@cldmv/gh-broker 0.7.0 → 0.8.0

package/tests/npm-setup.test.vitest.mts

@@ -0,0 +1,196 @@
+import { describe, it, expect, vi } from "vitest";
+import { createNpmToken, wantsOtp } from "../deploy/lib/npm-setup.mjs";
+
+const SESSION = "npm_SESSIONTOKEN";
+const NEW_TOKEN = "npm_NEWGRANULARTOKEN";
+const PASSWORD = "hunter2-secret";
+
+type Reply = { status: number; body?: unknown; headers?: Record<string, string> };
+const reply = (r: Reply) => ({
+	status: r.status,
+	headers: { get: (n: string) => r.headers?.[n.toLowerCase()] ?? null },
+	text: async () => (typeof r.body === "string" ? r.body : JSON.stringify(r.body ?? {}))
+});
+
+/** A scripted registry: each route pops its next reply. */
+function fakeNpm(script: { login?: Reply; polls?: Reply[]; tokens?: Reply[]; logout?: Reply | Error }) {
+	const calls: Array<{ method: string; url: string; headers: Record<string, string>; body?: any }> = [];
+	const polls = [...(script.polls ?? [{ status: 200, body: { token: SESSION } }])];
+	const tokens = [...(script.tokens ?? [{ status: 201, body: { token: NEW_TOKEN, expires: "2027-01-29T00:00:00.000Z", key: "k" } }])];
+	const fetch = vi.fn(async (url: string, init: any) => {
+		calls.push({ method: init.method, url, headers: init.headers, ...(init.body ? { body: JSON.parse(init.body) } : {}) });
+		const path = new URL(url).pathname;
+		if (path === "/-/v1/login") return reply(script.login ?? { status: 200, body: { loginUrl: "https://www.npmjs.com/login?next=/login/cli/abc", doneUrl: "https://registry.npmjs.org/-/v1/done?authId=abc" } });
+		if (path === "/-/v1/done") return reply(polls.shift() ?? { status: 500 });
+		if (path === "/-/npm/v1/tokens") return reply(tokens.shift() ?? { status: 500 });
+		if (path.startsWith("/-/user/token/")) {
+			if (script.logout instanceof Error) throw script.logout;
+			return reply(script.logout ?? { status: 200, body: { ok: true } });
+		}
+		throw new Error(`unexpected ${init.method} ${url}`);
+	});
+	return { fetch, calls };
+}
+
+/** Every answer, the OTP included, is read through the hidden prompt, in call order. */
+function prompts(answers: string[]) {
+	return { promptHidden: vi.fn(async () => answers.shift() ?? "") };
+}
+
+const run = (npm: ReturnType<typeof fakeNpm>, p = prompts([PASSWORD, "111111"]), extra: Record<string, unknown> = {}) => {
+	const logs: string[] = [];
+	const done = createNpmToken({ scopes: ["@cldmv"], tokenName: "gh-broker test", fetch: npm.fetch as any, log: (m: string) => logs.push(m), ...p, ...extra });
+	return { done, logs, p };
+};
+
+describe("createNpmToken", () => {
+	it("logs in through the web flow, creates a scoped read-write token without 2FA bypass, and revokes the session", async () => {
+		const npm = fakeNpm({});
+		const { done, logs } = run(npm);
+		await expect(done).resolves.toEqual({ token: NEW_TOKEN, expires: "2027-01-29T00:00:00.000Z" });
+		expect(logs.join("\n")).toContain("https://www.npmjs.com/login?next=/login/cli/abc");
+
+		const create = npm.calls.find((c) => c.url.endsWith("/-/npm/v1/tokens"))!;
+		expect(create.headers.authorization).toBe(`Bearer ${SESSION}`);
+		expect(create.headers["npm-otp"]).toBe("111111");
+		expect(create.body).toEqual({ name: "gh-broker test", scopes: ["@cldmv"], packages_and_scopes_permission: "read-write", expires: 90, password: PASSWORD });
+		expect(create.body).not.toHaveProperty("bypass_2fa");
+
+		const logout = npm.calls.at(-1)!;
+		expect(logout.method).toBe("DELETE");
+		expect(logout.url).toBe(`https://registry.npmjs.org/-/user/token/${SESSION}`);
