@oj-module/cli 0.2.1 → 0.2.5

package/templates/api/tests/lifecycle/text-edit.spec.ts

@@ -0,0 +1,177 @@
+// BDD：config.yaml 文本锚点编辑（R18，P1-3）。安装器改写 config.yaml 的唯一手段。
+// 约束：禁止 yaml 解析/stringify 回写——用户注释、缩进、空行、键序必须逐字保留。
+// 锚点为整行注释（如 `# ojm:mount`）；插入位置=锚点行下一行，缩进继承锚点行；
+// 锚点已存在=原样返回（幂等）；锚点缺失=可读错误（message 含锚点名）。
+import * as fsp from "node:fs/promises";
+import { describe, expect, it } from "vitest";
+
+import { appendAnonymousPaths, bumpInstallSeq, ensureReloadApi, hasAnchor, insertAnchor } from "../../src/_platform/_lifecycle/text-edit";
+
+describe("insertAnchor（R18）", () => {
+	it("带注释的 config.yaml 插入后注释/缩进/空行/键序逐字保留", () => {
+		const content = [
+			"# 用户全局注释，必须保留",
+			"server:",
+			"  port: 8080",
+			"",
+			"  # ojm:reload",
+			"database:",
+			"  host: localhost",
+		].join("\n");
+		const result = insertAnchor(content, "# ojm:reload", "reload_api: true");
+		expect(result).toBe([
+			"# 用户全局注释，必须保留",
+			"server:",
+			"  port: 8080",
+			"",
+			"  # ojm:reload",
+			"  reload_api: true",
+			"database:",
+			"  host: localhost",
+		].join("\n"));
+	});
+
+	it("锚点后已紧跟同内容块时原样返回（幂等）", () => {
+		const content = "server:\n  # ojm:mount\n  mount: []";
+		expect(insertAnchor(content, "# ojm:mount", "mount: []")).toBe(content);
+	});
+
+	it("连续两次调用同一锚点，第二次为 no-op", () => {
+		const content = "server:\n  # ojm:mount";
+		const once = insertAnchor(content, "# ojm:mount", "mount: []");
+		const twice = insertAnchor(once, "# ojm:mount", "mount: []");
+		expect(twice).toBe(once);
+	});
+
+	it("锚点注释行必须整行匹配：子串提及行不算锚点，插入定位到真实锚点行", () => {
+		const content = "# 参考 ojm:mount 文档\nserver:\n  # ojm:mount";
+		const result = insertAnchor(content, "# ojm:mount", "mount: []");
+		expect(result).toBe("# 参考 ojm:mount 文档\nserver:\n  # ojm:mount\n  mount: []");
+	});
+
+	it("只有相似锚点行（前缀超集）而无真实锚点时报错", () => {
+		expect(() => insertAnchor("# ojm:mounts\nserver: {}", "# ojm:mount", "mount: []"))
+			.toThrowError(/# ojm:mount/);
+	});
+
+	it("content 无锚点时报错，message 含锚点名", () => {
+		expect(() => insertAnchor("server:\n  port: 8080", "# ojm:mount", "mount: []"))
+			.toThrowError(/# ojm:mount/);
+	});
+
+	it("锚点在末行且无尾随换行时正确换行插入", () => {
+		const result = insertAnchor("# ojm:mount", "# ojm:mount", "mount: []");
+		expect(result).toBe("# ojm:mount\nmount: []");
+	});
+});
+
+describe("hasAnchor（R18）", () => {
+	it("锚点行存在返回 true", () => {
+		expect(hasAnchor("a: 1\n  # ojm:mount\nb: 2", "# ojm:mount")).toBe(true);
+	});
+
+	it("锚点仅作为子串出现返回 false", () => {
+		expect(hasAnchor("# 参考 ojm:mount 文档", "# ojm:mount")).toBe(false);
+		expect(hasAnchor("# ojm:mounts", "# ojm:mount")).toBe(false);
+	});
+
+	it("锚点不存在返回 false", () => {
+		expect(hasAnchor("a: 1\nb: 2", "# ojm:mount")).toBe(false);
+	});
+});
+
+describe("ensureReloadApi（P1-10，D3 一次性注入集收口：S1-1 定稿无需改 mounts）", () => {
+	it("无 reload_api 键且锚点在 → 锚点下插入 reload_api: true（缩进继承、注释逐字保留），changed=true", () => {
