@wenathlan/devthink 2.0.14 → 2.0.19

package/tests/pentest.test.ts

@@ -1,75 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { execFile } from "node:child_process";
-import { existsSync } from "node:fs";
-import { readFile } from "node:fs/promises";
-import { promisify } from "node:util";
-
-const execute = promisify(execFile);
-
-/* ── The 1.1.95 security hardening checklist coverage. ── */
-
-describe("the pentest checklist artifact", () => {
-  it("declares every automated entry of the release candidate checklist with its family and module", async () => {
-    const source = await readFile("tests/pentest.mjs", "utf8");
-    const declarations = [
-      ...source.matchAll(/await entry\(\{ id: (\d+), title: "([^"]+)", family: "([^"]+)", module: "([^"]+)" \}/g),
-    ].map((match) => ({ id: Number(match[1]), title: match[2], family: match[3], module: match[4] }));
-    expect(declarations).toHaveLength(21);
-    expect(declarations.map((entry) => entry.id)).toEqual(Array.from({ length: 21 }, (_, index) => index + 1));
-    const families = new Set(declarations.map((entry) => entry.family));
-    for (const family of [
-      "trust boundary",
-      "inbound guards",
-      "emergency stops",
-      "transport posture",
-      "secrets",
-      "audit integrity",
-      "untrusted rendering",
-      "minimization",
-      "phishguard",
-      "human gates",
-    ])
-      expect(families.has(family)).toBe(true);
-    for (const entry of declarations) expect((entry.title ?? "").length).toBeGreaterThan(10);
-  });
-
-  it("covers every checklist entry with a passing outcome once the gate has run", async () => {
-    const artifactpath = "tests/artifacts/pentest.json";
-    const built = existsSync("dist/extension/manifest.json");
-    const packagejson = JSON.parse(await readFile("package.json", "utf8")) as { version: string };
-    /* a built tree runs the gate itself when no fresh artifact of this release exists, so every lane that builds before the suite — the bun lane, the deno lane, a local two-pass validate — verifies the checklist artifact without depending on the gate having run before the tests */
-    if (built && !existsSync(artifactpath)) await execute("node", ["tests/pentest.mjs"]);
-    if (built && existsSync(artifactpath)) {
-      const stored = JSON.parse(await readFile(artifactpath, "utf8")) as { release: string };
-      if (stored.release !== packagejson.version) await execute("node", ["tests/pentest.mjs"]);
-    }
-    const stored = existsSync(artifactpath);
-    if (built) expect(stored).toBe(true);
-    if (!stored) return;
-    const report = JSON.parse(await readFile(artifactpath, "utf8")) as {
-      release: string;
-      entries: Array<{ id: number; title: string; outcome: string; detail: string }>;
-      summary: { total: number; passed: number; failed: number };
-    };
-    expect(report.release).toBe(packagejson.version);
-    expect(report.summary.total).toBe(21);
-    expect(report.summary.failed).toBe(0);
-    expect(report.summary.passed).toBe(21);
-    expect(report.entries.map((entry) => entry.id)).toEqual(Array.from({ length: 21 }, (_, index) => index + 1));
-    for (const entry of report.entries) {
-      expect(entry.outcome).toBe("pass");
-      expect(entry.detail.length).toBeGreaterThan(10);
-    }
-  });
-
-  it("exercises the real compiled modules the checklist names and stays deterministic", async () => {
-    const source = await readFile("tests/pentest.mjs", "utf8");
-    expect(source).toContain('import("../dist/index.js")');
-    expect(source).toContain('import("../dist/policy.js")');
-    expect(source).toContain('import("../dist/hardening.js")');
-    /* the artifact carries no timestamp so reruns stay byte identical */
-    expect(source).not.toContain("new Date()");
