@wenrwa/marketplace-cli 0.8.7 → 0.8.9

package/dist/__tests__/bridge-preview-forwarder.test.js

@@ -0,0 +1,465 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * tp-06 — previewForwarder.ts: the Team preview's tenant boundary on the
+ * owner's hosted machine (docs/prd/team-preview.md module 4, ADR-0014).
+ *
+ * Runs against the REAL `net` module with real upstream servers on
+ * 127.0.0.1. The two-source-address cases use two REAL source addresses:
+ * the forwarder listens dual-stack on `::`, the allowed peer dials `::1`
+ * and the "other tenant" dials 127.0.0.1 (which arrives as
+ * `::ffff:127.0.0.1`). The 6PN-address cases inject `remoteAddressOf`,
+ * because every real test connection necessarily comes from loopback.
+ */
+const net = __importStar(require("net"));
+const http = __importStar(require("http"));
+const ws_1 = require("ws");
+const previewForwarder_1 = require("../bridge/previewForwarder");
+const GATEWAY_6PN = 'fdaa:0:1234:a7b:ce1:2:8a2e:2';
+const OTHER_TENANT_6PN = 'fdaa:0:9999:a7b:ce1:7:1:1';
+/** A real TCP "preview app" on 127.0.0.1 that greets and records bytes. */
+function startUpstream() {
+    return new Promise((resolve) => {
+        const received = [];
+        let connections = 0;
+        const sockets = new Set();
+        const server = net.createServer((socket) => {
+            connections++;
+            sockets.add(socket);
+            socket.on('close', () => sockets.delete(socket));
+            socket.on('error', () => { });
+            socket.write('hello from preview\n');
+            socket.on('data', (d) => received.push(d));
+        });
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            resolve({
+                port: addr.port,
+                received,
+                connections: () => connections,
+                close: () => new Promise((r) => {
+                    for (const s of sockets)
+                        s.destroy();
+                    server.close(() => r());
+                }),
+            });
+        });
+    });
+}
+function connect(host, port) {
+    return new Promise((resolve, reject) => {
+        const client = net.createConnection({ host, port });
+        client.once('connect', () => resolve(client));
+        client.once('error', reject);
+    });
+}
+function readAll(socket, timeoutMs = 400) {
+    return new Promise((resolve) => {
+        const chunks = [];
+        let done = false;
+        const finish = () => {
+            if (done)
+                return;
+            done = true;
+            resolve(Buffer.concat(chunks).toString());
+        };
+        socket.on('data', (d) => chunks.push(d));
+        socket.on('close', finish);
+        socket.on('error', finish);
+        setTimeout(finish, timeoutMs);
+    });
+}
+const tick = (ms = 50) => new Promise((r) => setTimeout(r, ms));
+describe('canonicalAddress (tp-06)', () => {
+    it('treats compressed and expanded IPv6 spellings as the same address', () => {
+        expect((0, previewForwarder_1.canonicalAddress)('fdaa:0:1234::2')).toBe((0, previewForwarder_1.canonicalAddress)('FDAA:0000:1234:0:0:0:0:0002'));
+        expect((0, previewForwarder_1.canonicalAddress)('::1')).toBe('0000:0000:0000:0000:0000:0000:0000:0001');
+    });
+    it('unwraps an IPv4-mapped peer and drops a zone id', () => {
+        expect((0, previewForwarder_1.canonicalAddress)('::ffff:127.0.0.1')).toBe('127.0.0.1');
+        expect((0, previewForwarder_1.canonicalAddress)('fe80::1%eth0')).toBe((0, previewForwarder_1.canonicalAddress)('fe80::1'));
+    });
+    it('returns null for anything that is not an IP', () => {
+        expect((0, previewForwarder_1.canonicalAddress)('preview-gateway.internal')).toBeNull();
+        expect((0, previewForwarder_1.canonicalAddress)('')).toBeNull();
