@lqc123qwe/car-runtime 1.9.0 → 1.11.0

package/test/s34-mcp-remote-transport.spec.ts

@@ -1,250 +0,0 @@
-/**
- * 1.5-S2 · 远程 MCP 传输（S34）：Streamable HTTP 客户端（D-21）
- *
- * 覆盖：
- *  - 懒 initialize 握手：首次 send 前 initialize → notifications/initialized（恰好一次）；
- *    Mcp-Session-Id 捕获与回传；无会话头 server 容许
- *  - 响应形态双兼容：application/json 单响应 / text/event-stream 逐事件取本请求 id
- *  - McpGateway 注册回路：tools/list → 声明面（T-22 缺省 write 不变）；tools/call 往返
- *  - resolveMcpHeaders：${ENV} 插值（值内任意位置）/ env 缺席显式报错 / 字面明文凭据拒绝
- *  - config 校验：command/url 互斥恰好其一 / url 形态 / 通道专属键（args/env 仅 command、headers 仅 url）
- *  - spawn CLI 全链：car run --mcp <url server>（1.5-GO-5 生产调用点——真 initialize→tools/list→tools/call）
- */
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { spawn } from 'node:child_process'
-import { createServer, type Server, type IncomingMessage } from 'node:http'
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join, dirname } from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { McpGateway, type JsonRpcRequest } from '../src/mcp/gateway.ts'
-import { createHttpMcpTransport, resolveMcpHeaders, MCP_PROTOCOL_VERSION } from '../src/mcp/httpClient.ts'
-import { loadCarConfig } from '../src/load/config.ts'
-
-// 密钥扫描口径（generic-secret-assign）：夹具凭据经变量注入；值非真实凭据
-const TEST_TOKEN = 'test-token-456'
-const CLI = join(dirname(fileURLToPath(import.meta.url)), '..', 'src', 'cli.ts')
-
-function withTempDir(name: string, fn: (dir: string) => Promise<void> | void): Promise<void> {
-  const dir = mkdtempSync(join(tmpdir(), `car-s34-${name}-`))
-  try {
-    const r = fn(dir)
-    const cleanup = () => { try { rmSync(dir, { recursive: true, force: true }) } catch { /* 红线 8 */ } }
-    if (r instanceof Promise) return r.finally(cleanup)
-    cleanup()
-    return Promise.resolve()
-  } catch (e) {
-    try { rmSync(dir, { recursive: true, force: true }) } catch { /* 红线 8 */ }
-    throw e
-  }
-}
-
-interface SeenReq { url: string; method: string; headers: IncomingMessage['headers']; body: any }
-
-/** 本地假远程 MCP server（Streamable HTTP）：记录请求，按 method 分派；tools/list 可选 SSE 形态 */
-function fakeMcpHttp(opts: { sseToolsList?: boolean; sessionId?: string | null; rejectAll?: boolean } = {}): Promise<{
-  server: Server; url: string; seen: SeenReq[]; close: () => Promise<void>
-}> {
-  const seen: SeenReq[] = []
-  const server = createServer((req, res) => {
-    let raw = ''
-    req.on('data', c => { raw += c })
-    req.on('end', () => {
-      const body = raw ? JSON.parse(raw) : {}
-      seen.push({ url: req.url ?? '', method: body.method ?? '', headers: req.headers, body })
-      if (opts.rejectAll) {
-        res.writeHead(403, { 'content-type': 'application/json' })
-        res.end(JSON.stringify({ error: 'forbidden' }))
-        return
-      }
-      const respondJson = (payload: unknown, status = 200, headers: Record<string, string> = {}) => {
-        res.writeHead(status, { 'content-type': 'application/json', ...headers })
-        res.end(JSON.stringify(payload))
-      }
-      const respondSse = (payload: unknown) => {
-        res.writeHead(200, { 'content-type': 'text/event-stream' })
-        res.end(`data: ${JSON.stringify(payload)}\n\n`)
-      }
-      if (body.method === 'initialize') {
-        respondJson({ jsonrpc: '2.0', id: body.id, result: { protocolVersion: MCP_PROTOCOL_VERSION, capabilities: {}, serverInfo: { name: 'fake-remote', version: '0.0.0' } } }, 200, opts.sessionId === null ? {} : { 'mcp-session-id': opts.sessionId ?? 'sess-fake-1' })
-        return
-      }
-      if (body.id === undefined) { res.writeHead(202).end(); return } // notification（notifications/initialized）
-      if (body.method === 'tools/list') {
-        const result = { tools: [{ name: 'remote_echo', description: '远程回声', inputSchema: { type: 'object', properties: { t: { type: 'string' } } } }] }
-        opts.sseToolsList ? respondSse({ jsonrpc: '2.0', id: body.id, result }) : respondJson({ jsonrpc: '2.0', id: body.id, result })
-        return
-      }
-      if (body.method === 'tools/call') {
-        respondJson({ jsonrpc: '2.0', id: body.id, result: { content: [{ type: 'text', text: 'remote-ok:' + JSON.stringify(body.params.arguments) }] } })
