@kb-labs/shared 1.1.0

package/packages/shared-perm-presets/src/__tests__/combine.test.ts

@@ -0,0 +1,403 @@
+import { describe, it, expect } from 'vitest';
+import { combine, combinePresets } from '../combine';
+import { minimal, gitWorkflow, npmPublish, kbPlatform } from '../presets';
+import type { PermissionPreset } from '../types';
+
+describe('combine()', () => {
+  it('should return empty spec when nothing added', () => {
+    const result = combine().build();
+    expect(result).toEqual({});
+  });
+
+  it('should add a single preset', () => {
+    const result = combine().with(minimal).build();
+    expect(result.env?.read).toContain('PATH');
+    expect(result.env?.read).toContain('NODE_ENV');
+  });
+
+  it('should merge two presets', () => {
+    const result = combine()
+      .with(minimal)
+      .with(gitWorkflow)
+      .build();
+
+    const envVars = result.env?.read ?? [];
+    // From minimal
+    expect(envVars).toContain('PATH');
+    expect(envVars).toContain('NODE_ENV');
+    // From gitWorkflow
+    expect(envVars).toContain('HOME');
+    expect(envVars).toContain('USER');
+    expect(envVars).toContain('GIT_*');
+  });
+
+  it('should deduplicate env vars', () => {
+    const result = combine()
+      .with(gitWorkflow)
+      .with(npmPublish)
+      .build();
+
+    const envVars = result.env?.read ?? [];
+    // Both have HOME, USER, PATH - should appear once
+    const homeCount = envVars.filter(v => v === 'HOME').length;
+    expect(homeCount).toBe(1);
+  });
+
+  it('should merge fs.allow arrays and convert to runtime format', () => {
+    const result = combine()
+      .with(gitWorkflow)
+      .with(npmPublish)
+      .build();
+
+    // After build(), format is runtime (read/write arrays)
+    const read = result.fs?.read ?? [];
+    // From gitWorkflow
+    expect(read).toContain('**/.git/**');
+    // From npmPublish
+    expect(read).toContain('**/package.json');
+  });
+
+  it('should merge network domains', () => {
+    const result = combine()
+      .with(npmPublish)
+      .withNetwork({ fetch: ['api.example.com'] })
+      .build();
+
+    const domains = result.network?.fetch ?? [];
+    expect(domains).toContain('registry.npmjs.org');
+    expect(domains).toContain('api.example.com');
+  });
+
+  describe('withEnv()', () => {
+    it('should add custom env vars', () => {
+      const result = combine()
+        .with(minimal)
+        .withEnv(['MY_CUSTOM_VAR', 'ANOTHER_VAR'])
+        .build();
+
+      const envVars = result.env?.read ?? [];
+      expect(envVars).toContain('MY_CUSTOM_VAR');
+      expect(envVars).toContain('ANOTHER_VAR');
+      expect(envVars).toContain('PATH');
+    });
+  });
+
+  describe('withFs()', () => {
+    it('should add fs permissions and convert to runtime format', () => {
+      const result = combine()
+        .with(minimal)
+        .withFs({ mode: 'readWrite', allow: ['./data/**'] })
+        .build();
+
+      // After build(), format is runtime (read/write arrays)
+      expect(result.fs?.read).toContain('./data/**');
+      expect(result.fs?.write).toContain('./data/**');
+    });
+
+    it('should merge with existing fs', () => {
+      const result = combine()
+        .with(gitWorkflow)
+        .withFs({ allow: ['./custom/**'] })
+        .build();
+
+      const read = result.fs?.read ?? [];
+      expect(read).toContain('**/.git/**');
+      expect(read).toContain('./custom/**');
+    });
+  });
+
+  describe('withQuotas()', () => {
+    it('should add quotas', () => {
+      const result = combine()
+        .with(minimal)
+        .withQuotas({ timeoutMs: 30000, memoryMb: 512 })
+        .build();
+
+      expect(result.quotas?.timeoutMs).toBe(30000);
+      expect(result.quotas?.memoryMb).toBe(512);
+    });
+
+    it('should override quotas (last wins)', () => {
+      const result = combine()
+        .withQuotas({ timeoutMs: 10000 })
