@kafca/agentdock 0.1.61 → 0.1.63

package/dist-electron/tests/electron/automation-script-approval.test.js

@@ -0,0 +1,553 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_test_1 = __importDefault(require("node:test"));
+const local_core_acp_store_js_1 = require("../../services/local-ai-core/src/acp/local-core-acp-store.js");
+const automation_script_service_js_1 = require("../../services/local-ai-core/src/automation/automation-script-service.js");
+const NOW = '2026-07-08T12:00:00.000Z';
+function tempDir(prefix) {
+    return (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), prefix));
+}
+function removeTempTree(path) {
+    makeWritable(path);
+    (0, node_fs_1.rmSync)(path, { recursive: true, force: true });
+}
+function makeWritable(path) {
+    let stat;
+    try {
+        stat = (0, node_fs_1.lstatSync)(path);
+    }
+    catch {
+        return;
+    }
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+        try {
+            (0, node_fs_1.chmodSync)(path, 0o644);
+        }
+        catch {
+            // Best effort for portable test cleanup.
+        }
+        return;
+    }
+    try {
+        (0, node_fs_1.chmodSync)(path, 0o755);
+    }
+    catch {
+        // Best effort for portable test cleanup.
+    }
+    for (const entry of (0, node_fs_1.readdirSync)(path)) {
+        makeWritable((0, node_path_1.join)(path, entry));
+    }
+}
+function writeBundle(root, overrides = {}) {
+    const manifest = {
+        protocolVersion: 1,
+        entrypoint: 'run.sh',
+        config: {},
+        configSchema: { type: 'object' },
+        capabilities: {
+            network: 'none',
+            internalAccess: false,
+            allowedReadDirs: [],
+            ...(overrides.capabilities || {}),
+        },
+        secretRefs: overrides.secretRefs || [],
+        env: overrides.env || [],
+        testPlan: overrides.testPlan || { command: 'manual', cases: ['happy-path'] },
+        limits: { timeoutMs: 30_000, stdoutBytes: 8192, stderrBytes: 8192, payloadBytes: 8192, stateBytes: 8192 },
+    };
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(root, 'manifest.json'), `${JSON.stringify(manifest, null, 2)}\n`);
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(root, 'run.sh'), '#!/bin/sh\necho ok\n');
+}
+function createHarness(options = {}) {
+    const userDataPath = tempDir('automation-script-approval-store-');
+    const sourceDir = tempDir('automation-script-approval-bundle-');
+    writeBundle(sourceDir, options);
+    const store = new local_core_acp_store_js_1.LocalCoreAcpStore(userDataPath);
+    const internals = store;
+    const service = new automation_script_service_js_1.AutomationScriptService({
+        db: internals.db,
+        security: internals.security,
+        clock: () => new Date(options.now || NOW),
+    });
+    const script = store.createAutomationScript({
+        workspaceId: 'workspace-approval',
+        title: 'Check inbox',
+        description: 'approved script',
+    });
+    const version = store.createAutomationScriptVersionFromPackage({
+        scriptId: script.id,
+        sourceDir,
+        interpreterPath: '/bin/sh',
+        interpreterVersion: 'sh 1.0',
+    });
+    return {
+        userDataPath,
+        sourceDir,
+        store,
+        db: internals.db,
+        service,
+        script,
+        version,
+        cleanup() {
+            store.close();
+            removeTempTree(userDataPath);
+            removeTempTree(sourceDir);
+        },
+    };
+}
+const passedReport = {
+    status: 'passed',
+    finishedAt: NOW,
+    summary: 'Manual package approval smoke test passed.',
+};
+function approveThroughTwoStages(harness) {
+    const testApproval = harness.service.requestTestApproval(harness.version.id, 'author');
+    harness.store.resolveApprovalRequest(testApproval.approvalId, {
+        status: 'approved',
+        resolvedBy: 'security',
+        resolution: 'allow isolated package test',
+    });
+    harness.service.authorizeTest(harness.version.id, testApproval.approvalId, 'security');
+    harness.service.recordTestResult(harness.version.id, passedReport);
+    const enableApproval = harness.service.requestEnableApproval(harness.version.id, 'author');
+    harness.store.resolveApprovalRequest(enableApproval.approvalId, {
+        status: 'approved',
+        resolvedBy: 'owner',
+        resolution: 'enable after test evidence',
+    });
+    return harness.service.approveVersion(harness.version.id, enableApproval.approvalId, 'owner');
+}
+function advanceToTested(harness) {
+    const testApproval = harness.service.requestTestApproval(harness.version.id, 'author');
+    harness.store.resolveApprovalRequest(testApproval.approvalId, {
+        status: 'approved',
+        resolvedBy: 'security',
+        resolution: 'allow isolated package test',
+    });
+    harness.service.authorizeTest(harness.version.id, testApproval.approvalId, 'security');
+    return harness.service.recordTestResult(harness.version.id, passedReport);
+}
+function mutateVersion(harness, mutate) {
+    const current = harness.store.listAutomationScriptVersions(harness.script.id)
+        .find((candidate) => candidate.id === harness.version.id);
+    strict_1.default.ok(current, 'version must exist before mutation');
+    const next = mutate(current);
+    harness.db.prepare(`
+    UPDATE automation_script_versions
+    SET status = ?, package_sha256 = ?, updated_at = ?, version_json = ?
