@vantran-se/openchamber-web 1.23.1 → 1.24.4

package/server/lib/guests/auth-store.js

@@ -0,0 +1,184 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { z } from 'zod';
+
+const PANEL_ID = /^[a-z][a-z0-9-]*$/;
+const SETTING_KEY = /^[a-z][a-z0-9-]*$/;
+
+const guestAuthEntrySchema = z.object({
+  clientId: z.string().min(1).optional(),
+  clientSecret: z.string().min(1).optional(),
+  accessToken: z.string().min(1).optional(),
+  refreshToken: z.string().min(1).nullable().optional(),
+  tokenType: z.string().min(1).optional(),
+  expiresAt: z.number().int().positive().nullable().optional(),
+  account: z.string().max(200).optional(),
+  settings: z.record(z.string().regex(SETTING_KEY), z.string().max(2000)).optional(),
+  authorizedAt: z.number().int().positive().optional(),
+  // Where the tokens were minted for. Checked before every use, so a
+  // package that moved its API origin or OAuth endpoints cannot receive
+  // credentials the user connected for the old ones.
+  target: z.object({
+    apiOrigin: z.string().min(1),
+    authorizeUrl: z.string().min(1).optional(),
+    tokenUrl: z.string().min(1).optional(),
+  }).optional(),
+  // Where the client id and secret were entered for. A package that moved
+  // its endpoints gets no client credentials until the user enters them
+  // again; they are never carried over.
+  clientTarget: z.object({
+    apiOrigin: z.string().min(1),
+    authorizeUrl: z.string().min(1).optional(),
+    tokenUrl: z.string().min(1).optional(),
+  }).optional(),
+});
+
+const storeSchema = z.object({
+  guests: z.record(z.string().regex(PANEL_ID), guestAuthEntrySchema),
+});
+
+const dataDirSchema = z.string().min(1).refine((entry) => !entry.includes('\0') && path.isAbsolute(entry));
+
+export const guestAuthPersistPath = (dataDir) => {
+  const parsed = dataDirSchema.safeParse(dataDir);
+  if (!parsed.success) {
+    throw new Error('Guest auth needs an absolute OpenChamber data dir');
+  }
+  return path.join(parsed.data, 'guest-auth.json');
+};
+
+const parseStore = (raw) => {
+  try {
+    const parsed = storeSchema.safeParse(JSON.parse(raw));
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+};
+
+export const readGuestAuthStore = async (persistPath) => {
+  try {
+    const raw = await fs.readFile(persistPath, 'utf8');
+    const text = raw.replace(/^\uFEFF/, '').trim();
+    if (text === '') {
+      return { guests: {} };
+    }
+    const parsed = parseStore(text);
+    if (!parsed) {
+      throw new Error('Invalid guest auth store');
+    }
+    return parsed;
+  } catch (error) {
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+      return { guests: {} };
+    }
+    throw error;
+  }
+};
+
+/** @type {Map<string, Promise<unknown>>} */
+const writeChains = new Map();
+let writeSequence = 0;
+
+// Two writers at once (a token refresh while a settings field saves) used to
+// share one temp file and a stale read: one of them lost. Every change to one
+// store file now runs read → change → write as a single step, one after
+// another, each on its own temp file.
+const withAuthStoreLock = (persistPath, run) => {
+  const previous = writeChains.get(persistPath) ?? Promise.resolve();
+  const next = previous.catch(() => undefined).then(run);
+  const chained = next.finally(() => {
+    if (writeChains.get(persistPath) === chained) writeChains.delete(persistPath);
+  });
+  writeChains.set(persistPath, chained);
+  return next;
+};
+
+const writeGuestAuthStoreUnlocked = async (store, persistPath) => {
+  const parsed = storeSchema.safeParse(store);
+  if (!parsed.success) {
+    throw new Error('Invalid guest auth store');
+  }
+  await fs.mkdir(path.dirname(persistPath), { recursive: true });
+  const tmp = `${persistPath}.tmp-${process.pid}-${Date.now()}-${(writeSequence += 1)}`;
+  await fs.writeFile(tmp, `${JSON.stringify(parsed.data, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+  await fs.rename(tmp, persistPath);
+  await fs.chmod(persistPath, 0o600);
+};
+
+
+export const getGuestAuth = async (guestId, persistPath) => {
+  const store = await readGuestAuthStore(persistPath);
+  return store.guests[guestId] ?? null;
+};
+
+/**
+ * Apply `patch` to one guest's entry, read and written under the store lock.