+		const content = "server:\n  port: 8080\n  # 用户注释保留\n  # ojm:reload\ndb:\n  default: x";
+		const r = ensureReloadApi(content);
+		expect(r.changed).toBe(true);
+		expect(r.content).toBe("server:\n  port: 8080\n  # 用户注释保留\n  # ojm:reload\n  reload_api: true\ndb:\n  default: x");
+	});
+
+	it("reload_api: true 已在 → no-op（无锚点也不报错），changed=false", () => {
+		const content = "server:\n  reload_api: true\n  port: 1";
+		const r = ensureReloadApi(content);
+		expect(r.changed).toBe(false);
+		expect(r.content).toBe(content);
+	});
+
+	it("显式 reload_api: false → 拒绝（用户主动关闭，不偷偷翻转），message 可读", () => {
+		expect(() => ensureReloadApi("server:\n  reload_api: false # 运维明确关闭"))
+			.toThrowError(/reload_api/);
+	});
+
+	it("无键且锚点缺失 → 可读报错（不猜插入位置，锚点随模板发布，P1-16 接线）", () => {
+		expect(() => ensureReloadApi("server:\n  port: 1")).toThrowError(/# ojm:reload/);
+	});
+});
+
+describe("bumpInstallSeq（B-11 reload 触发面：vars 安装序号自增，PRD E5 实测 vars 改动可热生效）", () => {
+	it("0 → 1 自增，其余行（注释/缩进/键序）逐字保留", () => {
+		const content = "mounts: []\nvars:\n  ojm_install_seq: 0\n# 尾注释保留";
+		const r = bumpInstallSeq(content);
+		expect(r.seq).toBe(1);
+		expect(r.content).toBe("mounts: []\nvars:\n  ojm_install_seq: 1\n# 尾注释保留");
+	});
+
+	it("多次调用累加（N → N+1），行内尾注释原样保留", () => {
+		const content = "vars:\n  ojm_install_seq: 41 # 安装序号";
+		const r1 = bumpInstallSeq(content);
+		expect(r1.seq).toBe(42);
+		expect(r1.content).toBe("vars:\n  ojm_install_seq: 42 # 安装序号");
+		const r2 = bumpInstallSeq(r1.content);
+		expect(r2.seq).toBe(43);
+	});
+
+	it("键缺失 → 可读报错（用户删行 = 显式退出热更触发，安装器不猜位置）", () => {
+		expect(() => bumpInstallSeq("vars:\n  other: 1")).toThrowError(/ojm_install_seq/);
+	});
+
+	it("值非数字（行存在但形状不符）→ 视同缺失，可读报错不猜", () => {
+		expect(() => bumpInstallSeq("vars:\n  ojm_install_seq: abc")).toThrowError(/ojm_install_seq/);
+	});
+});
+
+describe("模板 config.yaml 随发锚点（P1-16 接线②：ensureReloadApi 键缺失插入路径的闭环依据）", () => {
+	it("模板 config.yaml 带整行 # ojm:reload 锚点；键在 → ensureReloadApi no-op", async () => {
+		const cfg = await fsp.readFile(new URL("../../config.yaml", import.meta.url), "utf8");
+		expect(hasAnchor(cfg, "# ojm:reload")).toBe(true);
+		const r = ensureReloadApi(cfg);
+		expect(r.changed).toBe(false);
+	});
+
+	it("用户删键保锚点 → ensureReloadApi 锚点下插回 reload_api: true（缩进继承）", async () => {
+		const cfg = await fsp.readFile(new URL("../../config.yaml", import.meta.url), "utf8");
+		const stripped = cfg.split("\n").filter(l => !/^\s*reload_api\s*:/.test(l)).join("\n");
+		const r = ensureReloadApi(stripped);
+		expect(r.changed).toBe(true);
+		expect(r.content).toContain("reload_api: true");
+		expect(r.content).toContain("# ojm:reload");
+	});
+});
+
+describe("p2-15③ C2-26 anonymous 运行时接线（appendAnonymousPaths：config 独占模型文本手术）", () => {
+	const BASE = "auth:\n  anonymous_paths:\n    - /auth/login\n    # 行内注释（模板 config 真形态）\n    - /system/login-methods\n";