+    WHERE id = ?
+  `).run(next.status, next.packageSha256, next.updatedAt, JSON.stringify(next), next.id);
+}
+function mutateApprovalMetadata(harness, approvalId, mutate) {
+    const approval = harness.store.getApprovalRequest(approvalId);
+    strict_1.default.ok(approval, 'approval must exist before mutation');
+    harness.db.prepare('UPDATE approval_requests SET metadata_json = ? WHERE id = ?')
+        .run(JSON.stringify(mutate({ ...(approval.metadata || {}) })), approvalId);
+}
+(0, node_test_1.default)('requires test approval before recording results and enable approval before approval', () => {
+    const h = createHarness({
+        capabilities: { network: 'public', allowedReadDirs: ['/tmp/inbox'] },
+        secretRefs: ['env://SLACK_TOKEN'],
+    });
+    try {
+        const testApproval = h.service.requestTestApproval(h.version.id, 'author');
+        strict_1.default.equal(testApproval.kind, 'automation_script_test');
+        strict_1.default.equal(testApproval.status, 'pending');
+        strict_1.default.equal(testApproval.metadata?.versionId, h.version.id);
+        strict_1.default.equal(testApproval.metadata?.packageSha256, h.version.packageSha256);
+        strict_1.default.match(String(testApproval.metadata?.manifestDigest), /^[a-f0-9]{64}$/);
+        strict_1.default.match(String(testApproval.metadata?.testPlanDigest), /^[a-f0-9]{64}$/);
+        strict_1.default.deepEqual((testApproval.metadata?.permissionSnapshot).secretEnvRefs, ['env://SLACK_TOKEN']);
+        strict_1.default.ok(testApproval.scopes.includes('network.access'));
+        strict_1.default.ok(testApproval.scopes.includes('secrets.access'));
+        strict_1.default.equal(h.store.listAutomationScriptVersions(h.script.id)[0]?.status, 'pending_test_approval');
+        h.store.resolveApprovalRequest(testApproval.approvalId, {
+            status: 'approved',
+            resolvedBy: 'security',
+            resolution: 'allow isolated package test',
+        });
+        const authorized = h.service.authorizeTest(h.version.id, testApproval.approvalId, 'security');
+        strict_1.default.equal(authorized.status, 'test_authorized');
+        strict_1.default.equal(authorized.testAuthorization?.approvalId, testApproval.approvalId);
+        const tested = h.service.recordTestResult(h.version.id, passedReport);
+        strict_1.default.equal(tested.status, 'tested');
+        strict_1.default.equal(tested.testReport?.status, 'passed');
+        const enableApproval = h.service.requestEnableApproval(h.version.id, 'author');
+        strict_1.default.equal(enableApproval.kind, 'automation_script_enable');
+        strict_1.default.equal(enableApproval.metadata?.versionId, h.version.id);
+        strict_1.default.equal(h.store.listAutomationScriptVersions(h.script.id)[0]?.status, 'pending_approval');
+        h.store.resolveApprovalRequest(enableApproval.approvalId, {
+            status: 'approved',
+            resolvedBy: 'owner',
+            resolution: 'enable after test evidence',
+        });
+        const approved = h.service.approveVersion(h.version.id, enableApproval.approvalId, 'owner');
+        strict_1.default.equal(approved.status, 'approved');
+        strict_1.default.equal(approved.approval?.approvalId, enableApproval.approvalId);
+        const auditTypes = h.store.listAuditEvents({ workspaceId: h.script.workspaceId, limit: 20 })
+            .events.map((event) => event.type);
+        strict_1.default.ok(auditTypes.includes('automation.script.test_authorized'));
+        strict_1.default.ok(auditTypes.includes('automation.script.approved'));
+    }
+    finally {
+        h.cleanup();
+    }
+});
+(0, node_test_1.default)('rejected approvals reject the script version and approved versions can be revoked', () => {
+    const rejectedHarness = createHarness();
+    try {
+        const testApproval = rejectedHarness.service.requestTestApproval(rejectedHarness.version.id, 'author');
+        rejectedHarness.store.resolveApprovalRequest(testApproval.approvalId, {
+            status: 'rejected',
