@cldmv/gh-broker 0.7.0 → 0.8.0

package/tests/security-alerts.test.vitest.mts

@@ -172,6 +172,16 @@ describe("reportSecurityAlerts — org-level reads", () => {
 		expect(out.alerts.find((a) => a.type === "secrets")).toMatchObject({ severity: "open", summary: "" });
 	});
 
+	it("leaves the location off a code scanning alert whose instance has no path", async () => {
+		const bare = { number: 7, html_url: "u", created_at: "t", repository: { full_name: "CLDMV/a" } };
+		const octokit = octokitWith(async (route) => ({
+			data: route === "GET /orgs/{owner}/code-scanning/alerts" ? [{ ...bare, most_recent_instance: { location: {} } }, { ...bare, number: 8 }] : [],
+			headers: {}
+		}));
+		const out = await reportSecurityAlerts(octokit, { owner: "cldmv" });
+		for (const a of out.alerts.filter((x) => x.type === "codeql")) expect(a).not.toHaveProperty("location");
+	});
+
 	it("flags max-alerts when a type fills its alertLimit", async () => {
 		const octokit = octokitWith(async (route) => ({ data: route.includes("dependabot") ? [dependabot(1, { repository: { full_name: "CLDMV/a" } }), dependabot(2, { repository: { full_name: "CLDMV/a" } })] : [], headers: {} }));
 		const out = await reportSecurityAlerts(octokit, { owner: "cldmv", alertLimit: 2 });

package/tests/server.test.vitest.mts

@@ -1,12 +1,77 @@
-import { describe, it, expect } from "vitest";
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { connect, type Socket } from "node:net";
+import { mkdirSync, rmSync, statSync, writeFileSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { Server as McpServer } from "@modelcontextprotocol/sdk/server/index.js";
 import { startServer } from "../src/server.ts";
 
-// startServer owns a long-lived net.Server it never hands back, so a successful
-// listen can't be cleanly torn down from a unit test. We exercise the safe,
-// non-listening paths only: the unsupported-scheme guard (synchronous throw) and
-// a listen that fails (bind into a non-existent directory) → promise rejects.
-const fakeRouter: any = { call: () => Promise.resolve({ content: [] }) };
-const catalog: any[] = [];
+// Real node:fs, except readFileSync is a spy so the /etc/group lookup can be forced to fail.
+vi.mock("node:fs", async (importOriginal) => {
+	const actual = await importOriginal<typeof import("node:fs")>();
+	return { ...actual, readFileSync: vi.fn(actual.readFileSync) };
+});
+
+// Real node:net, except createServer remembers the server-side sockets so a test can inject events on them.
+const seen = vi.hoisted(() => ({ sockets: [] as any[] }));
+vi.mock("node:net", async (importOriginal) => {
+	const actual = await importOriginal<typeof import("node:net")>();
+	return {
+		...actual,
+		createServer: (listener: (s: any) => void) =>
+			actual.createServer((s) => {
+				seen.sockets.push(s);
+				listener(s);
+			})
+	};
+});
+
+const root = join(process.cwd(), "tmp", "tests", "server");
+const fakeRouter: any = { call: vi.fn(async (name: string, args: unknown) => ({ content: [{ type: "text", text: `${name}:${JSON.stringify(args)}` }] })) };
+const catalog: any[] = [{ name: "get_me", description: "me", inputSchema: { type: "object" } }];
+const sockets: Socket[] = [];
+
+function sockPath(name: string): string {
+	mkdirSync(root, { recursive: true });
+	rmSync(join(root, name), { force: true }); // a socket left behind by an earlier run
+	return join(root, name);
+}
+
+/** Open a client connection and return a request/response helper over newline-delimited JSON-RPC. */
+async function client(path: string) {
+	const sock: Socket = await new Promise((resolve, reject) => {
+		const s = connect(path, () => resolve(s));
+		s.once("error", reject);
+	});
+	sockets.push(sock);
+	let buf = "";
+	const waiting = new Map<number, (m: any) => void>();
+	sock.on("data", (d) => {
+		buf += d.toString("utf8");
+		let nl;
+		while ((nl = buf.indexOf("\n")) >= 0) {
+			const msg = JSON.parse(buf.slice(0, nl));
+			buf = buf.slice(nl + 1);
+			waiting.get(msg.id)?.(msg);
+		}
+	});
+	let id = 0;
+	return {
+		sock,
+		request: (method: string, params: unknown) =>
+			new Promise<any>((resolve) => {
+				const i = ++id;
+				waiting.set(i, resolve);
+				sock.write(JSON.stringify({ jsonrpc: "2.0", id: i, method, params }) + "\n");
+			})
+	};
+}
+
+afterEach(() => {
+	vi.restoreAllMocks();
+	for (const s of sockets.splice(0)) s.destroy();
+	delete process.env.GH_BROKER_SOCKET_GROUP;
+	vi.mocked(readFileSync).mockClear();
+});
 