+ * With `expect`, the patch only lands when the entry read under the lock
+ * satisfies it; a caller that spent a network round trip on the old entry
+ * (a token refresh) uses this to drop its result when the entry moved on.
+ * `patch` may be a function of the entry read under the lock, for a change
+ * that depends on what is there (a client id replacing another one).
+ * Returns the entry as stored afterwards, or `null` when it is gone.
+ */
+export const patchGuestAuth = (guestId, patch, persistPath, expect = null) => withAuthStoreLock(persistPath, async () => {
+  const store = await readGuestAuthStore(persistPath);
+  const current = store.guests[guestId] ?? null;
+  if (expect && !expect(current)) {
+    return current;
+  }
+  const next = { ...(current ?? {}) };
+  const resolvedPatch = typeof patch === 'function' ? patch(current) : patch;
+  for (const [key, value] of Object.entries(resolvedPatch)) {
+    if (value === undefined) {
+      delete next[key];
+    } else {
+      next[key] = value;
+    }
+  }
+  const guests = { ...store.guests };
+  const empty = !next.clientId
+    && !next.clientSecret
+    && !next.accessToken
+    && !next.refreshToken
+    && (!next.settings || Object.keys(next.settings).length === 0);
+  if (empty) {
+    delete guests[guestId];
+  } else {
+    guests[guestId] = next;
+  }
+  await writeGuestAuthStoreUnlocked({ guests }, persistPath);
+  return guests[guestId] ?? null;
+});
+
+/**
+ * Forget the tokens. With `expect`, only when the entry read under the lock
+ * still holds the tokens the caller is reacting to; a caller that saw a 401
+ * on one access token must not erase a newer connection made meanwhile.
+ */
+export const dropGuestTokens = async (guestId, persistPath, expect = null) => {
+  const current = await getGuestAuth(guestId, persistPath);
+  if (!current) {
+    return null;
+  }
+  return patchGuestAuth(guestId, {
+    accessToken: undefined,
+    refreshToken: undefined,
+    target: undefined,
+    tokenType: undefined,
+    expiresAt: undefined,
+    account: undefined,
+    authorizedAt: undefined,
+  }, persistPath, expect);
+};
+
+/** Drop everything stored for a guest: tokens, client credentials, and settings. Used when the package is removed. */
+export const forgetGuestAuth = (guestId, persistPath) => withAuthStoreLock(persistPath, async () => {
+  const store = await readGuestAuthStore(persistPath);
+  if (!(guestId in store.guests)) {
+    return;
+  }
+  const guests = { ...store.guests };
+  delete guests[guestId];
+  await writeGuestAuthStoreUnlocked({ ...store, guests }, persistPath);
+});

package/server/lib/guests/auth-store.test.js

@@ -0,0 +1,112 @@
+import { describe, expect, test } from 'bun:test';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import {
+  dropGuestTokens,
+  forgetGuestAuth,
+  getGuestAuth,
+  guestAuthPersistPath,
+  patchGuestAuth,
+  readGuestAuthStore,
+} from './auth-store.js';
+
+describe('guestAuthPersistPath', () => {
+  test('joins the instance data dir and refuses a relative path', () => {
+    const dataDir = path.join(os.tmpdir(), 'oc-guest-auth-a');
+    expect(guestAuthPersistPath(dataDir)).toBe(path.join(dataDir, 'guest-auth.json'));
+    expect(() => guestAuthPersistPath('relative')).toThrow('absolute OpenChamber data dir');
+  });
+});
+
+describe('guest auth store', () => {
+  test('round-trips tokens and writes 0o600', async () => {
+    const dir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'oc-guest-auth-'));
+    const file = guestAuthPersistPath(dir);
+    expect(await readGuestAuthStore(file)).toEqual({ guests: {} });
+    await patchGuestAuth('clickup', {
+      clientId: 'id',
+      clientSecret: 'secret',
+      accessToken: 'tok',
+      account: 'ada',
+      settings: { 'list-id': '123' },
+    }, file);
+    expect(await getGuestAuth('clickup', file)).toMatchObject({
+      clientId: 'id',
+      accessToken: 'tok',
+      account: 'ada',
+      settings: { 'list-id': '123' },
+    });
+    expect(fs.statSync(file).mode & 0o777).toBe(0o600);
+    await dropGuestTokens('clickup', file);
+    const after = await getGuestAuth('clickup', file);
