@lqc123qwe/car-runtime 1.9.0 → 1.10.0

package/test/s43-remote-http-traceparent.spec.ts

@@ -1,262 +0,0 @@
-/**
- * 1.9 · 远程 MCP traceparent 传播——Streamable HTTP 头通道（D-32 · S43）
- *
- * 覆盖（1.9-迭代规划 HTTP-TP）：
- *  - 单元：httpClient tools/call 请求头注入（W3C `traceparent` 头）与缺省零注入（头面不变）；
- *    initialize/notifications/tools/list 不注入（无 span 上下文边界）；gateway.callTool 透传 +
- *    `_meta`/头双载体同值；畸形 fail-open 丢弃（含 CRLF 头注入形态）；配置 headers 同名注入优先；
- *  - E2E：car run --mcp <url> 全链（otel 开）——假远程 MCP server 捕获 `traceparent` 头回显进
- *    工具结果，与 OTLP 出站 car.mcp.tool span 三点对拍闭合（traceId + spanId）+ body `_meta`
- *    双载体同值实查 + 出站体零内容断言。
- */
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { spawn } from 'node:child_process'
-import { createServer, type Server, type IncomingMessage } from 'node:http'
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join, dirname } from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { McpGateway } from '../src/mcp/gateway.ts'
-import { createHttpMcpTransport, MCP_PROTOCOL_VERSION } from '../src/mcp/httpClient.ts'
-import { parseTraceparent } from '../src/runtime-core/trace.ts'
-
-const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..')
-const CLI = join(ROOT, 'src', 'cli.ts')
-
-// 密钥扫描口径：夹具凭据经变量注入（赋值行无引号字面量）
-const TEST_TOKEN = 'test-token-456'
-
-const TID = 'a'.repeat(32)
-const SID = 'b'.repeat(16)
-const TP = (tid: string, sid: string) => `00-${tid}-${sid}-01`
-
-function withTempDir(name: string, fn: (dir: string) => Promise<void> | void): Promise<void> {
-  const dir = mkdtempSync(join(tmpdir(), `car-s43-${name}-`))
-  try {
-    const r = fn(dir)
-    const cleanup = () => { try { rmSync(dir, { recursive: true, force: true }) } catch { /* 红线 8 */ } }
-    if (r instanceof Promise) return r.finally(cleanup)
-    cleanup()
-    return Promise.resolve()
-  } catch (e) {
-    try { rmSync(dir, { recursive: true, force: true }) } catch { /* 红线 8 */ }
-    throw e
-  }
-}
-
-interface SeenReq { url: string; method: string; headers: IncomingMessage['headers']; body: any }
-
-/** 本地假远程 MCP server（Streamable HTTP）：tools/call 捕获 `traceparent` 头回显进工具结果 */
-function fakeMcpHttp(): Promise<{ server: Server; url: string; seen: SeenReq[]; close: () => Promise<void> }> {
-  const seen: SeenReq[] = []
-  const server = createServer((req, res) => {
-    let raw = ''
-    req.on('data', c => { raw += c })
-    req.on('end', () => {
-      const body = raw ? JSON.parse(raw) : {}
-      seen.push({ url: req.url ?? '', method: body.method ?? '', headers: req.headers, body })
-      const respondJson = (payload: unknown, status = 200, headers: Record<string, string> = {}) => {
-        res.writeHead(status, { 'content-type': 'application/json', ...headers })
-        res.end(JSON.stringify(payload))
-      }
-      if (body.method === 'initialize') {
-        respondJson({ jsonrpc: '2.0', id: body.id, result: { protocolVersion: MCP_PROTOCOL_VERSION, capabilities: {}, serverInfo: { name: 'fake-remote', version: '0.0.0' } } }, 200, { 'mcp-session-id': 'sess-fake-1' })
-        return
-      }
-      if (body.id === undefined) { res.writeHead(202).end(); return } // notification（notifications/initialized）
-      if (body.method === 'tools/list') {
-        respondJson({ jsonrpc: '2.0', id: body.id, result: { tools: [{ name: 'remote_echo', description: '远程回声', inputSchema: { type: 'object', properties: { t: { type: 'string' } } } }] } })
-        return
-      }
-      if (body.method === 'tools/call') {
-        const tp = req.headers['traceparent'] ?? 'none'
-        respondJson({ jsonrpc: '2.0', id: body.id, result: { content: [{ type: 'text', text: 'remote-ok|tp:' + tp }] } })
-        return
-      }
-      respondJson({ jsonrpc: '2.0', id: body.id, error: { code: -32601, message: 'method not found: ' + body.method } }, 404)
-    })
-  })
-  const urlP = new Promise<string>(r => server.listen(0, '127.0.0.1', () => r(`http://127.0.0.1:${(server.address() as { port: number }).port}`)))
-  return urlP.then(url => ({ server, url, seen, close: () => new Promise<void>(r => server.close(() => r())) }))
-}
-
-// ==================== 单元：头注入与缺省零注入（D-32） ====================
-
-test('S43: httpClient tools/call 注入 traceparent 头 + _meta 双载体同值；握手/注册不注入；缺省零注入', async () => {
-  const { server, url, seen, close } = await fakeMcpHttp()
-  try {
-    const transport = createHttpMcpTransport({ url })
-    const gw = new McpGateway()
-    await gw.register({ serverId: 'remote', transport })
-    // 无 span 上下文边界：握手与注册请求零注入
-    assert.equal(seen[0]!.headers['traceparent'], undefined, 'initialize 不注入（传输内部握手）')
-    assert.equal(seen[1]!.headers['traceparent'], undefined, 'notifications/initialized 不注入')
-    assert.equal(seen[2]!.headers['traceparent'], undefined, 'tools/list 不注入（注册期无 span 上下文）')
-    // callTool + traceparent → 头注入 + _meta 双载体同值（1.8 字节面维持）
-    const tp = TP(TID, SID)
-    const r = await gw.callTool('remote', 'remote_echo', { t: 'hi' }, { traceparent: tp })
-    assert.equal(r.ok, true)
-    const call = seen.at(-1)!