 describe("startServer", () => {
 	it("throws synchronously for a non-unix listen scheme", () => {
@@ -17,4 +82,119 @@ describe("startServer", () => {
 		const config: any = { listen: "unix:/no/such/dir/gh-broker.sock" };
 		await expect(startServer(config, fakeRouter, catalog)).rejects.toBeTruthy();
 	});
+
+	it("serves tools/list and tools/call over the socket, then drops the connection cleanly", async () => {
+		const path = sockPath("serve.sock");
+		await startServer({ listen: `unix:${path}` } as any, fakeRouter, catalog);
+		expect(statSync(path).mode & 0o777).toBe(0o660);
+
+		const c = await client(path);
+		const init = await c.request("initialize", { protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "t", version: "1" } });
+		expect(init.result.serverInfo.name).toBe("gh-broker");
+		const listed = await c.request("tools/list", {});
+		expect(listed.result.tools).toEqual(catalog);
+		const called = await c.request("tools/call", { name: "get_me", arguments: { a: 1 } });
+		expect(called.result.content[0].text).toBe('get_me:{"a":1}');
+		// arguments omitted → router receives {}
+		const noArgs = await c.request("tools/call", { name: "get_me" });
+		expect(noArgs.result.content[0].text).toBe("get_me:{}");
+
+		c.sock.destroy();
+		await new Promise((r) => setTimeout(r, 50));
+	});
+
+	it("replaces a stale socket file left by a previous run", async () => {
+		const path = sockPath("stale.sock");
+		writeFileSync(path, "");
+		await startServer({ listen: `unix:${path}` } as any, fakeRouter, catalog);
+		const c = await client(path);
+		expect((await c.request("tools/list", {})).result.tools).toEqual(catalog);
+	});
+
+	it("applies the configured socket group when it resolves", async () => {
+		const path = sockPath("group.sock");
+		// the process's own primary group always resolves and is chown-able by the owner
+		const gid = process.getgid!();
+		const groupLine = `testgrp:x:${gid}:\n`;
+		vi.mocked(readFileSync).mockImplementationOnce(((p: any, ...rest: any[]) => (p === "/etc/group" ? groupLine : undefined)) as any);
+		process.env.GH_BROKER_SOCKET_GROUP = "testgrp";
+		await startServer({ listen: `unix:${path}` } as any, fakeRouter, catalog);
+		expect(statSync(path).gid).toBe(gid);
+	});
+
+	it("still listens when the group is unknown or /etc/group is unreadable", async () => {
+		process.env.GH_BROKER_SOCKET_GROUP = "no-such-group-xyz";
+		await startServer({ listen: `unix:${sockPath("nogroup.sock")}` } as any, fakeRouter, catalog);
+
+		vi.mocked(readFileSync).mockImplementationOnce((() => {
+			throw new Error("EACCES");
+		}) as any);
+		await startServer({ listen: `unix:${sockPath("unreadable.sock")}` } as any, fakeRouter, catalog);
+	});
+
+	it("tolerates a failed chown (group the process cannot assign)", async () => {
+		const path = sockPath("chownfail.sock");
+		// gid 0 (root) is not assignable by an unprivileged owner → chownSync throws, which is swallowed