+        expect((0, previewForwarder_1.canonicalAddress)(undefined)).toBeNull();
+    });
+});
+describe('resolvePreviewPorts (tp-06)', () => {
+    it('defaults to the fixed preview port and a distinct forwarder port', () => {
+        expect((0, previewForwarder_1.resolvePreviewPorts)({})).toEqual({
+            previewPort: previewForwarder_1.PREVIEW_PORT_DEFAULT,
+            forwarderPort: previewForwarder_1.PREVIEW_FORWARDER_PORT_DEFAULT,
+        });
+        expect(previewForwarder_1.PREVIEW_PORT_DEFAULT).not.toBe(previewForwarder_1.PREVIEW_FORWARDER_PORT_DEFAULT);
+    });
+    it('honours env overrides and ignores garbage', () => {
+        expect((0, previewForwarder_1.resolvePreviewPorts)({ HT_PREVIEW_PORT: '5100', HT_PREVIEW_FORWARDER_PORT: '5101' })).toEqual({
+            previewPort: 5100,
+            forwarderPort: 5101,
+        });
+        expect((0, previewForwarder_1.resolvePreviewPorts)({ HT_PREVIEW_PORT: 'nope', HT_PREVIEW_FORWARDER_PORT: '70000' })).toEqual({
+            previewPort: previewForwarder_1.PREVIEW_PORT_DEFAULT,
+            forwarderPort: previewForwarder_1.PREVIEW_FORWARDER_PORT_DEFAULT,
+        });
+    });
+    it('never lets the forwarder share the preview port', () => {
+        expect((0, previewForwarder_1.resolvePreviewPorts)({ HT_PREVIEW_PORT: '5100', HT_PREVIEW_FORWARDER_PORT: '5100' })).toEqual({
+            previewPort: 5100,
+            forwarderPort: previewForwarder_1.PREVIEW_FORWARDER_PORT_DEFAULT,
+        });
+    });
+});
+describe('createPreviewForwarder — two real source addresses (tp-06)', () => {
+    let preview;
+    let forwarder;
+    beforeEach(async () => {
+        preview = await startUpstream();
+        forwarder = (0, previewForwarder_1.createPreviewForwarder)({
+            listenHost: '::', // dual-stack, so the same listener sees ::1 and ::ffff:127.0.0.1
+            listenPort: 0,
+            targetPort: preview.port,
+            allowed: ['::1'],
+        });
+        await forwarder.start();
+    });
+    afterEach(async () => {
+        forwarder.stop();
+        await preview.close();
+    });
+    it('a connection from the allowed address reaches the preview port', async () => {
+        const client = await connect('::1', forwarder.port());
+        client.write('ping');
+        const reply = await readAll(client);
+        client.destroy();
+        await tick();
+        expect(reply).toContain('hello from preview');
+        expect(Buffer.concat(preview.received).toString()).toBe('ping');
+    });
+    it('a connection from any other address is closed without forwarding', async () => {
+        const client = await connect('127.0.0.1', forwarder.port());
+        client.write('should never arrive');
+        const reply = await readAll(client);
+        await tick();
+        expect(reply).toBe('');
+        expect(preview.connections()).toBe(0);
+        expect(preview.received).toHaveLength(0);
+    });
+});
+describe('createPreviewForwarder — another tenant on 6PN (tp-06)', () => {
+    it('refuses another tenant address and never dials the preview', async () => {
+        const preview = await startUpstream();
+        let peer = OTHER_TENANT_6PN;
+        const forwarder = (0, previewForwarder_1.createPreviewForwarder)({
+            listenHost: '::1',
+            listenPort: 0,
+            targetPort: preview.port,
+            allowed: [GATEWAY_6PN],
+            remoteAddressOf: () => peer,
+        });
+        try {
+            await forwarder.start();
+            const denied = await connect('::1', forwarder.port());
+            denied.write('GET /.env HTTP/1.1\r\nHost: x\r\n\r\n');
+            expect(await readAll(denied)).toBe('');
+            await tick();
+            expect(preview.connections()).toBe(0);
+            // Same listener, the gateway's own address (spelled differently) is let through.
