@cldmv/gh-broker 0.0.0-stage → 0.7.0

package/tests/catalog.test.vitest.mts

@@ -0,0 +1,180 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { buildCatalog } from "../src/catalog.ts";
+
+function makeConfig(tools: any[], owners: Record<string, unknown> = { cldmv: { read: "cred:r", write: "cred:w" } }): any {
+	return { listen: "unix:/x", upstream: "https://api.githubcopilot.com/mcp/", tools, owners };
+}
+
+describe("buildCatalog", () => {
+	let secrets: { resolve: ReturnType<typeof vi.fn> };
+	let upstream: { listToolsFor: ReturnType<typeof vi.fn> };
+	let errSpy: ReturnType<typeof vi.spyOn>;
+
+	beforeEach(() => {
+		secrets = { resolve: vi.fn(() => "tok") };
+		upstream = { listToolsFor: vi.fn() };
+		errSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+	});
+
+	afterEach(() => {
+		vi.restoreAllMocks();
+		delete process.env.GH_BROKER_CATALOG_TIMEOUT_MS;
+	});
+
+	it("uses upstream schemas, emits local schemas for custom verbs, and skips unexposed proxied tools", async () => {
+		const upstreamTool = { name: "get_me", description: "real", inputSchema: { type: "object", properties: {} } };
+		upstream.listToolsFor.mockResolvedValue([upstreamTool]);
+		const config = makeConfig([
+			{ name: "get_me", mode: "read" },
+			{ name: "not_exposed", mode: "read" },
+			{ name: "link_issue", mode: "write", custom: true },
+			{ name: "resolve_review_thread", mode: "write", custom: true },
+			{ name: "reply_review_thread", mode: "write", custom: true },
+			{ name: "mystery_custom", mode: "read", custom: true }
+		]);
+		const catalog = await buildCatalog(config, secrets as any, upstream as any);
+
+		expect(secrets.resolve).toHaveBeenCalledWith("cred:r");
+		const names = catalog.map((t) => t.name);
+		// get_me is served from upstream; not_exposed is dropped (fetched but absent);
+		// the two wired custom verbs get local schemas; link_issue is DEFERRED (its
+		// catalog branch is commented out) and mystery_custom matches no branch — both
+		// are silently skipped even when allowlisted.
+		expect(names).toEqual(["get_me", "resolve_review_thread", "reply_review_thread"]);
+		expect(names).not.toContain("link_issue");
+		expect(catalog[0]).toBe(upstreamTool);
+		expect(catalog.find((t) => t.name === "resolve_review_thread")?.inputSchema).toMatchObject({ type: "object" });
+		expect(errSpy).toHaveBeenCalledWith(expect.stringMatching(/allowlisted tool "not_exposed" is NOT exposed/));
+	});
+
+	it("advertises report_unlabeled with its local schema", async () => {
+		upstream.listToolsFor.mockResolvedValue([]);
+		const config = makeConfig([{ name: "report_unlabeled", mode: "read", custom: true }]);
+		const catalog = await buildCatalog(config, secrets as any, upstream as any);
+		expect(catalog).toHaveLength(1);
+		expect(catalog[0]).toMatchObject({ name: "report_unlabeled" });
+		expect(catalog[0]?.inputSchema).toMatchObject({ type: "object", required: ["owner"] });
+	});
+
+	it("advertises report_security_alerts with its local schema", async () => {
+		upstream.listToolsFor.mockResolvedValue([]);
+		const config = makeConfig([{ name: "report_security_alerts", mode: "read", custom: true }]);
+		const catalog = await buildCatalog(config, secrets as any, upstream as any);
+		expect(catalog).toHaveLength(1);
+		expect(catalog[0]).toMatchObject({ name: "report_security_alerts" });
+		expect(catalog[0]?.inputSchema).toMatchObject({ type: "object", required: ["owner"] });
+	});
+
+	it("advertises report_release_prs with its local schema", async () => {
+		upstream.listToolsFor.mockResolvedValue([]);
+		const config = makeConfig([{ name: "report_release_prs", mode: "read", custom: true }]);
+		const catalog = await buildCatalog(config, secrets as any, upstream as any);
+		expect(catalog).toHaveLength(1);
+		expect(catalog[0]).toMatchObject({ name: "report_release_prs" });
+		expect(catalog[0]?.inputSchema).toMatchObject({ type: "object", required: ["owner"] });
+	});
+