+		expect(logs).toContain("  npm login session revoked");
+	});
+
+	it("waits while the login is pending, honouring retry-after", async () => {
+		vi.useFakeTimers();
+		try {
+			const npm = fakeNpm({ polls: [{ status: 202, headers: { "retry-after": "2" } }, { status: 202 }, { status: 200, body: { token: SESSION } }] });
+			const { done } = run(npm);
+			await vi.advanceTimersByTimeAsync(3000);
+			await expect(done).resolves.toMatchObject({ token: NEW_TOKEN });
+			expect(npm.calls.filter((c) => c.url.includes("/-/v1/done"))).toHaveLength(3);
+		} finally {
+			vi.useRealTimers();
+		}
+	});
+
+	it("gives up when the login is never approved", async () => {
+		const npm = fakeNpm({ polls: Array.from({ length: 5 }, () => ({ status: 202, headers: { "retry-after": "0.001" } })) });
+		await expect(run(npm, undefined, { pollTimeoutMs: -1 }).done).rejects.toThrow(/timed out waiting for approval/);
+	});
+
+	it("re-prompts for the OTP when npm rejects it", async () => {
+		const npm = fakeNpm({ tokens: [{ status: 401, headers: { "www-authenticate": "OTP" } }, { status: 201, body: { token: NEW_TOKEN } }] });
+		const p = prompts([PASSWORD, "111111", "222222"]);
+		await expect(run(npm, p).done).resolves.toEqual({ token: NEW_TOKEN });
+		const creates = npm.calls.filter((c) => c.url.endsWith("/-/npm/v1/tokens"));
+		expect(creates.map((c) => c.headers["npm-otp"])).toEqual(["111111", "222222"]);
+		// password + first OTP + the replacement OTP: the password is not asked for again
+		expect(p.promptHidden).toHaveBeenCalledTimes(3);
+	});
+
+	it("re-prompts for the password (and a new OTP) when npm rejects it", async () => {
+		const npm = fakeNpm({ tokens: [{ status: 401, body: { error: "invalid password" } }, { status: 201, body: { token: NEW_TOKEN } }] });
+		const p = prompts([PASSWORD, "111111", "right-password", "222222"]);
+		await expect(run(npm, p).done).resolves.toEqual({ token: NEW_TOKEN });
+		expect(npm.calls.filter((c) => c.url.endsWith("/-/npm/v1/tokens")).map((c) => c.body.password)).toEqual([PASSWORD, "right-password"]);
+	});
+
+	it("stops after three attempts and still revokes the session", async () => {
+		const otpNo = { status: 401, headers: { "www-authenticate": "OTP" } };
+		const npm = fakeNpm({ tokens: [otpNo, otpNo, { status: 401, body: { error: "You must provide a one-time pass." } }] });
+		const { done, logs } = run(npm, prompts([PASSWORD, "1", "2", "3"]));
+		await expect(done).rejects.toThrow(/npm token creation failed \(HTTP 401\)/);
+		expect(npm.calls.at(-1)!.method).toBe("DELETE");
+		expect(logs).toContain("  npm login session revoked");
+	});
+
+	it("fails on an unexpected registry error, revoking the session", async () => {
+		const npm = fakeNpm({ tokens: [{ status: 400, body: { message: "expires must be at most 90 days" } }] });
+		await expect(run(npm).done).rejects.toThrow(/HTTP 400\): expires must be at most 90 days/);
+		expect(npm.calls.at(-1)!.method).toBe("DELETE");
+	});
+
+	it("fails when npm returns no token", async () => {
+		await expect(run(fakeNpm({ tokens: [{ status: 201, body: {} }] })).done).rejects.toThrow(/did not return it/);
+	});
+
+	it("reports an unrevokable session as a note, not a failure", async () => {
+		const a = run(fakeNpm({ logout: { status: 500 } }));
+		await expect(a.done).resolves.toMatchObject({ token: NEW_TOKEN });
+		expect(a.logs.at(-1)).toMatch(/could not revoke the npm login session \(HTTP 500\)/);
+		const b = run(fakeNpm({ logout: new Error("socket hang up") }));