-        return
-      }
-      respondJson({ jsonrpc: '2.0', id: body.id, error: { code: -32601, message: 'method not found: ' + body.method } }, 404)
-    })
-  })
-  const urlP = new Promise<string>(r => server.listen(0, '127.0.0.1', () => r(`http://127.0.0.1:${(server.address() as { port: number }).port}`)))
-  return urlP.then(url => ({ server, url, seen, close: () => new Promise<void>(r => server.close(() => r())) }))
-}
-
-// ==================== 传输客户端 ====================
-
-test('S34: 懒 initialize 握手——首次 send 前 initialize→initialized 恰好一次 + 会话头捕获回传 + tools/list 注册', async () => {
-  const { server, url, seen, close } = await fakeMcpHttp()
-  try {
-    const transport = createHttpMcpTransport({ url })
-    const gw = new McpGateway()
-    const tools = await gw.register({ serverId: 'remote', transport })
-    assert.equal(tools.length, 1)
-    assert.equal(tools[0]!.name, 'remote_echo')
-    assert.equal(tools[0]!.declaredSideEffect, 'write', 'T-22：未声明 sideEffect 注册时强制 write（远程与 stdio 同口径）')
-    // 请求序：initialize → notifications/initialized → tools/list
-    assert.deepEqual(seen.map(r => r.method), ['initialize', 'notifications/initialized', 'tools/list'])
-    assert.equal(seen[0]!.body.params.protocolVersion, MCP_PROTOCOL_VERSION)
-    assert.equal(seen[0]!.body.params.clientInfo.name, 'car-runtime')
-    // 会话头：initialize 请求无（尚未捕获）→ 后续请求回传
-    assert.equal(seen[0]!.headers['mcp-session-id'], undefined)
-    assert.equal(seen[2]!.headers['mcp-session-id'], 'sess-fake-1')
-    // accept 双形态声明 + 二次 send 不再握手
-    assert.match(String(seen[0]!.headers.accept), /application\/json/)
-    assert.match(String(seen[0]!.headers.accept), /text\/event-stream/)
-    const r = await gw.callTool('remote', 'remote_echo', { t: 'hi' })
-    assert.equal(r.ok, true)
-    assert.deepEqual(seen.map(m => m.method), ['initialize', 'notifications/initialized', 'tools/list', 'tools/call'], 'initialize 恰好一次')
-    // 声明面=授权面：gateway 声明面含远程工具
-    assert.equal(gw.listTools().some(t => t.serverId === 'remote' && t.name === 'remote_echo'), true)
-    transport.close()
-  } finally {
-    await close()
-  }
-})
-
-test('S34: SSE 响应形态——tools/list 以 text/event-stream 回包逐事件取本请求 id；无会话头 server 容许', async () => {
-  const { server, url, seen, close } = await fakeMcpHttp({ sseToolsList: true, sessionId: null })
-  try {
-    const transport = createHttpMcpTransport({ url })
-    const gw = new McpGateway()
-    const tools = await gw.register({ serverId: 'r2', transport })
-    assert.equal(tools.length, 1, 'SSE 流内 tools/list 响应正确解析')
-    assert.equal(seen[2]!.headers['mcp-session-id'], undefined, '无会话头 server 不回传（容许）')
-    transport.close()
-  } finally {
-    await close()
-  }
-})
-
-test('S34: closed 传输显式拒绝 + HTTP 错误 fail-visible（阶段名在错误信息）', async () => {
-  const { server, url, close } = await fakeMcpHttp({ rejectAll: true })
-  try {
-    const transport = createHttpMcpTransport({ url })
-    transport.close()
-    await assert.rejects(() => transport.send({ jsonrpc: '2.0', id: 1, method: 'tools/list' }), /closed/)
-    const bad = createHttpMcpTransport({ url })
-    await assert.rejects(() => bad.send({ jsonrpc: '2.0', id: 1, method: 'tools/list' }), /HTTP 403.*initialize/)
-    bad.close()
-  } finally {
-    await close()
-  }
-})
-
-// ==================== headers 凭据规则（D-21 / CR-05） ====================
-
-test('S34: resolveMcpHeaders——${ENV} 值内插值 / env 缺席显式报错 / 字面明文凭据拒绝', () => {
-  const env = { CAR_MCP_TOKEN: TEST_TOKEN }
-  assert.deepEqual(resolveMcpHeaders({ authorization: `Bearer \${CAR_MCP_TOKEN}` }, env), { authorization: `Bearer ${TEST_TOKEN}` })
-  assert.deepEqual(resolveMcpHeaders({ 'x-flag': 'plain' }, env), { 'x-flag': 'plain' })
-  assert.throws(() => resolveMcpHeaders({ authorization: 'Bearer ${CAR_MCP_MISSING}' }, env), /CAR_MCP_MISSING.*未设置/, 'env 缺席 fail-visible')
-  assert.throws(() => resolveMcpHeaders({ 'x-api-key': `sk-literal-123456789` }, env), /plaintext credential/, '字面 sk- 值拒绝（CR-05 配置明文禁令）')
-})
-
-// ==================== config 校验（command/url 互斥 + 通道专属键） ====================
-
-test('S34: mcp.servers url/headers 键位——互斥恰好其一 / url 形态 / 通道专属键 fail-visible', () => {
-  const load = (raw: unknown) => {
