@weave_protocol/mund 0.2.3 → 0.3.1

package/tests/fixtures/rugpull/schema-key-reorder/current.json

@@ -0,0 +1,36 @@
+{
+  "name": "weather-notes",
+  "version": "1.0.0",
+  "tools": [
+    {
+      "name": "get_weather",
+      "description": "Get the current weather for a city.",
+      "inputSchema": {
+        "required": [
+          "city"
+        ],
+        "properties": {
+          "city": {
+            "type": "string"
+          }
+        },
+        "type": "object"
+      }
+    },
+    {
+      "name": "read_note",
+      "description": "Read a saved note by its title.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "title": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "title"
+        ]
+      }
+    }
+  ]
+}

package/tests/fixtures/rugpull/schema-key-reorder/expected.json

@@ -0,0 +1,5 @@
+{
+  "description": "Same schema, keys in a different order",
+  "status": "unchanged",
+  "changes": []
+}

package/tests/fixtures/rugpull/server-renamed/baseline.json

@@ -0,0 +1,36 @@
+{
+  "name": "weather-notes",
+  "version": "1.0.0",
+  "tools": [
+    {
+      "name": "get_weather",
+      "description": "Get the current weather for a city.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "city": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "city"
+        ]
+      }
+    },
+    {
+      "name": "read_note",
+      "description": "Read a saved note by its title.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "title": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "title"
+        ]
+      }
+    }
+  ]
+}

package/tests/fixtures/rugpull/server-renamed/current.json

@@ -0,0 +1,36 @@
+{
+  "name": "weather-notes-pro",
+  "version": "1.0.0",
+  "tools": [
+    {
+      "name": "get_weather",
+      "description": "Get the current weather for a city.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "city": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "city"
+        ]
+      }
+    },
+    {
+      "name": "read_note",
+      "description": "Read a saved note by its title.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "title": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "title"
+        ]
+      }
+    }
+  ]
+}

package/tests/fixtures/rugpull/server-renamed/expected.json

@@ -0,0 +1,11 @@
+{
+  "description": "Server renamed after approval",
+  "status": "changed",
+  "changes": [
+    {
+      "kind": "server_renamed",
+      "tool": "*",
+      "severity": "high"
+    }
+  ]
+}

package/tests/fixtures/rugpull/tool-added/baseline.json

@@ -0,0 +1,36 @@
+{
+  "name": "weather-notes",
+  "version": "1.0.0",
+  "tools": [
+    {
+      "name": "get_weather",
+      "description": "Get the current weather for a city.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "city": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "city"
+        ]
+      }
+    },
+    {
+      "name": "read_note",
+      "description": "Read a saved note by its title.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "title": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "title"
+        ]
+      }
+    }
+  ]
+}

package/tests/fixtures/rugpull/tool-added/current.json

@@ -0,0 +1,44 @@
+{
+  "name": "weather-notes",
+  "version": "1.0.0",
+  "tools": [
+    {
+      "name": "get_weather",
+      "description": "Get the current weather for a city.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "city": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "city"
+        ]
+      }
+    },
+    {
+      "name": "read_note",
+      "description": "Read a saved note by its title.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "title": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "title"
+        ]
+      }
+    },
+    {
+      "name": "list_notes",
+      "description": "List the titles of saved notes.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {}
+      }
+    }
+  ]
+}

package/tests/fixtures/rugpull/tool-added/expected.json

@@ -0,0 +1,11 @@
+{
+  "description": "A new tool appears",
+  "status": "changed",
+  "changes": [
+    {
+      "kind": "tool_added",
+      "tool": "list_notes",
+      "severity": "medium"
+    }
+  ]
+}

package/tests/fixtures/rugpull/tool-removed/baseline.json

@@ -0,0 +1,36 @@
+{
+  "name": "weather-notes",
+  "version": "1.0.0",
+  "tools": [
+    {
+      "name": "get_weather",
+      "description": "Get the current weather for a city.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "city": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "city"
+        ]
+      }
+    },
+    {
+      "name": "read_note",
+      "description": "Read a saved note by its title.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "title": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "title"
+        ]
+      }
+    }
+  ]
+}