+		await expect(b.done).resolves.toMatchObject({ token: NEW_TOKEN });
+		expect(b.logs.at(-1)).toMatch(/could not revoke the npm login session \(socket hang up\)/);
+	});
+
+	it.each([
+		[{ status: 404, body: "Not Found" }, /could not start \(HTTP 404\): Not Found/],
+		[{ status: 200, body: { loginUrl: "http://insecure", doneUrl: "https://x" } }, /could not start/]
+	] as Array<[Reply, RegExp]>)("fails when the web login cannot start (%#)", async (login, msg) => {
+		const npm = fakeNpm({ login });
+		await expect(run(npm).done).rejects.toThrow(msg);
+		expect(npm.calls).toHaveLength(1);
+	});
+
+	it.each([
+		[{ status: 200, body: {} }, /finished without a session/],
+		[{ status: 403, body: { error: "denied" } }, /web login failed \(HTTP 403\): denied/]
+	] as Array<[Reply, RegExp]>)("fails when the login poll goes wrong (%#)", async (poll, msg) => {
+		await expect(run(fakeNpm({ polls: [poll] })).done).rejects.toThrow(msg);
+	});
+
+	it("never logs the password, the OTP or any token", async () => {
+		const { done, logs } = run(fakeNpm({}));
+		await done;
+		const all = logs.join("\n");
+		for (const secret of [PASSWORD, "111111", SESSION, NEW_TOKEN]) expect(all).not.toContain(secret);
+	});
+
+	it("adds org read-write only when orgs are given", async () => {
+		const npm = fakeNpm({});
+		await run(npm, undefined, { orgs: ["cldmv"] }).done;
+		expect(npm.calls.find((c) => c.url.endsWith("/tokens"))!.body).toMatchObject({ scopes: ["@cldmv"], orgs: ["cldmv"], orgs_permission: "read-write" });
+	});
+
+	it("rejects a login URL that does not parse", async () => {
+		const npm = fakeNpm({ login: { status: 200, body: { loginUrl: "not a url", doneUrl: "https://registry.npmjs.org/-/v1/done" } } });
+		await expect(run(npm).done).rejects.toThrow(/could not start/);
+	});
+
+	it("sends no npm-otp header when the code is left empty", async () => {
+		const npm = fakeNpm({});
+		await run(npm, prompts([PASSWORD, ""])).done;
+		expect(npm.calls.find((c) => c.url.endsWith("/tokens"))!.headers).not.toHaveProperty("npm-otp");
+	});
+
+	it("uses the global fetch when none is passed", async () => {
+		const npm = fakeNpm({});
+		vi.stubGlobal("fetch", npm.fetch);
+		try {
+			const logs: string[] = [];
+			await expect(createNpmToken({ scopes: ["@cldmv"], tokenName: "t", log: (m: string) => logs.push(m), ...prompts([PASSWORD, "111111"]) })).resolves.toMatchObject({ token: NEW_TOKEN });
+		} finally {
+			vi.unstubAllGlobals();
+		}
+	});
+
+	it("uses a custom registry and token lifetime", async () => {
+		const npm = fakeNpm({ login: { status: 200, body: { loginUrl: "https://npm.example.test/login", doneUrl: "https://npm.example.test/-/v1/done?x" } } });
+		await run(npm, undefined, { registry: "https://npm.example.test/", days: 30 }).done;
+		expect(npm.calls[0]!.url).toBe("https://npm.example.test/-/v1/login");
+		expect(npm.calls.find((c) => c.url.endsWith("/tokens"))!.body.expires).toBe(30);
+	});
+});
+
+describe("wantsOtp", () => {
+	const res = (status: number, h: Record<string, string> = {}) => ({ status, headers: { get: (n: string) => h[n] ?? null } });
+	it("recognises npm's OTP signals and nothing else", () => {
+		expect(wantsOtp(res(401, { "www-authenticate": "OTP" }), {})).toBe(true);
+		expect(wantsOtp(res(401), { error: "You must provide a one-time pass." })).toBe(true);
+		expect(wantsOtp(res(401), { error: "bad password" })).toBe(false);
+		expect(wantsOtp(res(401), undefined)).toBe(false);
+		expect(wantsOtp(res(403, { "www-authenticate": "OTP" }), {})).toBe(false);
+	});
+});