-    assert.equal(call.method, 'tools/call')
-    assert.equal(call.headers['traceparent'], tp, 'W3C traceparent 头注入（HTTP 载体惯例）')
-    assert.equal((call.body.params as any)._meta?.traceparent, tp, 'body _meta 双载体同值（1.8-D29 字节面维持）')
-    assert.deepEqual({ name: (call.body.params as any).name, arguments: (call.body.params as any).arguments }, { name: 'remote_echo', arguments: { t: 'hi' } }, 'params 主体不变')
-    // 缺省零注入：otel 关 = 头与 _meta 双缺省（线上请求头与字节面不变）
-    const r2 = await gw.callTool('remote', 'remote_echo', { t: 'ho' })
-    assert.equal(r2.ok, true)
-    const call2 = seen.at(-1)!
-    assert.equal(call2.headers['traceparent'], undefined, '缺省零注入（头面不变）')
-    assert.equal('_meta' in (call2.body.params as object), false, '缺省零注入（字节面不变——1.8 口径）')
-    transport.close()
-  } finally {
-    await close()
-  }
-})
-
-// ==================== 单元：畸形 fail-open + 头注入防线 ====================
-
-test('S43: 畸形 traceparent fail-open——头不注入调用照常；CRLF 头注入形态被排除；空串零注入', async () => {
-  const { server, url, seen, close } = await fakeMcpHttp()
-  try {
-    const transport = createHttpMcpTransport({ url })
-    const gw = new McpGateway()
-    await gw.register({ serverId: 'remote', transport })
-    // 非格式串：不注入不抛（协议面 fail-open——BD-05 同源）
-    const r1 = await gw.callTool('remote', 'remote_echo', { t: 'a' }, { traceparent: 'garbage' })
-    assert.equal(r1.ok, true, '畸形不 fail-hard（调用照常）')
-    assert.equal(seen.at(-1)!.headers['traceparent'], undefined, '畸形头不注入（fail-open）')
-    // CRLF 头注入形态：合法 traceparent 后拼越权第二头——严格 hex 格式整体拒绝
-    const evil = TP(TID, SID) + '\r\nx-inject: yes'
-    const r2 = await gw.callTool('remote', 'remote_echo', { t: 'b' }, { traceparent: evil })
-    assert.equal(r2.ok, true)
-    const h = seen.at(-1)!.headers
-    assert.equal(h['traceparent'], undefined, 'CRLF 形态头不注入')
-    assert.equal(h['x-inject'], undefined, '越权头不出现（严格格式排除 CR/LF）')
-    // 全零（W3C 无效）同拒
-    const r3 = await gw.callTool('remote', 'remote_echo', { t: 'c' }, { traceparent: TP('0'.repeat(32), '0'.repeat(16)) })
-    assert.equal(r3.ok, true)
-    assert.equal(seen.at(-1)!.headers['traceparent'], undefined, '全零 trace-id 不注入')
-    // 空串（noop 门面路径）零注入
-    const r4 = await gw.callTool('remote', 'remote_echo', { t: 'd' }, { traceparent: '' })
-    assert.equal(r4.ok, true)
-    assert.equal(seen.at(-1)!.headers['traceparent'], undefined, '空串零注入（otel 关路径）')
-    transport.close()
-  } finally {
-    await close()
-  }
-})
-
-// ==================== 单元：配置头同名——注入优先 ====================
-
-test('S43: 配置 headers 字面 traceparent——无注入请求沿用配置头；有注入请求注入优先', async () => {
-  const { server, url, seen, close } = await fakeMcpHttp()
-  try {
-    const stale = TP('c'.repeat(32), 'd'.repeat(16))
-    const transport = createHttpMcpTransport({ url, headers: { traceparent: stale } })
-    const gw = new McpGateway()
-    await gw.register({ serverId: 'remote', transport })
-    assert.equal(seen.at(-1)!.headers['traceparent'], stale, '无注入请求沿用配置头（配置面不受影响）')
-    const tp = TP(TID, SID)
-    await gw.callTool('remote', 'remote_echo', { t: 'hi' }, { traceparent: tp })
-    assert.equal(seen.at(-1)!.headers['traceparent'], tp, '注入优先（静态同名配置属误用——每请求 spanId 不同，登记口径）')
-    transport.close()
-  } finally {
-    await close()
-  }
-})
-
-// ==================== E2E：car run --mcp <url> 全链三点闭合（1.9-GO-5 生产调用点） ====================
-
-const sse = (chunks: object[]) => chunks.map(c => `data: ${JSON.stringify(c)}\n\n`).join('') + 'data: [DONE]\n\n'
-
-test('S43 E2E: car run 远程 MCP 全链——traceparent 头回显与 OTLP car.mcp.tool 三点闭合 + 双载体同值', async () => {
-  await withTempDir('e2e-http-tp', async dir => {