-    expect(source).toContain("1_800_000_000_000");
-    expect(source).toContain("process.exitCode = 1");
-  });
-});

package/tests/perfrecords.test.ts

@@ -1,257 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  abandonedparsetasks,
-  captureplanschedule,
-  dedupesnapshotrequests,
-  perfbundle,
-  perfrecordof,
-  perfsummary,
-  pruneperfrecords,
-  queuedepthsampleof,
-  queuedepthview,
-  snapshotrequestkey,
-  stepdurationchart,
-  workerbackpressure,
-} from "../perf.js";
-import { perfprovenancegate, workerbackpressuregate } from "../policy.js";
-import { perfreport } from "../protocol.js";
-import { sessionmemory } from "../memory.js";
-
-const now = 1_800_000_000_000;
-
-class fakeadapter {
-  private readonly data = new Map<string, unknown>();
-  async get<T>(key: string): Promise<T | undefined> {
-    return this.data.get(key) as T | undefined;
-  }
-  async set<T>(key: string, value: T): Promise<void> {
-    this.data.set(key, value);
-  }
-}
-
-describe("worker queue backpressure", () => {
-  it("defers parse tasks past the user configured depth and never refuses them", () => {
-    expect(workerbackpressure({ depth: 8, pending: 8, configured: 5 })).toEqual({
-      deferred: 3,
-      admitted: 5,
-      unbounded: false,
-    });
-    expect(workerbackpressure({ depth: 2, pending: 4, configured: 5 })).toEqual({
-      deferred: 0,
-      admitted: 4,
-      unbounded: false,
-    });
-    expect(workerbackpressure({ depth: 9, pending: 9 })).toEqual({ deferred: 0, admitted: 9, unbounded: true });
-    expect(workerbackpressuregate({ depth: 5, pending: 9 }).allowed).toBe(true);
-    expect(workerbackpressuregate({ depth: 5, pending: 9 }).reason).toMatch(/defers and never refuses/i);
-    expect(workerbackpressuregate({ pending: 9 }).reason).toMatch(/unbounded/i);
-    expect(workerbackpressuregate({ depth: 0, pending: 9 }).allowed).toBe(false);
-  });
-
-  it("records the queue depth over time for tuning", () => {
-    const sample = queuedepthsampleof({ depth: 4, deferred: 2, now });
-    expect(sample).toEqual({ at: now, depth: 4, deferred: 2 });
-    const view = queuedepthview([sample, queuedepthsampleof({ depth: 7, deferred: 0, now: now + 100 })]);
-    expect(view).toEqual({ peak: 7, deferred: 2, samples: 2 });
-  });
-
-  it("cancels the abandoned parse tasks of a halted run while the other runs keep theirs", () => {
-    const pending = [
-      { id: "a", runid: "run1", started: false },
-      { id: "b", runid: "run1", started: true },
-      { id: "c", runid: "run2", started: false },
-    ];
-    const halted = abandonedparsetasks({ halted: true, runid: "run1", pending });
-    expect(halted.cancelled).toEqual(["a"]);
-    expect(halted.kept.sort()).toEqual(["b", "c"]);
-    const running = abandonedparsetasks({ halted: false, runid: "run1", pending });
-    expect(running.cancelled).toEqual([]);
-    expect(running.kept).toHaveLength(3);
-  });
-});
-
-describe("perf recording per step", () => {
-  it("records one perf record per step with its provenance attached", () => {
-    const record = perfrecordof({
-      runid: "run1",
-      stepid: "s1",
-      duration: 120,
-      queries: 5,
-      cachehits: 3,
-      delta: true,
-      now,
-      provenance: { origin: "https://example.com", environment: "offscreenworker", task: "htmlsnapshot" },
-    });
-    expect(record.delta).toBe(true);
-    expect(perfprovenancegate(record).allowed).toBe(true);
-    expect(() =>
-      perfrecordof({ runid: " ", stepid: "s1", duration: 1, queries: 1, cachehits: 0, delta: false, now }),
-    ).toThrow(/run id/i);
-    expect(() =>
-      perfrecordof({ runid: "run1", stepid: " ", duration: 1, queries: 1, cachehits: 0, delta: false, now }),
-    ).toThrow(/step id/i);
-    expect(perfprovenancegate({ ...record, provenance: {} }).allowed).toBe(false);