package/tests/paths.test.vitest.mts

@@ -46,6 +46,11 @@ describe("paths", () => {
 		const win = await import("../src/paths.ts");
 		expect(win.configDir()).toContain("gh-broker");
 
+		vi.resetModules();
+		vi.doMock("node:process", () => ({ platform: "win32", env: {} }));
+		const winDefault = await import("../src/paths.ts");
+		expect(winDefault.configDir()).toContain("C:\\ProgramData");
+
 		vi.doUnmock("node:process");
 		vi.resetModules();
 	});

package/tests/prompt.test.vitest.mts

@@ -0,0 +1,128 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+// Stand-ins for process.stdin / process.stdout so the raw-mode reader can be driven by hand.
+const h = vi.hoisted(() => ({ stdin: null as any, stdout: null as any }));
+vi.mock("node:process", async () => {
+	const { EventEmitter } = await import("node:events");
+	class FakeStdin extends EventEmitter {
+		isTTY = true;
+		raw: boolean[] = [];
+		paused = false;
+		setRawMode(v: boolean) {
+			this.raw.push(v);
+		}
+		resume() {
+			this.paused = false;
+		}
+		pause() {
+			this.paused = true;
+		}
+	}
+	h.stdin = new FakeStdin();
+	h.stdout = { out: "", write(s: string) { this.out += s; return true; } };
+	return { stdin: h.stdin, stdout: h.stdout };
+});
+
+import { promptLine, promptHidden, confirm, choose } from "../deploy/lib/prompt.mjs";
+
+const type = (s: string) => h.stdin.emit("data", Buffer.from(s, "utf8"));
+
+beforeEach(() => {
+	h.stdout.out = "";
+	h.stdin.removeAllListeners("data");
+	h.stdin.raw = [];
+	h.stdin.isTTY = true;
+});
+
+describe("promptLine / promptHidden", () => {
+	it("echoes typed characters and returns the trimmed line on Enter", async () => {
+		const p = promptLine("name? ");
+		type("  ab");
+		type("c \r");
+		expect(await p).toBe("abc");
+		expect(h.stdout.out).toBe("name?   abc \n");
+		expect(h.stdin.raw).toEqual([true, false]);
+		expect(h.stdin.paused).toBe(true);
+		expect(h.stdin.listenerCount("data")).toBe(0);
+	});
+
+	it("does not echo hidden input", async () => {
+		const p = promptHidden("secret: ");
+		type("hunter2\n");
+		expect(await p).toBe("hunter2");
+		expect(h.stdout.out).toBe("secret: \n");
+	});
+
+	it("handles Backspace (DEL and BS), including on empty input", async () => {
+		const p = promptLine("? ");
+		type("\x7f"); // nothing to delete
+		type("abc\x7f\x08d\n");
+		expect(await p).toBe("ad");
+		expect(h.stdout.out).toContain("\b \b");
+
+		const q = promptHidden("? ");
+		h.stdout.out = "";
+		type("ab\x7f\n");
+		expect(await q).toBe("a");
+		expect(h.stdout.out).not.toContain("\b \b");
+	});
+
+	it("returns what was typed on Ctrl-D, and rejects on Ctrl-C", async () => {
+		const p = promptLine("? ");
+		type("xy\x04");
+		expect(await p).toBe("xy");
+
+		const q = promptLine("? ");
+		type("xy\x03");
+		await expect(q).rejects.toThrow("aborted");
+	});
+
+	it("skips raw mode when stdin is not a TTY", async () => {
+		h.stdin.isTTY = false;
+		const p = promptLine("? ");
+		type("ok\n");
+		expect(await p).toBe("ok");
+		expect(h.stdin.raw).toEqual([]);
+	});
+});
+
+describe("confirm", () => {
+	it.each([
+		["y\n", true],
+		["YES\n", true],
+		["n\n", false],
+		["\n", false],
+		["yeah\n", false]
+	])("%j -> %s", async (input, expected) => {
+		const p = confirm("sure?");
+		type(input);
+		expect(await p).toBe(expected);
+		expect(h.stdout.out).toContain("sure? [y/N] ");
+	});
+});
+
+describe("choose", () => {
+	const opts = [
+		{ key: "a", label: "Alpha" },
+		{ key: "b", label: "Beta" }
+	];
+
+	it("lists the options and returns the chosen key", async () => {
+		const p = choose("pick", opts);
+		type("2\n");
+		expect(await p).toBe("b");
+		expect(h.stdout.out).toContain("pick\n  1) Alpha\n  2) Beta\n");
+	});
+
+	it("uses the default on empty input, and falls back to it on invalid input", async () => {
+		let p = choose("pick", opts, 2);
+		type("\n");
+		expect(await p).toBe("b");
+		p = choose("pick", opts);
+		type("9\n");
+		expect(await p).toBe("a");
+		p = choose("pick", opts);
+		type("zz\n");
+		expect(await p).toBe("a");
+	});
+});

package/tests/release-prs.test.vitest.mts

@@ -203,6 +203,16 @@ describe("reportReleasePrs", () => {
 		expect(out.releasePrs).toEqual([]);
 	});
 
+	it("stops with rate-limited when the changelog lookup itself is rate limited", async () => {
+		const octokit = octokitWith(async (route) => {
+			if (route === "GET /search/issues") return search([hit("a", 1, "release: v1.0.0")]);
+			if (route === "GET /repos/{owner}/{repo}/pulls/{pull_number}") return pull();
+			throw status(429, "Too Many Requests");
+		});
+		const out = await reportReleasePrs(octokit, { owner: "cldmv" });
+		expect(out.truncatedReason).toBe("rate-limited");
+	});
+
 	it("omits retryAfterSeconds when GitHub sent none", async () => {
 		const octokit = octokitWith(async () => { throw status(429, "Too Many Requests"); });
 		const out = await reportReleasePrs(octokit, { owner: "cldmv" });

package/tests/router.test.vitest.mts

@@ -70,7 +70,7 @@ describe("Router.call", () => {
 	beforeEach(() => {
 		vi.clearAllMocks();
 		vi.spyOn(console, "log").mockImplementation(() => {}); // silence audit output
-		secrets = { resolve: vi.fn((ref: string) => `token:${ref}`) };
+		secrets = { resolve: vi.fn((ref: string) => `token:${ref}`), has: vi.fn(() => true) };
 		upstream = { forward: vi.fn().mockResolvedValue({ content: [{ type: "text", text: "ok" }] }) };
 	});
 