-    const { server: mcpServer, url: mcpUrl, seen, close } = await fakeMcpHttp()
-    // 假 LLM：req1 → 直调 MCP 工具；req2 → 收尾文本
-    const llmBodies: any[] = []
-    let n = 0
-    const llmServer: Server = createServer((req, res) => {
-      let raw = ''
-      req.on('data', c => { raw += c })
-      req.on('end', () => {
-        void req
-        llmBodies.push(JSON.parse(raw))
-        res.writeHead(200, { 'content-type': 'text/event-stream' })
-        res.end(n++ === 0
-          ? sse([
-              { choices: [{ delta: { tool_calls: [{ index: 0, id: 'c1', function: { name: 'mcp_remote_remote_echo', arguments: '{"t":"hi"}' } }] } }] },
-              { choices: [{ delta: {}, finish_reason: 'tool_calls' }] },
-            ])
-          : sse([
-              { choices: [{ delta: { content: 'remote 调用完成' } }] },
-              { choices: [{ delta: {}, finish_reason: 'stop' }] },
-            ]))
-      })
-    })
-    await new Promise<void>(r => llmServer.listen(0, '127.0.0.1', r))
-    const llmPort = (llmServer.address() as { port: number }).port
-    // OTLP 捕获端点
-    const otlpBodies: any[] = []
-    const otlp: Server = createServer((req, res) => {
-      let raw = ''
-      req.on('data', c => { raw += c })
-      req.on('end', () => { if (req.url === '/v1/traces') otlpBodies.push(JSON.parse(raw)); res.writeHead(200).end() })
-    })
-    await new Promise<void>(r => otlp.listen(0, '127.0.0.1', r))
-    const otlpPort = (otlp.address() as { port: number }).port
-
-    writeFileSync(join(dir, 'empty.ts'), `export const manifest = { name: 'empty', version: '1.0.0' }\nexport default function apply() {}\n`)
-    writeFileSync(join(dir, 'car.config.json'), JSON.stringify({
-      llm: { baseUrl: `http://127.0.0.1:${llmPort}/v1`, model: 'm' },
-      mcp: { servers: { remote: { url: mcpUrl } } },
-    }))
-    const child = spawn(process.execPath, ['--experimental-transform-types', CLI, 'run', 'empty.ts',
-      '--prompt', 'call the remote echo tool with t=hi', '--mcp', 'remote'], {
-      cwd: dir,
-      env: { ...process.env, OPENAI_API_KEY: TEST_TOKEN, CAR_ALLOW_ENV_CREDENTIALS: '1', CAR_OTEL_ENDPOINT: `http://127.0.0.1:${otlpPort}` },
-      stdio: ['ignore', 'pipe', 'pipe'],
-    })
-    let out = ''
-    let err = ''
-    child.stdout.on('data', d => { out += d })
-    child.stderr.on('data', d => { err += d })
-    const exitDone = new Promise<number>(resolve => child.on('exit', c => resolve(c ?? -1)))
-    const code = await Promise.race([exitDone, new Promise<number>(r => setTimeout(() => r(-999), 60_000))])
-    mcpServer.close()
-    llmServer.close()
-    otlp.close()
-
-    assert.equal(code, 0, `exit=${code}\nSTDOUT:\n${out}\nSTDERR:\n${err}`)
-    assert.match(out, /turnEnd=completed/)
-    // 远程 server 侧：请求序 + 头/体双载体同值（生产调用点实查）
-    assert.deepEqual(seen.map(r => r.method), ['initialize', 'notifications/initialized', 'tools/list', 'tools/call'])
-    const call = seen[3]!
-    const headerTp = call.headers['traceparent']
-    assert.ok(typeof headerTp === 'string' && parseTraceparent(headerTp), `tools/call 请求携带合法 traceparent 头（${headerTp}）`)
-    assert.equal((call.body.params as any)._meta?.traceparent, headerTp, 'body _meta 与头双载体同值（1.8 字节面维持 + 1.9 头通道加法）')
-    // 工具结果含回显 traceparent（假 server 捕获头）
-    const toolMsgs = llmBodies.flatMap(b => b.messages).filter((m: any) => m.role === 'tool')
-    const echoed: string[] = []
-    for (const m of toolMsgs) {
-      for (const g of JSON.stringify(m.content).matchAll(/tp:(00-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2})/g)) echoed.push(g[1]!)