-    const p = join(withTmp(), 'c.json')
-    writeFileSync(p, JSON.stringify(raw))
-    return loadCarConfig({ explicitPath: p })
-  }
-  const withTmp = () => mkdtempSync(join(tmpdir(), 'car-s34-cfg-'))
-  // command + url 同给 = 显式报错
-  assert.match(load({ mcp: { servers: { a: { command: 'node', url: 'https://x.test' } } } }).error!, /恰好其一/)
-  // 都缺 = 显式报错
-  assert.match(load({ mcp: { servers: { a: { args: ['x'] } } } }).error!, /恰好其一/)
-  // url 形态
-  assert.match(load({ mcp: { servers: { a: { url: 'ftp://x' } } } }).error!, /http\(s\) URL/)
-  // 通道专属键
-  assert.match(load({ mcp: { servers: { a: { url: 'https://x.test', args: ['x'] } } } }).error!, /args 仅 stdio 通道/)
-  assert.match(load({ mcp: { servers: { a: { url: 'https://x.test', env: { K: 'v' } } } } }).error!, /env 仅 stdio 通道/)
-  assert.match(load({ mcp: { servers: { a: { command: 'node', headers: { h: 'v' } } } } }).error!, /headers 仅远程通道/)
-  // 有效：url + headers
-  const ok = load({ mcp: { servers: { a: { url: 'https://x.test/mcp', headers: { authorization: 'Bearer ${T}' } } } } })
-  assert.equal(ok.error, undefined)
-  assert.deepEqual(ok.config.mcp?.servers?.a, { url: 'https://x.test/mcp', headers: { authorization: 'Bearer ${T}' } })
-  // 有效：command（存量键位兼容）
-  const ok2 = load({ mcp: { servers: { b: { command: 'node', args: ['s.js'] } } } })
-  assert.equal(ok2.error, undefined)
-})
-
-// ==================== spawn CLI 全链（1.5-GO-5） ====================
-
-test('S34: spawn CLI 全链——car run --mcp 远程 server（initialize→tools/list→tools/call 进 turn）', async () => {
-  await withTempDir('cli-remote', async dir => {
-    const { server, url: mcpUrl, seen, close } = await fakeMcpHttp()
-    let llmHits = 0
-    const llm = createServer((req, res) => {
-      let raw = ''
-      req.on('data', c => { raw += c })
-      req.on('end', () => {
-        void req
-        const sse = (events: object[]) => {
-          res.writeHead(200, { 'content-type': 'text/event-stream' })
-          res.end(events.map(e => `data: ${JSON.stringify(e)}\n\n`).join('') + 'data: [DONE]\n\n')
-        }
-        // 请求序驱动：首轮出 tool_calls（MCP 工具名在 tools[0].function.name——openai 出站体），
-        // 次轮收尾文本；同时校验 MCP 工具确实进了声明面
-        const n = llmHits++
-        if (n === 0) {
-          const body = JSON.parse(raw)
-          assert.equal(body.tools?.[0]?.function?.name, 'mcp_remote_remote_echo', 'MCP 远程工具进声明面')
-          sse([
-            { choices: [{ delta: { tool_calls: [{ index: 0, id: 'c1', function: { name: 'mcp_remote_remote_echo', arguments: '{"t":"hi"}' } }] } }] },
-            { choices: [{ delta: {}, finish_reason: 'tool_calls' }] },
-          ])
-          return
-        }
-        sse([
-          { choices: [{ delta: { content: 'remote 调用完成' } }] },
-          { choices: [{ delta: {}, finish_reason: 'stop' }] },
-        ])
-      })
-    })
-    await new Promise<void>(r => llm.listen(0, '127.0.0.1', r))
-    const llmPort = (llm.address() as { port: number }).port
-    writeFileSync(join(dir, 'empty.ts'), `export const manifest = { name: 'empty', version: '1.0.0' }\nexport default function apply() {}\n`)
-    writeFileSync(join(dir, 'car.config.json'), JSON.stringify({
-      llm: { baseUrl: `http://127.0.0.1:${llmPort}/v1`, model: 'm' },
-      mcp: { servers: { remote: { url: mcpUrl, headers: { authorization: `Bearer \${CAR_MCP_TOKEN}` } } } },
-    }))
-    const child = spawn(process.execPath, ['--experimental-transform-types', CLI, 'run', 'empty.ts',
-      '--prompt', 'call the remote echo tool with t=hi', '--mcp', 'remote'], {
-      cwd: dir,
-      env: { ...process.env, OPENAI_API_KEY: TEST_TOKEN, CAR_ALLOW_ENV_CREDENTIALS: '1', CAR_MCP_TOKEN: TEST_TOKEN },
-      stdio: ['ignore', 'pipe', 'pipe'],
-    })
-    let out = ''
-    let err = ''
-    child.stdout.on('data', d => { out += d })
-    child.stderr.on('data', d => { err += d })
-    const code = await new Promise<number>(resolve => child.on('exit', c => resolve(c ?? -1)))
-    server.close()
-    llm.close()
-    assert.equal(code, 0, err + out)
-    assert.match(out, /\[MCP\] remote: 1 工具入声明面/)
-    assert.match(out, /turnEnd=completed/)
-    // 远程 server 侧：真握手 + 调用（Authorization 头 ${ENV} 展开）