+
+	it("追加方案匿名端点：列表尾部插入、统一补前导 /、缩进继承", () => {
+		const r = appendAnonymousPaths(BASE, ["demo-solution/ping", "demo-solution/health"]);
+		expect(r.added).toEqual(["/demo-solution/ping", "/demo-solution/health"]);
+		expect(r.content).toContain("    - /demo-solution/ping");
+		expect(r.content).toContain("    - /demo-solution/health");
+		// 注释逐字保留 + 既有项不动
+		expect(r.content).toContain("# 行内注释（模板 config 真形态）");
+		expect(r.content).toContain("- /auth/login");
+		expect(r.content).toContain("- /system/login-methods");
+	});
+
+	it("幂等：已存在（trim 相等）不重复插入", () => {
+		const once = appendAnonymousPaths(BASE, ["demo-solution/ping"]);
+		const twice = appendAnonymousPaths(once.content, ["demo-solution/ping"]);
+		expect(twice.added).toEqual([]);
+		expect(twice.content).toBe(once.content);
+		expect(once.content.match(/demo-solution\/ping/g)).toHaveLength(1);
+	});
+
+	it("键缺失 = 可读报错不猜位置（用户删键 = 显式退出匿名模型）", () => {
+		expect(() => appendAnonymousPaths("server:\n  reload_api: true\n", ["x/y"])).toThrow(/anonymous_paths/);
+	});
+});

package/templates/api/tests/lifecycle/tgz-guard.spec.ts

@@ -0,0 +1,103 @@
+// BDD：tgz 成员守卫（R1，P1-2）。zip-slip 防护的校验核。
+// 输入契约：`tar -tvzf` 的逐行输出；成员名取行内最后一个空格分隔字段；
+// 条目类型取权限串首字符（l=symlink、h=hardlink）；symlink 行成员名取箭头左侧。
+// 拒绝：绝对路径、任何 `..` 段、l/h 条目、空成员名、反斜杠路径；`./` 前缀相对合法。
+import { describe, expect, it } from "vitest";
+
+import { validateTarListing } from "../../src/_platform/_lifecycle/tgz-guard";
+
+describe("validateTarListing（R1）", () => {
+	it("正常成员列表通过", () => {
+		expect(validateTarListing([
+			"drwxr-xr-x  0 ever staff    0 10 17 12:00 wiki-0.2.0/",
+			"-rw-r--r--  0 ever staff   42 10 17 12:00 wiki-0.2.0/src/manifest.yaml",
+		])).toEqual({ ok: true });
+	});
+
+	it("嵌套合法相对路径通过", () => {
+		expect(validateTarListing([
+			"-rw-r--r--  0 ever staff    7 10 17 12:00 wiki-0.2.0/src/a/b/c.yaml",
+		])).toEqual({ ok: true });
+	});
+
+	it("`./` 前缀视为相对合法", () => {
+		expect(validateTarListing([
+			"-rw-r--r--  0 ever staff   42 10 17 12:00 ./wiki-0.2.0/src/manifest.yaml",
+		])).toEqual({ ok: true });
+	});
+
+	it("成员名含连续点但非 `..` 段通过", () => {
+		expect(validateTarListing([
+			"-rw-r--r--  0 ever staff    7 10 17 12:00 wiki-0.2.0/a..b/file",
+		])).toEqual({ ok: true });
+	});
+
+	it("`../evil` 拒绝并报 offender", () => {
+		expect(validateTarListing([
+			"drwxr-xr-x  0 ever staff    0 10 17 12:00 wiki-0.2.0/",
+			"-rw-r--r--  0 ever staff    7 10 17 12:00 ../evil",
+		])).toEqual({ ok: false, offender: "../evil" });
+	});
+
+	it("路径中段的 `..` 拒绝", () => {
+		expect(validateTarListing([
+			"-rw-r--r--  0 ever staff    7 10 17 12:00 wiki-0.2.0/../../etc/passwd",
+		])).toEqual({ ok: false, offender: "wiki-0.2.0/../../etc/passwd" });
+	});
+
+	it("绝对路径拒绝", () => {
+		expect(validateTarListing([
+			"-rw-r--r--  0 ever staff    7 10 17 12:00 /etc/passwd",