-  });
-
-  it("sums the perf summary and charts the step durations over the run", () => {
-    const records = [
-      perfrecordof({
-        runid: "run1",
-        stepid: "s1",
-        duration: 100,
-        queries: 4,
-        cachehits: 2,
-        delta: false,
-        now: now + 100,
-        provenance: { origin: "https://example.com" },
-      }),
-      perfrecordof({
-        runid: "run1",
-        stepid: "s2",
-        duration: 300,
-        queries: 6,
-        cachehits: 3,
-        delta: true,
-        now: now + 50,
-        provenance: { environment: "offscreenworker" },
-      }),
-    ];
-    const summary = perfsummary(records);
-    expect(summary).toEqual({
-      steps: 2,
-      duration: 400,
-      average: 200,
-      queries: 10,
-      cachehits: 5,
-      hitratio: 0.5,
-      deltashare: 0.5,
-    });
-    expect(perfsummary([]).steps).toBe(0);
-    const chart = stepdurationchart(records);
-    expect(chart.map((point) => point.stepid)).toEqual(["s2", "s1"]);
-    expect(chart[0]?.delta).toBe(true);
-    const bundle = perfbundle({ runid: "run1", records });
-    expect(bundle.records).toHaveLength(2);
-    expect(bundle.summary.steps).toBe(2);
-  });
-
-  it("deduplicates identical snapshot requests within one run", () => {
-    const requests = [
-      { stepid: "s1", fingerprint: "f1" },
-      { stepid: "s1", fingerprint: "f1" },
-      { stepid: "s2", fingerprint: "f1" },
-      { stepid: "s2", fingerprint: "f2" },
-    ];
-    const deduped = dedupesnapshotrequests({ runid: "run1", requests });
-    expect(deduped.distinct).toHaveLength(3);
-    expect(deduped.duplicates).toBe(1);
-    expect(snapshotrequestkey({ runid: "run1", stepid: "s1", fingerprint: "f1" })).toBe("run1:s1:f1");
-  });
-
-  it("schedules the heavy capture work behind the user priority choice and never drops a capture", () => {
-    const speed = captureplanschedule({ priority: "speed", heavy: ["capturevisible", "captureelement"] });
-    expect(speed.beside).toHaveLength(0);
-    expect(speed.deferred).toEqual(["capturevisible", "captureelement"]);
-    expect(speed.note).toMatch(/still runs inside the reviewed plan/i);
-    const evidence = captureplanschedule({ priority: "evidence", heavy: ["capturevisible"] });
-    expect(evidence.beside).toEqual(["capturevisible"]);
-    expect(evidence.deferred).toHaveLength(0);
-    const unset = captureplanschedule({ heavy: ["capturevisible"] });
-    expect(unset.beside).toEqual(["capturevisible"]);
-  });
-
-  it("prunes the perf records past the user configured retention window and exports the bundle", async () => {
-    const store = new sessionmemory(new fakeadapter());
-    const fresh = perfrecordof({
-      runid: "run1",
-      stepid: "s1",
-      duration: 10,
-      queries: 1,
-      cachehits: 0,
-      delta: false,
-      now,
-      provenance: { origin: "https://example.com" },
-    });
-    const old = perfrecordof({
-      runid: "run1",
-      stepid: "s2",
-      duration: 20,
-      queries: 2,
-      cachehits: 1,
-      delta: false,
-      now: now - 10_000,
-      provenance: { environment: "pagecontext" },
-    });
-    await store.addperfrecord(fresh);
-    await store.addperfrecord(old);
-    await store.recordqueuedepth(queuedepthsampleof({ depth: 3, deferred: 1, now }));
-    expect(await store.getperfrecords()).toHaveLength(2);
-    const pruned = await store.pruneperfrecords(5000, now);
-    expect(pruned.pruned).toBe(1);
-    expect(pruned.kept).toHaveLength(1);
-    const unpruned = await store.pruneperfrecords(undefined, now);
-    expect(unpruned.pruned).toBe(0);
-    const bundle = await store.exportperfbundle("run1");
-    expect(bundle.records).toHaveLength(1);
-    expect(await store.getqueuedepths()).toHaveLength(1);