-    assert.deepEqual(seen.map(r => r.method), ['initialize', 'notifications/initialized', 'tools/list', 'tools/call'])
-    assert.equal(seen[3]!.headers.authorization, `Bearer ${TEST_TOKEN}`)
-    assert.deepEqual(seen[3]!.body.params, { name: 'remote_echo', arguments: { t: 'hi' } })
-    await close()
-  })
-})

package/test/s35-config-ts-zod.spec.ts

@@ -1,145 +0,0 @@
-/**
- * 1.5-S3 · 配置完整形态（S35）：car.config.ts + zod（D-22）
- *
- * 覆盖：
- *  - zod 校验层 JSON 键位兼容（存量锚点）：未知键 fail-visible（llm.temperature）/ 类型错
- *    （llm.maxTokens 必须为正整数）/ sandbox 扁平渲染 / 坏 JSON / 顶层非对象
- *  - car.config.ts 载体：发现序 ts > json（并存 = ts 胜出）/ 显式 --config *.ts /
- *    未预热显式报错（禁静默回退 json）/ epoch 缓存击穿（热改重预热取新内容）
- *  - TS 形态校验：缺 default export / 非 object default / 坏 TS（Node 不支持时引导文案）
- *  - mcp url/headers 键位经 zod（s34 锚点：恰好其一 / http(s) URL / 通道专属键）
- */
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { loadCarConfig, warmCarConfig } from '../src/load/config.ts'
-import { mergeSignatureGate, mergeLlmConfig } from '../src/load/config.ts'
-
-function withTempDir(name: string, fn: (dir: string) => Promise<void> | void): Promise<void> {
-  const dir = mkdtempSync(join(tmpdir(), `car-s35-${name}-`))
-  try {
-    const r = fn(dir)
-    const cleanup = () => { try { rmSync(dir, { recursive: true, force: true }) } catch { /* 红线 8 */ } }
-    if (r instanceof Promise) return r.finally(cleanup)
-    cleanup()
-    return Promise.resolve()
-  } catch (e) {
-    try { rmSync(dir, { recursive: true, force: true }) } catch { /* 红线 8 */ }
-    throw e
-  }
-}
-
-// ==================== zod 校验层（JSON 键位兼容） ====================
-
-test('S35: zod 校验层——存量锚点全过（未知键/类型错/坏 JSON/顶层非对象/扁平渲染）', () => {
-  withTempDir('zod-compat', dir => {
-    // s31 锚点：未知键 llm.temperature / maxTokens 类型错
-    writeFileSync(join(dir, 'a.json'), JSON.stringify({ llm: { temperature: 0.7 } }))
-    assert.match(loadCarConfig({ explicitPath: join(dir, 'a.json') }).error!, /未知键 llm\.temperature/)
-    writeFileSync(join(dir, 'b.json'), JSON.stringify({ llm: { maxTokens: 1.5 } }))
-    assert.match(loadCarConfig({ explicitPath: join(dir, 'b.json') }).error!, /llm\.maxTokens 必须为正整数/)
-    // 坏 JSON / 顶层非对象（CAR-E-CONFIG 前缀）
-    writeFileSync(join(dir, 'c.json'), '{ sandbox: {')
-    assert.match(loadCarConfig({ explicitPath: join(dir, 'c.json') }).error!, /CAR-E-CONFIG/)
-    writeFileSync(join(dir, 'd.json'), '[]')
-    assert.match(loadCarConfig({ explicitPath: join(dir, 'd.json') }).error!, /CAR-E-CONFIG/)
-    // 未知顶层键 / 未知嵌套键（unrecognized_keys 渲染）
-    writeFileSync(join(dir, 'e.json'), JSON.stringify({ plugins: [] }))
-    assert.match(loadCarConfig({ explicitPath: join(dir, 'e.json') }).error!, /未知顶层键 "plugins"/)
-    writeFileSync(join(dir, 'f.json'), JSON.stringify({ sandbox: { unsigned: { allow: true, extra: 1 } } }))
-    assert.match(loadCarConfig({ explicitPath: join(dir, 'f.json') }).error!, /未知键 sandbox\.unsigned\.extra/)
-    // 有效配置：扁平渲染（mergeSignatureGate 消费形态不变，s26 锚点）
-    writeFileSync(join(dir, 'g.json'), JSON.stringify({ sandbox: { unsigned: { allow: true }, sig: { enforce: true, trustRoot: 'PUBKEY' } }, llm: { baseUrl: 'https://x/v1', model: 'm' } }))
-    const ok = loadCarConfig({ explicitPath: join(dir, 'g.json') })
-    assert.equal(ok.error, undefined)
-    assert.deepEqual(ok.config.sandbox, { unsignedAllow: true, sigEnforce: true, sigTrustRoot: 'PUBKEY' })
-    assert.deepEqual(ok.config.llm, { baseUrl: 'https://x/v1', model: 'm' })
-    // mcp url/headers 键位经 zod（s34 锚点）
-    writeFileSync(join(dir, 'h.json'), JSON.stringify({ mcp: { servers: { a: { command: 'node', url: 'https://x' } } } }))
-    assert.match(loadCarConfig({ explicitPath: join(dir, 'h.json') }).error!, /恰好其一/)
-    writeFileSync(join(dir, 'i.json'), JSON.stringify({ mcp: { servers: { a: { command: 'node', headers: { h: 'v' } } } } }))
-    assert.match(loadCarConfig({ explicitPath: join(dir, 'i.json') }).error!, /headers 仅远程通道/)
-    writeFileSync(join(dir, 'j.json'), JSON.stringify({ mcp: { servers: { a: { url: 'https://x/mcp', headers: { authorization: 'Bearer ${T}' } } } } }))
-    const ok2 = loadCarConfig({ explicitPath: join(dir, 'j.json') })
-    assert.equal(ok2.error, undefined)