+		])).toEqual({ ok: false, offender: "/etc/passwd" });
+	});
+
+	it("symlink（l 类型）拒绝，offender 取箭头左侧成员名", () => {
+		expect(validateTarListing([
+			"lrwxr-xr-x  0 ever staff    0 10 17 12:00 link -> /etc",
+		])).toEqual({ ok: false, offender: "link" });
+	});
+
+	it("hardlink（h 类型）拒绝", () => {
+		expect(validateTarListing([
+			"hrwxr-xr-x  0 ever staff    0 10 17 12:00 wiki-0.2.0/dup",
+		])).toEqual({ ok: false, offender: "wiki-0.2.0/dup" });
+	});
+
+	it("空成员名（无字段的退化行）拒绝", () => {
+		expect(validateTarListing([""])).toEqual({ ok: false, offender: "" });
+	});
+
+	it("windows 风格反斜杠路径防御性拒绝", () => {
+		expect(validateTarListing([
+			"-rw-r--r--  0 ever staff    7 10 17 12:00 wiki-0.2.0\\src\\manifest.yaml",
+		])).toEqual({ ok: false, offender: "wiki-0.2.0\\src\\manifest.yaml" });
+		expect(validateTarListing([
+			"-rw-r--r--  0 ever staff    7 10 17 12:00 ..\\evil",
+		])).toEqual({ ok: false, offender: "..\\evil" });
+	});
+
+	it("空格成员名内藏 `..` 逃逸拒绝（R1 评审构造行）", () => {
+		expect(validateTarListing([
+			"-rw-r--r--  0 ever staff    7 10 17 15:01 ./wiki-0.2.0/../../evil pwn",
+		])).toEqual({ ok: false, offender: "./wiki-0.2.0/../../evil" });
+	});
+
+	it("空格成员名以 `/` 开头的逃逸形态拒绝", () => {
+		expect(validateTarListing([
+			"-rw-r--r--  0 ever staff    7 10 17 15:01 /etc x",
+		])).toEqual({ ok: false, offender: "/etc" });
+	});
+
+	it("`tar: …` 警告杂行拒绝（tar 的 stderr 混入）", () => {
+		expect(validateTarListing([
+			"tar: ../evil",
+		])).toEqual({ ok: false, offender: "../evil" });
+	});
+
+	it("多个坏成员时报第一个 offender", () => {
+		expect(validateTarListing([
+			"-rw-r--r--  0 ever staff    7 10 17 12:00 /abs",
+			"-rw-r--r--  0 ever staff    7 10 17 12:00 ../evil",
+		])).toEqual({ ok: false, offender: "/abs" });
+	});
+});

package/templates/api/tests/lifecycle/trust.spec.ts

@@ -0,0 +1,310 @@
+// BDD：宿主信任库（P2-2，契约 v1.3 §2.11 C2-38/39，G3 双轨第一轨 / G5）+ 市场运维端点（superadmin，R9）。
+// store 层：空库/幂等/首次绑定不可改/多 key/吊销/损坏 fail-closed/.bak 回落/并发读不见半截/审计。
+// 端点层：GET /market/trust、POST /market/trust/key、DELETE /market/trust/key?key_id=（del 动词 + query，system/roles 同款先例）。
+/* eslint-disable test/prefer-lowercase-title -- 端点动词/路径是验收锚点，保留大写（market-api.spec 同约定） */
+import type { FsFace } from "../../src/_platform/_lifecycle/atomic";
+import type { MarketEnv } from "../../src/_platform/market/api";
+import { Buffer } from "node:buffer";
+import { createHash } from "node:crypto";
+import * as fsp from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { createTrustStore, isValidKeyId } from "../../src/_platform/_lifecycle/trust";
+import { invalidateAllUsers } from "../../src/_platform/_shared/service/access";
+import { createMarketApi, marketEnv } from "../../src/_platform/market/api";
+import { installDb } from "../fixture";
+
+const g = globalThis as any;
+
+const PUB_A = "a".repeat(64);
+const PUB_B = "b".repeat(64);
+