+            resolvedBy: 'security',
+            resolution: 'test plan is incomplete',
+        });
+        const rejected = rejectedHarness.service.authorizeTest(rejectedHarness.version.id, testApproval.approvalId, 'security');
+        strict_1.default.equal(rejected.status, 'rejected');
+        strict_1.default.equal(rejected.rejection?.approvalId, testApproval.approvalId);
+    }
+    finally {
+        rejectedHarness.cleanup();
+    }
+    const revokedHarness = createHarness();
+    try {
+        approveThroughTwoStages(revokedHarness);
+        const revoked = revokedHarness.service.revokeVersion(revokedHarness.version.id, 'owner');
+        strict_1.default.equal(revoked.status, 'revoked');
+        strict_1.default.equal(revoked.revocation?.actor, 'owner');
+        const auditTypes = revokedHarness.store.listAuditEvents({ workspaceId: revokedHarness.script.workspaceId, limit: 20 })
+            .events.map((event) => event.type);
+        strict_1.default.ok(auditTypes.includes('automation.script.revoked'));
+    }
+    finally {
+        revokedHarness.cleanup();
+    }
+});
+(0, node_test_1.default)('test authorization is one-shot', () => {
+    const h = createHarness();
+    try {
+        const approval = h.service.requestTestApproval(h.version.id, 'author');
+        h.store.resolveApprovalRequest(approval.approvalId, {
+            status: 'approved',
+            resolvedBy: 'security',
+            resolution: 'allow test once',
+        });
+        h.service.authorizeTest(h.version.id, approval.approvalId, 'security');
+        strict_1.default.throws(() => h.service.authorizeTest(h.version.id, approval.approvalId, 'security'), /one-shot|already authorized|test authorization/i);
+        h.service.recordTestResult(h.version.id, passedReport);
+        strict_1.default.throws(() => h.service.recordTestResult(h.version.id, passedReport), /one-shot|already recorded|test_authorized/i);
+    }
+    finally {
+        h.cleanup();
+    }
+});
+(0, node_test_1.default)('claiming a test execution atomically consumes the test authorization before sandbox work', () => {
+    const h = createHarness();
+    try {
+        const approval = h.service.requestTestApproval(h.version.id, 'author');
+        h.store.resolveApprovalRequest(approval.approvalId, {
+            status: 'approved', resolvedBy: 'security', resolution: 'allow one test',
+        });
+        h.service.authorizeTest(h.version.id, approval.approvalId, 'security');
+        strict_1.default.equal(h.service.claimTestExecution(h.version.id).status, 'testing');
+        strict_1.default.throws(() => h.service.claimTestExecution(h.version.id), /test_authorized/);
+        strict_1.default.equal(h.service.recordTestResult(h.version.id, passedReport).status, 'tested');
+    }
+    finally {
+        h.cleanup();
+    }
+});
+(0, node_test_1.default)('a stranded testing claim is recovered to a terminal failed report after its lease', () => {
+    const h = createHarness();
+    try {
+        const approval = h.service.requestTestApproval(h.version.id, 'author');
+        h.store.resolveApprovalRequest(approval.approvalId, { status: 'approved', resolvedBy: 'security', resolution: 'allow one test' });
+        h.service.authorizeTest(h.version.id, approval.approvalId, 'security');
+        h.service.claimTestExecution(h.version.id);
+        const resumed = new automation_script_service_js_1.AutomationScriptService({
+            db: h.db,
+            security: h.store.security,
+            clock: () => new Date(Date.parse(NOW) + 11 * 60 * 1000),
+        });
+        strict_1.default.throws(() => resumed.claimTestExecution(h.version.id), /lease expired/);
+        const recovered = h.store.getAutomationScriptVersion(h.version.id);
+        strict_1.default.equal(recovered.status, 'tested');
+        strict_1.default.equal(recovered.testReport?.status, 'failed');
+        strict_1.default.throws(() => resumed.requestEnableApproval(h.version.id, 'author'), /passing server-recorded test/i);
+    }
+    finally {
+        h.cleanup();
+    }
+});