+	it("advertises issue_labels with its local schema", async () => {
+		upstream.listToolsFor.mockResolvedValue([]);
+		const config = makeConfig([{ name: "issue_labels", mode: "write", custom: true }]);
+		const catalog = await buildCatalog(config, secrets as any, upstream as any);
+		expect(catalog).toHaveLength(1);
+		expect(catalog[0]).toMatchObject({ name: "issue_labels" });
+		expect(catalog[0]?.description).toMatch(/swap/);
+		expect(catalog[0]?.inputSchema).toMatchObject({ type: "object", required: ["owner", "repo", "issue_number"] });
+	});
+
+	it("warns on issue_write that labels replaces the set, pointing at issue_labels when it is allowlisted", async () => {
+		const upstreamTool = { name: "issue_write", description: "Create or update an issue.", inputSchema: { type: "object", properties: { labels: {} } } };
+		upstream.listToolsFor.mockResolvedValue([upstreamTool]);
+		const withVerb = await buildCatalog(
+			makeConfig([{ name: "issue_write", mode: "write" }, { name: "issue_labels", mode: "write", custom: true }]),
+			secrets as any,
+			upstream as any
+		);
+		const iw = withVerb.find((t) => t.name === "issue_write")!;
+		expect(iw.description).toMatch(/^Create or update an issue\. WARNING \(gh-broker\): "labels" REPLACES the issue's whole label set/);
+		expect(iw.description).toMatch(/use issue_labels instead/);
+		expect(iw.inputSchema).toBe(upstreamTool.inputSchema);
+		expect(upstreamTool.description).toBe("Create or update an issue."); // the fetched tool is not mutated
+
+		const without = await buildCatalog(makeConfig([{ name: "issue_write", mode: "write" }]), secrets as any, upstream as any);
+		expect(without[0]?.description).toMatch(/REPLACES/);
+		expect(without[0]?.description).not.toMatch(/issue_labels/);
+		expect(without[0]?.description).toMatch(/pass the full set/);
+	});
+
+	it("still warns on issue_write when the upstream fetch fails (minimal schema)", async () => {
+		upstream.listToolsFor.mockRejectedValue(new Error("down"));
+		const catalog = await buildCatalog(makeConfig([{ name: "issue_write", mode: "write" }]), secrets as any, upstream as any);
+		expect(catalog[0]?.description).toMatch(/^\(write\) proxied to the GitHub MCP WARNING/);
+	});
+
+	it("advertises report_ci_status with its local schema", async () => {
+		upstream.listToolsFor.mockResolvedValue([]);
+		const config = makeConfig([{ name: "report_ci_status", mode: "read", custom: true }]);
+		const catalog = await buildCatalog(config, secrets as any, upstream as any);
+		expect(catalog).toHaveLength(1);
+		expect(catalog[0]).toMatchObject({ name: "report_ci_status" });
+		expect(catalog[0]?.inputSchema).toMatchObject({ type: "object", required: ["owner", "repo"] });
+	});
+
+	it("layers ciVerbosity/logLines onto pull_request_read's real upstream schema without dropping its own params", async () => {
+		const upstreamTool = {
+			name: "pull_request_read",
+			description: "Get information on a specific pull request.",
+			inputSchema: { type: "object", required: ["owner", "repo", "pullNumber", "method"], properties: { method: { type: "string" }, pullNumber: { type: "number" } } }
+		};
+		upstream.listToolsFor.mockResolvedValue([upstreamTool]);
+		const config = makeConfig([{ name: "pull_request_read", mode: "read", augment: true }]);
+		const catalog = await buildCatalog(config, secrets as any, upstream as any);
+		expect(catalog).toHaveLength(1);
+		const tool = catalog[0]!;
+		expect(tool.description).toContain("gh-broker extension");
+		expect((tool.inputSchema as any).required).toEqual(["owner", "repo", "pullNumber", "method"]);
+		expect((tool.inputSchema as any).properties.pullNumber).toEqual({ type: "number" });
+		expect((tool.inputSchema as any).properties.ciVerbosity).toMatchObject({ type: "number", enum: [0, 1, 2, 3] });
+		expect((tool.inputSchema as any).properties.logLines).toMatchObject({ type: "number" });
+	});
+
+	it("still adds ciVerbosity/logLines to pull_request_read when the upstream fetch fails entirely", async () => {