-    }
-    assert.equal(echoed.length, 1, '远程 MCP 路径头通道回显')
-    assert.equal(echoed[0], headerTp, '回显 == 出站头（头通道端到端一致）')
-
-    // OTLP 出站对拍（三点闭合：回显 traceparent ↔ 出站 car.mcp.tool spanId ↔ 同 traceId）
-    await new Promise(r => setTimeout(r, 300))
-    const spans = otlpBodies.flatMap(b => b.scopeSpans[0].spans)
-    const turnSpan = spans.find((s: any) => s.name === 'car.turn')
-    assert.ok(turnSpan, 'turn span 出站')
-    const mcpSpans = spans.filter((s: any) => s.name === 'car.mcp.tool')
-    assert.equal(mcpSpans.length, 1, '一次远程 MCP 外呼一个 client span')
-    const parsed = parseTraceparent(headerTp!)!
-    assert.equal(parsed.traceId, turnSpan.traceId, '回显 traceId == 出站 turn traceId（端到端同 trace）')
-    assert.ok(mcpSpans.some((s: any) => s.spanId === parsed.parentSpanId), '回显 spanId == 出站 car.mcp.tool spanId（client span 对拍闭合）')
-    // 零内容口径：出站体无会话内容
-    const all = JSON.stringify(otlpBodies)
-    assert.equal(/call the remote echo tool|远程回声|remote-ok/.test(all), false, 'span 出站体零内容')
-    await close()
-  })
-})

package/test/s5.spec.ts

@@ -1,95 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { validatePeers, parseManifest } from '../src/load/loader.ts'
-import { declareEvent, EventBus } from '../src/kernel/events.ts'
-import { parseManifest as pm } from '../src/load/loader.ts'
-
-// ==================== F10 peer 版本约束激活（严格模式默认+显式豁免，经中间确认⑥） ====================
-
-const manifest = (peers: any[], override?: any) => ({ name: 'consumer', version: '1.0.0', peers, ...(override ? { peerPolicyOverride: override } : {}) }) as any
-
-test('F10 AC: peer 冲突 → 加载期硬报错 + 冲突链（严格模式默认）', () => {
-  const m = manifest([{ peer: 'lib-a', range: '^1.0.0' }])
-  const installed = new Map([['lib-a', '2.0.0']])
-  assert.throws(() => validatePeers(m, installed), /CAR-E-PEER.*lib-a@\^1\.0\.0 required but 2\.0\.0 installed/)
-})
-
-test('F10 AC: 缺失必选 peer → 硬报错（installed=null）', () => {
-  const m = manifest([{ peer: 'lib-b', range: '^1.0.0' }])
-  assert.throws(() => validatePeers(m, new Map()), /<missing>/)
-})
-
-test('F10 AC: 显式豁免 → 放宽生效（exempted=true，调用方留痕）', () => {
-  const m = manifest([{ peer: 'lib-a', range: '^1.0.0' }], { relaxed: true, reason: 'internal fork compatibility' })
-  const installed = new Map([['lib-a', '2.0.0']])
-  const r = validatePeers(m, installed)
-  assert.equal(r.exempted, true)
-  assert.equal(r.violations.length, 1)
-})
-
-test('F10 AC: optional peer 缺失不构成硬冲突', () => {
-  const m = manifest([{ peer: 'lib-opt', range: '^1.0.0', optional: true }])
-  const r = validatePeers(m, new Map())
-  assert.equal(r.exempted, false)
-  assert.equal(r.violations.filter(v => !v.optional).length, 0)
-})
-
-test('F10: satisfiesRange 语义——^0.x 锁 minor；^1.x 允许 minor/patch', () => {
-  const m0 = manifest([{ peer: 'z', range: '^0.2.1' }])
-  assert.throws(() => validatePeers(m0, new Map([['z', '0.3.0']]))) // ^0.2 不接受 0.3
-  const m1 = manifest([{ peer: 'z', range: '^1.2.3' }])
-  assert.doesNotThrow(() => validatePeers(m1, new Map([['z', '1.9.0']])))
-  assert.throws(() => validatePeers(m1, new Map([['z', '2.0.0']])))
-})
-
-test('F10: 豁免缺 reason 在 parseManifest 即拒绝（审计留痕前置）', () => {
-  assert.throws(() => pm({ name: 'p', version: '1.0.0', peerPolicyOverride: { relaxed: true } }), /reason.*required/)
-})
-
-// ==================== F11 优先级字段（处理器级契约） ====================
-
-test('F11 AC: 同事件多处理器按 priority 升序执行（默认 0）', async () => {
-  declareEvent('prio/demo', 'serial')
-  const bus = new EventBus()
-  const order: string[] = []
-  bus.on('prio/demo', (_p: unknown, next: () => string) => { order.push('late'); return next() }, { priority: 10 })
-  bus.on('prio/demo', (_p: unknown, next: () => string) => { order.push('early'); return next() }, { priority: -5 })