+    expect(after?.accessToken).toBeUndefined();
+    expect(after?.clientId).toBe('id');
+    expect(after?.settings).toEqual({ 'list-id': '123' });
+    await fs.promises.rm(dir, { recursive: true, force: true });
+  });
+
+  test('forgets a guest entirely when its package is removed', async () => {
+    const dir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'oc-guest-auth-'));
+    const file = guestAuthPersistPath(dir);
+    try {
+      await patchGuestAuth('clickup', { clientId: 'app', clientSecret: 'secret', accessToken: 'token' }, file);
+      await patchGuestAuth('other', { accessToken: 'keep' }, file);
+      await forgetGuestAuth('clickup', file);
+      expect(await getGuestAuth('clickup', file)).toBeNull();
+      expect((await getGuestAuth('other', file))?.accessToken).toBe('keep');
+    } finally {
+      await fs.promises.rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test('treats a blank file as an empty store', async () => {
+    const dir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'oc-guest-auth-'));
+    const file = guestAuthPersistPath(dir);
+    await fs.promises.writeFile(file, '', 'utf8');
+    expect(await readGuestAuthStore(file)).toEqual({ guests: {} });
+    await fs.promises.writeFile(file, '\uFEFF\n', 'utf8');
+    expect(await readGuestAuthStore(file)).toEqual({ guests: {} });
+    await fs.promises.rm(dir, { recursive: true, force: true });
+  });
+
+  test('refuses a corrupt store', async () => {
+    const dir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'oc-guest-auth-'));
+    const file = guestAuthPersistPath(dir);
+    await fs.promises.writeFile(file, '{"guests":[]}', 'utf8');
+    try {
+      await readGuestAuthStore(file);
+      throw new Error('should have thrown');
+    } catch (error) {
+      expect(String(error)).toContain('Invalid guest auth store');
+    }
+    await fs.promises.writeFile(file, '{', 'utf8');
+    try {
+      await readGuestAuthStore(file);
+      throw new Error('should have thrown');
+    } catch (error) {
+      expect(String(error)).toContain('Invalid guest auth store');
+    }
+    await fs.promises.rm(dir, { recursive: true, force: true });
+  });
+});
+
+describe('concurrent auth changes', () => {
+  test('two patches at once both land', async () => {
+    const dir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'oc-guest-auth-'));
+    const file = guestAuthPersistPath(dir);
+    try {
+      await Promise.all([
+        patchGuestAuth('alpha', { accessToken: 'tok-a' }, file),
+        patchGuestAuth('beta', { accessToken: 'tok-b' }, file),
+        patchGuestAuth('alpha', { settings: { 'list-id': '7' } }, file),
+      ]);
+      expect(await getGuestAuth('alpha', file)).toMatchObject({ accessToken: 'tok-a', settings: { 'list-id': '7' } });
+      expect(await getGuestAuth('beta', file)).toMatchObject({ accessToken: 'tok-b' });
+      expect(fs.readdirSync(dir).filter((name) => name.includes('.tmp-'))).toEqual([]);
+    } finally {
+      await fs.promises.rm(dir, { recursive: true, force: true });
+    }
+  });
+});

package/server/lib/guests/background.test.js

@@ -0,0 +1,83 @@
+import { afterEach, expect, test } from 'bun:test';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import express from 'express';
+import request from 'supertest';
+import { inspectGuestPackage, toPublicGuest } from './catalog.js';
+import { registerGuestRoutes } from './routes.js';
+
+const roots = [];
+afterEach(async () => { await Promise.all(roots.splice(0).map((root) => fs.rm(root, { recursive: true, force: true }))); });
+const fixture = async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'oc-background-')); roots.push(root);
+  const packageRoot = path.join(root, 'package');
+  await fs.mkdir(packageRoot);
+  await fs.writeFile(path.join(packageRoot, 'package.json'), JSON.stringify({ name: 'background-test', version: '1.0.0', openchamber: {
+    apiVersion: 1, contributes: {
+      panel: { id: 'background-test', name: 'Background Test', icon: 'apps' },
+      background: { entry: 'index.html' },
+      capabilities: ['files'], commands: [{ name: 'test-background' }],