+		upstream.listToolsFor.mockRejectedValue(new Error("network down"));
+		const config = makeConfig([{ name: "pull_request_read", mode: "read", augment: true }]);
+		const catalog = await buildCatalog(config, secrets as any, upstream as any);
+		expect(catalog).toHaveLength(1);
+		expect((catalog[0]!.inputSchema as any).properties).toEqual({
+			ciVerbosity: { type: "number", enum: [0, 1, 2, 3], description: expect.any(String) },
+			logLines: { type: "number", description: expect.any(String) }
+		});
+	});
+
+	it("falls back to minimal schemas when the upstream fetch fails", async () => {
+		upstream.listToolsFor.mockRejectedValue(new Error("401 bad token"));
+		const config = makeConfig([
+			{ name: "get_me", mode: "read" },
+			{ name: "resolve_review_thread", mode: "write", custom: true }
+		]);
+		const catalog = await buildCatalog(config, secrets as any, upstream as any);
+
+		const getMe = catalog.find((t) => t.name === "get_me");
+		expect(getMe).toEqual({ name: "get_me", description: "(read) proxied to the GitHub MCP", inputSchema: { type: "object" } });
+		expect(catalog.map((t) => t.name)).toContain("resolve_review_thread");
+		expect(errSpy).toHaveBeenCalledWith(expect.stringMatching(/could not fetch upstream tool schemas/));
+	});
+
+	it("skips the upstream fetch entirely when there are no owners", async () => {
+		const config = makeConfig([{ name: "get_me", mode: "read" }], {});
+		const catalog = await buildCatalog(config, secrets as any, upstream as any);
+		expect(upstream.listToolsFor).not.toHaveBeenCalled();
+		expect(catalog).toEqual([{ name: "get_me", description: "(read) proxied to the GitHub MCP", inputSchema: { type: "object" } }]);
+	});
+
+	it("times out a slow upstream and advertises minimal schemas", async () => {
+		process.env.GH_BROKER_CATALOG_TIMEOUT_MS = "15";
+		upstream.listToolsFor.mockReturnValue(new Promise(() => {})); // never resolves
+		const config = makeConfig([{ name: "get_me", mode: "read" }]);
+		const catalog = await buildCatalog(config, secrets as any, upstream as any);
+		expect(catalog.map((t) => t.name)).toEqual(["get_me"]);
+		expect(errSpy).toHaveBeenCalledWith(expect.stringMatching(/timed out after 15ms/));
+	});
+});

package/tests/config-merge.test.vitest.mts

@@ -0,0 +1,58 @@
+import { describe, it, expect } from "vitest";
+import { mergeConfig } from "../deploy/lib/config-merge.mjs";
+
+const example = {
+	listen: "unix:/run/gh-broker/gh-broker.sock",
+	upstream: "https://api.githubcopilot.com/mcp/x/all",
+	tools: [
+		{ name: "get_me", mode: "read" },
+		{ name: "list_issues", mode: "read" }
+	],
+	owners: { cldmv: { read: "cred:cldmv-read", write: "cred:cldmv-write" } },
+	defaultOwner: "cldmv"
+};
+
+describe("mergeConfig", () => {
+	it("uses the example as-is on first install (no current)", () => {
+		expect(mergeConfig(example, null)).toEqual(example);
+	});
+
+	it("takes tools from the example so allowlist removals/tightenings apply", () => {
+		const current = { ...example, tools: [{ name: "get_me", mode: "read" }, { name: "removed_tool", mode: "write" }] };
+		const merged = mergeConfig(example, current);
+		expect(merged.tools).toEqual(example.tools);
+		expect(merged.tools.find((t: { name: string }) => t.name === "removed_tool")).toBeUndefined();
+	});
+
+	it("preserves current owner data and adds example-only owners on upgrade", () => {
+		const current = { ...example, owners: { cldmv: { read: "cred:cldmv-read", write: "cred:cldmv-write", installationId: 123 } } };
+		const example2 = {
+			...example,
+			owners: {
+				cldmv: { read: "cred:cldmv-read", write: "cred:cldmv-write" },
+				acme: { read: "cred:acme-read", write: "cred:acme-write" }
+			}
+		};
+		const merged = mergeConfig(example2, current);
+		expect(merged.owners.cldmv.installationId).toBe(123); // current wins
+		expect(merged.owners.acme).toBeDefined(); // new example owner appears
+	});
+