-    assert.deepEqual(ok2.config.mcp?.servers?.a, { url: 'https://x/mcp', headers: { authorization: 'Bearer ${T}' } })
-  })
-})
-
-// ==================== car.config.ts 载体 ====================
-
-test('S35: car.config.ts 载体——发现序 ts > json（并存 ts 胜出）+ 显式 --config *.ts + merge 全链', async () => {
-  await withTempDir('ts-carrier', async dir => {
-    writeFileSync(join(dir, 'car.config.ts'), `export default {\n  llm: { baseUrl: 'https://ts.example/v1', model: 'ts-model', maxTokens: 512 },\n  mcp: { servers: { remote: { url: 'https://mcp.example/mcp' } } },\n}\n`)
-    writeFileSync(join(dir, 'car.config.json'), JSON.stringify({ llm: { baseUrl: 'https://json.example/v1', model: 'json-model' } }))
-    await warmCarConfig({ cwd: dir })
-    const r = loadCarConfig({ cwd: dir })
-    assert.equal(r.error, undefined)
-    assert.match(r.path!, /car\.config\.ts$/, '发现序 ts > json：并存时 ts 胜出')
-    assert.equal(r.config.llm?.baseUrl, 'https://ts.example/v1')
-    assert.deepEqual(r.config.mcp?.servers?.remote, { url: 'https://mcp.example/mcp' }, 'ts 载体携带 1.5 新键位')
-    // merge 全链（D-16 优先级）不变
-    const merged = mergeLlmConfig({}, r.config)
-    assert.equal(merged.model, 'ts-model')
-    assert.equal(merged.maxTokens, 512)
-    // 显式 --config *.ts
-    await warmCarConfig({ explicitPath: join(dir, 'car.config.ts'), cwd: dir })
-    const r2 = loadCarConfig({ explicitPath: join(dir, 'car.config.ts'), cwd: dir })
-    assert.equal(r2.error, undefined)
-    assert.equal(r2.config.llm?.model, 'ts-model')
-    // 纯 json 目录不受影响（回归口径：无 ts 载体 = 原行为）
-    await withTempDir('json-only', async dir2 => {
-      writeFileSync(join(dir2, 'car.config.json'), JSON.stringify({ sandbox: { sig: { enforce: true } } }))
-      const r3 = loadCarConfig({ cwd: dir2 })
-      assert.equal(r3.error, undefined)
-      assert.equal(mergeSignatureGate({}, r3.config).mode, 'enforce')
-    })
-  })
-})
-
-test('S35: car.config.ts 未预热显式报错（禁静默回退 json）+ epoch 缓存击穿（热改重预热取新内容）', async () => {
-  await withTempDir('warm-protocol', async dir => {
-    writeFileSync(join(dir, 'car.config.ts'), `export default { llm: { model: 'v1' } }\n`)
-    writeFileSync(join(dir, 'car.config.json'), JSON.stringify({ llm: { model: 'json-fallback' } }))
-    // 未预热：显式报错（不静默回退 json——「配置写了但不生效」漂移面显式化）
-    const cold = loadCarConfig({ cwd: dir })
-    assert.match(cold.error!, /car\.config\.ts 未预热/)
-    assert.match(cold.error!, /warmCarConfig/)
-    // 预热后取 ts 内容
-    await warmCarConfig({ cwd: dir })
-    assert.equal(loadCarConfig({ cwd: dir }).config.llm?.model, 'v1')
-    // 热改：同路径重写 → 重预热（epoch 查询串击穿模块缓存）→ 新内容
-    writeFileSync(join(dir, 'car.config.ts'), `export default { llm: { model: 'v2' } }\n`)
-    await warmCarConfig({ cwd: dir })
-    assert.equal(loadCarConfig({ cwd: dir }).config.llm?.model, 'v2', 'epoch 击穿缓存')
-  })
-})
-
-test('S35: TS 形态校验——缺 default / 非 object default / 坏 TS fail-visible', async () => {
-  await withTempDir('ts-shape', async dir => {
-    writeFileSync(join(dir, 'car.config.ts'), `export const config = { llm: { model: 'x' } }\n`)
-    await warmCarConfig({ cwd: dir })
-    assert.match(loadCarConfig({ cwd: dir }).error!, /缺 default export/)
-
-    await withTempDir('ts-shape2', async dir2 => {
-      writeFileSync(join(dir2, 'car.config.ts'), `export default ['not', 'an', 'object']\n`)
-      await warmCarConfig({ cwd: dir2 })
-      assert.match(loadCarConfig({ cwd: dir2 }).error!, /default export 必须为对象/)
-    })
-
-    await withTempDir('ts-broken', async dir3 => {
-      writeFileSync(join(dir3, 'car.config.ts'), `export default { llm: ((( }\n`)
-      await warmCarConfig({ cwd: dir3 })
-      const r = loadCarConfig({ cwd: dir3 })
-      assert.match(r.error!, /CAR-E-CONFIG: car\.config\.ts 载入失败/)
-    })
-
-    await withTempDir('ts-zod-invalid', async dir4 => {
-      writeFileSync(join(dir4, 'car.config.ts'), `export default { llm: { temperature: 0.9 } }\n`)
-      await warmCarConfig({ cwd: dir4 })
-      assert.match(loadCarConfig({ cwd: dir4 }).error!, /未知键 llm\.temperature/, 'ts 载体与 json 同一 zod 校验层')
-    })
-  })
-})

package/test/s36-host-tool-surface.spec.ts

@@ -1,250 +0,0 @@
-/**
- * 1.6-S2 · 宿主工具面透传（S36）：RuntimeFacade toolList/toolCall 实装（D-25）
- *
- * 覆盖：
