@wenathlan/devthink 2.0.13 → 2.0.15

package/tests/pentest.test.ts

@@ -0,0 +1,75 @@
+import { describe, expect, it } from "vitest";
+import { execFile } from "node:child_process";
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { promisify } from "node:util";
+
+const execute = promisify(execFile);
+
+/* ── The 1.1.95 security hardening checklist coverage. ── */
+
+describe("the pentest checklist artifact", () => {
+  it("declares every automated entry of the release candidate checklist with its family and module", async () => {
+    const source = await readFile("tests/pentest.mjs", "utf8");
+    const declarations = [
+      ...source.matchAll(/await entry\(\{ id: (\d+), title: "([^"]+)", family: "([^"]+)", module: "([^"]+)" \}/g),
+    ].map((match) => ({ id: Number(match[1]), title: match[2], family: match[3], module: match[4] }));
+    expect(declarations).toHaveLength(21);
+    expect(declarations.map((entry) => entry.id)).toEqual(Array.from({ length: 21 }, (_, index) => index + 1));
+    const families = new Set(declarations.map((entry) => entry.family));
+    for (const family of [
+      "trust boundary",
+      "inbound guards",
+      "emergency stops",
+      "transport posture",
+      "secrets",
+      "audit integrity",
+      "untrusted rendering",
+      "minimization",
+      "phishguard",
+      "human gates",
+    ])
+      expect(families.has(family)).toBe(true);
+    for (const entry of declarations) expect((entry.title ?? "").length).toBeGreaterThan(10);
+  });
+
+  it("covers every checklist entry with a passing outcome once the gate has run", async () => {
+    const artifactpath = "tests/artifacts/pentest.json";
+    const built = existsSync("dist/extension/manifest.json");
+    const packagejson = JSON.parse(await readFile("package.json", "utf8")) as { version: string };
+    /* a built tree runs the gate itself when no fresh artifact of this release exists, so every lane that builds before the suite — the bun lane, the deno lane, a local two-pass validate — verifies the checklist artifact without depending on the gate having run before the tests */
+    if (built && !existsSync(artifactpath)) await execute("node", ["tests/pentest.mjs"]);
+    if (built && existsSync(artifactpath)) {
+      const stored = JSON.parse(await readFile(artifactpath, "utf8")) as { release: string };
+      if (stored.release !== packagejson.version) await execute("node", ["tests/pentest.mjs"]);
+    }
+    const stored = existsSync(artifactpath);
+    if (built) expect(stored).toBe(true);
+    if (!stored) return;
+    const report = JSON.parse(await readFile(artifactpath, "utf8")) as {
+      release: string;
+      entries: Array<{ id: number; title: string; outcome: string; detail: string }>;
+      summary: { total: number; passed: number; failed: number };
+    };
+    expect(report.release).toBe(packagejson.version);
+    expect(report.summary.total).toBe(21);
+    expect(report.summary.failed).toBe(0);
+    expect(report.summary.passed).toBe(21);
+    expect(report.entries.map((entry) => entry.id)).toEqual(Array.from({ length: 21 }, (_, index) => index + 1));
+    for (const entry of report.entries) {
+      expect(entry.outcome).toBe("pass");
+      expect(entry.detail.length).toBeGreaterThan(10);
+    }
+  });
+
+  it("exercises the real compiled modules the checklist names and stays deterministic", async () => {
+    const source = await readFile("tests/pentest.mjs", "utf8");
+    expect(source).toContain('import("../dist/index.js")');
+    expect(source).toContain('import("../dist/policy.js")');
+    expect(source).toContain('import("../dist/hardening.js")');
+    /* the artifact carries no timestamp so reruns stay byte identical */
+    expect(source).not.toContain("new Date()");
+    expect(source).toContain("1_800_000_000_000");