+            peer = 'FDAA:0:1234:A7B:CE1:2:8A2E:2';
+            const allowed = await connect('::1', forwarder.port());
+            expect(await readAll(allowed)).toContain('hello from preview');
+            allowed.destroy();
+            expect(preview.connections()).toBe(1);
+        }
+        finally {
+            forwarder.stop();
+            await preview.close();
+        }
+    });
+});
+describe('createPreviewForwarder — one port only (tp-06)', () => {
+    it('opens exactly one listener and forwards only to 127.0.0.1:<preview port>', async () => {
+        const preview = await startUpstream();
+        const secret = await startUpstream(); // e.g. the owner's own dev server, or the bridge
+        const created = [];
+        const dialled = [];
+        const spyNet = {
+            createServer: ((...args) => {
+                created.push(1);
+                return net.createServer(...args);
+            }),
+            createConnection: ((opts) => {
+                dialled.push(opts);
+                return net.createConnection(opts);
+            }),
+        };
+        const forwarder = (0, previewForwarder_1.createPreviewForwarder)({
+            listenHost: '::1',
+            listenPort: 0,
+            targetPort: preview.port,
+            allowed: [GATEWAY_6PN],
+            remoteAddressOf: () => GATEWAY_6PN,
+            net: spyNet,
+        });
+        try {
+            await forwarder.start();
+            for (let i = 0; i < 3; i++) {
+                const c = await connect('::1', forwarder.port());
+                c.write(`try ${secret.port}`);
+                await readAll(c, 150);
+                c.destroy();
+            }
+            await tick();
+            expect(created).toHaveLength(1);
+            expect(dialled).toEqual([
+                { host: '127.0.0.1', port: preview.port },
+                { host: '127.0.0.1', port: preview.port },
+                { host: '127.0.0.1', port: preview.port },
+            ]);
+            expect(secret.connections()).toBe(0);
+            // Nothing listens on the listen host at any other port.
+            const outcome = await connect('::1', secret.port).then((s) => {
+                s.destroy();
+                return 'connected';
+            }, () => 'refused');
+            expect(outcome).toBe('refused');
+        }
+        finally {
+            forwarder.stop();
+            await preview.close();
+            await secret.close();
+        }
+    });
+});
+describe('createPreviewForwarder — WebSocket upgrade (tp-06)', () => {
+    it('passes a WebSocket upgrade through end to end', async () => {
+        const server = http.createServer((_req, res) => res.end('ok'));
+        const wss = new ws_1.WebSocketServer({ server });
+        wss.on('connection', (ws) => ws.on('message', (m) => ws.send(`echo:${m.toString()}`)));
+        await new Promise((r) => server.listen(0, '127.0.0.1', () => r()));
+        const previewPort = server.address().port;
+        const forwarder = (0, previewForwarder_1.createPreviewForwarder)({
+            listenHost: '::1',
+            listenPort: 0,
+            targetPort: previewPort,
+            allowed: [GATEWAY_6PN],
+            remoteAddressOf: () => GATEWAY_6PN,
+        });
+        try {
+            await forwarder.start();
+            const ws = new ws_1.WebSocket(`ws://[::1]:${forwarder.port()}/_next/webpack-hmr`);
+            const reply = await new Promise((resolve, reject) => {
+                ws.on('open', () => ws.send('hi'));
+                ws.on('message', (m) => resolve(m.toString()));
+                ws.on('error', reject);
+            });
+            ws.close();
+            expect(reply).toBe('echo:hi');
+        }
+        finally {
+            forwarder.stop();
+            for (const c of wss.clients)
+                c.terminate();
+            wss.close();
+            await new Promise((r) => server.close(() => r()));
+        }
+    });
+});
+describe('createPreviewForwarder — gateway name resolved and pinned (tp-06)', () => {
+    it('resolves a .internal name once at start and admits only its addresses', async () => {
+        const preview = await startUpstream();
+        const lookups = [];
+        let peer = GATEWAY_6PN;
+        const forwarder = (0, previewForwarder_1.createPreviewForwarder)({
+            listenHost: '::1',
+            listenPort: 0,
+            targetPort: preview.port,
+            allowed: ['hiveop-preview-gateway.internal'],
+            lookup: async (name) => {
+                lookups.push(name);
+                return ['fdaa:0:1234:a7b:ce1:2:8a2e:2'];
+            },
+            refreshMs: 60_000,
+            setIntervalFn: () => 1,
+            clearIntervalFn: () => { },
+            remoteAddressOf: () => peer,
+        });
+        try {
+            await forwarder.start();
+            expect(forwarder.allowedAddresses()).toEqual([(0, previewForwarder_1.canonicalAddress)(GATEWAY_6PN)]);
+            const a = await connect('::1', forwarder.port());
+            expect(await readAll(a)).toContain('hello from preview');
+            a.destroy();
+            peer = OTHER_TENANT_6PN;
+            const b = await connect('::1', forwarder.port());
+            expect(await readAll(b)).toBe('');
+            expect(lookups).toEqual(['hiveop-preview-gateway.internal']); // pinned, not per connection
+        }
+        finally {
+            forwarder.stop();