+function nodeFsFace(): FsFace {
+	return {
+		writeFile: (path, data) => fsp.writeFile(path, data),
+		readFile: path => fsp.readFile(path),
+		mkdir: (path, opts) => fsp.mkdir(path, opts),
+		remove: (path, opts) => fsp.rm(path, opts),
+		rename: (oldPath, newPath) => fsp.rename(oldPath, newPath),
+		copyFile: (src, dest) => fsp.copyFile(src, dest),
+		readdir: path => fsp.readdir(path),
+	};
+}
+
+/** sha256Hex 指纹面（契约 §2.11；真机由 oj crypto 增补面提供，测试经 opts.fingerprintOf 注入同值实现） */
+function fingerprintOf(publicKeyHex: string): string {
+	return createHash("sha256").update(Buffer.from(publicKeyHex, "hex")).digest("hex");
+}
+
+let root: string;
+let trustPath: string;
+let auditLog: { action: string, target: string, detail: unknown, level?: number }[];
+
+beforeEach(async () => {
+	root = await fsp.mkdtemp(join(tmpdir(), "ojm-trust-"));
+	trustPath = join(root, ".solutions", "trusted-keys.yaml");
+	g.fs = nodeFsFace();
+	auditLog = [];
+});
+
+afterEach(async () => {
+	g.fs = undefined;
+	await fsp.rm(root, { recursive: true, force: true });
+});
+
+function store(): ReturnType<typeof createTrustStore> {
+	return createTrustStore(trustPath, { audit: e => auditLog.push({ action: e.action, target: e.target, detail: e.detail, level: e.level }), fingerprintOf });
+}
+
+describe("信任库 store（C2-38/39）", () => {
+	it("空库：list 空数组 / get null，不报错", async () => {
+		const s = store();
+		expect(await s.list()).toEqual([]);
+		expect(await s.get("ojm.test")).toBeNull();
+	});
+
+	it("add → get/list 命中；落盘为受限 YAML 子集", async () => {
+		const s = store();
+		expect(await s.add("ojm.test", PUB_A, { operator: "admin" })).toBe("added");
+		expect(await s.get("ojm.test")).toBe(PUB_A);
+		expect(await s.list()).toEqual([{ key_id: "ojm.test", public_key: PUB_A, added_at: expect.any(Number) }]);
+		const text = await fsp.readFile(trustPath, "utf8");
+		expect(text).toMatch(/^trusted_keys:\n {2}ojm\.test:\n {4}public_key: "a{64}"\n {4}added_at: \d+\n$/);
+	});
+
+	it("同 key 同公钥幂等：exists_same，盘上内容不变", async () => {
+		const s = store();
+		await s.add("ojm.test", PUB_A);
+		const before = await fsp.readFile(trustPath, "utf8");
+		expect(await s.add("ojm.test", PUB_A)).toBe("exists_same");
+		expect(await fsp.readFile(trustPath, "utf8")).toBe(before);
+	});
+
+	it("首次绑定不可改：同 key_id 异公钥 = 409 trust_bound_mismatch（含双方指纹），库内原值不动", async () => {
+		const s = store();
+		await s.add("ojm.test", PUB_A);
+		await expect(s.add("ojm.test", PUB_B)).rejects.toMatchObject({ status: 409, message: expect.stringContaining("首次绑定不可改") });
+		await expect(s.add("ojm.test", PUB_B)).rejects.toThrow(/库内指纹 [0-9a-f]{64} ≠ 新钥指纹 [0-9a-f]{64}/);
+		expect(await s.get("ojm.test")).toBe(PUB_A);
+	});
+
+	it("多 key 共存（轮换过渡期）：两个 key_id 均在列", async () => {
+		const s = store();
+		await s.add("ojm.old", PUB_A);
+		await s.add("ojm.new", PUB_B);
+		const rows = await s.list();