+    expect(source).toContain("process.exitCode = 1");
+  });
+});

package/tests/perfrecords.test.ts

@@ -0,0 +1,257 @@
+import { describe, expect, it } from "vitest";
+import {
+  abandonedparsetasks,
+  captureplanschedule,
+  dedupesnapshotrequests,
+  perfbundle,
+  perfrecordof,
+  perfsummary,
+  pruneperfrecords,
+  queuedepthsampleof,
+  queuedepthview,
+  snapshotrequestkey,
+  stepdurationchart,
+  workerbackpressure,
+} from "../perf.js";
+import { perfprovenancegate, workerbackpressuregate } from "../policy.js";
+import { perfreport } from "../protocol.js";
+import { sessionmemory } from "../memory.js";
+
+const now = 1_800_000_000_000;
+
+class fakeadapter {
+  private readonly data = new Map<string, unknown>();
+  async get<T>(key: string): Promise<T | undefined> {
+    return this.data.get(key) as T | undefined;
+  }
+  async set<T>(key: string, value: T): Promise<void> {
+    this.data.set(key, value);
+  }
+}
+
+describe("worker queue backpressure", () => {
+  it("defers parse tasks past the user configured depth and never refuses them", () => {
+    expect(workerbackpressure({ depth: 8, pending: 8, configured: 5 })).toEqual({
+      deferred: 3,
+      admitted: 5,
+      unbounded: false,
+    });
+    expect(workerbackpressure({ depth: 2, pending: 4, configured: 5 })).toEqual({
+      deferred: 0,
+      admitted: 4,
+      unbounded: false,
+    });
+    expect(workerbackpressure({ depth: 9, pending: 9 })).toEqual({ deferred: 0, admitted: 9, unbounded: true });
+    expect(workerbackpressuregate({ depth: 5, pending: 9 }).allowed).toBe(true);
+    expect(workerbackpressuregate({ depth: 5, pending: 9 }).reason).toMatch(/defers and never refuses/i);
+    expect(workerbackpressuregate({ pending: 9 }).reason).toMatch(/unbounded/i);
+    expect(workerbackpressuregate({ depth: 0, pending: 9 }).allowed).toBe(false);
+  });
+
+  it("records the queue depth over time for tuning", () => {
+    const sample = queuedepthsampleof({ depth: 4, deferred: 2, now });
+    expect(sample).toEqual({ at: now, depth: 4, deferred: 2 });
+    const view = queuedepthview([sample, queuedepthsampleof({ depth: 7, deferred: 0, now: now + 100 })]);
+    expect(view).toEqual({ peak: 7, deferred: 2, samples: 2 });
+  });
+
+  it("cancels the abandoned parse tasks of a halted run while the other runs keep theirs", () => {
+    const pending = [
+      { id: "a", runid: "run1", started: false },
+      { id: "b", runid: "run1", started: true },
+      { id: "c", runid: "run2", started: false },
+    ];
+    const halted = abandonedparsetasks({ halted: true, runid: "run1", pending });
+    expect(halted.cancelled).toEqual(["a"]);
+    expect(halted.kept.sort()).toEqual(["b", "c"]);
+    const running = abandonedparsetasks({ halted: false, runid: "run1", pending });
+    expect(running.cancelled).toEqual([]);
+    expect(running.kept).toHaveLength(3);
+  });
+});
+
+describe("perf recording per step", () => {
+  it("records one perf record per step with its provenance attached", () => {
+    const record = perfrecordof({
+      runid: "run1",
+      stepid: "s1",
+      duration: 120,
+      queries: 5,
+      cachehits: 3,
+      delta: true,
+      now,
+      provenance: { origin: "https://example.com", environment: "offscreenworker", task: "htmlsnapshot" },
+    });
+    expect(record.delta).toBe(true);
+    expect(perfprovenancegate(record).allowed).toBe(true);
+    expect(() =>
+      perfrecordof({ runid: " ", stepid: "s1", duration: 1, queries: 1, cachehits: 0, delta: false, now }),
+    ).toThrow(/run id/i);
+    expect(() =>
+      perfrecordof({ runid: "run1", stepid: " ", duration: 1, queries: 1, cachehits: 0, delta: false, now }),
+    ).toThrow(/step id/i);
+    expect(perfprovenancegate({ ...record, provenance: {} }).allowed).toBe(false);
