ccs-mcp-server 1.2.17 → 1.4.0

package/test/run-tests.js

@@ -0,0 +1,355 @@
+"use strict";
+/**
+ * locate_tampering 测试套件
+ *
+ * 关键断言不是"函数能跑"，而是三件事：
+ *   1) 字段级定位真的指向**正确的指针**（RFC 6901 转义正确）
+ *   2) 严重度按**字段语义**分级，不按差异大小
+ *   3) 数组顺序变更必须被检出（不能退化成集合比较）
+ *
+ * 运行： node test/run-tests.js
+ */
+
+const assert = require("assert");
+const t = require("../src/locate_tampering");
+
+let passed = 0, failed = 0;
+const failures = [];
+
+function test(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  PASS  ${name}`);
+  } catch (e) {
+    failed++;
+    failures.push({ name, msg: e.message });
+    console.log(`  FAIL  ${name}\n        ${e.message}`);
+  }
+}
+
+console.log("locate_tampering 测试套件\n");
+
+// ---------------------------------------------------------------------------
+console.log("1. JSON-Pointer 转义（RFC 6901）");
+// ---------------------------------------------------------------------------
+
+test("普通 token 不变", () => {
+  assert.strictEqual(t.pointerEscape("checks"), "checks");
+});
+
+test("~ 转义为 ~0", () => {
+  assert.strictEqual(t.pointerEscape("a~b"), "a~0b");
+});
+
+test("/ 转义为 ~1", () => {
+  assert.strictEqual(t.pointerEscape("a/b"), "a~1b");
+});
+
+test("~ 先于 / 转义（顺序敏感）", () => {
+  // "~/" 必须变成 "~0~1"，
+  // 若先转 / 会得到 "~~1" 再转 ~ 成 "~0~1"……不，先转 / 会错成 "~~01"
+  assert.strictEqual(t.pointerEscape("~/"), "~0~1");
+});
+
+test("含 / 的 key 仍产生合法单段指针", () => {
+  const ptr = t.joinPointer("", "a/b");
+  assert.strictEqual(ptr, "/a~1b");
+  // 指针段数必须是 1（因为 / 被转义了）
+  assert.strictEqual(ptr.split("/").length - 1, 1);
+});
+
+// ---------------------------------------------------------------------------
+console.log("\n2. 差异检出");
+// ---------------------------------------------------------------------------
+
+test("无差异返回空清单", () => {
+  const a = { x: 1, y: { z: "ok" } };
+  assert.strictEqual(t.deepDiff(a, JSON.parse(JSON.stringify(a))).length, 0);
+});
+
+test("标量修改被检出且指针正确", () => {
+  const d = t.deepDiff({ verdict: "valid" }, { verdict: "invalid" });
+  assert.strictEqual(d.length, 1);
+  assert.strictEqual(d[0].path, "/verdict");
+  assert.strictEqual(d[0].change, "modified");
+  assert.strictEqual(d[0].original, "valid");
+  assert.strictEqual(d[0].suspect, "invalid");
+});
+
+test("嵌套字段指针用 / 分隔", () => {
+  const d = t.deepDiff(
+    { checks: { security: { status: "pass" } } },
+    { checks: { security: { status: "fail" } } }
+  );
+  assert.strictEqual(d[0].path, "/checks/security/status");
+});
+
+test("新增字段标 added 且 original 为 null", () => {
+  const d = t.deepDiff({ a: 1 }, { a: 1, b: 2 });
+  assert.strictEqual(d.length, 1);
+  assert.strictEqual(d[0].change, "added");
+  assert.strictEqual(d[0].path, "/b");
+  assert.strictEqual(d[0].original, null);
+});
+
+test("删除字段标 removed", () => {
+  const d = t.deepDiff({ a: 1, b: 2 }, { a: 1 });
+  assert.strictEqual(d[0].change, "removed");
+  assert.strictEqual(d[0].path, "/b");
+});
+
+test("数组按下标比较，顺序变更被检出", () => {