+            await preview.close();
+        }
+    });
+    it('fails closed when the name does not resolve', async () => {
+        const preview = await startUpstream();
+        const forwarder = (0, previewForwarder_1.createPreviewForwarder)({
+            listenHost: '::1',
+            listenPort: 0,
+            targetPort: preview.port,
+            allowed: ['hiveop-preview-gateway.internal'],
+            lookup: async () => {
+                throw new Error('ENOTFOUND');
+            },
+            setIntervalFn: () => 1,
+            clearIntervalFn: () => { },
+            remoteAddressOf: () => GATEWAY_6PN,
+        });
+        try {
+            await forwarder.start();
+            expect(forwarder.allowedAddresses()).toEqual([]);
+            const c = await connect('::1', forwarder.port());
+            expect(await readAll(c)).toBe('');
+            expect(preview.connections()).toBe(0);
+        }
+        finally {
+            forwarder.stop();
+            await preview.close();
+        }
+    });
+    it('a refresh that fails keeps the pinned addresses', async () => {
+        let refresh = null;
+        let fail = false;
+        const forwarder = (0, previewForwarder_1.createPreviewForwarder)({
+            listenHost: '::1',
+            listenPort: 0,
+            targetPort: 1,
+            allowed: ['hiveop-preview-gateway.internal'],
+            lookup: async () => {
+                if (fail)
+                    throw new Error('SERVFAIL');
+                return [GATEWAY_6PN];
+            },
+            setIntervalFn: (cb) => {
+                refresh = cb;
+                return 1;
+            },
+            clearIntervalFn: () => { },
+        });
+        try {
+            await forwarder.start();
+            fail = true;
+            refresh();
+            await tick();
+            expect(forwarder.allowedAddresses()).toEqual([(0, previewForwarder_1.canonicalAddress)(GATEWAY_6PN)]);
+        }
+        finally {
+            forwarder.stop();
+        }
+    });
+});
+describe('buildPreviewForwarder — hosted lane only (tp-06, ADR-0014)', () => {
+    const FLY_HOSTS = `127.0.0.1\tlocalhost\n${GATEWAY_6PN.replace(':2', ':9')}\tfly-local-6pn\n`;
+    function spyNet() {
+        const calls = { createServer: 0 };
+        const n = {
+            createServer: ((...args) => {
+                calls.createServer++;
+                return net.createServer(...args);
+            }),
+            createConnection: net.createConnection,
+        };
+        return { calls, net: n };
+    }
+    it('the local bridge (no fly-local-6pn) never opens the listener', async () => {
+        const spy = spyNet();
+        const fwd = (0, previewForwarder_1.buildPreviewForwarder)({
+            env: { HT_PREVIEW_GATEWAY: 'hiveop-preview-gateway.internal' },
+            readHosts: () => '127.0.0.1\tlocalhost\n::1\tlocalhost\n',
+            net: spy.net,
+            log: () => { },
+        });
+        await fwd.start();
+        fwd.stop();
+        expect(fwd.port()).toBeNull();
+        expect(spy.calls.createServer).toBe(0);
+    });
+    it('an unreadable /etc/hosts is the local lane too', async () => {
+        const spy = spyNet();
+        const fwd = (0, previewForwarder_1.buildPreviewForwarder)({
+            env: { HT_PREVIEW_GATEWAY: 'hiveop-preview-gateway.internal' },
+            readHosts: () => {
+                throw new Error('ENOENT');
+            },
+            net: spy.net,
+            log: () => { },
+        });
+        await fwd.start();
+        expect(spy.calls.createServer).toBe(0);
+    });
+    it('stays off on a hosted machine until a gateway is configured (default-off)', async () => {
+        const spy = spyNet();
+        const fwd = (0, previewForwarder_1.buildPreviewForwarder)({ env: {}, readHosts: () => FLY_HOSTS, net: spy.net, log: () => { } });
+        await fwd.start();
+        expect(spy.calls.createServer).toBe(0);
+    });
+    it('on a hosted machine with a gateway, binds the 6PN address at the forwarder port', async () => {
+        const listens = [];
+        const fakeServer = {
+            on: () => fakeServer,
+            once: () => fakeServer,
+            listen: (port, host, cb) => {
+                listens.push({ port, host });
+                cb?.();
+                return fakeServer;
+            },
+            address: () => ({ port: 4801 }),
+            close: () => fakeServer,
+        };
+        const fwd = (0, previewForwarder_1.buildPreviewForwarder)({
+            env: { HT_PREVIEW_GATEWAY: GATEWAY_6PN },
+            readHosts: () => FLY_HOSTS,
+            net: {
+                createServer: (() => fakeServer),
+                createConnection: net.createConnection,
+            },
+            log: () => { },
+        });
+        await fwd.start();
+        fwd.stop();
+        expect(listens).toEqual([{ port: previewForwarder_1.PREVIEW_FORWARDER_PORT_DEFAULT, host: GATEWAY_6PN.replace(':2', ':9') }]);
+        expect(fwd.allowedAddresses()).toEqual([(0, previewForwarder_1.canonicalAddress)(GATEWAY_6PN)]);
+    });
+});

package/dist/__tests__/bridge-preview-frames.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/bridge-preview-frames.test.js

@@ -0,0 +1,165 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * tp-05 — the preview relay frames, driven through the REAL relay client
+ * against a fake relay (wire behaviour, not internals).