+        .withQuotas({ timeoutMs: 30000 })
+        .build();
+
+      expect(result.quotas?.timeoutMs).toBe(30000);
+    });
+  });
+
+  describe('withPlatform()', () => {
+    it('should add platform permissions with booleans', () => {
+      const result = combine()
+        .with(minimal)
+        .withPlatform({
+          llm: true,
+          cache: true,
+          analytics: true,
+        })
+        .build();
+
+      expect(result.platform?.llm).toBe(true);
+      expect(result.platform?.cache).toBe(true);
+      expect(result.platform?.analytics).toBe(true);
+    });
+
+    it('should add platform permissions with arrays', () => {
+      const result = combine()
+        .with(minimal)
+        .withPlatform({
+          cache: ['git-status:', 'workflow:'],
+          storage: ['uploads/', 'temp/'],
+        })
+        .build();
+
+      expect(result.platform?.cache).toEqual(['git-status:', 'workflow:']);
+      expect(result.platform?.storage).toEqual(['uploads/', 'temp/']);
+    });
+
+    it('should add platform permissions with objects', () => {
+      const result = combine()
+        .with(minimal)
+        .withPlatform({
+          llm: { models: ['gpt-4', 'claude-3'] },
+          vectorStore: { collections: ['docs', 'code'] },
+          eventBus: { publish: ['events.*'], subscribe: ['jobs.*'] },
+        })
+        .build();
+
+      expect(result.platform?.llm).toEqual({ models: ['gpt-4', 'claude-3'] });
+      expect(result.platform?.vectorStore).toEqual({ collections: ['docs', 'code'] });
+      expect(result.platform?.eventBus).toEqual({ publish: ['events.*'], subscribe: ['jobs.*'] });
+    });
+
+    it('should merge platform arrays (union)', () => {
+      const result = combine()
+        .withPlatform({
+          cache: ['git-status:'],
+          storage: ['uploads/'],
+        })
+        .withPlatform({
+          cache: ['workflow:'],
+          storage: ['temp/'],
+        })
+        .build();
+
+      // Arrays should be merged (union)
+      expect(result.platform?.cache).toEqual(['git-status:', 'workflow:']);
+      expect(result.platform?.storage).toEqual(['uploads/', 'temp/']);
+    });
+
+    it('should merge platform objects (spread)', () => {
+      const result = combine()
+        .withPlatform({
+          llm: { models: ['gpt-4'] },
+          vectorStore: { collections: ['docs'] },
+        })
+        .withPlatform({
+          llm: { models: ['claude-3'] },
+          vectorStore: { collections: ['code'] },
+        })
+        .build();
+
+      // Objects should be merged (last wins for same keys)
+      expect(result.platform?.llm).toEqual({ models: ['claude-3'] });
+      expect(result.platform?.vectorStore).toEqual({ collections: ['code'] });
+    });
+
+    it('should override booleans (last wins)', () => {
+      const result = combine()
+        .withPlatform({ analytics: false })
+        .withPlatform({ analytics: true })
+        .build();
+
+      expect(result.platform?.analytics).toBe(true);
+    });
+
+    it('should merge with existing platform permissions from presets', () => {
+      const presetWithPlatform: PermissionPreset = {
+        id: 'test-preset',
+        description: 'Test preset with platform',
+        permissions: {
+          platform: {
+            llm: true,
+            cache: ['preset:'],
+          },
+        },
+      };
+
+      const result = combine()
+        .with(presetWithPlatform)
+        .withPlatform({
+          cache: ['custom:'],
+          analytics: true,
+        })
+        .build();
+
+      expect(result.platform?.llm).toBe(true);
+      expect(result.platform?.cache).toEqual(['preset:', 'custom:']);
+      expect(result.platform?.analytics).toBe(true);
+    });
+
+    it('should deduplicate array values in platform permissions', () => {
+      const result = combine()
+        .withPlatform({
+          cache: ['git-status:', 'workflow:'],
+        })