+(0, node_test_1.default)('a failed server-recorded test cannot request enable approval', () => {
+    const h = createHarness();
+    try {
+        const approval = h.service.requestTestApproval(h.version.id, 'author');
+        h.store.resolveApprovalRequest(approval.approvalId, { status: 'approved', resolvedBy: 'security', resolution: 'allow one test' });
+        h.service.authorizeTest(h.version.id, approval.approvalId, 'security');
+        h.service.recordTestResult(h.version.id, { status: 'failed', finishedAt: NOW, summary: 'fixture failed' });
+        strict_1.default.throws(() => h.service.requestEnableApproval(h.version.id, 'author'), /passing server-recorded test/i);
+    }
+    finally {
+        h.cleanup();
+    }
+});
+(0, node_test_1.default)('expired test approvals cannot authorize a test run', () => {
+    const h = createHarness();
+    try {
+        const approval = h.service.requestTestApproval(h.version.id, 'author');
+        strict_1.default.ok(approval.expiresAt, 'test approval must expire');
+        h.db.prepare('UPDATE approval_requests SET expires_at = ? WHERE id = ?').run('2026-07-08T11:59:00.000Z', approval.approvalId);
+        h.store.resolveApprovalRequest(approval.approvalId, {
+            status: 'approved',
+            resolvedBy: 'security',
+            resolution: 'approved too late',
+        });
+        strict_1.default.throws(() => h.service.authorizeTest(h.version.id, approval.approvalId, 'security'), /expired/i);
+        strict_1.default.equal(h.store.getApprovalRequest(approval.approvalId)?.status, 'expired');
+        strict_1.default.equal(h.store.listAutomationScriptVersions(h.script.id)[0]?.status, 'pending_test_approval');
+    }
+    finally {
+        h.cleanup();
+    }
+});
+(0, node_test_1.default)('approval snapshots guard package hash, permissions, and env secret references', () => {
+    const hashHarness = createHarness();
+    try {
+        advanceToTested(hashHarness);
+        const approval = hashHarness.service.requestEnableApproval(hashHarness.version.id, 'author');
+        mutateVersion(hashHarness, (version) => ({
+            ...version,
+            packageSha256: 'f'.repeat(64),
+            staticCheck: { ...version.staticCheck, packageSha256: 'f'.repeat(64) },
+        }));
+        hashHarness.store.resolveApprovalRequest(approval.approvalId, {
+            status: 'approved',
+            resolvedBy: 'owner',
+            resolution: 'enable stale hash',
+        });
+        strict_1.default.throws(() => hashHarness.service.approveVersion(hashHarness.version.id, approval.approvalId, 'owner'), /package hash/i);
+    }
+    finally {
+        hashHarness.cleanup();
+    }
+    const permissionHarness = createHarness();
+    try {
+        advanceToTested(permissionHarness);
+        const approval = permissionHarness.service.requestEnableApproval(permissionHarness.version.id, 'author');
+        mutateVersion(permissionHarness, (version) => ({
+            ...version,
+            internalAccess: true,
+            capabilities: { ...version.capabilities, internalAccess: true },
+        }));
+        permissionHarness.store.resolveApprovalRequest(approval.approvalId, {
+            status: 'approved',
+            resolvedBy: 'owner',
+            resolution: 'enable stale permissions',
+        });
+        strict_1.default.throws(() => permissionHarness.service.approveVersion(permissionHarness.version.id, approval.approvalId, 'owner'), /permission/i);
+    }
+    finally {
+        permissionHarness.cleanup();
+    }
+    const secretHarness = createHarness({ secretRefs: ['env://OLD_TOKEN'] });
+    try {
+        advanceToTested(secretHarness);
+        const approval = secretHarness.service.requestEnableApproval(secretHarness.version.id, 'author');
+        mutateVersion(secretHarness, (version) => ({
+            ...version,
+            secretRefs: ['env://NEW_TOKEN'],
+        }));
+        secretHarness.store.resolveApprovalRequest(approval.approvalId, {
+            status: 'approved',
+            resolvedBy: 'owner',
