@kodama-run/sdk 0.1.1 → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kodama Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/package.json

@@ -1,14 +1,11 @@
 {
   "name": "@kodama-run/sdk",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "type": "module",
   "exports": {
     ".": "./src/index.ts"
   },
-  "bin": {
-    "kodama-mcp": "./bin/mcp.js",
-    "kodama": "./bin/cli.js"
-  },
+  "bin": "bin/mcp.js",
   "files": [
     "src/**/*.ts",
     "!src/__tests__",
@@ -16,21 +13,21 @@
     "bin/cli.js",
     "README.md"
   ],
-  "scripts": {
-    "build": "echo 'No build step for sdk (source-only)'",
-    "test": "bun test",
-    "lint": "tsc --noEmit",
-    "clean": "rm -rf dist"
-  },
   "dependencies": {
-    "@kodama-run/shared": "workspace:*",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "commander": "^13",
     "ws": "^8",
-    "zod": "^4.3.6"
+    "zod": "^4.3.6",
+    "@kodama-run/shared": "0.1.0"
   },
   "devDependencies": {
     "@types/ws": "^8",
     "typescript": "*"
+  },
+  "scripts": {
+    "build": "echo 'No build step for sdk (source-only)'",
+    "test": "bun test",
+    "lint": "tsc --noEmit",
+    "clean": "rm -rf dist"
   }
-}
+}

package/src/__tests__/crypto.test.ts

@@ -0,0 +1,47 @@
+import { describe, it, expect } from "bun:test";
+import { KodamaCrypto } from "../crypto.ts";
+
+describe("KodamaCrypto", () => {
+  it("generates a session key (non-empty base64 string)", async () => {
+    const key = await KodamaCrypto.generateKey();
+    expect(typeof key).toBe("string");
+    expect(key.length).toBeGreaterThan(0);
+    // AES-256 key = 32 bytes = 44 chars in base64
+    expect(key.length).toBe(44);
+  });
+
+  it("encrypts and decrypts roundtrip", async () => {
+    const key = await KodamaCrypto.generateKey();
+    const plaintext = "Hello, Kodama! 🌿 This is a secret message.";
+
+    const { ciphertext, iv } = await KodamaCrypto.encrypt(key, plaintext);
+    expect(ciphertext.length).toBeGreaterThan(0);
+    expect(iv.length).toBeGreaterThan(0);
+
+    const decrypted = await KodamaCrypto.decrypt(key, ciphertext, iv);
+    expect(decrypted).toBe(plaintext);
+  });
+
+  it("fails to decrypt with wrong key", async () => {
+    const key1 = await KodamaCrypto.generateKey();
+    const key2 = await KodamaCrypto.generateKey();
+    const plaintext = "Secret data";
+
+    const { ciphertext, iv } = await KodamaCrypto.encrypt(key1, plaintext);
+
+    expect(KodamaCrypto.decrypt(key2, ciphertext, iv)).rejects.toThrow();
+  });
+
+  it("produces different ciphertext for same plaintext (unique IVs)", async () => {
+    const key = await KodamaCrypto.generateKey();
+    const plaintext = "Same input, different output";
+
+    const result1 = await KodamaCrypto.encrypt(key, plaintext);
+    const result2 = await KodamaCrypto.encrypt(key, plaintext);
+
+    // IVs should be different (random)
+    expect(result1.iv).not.toBe(result2.iv);
+    // Ciphertext should also differ due to different IVs
+    expect(result1.ciphertext).not.toBe(result2.ciphertext);
+  });
+});

package/src/__tests__/permissions.test.ts

@@ -0,0 +1,71 @@
+import { describe, it, expect } from "bun:test";
+import { PermissionChecker } from "../permissions.ts";
+
+describe("PermissionChecker", () => {
+  it("allows everything with no config", () => {
+    const checker = new PermissionChecker();
+    expect(checker.isAllowed("src/main.ts")).toBe(true);
+    expect(checker.isAllowed("docs/readme.md")).toBe(true);
+    expect(checker.isAllowed("any/deep/nested/file.txt")).toBe(true);
+  });
+
+  it("always denies secret patterns (.env, .pem, .key, credentials.*)", () => {
+    const checker = new PermissionChecker();
+    expect(checker.isAllowed(".env")).toBe(false);
+    expect(checker.isAllowed(".env.local")).toBe(false);
+    expect(checker.isAllowed("certs/server.pem")).toBe(false);
+    expect(checker.isAllowed("keys/private.key")).toBe(false);
+    expect(checker.isAllowed("credentials.json")).toBe(false);
+    expect(checker.isAllowed("dir/credentials.yaml")).toBe(false);
+    expect(checker.isAllowed("tls/cert.p12")).toBe(false);
+    expect(checker.isAllowed("tls/cert.pfx")).toBe(false);
+  });
+
+  it("respects allow list — only allowed patterns pass", () => {
+    const checker = new PermissionChecker({
+      allow: ["src/**", "docs/*.md"],
+    });
+    expect(checker.isAllowed("src/index.ts")).toBe(true);
+    expect(checker.isAllowed("src/deep/nested/file.ts")).toBe(true);
+    expect(checker.isAllowed("docs/guide.md")).toBe(true);
+    // Not in allow list
+    expect(checker.isAllowed("test/foo.ts")).toBe(false);
+    expect(checker.isAllowed("package.json")).toBe(false);
+  });
+
+  it("respects deny list — denied patterns are blocked", () => {
+    const checker = new PermissionChecker({
+      deny: ["*.log", "tmp/**"],
+    });
+    expect(checker.isAllowed("src/main.ts")).toBe(true);
+    expect(checker.isAllowed("server.log")).toBe(false);
+    expect(checker.isAllowed("tmp/cache.dat")).toBe(false);
+    expect(checker.isAllowed("tmp/deep/file.txt")).toBe(false);
+  });
+
+  it("filterMessage passes content through", () => {
+    const checker = new PermissionChecker();
+    const content = "Hello, this is a test message with sensitive data";
+    expect(checker.filterMessage(content)).toBe(content);
+  });
+
+  it("parses YAML format correctly", () => {
+    const yaml = `
+allow:
+  - src/**
+  - docs/*.md
+deny:
+  - "*.log"
+  - tmp/**
+`;
+    const checker = PermissionChecker.fromYaml(yaml);
+    expect(checker.isAllowed("src/index.ts")).toBe(true);
+    expect(checker.isAllowed("docs/guide.md")).toBe(true);
+    expect(checker.isAllowed("test/foo.ts")).toBe(false);
+    expect(checker.isAllowed("server.log")).toBe(false);
+    expect(checker.isAllowed("tmp/cache.dat")).toBe(false);
+    // Auto-deny patterns still active
+    expect(checker.isAllowed(".env")).toBe(false);
+    expect(checker.isAllowed("keys/private.key")).toBe(false);
+  });
+});