBeDefined();
         });
     });
+    describe("Minimal Environment Variables (Issue #211)", () => {
+        let originalEnv;
+        afterEach(() => {
+            // Restore original environment after each test
+            process.env = originalEnv;
+        });
+        it("should pass minimal env vars (PATH, HOME) to spawned servers", () => {
+            originalEnv = process.env;
+            process.env = {
+                PATH: "/usr/bin:/usr/local/bin",
+                HOME: "/home/testuser",
+            };
+            const options = {
+                transportType: "stdio",
+                command: "node",
+                args: ["server.js"],
+            };
+            // Creating the transport should not throw
+            const transport = createTransport(options);
+            expect(transport).toBeDefined();
+            // The transport is created with minimal env (PATH, HOME, NODE_ENV)
+            // We can't directly inspect StdioClientTransport's env without mocking,
+            // but we verify the transport was created successfully
+        });
+        it("should default NODE_ENV to production when not set", () => {
+            originalEnv = process.env;
+            process.env = {
+                PATH: "/usr/bin",
+                HOME: "/home/user",
+                // NODE_ENV intentionally not set
+            };
+            const options = {
+                transportType: "stdio",
+                command: "python",
+                args: ["server.py"],
+            };
+            const transport = createTransport(options);
+            expect(transport).toBeDefined();
+        });
+        it("should preserve NODE_ENV when set", () => {
+            originalEnv = process.env;
+            process.env = {
+                PATH: "/usr/bin",
+                HOME: "/home/user",
+                NODE_ENV: "development",
+            };
+            const options = {
+                transportType: "stdio",
+                command: "node",
+                args: ["server.js"],
+            };
+            const transport = createTransport(options);
+            expect(transport).toBeDefined();
+        });
+        it("should NOT pass arbitrary process.env vars (Issue #211)", () => {
+            originalEnv = process.env;
+            process.env = {
+                PATH: "/usr/bin",
+                HOME: "/home/user",
+                SOME_RANDOM_VAR: "should-not-pass",
+                ENABLE_DYNAMIC_MAPS: "true", // This caused TomTom MCP issues
+                AWS_ACCESS_KEY_ID: "secret", // Sensitive vars should not leak
+                CUSTOM_CONFIG: "value",
+            };
+            const options = {
+                transportType: "stdio",
+                command: "node",
+                args: ["server.js"],
+            };
+            // Creating transport should succeed
+            const transport = createTransport(options);
+            expect(transport).toBeDefined();
+            // The arbitrary environment variables are filtered out by getMinimalEnv()
+            // We verify the transport was created without throwing errors
+        });
+        it("should pass platform-specific essential vars (USER, SHELL, LANG)", () => {
+            originalEnv = process.env;
+            process.env = {
+                PATH: "/usr/bin",
+                HOME: "/home/user",
+                USER: "testuser",
+                SHELL: "/bin/bash",
+                LANG: "en_US.UTF-8",
+            };
+            const options = {
+                transportType: "stdio",
+                command: "node",
+                args: ["server.js"],
+            };
+            const transport = createTransport(options);
+            expect(transport).toBeDefined();
+        });
+        it("should pass temp directory vars (TMPDIR, TMP, TEMP)", () => {
+            originalEnv = process.env;
+            process.env = {
+                PATH: "/usr/bin",
+                HOME: "/home/user",
+                TMPDIR: "/tmp",
+                TMP: "/tmp",
+                TEMP: "/tmp",
+            };
+            const options = {
+                transportType: "stdio",
+                command: "python",
+                args: ["-m", "server"],
+            };
+            const transport = createTransport(options);
+            expect(transport).toBeDefined();
+        });
+        it("should handle minimal env when optional vars are missing", () => {
+            originalEnv = process.env;
+            process.env = {
+                PATH: "/usr/bin",
+                // HOME, USER, SHELL, etc. intentionally not set
+            };
+            const options = {
+                transportType: "stdio",
+                command: "node",
+                args: ["server.js"],
+            };
+            // Should still work with just PATH
+            const transport = createTransport(options);
+            expect(transport).toBeDefined();
+        });
+        it("should combine SDK defaults with minimal env vars", () => {
+            originalEnv = process.env;
+            process.env = {
+                PATH: "/custom/path",
+                HOME: "/home/custom",
+                NODE_ENV: "test",
+            };
+            const options = {
+                transportType: "stdio",
+                command: "node",
+                args: ["server.js"],
+            };
+            // getDefaultEnvironment() from SDK is merged with getMinimalEnv()
+            const transport = createTransport(options);
+            expect(transport).toBeDefined();
+        });
+    });
     describe("HTTP Transport", () => {
         it("should create transport for valid HTTP options", () => {
             const options = {