+		expect(rows.map(r => r.key_id)).toEqual(["ojm.new", "ojm.old"]); // 字典序
+	});
+
+	it("吊销：remove → get null；再 remove → false；审计留痕", async () => {
+		const s = store();
+		await s.add("ojm.test", PUB_A, { operator: "admin" });
+		expect(await s.remove("ojm.test", { operator: "admin" })).toBe(true);
+		expect(await s.get("ojm.test")).toBeNull();
+		expect(await s.remove("ojm.test")).toBe(false);
+		expect(auditLog.map(e => e.action)).toEqual(["solution.trust.add", "solution.trust.revoke"]);
+		expect(auditLog[0]).toMatchObject({ target: "ojm.test", detail: { key_id: "ojm.test", operator: "admin", fingerprint: fingerprintOf(PUB_A) } });
+	});
+
+	it("审计 operator 不可得 → 记 unknown 且告警级 level=4（不静默 null，P2-5）", async () => {
+		const s = store();
+		await s.add("ojm.test", PUB_A); // 无 operator
+		expect(auditLog[0]?.level).toBe(4);
+		expect(auditLog[0]?.detail).toMatchObject({ operator: "unknown" });
+		await s.remove("ojm.test"); // 无 operator
+		expect(auditLog[1]?.level).toBe(4);
+		expect(auditLog[1]?.detail).toMatchObject({ operator: "unknown" });
+	});
+
+	it("审计 operator 可得 → 记真值且 info 级 level=6", async () => {
+		const s = store();
+		await s.add("ojm.test", PUB_A, { operator: "admin" });
+		expect(auditLog[0]?.level).toBe(6);
+		expect(auditLog[0]?.detail).toMatchObject({ operator: "admin" });
+	});
+
+	it("key_id 命名空间违规拒（C2-37）：单段裸名 / 大写 / 空段", async () => {
+		const s = store();
+		await expect(s.add("test", PUB_A)).rejects.toMatchObject({ status: 400 });
+		await expect(s.add("Default.x", PUB_A)).rejects.toMatchObject({ status: 400 });
+		await expect(s.add("a..b", PUB_A)).rejects.toMatchObject({ status: 400 });
+		expect(isValidKeyId("ojm.test")).toBe(true);
+		expect(isValidKeyId("pub.team.key-2")).toBe(true);
+		expect(isValidKeyId("test")).toBe(false);
+	});
+
+	it("public_key 非 64hex 拒（400）", async () => {
+		const s = store();
+		await expect(s.add("ojm.test", "abc")).rejects.toMatchObject({ status: 400 });
+		await expect(s.add("ojm.test", "A".repeat(64))).rejects.toMatchObject({ status: 400 });
+	});
+
+	it("损坏 fail-closed：主与 .bak 皆不可解析 → 500 可读报错（含路径与修法）", async () => {
+		await fsp.mkdir(join(root, ".solutions"), { recursive: true });
+		await fsp.writeFile(trustPath, "trusted_keys: [1, 2, 3]\n");
+		const s = store();
+		await expect(s.list()).rejects.toMatchObject({ status: 500, message: expect.stringContaining(trustPath) });
+	});
+
+	it(".bak 回落：主损坏 + .bak 完好 → 自动回落并留 note；下次写入自愈", async () => {
+		const s0 = store();
+		await s0.add("ojm.test", PUB_A);
+		await s0.add("ojm.other", PUB_B); // 第二次写后 .bak = 只含 ojm.test 的前一版
+		const bak = await fsp.readFile(`${trustPath}.bak`, "utf8");
+		expect(bak).toContain("ojm.test");
+		expect(bak).not.toContain("ojm.other");
+
+		await fsp.writeFile(trustPath, "garbage: {{\n");
+		const s1 = store();
+		const rows = await s1.list();