@@ -87,7 +87,12 @@ describe("Router.call", () => {
 	it("advertisedTools returns the config tools", () => {
 		const cfg = makeConfig();
 		const r = new Router(cfg, secrets as any, upstream as any);
-		expect(r.advertisedTools()).toBe(cfg.tools);
+		expect(r.advertisedTools()).toEqual(cfg.tools);
+	});
+
+	it("advertisedTools leaves out a tool whose optional integration is not set up", () => {
+		const cfg = makeConfig({ tools: [{ name: "get_me", mode: "read" }, { name: "npm_scaffold", mode: "write", custom: true }] });
+		expect(new Router(cfg, secrets as any, upstream as any).advertisedTools().map((t) => t.name)).toEqual(["get_me"]);
 	});
 
 	it("forwards a read call with the resolved read PAT", async () => {
@@ -152,6 +157,56 @@ describe("Router.call", () => {
 			expect(out).toEqual({ content: [{ type: "text", text: "thread PRRT_1: isResolved=true" }] });
 		});
 
+		it("npm_scaffold is unavailable without an npm block, before any credential is read", async () => {
+			const r = new Router(makeConfig({ tools: [{ name: "npm_scaffold", mode: "write", custom: true }] }), secrets as any, upstream as any);
+			await expect(r.call("npm_scaffold", { owner: "cldmv", repo: "x", package: "@cldmv/x", otp: "123456" })).rejects.toThrow(
+				/tool "npm_scaffold" is not available on this broker: the npm integration is not configured/
+			);
+			expect(secrets.resolve).not.toHaveBeenCalled();
+		});
+
+		it("npm_scaffold is unavailable when its token is not stored", async () => {
+			secrets.has.mockImplementation((ref: string) => ref !== "cred:npm-token");
+			const cfg = makeConfig({ tools: [{ name: "npm_scaffold", mode: "write", custom: true }], npm: { token: "cred:npm-token", scopes: ["@cldmv"] } });
+			const r = new Router(cfg, secrets as any, upstream as any);
+			await expect(r.call("npm_scaffold", { owner: "cldmv", repo: "x", package: "@cldmv/x", otp: "123456" })).rejects.toThrow(/its credential "npm-token" is not stored/);
+			expect(secrets.resolve).not.toHaveBeenCalled();
+		});
+
+		it("npm_scaffold reads GitHub on the READ PAT and resolves the npm token", async () => {
+			requestMock.mockRejectedValue(Object.assign(new Error("Not Found"), { status: 404 }));
+			const cfg = makeConfig({ tools: [{ name: "npm_scaffold", mode: "write", custom: true }], npm: { token: "cred:npm-token", scopes: ["@cldmv"] } });
+			const r = new Router(cfg, secrets as any, upstream as any);
+			await expect(r.call("npm_scaffold", { owner: "cldmv", repo: "x", package: "@cldmv/x", otp: "123456" })).rejects.toThrow(/repository cldmv\/x not found/);
+			expect(Octokit).toHaveBeenLastCalledWith({ auth: "token:cred:cldmv-read" });
+			expect(secrets.resolve).toHaveBeenCalledWith("cred:npm-token");
+		});
+
+		it("npm_scaffold publishes through the configured registry and returns the verb's result", async () => {
+			const b64 = (x: string) => Buffer.from(x).toString("base64");
+			requestMock.mockImplementation(async (route: string, p: any) => {
+				if (route === "GET /repos/{owner}/{repo}") return { data: { full_name: "CLDMV/x", private: false, default_branch: "master" } };
+				if (p.path === "package.json") return { data: { type: "file", encoding: "base64", content: b64('{"name":"@cldmv/x"}') } };
+				return { data: { type: "file", encoding: "base64", content: b64("name: publish") } };
+			});
+			const urls: string[] = [];
+			const fetchMock = vi.fn(async (url: string, init: any) => {
+				urls.push(`${init.method} ${url}`);
+				return { status: init.method === "GET" ? 404 : 200, headers: { get: () => null }, text: async () => "{}" };
+			});
+			vi.stubGlobal("fetch", fetchMock);
+			try {
+				const cfg = makeConfig({ tools: [{ name: "npm_scaffold", mode: "write", custom: true }], npm: { token: "cred:npm-token", scopes: ["@cldmv"], registry: "https://npm.example.test" } });
+				const r = new Router(cfg, secrets as any, upstream as any);