+        .withPlatform({
+          cache: ['git-status:', 'cache:'], // git-status: is duplicate
+        })
+        .build();
+
+      // Should deduplicate git-status:
+      const cache = result.platform?.cache as string[];
+      expect(cache).toHaveLength(3);
+      expect(cache).toContain('git-status:');
+      expect(cache).toContain('workflow:');
+      expect(cache).toContain('cache:');
+    });
+
+    it('should handle undefined platform gracefully', () => {
+      const result = combine()
+        .with(minimal)
+        .withPlatform(undefined as any)
+        .build();
+
+      expect(result.platform).toBeUndefined();
+    });
+
+    it('should pass through platform to runtime format unchanged', () => {
+      const result = combine()
+        .withPlatform({
+          llm: { models: ['gpt-4'] },
+          cache: ['git:'],
+          analytics: true,
+        })
+        .build();
+
+      // Platform permissions should pass through to runtime format unchanged
+      expect(result.platform?.llm).toEqual({ models: ['gpt-4'] });
+      expect(result.platform?.cache).toEqual(['git:']);
+      expect(result.platform?.analytics).toBe(true);
+    });
+  });
+
+  describe('with raw PermissionSpec', () => {
+    it('should accept raw spec without id/description', () => {
+      const result = combine()
+        .with({ env: { read: ['CUSTOM_VAR'] } })
+        .build();
+
+      expect(result.env?.read).toContain('CUSTOM_VAR');
+    });
+  });
+});
+
+describe('combinePresets()', () => {
+  it('should combine multiple presets at once', () => {
+    const result = combinePresets(minimal, gitWorkflow, kbPlatform);
+
+    const envVars = result.env?.read ?? [];
+    expect(envVars).toContain('PATH');
+    expect(envVars).toContain('HOME');
+    expect(envVars).toContain('KB_*');
+  });
+
+  it('should work with single preset', () => {
+    const result = combinePresets(gitWorkflow);
+    expect(result.env?.read).toContain('HOME');
+  });
+
+  it('should return empty spec with no presets', () => {
+    const result = combinePresets();
+    expect(result).toEqual({});
+  });
+});
+
+describe('Real-world scenarios', () => {
+  it('should create commit-plugin permissions (git + kb-platform)', () => {
+    const result = combine()
+      .with(gitWorkflow)
+      .with(kbPlatform)
+      .withEnv(['OPENAI_API_KEY'])
+      .build();
+
+    const envVars = result.env?.read ?? [];
+    // Git needs
+    expect(envVars).toContain('HOME');
+    expect(envVars).toContain('USER');
+    expect(envVars).toContain('GIT_*');
+    // KB platform needs
+    expect(envVars).toContain('KB_*');
+    // Custom
+    expect(envVars).toContain('OPENAI_API_KEY');
+  });
+
+  it('should create release-plugin permissions (git + npm + kb-platform)', () => {
+    const result = combine()
+      .with(gitWorkflow)
+      .with(npmPublish)
+      .with(kbPlatform)
+      .withQuotas({ timeoutMs: 300000 })
+      .build();
+
+    const envVars = result.env?.read ?? [];
+    expect(envVars).toContain('HOME');
+    expect(envVars).toContain('GIT_*');
+    expect(envVars).toContain('NPM_TOKEN');
+    expect(envVars).toContain('KB_*');
+
+    const domains = result.network?.fetch ?? [];
+    expect(domains).toContain('registry.npmjs.org');
+
+    expect(result.quotas?.timeoutMs).toBe(300000);
+  });
+
+  it('should create commit-plugin with platform permissions (git + kb + llm + cache)', () => {
+    const result = combine()
+      .with(gitWorkflow)
+      .with(kbPlatform)
+      .withEnv(['OPENAI_API_KEY', 'ANTHROPIC_API_KEY'])
+      .withFs({
+        mode: 'readWrite',
+        allow: ['.kb/commit/**'],
+      })
+      .withPlatform({
+        llm: true,
+        cache: ['git-status:'],
+        analytics: true,
+      })
+      .withQuotas({
+        timeoutMs: 600000,
+        memoryMb: 512,
+      })
+      .build();
+
+    // Env vars
+    const envVars = result.env?.read ?? [];