+		expect(rows.map(r => r.key_id)).toEqual(["ojm.test"]); // 回落 .bak
+		expect(s1.corruptNote?.()).toContain("已自动回落");
+
+		await s1.add("ojm.third", PUB_A); // 写入自愈：主文件重建、note 清零、.bak 不被垃圾覆盖
+		const healed = await fsp.readFile(trustPath, "utf8");
+		expect(healed).toContain("ojm.test");
+		expect(healed).toContain("ojm.third");
+		expect(await fsp.readFile(`${trustPath}.bak`, "utf8")).toBe(bak);
+		expect((store()).corruptNote?.()).toBeNull();
+	});
+
+	it("并发读不见半截：写与读交叉进行，读方永远得到完整旧版或完整新版", async () => {
+		const s = store();
+		// 单写者顺序写（trust 变更经端点/CLI 串行到达；跨进程并发锁属安装互斥面，R17/R31）
+		const writer = (async () => {
+			for (let i = 0; i < 20; i++)
+				await s.add(`pub.k${i}`, i % 2 === 0 ? PUB_A : PUB_B);
+		})();
+		const sizes: number[] = [];
+		for (let round = 0; round < 500; round++) {
+			const rows = await s.list(); // 半截文件会在此抛错（严格解析）
+			sizes.push(rows.length);
+		}
+		await writer;
+		expect(Math.max(...sizes)).toBeLessThanOrEqual(20);
+		expect((await s.list()).length).toBe(20);
+	});
+});
+
+describe("信任库运维端点（superadmin，R9）", () => {
+	let sharedRoot: string;
+	let last: { status: number, data?: unknown, msg?: string } | null;
+
+	beforeEach(async () => {
+		sharedRoot = join(root, "modules");
+		const dbo = installDb(); // 注入 g.db（node:sqlite 内存库 + 真实迁移）
+		dbo.prepare("INSERT OR IGNORE INTO sys_user_role (user_id, role_name) VALUES (?, ?)").run(1, "superadmin");
+		g.yaml = { parse: async (t: string) => JSON.parse(t) };
+		g.http = { user: { id: 1 }, query: {}, body: {} };
+		g.json = {
+			ok: (data: unknown) => { last = { status: 200, data }; },
+			fail: (status: number, msg: string) => { last = { status, msg }; },
+		};
+		last = null;
+	});
+
+	afterEach(async () => {
+		g.db = undefined;
+		g.http = undefined;
+		g.json = undefined;
+		g.yaml = undefined;
+		invalidateAllUsers();
+	});
+
+	function makeEnv(): MarketEnv {
+		return {
+			sharedRoot,
+			staging: join(sharedRoot, ".staging"),
+			taskDir: join(sharedRoot, ".install-tasks"),
+			statePath: join(sharedRoot, ".solutions", "state.yaml"),
+			trustPath,
+			dbPath: join(root, "db.sqlite"),
+			siteModulesDir: join(root, "dist", "modules"),
+			modulesJsonPath: join(root, "dist", "modules.json"),
+			apiPrefix: "/api",
+		};
+	}
+
+	it("未登录 / 非 superadmin 一律 403（拒权不泄露存在性，同 market 编排面口径）", async () => {
+		const api = createMarketApi(makeEnv());
+		g.http = {}; // 无 user：currentAccess deny（403，不区分「未登录」与「无权」）
+		await api.trust.get();
+		expect(last).toMatchObject({ status: 403 });
+		g.http = { user: { id: 2 } }; // 登录但非 superadmin
+		await api.trust.get();
+		expect(last).toMatchObject({ status: 403 });
+	});
+
+	it("GET trust：空库返回 {keys: [], note: null}", async () => {
+		const api = createMarketApi(makeEnv());
+		await api.trust.get();
+		expect(last).toMatchObject({ status: 200, data: { keys: [], note: null } });
+	});
+
