@inetafrica/open-claudia 3.4.23 → 3.5.0

package/test-tool-manifest.js

@@ -8,7 +8,12 @@ const fs = require("fs");
 const os = require("os");
 const path = require("path");
 
+// The CLI asks the running bot who it acts for; never let this suite (which
+// may run inside a bot turn) reach that bot.
+for (const key of Object.keys(process.env)) if (key.startsWith("OC_")) delete process.env[key];
+
 const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "tool-manifest-test-"));
+process.env.OPEN_CLAUDIA_CONFIG_DIR = path.join(tmp, "config");
 process.env.TOOLS_DIR = path.join(tmp, "tools");
 process.env.KEYRING_FILE = path.join(tmp, "keyring.json");
 process.env.APPROVALS_DIR = path.join(tmp, "approvals");
@@ -142,6 +147,32 @@ const topLevelEnv = {};
     await toolCli.run(["run", "vaulted", "go", "--approval", b10rec.id]);
     assert.strictEqual(process.exitCode, 0, "the same token redeems once the key exists");
     assert.ok(approvals.read(b10rec.id).consumedAt, "token consumed exactly by the real run");
+
+    // ── an undeclared verb is refused at the CLI before anything else — even
+    // with an approved token for that exact command, which stays unconsumed
+    // (the smart-josephine `whatsapp chats` case used to reach the owner).
+    const chatsCmd = approvals.formatApprovedCommand(["open-claudia", "tool", "run", "fleet", "chats"]);
+    const chatsRec = approvals.create({ tool: "fleet", tier: "write", command: chatsCmd, channelId: "c1", adapter: "tg" });
+    approvals.decide(chatsRec.id, "approved", "c1");
+    errs.length = 0;
+    process.exitCode = 0;
+    await toolCli.run(["run", "fleet", "chats", "--approval", chatsRec.id]);
+    assert.strictEqual(process.exitCode, 3, "undeclared verb refused (exit 3)");
+    assert.ok(errs.some((l) => /no declared verb "chats" — its manifest allows: list, restart, purge/.test(l)), "the refusal lists the declared verbs");
+    assert.strictEqual(approvals.read(chatsRec.id).consumedAt, undefined, "the token is never redeemed for an undeclared verb");
+
+    // ── a redeemed approval exports exactly the approved tier to the tool (a
+    // write approval no longer hands nested tools destructive access) ──
+    const tierSrc = path.join(tmp, "tiered.sh");
+    fs.writeFileSync(tierSrc, `#!/usr/bin/env bash\necho "$OPEN_CLAUDIA_APPROVED_TIER" > ${JSON.stringify(path.join(tmp, "tier.out"))}\n`);
+    tools.addTool(tierSrc, { name: "tiered", description: "reports its approved tier", risk: "write" });
+    const tierCmd = approvals.formatApprovedCommand(["open-claudia", "tool", "run", "tiered", "go"]);
+    const tierRec = approvals.create({ tool: "tiered", tier: "write", command: tierCmd, channelId: "c1", adapter: "tg" });
+    approvals.decide(tierRec.id, "approved", "c1");
+    process.exitCode = 0;
+    await toolCli.run(["run", "tiered", "go", "--approval", tierRec.id]);
+    assert.strictEqual(process.exitCode, 0, "the write approval redeems");
+    assert.strictEqual(fs.readFileSync(path.join(tmp, "tier.out"), "utf-8").trim(), "write", "the run carries the approved tier, not destructive");
   } finally {
     for (const key of approvalKeys) {
       if (savedApprovalEnv[key] === undefined) delete process.env[key];