+ *
+ * - Local lane (a laptop's crew-relay dial, onlyRelayOwnedSessions) answers
+ *   every preview frame `unsupported / local_lane` — ADR-0014 scopes it out.
+ * - Hosted lane: start/update answer `accepted` at once then `done`; stop
+ *   answers `done`; logs answer the tail. requestId is echoed every time.
+ */
+const ws_1 = require("ws");
+const relayClient_1 = require("../bridge/relayClient");
+const sessionManager_1 = require("../bridge/sessionManager");
+class FakePty {
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    write() { }
+    resize() { }
+    kill() { }
+    onData() { }
+    onExit() { }
+}
+const makeFactory = () => ({ spawn: (o) => new FakePty(o) });
+function frameQueue(ws) {
+    const frames = [];
+    const waiters = [];
+    ws.on('message', (raw) => {
+        const f = JSON.parse(String(raw));
+        const w = waiters.shift();
+        if (w)
+            w(f);
+        else
+            frames.push(f);
+    });
+    return { next: () => (frames.length > 0 ? Promise.resolve(frames.shift()) : new Promise((r) => waiters.push(r))) };
+}
+function startFakeRelay() {
+    return new Promise((resolve) => {
+        const wss = new ws_1.WebSocketServer({ port: 0, host: '127.0.0.1' });
+        const queue = [];
+        const waiters = [];
+        wss.on('connection', (ws) => { const w = waiters.shift(); if (w)
+            w(ws);
+        else
+            queue.push(ws); });
+        wss.on('listening', () => {
+            const addr = wss.address();
+            resolve({ wss, port: typeof addr === 'object' && addr ? addr.port : 0, nextConnection: () => (queue.length > 0 ? Promise.resolve(queue.shift()) : new Promise((r) => waiters.push(r))) });
+        });
+    });
+}
+function closeRelay(wss) {
+    return new Promise((resolve, reject) => {
+        for (const c of wss.clients)
+            c.terminate();
+        wss.close((err) => (err ? reject(err) : resolve()));
+    });
+}
+const FRAMES = [
+    { t: 'preview-start', requestId: 'r1', workspaceId: 'ws-1', repoUrl: 'https://github.com/o/r.git' },
+    { t: 'preview-update', requestId: 'r2', workspaceId: 'ws-1', repoUrl: 'https://github.com/o/r.git' },
+    { t: 'preview-stop', requestId: 'r3', workspaceId: 'ws-1' },
+    { t: 'preview-logs', requestId: 'r4', workspaceId: 'ws-1' },
+];
+function fakeRunner(seen) {
+    return {
+        status: (ws) => ({ workspaceId: ws, status: 'stopped', mode: 'built' }),
+        start: async (req) => { seen.push(['start', req]); return { workspaceId: req.workspaceId, status: 'running', mode: 'built', sha: 'a'.repeat(40), runningSha: 'a'.repeat(40), builtSha: 'a'.repeat(40) }; },
+        update: async (req) => { seen.push(['update', req]); return { workspaceId: req.workspaceId, status: 'build_failed', mode: 'built', sha: 'b'.repeat(40), runningSha: 'a'.repeat(40), builtSha: 'a'.repeat(40) }; },
+        stop: async (req) => { seen.push(['stop', req]); return { workspaceId: req.workspaceId, status: 'stopped', mode: 'built' }; },
+        logs: () => ({ log: 'built ok', truncated: false }),
+    };
+}
+describe('relay client — Team preview frames (tp-05)', () => {
+    it('preview frames are workspace-addressed, not session-addressed', () => {
+        for (const f of FRAMES)
+            expect(relayClient_1.SESSION_ADDRESSED_FRAMES.has(f.t)).toBe(false);
+    });
+    it('LOCAL lane (ADR-0014): every preview frame is answered unsupported / local_lane', async () => {
+        const relay = await startFakeRelay();
+        const seen = [];
+        const handle = (0, relayClient_1.startRelayClient)({
+            relayUrl: `ws://127.0.0.1:${relay.port}`,
+            relayToken: 'tok',
+            sessions: new sessionManager_1.SessionManager(makeFactory()),
+            onlyRelayOwnedSessions: true,
+            // Even a wired runner is never reached from the local lane.