+      actions: [{ id: 'count', label: 'Count', where: 'message', mode: 'background' }],
+    },
+  } }));
+  return { root, packageRoot };
+};
+
+test('background-only packages validate HTML and built scripts and expose a separate catalog entry', async () => {
+  const { packageRoot } = await fixture();
+  expect(await inspectGuestPackage(packageRoot)).toMatchObject({ ok: false, code: 'invalid-manifest' });
+  await fs.writeFile(path.join(packageRoot, 'index.html'), '<script src="main.js"></script>');
+  await fs.writeFile(path.join(packageRoot, 'main.ts'), 'export {};');
+  expect(await inspectGuestPackage(packageRoot)).toMatchObject({ ok: false, code: 'missing-build' });
+  await fs.writeFile(path.join(packageRoot, 'main.js'), 'void 0;');
+  const result = await inspectGuestPackage(packageRoot);
+  expect(result.ok).toBe(true);
+  if (!result.ok) throw new Error(result.code);
+  const row = toPublicGuest(result.guest);
+  expect(row.entry).toBeUndefined();
+  expect(row.backgroundEntry).toBe('index.html');
+  expect(row.attach).toBeUndefined();
+  expect(row.actions).toHaveLength(1);
+  expect(row.commands).toHaveLength(1);
+  expect(row.capabilities).toEqual({ requested: ['files'], granted: [] });
+});
+
+test('background entry and its scripts cannot escape the installed package through symlinks', async () => {
+  const { root, packageRoot } = await fixture();
+  const outside = path.join(root, 'outside.html');
+  await fs.writeFile(outside, '<p>Outside</p>');
+  await fs.symlink(outside, path.join(packageRoot, 'index.html'));
+  expect(await inspectGuestPackage(packageRoot)).toMatchObject({ ok: false, code: 'invalid-manifest' });
+  await fs.unlink(path.join(packageRoot, 'index.html'));
+  await fs.writeFile(path.join(packageRoot, 'index.html'), '<script src="main.js"></script>');
+  await fs.writeFile(path.join(root, 'outside.js'), 'void 0;');
+  await fs.symlink(path.join(root, 'outside.js'), path.join(packageRoot, 'main.js'));
+  expect(await inspectGuestPackage(packageRoot)).toMatchObject({ ok: false, code: 'missing-build' });
+});
+
+test('background install serves sandboxed assets and storage obeys approval and enabled state', async () => {
+  const { root, packageRoot } = await fixture();
+  await fs.writeFile(path.join(packageRoot, 'index.html'), '<script src="main.js"></script>');
+  await fs.writeFile(path.join(packageRoot, 'main.js'), 'void 0;');
+  const app = express(); registerGuestRoutes(app, { openchamberDataDir: root, resolveGitBinaryForSpawn: () => 'git' });
+  const installed = await request(app).post('/api/guests').send({ path: packageRoot }).expect(201);
+  expect(installed.body.guest.backgroundEntry).toBe('index.html');
+  expect(installed.body.guest.entry).toBeUndefined();
+  const catalog = await request(app).get('/api/guests').expect(200);
+  expect(catalog.body.guests[0].backgroundEntry).toBe('index.html');
+  const html = await request(app).get('/api/guests/background-test/index.html?oc_url_token=test-scope').expect(200);
+  expect(html.headers['content-security-policy']).toBe('sandbox allow-scripts');
+  expect(html.text).toContain('main.js?oc_url_token=test-scope');
+  expect((await request(app).get('/api/guests/background-test/main.js').expect(200)).text).toBe('void 0;');
+  await request(app).post('/api/guests/background-test/storage').send({ op: 'set', key: 'count', value: 1 }).expect(400);
+  await request(app).put('/api/guests/background-test/capabilities').send({ granted: ['files'] }).expect(200);
+  await request(app).post('/api/guests/background-test/storage').send({ op: 'set', key: 'count', value: 1 }).expect(200);
+  expect((await request(app).post('/api/guests/background-test/storage').send({ op: 'get', key: 'count' }).expect(200)).body).toMatchObject({ found: true, value: 1 });
+  await request(app).put('/api/guests/background-test/enabled').send({ enabled: false }).expect(200);
+  await request(app).post('/api/guests/background-test/storage').send({ op: 'set', key: 'count', value: 2 }).expect(400);
+  await request(app).put('/api/guests/background-test/enabled').send({ enabled: true }).expect(200);