-  bus.on('prio/demo', (_p: unknown, next: () => string) => { order.push('mid'); return next() }, { priority: 0 })
-  await bus.dispatch<string>('prio/demo', 'x', () => 'base')
-  assert.deepEqual(order, ['early', 'mid', 'late'])
-})
-
-test('F11 AC: 同 priority 保持注册序（稳定排序，M1 行为不回退）', async () => {
-  declareEvent('prio/stable', 'serial')
-  const bus = new EventBus()
-  const order: string[] = []
-  bus.on('prio/stable', () => { order.push('first'); return 'x' })
-  bus.on('prio/stable', () => { order.push('second'); return 'x' })
-  bus.on('prio/stable', () => { order.push('third'); return 'x' })
-  await bus.dispatch('prio/stable', {})
-  assert.deepEqual(order, ['first', 'second', 'third'])
-})
-
-test('F11: 向后兼容——M1 字符串 label 形态照常工作', async () => {
-  declareEvent('prio/compat', 'bail')
-  const bus = new EventBus()
-  bus.on('prio/compat', () => 'hit', 'my-label')
-  assert.equal(await bus.dispatch('prio/compat', {}), 'hit')
-  assert.deepEqual(bus.handlerChain('prio/compat'), [{ label: 'my-label', priority: 0 }])
-})
-
-test('F11: handlerChain 治理视图返回实际执行序（F14 配置树/产消图数据源）', async () => {
-  declareEvent('prio/gov', 'emit')
-  const bus = new EventBus()
-  bus.on('prio/gov', () => {}, { label: 'b', priority: 2 })
-  bus.on('prio/gov', () => {}, { label: 'a', priority: 1 })
-  assert.deepEqual(bus.handlerChain('prio/gov').map(h => h.label), ['a', 'b'])
-})
-
-// ==================== 签名方案定稿（ADR-003）口径自检 ====================
-
-test('ADR-003: manifest 解析对签名预留字段不拒绝（S6 验签器接入点）', () => {
-  // S6 将扩展 manifest: signature: { bundle?: string; minisig?: string }
-  const m = pm({ name: 'signed', version: '1.0.0' })
-  assert.equal(m.name, 'signed') // M2 S5 口径：解析层不感知签名字段（warn 语义 S6 落地）
-})

package/test/s6.spec.ts

@@ -1,169 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { generateKeyPairSync, sign, createHash } from 'node:crypto'
-import { enforceSignature, verifyMinisig, type SignatureBundle } from '../src/load/verifier.ts'
-import { GoalDriver } from '../src/loop/goal.ts'
-import { recoverInterrupted } from '../src/loop/recover.ts'
-import { runTurn } from '../src/loop/stop.ts'
-import { SessionLog } from '../src/session/log.ts'
-
-// ==================== 验签器（ADR-003 双轨 / D-2 enforce 分级） ====================
-
-function makeTrustRoot() {
-  const { publicKey, privateKey } = generateKeyPairSync('ed25519')
-  const pubB64 = publicKey.export({ type: 'spki', format: 'der' }).toString('base64')
-  const signHash = (hash: string) => sign(null, Buffer.from(hash), privateKey).toString('base64')
-  return { pubB64, signHash }
-}
-
-const HASH = createHash('sha256').update('manifest-body').digest('hex')
-
-test('S6: minisig 验证——正确签名放行，篡改硬拒绝（不可配置放行）', () => {
-  const { pubB64, signHash } = makeTrustRoot()
-  const sig: SignatureBundle = { minisig: signHash(HASH) }
-  const good = enforceSignature(HASH, sig, { trustRootPublicKey: pubB64, mode: 'warn' })
-  assert.equal(good.allowed, true)
-  assert.equal(good.warning, undefined)
-  // 篡改哈希后验签失败——即使 warn 模式也硬拒绝
-  const bad = enforceSignature(HASH + 'x', sig, { trustRootPublicKey: pubB64, mode: 'warn' })
-  assert.equal(bad.allowed, false)
-  assert.match(bad.error!, /verification FAILED.*不可配置放行/)
-})
-
-test('S6 D-2: 签名缺失——warn 告警放行（指纹兜底），enforce 硬拒绝', () => {
-  const { pubB64 } = makeTrustRoot()
-  const warn = enforceSignature(HASH, undefined, { trustRootPublicKey: pubB64, mode: 'warn' })
-  assert.equal(warn.allowed, true)
-  assert.match(warn.warning!, /CAR-W-SIG.*enforce 切换见 D-2 终局条件/)
-  const enforce = enforceSignature(HASH, undefined, { trustRootPublicKey: pubB64, mode: 'enforce' })
-  assert.equal(enforce.allowed, false)
-  assert.match(enforce.error!, /signature missing/)
-})
-
-test('S6 ADR-003: Sigstore 不可达 → 回退静态轨（双轨回退语义）', () => {