+				const out = await r.call("npm_scaffold", { owner: "cldmv", repo: "x", package: "@cldmv/x", otp: "123456" });
+				expect(JSON.parse((out.content[0] as any).text)).toMatchObject({ status: "needs_otp", done: ["publish"], remaining: ["trust"] });
+				expect(urls).toEqual(["GET https://npm.example.test/@cldmv%2fx?write=true", "PUT https://npm.example.test/@cldmv%2fx"]);
+				expect(fetchMock.mock.calls[1]![1].headers.authorization).toBe("Bearer token:cred:npm-token");
+			} finally {
+				vi.unstubAllGlobals();
+			}
+		});
+
 		it("throws for an allowlisted custom verb that has no implementation", async () => {
 			const cfg = makeConfig({ tools: [{ name: "weird_verb", mode: "read", custom: true }] });
 			const r = new Router(cfg, secrets as any, upstream as any);
@@ -397,3 +452,54 @@ describe("Router.call", () => {
 		});
 	});
 });
+
+describe("Router.call — GHCR verbs", () => {
+	const ghcr = { dropDir: "/srv/gh-broker/ghcr-drop", protectReleaseTags: true, maxArchiveBytes: 1024, owners: { cldmv: { username: "u", credential: "cred:cldmv-packages", images: ["hoot"] } } };
+	const tools = [
+		{ name: "ghcr_push", mode: "write", custom: true },
+		{ name: "ghcr_push_status", mode: "read", custom: true },
+		{ name: "ghcr_tags", mode: "read", custom: true }
+	];
+	let secrets: { resolve: ReturnType<typeof vi.fn> };
+	beforeEach(() => {
+		vi.spyOn(console, "log").mockImplementation(() => {});
+		secrets = { resolve: vi.fn((ref: string) => `token:${ref}`), has: vi.fn(() => true) };
+	});
+	afterEach(() => vi.restoreAllMocks());
+
+	it("dispatches ghcr_push_status to the GHCR service and returns JSON", async () => {
+		const r = new Router(makeConfig({ tools, ghcr }), secrets as any, { forward: vi.fn() } as any);
+		expect(await r.call("ghcr_push_status", { owner: "cldmv" })).toEqual({ content: [{ type: "text", text: JSON.stringify({ jobs: [] }) }] });
+	});
+
+	it("passes GHCR refusals through (allowlist checked before any network call or GHCR credential read)", async () => {
+		const r = new Router(makeConfig({ tools, ghcr }), secrets as any, { forward: vi.fn() } as any);
+		await expect(r.call("ghcr_tags", { owner: "cldmv", image: "private" })).rejects.toThrow(/not on the allowlist/);
+		await expect(r.call("ghcr_push", { owner: "cldmv", image: "private", tag: "t", archive: "a.tar" })).rejects.toThrow(/not on the allowlist/);
+		expect(secrets.resolve).not.toHaveBeenCalledWith("cred:cldmv-packages");
+	});
+
+	it("audits and rethrows a GHCR call that names no owner", async () => {
+		const r = new Router(makeConfig({ tools, ghcr }), secrets as any, { forward: vi.fn() } as any);
+		await expect(r.call("ghcr_push_status", {})).rejects.toThrow();
+	});
+
+	it("refuses GHCR verbs when config.ghcr is absent", async () => {
+		const r = new Router(makeConfig({ tools }), secrets as any, { forward: vi.fn() } as any);
+		await expect(r.call("ghcr_push", { owner: "cldmv", image: "hoot", tag: "t", archive: "a" })).rejects.toThrow(/tool "ghcr_push" is not available on this broker: GHCR pushes are not configured/);
+	});
+
+	it("refuses an owner whose GHCR credential is not stored, while another owner's is", async () => {
+		const ghcr = {
+			dropDir: "/srv/x/drop",
+			protectReleaseTags: true,
+			maxArchiveBytes: 1,
+			owners: { cldmv: { username: "u", credential: "cred:cldmv-packages", images: ["hoot"] }, other: { username: "o", credential: "cred:other-packages", images: ["x"] } }
+		};
+		secrets.has.mockImplementation((ref: string) => ref === "cred:other-packages");
+		const r = new Router(makeConfig({ tools, ghcr }), secrets as any, { forward: vi.fn() } as any);
+		await expect(r.call("ghcr_push_status", { owner: "cldmv" })).rejects.toThrow(/owner "cldmv"'s GHCR credential "cldmv-packages" is not stored/);
+		await expect(r.call("ghcr_push_status", { owner: "other" })).resolves.toMatchObject({ content: [{ type: "text" }] });
+		expect(secrets.resolve).not.toHaveBeenCalledWith("cred:cldmv-packages");
+	});
+});