+  // 关键：不能用集合语义，否则 ["a","b"] vs ["b","a"] 会被判为相同
+  const d = t.deepDiff({ list: ["a", "b"] }, { list: ["b", "a"] });
+  assert.ok(d.length > 0, "顺序变更必须被检出");
+  const paths = d.map((c) => c.path).sort();
+  assert.deepStrictEqual(paths, ["/list/0", "/list/1"]);
+});
+
+test("数组长度变化：新增项标 added", () => {
+  const d = t.deepDiff({ l: [1] }, { l: [1, 2] });
+  assert.strictEqual(d.length, 1);
+  assert.strictEqual(d[0].path, "/l/1");
+  assert.strictEqual(d[0].change, "added");
+});
+
+test("类型变更（对象→标量）被检出", () => {
+  const d = t.deepDiff({ a: { b: 1 } }, { a: "flat" });
+  assert.strictEqual(d.length, 1);
+  assert.strictEqual(d[0].path, "/a");
+});
+
+test("深层多处修改全部报出", () => {
+  const o = { v: "valid", lat: 12, c: { s: { st: "pass", d: "ok" } } };
+  const s = { v: "invalid", lat: 71, c: { s: { st: "fail", d: "ok" } } };
+  const d = t.deepDiff(o, s);
+  const paths = d.map((c) => c.path).sort();
+  assert.deepStrictEqual(paths, ["/c/s/st", "/lat", "/v"]);
+});
+
+// ---------------------------------------------------------------------------
+console.log("\n3. 严重度按字段语义（不是按差异大小）");
+// ---------------------------------------------------------------------------
+
+test("verdict 为 critical", () => {
+  assert.strictEqual(t.classifySeverity("/verdict"), "critical");
+});
+
+test("checks 下任意深度均为 critical", () => {
+  assert.strictEqual(t.classifySeverity("/checks/security/status"), "critical");
+  assert.strictEqual(t.classifySeverity("/checks/a/b/c/d"), "critical");
+});
+
+test("reason 为 high", () => {
+  assert.strictEqual(t.classifySeverity("/reason"), "high");
+});
+
+test("latency 为 medium", () => {
+  assert.strictEqual(t.classifySeverity("/latency_ms"), "medium");
+});
+
+test("未知字段为 low", () => {
+  assert.strictEqual(t.classifySeverity("/some_unknown_field"), "low");
+});
+
+test("改一个字符的 verdict 比改大对象的 latency 更严重", () => {
+  const d = t.deepDiff(
+    { verdict: "valid", latency_ms: 1 },
+    { verdict: "invali", latency_ms: 99999 }
+  );
+  const byPath = Object.fromEntries(d.map((c) => [c.path, c.severity]));
+  assert.strictEqual(byPath["/verdict"], "critical");
+  assert.strictEqual(byPath["/latency_ms"], "medium");
+  const rank = { critical: 3, high: 2, medium: 1, low: 0 };
+  assert.ok(rank[byPath["/verdict"]] > rank[byPath["/latency_ms"]]);
+});
+
+// ---------------------------------------------------------------------------
+console.log("\n4. 报告结构");
+// ---------------------------------------------------------------------------
+
+test("报告带 schema 标识", () => {
+  const r = t.buildReport({ a: 1 }, { a: 2 });
+  assert.strictEqual(r.schema, "correctover.tamper-localization.v1");
+});
+
+test("tampered 在有差异时为 true", () => {
+  assert.strictEqual(t.buildReport({ a: 1 }, { a: 2 }).tampered, true);
+});
+
+test("tampered 在无差异时为 false", () => {
+  assert.strictEqual(t.buildReport({ a: 1 }, { a: 1 }).tampered, false);
+});
+
+test("counts 按严重度汇总", () => {
+  const r = t.buildReport(
+    { verdict: "valid", reason: "x", latency_ms: 1 },