-  });
-
-  it("builds the perf report envelope for the dashboardpage", () => {
-    const report = perfreport({
-      runid: "run1",
-      summary: { steps: 2, duration: 400, average: 200, queries: 10, cachehits: 5, hitratio: 0.5, deltashare: 0.5 },
-      chart: [{ stepid: "s1", duration: 100, delta: false }],
-      selcache: { generation: 3, entries: 4 },
-      queue: { depth: 2, deferred: 1, peak: 6 },
-      chunk: { tableid: "table1", extracted: 10, total: 25, complete: false },
-    });
-    expect(report.runid).toBe("run1");
-    expect(report.chart[0]?.stepid).toBe("s1");
-    expect(report.chunk?.tableid).toBe("table1");
-    const minimal = perfreport({
-      runid: "run2",
-      summary: { steps: 0, duration: 0, average: 0, queries: 0, cachehits: 0, hitratio: 0, deltashare: 0 },
-      chart: [],
-      selcache: { generation: 0, entries: 0 },
-      queue: { depth: 0, deferred: 0, peak: 0 },
-    });
-    expect(minimal.chunk).toBeUndefined();
-    expect(() =>
-      perfreport({
-        runid: " ",
-        summary: { steps: 0, duration: 0, average: 0, queries: 0, cachehits: 0, hitratio: 0, deltashare: 0 },
-        chart: [],
-        selcache: { generation: 0, entries: 0 },
-        queue: { depth: 0, deferred: 0, peak: 0 },
-      }),
-    ).toThrow(/run id/i);
-  });
-
-  it("prunes the record list through the pure pruner beside the store", () => {
-    const records = [
-      perfrecordof({
-        runid: "run1",
-        stepid: "s1",
-        duration: 1,
-        queries: 1,
-        cachehits: 0,
-        delta: false,
-        now,
-        provenance: {},
-      }),
-      perfrecordof({
-        runid: "run1",
-        stepid: "s2",
-        duration: 1,
-        queries: 1,
-        cachehits: 0,
-        delta: false,
-        now: now - 100,
-        provenance: {},
-      }),
-    ];
-    const pruned = pruneperfrecords(records, 50, now);
-    expect(pruned.pruned).toBe(1);
-    expect(pruneperfrecords(records, undefined, now).kept).toHaveLength(2);
-  });
-});

package/tests/permdiff.test.ts

@@ -1,85 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { createHash } from "node:crypto";
-import { readFile } from "node:fs/promises";
-import { diffpermissionsets, permissionsetof, previousof } from "./permdiff.mjs";
-
-/* ── The 1.1.95 permission diff logic against fixture manifests. ── */
-
-const basemanifest = {
-  manifest_version: 3,
-  version: "1.0.0",
-  permissions: ["activeTab", "storage", "scripting", "sidePanel"],
-  optional_permissions: ["tabs", "downloads", "clipboardRead", "clipboardWrite", "offscreen", "nativeMessaging"],
-  optional_host_permissions: ["https://*/*"],
-};
-
-describe("the permdiff logic", () => {
-  it("reads the permission set of a manifest in its declared order with its set tags", () => {
-    const set = permissionsetof(basemanifest);
-    expect(set.required).toEqual([
-      "required:activeTab",
-      "required:storage",
-      "required:scripting",
-      "required:sidePanel",
-    ]);
-    expect(set.optional).toHaveLength(6);
-    expect(set.optionalhost).toEqual(["optionalhost:https://*/*"]);
-    expect(set.entries).toHaveLength(11);
-  });
-
-  it("reports a clean diff when the fixture manifests carry the same permission set", () => {
-    const diff = diffpermissionsets(permissionsetof(basemanifest), permissionsetof({ ...basemanifest }));
-    expect(diff.added).toEqual([]);
-    expect(diff.removed).toEqual([]);
-    expect(diff.reordered).toEqual([]);
-  });
-
-  it("reports every added permission a fixture manifest gains", () => {
-    const grown = { ...basemanifest, permissions: [...basemanifest.permissions, "debugger"] };
-    const diff = diffpermissionsets(permissionsetof(grown), permissionsetof(basemanifest));