package/tests/fixtures/rugpull/tool-removed/current.json

@@ -0,0 +1,21 @@
+{
+  "name": "weather-notes",
+  "version": "1.0.0",
+  "tools": [
+    {
+      "name": "get_weather",
+      "description": "Get the current weather for a city.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "city": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "city"
+        ]
+      }
+    }
+  ]
+}

package/tests/fixtures/rugpull/tool-removed/expected.json

@@ -0,0 +1,11 @@
+{
+  "description": "A tool disappears",
+  "status": "changed",
+  "changes": [
+    {
+      "kind": "tool_removed",
+      "tool": "read_note",
+      "severity": "low"
+    }
+  ]
+}

package/tests/fixtures/rugpull/unchanged/baseline.json

@@ -0,0 +1,36 @@
+{
+  "name": "weather-notes",
+  "version": "1.0.0",
+  "tools": [
+    {
+      "name": "get_weather",
+      "description": "Get the current weather for a city.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "city": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "city"
+        ]
+      }
+    },
+    {
+      "name": "read_note",
+      "description": "Read a saved note by its title.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "title": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "title"
+        ]
+      }
+    }
+  ]
+}

package/tests/fixtures/rugpull/unchanged/current.json

@@ -0,0 +1,36 @@
+{
+  "name": "weather-notes",
+  "version": "1.0.0",
+  "tools": [
+    {
+      "name": "get_weather",
+      "description": "Get the current weather for a city.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "city": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "city"
+        ]
+      }
+    },
+    {
+      "name": "read_note",
+      "description": "Read a saved note by its title.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "title": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "title"
+        ]
+      }
+    }
+  ]
+}

package/tests/fixtures/rugpull/unchanged/expected.json

@@ -0,0 +1,5 @@
+{
+  "description": "Same manifest re-checked",
+  "status": "unchanged",
+  "changes": []
+}

package/tests/fixtures.test.ts

@@ -0,0 +1,40 @@
+/**
+ * Fixture library: one fixture per case, each with its expected verdict.
+ * Add a file/folder under tests/fixtures/ and it is picked up here.
+ */
+import { readdirSync, readFileSync } from 'fs';
+import { join } from 'path';
+import { describe, expect, it } from 'vitest';
+import { CanaryRegistry } from '../src/canary.js';
+import { diffManifest, fingerprintManifest } from '../src/rugpull.js';
+
+const dir = (p: string) => join(__dirname, 'fixtures', p);
+const json = (p: string) => JSON.parse(readFileSync(p, 'utf8'));
+
+describe('canary fixtures', () => {
+  for (const file of readdirSync(dir('canary'))) {
+    const fx = json(join(dir('canary'), file));
+    it(`${file}: ${fx.description}`, () => {
+      const registry = new CanaryRegistry();
+      registry.register(fx.canary);
+      const hits = registry.find(fx.content);
+      expect(hits.length > 0).toBe(fx.expected.detected);
+      if (fx.expected.kind) expect(hits[0].kind).toBe(fx.expected.kind);
+    });
+  }
+});
+
+describe('rug-pull fixtures', () => {
+  for (const name of readdirSync(dir('rugpull'))) {
+    const base = join(dir('rugpull'), name);
+    const expected = json(join(base, 'expected.json'));
+    it(`${name}: ${expected.description}`, async () => {
+      const baseline = fingerprintManifest('fixture', json(join(base, 'baseline.json')));
+      const changes = await diffManifest(baseline, json(join(base, 'current.json')));
+      expect(changes.length > 0 ? 'changed' : 'unchanged').toBe(expected.status);
+      expect(changes.map(c => ({ kind: c.kind, tool: c.tool, severity: c.severity, ...(c.escalated ? { escalated: true } : {}) })))
+        .toEqual(expect.arrayContaining(expected.changes));
+      expect(changes).toHaveLength(expected.changes.length);
+    });
+  }
+});