+		vi.mocked(readFileSync).mockImplementationOnce((() => "rootish:x:0:\n") as any);
+		process.env.GH_BROKER_SOCKET_GROUP = "rootish";
+		await startServer({ listen: `unix:${path}` } as any, fakeRouter, catalog);
+		const c = await client(path);
+		expect((await c.request("tools/list", {})).result.tools).toEqual(catalog);
+	});
+
+	it("survives garbage from a client without taking the server down", async () => {
+		const path = sockPath("garbage.sock");
+		await startServer({ listen: `unix:${path}` } as any, fakeRouter, catalog);
+		const bad = await client(path);
+		bad.sock.write("not json\n");
+		await new Promise((r) => setTimeout(r, 50));
+		bad.sock.destroy();
+		const good = await client(path);
+		expect((await good.request("tools/list", {})).result.tools).toEqual(catalog);
+	});
+
+	it("ignores an error on a client socket", async () => {
+		const path = sockPath("hangup.sock");
+		await startServer({ listen: `unix:${path}` } as any, fakeRouter, catalog);
+		const c = await client(path);
+		await c.request("tools/list", {});
+		const serverSide = seen.sockets.at(-1);
+		expect(() => serverSide.emit("error", new Error("ECONNRESET"))).not.toThrow();
+		expect((await c.request("tools/list", {})).result.tools).toEqual(catalog);
+	});
+
+	it("tolerates a failing MCP close when the client goes away", async () => {
+		const path = sockPath("closefail.sock");
+		await startServer({ listen: `unix:${path}` } as any, fakeRouter, catalog);
+		const close = vi.spyOn(McpServer.prototype, "close").mockRejectedValue(new Error("close failed"));
+		const c = await client(path);
+		await c.request("tools/list", {});
+		c.sock.destroy();
+		await vi.waitFor(() => expect(close).toHaveBeenCalled());
+	});
+
+	it("logs and drops a connection whose MCP transport fails to start", async () => {
+		const path = sockPath("connectfail.sock");
+		await startServer({ listen: `unix:${path}` } as any, fakeRouter, catalog);
+		vi.spyOn(McpServer.prototype, "connect").mockRejectedValue(new Error("transport broke"));
+		const err = vi.spyOn(console, "error").mockImplementation(() => {});
+		const c = await client(path);
+		await new Promise<void>((resolve) => c.sock.once("close", () => resolve()));
+		expect(err).toHaveBeenCalledWith("gh-broker: connection error: transport broke");
+	});
+
+	it("chowns with uid -1 when process.getuid is unavailable", async () => {
+		const orig = process.getuid;
+		const path = sockPath("nouid.sock");
+		const gid = process.getgid!();
+		vi.mocked(readFileSync).mockImplementationOnce(((p: any) => (p === "/etc/group" ? `testgrp:x:${gid}:\n` : undefined)) as any);
+		process.env.GH_BROKER_SOCKET_GROUP = "testgrp";
+		(process as any).getuid = undefined;
+		try {
+			await startServer({ listen: `unix:${path}` } as any, fakeRouter, catalog);
+		} finally {
+			process.getuid = orig;
+		}
+		expect(statSync(path).mode & 0o777).toBe(0o660);
+	});
 });