-  const { pubB64, signHash } = makeTrustRoot()
-  const sig: SignatureBundle = { minisig: signHash(HASH), sigstoreBundle: '<bundled>' }
-  const r = enforceSignature(HASH, sig, {
-    trustRootPublicKey: pubB64, mode: 'enforce',
-    sigstoreAvailable: () => true, // 主轨探针可用但骨架期 bundle 校验不可达 → 回退静态轨
-  })
-  assert.equal(r.allowed, true) // 静态轨兜底成功
-})
-
-test('S6: verifyMinisig 对非法 base64 不崩溃（fail-closed）', () => {
-  const { pubB64 } = makeTrustRoot()
-  const r = verifyMinisig(HASH, 'not-base64!!!', pubB64)
-  assert.equal(r.ok, false)
-  assert.ok(r.error)
-})
-
-// ==================== F13 Goal 层 ====================
-
-test('F13: Goal phase 持久化（goalUpdate 事件）+ 恢复层重放（activation 不恢复=disarmed）', () => {
-  const log = new SessionLog()
-  const goal = new GoalDriver(log)
-  goal.arm()
-  assert.equal(goal.activation, 'armed')
-  goal.setPhase('paused', 'waiting for external event')
-  goal.setPhase('complete', 'done')
-  const events = log.events as any[]
-  assert.equal(events.filter(e => e.kind === 'goalUpdate').length, 2)
-  const replay = GoalDriver.replay(log.events)
-  assert.equal(replay.phase, 'complete')   // phase 从日志重放
-  assert.equal(replay.activation, 'disarmed') // activation 永不持久化（AC-4.5）
-})
-
-test('F13: 新实例默认 disarmed（重启不会把历史任务叫醒，AC-4.5）', () => {
-  const goal = new GoalDriver(new SessionLog())
-  assert.equal(goal.activation, 'disarmed')
-  assert.equal(goal.phase, 'active')
-})
-
-test('F13: 非 completed 收口自动 disarm（D5 §9：撞限/错误都会 disarm）', () => {
-  const goal = new GoalDriver(new SessionLog())
-  goal.arm()
-  goal.autoDisarmOnTurnEnd('max-tokens')
-  assert.equal(goal.activation, 'disarmed')
-  goal.arm()
-  goal.autoDisarmOnTurnEnd('completed')
-  assert.equal(goal.activation, 'armed') // completed 不 disarm
-})
-
-// ==================== F13 aggregate 可配置 + blockOnDeny ====================
-
-test('F13: aggregate.terminate=any——单个 terminate 即 aborted（对照默认 AND）', async () => {
-  const log = new SessionLog()
-  const tools = new Map([
-    ['killer', { declaredSideEffect: 'readonly', terminate: true, run: async () => 'k' } as any],
-    ['probe', { declaredSideEffect: 'readonly', run: async () => 'p' } as any],
-  ])
-  const r = await runTurn({
-    log, turnId: 'T', tools,
-    preset: { aggregate: { terminate: 'any' } },
-    model: async (): Promise<any> => ({ stopReason: 'toolUse', toolCalls: [
-      { id: 'c1', tool: 'probe', args: {} }, { id: 'c2', tool: 'killer', args: {} },
-    ] }),
-  })
-  assert.equal(r.reason, 'aborted') // any：killer 投票即整批终止（对照 M1 默认 AND 需全部）
-})
-
-test('F13: aggregate.concludesTurn=all——单工具收口不再立即 completed（对照默认 OR）', async () => {
-  const log = new SessionLog()
-  let n = 0
-  const tools = new Map([
-    ['probe', { declaredSideEffect: 'readonly', run: async () => 'p' } as any],
-    ['commit', { declaredSideEffect: 'write', concludesTurn: true, run: async () => 'c' } as any],
-  ])
-  const r = await runTurn({
-    log, turnId: 'T', tools, preset: { mode: 'full', aggregate: { concludesTurn: 'all' } },
-    model: async (): Promise<any> => n++ === 0
-      ? { stopReason: 'toolUse', toolCalls: [
-          { id: 'c1', tool: 'probe', args: {} }, { id: 'c2', tool: 'commit', args: {} },
-        ] }
-      : { stopReason: 'stop', text: 'final' },
-  })
-  // all 模式：批次 2 个工具仅 1 个 conclude 投票 → concludesAll 不满足 → 模型继续 → stop 收口
-  // （对照默认 OR：同批次会立即 completed——见 s2/s4 用例）
-  assert.equal(r.reason, 'completed')
-  assert.equal(r.steps, 2)
-})
-
-test('F13: blockOnDeny——授权拒绝即收口 blocked（产出点新增，枚举不增）', async () => {
-  const log = new SessionLog()
-  const tools = new Map([['danger', { declaredSideEffect: 'write', run: async () => 'x' } as any]])
-  const r = await runTurn({
-    log, turnId: 'T', tools,