+    expect(envVars).toContain('HOME');
+    expect(envVars).toContain('USER');
+    expect(envVars).toContain('GIT_*');
+    expect(envVars).toContain('KB_*');
+    expect(envVars).toContain('OPENAI_API_KEY');
+    expect(envVars).toContain('ANTHROPIC_API_KEY');
+
+    // File system (runtime format)
+    const read = result.fs?.read ?? [];
+    const write = result.fs?.write ?? [];
+    expect(read).toContain('**/.git/**');
+    expect(read).toContain('.kb/**');
+    expect(read).toContain('.kb/commit/**');
+    expect(write).toContain('.kb/**');
+    expect(write).toContain('.kb/commit/**');
+
+    // Platform services
+    expect(result.platform?.llm).toBe(true);
+    expect(result.platform?.cache).toEqual(['git-status:']);
+    expect(result.platform?.analytics).toBe(true);
+
+    // Quotas
+    expect(result.quotas?.timeoutMs).toBe(600000);
+    expect(result.quotas?.memoryMb).toBe(512);
+  });
+});

package/packages/shared-perm-presets/src/__tests__/presets.test.ts

@@ -0,0 +1,205 @@
+import { describe, it, expect } from 'vitest';
+import {
+  minimal,
+  gitWorkflow,
+  npmPublish,
+  fullEnv,
+  kbPlatform,
+  llmAccess,
+  vectorStore,
+  ciEnvironment,
+} from '../presets';
+
+describe('Permission Presets', () => {
+  describe('minimal', () => {
+    it('should have id and description', () => {
+      expect(minimal.id).toBe('minimal');
+      expect(minimal.description).toBeTruthy();
+    });
+
+    it('should include basic system env vars', () => {
+      const envVars = minimal.permissions.env?.read ?? [];
+      expect(envVars).toContain('PATH');
+      expect(envVars).toContain('NODE_ENV');
+      expect(envVars).toContain('LANG');
+    });
+
+    it('should NOT include HOME or USER', () => {
+      const envVars = minimal.permissions.env?.read ?? [];
+      expect(envVars).not.toContain('HOME');
+      expect(envVars).not.toContain('USER');
+    });
+  });
+
+  describe('gitWorkflow', () => {
+    it('should have id and description', () => {
+      expect(gitWorkflow.id).toBe('git-workflow');
+      expect(gitWorkflow.description).toBeTruthy();
+    });
+
+    it('should include HOME for git config', () => {
+      const envVars = gitWorkflow.permissions.env?.read ?? [];
+      expect(envVars).toContain('HOME');
+    });
+
+    it('should include USER for git author', () => {
+      const envVars = gitWorkflow.permissions.env?.read ?? [];
+      expect(envVars).toContain('USER');
+    });
+
+    it('should include GIT_* wildcard', () => {
+      const envVars = gitWorkflow.permissions.env?.read ?? [];
+      expect(envVars).toContain('GIT_*');
+    });
+
+    it('should include SSH env vars for auth', () => {
+      const envVars = gitWorkflow.permissions.env?.read ?? [];
+      expect(envVars).toContain('SSH_AUTH_SOCK');
+      expect(envVars).toContain('SSH_AGENT_PID');
+    });
+
+    it('should allow .git directory access', () => {
+      const allow = gitWorkflow.permissions.fs?.allow ?? [];
+      expect(allow).toContain('**/.git/**');
+    });
+  });
+
+  describe('npmPublish', () => {
+    it('should have id and description', () => {
+      expect(npmPublish.id).toBe('npm-publish');
+      expect(npmPublish.description).toBeTruthy();
+    });
+
+    it('should include HOME for .npmrc', () => {
+      const envVars = npmPublish.permissions.env?.read ?? [];
+      expect(envVars).toContain('HOME');
+    });
+
+    it('should include npm token vars', () => {
+      const envVars = npmPublish.permissions.env?.read ?? [];
+      expect(envVars).toContain('NPM_TOKEN');
+      expect(envVars).toContain('NPM_AUTH_TOKEN');
+      expect(envVars).toContain('NODE_AUTH_TOKEN');
+    });
+
+    it('should include npm_* wildcard', () => {
+      const envVars = npmPublish.permissions.env?.read ?? [];
+      expect(envVars).toContain('npm_*');
+    });
+
+    it('should allow package.json and lock files', () => {