+	it("lets current win for listen/upstream/defaultOwner/app/secrets", () => {
+		const current = { ...example, listen: "unix:/tmp/custom.sock", app: { appId: 1, privateKey: "cred:k" } };
+		const merged = mergeConfig(example, current);
+		expect(merged.listen).toBe("unix:/tmp/custom.sock");
+		expect(merged.app).toEqual({ appId: 1, privateKey: "cred:k" });
+	});
+
+	it("does not mutate its inputs", () => {
+		const ex = structuredClone(example);
+		mergeConfig(ex, { ...example, listen: "unix:/z" });
+		expect(ex).toEqual(example);
+	});
+
+	it("rejects an array as example or current (typeof reports 'object')", () => {
+		expect(() => mergeConfig([], null)).toThrow(/example config must be an object/);
+		expect(() => mergeConfig(example, [])).toThrow(/current config must be an object/);
+	});
+});

package/tests/config.test.vitest.mts

@@ -0,0 +1,314 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach } from "vitest";
+import { mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { loadConfig, indexTools } from "../src/config.ts";
+
+// loadConfig reads a real file off disk, so we materialize each fixture into the
+// repo's gitignored tmp/ and pass the path.
+const DIR = join(process.cwd(), "tmp", "config-tests");
+let counter = 0;
+
+/** Write `contents` (string or object) to a unique tmp file and return its path. */
+function writeConfig(contents: unknown): string {
+	const path = join(DIR, `cfg-${counter++}.json`);
+	writeFileSync(path, typeof contents === "string" ? contents : JSON.stringify(contents));
+	return path;
+}
+
+function baseConfig(): Record<string, unknown> {
+	return {
+		listen: "unix:/run/gh-broker/gh-broker.sock",
+		upstream: "https://api.githubcopilot.com/mcp/",
+		tools: [{ name: "get_me", mode: "read" }],
+		owners: { cldmv: { read: "cred:cldmv-read", write: "cred:cldmv-write" } }
+	};
+}
+
+beforeAll(() => {
+	mkdirSync(DIR, { recursive: true });
+});
+
+afterAll(() => {
+	rmSync(DIR, { recursive: true, force: true });
+});
+
+describe("loadConfig — file/parse errors", () => {
+	it("throws when the file cannot be read", () => {
+		expect(() => loadConfig(join(DIR, "does-not-exist.json"))).toThrow(/cannot read\/parse/);
+	});
+
+	it("throws on malformed JSON", () => {
+		const p = writeConfig("{ not json ");
+		expect(() => loadConfig(p)).toThrow(/cannot read\/parse/);
+	});
+
+	it("throws when the root is not an object", () => {
+		const p = writeConfig("123");
+		expect(() => loadConfig(p)).toThrow(/root must be an object/);
+	});
+
+	it("throws when the root is JSON null", () => {
+		const p = writeConfig("null");
+		expect(() => loadConfig(p)).toThrow(/root must be an object/);
+	});
+});
+
+describe("loadConfig — listen / upstream", () => {
+	it("rejects a non-string listen", () => {
+		const c = baseConfig();
+		delete c.listen;
+		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.listen/);
+	});
+
+	it("rejects a listen without the unix: prefix", () => {
+		const c = baseConfig();
+		c.listen = "tcp:0.0.0.0:9000";
+		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.listen/);
+	});
+
+	it("rejects a non-http upstream", () => {
+		const c = baseConfig();
+		c.upstream = "ftp://example.com";
+		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.upstream/);
+	});
+
+	it("rejects a non-string upstream", () => {
+		const c = baseConfig();
+		c.upstream = 42;
+		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.upstream/);
+	});
+});
+
+describe("loadConfig — tools", () => {
+	it("rejects a missing tools array", () => {
+		const c = baseConfig();
+		delete c.tools;
+		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.tools: must be a non-empty array/);
+	});
+
+	it("rejects an empty tools array", () => {
+		const c = baseConfig();
+		c.tools = [];
+		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.tools: must be a non-empty array/);
+	});
+
+	it("rejects a tool with no name", () => {
+		const c = baseConfig();
+		c.tools = [{ mode: "read" }];