+  expect((await request(app).post('/api/guests/background-test/storage').send({ op: 'get', key: 'count' }).expect(200)).body).toMatchObject({ value: 1 });
+  await request(app).put('/api/guests/background-test/capabilities').send({ granted: [] }).expect(200);
+  await request(app).post('/api/guests/background-test/storage').send({ op: 'get', key: 'count' }).expect(400);
+});

package/server/lib/guests/builtins.js

@@ -0,0 +1,34 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { z } from 'zod';
+
+const BUILTIN_PREFIX = 'openchamber-builtin-';
+export const DEFAULT_BUILTIN_ROOT = fileURLToPath(new URL('../../built-in-extensions/', import.meta.url));
+export const builtInExtensionSchema = z.object({
+  id: z.string().regex(/^openchamber-builtin-[a-z][a-z0-9-]*$/),
+  directory: z.string().regex(/^[a-z][a-z0-9-]*$/),
+});
+export const builtInRegistrySchema = z.object({
+  version: z.literal(1),
+  extensions: z.array(builtInExtensionSchema),
+}).superRefine(({ extensions }, context) => {
+  const ids = new Set();
+  const directories = new Set();
+  for (const entry of extensions) {
+    if (ids.has(entry.id) || directories.has(entry.directory)) {
+      context.addIssue({ code: 'custom', message: 'Built-in extension IDs and directories must be unique' });
+    }
+    ids.add(entry.id);
+    directories.add(entry.directory);
+  }
+});
+
+export const isReservedBuiltInId = (id) => id.startsWith(BUILTIN_PREFIX);
+
+/** Only application startup supplies this root; manifests and HTTP input cannot select it. */
+export const readBuiltInRegistry = async (root = DEFAULT_BUILTIN_ROOT) => {
+  const realRoot = await fs.realpath(root);
+  const registry = builtInRegistrySchema.parse(JSON.parse(await fs.readFile(path.join(realRoot, 'registry.json'), 'utf8')));
+  return { root: realRoot, extensions: registry.extensions };
+};

package/server/lib/guests/builtins.test.js

@@ -0,0 +1,174 @@
+import { afterEach, describe, expect, spyOn, test } from 'bun:test';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import express from 'express';
+import request from 'supertest';
+
+import { registerBuiltInGuests, listInstalledGuests, invalidateGuestCatalog, toPublicGuest } from './catalog.js';
+import { registerGuestRoutes } from './routes.js';
+import { readExtensionStore, writeExtensionStore } from './persist.js';
+import { getServiceStatus, stopAllGuestServices } from './service.js';
+
+const roots = [];
+const releases = [];
+const id = 'openchamber-builtin-fixture';
+afterEach(async () => {
+  await stopAllGuestServices();
+  for (const release of releases.splice(0)) release();
+  await Promise.all(roots.splice(0).map((root) => fs.rm(root, { recursive: true, force: true })));
+});
+
+const manifest = (panelId = id) => ({
+  name: 'fixture', version: '1.0.0', type: 'module',
+  openchamber: { apiVersion: 1, contributes: {
+    panel: { id: panelId, name: 'Fixture', icon: 'puzzle', entry: 'panel/index.html' },
+    capabilities: ['files', 'sessions'],
+    integration: { name: 'Fixture', description: 'GitHub', token: { apiOrigin: 'https://api.github.com', scheme: 'bearer', account: { path: '/user', name: 'login' } } },
+  } },
+});
+const writePackage = async (root, definition) => {
+  await fs.mkdir(path.join(root, 'panel'), { recursive: true });
+  await fs.writeFile(path.join(root, 'package.json'), JSON.stringify(definition));
+  await fs.writeFile(path.join(root, 'panel/index.html'), '<script src="main.js"></script>');
+  await fs.writeFile(path.join(root, 'panel/main.js'), 'console.log("fixture");');
+};
+const fixture = async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'oc-builtins-'));
+  roots.push(root);
+  const bundle = path.join(root, 'app-bundle');
+  const packageRoot = path.join(bundle, 'fixture');
+  const data = path.join(root, 'data');
+  const persistPath = path.join(data, 'extensions.json');
+  const project = path.join(root, 'project');
+  await fs.mkdir(project);
+  await fs.writeFile(path.join(project, 'README.md'), 'Fixture project');
+  await writePackage(packageRoot, manifest());
+  await fs.writeFile(path.join(bundle, 'registry.json'), JSON.stringify({ version: 1, extensions: [{ id, directory: 'fixture' }] }));