+  });
+
+  it("sums the perf summary and charts the step durations over the run", () => {
+    const records = [
+      perfrecordof({
+        runid: "run1",
+        stepid: "s1",
+        duration: 100,
+        queries: 4,
+        cachehits: 2,
+        delta: false,
+        now: now + 100,
+        provenance: { origin: "https://example.com" },
+      }),
+      perfrecordof({
+        runid: "run1",
+        stepid: "s2",
+        duration: 300,
+        queries: 6,
+        cachehits: 3,
+        delta: true,
+        now: now + 50,
+        provenance: { environment: "offscreenworker" },
+      }),
+    ];
+    const summary = perfsummary(records);
+    expect(summary).toEqual({
+      steps: 2,
+      duration: 400,
+      average: 200,
+      queries: 10,
+      cachehits: 5,
+      hitratio: 0.5,
+      deltashare: 0.5,
+    });
+    expect(perfsummary([]).steps).toBe(0);
+    const chart = stepdurationchart(records);
+    expect(chart.map((point) => point.stepid)).toEqual(["s2", "s1"]);
+    expect(chart[0]?.delta).toBe(true);
+    const bundle = perfbundle({ runid: "run1", records });
+    expect(bundle.records).toHaveLength(2);
+    expect(bundle.summary.steps).toBe(2);
+  });
+
+  it("deduplicates identical snapshot requests within one run", () => {
+    const requests = [
+      { stepid: "s1", fingerprint: "f1" },
+      { stepid: "s1", fingerprint: "f1" },
+      { stepid: "s2", fingerprint: "f1" },
+      { stepid: "s2", fingerprint: "f2" },
+    ];
+    const deduped = dedupesnapshotrequests({ runid: "run1", requests });
+    expect(deduped.distinct).toHaveLength(3);
+    expect(deduped.duplicates).toBe(1);
+    expect(snapshotrequestkey({ runid: "run1", stepid: "s1", fingerprint: "f1" })).toBe("run1:s1:f1");
+  });
+
+  it("schedules the heavy capture work behind the user priority choice and never drops a capture", () => {
+    const speed = captureplanschedule({ priority: "speed", heavy: ["capturevisible", "captureelement"] });
+    expect(speed.beside).toHaveLength(0);
+    expect(speed.deferred).toEqual(["capturevisible", "captureelement"]);
+    expect(speed.note).toMatch(/still runs inside the reviewed plan/i);
+    const evidence = captureplanschedule({ priority: "evidence", heavy: ["capturevisible"] });
+    expect(evidence.beside).toEqual(["capturevisible"]);
+    expect(evidence.deferred).toHaveLength(0);
+    const unset = captureplanschedule({ heavy: ["capturevisible"] });
+    expect(unset.beside).toEqual(["capturevisible"]);
+  });
+
+  it("prunes the perf records past the user configured retention window and exports the bundle", async () => {
+    const store = new sessionmemory(new fakeadapter());
+    const fresh = perfrecordof({
+      runid: "run1",
+      stepid: "s1",
+      duration: 10,
+      queries: 1,
+      cachehits: 0,
+      delta: false,
+      now,
+      provenance: { origin: "https://example.com" },
+    });
+    const old = perfrecordof({
+      runid: "run1",
+      stepid: "s2",
+      duration: 20,
+      queries: 2,
+      cachehits: 1,
+      delta: false,
+      now: now - 10_000,
+      provenance: { environment: "pagecontext" },
+    });
+    await store.addperfrecord(fresh);
+    await store.addperfrecord(old);
+    await store.recordqueuedepth(queuedepthsampleof({ depth: 3, deferred: 1, now }));
+    expect(await store.getperfrecords()).toHaveLength(2);
+    const pruned = await store.pruneperfrecords(5000, now);
+    expect(pruned.pruned).toBe(1);
+    expect(pruned.kept).toHaveLength(1);
+    const unpruned = await store.pruneperfrecords(undefined, now);
+    expect(unpruned.pruned).toBe(0);
+    const bundle = await store.exportperfbundle("run1");
+    expect(bundle.records).toHaveLength(1);
+    expect(await store.getqueuedepths()).toHaveLength(1);