-    expect(diff.added).toEqual(["required:debugger"]);
-    expect(diff.removed).toEqual([]);
-    expect(diff.reordered).toEqual([]);
-  });
-
-  it("reports every removed permission and every move between the required and the optional sets", () => {
-    const shrunk = { ...basemanifest, permissions: basemanifest.permissions.slice(0, 3) };
-    const diff = diffpermissionsets(permissionsetof(shrunk), permissionsetof(basemanifest));
-    expect(diff.added).toEqual([]);
-    expect(diff.removed).toEqual(["required:sidePanel"]);
-    const moved = {
-      ...basemanifest,
-      permissions: basemanifest.permissions.slice(0, 3),
-      optional_permissions: [...basemanifest.optional_permissions, "sidePanel"],
-    };
-    const moveddiff = diffpermissionsets(permissionsetof(moved), permissionsetof(basemanifest));
-    expect(moveddiff.added).toEqual(["optional:sidePanel"]);
-    expect(moveddiff.removed).toEqual(["required:sidePanel"]);
-    expect(moveddiff.reordered).toEqual([]);
-  });
-
-  it("reports a reordered set when the same permissions appear in a different order", () => {
-    const reordered = { ...basemanifest, permissions: [...basemanifest.permissions.slice(1), "activeTab"] };
-    const diff = diffpermissionsets(permissionsetof(reordered), permissionsetof(basemanifest));
-    expect(diff.added).toEqual([]);
-    expect(diff.removed).toEqual([]);
-    expect(diff.reordered).toEqual(["required"]);
-  });
-
-  it("resolves the previous release version of the package", async () => {
-    expect(previousof("1.1.95")).toBe("1.1.94");
-    expect(previousof("1.2.0")).toBe("1.1.0");
-    expect(previousof("2.0.0")).toBe("1.0.0");
-    const packagejson = JSON.parse(await readFile("package.json", "utf8")) as { version: string };
-    const manifest = JSON.parse(await readFile("web/manifest.json", "utf8")) as typeof basemanifest;
-    expect(
-      manifest.permissions.length + manifest.optional_permissions.length + manifest.optional_host_permissions.length,
-    ).toBe(permissionsetof(manifest).entries.length);
-    /* the permission set hash the gate records covers the sorted unique entries of the current manifest */
-    const entries = permissionsetof(manifest).entries;
-    const digest = createHash("sha256")
-      .update([...new Set(entries)].sort().join("\n"))
-      .digest("hex");
-    expect(digest).toMatch(/^[0-9a-f]{64}$/);
-  });
-});

package/tests/phishguard.test.ts

@@ -1,128 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  credentialstep,
-  lookalikedistance,
-  originlabels,
-  phishnotetext,
-  phishthresholdvalid,
-  phishverdictof,
-  verdictfresh,
-} from "../security.js";
-
-const now = 1_800_000_000_000;
-
-describe("phishguard", () => {
-  it("marks login and credential steps for the watch", () => {
-    expect(credentialstep({ kind: "consentpassword", target: "" })).toBe(true);
-    expect(credentialstep({ kind: "authflow", target: "" })).toBe(true);
-    expect(credentialstep({ kind: "fillcard", target: "" })).toBe(true);
-    expect(credentialstep({ kind: "click", target: "#submit" })).toBe(false);
-    expect(credentialstep({ kind: "type", target: "#password" })).toBe(true);
-    expect(
-      credentialstep({
-        kind: "fillform",
-        target: "#login",
-        value: "",
-        options: JSON.stringify({ fields: [{ name: "passphrase", value: "x" }] }),
-      }),
-    ).toBe(true);
-  });
-
-  it("splits origins into registrable ordered labels", () => {
-    expect(originlabels("https://pay.example.com")).toEqual(["com", "example", "pay"]);
-    expect(originlabels("https://example.com")).toEqual(["com", "example"]);
-    expect(originlabels("https://example.com/path/segment")).toEqual(["com", "example"]);
-  });
-
-  it("measures the lookalike distance between origins from zero to one", () => {