+		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.tools\[0\]\.name: required/);
+	});
+
+	it("rejects a tool with a bad mode", () => {
+		const c = baseConfig();
+		c.tools = [{ name: "get_me", mode: "admin" }];
+		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.tools\[0\]\.mode: must be read\|write/);
+	});
+
+	it("rejects duplicate tool names", () => {
+		const c = baseConfig();
+		c.tools = [
+			{ name: "get_me", mode: "read" },
+			{ name: "get_me", mode: "write" }
+		];
+		expect(() => loadConfig(writeConfig(c))).toThrow(/duplicate tool "get_me"/);
+	});
+
+	it("carries the custom flag through, defaulting to false", () => {
+		const c = baseConfig();
+		c.tools = [
+			{ name: "get_me", mode: "read" },
+			{ name: "link_issue", mode: "write", custom: true }
+		];
+		const out = loadConfig(writeConfig(c));
+		expect(out.tools).toEqual([
+			{ name: "get_me", mode: "read", custom: false, augment: false },
+			{ name: "link_issue", mode: "write", custom: true, augment: false }
+		]);
+	});
+
+	it("carries the augment flag through, defaulting to false", () => {
+		const c = baseConfig();
+		c.tools = [
+			{ name: "get_me", mode: "read" },
+			{ name: "pull_request_read", mode: "read", augment: true }
+		];
+		const out = loadConfig(writeConfig(c));
+		expect(out.tools).toEqual([
+			{ name: "get_me", mode: "read", custom: false, augment: false },
+			{ name: "pull_request_read", mode: "read", custom: false, augment: true }
+		]);
+	});
+
+	it("rejects a tool marked both custom and augment", () => {
+		const c = baseConfig();
+		c.tools = [{ name: "weird", mode: "read", custom: true, augment: true }];
+		expect(() => loadConfig(writeConfig(c))).toThrow(/custom and augment are mutually exclusive/);
+	});
+});
+
+describe("loadConfig — owners", () => {
+	it("rejects a non-object owners", () => {
+		const c = baseConfig();
+		c.owners = "cldmv";
+		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.owners: must be an object/);
+	});
+
+	it("rejects an owner missing read/write", () => {
+		const c = baseConfig();
+		c.owners = { cldmv: { read: "cred:x" } };
+		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.owners\.cldmv: needs "read" and "write"/);
+	});
+
+	it("rejects a non-numeric installationId", () => {
+		const c = baseConfig();
+		c.owners = { cldmv: { read: "cred:r", write: "cred:w", installationId: "42" } };
+		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.owners\.cldmv\.installationId: must be a number/);
+	});
+
+	it("rejects an empty owners object", () => {
+		const c = baseConfig();
+		c.owners = {};
+		expect(() => loadConfig(writeConfig(c))).toThrow(/at least one owner required/);
+	});
+
+	it("lowercases owner keys and carries installationId", () => {
+		const c = baseConfig();
+		c.owners = { CLDMV: { read: "cred:r", write: "cred:w", installationId: 99 } };
+		const out = loadConfig(writeConfig(c));
+		expect(out.owners).toEqual({ cldmv: { read: "cred:r", write: "cred:w", installationId: 99 } });
+	});
+
+	it("omits installationId when absent", () => {
+		const out = loadConfig(writeConfig(baseConfig()));
+		expect(out.owners.cldmv).toEqual({ read: "cred:cldmv-read", write: "cred:cldmv-write" });
+		expect(out.owners.cldmv).not.toHaveProperty("installationId");
+	});
+});
+
+describe("loadConfig — defaultOwner", () => {
+	it("is undefined when omitted", () => {
+		const out = loadConfig(writeConfig(baseConfig()));
+		expect(out.defaultOwner).toBeUndefined();
+	});
+
+	it("lowercases a valid defaultOwner and carries it through", () => {
+		const c = baseConfig();
+		c.defaultOwner = "CLDMV";
+		const out = loadConfig(writeConfig(c));
+		expect(out.defaultOwner).toBe("cldmv");
+	});
+
+	it("rejects a non-string / empty defaultOwner", () => {
+		const c = baseConfig();
+		c.defaultOwner = "";
+		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.defaultOwner: must be a non-empty string/);
+	});
+
+	it("rejects a defaultOwner that is not a configured owner", () => {