-    preset: { mode: 'confirm', blockOnDeny: true, authorize: async () => false },
-    model: async (): Promise<any> => ({ stopReason: 'toolUse', toolCalls: [{ id: 'c1', tool: 'danger', args: {} }] }),
-  })
-  assert.equal(r.reason, 'blocked')
-  const end = log.events.find(e => e.kind === 'turnEnd') as any
-  assert.equal(end.meta.reason, 'blocked')
-})
-
-// ==================== 恢复层（interrupted） ====================
-
-test('F13: recoverInterrupted——未配对 toolCall 补合成结果 + 未闭合 turn 补记 interrupted', () => {
-  const log = new SessionLog()
-  log.append('user', 'user', 'T1', 'go')
-  log.append('model', 'toolCall', 'T1', { id: 'c1', tool: 't', args: {} })
-  // 模拟进程消失：c1 无 toolResult、T1 无 turnEnd
-  const report = recoverInterrupted(log)
-  assert.equal(report.pairedCalls, 1)
-  assert.equal(report.turnsClosed, 1)
-  const synthetic = log.events.find(e => e.kind === 'toolResult' && (e.payload as any).id === 'c1') as any
-  assert.equal(synthetic.payload.recovered, true) // 副作用状态未知显式声明
-  const end = log.events.find(e => e.kind === 'turnEnd' && e.turnId === 'T1') as any
-  assert.equal(end.meta.reason, 'interrupted') // 与 aborted 不混用
-})
-
-test('F13: 已配对/已闭合日志幂等（重复恢复零补记）', () => {
-  const log = new SessionLog()
-  log.append('user', 'user', 'T1', 'go')
-  log.append('model', 'toolCall', 'T1', { id: 'c1', tool: 't', args: {} })
-  log.append('plugin', 'toolResult', 'T1', { id: 'c1', result: 'ok' })
-  log.append('runtime', 'turnEnd', 'T1', null, { reason: 'completed' })
-  const report = recoverInterrupted(log)
-  assert.equal(report.pairedCalls, 0)
-  assert.equal(report.turnsClosed, 0)
-})

package/test/s7.spec.ts

@@ -1,136 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { scanSecrets, redactSecrets, shannonEntropy, PATTERN_LIBRARY } from '../src/security/secrets.ts'
-import { buildSeatbeltProfile } from '../src/sandbox/sandbox.ts'
-import { execFileSync } from 'node:child_process'
-
-// ==================== F12 secrets 检测（T-6 + D-3） ====================
-
-test('F12: API Key 前缀族命中（OpenAI/GitHub/AWS）', () => {
-  const t = 'const key = "sk-proj-abcdefghij0123456789abcd" // OPENAI_API_KEY'
-  const { hits } = scanSecrets(t)
-  assert.ok(hits.some(h => h.name === 'OpenAI'), 'OpenAI sk- 命中')
-  const aws = scanSecrets('aws_secret_access_key = "AKIAIOSFODNN7EXAMPLE"').hits
-  assert.ok(aws.some(h => h.name === 'AWS Access Key'), 'AWS AccessKey 命中')
-})
-
-test('F12: L2 熵过滤——低熵假 token 不命中（误报控制）', () => {
-  // sk- 前缀但内容是重复字符（低熵 <3.5）→ 不应命中
-  const t = 'sk-aaaaaaaaaaaaaaaaaaaaaaaa  // 测试占位符，非真实 key'
-  const { hits, candidates } = scanSecrets(t, { returnCandidates: true })
-  assert.equal(hits.length, 0, '低熵候选不进命中')
-  assert.ok(candidates.length >= 0) // 观察面存在
-})
-
-test('F12: L3 上下文打分——裸 sk- 串（无键名/赋值语境）分数不足则降级候选', () => {
-  const t = 'random text sk-Xy3kP9mQ2vB7nR4tW8zC for demo' // 有熵但无键名共现、非赋值语境
-  const { hits, candidates } = scanSecrets(t, { returnCandidates: true })
-  assert.ok(!hits.some(h => h.name === 'OpenAI') || hits.length >= 0) // 依打分而定，但机制须工作
-  assert.ok(hits.length + candidates.length >= 1, 'L1 前缀层必须先捕获候选')
-})
-
-test('F12: 私钥块与连接串结构化模式豁免熵检查', () => {
-  const pem = '-----BEGIN RSA PRIVATE KEY-----\nMIIB\n-----END RSA PRIVATE KEY-----'
-  assert.ok(scanSecrets(pem).hits.some(h => h.category === 'private-key'))
-  const cs = 'mongodb://admin:S3cretPw@cluster0.abc.mongodb.net/db'
-  assert.ok(scanSecrets(cs).hits.some(h => h.category === 'connection-string'))
-})
-
-test('F12: 连接串误报防护——无凭据连接串不命中', () => {
-  const t = 'mongodb://localhost:27017/mydb' // 无用户:密码@ 结构
-  const { hits } = scanSecrets(t)
-  assert.equal(hits.length, 0)
-})
-
-test('F12: redact 全遮蔽（保留首尾 ≤4）+ 原文不可逆', () => {
-  const key = 'sk-proj-abcdefghij0123456789abcd'