package/tests/secret-store.test.vitest.mts

@@ -5,17 +5,43 @@ vi.mock("node:fs", () => ({
 	readFileSync: vi.fn(),
 	writeFileSync: vi.fn(),
 	statSync: vi.fn(() => ({ size: 8 })),
-	rmSync: vi.fn()
+	rmSync: vi.fn(),
+	chmodSync: vi.fn(),
+	chownSync: vi.fn()
 }));
 
-import { readFileSync, existsSync, writeFileSync, rmSync } from "node:fs";
-import { readSecretsFile, removeSecretsFile, referencedCredNames, detectSecretsProvider } from "../deploy/lib/secret-store.mjs";
+import { readFileSync, existsSync, writeFileSync, rmSync, chmodSync, chownSync } from "node:fs";
+import { writeSecretsFile, readSecretsFile, removeSecretsFile, referencedCredNames, optionalCredNames, detectSecretsProvider } from "../deploy/lib/secret-store.mjs";
 
 const mockRead = vi.mocked(readFileSync);
 const mockExists = vi.mocked(existsSync);
 const mockWrite = vi.mocked(writeFileSync);
 const mockRm = vi.mocked(rmSync);
 
+describe("writeSecretsFile", () => {
+	beforeEach(() => {
+		vi.mocked(writeFileSync).mockReset();
+		vi.mocked(chmodSync).mockReset();
+		vi.mocked(chownSync).mockReset();
+	});
+
+	it("writes tab-indented JSON at 0640 and chowns to root:<gid> when a gid is given", () => {
+		writeSecretsFile("/etc/s.json", { a: "tok" }, { gid: 42 });
+		expect(writeFileSync).toHaveBeenCalledWith("/etc/s.json", '{\n\t"a": "tok"\n}\n', { mode: 0o640 });
+		expect(chmodSync).toHaveBeenCalledWith("/etc/s.json", 0o640);
+		expect(chownSync).toHaveBeenCalledWith("/etc/s.json", 0, 42);
+	});
+
+	it("honours a custom uid/mode, and skips chown without a gid (including no options at all)", () => {
+		writeSecretsFile("/etc/s.json", {}, { uid: 7, gid: 9, mode: 0o600 });
+		expect(chmodSync).toHaveBeenCalledWith("/etc/s.json", 0o600);
+		expect(chownSync).toHaveBeenCalledWith("/etc/s.json", 7, 9);
+		vi.mocked(chownSync).mockClear();
+		writeSecretsFile("/etc/s.json", {});
+		expect(chownSync).not.toHaveBeenCalled();
+	});
+});
+
 describe("readSecretsFile", () => {
 	beforeEach(() => mockRead.mockReset());
 
@@ -24,6 +50,12 @@ describe("readSecretsFile", () => {
 		expect(readSecretsFile("/x")).toEqual({ a: "tok", e: "ok" });
 	});
 
+	it("returns {} when the file is absent", () => {
+		mockExists.mockReturnValueOnce(false);
+		expect(readSecretsFile("/x")).toEqual({});
+		expect(mockRead).not.toHaveBeenCalled();
+	});
+
 	it("returns {} for a non-object or unparseable file", () => {
 		mockRead.mockReturnValue("[1,2,3]" as any);
 		expect(readSecretsFile("/x")).toEqual({});
@@ -56,6 +88,20 @@ describe("removeSecretsFile", () => {
 	});
 });
 
+describe("optionalCredNames", () => {
+	it("lists the npm token and nothing required", () => {
+		const cfg = { owners: { o: { read: "cred:a", write: "cred:b" } }, app: { privateKey: "cred:k" }, npm: { token: "cred:npm-token", scopes: ["@cldmv"] } };
+		expect(optionalCredNames(cfg)).toEqual(["npm-token"]);
+		expect(optionalCredNames({ owners: cfg.owners })).toEqual([]);
+		expect(optionalCredNames({ npm: { token: "npm_inline" } })).toEqual([]);
+		expect(optionalCredNames({ ...cfg, ghcr: { owners: { cldmv: { credential: "cred:cldmv-packages" }, x: { credential: "inline" } } } })).toEqual(["npm-token", "cldmv-packages"]);
+	});
+
+	it("rejects an unsafe cred name", () => {
+		expect(() => optionalCredNames({ npm: { token: "cred:../x" } })).toThrow(/unsafe credential name/);
+	});
+});
+
 describe("referencedCredNames", () => {
 	it("collects distinct cred names from owners + app, ignoring non-cred refs", () => {
 		const cfg = {
@@ -63,6 +109,21 @@ describe("referencedCredNames", () => {
 			app: { privateKey: "cred:k" }
 		};
 		expect(referencedCredNames(cfg).sort()).toEqual(["a", "b", "c", "k"]);
+		expect(referencedCredNames({ owners: { o: { read: "plain-token", write: 5 } } })).toEqual([]);
+	});
+
+	it("includes the npm token ref", () => {
+		const cfg = { owners: { o: { read: "cred:a", write: "cred:b" } }, npm: { token: "cred:npm-token", scopes: ["@cldmv"] } };
+		expect(referencedCredNames(cfg).sort()).toEqual(["a", "b", "npm-token"]);
+	});
+
+	it("includes each ghcr owner's credential, so the installer prompts for it", () => {
+		const cfg = {
+			owners: { cldmv: { read: "cred:cldmv-read", write: "cred:cldmv-write" } },
+			ghcr: { owners: { cldmv: { credential: "cred:cldmv-packages" } } }
+		};
+		expect(referencedCredNames(cfg).sort()).toEqual(["cldmv-packages", "cldmv-read", "cldmv-write"]);
+		expect(() => referencedCredNames({ ghcr: { owners: { o: { credential: "cred:../x" } } } })).toThrow(/unsafe credential name/);
 	});
 
 	it("returns [] with no owners", () => {

package/tests/secrets.test.vitest.mts

@@ -107,12 +107,46 @@ describe("loadSecretStore (file provider)", () => {
 		expect(() => loadSecretStore(config(undefined, { secrets: { provider: "vault", path: SECRETS } }))).toThrow(/unknown provider/);
 	});
 