- *  - toolList：声明面出站（name/description/parameters）+ **declaredSideEffect 不出站**（权限面
- *    只进权限门红线）；未装配 = 空面（占位形态兼容）
- *  - toolCall 权限门：readonly 执行 / write（显式声明与未声明 T-22 收口）一律 policy 拒绝
- *    （CAR-E-HOST-AUTHZ——mcp-serve 无人审回路，deny-by-default）/ 未知工具显式报错 /
- *    工具异常=成对错误结果（US-5 同款）
- *  - 成对落链：actor='user'（宿主=用户代理）+ turnId='T0'（会话级能力面，sessionTurn 从 T1
- *    起不冲突）+ id 序列 host-tc-N；verifyChain 全程完整；跨源同名 CAR-E-DUP 由 cli 装配层
- *    fail-closed（spawn E2E 断言）
- *  - spawn E2E：mcp-serve 真进程 stdio——tools/list 十面不变 + tool_list 真实出插件工具 +
- *    tool_call readonly 执行 / write 拒绝 / verify 链完整（1.6-GO-5 生产调用点核查）
- */
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { spawn } from 'node:child_process'
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join, dirname } from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { createRuntimeFacade } from '../src/host/facade.ts'
-import { HostGateway } from '../src/host/hostGateway.ts'
-import { HOST_MAPPINGS, deriveSessionId } from '../src/host/mappings.ts'
-import type { ToolReg } from '../src/load/loader.ts'
-
-const CLI = join(dirname(fileURLToPath(import.meta.url)), '..', 'src', 'cli.ts')
-
-function makeTools(): Map<string, ToolReg> {
-  return new Map([
-    ['echo', {
-      name: 'echo', description: '回声工具', parameters: { type: 'object', properties: { text: { type: 'string' } } },
-      declaredSideEffect: 'readonly', run: async (args: Record<string, unknown>) => 'pong:' + String((args as { text?: string }).text ?? ''),
-    }],
-    ['write_file', { name: 'write_file', declaredSideEffect: 'write', run: async () => 'written' }],
-    ['stealth', { name: 'stealth', run: async () => 'undeclared' }], // 未声明 sideEffect——T-22 收口 write
-  ])
-}
-
-function gatewayWith(tools?: Map<string, ToolReg>) {
-  const facade = createRuntimeFacade({ profiles: new Map(HOST_MAPPINGS.map(h => [h.hostId, h])), ...(tools ? { tools } : {}) })
-  const gw = new HostGateway({ facade, audit: () => {} })
-  gw.registerHost({ hostId: 'claude-code', profile: HOST_MAPPINGS[0]!, transport: {} as never })
-  return { facade, gw }
-}
-
-test('S36: toolList 声明面出站——name/description/parameters 齐，declaredSideEffect 权限面不出站', async () => {
-  const { gw } = gatewayWith(makeTools())
-  await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-list' })
-  const r = await gw.handle('claude-code', 'tool_list', {})
-  assert.ok(r.ok)
-  const tools = (r.result as { tools: Array<Record<string, unknown>> }).tools
-  assert.equal(tools.length, 3)
-  const echo = tools.find(t => t.name === 'echo')!
-  assert.equal(echo.description, '回声工具')
-  assert.deepEqual(echo.parameters, { type: 'object', properties: { text: { type: 'string' } } })
-  assert.ok(tools.every(t => !('declaredSideEffect' in t)), '权限面不出站红线：sideEffect 信息不经宿主面外泄')
-  assert.ok(tools.every(t => !('run' in t)), '执行面不出站')
-})
-
-test('S36: toolList 未装配 = 空面（S12 占位形态兼容）', async () => {
-  const { gw } = gatewayWith()
-  await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-empty' })
-  const r = await gw.handle('claude-code', 'tool_list', {})
-  assert.ok(r.ok)
-  assert.deepEqual((r.result as { tools: unknown[] }).tools, [])
-})
-
-test('S36: toolCall readonly 执行——ok + 成对落链（actor=user/turnId=T0/id 序列）+ 链完整', async () => {
-  const { gw } = gatewayWith(makeTools())
-  const { sessionId } = await (await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-exec' })).result as { sessionId: string }
-  // gateway.handle 把 facade 返回值包进 {ok:true, result:<facade envelope>}——双层 ok 语义
-  const r1 = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'echo', arguments: { text: 'hi' } })
-  assert.ok(r1.ok)
-  assert.deepEqual(r1.result, { ok: true, result: 'pong:hi' })
-  const r2 = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'echo', arguments: { text: 'again' } })
-  assert.deepEqual(r2.result, { ok: true, result: 'pong:again' })
-  // 落链核查经 sessionExport（生产消费路径）：toolCall actor=user + turnId=T0 + id 序列 host-tc-N
-  const exp = await gw.handle('claude-code', 'session_export', { sessionId })
-  const bundle = (exp.result as { bundle: { files: Array<{ name: string; content: string }> } }).bundle
-  const eventsFile = bundle.files.find(f => f.name.endsWith('events.jsonl'))!