+            resolution: 'enable stale secret env refs',
+        });
+        strict_1.default.throws(() => secretHarness.service.approveVersion(secretHarness.version.id, approval.approvalId, 'owner'), /secret env/i);
+    }
+    finally {
+        secretHarness.cleanup();
+    }
+});
+(0, node_test_1.default)('test authorization rejects stale permissions, secret env refs, and digests', () => {
+    const permissionHarness = createHarness();
+    try {
+        const approval = permissionHarness.service.requestTestApproval(permissionHarness.version.id, 'author');
+        mutateVersion(permissionHarness, (version) => ({
+            ...version,
+            internalAccess: true,
+            capabilities: { ...version.capabilities, internalAccess: true },
+        }));
+        permissionHarness.store.resolveApprovalRequest(approval.approvalId, {
+            status: 'approved',
+            resolvedBy: 'security',
+            resolution: 'authorize stale permissions',
+        });
+        strict_1.default.throws(() => permissionHarness.service.authorizeTest(permissionHarness.version.id, approval.approvalId, 'security'), /permission/i);
+    }
+    finally {
+        permissionHarness.cleanup();
+    }
+    const secretHarness = createHarness({ secretRefs: ['env://OLD_TOKEN'] });
+    try {
+        const approval = secretHarness.service.requestTestApproval(secretHarness.version.id, 'author');
+        mutateVersion(secretHarness, (version) => ({
+            ...version,
+            secretRefs: ['env://NEW_TOKEN'],
+        }));
+        secretHarness.store.resolveApprovalRequest(approval.approvalId, {
+            status: 'approved',
+            resolvedBy: 'security',
+            resolution: 'authorize stale secret env refs',
+        });
+        strict_1.default.throws(() => secretHarness.service.authorizeTest(secretHarness.version.id, approval.approvalId, 'security'), /secret env/i);
+    }
+    finally {
+        secretHarness.cleanup();
+    }
+    const testPlanHarness = createHarness();
+    try {
+        const approval = testPlanHarness.service.requestTestApproval(testPlanHarness.version.id, 'author');
+        mutateVersion(testPlanHarness, (version) => ({
+            ...version,
+            testPlan: { command: 'manual', cases: ['changed-case'] },
+        }));
+        testPlanHarness.store.resolveApprovalRequest(approval.approvalId, {
+            status: 'approved',
+            resolvedBy: 'security',
+            resolution: 'authorize stale test plan',
+        });
+        strict_1.default.throws(() => testPlanHarness.service.authorizeTest(testPlanHarness.version.id, approval.approvalId, 'security'), /test plan digest/i);
+    }
+    finally {
+        testPlanHarness.cleanup();
+    }
+    const manifestHarness = createHarness();
+    try {
+        const approval = manifestHarness.service.requestTestApproval(manifestHarness.version.id, 'author');
+        mutateVersion(manifestHarness, (version) => ({
+            ...version,
+            config: { changed: true },
+        }));
+        manifestHarness.store.resolveApprovalRequest(approval.approvalId, {
+            status: 'approved',
+            resolvedBy: 'security',
+            resolution: 'authorize stale manifest',
+        });
+        strict_1.default.throws(() => manifestHarness.service.authorizeTest(manifestHarness.version.id, approval.approvalId, 'security'), /manifest digest/i);
+    }
+    finally {
+        manifestHarness.cleanup();
+    }
+});
+(0, node_test_1.default)('approval metadata must contain required digest snapshots', () => {
+    const testHarness = createHarness();
+    try {
+        const approval = testHarness.service.requestTestApproval(testHarness.version.id, 'author');
+        mutateApprovalMetadata(testHarness, approval.approvalId, (metadata) => {
+            delete metadata.manifestDigest;
+            return metadata;
+        });
+        testHarness.store.resolveApprovalRequest(approval.approvalId, {
+            status: 'approved',
+            resolvedBy: 'security',
+            resolution: 'authorize malformed metadata',