+  });
+
+  it("builds the perf report envelope for the dashboardpage", () => {
+    const report = perfreport({
+      runid: "run1",
+      summary: { steps: 2, duration: 400, average: 200, queries: 10, cachehits: 5, hitratio: 0.5, deltashare: 0.5 },
+      chart: [{ stepid: "s1", duration: 100, delta: false }],
+      selcache: { generation: 3, entries: 4 },
+      queue: { depth: 2, deferred: 1, peak: 6 },
+      chunk: { tableid: "table1", extracted: 10, total: 25, complete: false },
+    });
+    expect(report.runid).toBe("run1");
+    expect(report.chart[0]?.stepid).toBe("s1");
+    expect(report.chunk?.tableid).toBe("table1");
+    const minimal = perfreport({
+      runid: "run2",
+      summary: { steps: 0, duration: 0, average: 0, queries: 0, cachehits: 0, hitratio: 0, deltashare: 0 },
+      chart: [],
+      selcache: { generation: 0, entries: 0 },
+      queue: { depth: 0, deferred: 0, peak: 0 },
+    });
+    expect(minimal.chunk).toBeUndefined();
+    expect(() =>
+      perfreport({
+        runid: " ",
+        summary: { steps: 0, duration: 0, average: 0, queries: 0, cachehits: 0, hitratio: 0, deltashare: 0 },
+        chart: [],
+        selcache: { generation: 0, entries: 0 },
+        queue: { depth: 0, deferred: 0, peak: 0 },
+      }),
+    ).toThrow(/run id/i);
+  });
+
+  it("prunes the record list through the pure pruner beside the store", () => {
+    const records = [
+      perfrecordof({
+        runid: "run1",
+        stepid: "s1",
+        duration: 1,
+        queries: 1,
+        cachehits: 0,
+        delta: false,
+        now,
+        provenance: {},
+      }),
+      perfrecordof({
+        runid: "run1",
+        stepid: "s2",
+        duration: 1,
+        queries: 1,
+        cachehits: 0,
+        delta: false,
+        now: now - 100,
+        provenance: {},
+      }),
+    ];
+    const pruned = pruneperfrecords(records, 50, now);
+    expect(pruned.pruned).toBe(1);
+    expect(pruneperfrecords(records, undefined, now).kept).toHaveLength(2);
+  });
+});

package/tests/permdiff.test.ts

@@ -0,0 +1,85 @@
+import { describe, expect, it } from "vitest";
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { diffpermissionsets, permissionsetof, previousof } from "./permdiff.mjs";
+
+/* ── The 1.1.95 permission diff logic against fixture manifests. ── */
+
+const basemanifest = {
+  manifest_version: 3,
+  version: "1.0.0",
+  permissions: ["activeTab", "storage", "scripting", "sidePanel"],
+  optional_permissions: ["tabs", "downloads", "clipboardRead", "clipboardWrite", "offscreen", "nativeMessaging"],
+  optional_host_permissions: ["https://*/*"],
+};
+
+describe("the permdiff logic", () => {
+  it("reads the permission set of a manifest in its declared order with its set tags", () => {
+    const set = permissionsetof(basemanifest);
+    expect(set.required).toEqual([
+      "required:activeTab",
+      "required:storage",
+      "required:scripting",
+      "required:sidePanel",
+    ]);
+    expect(set.optional).toHaveLength(6);
+    expect(set.optionalhost).toEqual(["optionalhost:https://*/*"]);
+    expect(set.entries).toHaveLength(11);
+  });
+
+  it("reports a clean diff when the fixture manifests carry the same permission set", () => {
+    const diff = diffpermissionsets(permissionsetof(basemanifest), permissionsetof({ ...basemanifest }));
+    expect(diff.added).toEqual([]);
+    expect(diff.removed).toEqual([]);
+    expect(diff.reordered).toEqual([]);
+  });
+
+  it("reports every added permission a fixture manifest gains", () => {
+    const grown = { ...basemanifest, permissions: [...basemanifest.permissions, "debugger"] };
+    const diff = diffpermissionsets(permissionsetof(grown), permissionsetof(basemanifest));
+    expect(diff.added).toEqual(["required:debugger"]);