+	it("POST trust/key：缺参 400；坏 key_id 400；正常 added → 幂等 exists_same；撞绑定 409", async () => {
+		const api = createMarketApi(makeEnv());
+		g.http.body = {};
+		await api.trust.key.post();
+		expect(last).toMatchObject({ status: 400 });
+
+		g.http.body = { key_id: "test", public_key: PUB_A };
+		await api.trust.key.post();
+		expect(last).toMatchObject({ status: 400 });
+
+		g.http.body = { key_id: "ojm.test", public_key: PUB_A };
+		await api.trust.key.post();
+		expect(last).toMatchObject({ status: 200, data: { result: "added" } });
+		await api.trust.key.post();
+		expect(last).toMatchObject({ status: 200, data: { result: "exists_same" } });
+
+		g.http.body = { key_id: "ojm.test", public_key: PUB_B };
+		await api.trust.key.post();
+		expect(last).toMatchObject({ status: 409 });
+	});
+
+	it("DELETE trust/key：吊销成功 / 无此 key 皆可断言；审计落 sys_oplog（operator=admin）", async () => {
+		const api = createMarketApi(makeEnv());
+		g.http.body = { key_id: "ojm.test", public_key: PUB_A };
+		await api.trust.key.post();
+		await new Promise(r => setTimeout(r, 20)); // auditOp fire-and-forget：等落库
+
+		g.http.query = { key_id: "ojm.test" };
+		await api.trust.key.del();
+		expect(last).toMatchObject({ status: 200, data: { revoked: true } });
+
+		await api.trust.key.del();
+		expect(last).toMatchObject({ status: 200, data: { revoked: false } });
+
+		g.http.query = {};
+		await api.trust.key.del();
+		expect(last).toMatchObject({ status: 400 });
+
+		const rows = await (g.db.query as (sql: string, p?: unknown[]) => Promise<Array<Record<string, unknown>>>)("select action, target, detail from sys_oplog where action like 'solution.trust.%' order by id");
+		expect(rows.map(r => r.action)).toEqual(["solution.trust.add", "solution.trust.revoke"]);
+		expect(rows[0]).toMatchObject({ target: "ojm.test" });
+		expect(JSON.parse(String(rows[0].detail))).toMatchObject({ key_id: "ojm.test", operator: "admin" });
+	});
+});
+
+// U6 信任库加固（P3-1）：信任库路径须移出第三方方案模块的 fs jail（modules/ 安装子树），
+// 并经 platform.trusted_paths 显式授权给 _platform 特权模块——防止伪造信任锚（P2-2 红线 spike）。
+describe("U6 信任库路径加固（P3-1）", () => {
+	it("marketEnv().trustPath 不在 modules/ 安装子树内", () => {
+		const env = marketEnv();
+		// 关键不变量：第三方方案模块（非 _platform）的 fs 读写范围 = fs.root，
+		// 落在 modules/ 下即处于其 jail 内可被写入；信任库必须在其外。
+		expect(env.trustPath.startsWith("modules/")).toBe(false);
+		expect(env.trustPath).toBe(".solutions/trusted-keys.yaml");
+	});
+
+	it("模板 config.yaml 文档化 U6 trusted_paths 授权要求（部署侧须补声明）", async () => {
+		const cfg = await fsp.readFile(join(__dirname, "..", "..", "config.yaml"), "utf8");
+		// 信任库存放根须落 platform.trusted_paths 授权 + 移出 modules/ 安装子树（防第三方方案模块伪造信任锚）。
+		// 模板不硬编码 trusted_paths 条目（oj 对不存在路径装配 fail-fast，会致 oj serve 起服失败），
+		// 故此处钉「要求被文档化」这一不变量，部署侧据此补声明。
+		expect(cfg).toContain("trusted_paths");
+		expect(cfg).toContain("U6");
+		expect(cfg).toContain(".solutions/trusted-keys.yaml");
+	});
+});