-    expect(lookalikedistance("https://example.com", "https://example.com")).toBe(0);
-    expect(lookalikedistance("https://pay.example.com", "https://pay.example.com")).toBe(0);
-    const lookalike = lookalikedistance("https://pay.example.com.attacker.example", "https://pay.example.com");
-    expect(lookalike).toBeGreaterThan(0);
-    expect(lookalike).toBeLessThan(1);
-    const far = lookalikedistance("https://example.com", "https://totally-different.example");
-    expect(far).toBeGreaterThan(lookalike);
-    expect(lookalikedistance("", "https://example.com")).toBe(1);
-  });
-
-  it("validates the threshold as a user choice between zero and one", () => {
-    expect(phishthresholdvalid(0.4).valid).toBe(true);
-    expect(phishthresholdvalid(0).valid).toBe(false);
-    expect(phishthresholdvalid(1).valid).toBe(false);
-    expect(phishthresholdvalid(1.5).valid).toBe(false);
-  });
-
-  it("blocks login origins whose distance crosses the user threshold and names the matched origin", () => {
-    const verdict = phishverdictof({
-      origin: "https://pay.example.com.attacker.example",
-      granted: ["https://pay.example.com", "https://other.example"],
-      threshold: 0.5,
-      now,
-    });
-    expect(verdict.blocked).toBe(true);
-    expect(verdict.matchedorigin).toBe("https://pay.example.com");
-    expect(verdict.reason).toMatch(/names https:\/\/pay\.example\.com/);
-    expect(verdict.distance).toBeLessThanOrEqual(0.5);
-  });
-
-  it("passes granted origins and distant origins under the threshold", () => {
-    const granted = phishverdictof({
-      origin: "https://pay.example.com",
-      granted: ["https://pay.example.com"],
-      threshold: 0.4,
-      now,
-    });
-    expect(granted.blocked).toBe(false);
-    expect(granted.distance).toBe(0);
-    const distant = phishverdictof({
-      origin: "https://unrelated.example",
-      granted: ["https://pay.example.com"],
-      threshold: 0.3,
-      now,
-    });
-    expect(distant.blocked).toBe(false);
-    expect(distant.matchedorigin).toBe("https://pay.example.com");
-    const lonely = phishverdictof({ origin: "https://first.example", granted: [], threshold: 0.4, now });
-    expect(lonely.blocked).toBe(false);
-    expect(lonely.matchedorigin).toBeUndefined();
-  });
-
-  it("blocks exactly at the threshold boundary", () => {
-    const origin = "https://pay.example.com.attacker.example";
-    const granted = ["https://pay.example.com"];
-    const distance = lookalikedistance(origin, granted[0] as string);
-    const at = phishverdictof({ origin, granted, threshold: distance, now });
-    expect(at.blocked).toBe(true);
-    const below = phishverdictof({ origin, granted, threshold: distance / 2, now });
-    expect(below.blocked).toBe(false);
-  });
-
-  it("expires verdicts past their freshness window", () => {
-    const verdict = phishverdictof({
-      origin: "https://pay.example.com",
-      granted: ["https://pay.example.com"],
-      threshold: 0.4,
-      now,
-    });
-    expect(verdictfresh(verdict, now, undefined)).toBe(true);
-    expect(verdictfresh(verdict, now + 1000, 5000)).toBe(true);
-    expect(verdictfresh(verdict, now + 6000, 5000)).toBe(false);
-  });
-
-  it("renders the phishguard notice the surfaces show before a login step", () => {
-    const blocked = phishverdictof({
-      origin: "https://pay.example.com.attacker.example",
-      granted: ["https://pay.example.com"],
-      threshold: 0.5,
-      now,
-    });
-    expect(phishnotetext(blocked)).toMatch(/blocks/);
-    const pass = phishverdictof({
-      origin: "https://pay.example.com",
-      granted: ["https://pay.example.com"],
-      threshold: 0.5,
-      now,
-    });
-    expect(phishnotetext(pass)).toMatch(/under the user threshold/);
-  });
-});