package/tests/helpers.ts

@@ -0,0 +1,51 @@
+/**
+ * Shared test fixtures for Mund.
+ */
+
+import { DEFAULT_CONFIG } from '../src/constants.js';
+import type { MundConfig, SecurityEvent } from '../src/types.js';
+
+export function makeConfig(overrides: Partial<MundConfig> = {}): MundConfig {
+  return { ...DEFAULT_CONFIG, notifications: {}, ...overrides };
+}
+
+export function makeEvent(overrides: Partial<SecurityEvent> = {}): SecurityEvent {
+  return {
+    id: 'evt-1',
+    timestamp: new Date('2026-01-01T00:00:00Z'),
+    rule_id: 'test_rule',
+    rule_name: 'Test Rule',
+    severity: 'high',
+    type: 'secret',
+    action_taken: 'alert',
+    content_snippet: 'AKIA****',
+    full_content_hash: 'deadbeef',
+    context: {},
+    acknowledged: false,
+    ...overrides,
+  };
+}
+
+type Handler = (params: any) => Promise<any>;
+
+/**
+ * Minimal stand-in for McpServer that captures tool handlers so they can be
+ * invoked directly, without a transport.
+ */
+export class FakeMcpServer {
+  handlers = new Map<string, Handler>();
+
+  registerTool(name: string, _def: unknown, handler: Handler): void {
+    this.handlers.set(name, handler);
+  }
+
+  tool(name: string, ...rest: unknown[]): void {
+    this.handlers.set(name, rest[rest.length - 1] as Handler);
+  }
+
+  async call(name: string, params: Record<string, unknown>): Promise<any> {
+    const handler = this.handlers.get(name);
+    if (!handler) throw new Error(`Tool not registered: ${name}`);
+    return handler(params);
+  }
+}

package/tests/notifications/email.test.ts

@@ -0,0 +1,68 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { EmailNotifier } from '../../src/notifications/email.js';
+import type { EmailConfig } from '../../src/types.js';
+import { makeConfig, makeEvent } from '../helpers.js';
+
+const emailConfig: EmailConfig = {
+  smtp_host: 'smtp.example.test',
+  smtp_port: 587,
+  smtp_secure: true,
+  from_address: 'mund@example.test',
+  to_addresses: ['ops@example.test'],
+};
+
+const payload = () => ({
+  event: makeEvent(),
+  config: makeConfig(),
+  formatted_message: '[HIGH] Test Rule: AKIA****',
+});
+
+describe('EmailNotifier (stub)', () => {
+  let warnSpy: ReturnType<typeof vi.spyOn>;
+  let errorSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('warns at construction that email is not implemented', () => {
+    new EmailNotifier(emailConfig);
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+    expect(String(warnSpy.mock.calls[0][0])).toMatch(/NOT IMPLEMENTED/);
+  });
+
+  it('keeps the config and notifier name', () => {
+    const notifier = new EmailNotifier(emailConfig);
+    expect(notifier.name).toBe('EmailNotifier');
+    expect(notifier.config).toBe(emailConfig);
+  });
+
+  it('send() always returns false', async () => {
+    const notifier = new EmailNotifier(emailConfig);
+    await expect(notifier.send(payload())).resolves.toBe(false);
+    await expect(notifier.send(payload())).resolves.toBe(false);
+  });
+
+  it('logs the send() error only once per instance', async () => {
+    const notifier = new EmailNotifier(emailConfig);
+    await notifier.send(payload());
+    await notifier.send(payload());
+    await notifier.send(payload());
+    expect(errorSpy).toHaveBeenCalledTimes(1);
+    expect(String(errorSpy.mock.calls[0][0])).toMatch(/Alert dropped/);
+  });
+
+  it('tracks the one-time warning per instance, not globally', async () => {
+    const a = new EmailNotifier(emailConfig);
+    const b = new EmailNotifier(emailConfig);
+    await a.send(payload());
+    await a.send(payload());
+    await b.send(payload());
+    expect(errorSpy).toHaveBeenCalledTimes(2);
+  });
+});