-  const events = eventsFile.content.trim().split('\n').map(l => JSON.parse(l)) as Array<{ actor: string; kind: string; turnId: string; payload: { id?: string; tool?: string } }>
-  const calls = events.filter(e => e.kind === 'toolCall')
-  assert.equal(calls.length, 2)
-  assert.ok(calls.every(e => e.actor === 'user' && e.turnId === 'T0'), 'D-25：宿主=用户代理，会话级能力面落 T0（sessionTurn 从 T1 起不冲突）')
-  assert.deepEqual(calls.map(e => e.payload.id), ['host-tc-1', 'host-tc-2'])
-  const verify = await gw.handle('claude-code', 'session_verify', { sessionId })
-  assert.deepEqual((verify.result as { ok: boolean }).ok, true, '工具调用成对落链后哈希链完整')
-})
-
-test('S36: toolCall write 类 policy 拒绝（显式声明 + 未声明 T-22 收口双路径）+ 拒绝落链', async () => {
-  const { gw } = gatewayWith(makeTools())
-  const { sessionId } = await (await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-deny' })).result as { sessionId: string }
-  const w = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'write_file' })
-  assert.ok(w.ok, 'handle 层 ok（facade 正常返回 envelope）')
-  assert.equal((w.result as { ok: boolean }).ok, false, 'facade 层 ok=false')
-  assert.match((w.result as { error?: string }).error!, /CAR-E-HOST-AUTHZ/)
-  const s = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'stealth' })
-  assert.equal((s.result as { ok: boolean }).ok, false, 'T-22：未声明 sideEffect 收口 write → 同样拒绝')
-  assert.match((s.result as { error?: string }).error!, /CAR-E-HOST-AUTHZ/)
-  // 拒绝也落链（runtime/toolResult authorization-denied）——审计全量留痕
-  const replay = await gw.handle('claude-code', 'session_replay', { sessionId })
-  const results = ((replay.result as { messages: Array<{ role: string; content?: unknown }> }).messages).filter(m => m.role === 'toolResult')
-  const denied = results.filter(m => (m.content as { error?: string }).error === 'authorization-denied')
-  assert.equal(denied.length, 2, '两次拒绝各落一条授权拒绝记录（单条即终态——D-23 不收敛）')
-  const verify = await gw.handle('claude-code', 'session_verify', { sessionId })
-  assert.deepEqual((verify.result as { ok: boolean }).ok, true)
-})
-
-test('S36: toolCall 未知工具显式报错 + 成对落链；工具异常=成对错误结果（US-5 同款）', async () => {
-  const tools = new Map<string, ToolReg>([['boom', { name: 'boom', declaredSideEffect: 'readonly', run: async () => { throw new Error('炸了') } }]])
-  const { gw } = gatewayWith(tools)
-  const { sessionId } = await (await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-err' })).result as { sessionId: string }
-  const unk = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'nope' })
-  assert.ok(unk.ok, 'handle 层正常返回')
-  assert.equal((unk.result as { ok: boolean }).ok, false, 'facade 层显式拒绝')
-  assert.match((unk.result as { error?: string }).error!, /unknown tool "nope"/)
-  const err = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'boom', arguments: {} })
-  assert.equal((err.result as { ok: boolean }).ok, false)
-  assert.match((err.result as { error?: string }).error!, /炸了/)
-  const replay = await gw.handle('claude-code', 'session_replay', { sessionId })
-  const results = ((replay.result as { messages: Array<{ role: string; content?: unknown }> }).messages).filter(m => m.role === 'toolResult')
-  assert.equal((results[0]!.content as { error?: string }).error, 'unknown tool "nope"')
-  assert.match((results[1]!.content as { error?: string }).error!, /炸了/, '工具异常=结果非中断（US-5/D5 语义同款）')
-})
-
-test('S36: 未装配 tool 面时 toolCall 显式报错（S13 静默占位退役——fail-visible）', async () => {
-  const { gw } = gatewayWith()
-  const { sessionId } = await (await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-nobridge' })).result as { sessionId: string }
-  const r = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'echo' })
-  assert.equal(r.ok, false)
-  assert.match(r.error!, /tool 面未装配/)
-})
-
-// ==================== spawn E2E（生产调用点——1.6-GO-5） ====================
-
-function withTempDir(name: string, fn: (dir: string) => Promise<void> | void): Promise<void> {
-  const dir = mkdtempSync(join(tmpdir(), `car-s36-${name}-`))
-  try {
-    const r = fn(dir)
-    const cleanup = () => { try { rmSync(dir, { recursive: true, force: true }) } catch { /* 红线 8 */ } }
-    if (r instanceof Promise) return r.finally(cleanup)
-    cleanup()
-    return Promise.resolve()
-  } catch (e) {
-    try { rmSync(dir, { recursive: true, force: true }) } catch { /* 红线 8 */ }
-    throw e
-  }
-}
-
-function talk(requests: string[], plugin: string): Promise<{ outs: any[]; stderr: string }> {
-  return new Promise((resolve, reject) => {
-    const child = spawn(process.execPath, ['--experimental-transform-types', CLI, 'mcp-serve', '--plugin', plugin], { stdio: ['pipe', 'pipe', 'pipe'] })
-    let out = ''
-    let err = ''
-    child.stdout.on('data', d => { out += d })
-    child.stderr.on('data', d => { err += d })
-    child.on('error', reject)
-    child.on('exit', () => {
-      try { resolve({ outs: out.split('\n').filter(Boolean).map(l => JSON.parse(l)), stderr: err }) } catch (e) { reject(e) }
-    })
-    for (const r of requests) child.stdin.write(r + '\n')
-    child.stdin.end()
-  })
-}
-
-test('S36: spawn E2E——mcp-serve 真进程 tool_list 透传插件工具面 + tool_call 执行/拒绝 + verify 链完整', async () => {
-  await withTempDir('e2e', async dir => {
-    const plugin = join(dir, 'p.ts')
-    writeFileSync(plugin, [
-      'export const manifest = { name: "s36p", version: "1.0.0" }',
-      'export default function apply(api) {',
-      '  api.registerTool({ name: "echo", description: "回声", declaredSideEffect: "readonly", parameters: { type: "object", properties: { text: { type: "string" } } }, run: async (a) => "pong:" + a.text })',