+		const c = baseConfig();
+		c.defaultOwner = "nobody";
+		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.defaultOwner "nobody" is not a key of config\.owners/);
+	});
+});
+
+describe("loadConfig — app", () => {
+	it("rejects a non-numeric appId", () => {
+		const c = baseConfig();
+		c.app = { appId: "1", privateKey: "cred:app" };
+		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.app\.appId: must be a number/);
+	});
+
+	it("rejects a non-string privateKey", () => {
+		const c = baseConfig();
+		c.app = { appId: 1, privateKey: 5 };
+		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.app\.privateKey/);
+	});
+
+	it("carries a valid app config through", () => {
+		const c = baseConfig();
+		c.app = { appId: 12345, privateKey: "cred:gh-app-key" };
+		const out = loadConfig(writeConfig(c));
+		expect(out.app).toEqual({ appId: 12345, privateKey: "cred:gh-app-key" });
+	});
+
+	it("omits app when absent", () => {
+		const out = loadConfig(writeConfig(baseConfig()));
+		expect(out.app).toBeUndefined();
+	});
+});
+
+describe("loadConfig — secrets", () => {
+	it("rejects an array (which typeof reports as 'object')", () => {
+		const c = baseConfig();
+		c.secrets = [];
+		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.secrets: must be an object/);
+	});
+
+	it("rejects null", () => {
+		const c = baseConfig();
+		c.secrets = null;
+		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.secrets: must be an object/);
+	});
+
+	it("rejects an unknown provider", () => {
+		const c = baseConfig();
+		c.secrets = { provider: "vault" };
+		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.secrets\.provider/);
+	});
+
+	it("carries a valid secrets block through", () => {
+		const c = baseConfig();
+		c.secrets = { provider: "file", path: "/etc/gh-broker/secrets.json" };
+		const out = loadConfig(writeConfig(c));
+		expect(out.secrets).toEqual({ provider: "file", path: "/etc/gh-broker/secrets.json" });
+	});
+
+	it("rejects a path without the file provider (omitted → systemd-creds default)", () => {
+		const c = baseConfig();
+		c.secrets = { path: "/etc/gh-broker/secrets.json" };
+		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.secrets\.path is only used by the "file" provider/);
+	});
+
+	it("rejects a path with the systemd-creds provider", () => {
+		const c = baseConfig();
+		c.secrets = { provider: "systemd-creds", path: "/etc/gh-broker/secrets.json" };
+		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.secrets\.path is only used by the "file" provider/);
+	});
+
+	it("rejects an empty path (would be silently ignored by resolveSecretsPath)", () => {
+		const c = baseConfig();
+		c.secrets = { provider: "file", path: "" };
+		expect(() => loadConfig(writeConfig(c))).toThrow(/config\.secrets\.path: must be a non-empty string/);
+	});
+});
+
+describe("loadConfig — full valid config", () => {
+	it("returns the normalized shape", () => {
+		const c = baseConfig();
+		c.defaultOwner = "cldmv";
+		c.app = { appId: 7, privateKey: "cred:app" };
+		const out = loadConfig(writeConfig(c));
+		expect(out).toEqual({
+			listen: "unix:/run/gh-broker/gh-broker.sock",
+			upstream: "https://api.githubcopilot.com/mcp/",
+			tools: [{ name: "get_me", mode: "read", custom: false, augment: false }],
+			owners: { cldmv: { read: "cred:cldmv-read", write: "cred:cldmv-write" } },
+			app: { appId: 7, privateKey: "cred:app" },
+			defaultOwner: "cldmv"
+		});
+	});
+});
+
+describe("indexTools", () => {
+	it("builds a name→rule map", () => {
+		const rules = [
+			{ name: "get_me", mode: "read" as const },
+			{ name: "create_pull_request", mode: "write" as const, custom: false }
+		];
+		const map = indexTools(rules);
+		expect(map.size).toBe(2);
+		expect(map.get("get_me")).toEqual({ name: "get_me", mode: "read" });
+		expect(map.get("create_pull_request")).toEqual({ name: "create_pull_request", mode: "write", custom: false });
+		expect(map.get("missing")).toBeUndefined();
+	});
+});