+            preview: fakeRunner(seen),
+        });
+        try {
+            const ws = await relay.nextConnection();
+            const q = frameQueue(ws);
+            await q.next(); // auth
+            for (const f of FRAMES) {
+                ws.send(JSON.stringify(f));
+                expect(await q.next()).toMatchObject({
+                    t: f.t === 'preview-logs' ? 'preview-logs-result' : 'preview-result',
+                    requestId: f.requestId,
+                    workspaceId: 'ws-1',
+                    ok: false,
+                    error: 'unsupported',
+                    reason: 'local_lane',
+                });
+            }
+            expect(seen).toEqual([]);
+        }
+        finally {
+            handle.close();
+            await closeRelay(relay.wss);
+        }
+    });
+    it('HOSTED lane: start → accepted then done; update reports build_failed; stop; logs', async () => {
+        const relay = await startFakeRelay();
+        const seen = [];
+        const handle = (0, relayClient_1.startRelayClient)({
+            relayUrl: `ws://127.0.0.1:${relay.port}`,
+            relayToken: 'tok',
+            sessions: new sessionManager_1.SessionManager(makeFactory()),
+            preview: fakeRunner(seen),
+        });
+        try {
+            const ws = await relay.nextConnection();
+            const q = frameQueue(ws);
+            await q.next(); // auth
+            ws.send(JSON.stringify({ ...FRAMES[0], mode: 'dev', gitCredential: { token: 't', repoFullName: 'o/r' }, branch: 'evil' }));
+            expect(await q.next()).toMatchObject({ t: 'preview-result', requestId: 'r1', phase: 'accepted', status: 'building' });
+            expect(await q.next()).toMatchObject({ t: 'preview-result', requestId: 'r1', phase: 'done', ok: true, status: 'running', runningSha: 'a'.repeat(40) });
+            // No branch ever reaches the runner (ADR-0014).
+            expect(seen[0]).toEqual(['start', { workspaceId: 'ws-1', repoUrl: 'https://github.com/o/r.git', gitCredential: { token: 't', repoFullName: 'o/r' }, mode: 'dev' }]);
+            ws.send(JSON.stringify(FRAMES[1]));
+            expect(await q.next()).toMatchObject({ requestId: 'r2', phase: 'accepted' });
+            expect(await q.next()).toMatchObject({ requestId: 'r2', phase: 'done', ok: false, status: 'build_failed', sha: 'b'.repeat(40), runningSha: 'a'.repeat(40) });
+            ws.send(JSON.stringify(FRAMES[2]));
+            expect(await q.next()).toMatchObject({ requestId: 'r3', phase: 'done', ok: true, status: 'stopped' });
+            ws.send(JSON.stringify(FRAMES[3]));
+            expect(await q.next()).toEqual({ t: 'preview-logs-result', requestId: 'r4', workspaceId: 'ws-1', ok: true, log: 'built ok', truncated: false });
+        }
+        finally {
+            handle.close();
+            await closeRelay(relay.wss);
+        }
+    });
+    it('a hosted bridge with no runner answers unsupported / bridge-cannot-preview (no timeout)', async () => {
+        const relay = await startFakeRelay();
+        const handle = (0, relayClient_1.startRelayClient)({
+            relayUrl: `ws://127.0.0.1:${relay.port}`,
+            relayToken: 'tok',
+            sessions: new sessionManager_1.SessionManager(makeFactory()),
+        });
+        try {
+            const ws = await relay.nextConnection();
+            const q = frameQueue(ws);
+            await q.next();
+            ws.send(JSON.stringify(FRAMES[0]));
+            expect(await q.next()).toMatchObject({ requestId: 'r1', ok: false, error: 'unsupported', reason: 'bridge-cannot-preview' });
+        }
+        finally {
+            handle.close();
+            await closeRelay(relay.wss);
+        }
+    });
+});

package/dist/__tests__/bridge-session-anchor-no-identity.test.d.ts

@@ -0,0 +1 @@
+export {};