-      '  api.registerTool({ name: "write_file", declaredSideEffect: "write", run: async () => "written" })',
-      '}',
-    ].join('\n'))
-    // 派生 id 进程内预计算（确定性派生——session_start 返回必须一致）
-    const sid = deriveSessionId('claude-code', 's36-e2e')
-    const { outs } = await talk([
-      JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }),
-      JSON.stringify({ jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: 'session_start', arguments: { hostSessionId: 's36-e2e' } } }),
-      JSON.stringify({ jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: 'tool_list', arguments: {} } }),
-      JSON.stringify({ jsonrpc: '2.0', id: 4, method: 'tools/call', params: { name: 'tool_call', arguments: { sessionId: sid, tool: 'echo', arguments: { text: 'hi' } } } }),
-      JSON.stringify({ jsonrpc: '2.0', id: 5, method: 'tools/call', params: { name: 'tool_call', arguments: { sessionId: sid, tool: 'write_file', arguments: {} } } }),
-      JSON.stringify({ jsonrpc: '2.0', id: 6, method: 'tools/call', params: { name: 'session_verify', arguments: { sessionId: sid } } }),
-      JSON.stringify({ jsonrpc: '2.0', id: 7, method: 'tools/call', params: { name: 'session_replay', arguments: { sessionId: sid } } }),
-    ], plugin)
-    assert.equal(outs[0].result.tools.length, 10, 'MCP tools/list 十面不变（宿主能力面与插件工具面分层）')
-    assert.equal(JSON.parse(outs[1].result.content[0].text).sessionId, sid, '确定性派生经真进程复核')
-    const listed = JSON.parse(outs[2].result.content[0].text) as { tools: Array<Record<string, unknown>> }
-    assert.deepEqual(listed.tools.map(t => t.name), ['echo', 'write_file'], 'tool_list 透传插件声明面')
-    assert.equal(listed.tools.find(t => t.name === 'echo')!.description, '回声')
-    assert.ok(listed.tools.every(t => !('declaredSideEffect' in t)), '权限面不出站经真进程协议面复核')
-    assert.deepEqual(JSON.parse(outs[3].result.content[0].text), { ok: true, result: 'pong:hi' }, 'readonly 工具经宿主面真实执行（facade envelope 经 stdio content 透出）')
-    const denied = JSON.parse(outs[4].result.content[0].text) as { ok: boolean; error?: string }
-    assert.equal(denied.ok, false, 'write 类工具 policy 拒绝（facade envelope——handle 层未抛错）')
-    assert.match(denied.error!, /CAR-E-HOST-AUTHZ/)
-    assert.equal(JSON.parse(outs[5].result.content[0].text).ok, true, '工具调用成对落链后哈希链完整')
-    const msgs = JSON.parse(outs[6].result.content[0].text).messages as Array<{ role: string; content?: unknown; toolCall?: unknown }>
-    assert.ok(msgs.some(m => m.role === 'assistant' && (m.toolCall as { tool?: string })?.tool === 'echo'), 'toolCall 落链经 replay 可见')
-    assert.deepEqual(msgs.filter(m => m.role === 'toolResult').map(m => m.content), [
-      { id: 'host-tc-1', result: 'pong:hi' },
-      { id: 'host-tc-2', error: 'authorization-denied', granted: false, mode: 'host-policy' },
-    ])
-  })
-})
-
-test('S36: spawn E2E——tool_call 带 sessionId 全链（readonly 执行 / write 拒绝 / verify 完整）', async () => {
-  await withTempDir('e2e2', async dir => {
-    const plugin = join(dir, 'p.ts')
-    writeFileSync(plugin, [
-      'export const manifest = { name: "s36p2", version: "1.0.0" }',
-      'export default function apply(api) {',
-      '  api.registerTool({ name: "echo", description: "回声", declaredSideEffect: "readonly", run: async (a) => "pong:" + a.text })',
-      '  api.registerTool({ name: "write_file", declaredSideEffect: "write", run: async () => "written" })',
-      '}',
-    ].join('\n'))
-    const start = JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'session_start', arguments: { hostSessionId: 's36-e2e2' } } })
-    const first = await talk([start], plugin)
-    const sid = JSON.parse(first.outs[0].result.content[0].text).sessionId as string
-    const { outs } = await talk([
-      JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'session_start', arguments: { hostSessionId: 's36-e2e2' } } }),
-      JSON.stringify({ jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: 'tool_call', arguments: { sessionId: sid, tool: 'echo', arguments: { text: 'hi' } } } }),
-      JSON.stringify({ jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: 'tool_call', arguments: { sessionId: sid, tool: 'write_file', arguments: {} } } }),
-    ], plugin)
-    assert.deepEqual(JSON.parse(outs[1].result.content[0].text), { ok: true, result: 'pong:hi' }, 'readonly 工具经宿主面真实执行（跨进程幂等派生会话）')
-    const denied2 = JSON.parse(outs[2].result.content[0].text) as { ok: boolean; error?: string }
-    assert.equal(denied2.ok, false, 'write 类工具 policy 拒绝经真进程协议面可达')
-    assert.match(denied2.error!, /CAR-E-HOST-AUTHZ/)
-  })
-})
-
-test('S36: spawn E2E——跨源同名工具 CAR-E-DUP fail-closed 启动中止（exit 1）', async () => {
-  await withTempDir('e2e3', async dir => {
-    const pA = join(dir, 'a.ts')
-    const pB = join(dir, 'b.ts')
-    for (const [p, name] of [[pA, 'a'], [pB, 'b']] as const) {
-      writeFileSync(p, `export const manifest = { name: "${name}", version: "1.0.0" }\nexport default function apply(api) { api.registerTool({ name: "dup_tool", declaredSideEffect: "readonly", run: async () => "${name}" }) }\n`)
-    }
-    const code = await new Promise<number>(resolve => {
-      const child = spawn(process.execPath, ['--experimental-transform-types', CLI, 'mcp-serve', '--plugin', pA, '--plugin', pB], { stdio: ['pipe', 'pipe', 'pipe'] })
-      let err = ''
-      child.stderr.on('data', d => { err += d })
-      child.on('exit', c => { resolve(c ?? -1) })
-      child.stdin.end()
-    })
-    assert.equal(code, 1, '禁静默覆盖：fail-closed 启动中止（1.4-S1 跨源同名纪律同款）')
-  })
-})