package/tests/smoke.test.vitest.mts

@@ -0,0 +1,177 @@
+import { describe, it, expect, afterEach, vi } from "vitest";
+import { createServer, type Server, type Socket } from "node:net";
+import { spawn } from "node:child_process";
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { smokeTest } from "../deploy/lib/smoke.mjs";
+
+// Real node:net, except connect() lets a test grab the client socket (to inject an error on it).
+const hook = vi.hoisted(() => ({ onSock: null as null | ((s: any) => void) }));
+vi.mock("node:net", async (importOriginal) => {
+	const actual = await importOriginal<typeof import("node:net")>();
+	return {
+		...actual,
+		connect: (...a: any[]) => {
+			const sock = (actual.connect as any)(...a);
+			hook.onSock?.(sock);
+			return sock;
+		}
+	};
+});
+
+const root = join(process.cwd(), "tmp", "tests", "smoke");
+mkdirSync(root, { recursive: true });
+let n = 0;
+const servers: Server[] = [];
+const conns: Socket[] = [];
+
+type Handler = (msg: any, sock: Socket) => void;
+
+/** A fake broker on a real unix socket; `onMsg` answers each newline-delimited JSON-RPC message. */
+function fakeBroker(path: string, onMsg: Handler, onConn?: (s: Socket) => void): Promise<Server> {
+	return new Promise((resolve) => {
+		const srv = createServer((sock) => {
+			conns.push(sock);
+			if (onConn) return onConn(sock);
+			let buf = "";
+			sock.on("data", (d) => {
+				buf += d.toString("utf8");
+				let nl;
+				while ((nl = buf.indexOf("\n")) >= 0) {
+					const line = buf.slice(0, nl);
+					buf = buf.slice(nl + 1);
+					onMsg(JSON.parse(line), sock);
+				}
+			});
+			sock.on("error", () => {});
+		});
+		servers.push(srv);
+		srv.listen(path, () => resolve(srv));
+	});
+}
+
+const reply = (sock: Socket, id: number, result: unknown) => sock.write(JSON.stringify({ jsonrpc: "2.0", id, result }) + "\n");
+const replyErr = (sock: Socket, id: number, error: unknown) => sock.write(JSON.stringify({ jsonrpc: "2.0", id, error }) + "\n");
+const path = () => {
+	const p = join(root, `s${++n}.sock`);
+	rmSync(p, { force: true }); // a socket left behind by an earlier run
+	return p;
+};
+
+afterEach(async () => {
+	for (const c of conns.splice(0)) c.destroy();
+	await Promise.all(servers.splice(0).map((s) => new Promise((r) => s.close(() => r(null)))));
+});
+
+describe("smokeTest", () => {
+	it("handshakes, lists tools and round-trips get_me", async () => {
+		const p = path();
+		await fakeBroker(p, (m, s) => {
+			if (m.method === "initialize") reply(s, m.id, {});
+			else if (m.method === "tools/list") reply(s, m.id, { tools: [{ name: "get_me" }, { name: "other" }] });
+			else if (m.method === "tools/call") reply(s, m.id, { content: [] });
+		});
+		expect(await smokeTest(p)).toEqual({ tools: ["get_me", "other"], roundTrip: "get_me ok" });
+	});
+
+	it("reports an isError get_me, and a failing get_me", async () => {
+		const p1 = path();
+		await fakeBroker(p1, (m, s) => {
+			if (m.method === "tools/list") reply(s, m.id, { tools: [{ name: "get_me" }] });
+			else if (m.method === "tools/call") reply(s, m.id, { isError: true });
+			else if (m.id) reply(s, m.id, {});
+		});
+		expect((await smokeTest(p1)).roundTrip).toBe("get_me returned an error");
+
+		const p2 = path();
+		await fakeBroker(p2, (m, s) => {
+			if (m.method === "tools/list") reply(s, m.id, { tools: [{ name: "get_me" }] });
+			else if (m.method === "tools/call") replyErr(s, m.id, { message: "denied" });
+			else if (m.id) reply(s, m.id, {});
+		});