+    { verdict: "invalid", reason: "y", latency_ms: 2 }
+  );
+  assert.strictEqual(r.counts.critical, 1);
+  assert.strictEqual(r.counts.high, 1);
+  assert.strictEqual(r.counts.medium, 1);
+});
+
+test("结论在存在 critical 时明确说明不可互换", () => {
+  const r = t.buildReport({ verdict: "valid" }, { verdict: "invalid" });
+  assert.ok(/not interchangeable/i.test(r.conclusion), r.conclusion);
+});
+
+test("结论在无 critical 时不夸大", () => {
+  const r = t.buildReport({ latency_ms: 1 }, { latency_ms: 2 });
+  assert.ok(/likely operational|None are verdict-bearing/i.test(r.conclusion), r.conclusion);
+});
+
+test("无差异时结论不声称真实性", () => {
+  const r = t.buildReport({ a: 1 }, { a: 1 });
+  assert.ok(/does not by itself prove/i.test(r.conclusion), r.conclusion);
+});
+
+test("limitations 明确不做真实性判断", () => {
+  const r = t.buildReport({ a: 1 }, { a: 2 });
+  assert.ok(r.limitations.some((l) => /does not prove which one is authentic/i.test(l)));
+  assert.ok(r.limitations.some((l) => /does not verify any cryptographic signature/i.test(l)));
+});
+
+test("每条变更都带整改建议", () => {
+  const r = t.buildReport({ verdict: "a" }, { verdict: "b" });
+  assert.ok(r.changes.every((c) => typeof c.remediation === "string" && c.remediation.length > 10));
+});
+
+test("digests 对相同内容稳定", () => {
+  const a = t.buildReport({ x: 1, y: 2 }, { x: 1, y: 2 });
+  const b = t.buildReport({ y: 2, x: 1 }, { y: 2, x: 1 });
+  assert.strictEqual(a.digests.original, b.digests.original,
+    "键顺序不同不应导致摘要不同");
+});
+
+// ---------------------------------------------------------------------------
+console.log("\n5. 与 Python 侧输出对齐");
+// ---------------------------------------------------------------------------
+
+test("path_dotted 兼容字段存在且格式正确", () => {
+  const d = t.deepDiff(
+    { checks: { security: { status: "pass" } } },
+    { checks: { security: { status: "fail" } } }
+  );
+  assert.strictEqual(d[0].path_dotted, "checks.security.status");
+});
+
+test("path_format 声明为 rfc6901", () => {
+  const d = t.deepDiff({ a: 1 }, { a: 2 });
+  assert.strictEqual(d[0].path_format, "rfc6901");
+});
+
+test("指针与点号路径同时可查（既有消费方不被破坏）", () => {
+  const d = t.deepDiff({ a: { b: 1 } }, { a: { b: 2 } })[0];
+  assert.strictEqual(d.path, "/a/b");
+  assert.strictEqual(d.path_dotted, "a.b");
+});
+
+// ---------------------------------------------------------------------------
+// 6. CLI 参数层
+//
+// 为什么这些断言重要：用户会用 --help / --version 探路。
+// 在此之前，任何参数都会被无视、直接启动 stdio 服务并打广告 ——
+// 用户得不到信息、命令还会挂住，这是最早的流失点。
+// 同时必须保证：CLI 层是纯增量的，不带参数时协议行为一字不变。
+// ---------------------------------------------------------------------------
+
+const { spawnSync } = require("child_process");
+const path = require("path");
+const INDEX = path.join(__dirname, "..", "src", "index.js");
+
+function runCli(args, input) {
+  return spawnSync(process.execPath, [INDEX, ...args], {
+    input: input || "",
+    encoding: "utf8",
+    timeout: 15000,
+  });
+}
+
+test("--help 输出版本号", () => {