+  releases.push(await registerBuiltInGuests({ persistPath, root: bundle }));
+  const app = express();
+  registerGuestRoutes(app, { openchamberDataDir: data, openchamberVersion: '1.23.2', resolveGitBinaryForSpawn: () => 'git', resolveOptionalProjectDirectory: () => ({ directory: project }) });
+  return { root, bundle, packageRoot, persistPath, api: request(app) };
+};
+
+describe('app-owned extensions', () => {
+  test('each instance owns its disabled state independently', async () => {
+    const first = await fixture();
+    const second = await fixture();
+    await first.api.put(`/api/guests/${id}/enabled`).send({ enabled: false }).expect(200);
+    expect((await first.api.get('/api/guests').expect(200)).body.guests[0].enabled).toBe(false);
+    expect((await second.api.get('/api/guests').expect(200)).body.guests[0].enabled).toBe(true);
+  });
+  test('ships enabled with its exact declared grants and no persisted approval', async () => {
+    const { api, persistPath } = await fixture();
+    const response = await api.get('/api/guests').expect(200);
+    const guest = response.body.guests[0];
+    expect(guest.source).toBe('bundled');
+    expect(guest.enabled).toBe(true);
+    expect(guest.path).toBeNull();
+    expect([...guest.capabilities.granted].sort()).toEqual([...guest.capabilities.requested].sort());
+    expect(guest.capabilities.granted).toContain('files');
+    expect(guest.capabilities.granted).toContain('network');
+    expect((await readExtensionStore(persistPath)).capabilityGrants).toEqual({});
+    await api.post(`/api/guests/${id}/files`).send({ op: 'read', path: 'README.md' }).expect(200);
+    const deniedModel = await api.post(`/api/guests/${id}/generate`).send({ prompt: 'not declared' }).expect(400);
+    expect(deniedModel.body.error).toBe('NOT_GRANTED');
+    await api.put(`/api/guests/${id}/capabilities`).send({ granted: [] }).expect(400, { error: 'bundled' });
+    await api.delete(`/api/guests/${id}`).expect(400, { error: 'bundled' });
+    await api.post(`/api/guests/${id}/update`).expect(400, { error: 'not-git' });
+  });
+
+  test('disable survives a new application version and preserves storage and credentials', async () => {
+    const { api, persistPath, packageRoot, bundle } = await fixture();
+    await api.post(`/api/guests/${id}/storage`).send({ op: 'set', key: 'note', value: 'keep this' }).expect(200);
+    const fetch = spyOn(globalThis, 'fetch').mockResolvedValue(Response.json({ login: 'fixture' }));
+    try {
+      await api.put(`/api/guests/${id}/token`).send({ token: 'fixture-token' }).expect(200);
+    } finally { fetch.mockRestore(); }
+    await api.put(`/api/guests/${id}/enabled`).send({ enabled: false }).expect(200);
+    const deniedFile = await api.post(`/api/guests/${id}/files`).send({ op: 'read', path: 'README.md' }).expect(400);
+    expect(deniedFile.body.error).toBe('DISABLED');
+    const blockedFetch = spyOn(globalThis, 'fetch').mockRejectedValue(new Error('Disabled extension reached the provider'));
+    try {
+      const deniedRequest = await api.post(`/api/guests/${id}/request`).send({ method: 'GET', path: '/user' }).expect(400);
+      expect(deniedRequest.body.error).toBe('DISABLED');
+      expect(blockedFetch.mock.calls).toHaveLength(0);
+    } finally { blockedFetch.mockRestore(); }
+    const next = manifest();
+    next.version = '2.0.0';
+    next.openchamber.contributes.capabilities.push('model');
+    await writePackage(packageRoot, next);
+    releases.push(await registerBuiltInGuests({ persistPath, root: bundle }));
+    const updated = (await api.get('/api/guests').expect(200)).body.guests[0];
+    expect(updated.enabled).toBe(false);
+    expect(updated.version).toBe('2.0.0');
+    expect(updated.capabilities.granted).toContain('model');
+    expect((await readExtensionStore(persistPath)).disabledGuests[id]).toBe(true);
+    await api.put(`/api/guests/${id}/enabled`).send({ enabled: true }).expect(200);
+    const saved = await api.post(`/api/guests/${id}/storage`).send({ op: 'get', key: 'note' }).expect(200);
+    expect(saved.body.value).toBe('keep this');