+	it("treats the ghcr credentials as optional: startup does not need them, has() reports them", () => {
+		const ghcr = { dropDir: "/srv/x/y", protectReleaseTags: true, maxArchiveBytes: 1, owners: { cldmv: { username: "u", credential: "cred:cldmv-packages", images: ["hoot"] } } };
+		secretsFile({ "cldmv-read": "r", "cldmv-write": "w" });
+		expect(loadSecretStore(config(undefined, { ghcr })).has("cred:cldmv-packages")).toBe(false);
+		secretsFile({ "cldmv-read": "r", "cldmv-write": "w", "cldmv-packages": "p" });
+		const store = loadSecretStore(config(undefined, { ghcr }));
+		expect(store.has("cred:cldmv-packages")).toBe(true);
+		expect(store.resolve("cred:cldmv-packages")).toBe("p");
+		const bad = { ...ghcr, owners: { cldmv: { ...ghcr.owners.cldmv, credential: "cred:../x" } } };
+		expect(() => loadSecretStore(config(undefined, { ghcr: bad }))).toThrow(/unsafe credential name/);
+	});
+
 	it("rejects a non-cred config.app.privateKey (would inline a secret in the config)", () => {
 		secretsFile({ "cldmv-read": "r", "cldmv-write": "w" });
 		expect(() => loadSecretStore(config(undefined, { app: { appId: 1, privateKey: "-----BEGIN PRIVATE KEY-----" } }))).toThrow(
 			/config.app.privateKey must be a "cred:<name>" ref/
 		);
 	});
+
+	it("requires a valid config.app.privateKey cred to be stored", () => {
+		secretsFile({ "cldmv-read": "r", "cldmv-write": "w", "app-key": "pem" });
+		const store = loadSecretStore(config(undefined, { app: { appId: 1, privateKey: "cred:app-key" } }));
+		expect(store.resolve("cred:app-key")).toBe("pem");
+		secretsFile({ "cldmv-read": "r", "cldmv-write": "w" });
+		expect(() => loadSecretStore(config(undefined, { app: { appId: 1, privateKey: "cred:app-key" } }))).toThrow(/app-key/);
+	});
+
+	it("treats the npm token as optional: has() reports it, startup does not require it", () => {
+		const npm = { token: "cred:npm-token", scopes: ["@cldmv"] };
+		secretsFile({ "cldmv-read": "r", "cldmv-write": "w", "npm-token": "npm_x" });
+		const store = loadSecretStore(config(undefined, { npm }));
+		expect(store.has("cred:npm-token")).toBe(true);
+		expect(store.resolve("cred:npm-token")).toBe("npm_x");
+		secretsFile({ "cldmv-read": "r", "cldmv-write": "w" });
+		const without = loadSecretStore(config(undefined, { npm }));
+		expect(without.has("cred:npm-token")).toBe(false);
+		expect(without.has("cred:cldmv-read")).toBe(true);
+		expect(() => loadSecretStore(config(undefined, { npm: { ...npm, token: "npm_inline" } }))).toThrow(/config.npm.token must be a "cred:<name>" ref/);
+		expect(() => loadSecretStore(config(undefined, { npm: { ...npm, token: "cred:../x" } }))).toThrow(/unsafe credential name/);
+	});
 });
 
 describe("loadSecretStore (systemd-creds provider, the default)", () => {
@@ -152,4 +186,23 @@ describe("loadSecretStore (systemd-creds provider, the default)", () => {
 		expect(store.resolve("cred:cldmv-read")).toBe("rtok");
 		expect(store.resolve("cred:cldmv-write")).toBe("wtok");
 	});
+
+	it("defaults to systemd-creds when config.secrets is absent", () => {
+		mockRead.mockReturnValue("tok" as any);
+		const cfg = scConfig();
+		delete cfg.secrets;
+		expect(loadSecretStore(cfg).resolve("cred:cldmv-read")).toBe("tok");
+	});
+
+	it("fails startup when a required credential cannot be read", () => {
+		mockRead.mockImplementation(() => {
+			throw new Error("ENOENT");
+		});
+		expect(() => loadSecretStore(scConfig())).toThrow(/credential "cldmv-read" not available: ENOENT/);
+	});
+
+	it("fails startup when a required credential is empty", () => {
+		mockRead.mockReturnValue("\n" as any);
+		expect(() => loadSecretStore(scConfig())).toThrow(/credential "cldmv-read" is empty/);
+	});
 });