+  const r = runCli(["--help"]);
+  assert.strictEqual(r.status, 0);
+  assert.ok(/ccs-mcp-server v\d+\.\d+\.\d+/.test(r.stdout), "缺少版本号行");
+});
+
+test("--help 输出用法说明而非广告", () => {
+  const r = runCli(["--help"]);
+  assert.ok(r.stdout.includes("用法:"), "缺少用法段");
+  assert.ok(r.stdout.includes("mcpServers"), "缺少 MCP 配置示例");
+});
+
+test("--help 列出全部工具", () => {
+  const r = runCli(["--help"]);
+  for (const tool of ["verify_tool_call", "issue_evidence", "audit_mcp_config",
+                      "verify_intent_binding", "verify_receipt", "locate_tampering"]) {
+    assert.ok(r.stdout.includes(tool), `--help 未列出工具 ${tool}`);
+  }
+});
+
+test("--help 不把广告放在开头", () => {
+  const r = runCli(["--help"]);
+  const firstLine = r.stdout.split("\n")[0];
+  assert.ok(!firstLine.includes("支付宝"), "第一行就是广告（时序错位）");
+});
+
+test("--version 只输出版本号", () => {
+  const r = runCli(["--version"]);
+  assert.strictEqual(r.status, 0);
+  assert.strictEqual(r.stdout.trim(), require("../package.json").version);
+});
+
+test("-v 与 --version 等价", () => {
+  assert.strictEqual(runCli(["-v"]).stdout.trim(), require("../package.json").version);
+});
+
+test("-h 与 --help 等价", () => {
+  assert.ok(runCli(["-h"]).stdout.includes("用法:"));
+});
+
+test("--tools 输出纯工具名，无广告", () => {
+  const r = runCli(["--tools"]);
+  assert.strictEqual(r.status, 0);
+  assert.ok(r.stdout.includes("verify_tool_call"));
+  assert.ok(!r.stdout.includes("支付宝"), "--tools 不应含广告");
+  assert.ok(!r.stdout.includes("SkillPay"), "--tools 不应含 SkillPay");
+});
+
+test("CLI 参数不启动 stdio 服务（立即退出）", () => {
+  const r = runCli(["--help"]);
+  assert.strictEqual(r.status, 0, "应正常退出而非挂住等待 stdin");
+});
+
+test("不带参数时协议行为不变：initialize 正常", () => {
+  const r = runCli([], '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"t","version":"1"}}}\n');
+  const line = r.stdout.split("\n").find((l) => l.includes('"id":1'));
+  assert.ok(line, "未收到 initialize 响应");
+  const d = JSON.parse(line);
+  assert.ok(d.result && d.result.serverInfo, "响应结构异常");
+  assert.strictEqual(d.result.protocolVersion, "2024-11-05");
+});
+
+test("不带参数时协议行为不变：tools/list 返回 6 个工具", () => {
+  const r = runCli([], '{"jsonrpc":"2.0","id":1,"method":"tools/list"}\n');
+  const line = r.stdout.split("\n").find((l) => l.includes('"id":1'));
+  const d = JSON.parse(line);
+  assert.strictEqual(d.result.tools.length, 6);
+});
+
+test("未知参数不误触发 CLI 层（仍进入服务模式）", () => {
+  const r = runCli(["--nonexistent-flag"], '{"jsonrpc":"2.0","id":1,"method":"ping"}\n');
+  const line = r.stdout.split("\n").find((l) => l.includes('"id":1'));
+  assert.ok(line, "未知参数不应阻止服务启动");
+});
+
+// ---------------------------------------------------------------------------
+console.log(`\n${"=".repeat(52)}`);
+console.log(`  ${passed}/${passed + failed} PASS`);
+console.log(`${"=".repeat(52)}`);
+if (failures.length) {
+  console.log("\n失败明细：");
+  for (const f of failures) console.log(`  - ${f.name}\n    ${f.msg}`);
+}
+process.exit(failed ? 1 : 0);