+    expect(diff.removed).toEqual([]);
+    expect(diff.reordered).toEqual([]);
+  });
+
+  it("reports every removed permission and every move between the required and the optional sets", () => {
+    const shrunk = { ...basemanifest, permissions: basemanifest.permissions.slice(0, 3) };
+    const diff = diffpermissionsets(permissionsetof(shrunk), permissionsetof(basemanifest));
+    expect(diff.added).toEqual([]);
+    expect(diff.removed).toEqual(["required:sidePanel"]);
+    const moved = {
+      ...basemanifest,
+      permissions: basemanifest.permissions.slice(0, 3),
+      optional_permissions: [...basemanifest.optional_permissions, "sidePanel"],
+    };
+    const moveddiff = diffpermissionsets(permissionsetof(moved), permissionsetof(basemanifest));
+    expect(moveddiff.added).toEqual(["optional:sidePanel"]);
+    expect(moveddiff.removed).toEqual(["required:sidePanel"]);
+    expect(moveddiff.reordered).toEqual([]);
+  });
+
+  it("reports a reordered set when the same permissions appear in a different order", () => {
+    const reordered = { ...basemanifest, permissions: [...basemanifest.permissions.slice(1), "activeTab"] };
+    const diff = diffpermissionsets(permissionsetof(reordered), permissionsetof(basemanifest));
+    expect(diff.added).toEqual([]);
+    expect(diff.removed).toEqual([]);
+    expect(diff.reordered).toEqual(["required"]);
+  });
+
+  it("resolves the previous release version of the package", async () => {
+    expect(previousof("1.1.95")).toBe("1.1.94");
+    expect(previousof("1.2.0")).toBe("1.1.0");
+    expect(previousof("2.0.0")).toBe("1.0.0");
+    const packagejson = JSON.parse(await readFile("package.json", "utf8")) as { version: string };
+    const manifest = JSON.parse(await readFile("web/manifest.json", "utf8")) as typeof basemanifest;
+    expect(
+      manifest.permissions.length + manifest.optional_permissions.length + manifest.optional_host_permissions.length,
+    ).toBe(permissionsetof(manifest).entries.length);
+    /* the permission set hash the gate records covers the sorted unique entries of the current manifest */
+    const entries = permissionsetof(manifest).entries;
+    const digest = createHash("sha256")
+      .update([...new Set(entries)].sort().join("\n"))
+      .digest("hex");
+    expect(digest).toMatch(/^[0-9a-f]{64}$/);
+  });
+});

package/tests/phishguard.test.ts

@@ -0,0 +1,128 @@
+import { describe, expect, it } from "vitest";
+import {
+  credentialstep,
+  lookalikedistance,
+  originlabels,
+  phishnotetext,
+  phishthresholdvalid,
+  phishverdictof,
+  verdictfresh,
+} from "../security.js";
+
+const now = 1_800_000_000_000;
+
+describe("phishguard", () => {
+  it("marks login and credential steps for the watch", () => {
+    expect(credentialstep({ kind: "consentpassword", target: "" })).toBe(true);
+    expect(credentialstep({ kind: "authflow", target: "" })).toBe(true);
+    expect(credentialstep({ kind: "fillcard", target: "" })).toBe(true);
+    expect(credentialstep({ kind: "click", target: "#submit" })).toBe(false);
+    expect(credentialstep({ kind: "type", target: "#password" })).toBe(true);
+    expect(
+      credentialstep({
+        kind: "fillform",
+        target: "#login",
+        value: "",
+        options: JSON.stringify({ fields: [{ name: "passphrase", value: "x" }] }),
+      }),
+    ).toBe(true);
+  });
+
+  it("splits origins into registrable ordered labels", () => {
+    expect(originlabels("https://pay.example.com")).toEqual(["com", "example", "pay"]);
+    expect(originlabels("https://example.com")).toEqual(["com", "example"]);
+    expect(originlabels("https://example.com/path/segment")).toEqual(["com", "example"]);
+  });
+
+  it("measures the lookalike distance between origins from zero to one", () => {