+        });
+        strict_1.default.throws(() => testHarness.service.authorizeTest(testHarness.version.id, approval.approvalId, 'security'), /manifest digest/i);
+    }
+    finally {
+        testHarness.cleanup();
+    }
+    const enableHarness = createHarness();
+    try {
+        advanceToTested(enableHarness);
+        const approval = enableHarness.service.requestEnableApproval(enableHarness.version.id, 'author');
+        mutateApprovalMetadata(enableHarness, approval.approvalId, (metadata) => ({
+            ...metadata,
+            permissionSnapshotDigest: '0'.repeat(64),
+        }));
+        enableHarness.store.resolveApprovalRequest(approval.approvalId, {
+            status: 'approved',
+            resolvedBy: 'owner',
+            resolution: 'approve tampered metadata',
+        });
+        strict_1.default.throws(() => enableHarness.service.approveVersion(enableHarness.version.id, approval.approvalId, 'owner'), /permission snapshot digest/i);
+    }
+    finally {
+        enableHarness.cleanup();
+    }
+});
+(0, node_test_1.default)('approval transitions reject wrong approval ids and cross-workspace approvals', () => {
+    const wrongIdHarness = createHarness();
+    try {
+        const expected = wrongIdHarness.service.requestTestApproval(wrongIdHarness.version.id, 'author');
+        const wrong = wrongIdHarness.store.createApprovalRequest({
+            workspaceId: wrongIdHarness.script.workspaceId,
+            kind: 'automation_script_test',
+            riskLevel: 'low',
+            title: 'Wrong test approval',
+            description: 'Wrong approval for same version',
+            requestedAction: 'Run wrong test approval',
+            requestedBy: 'author',
+            metadata: expected.metadata,
+        });
+        wrongIdHarness.store.resolveApprovalRequest(wrong.approvalId, {
+            status: 'approved',
+            resolvedBy: 'security',
+            resolution: 'approve wrong id',
+        });
+        strict_1.default.throws(() => wrongIdHarness.service.authorizeTest(wrongIdHarness.version.id, wrong.approvalId, 'security'), /approval id/i);
+    }
+    finally {
+        wrongIdHarness.cleanup();
+    }
+    const workspaceHarness = createHarness();
+    try {
+        const expected = workspaceHarness.service.requestTestApproval(workspaceHarness.version.id, 'author');
+        const crossWorkspace = workspaceHarness.store.createApprovalRequest({
+            workspaceId: 'workspace-other',
+            kind: 'automation_script_test',
+            riskLevel: 'low',
+            title: 'Cross workspace test approval',
+            description: 'Cross workspace approval for same version',
+            requestedAction: 'Run cross workspace test approval',
+            requestedBy: 'author',
+            metadata: expected.metadata,
+        });
+        mutateVersion(workspaceHarness, (version) => ({
+            ...version,
+            pendingTestApprovalId: crossWorkspace.approvalId,
+        }));
+        workspaceHarness.store.resolveApprovalRequest(crossWorkspace.approvalId, {
+            status: 'approved',
+            resolvedBy: 'security',
+            resolution: 'approve cross workspace id',
+        });
+        strict_1.default.throws(() => workspaceHarness.service.authorizeTest(workspaceHarness.version.id, crossWorkspace.approvalId, 'security'), /workspace/i);
+    }
+    finally {
+        workspaceHarness.cleanup();
+    }
+});
+(0, node_test_1.default)('approval service rejects mismatched duplicated version row data', () => {
+    const h = createHarness();
+    try {
+        const corrupted = {
+            ...h.version,
+            packageSha256: 'e'.repeat(64),
+        };
+        h.db.prepare('UPDATE automation_script_versions SET version_json = ? WHERE id = ?')
+            .run(JSON.stringify(corrupted), h.version.id);
+        strict_1.default.throws(() => h.service.requestTestApproval(h.version.id, 'author'), /mismatch between duplicated columns|invalid persisted data/i);
+    }
+    finally {
+        h.cleanup();
+    }
+});