+    expect((await api.get(`/api/guests/${id}/oauth/status`).expect(200)).body.connected).toBe(true);
+  });
+
+  test('a package cannot claim built-in trust or replace a reserved ID', async () => {
+    const { api, root, persistPath } = await fixture();
+    const forged = path.join(root, 'forged');
+    const definition = manifest('third-party');
+    definition.builtin = true;
+    definition.openchamber.builtin = true;
+    await writePackage(forged, definition);
+    const installed = await api.post('/api/guests').send({ path: forged, source: 'bundled' }).expect(201);
+    expect(installed.body.guest.source).toBe('path');
+    expect(installed.body.guest.capabilities.granted).toEqual([]);
+    await writePackage(forged, manifest());
+    await api.post('/api/guests').send({ path: forged, replace: true }).expect(400, { error: 'reserved-id' });
+    await writeExtensionStore(persistPath, { paths: [forged], sources: {}, capabilityGrants: { [id]: ['files', 'network'] } });
+    const guests = await listInstalledGuests({ persistPath });
+    expect(guests).toHaveLength(1);
+    expect(guests[0].source).toBe('bundled');
+    expect(guests[0].packageRoot).not.toBe(forged);
+  });
+
+  test('automatic grants never move a saved token to a changed provider origin', async () => {
+    const { api, packageRoot, persistPath } = await fixture();
+    const fetch = spyOn(globalThis, 'fetch').mockResolvedValue(Response.json({ login: 'fixture' }));
+    try { await api.put(`/api/guests/${id}/token`).send({ token: 'fixture-token' }).expect(200); }
+    finally { fetch.mockRestore(); }
+    const definition = manifest();
+    definition.openchamber.contributes.integration.token.apiOrigin = 'https://api.example.com';
+    await writePackage(packageRoot, definition);
+    invalidateGuestCatalog(persistPath);
+    expect((await api.get('/api/guests').expect(200)).body.guests[0].capabilities.granted).toContain('network');
+    expect((await api.get(`/api/guests/${id}/oauth/status`).expect(200)).body.connected).toBe(false);
+  });
+
+  test('rejects invalid registries and does not elevate symlinked packages outside the bundle', async () => {
+    const { root, bundle, persistPath } = await fixture();
+    const outside = path.join(root, 'outside');
+    await writePackage(outside, manifest());
+    const broken = path.join(bundle, 'linked');
+    await fs.symlink(outside, broken, 'dir');
+    await fs.writeFile(path.join(bundle, 'registry.json'), JSON.stringify({ version: 1, extensions: [{ id, directory: '../outside' }] }));
+    await expect(registerBuiltInGuests({ persistPath, root: bundle })).rejects.toThrow();
+    const otherId = 'openchamber-builtin-linked';
+    await fs.writeFile(path.join(bundle, 'registry.json'), JSON.stringify({ version: 1, extensions: [{ id, directory: 'fixture' }, { id: otherId, directory: 'linked' }] }));
+    releases.push(await registerBuiltInGuests({ persistPath, root: bundle }));
+    const guests = await listInstalledGuests({ persistPath });
+    expect(guests.map((guest) => guest.id)).toEqual([id]);
+    expect(toPublicGuest(guests[0]).capabilities.granted).toContain('network');
+  });
+
+  test('disable stops an automatically approved built-in service', async () => {
+    const { api, packageRoot, persistPath } = await fixture();
+    const definition = manifest();
+    definition.openchamber.contributes.service = { runtime: 'host', entry: 'service.mjs' };
+    await fs.writeFile(path.join(packageRoot, 'service.mjs'), `import http from 'node:http';
+http.createServer((req,res)=>{ if(req.headers.authorization!=='Bearer '+process.env.OPENCHAMBER_SERVICE_TOKEN){res.writeHead(401);res.end();return;}res.end('ok'); }).listen(Number(process.env.OPENCHAMBER_SERVICE_PORT),'127.0.0.1');`);
+    await fs.writeFile(path.join(packageRoot, 'package.json'), JSON.stringify(definition));
+    invalidateGuestCatalog(persistPath);
+    await api.post(`/api/guests/${id}/service/request`).send({ method: 'GET', path: '/test' }).expect(200);
+    expect(getServiceStatus(id)).toBe('ready');
+    await api.put(`/api/guests/${id}/enabled`).send({ enabled: false }).expect(200);
+    expect(getServiceStatus(id)).toBe('stopped');
+  });
+});