+		expect((await smokeTest(p2)).roundTrip).toBe("get_me failed: denied");
+	});
+
+	it("skips the round trip when get_me is not advertised, tolerating an empty list result", async () => {
+		const p = path();
+		await fakeBroker(p, (m, s) => {
+			if (m.method === "tools/list") reply(s, m.id, {});
+			else if (m.id) reply(s, m.id, {});
+		});
+		expect(await smokeTest(p)).toEqual({ tools: [], roundTrip: null });
+	});
+
+	it("ignores blank lines, garbage and unknown ids, and reassembles split lines", async () => {
+		const p = path();
+		await fakeBroker(p, (m, s) => {
+			if (m.method === "initialize") {
+				s.write("\n   \nnot-json\n");
+				s.write(JSON.stringify({ jsonrpc: "2.0", id: 999, result: {} }) + "\n");
+				const full = JSON.stringify({ jsonrpc: "2.0", id: m.id, result: {} }) + "\n";
+				s.write(full.slice(0, 5));
+				setTimeout(() => s.write(full.slice(5)), 20);
+			} else if (m.method === "tools/list") reply(s, m.id, { tools: [] });
+		});
+		expect((await smokeTest(p)).tools).toEqual([]);
+	});
+
+	it("rejects with the rpc error message, falling back to a generic one", async () => {
+		const p1 = path();
+		await fakeBroker(p1, (m, s) => replyErr(s, m.id, { message: "bad init" }));
+		await expect(smokeTest(p1)).rejects.toThrow("bad init");
+
+		const p2 = path();
+		await fakeBroker(p2, (m, s) => replyErr(s, m.id, {}));
+		await expect(smokeTest(p2)).rejects.toThrow("rpc error");
+	});
+
+	it("retries until the socket appears", async () => {
+		const p = path();
+		const pending = smokeTest(p, { timeoutMs: 5000 });
+		await new Promise((r) => setTimeout(r, 400)); // first attempts hit ENOENT
+		await fakeBroker(p, (m, s) => {
+			if (m.method === "tools/list") reply(s, m.id, { tools: [] });
+			else if (m.id) reply(s, m.id, {});
+		});
+		expect((await pending).tools).toEqual([]);
+	});
+
+	it("retries on ECONNREFUSED (stale socket file with no listener) until the deadline", async () => {
+		const p = path();
+		// a child binds the socket and is SIGKILLed, leaving the socket file behind with nobody listening
+		const child = spawn(process.execPath, ["-e", `require("net").createServer().listen(${JSON.stringify(p)}, () => console.log("up"))`], {
+			stdio: ["ignore", "pipe", "inherit"]
+		});
+		await new Promise((r) => child.stdout.once("data", r));
+		child.kill("SIGKILL");
+		await new Promise((r) => child.once("exit", r));
+		await expect(smokeTest(p, { timeoutMs: 600 })).rejects.toThrow(/smoke: socket error .*ECONNREFUSED/);
+	});
+
+	it("gives up once the deadline passes", async () => {
+		await expect(smokeTest(path(), { timeoutMs: 300 })).rejects.toThrow(/smoke: socket error .*ENOENT/);
+	});
+
+	it("fails immediately on a non-retryable connect error", async () => {
+		const file = join(root, "plainfile");
+		writeFileSync(file, "x");
+		await expect(smokeTest(join(file, "child.sock"), { timeoutMs: 5000 })).rejects.toThrow(/smoke: socket error/);
+	});
+
+	it("rejects when the broker never answers", async () => {
+		const p = path();
+		await fakeBroker(p, () => {});
+		await expect(smokeTest(p, { timeoutMs: 100 })).rejects.toThrow("smoke: no response before deadline");
+	});
+
+	it("rejects when the socket errors mid-handshake", async () => {
+		const p = path();
+		await fakeBroker(p, () => {});
+		hook.onSock = (sock) => sock.once("connect", () => setTimeout(() => sock.emit("error", new Error("boom")), 30));
+		try {
+			await expect(smokeTest(p)).rejects.toThrow("smoke: socket error: boom");
+		} finally {
+			hook.onSock = null;
+		}
+	});
+});