-  const t = `const key = "${key}" // OPENAI_API_KEY`
-  const { text, redacted } = redactSecrets(t)
-  assert.equal(redacted, 1)
-  assert.ok(!text.includes(key), '原文 key 不可见于脱敏后文本')
-  assert.ok(text.includes('sk-p****abcd'), '遮蔽格式 = 首 4 + **** + 尾 4')
-})
-
-test('F12: 熵函数基准', () => {
-  assert.ok(shannonEntropy('aaaaaaaa') < 0.1)
-  assert.ok(shannonEntropy('Xy3kP9mQ2vB7') > 3.2)
-})
-
-test('F12: 模式库 6 类齐备且可枚举（治理视图数据源）', () => {
-  const cats = new Set(PATTERN_LIBRARY.map(p => p.category))
-  for (const c of ['api-key', 'private-key', 'connection-string', 'cloud-credential', 'bearer-token']) {
-    assert.ok(cats.has(c as any), `类别 ${c} 存在`)
-  }
-  assert.ok(PATTERN_LIBRARY.length >= 20, '模式 ≥20 条（v1 目标 30 内精选）')
-})
-
-test('F12: D-3 标定——正负 1:9 基准集粗标（FPR ≤5% 门禁可执行）', () => {
-  // 负样本 90 条：常见代码片段（不含真实凭据）
-  const negatives: string[] = []
-  for (let i = 0; i < 90; i++) {
-    negatives.push([
-      `const cfg = { port: ${3000 + i}, debug: true }`,
-      `await fetch('https://api.example.com/v1/items?page=${i}')`,
-      `// TODO: handle error case ${i}`,
-      `const xs = [${i}, ${i + 1}, ${i + 2}].map(x => x * 2)`,
-    ][i % 4])
-  }
-  let fp = 0
-  for (const n of negatives) if (scanSecrets(n).hits.length > 0) fp++
-  const fpr = fp / negatives.length
-  assert.ok(fpr <= 0.05, `FPR=${(fpr * 100).toFixed(1)}% ≤5%（D-3）`)
-  // 正样本 10 条
-  const positives = [
-    'const k = "sk-proj-abcdefghij0123456789abcd" // openai key',
-    'const g = "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ123456"',
-    'xoxb-123456789-abcdefgh',
-    'AKIAIOSFODNN7EXAMPLE',
-    '-----BEGIN RSA PRIVATE KEY-----',
-    'postgres://u:pX9k2m@db.internal:5432/app',
-    'Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.abc',
-    'api_key = "a1B2c3D4e5F6g7H8i9J0"',
-    'password: "Sup3rS3cret!"',
-    'client_secret = "cs_live_abcdefghijklmnop"',
-  ]
-  let tp = 0
-  for (const p of positives) if (scanSecrets(p).hits.length > 0) tp++
-  const recall = tp / positives.length
-  assert.ok(recall >= 0.85, `正样本召回 ${(recall * 100).toFixed(0)}% ≥85%（正式 <1.5% 漏报为万级基准集目标）`)
-})
-
-// ==================== Seatbelt profile（darwin 后端，纯生成器测试） ====================
-
-test('Seatbelt: profile fail-closed 结构（deny default + 网络拒绝 + .git 保护）', () => {
-  const p = buildSeatbeltProfile('workspace-write', '/home/dev/proj')
-  assert.ok(p.includes('(deny default)'), 'fail-closed 顶层')
-  assert.ok(p.includes('(deny network*)'), 'deny-by-default 网络')
-  assert.ok(p.includes('(allow file-write* (subpath "/home/dev/proj"))'))
-  assert.ok(p.includes(`(deny file-write* (subpath "/home/dev/proj/.git"))`), '.git 受保护路径')
-  assert.ok(p.includes('(subpath "/usr")'), '系统只读面')
-})
-
-test('Seatbelt: read-only 不含 file-write*；danger-full-access 不生成 profile', () => {
-  const ro = buildSeatbeltProfile('read-only', '/w')
-  assert.ok(!ro.includes('file-write*'), 'read-only 无写授权')
-  assert.throws(() => buildSeatbeltProfile('danger-full-access', '/w'), /danger-full-access/)
-})
-
-test('Seatbelt: workspace 引号转义（注入防护）', () => {
-  const p = buildSeatbeltProfile('workspace-write', '/tmp/x"y')
-  assert.ok(!p.includes('"/tmp/x"y"'), '恶意引号被转义')
-  assert.ok(p.includes('\\"'))
-})
-
-// ==================== win32 spike 准备（S8 结论门输入） ====================
-
-test('win32 spike: 脚本存在且 win32 外环境输出 SKIP（判据清单可达）', () => {
-  const out = execFileSync(process.execPath, ['--experimental-transform-types', 'scripts/win32-koffi-spike.ts'], {
-    encoding: 'utf-8', timeout: 30_000,
-  })
-  if (process.platform !== 'win32') {
-    assert.ok(out.includes('SKIP: spike requires win32'))
-  } else {
-    // M5-S26 起四判据自动断言整合，win32 上以 VERDICT 收口（四判据全 PASS 或逐条列明）
-    assert.ok(out.includes('VERDICT:'), '四判据报告以 VERDICT 收口')
-  }
-})