+      const allow = npmPublish.permissions.fs?.allow ?? [];
+      expect(allow).toContain('**/package.json');
+      expect(allow).toContain('**/package-lock.json');
+      expect(allow).toContain('**/pnpm-lock.yaml');
+    });
+
+    it('should allow npm registry domains', () => {
+      const domains = npmPublish.permissions.network?.fetch ?? [];
+      expect(domains).toContain('registry.npmjs.org');
+      expect(domains).toContain('npm.pkg.github.com');
+    });
+  });
+
+  describe('fullEnv', () => {
+    it('should have id and description', () => {
+      expect(fullEnv.id).toBe('full-env');
+      expect(fullEnv.description).toBeTruthy();
+    });
+
+    it('should include wildcard for all env vars', () => {
+      const envVars = fullEnv.permissions.env?.read ?? [];
+      expect(envVars).toContain('*');
+    });
+  });
+
+  describe('kbPlatform', () => {
+    it('should have id and description', () => {
+      expect(kbPlatform.id).toBe('kb-platform');
+      expect(kbPlatform.description).toBeTruthy();
+    });
+
+    it('should include KB_* wildcard', () => {
+      const envVars = kbPlatform.permissions.env?.read ?? [];
+      expect(envVars).toContain('KB_*');
+    });
+
+    it('should allow .kb directory access', () => {
+      const allow = kbPlatform.permissions.fs?.allow ?? [];
+      expect(allow).toContain('.kb/**');
+    });
+  });
+
+  describe('llmAccess', () => {
+    it('should have id and description', () => {
+      expect(llmAccess.id).toBe('llm-access');
+      expect(llmAccess.description).toBeTruthy();
+    });
+
+    it('should include OpenAI env vars', () => {
+      const envVars = llmAccess.permissions.env?.read ?? [];
+      expect(envVars).toContain('OPENAI_API_KEY');
+      expect(envVars).toContain('OPENAI_ORG_ID');
+    });
+
+    it('should include Anthropic env vars', () => {
+      const envVars = llmAccess.permissions.env?.read ?? [];
+      expect(envVars).toContain('ANTHROPIC_API_KEY');
+    });
+
+    it('should allow LLM API domains', () => {
+      const domains = llmAccess.permissions.network?.fetch ?? [];
+      expect(domains).toContain('api.openai.com');
+      expect(domains).toContain('api.anthropic.com');
+    });
+  });
+
+  describe('vectorStore', () => {
+    it('should have id and description', () => {
+      expect(vectorStore.id).toBe('vector-store');
+      expect(vectorStore.description).toBeTruthy();
+    });
+
+    it('should include Qdrant env vars', () => {
+      const envVars = vectorStore.permissions.env?.read ?? [];
+      expect(envVars).toContain('QDRANT_URL');
+      expect(envVars).toContain('QDRANT_API_KEY');
+    });
+
+    it('should include Pinecone env vars', () => {
+      const envVars = vectorStore.permissions.env?.read ?? [];
+      expect(envVars).toContain('PINECONE_API_KEY');
+    });
+
+    it('should allow vector store domains', () => {
+      const domains = vectorStore.permissions.network?.fetch ?? [];
+      expect(domains).toContain('localhost');
+      expect(domains).toContain('*.qdrant.io');
+      expect(domains).toContain('*.pinecone.io');
+    });
+  });
+
+  describe('ciEnvironment', () => {
+    it('should have id and description', () => {
+      expect(ciEnvironment.id).toBe('ci-environment');
+      expect(ciEnvironment.description).toBeTruthy();
+    });
+
+    it('should include CI indicator', () => {
+      const envVars = ciEnvironment.permissions.env?.read ?? [];
+      expect(envVars).toContain('CI');
+    });
+
+    it('should include GitHub Actions vars', () => {
+      const envVars = ciEnvironment.permissions.env?.read ?? [];
+      expect(envVars).toContain('GITHUB_TOKEN');
+      expect(envVars).toContain('GITHUB_*');
+    });
+
+    it('should include GitLab CI vars', () => {
+      const envVars = ciEnvironment.permissions.env?.read ?? [];
+      expect(envVars).toContain('GITLAB_*');
+      expect(envVars).toContain('CI_JOB_TOKEN');
+    });
+  });
+});