+    expect(lookalikedistance("https://example.com", "https://example.com")).toBe(0);
+    expect(lookalikedistance("https://pay.example.com", "https://pay.example.com")).toBe(0);
+    const lookalike = lookalikedistance("https://pay.example.com.attacker.example", "https://pay.example.com");
+    expect(lookalike).toBeGreaterThan(0);
+    expect(lookalike).toBeLessThan(1);
+    const far = lookalikedistance("https://example.com", "https://totally-different.example");
+    expect(far).toBeGreaterThan(lookalike);
+    expect(lookalikedistance("", "https://example.com")).toBe(1);
+  });
+
+  it("validates the threshold as a user choice between zero and one", () => {
+    expect(phishthresholdvalid(0.4).valid).toBe(true);
+    expect(phishthresholdvalid(0).valid).toBe(false);
+    expect(phishthresholdvalid(1).valid).toBe(false);
+    expect(phishthresholdvalid(1.5).valid).toBe(false);
+  });
+
+  it("blocks login origins whose distance crosses the user threshold and names the matched origin", () => {
+    const verdict = phishverdictof({
+      origin: "https://pay.example.com.attacker.example",
+      granted: ["https://pay.example.com", "https://other.example"],
+      threshold: 0.5,
+      now,
+    });
+    expect(verdict.blocked).toBe(true);
+    expect(verdict.matchedorigin).toBe("https://pay.example.com");
+    expect(verdict.reason).toMatch(/names https:\/\/pay\.example\.com/);
+    expect(verdict.distance).toBeLessThanOrEqual(0.5);
+  });
+
+  it("passes granted origins and distant origins under the threshold", () => {
+    const granted = phishverdictof({
+      origin: "https://pay.example.com",
+      granted: ["https://pay.example.com"],
+      threshold: 0.4,
+      now,
+    });
+    expect(granted.blocked).toBe(false);
+    expect(granted.distance).toBe(0);
+    const distant = phishverdictof({
+      origin: "https://unrelated.example",
+      granted: ["https://pay.example.com"],
+      threshold: 0.3,
+      now,
+    });
+    expect(distant.blocked).toBe(false);
+    expect(distant.matchedorigin).toBe("https://pay.example.com");
+    const lonely = phishverdictof({ origin: "https://first.example", granted: [], threshold: 0.4, now });
+    expect(lonely.blocked).toBe(false);
+    expect(lonely.matchedorigin).toBeUndefined();
+  });
+
+  it("blocks exactly at the threshold boundary", () => {
+    const origin = "https://pay.example.com.attacker.example";
+    const granted = ["https://pay.example.com"];
+    const distance = lookalikedistance(origin, granted[0] as string);
+    const at = phishverdictof({ origin, granted, threshold: distance, now });
+    expect(at.blocked).toBe(true);
+    const below = phishverdictof({ origin, granted, threshold: distance / 2, now });
+    expect(below.blocked).toBe(false);
+  });
+
+  it("expires verdicts past their freshness window", () => {
+    const verdict = phishverdictof({
+      origin: "https://pay.example.com",
+      granted: ["https://pay.example.com"],
+      threshold: 0.4,
+      now,
+    });
+    expect(verdictfresh(verdict, now, undefined)).toBe(true);
+    expect(verdictfresh(verdict, now + 1000, 5000)).toBe(true);
+    expect(verdictfresh(verdict, now + 6000, 5000)).toBe(false);
+  });
+
+  it("renders the phishguard notice the surfaces show before a login step", () => {
+    const blocked = phishverdictof({
+      origin: "https://pay.example.com.attacker.example",
+      granted: ["https://pay.example.com"],
+      threshold: 0.5,
+      now,
+    });
+    expect(phishnotetext(blocked)).toMatch(/blocks/);
+    const pass = phishverdictof({
+      origin: "https://pay.example.com",
+      granted: ["https://pay.example.com"],
+      threshold: 0.5,
+      now,
+    });
+    expect(phishnotetext(pass)).toMatch(/under the user threshold/);
+  });
+});