claude-dev-env 2.15.0 → 2.16.0

package/scripts/profile-isolation-launchers/tests/mcp-bundles.test.mjs

@@ -1,147 +0,0 @@
-import { test } from 'node:test';
-import { strict as assert } from 'node:assert';
-import { mkdtempSync, readFileSync, rmSync, writeFileSync, mkdirSync } from 'node:fs';
-import { join } from 'node:path';
-import { tmpdir } from 'node:os';
-import {
-  listServerNamesForBundle,
-  loadMcpBundlesDocument,
-  materializeProfileMcpConfig,
-  readEffectiveMcpServerInventory,
-  resolveProfileMcpBundleId,
-  SUPPORTED_ACTIVATION_INTERFACE,
-  validateMcpBundlesDocument,
-} from '../mcp-bundles.mjs';
-
-test('mcp bundles document loads with lean and full inventories', () => {
-  const document = loadMcpBundlesDocument();
-  assert.equal(document.supportedActivationInterface, SUPPORTED_ACTIVATION_INTERFACE);
-  assert.ok(document.bundles.lean.allServerNames.length >= 1);
-  assert.ok(document.bundles.full.allServerNames.length >= document.bundles.lean.allServerNames.length);
-});
-
-test('profile-a and profile-b resolve to lean mcp bundles from the profiles manifest', () => {
-  assert.equal(resolveProfileMcpBundleId('profile-a'), 'lean');
-  assert.equal(resolveProfileMcpBundleId('profile-b'), 'lean');
-});
-
-test('materializeProfileMcpConfig writes mcp.json inventory for profile-a', () => {
-  const claudeConfigDir = mkdtempSync(join(tmpdir(), 'mcp-profile-a-'));
-  try {
-    const result = materializeProfileMcpConfig({
-      profileId: 'profile-a',
-      claudeConfigDir,
-    });
-    assert.equal(result.activationInterface, SUPPORTED_ACTIVATION_INTERFACE);
-    assert.equal(result.bundleId, 'lean');
-    const inventory = readEffectiveMcpServerInventory(result.mcpConfigPath);
-    assert.deepEqual(inventory, [...result.allServerNames].sort());
-    const document = JSON.parse(readFileSync(result.mcpConfigPath, 'utf8'));
-    assert.ok(document.mcpServers['filesystem-readonly']);
-  } finally {
-    rmSync(claudeConfigDir, { recursive: true, force: true });
-  }
-});
-
-test('materializeProfileMcpConfig writes mcp.json inventory for profile-b', () => {
-  const claudeConfigDir = mkdtempSync(join(tmpdir(), 'mcp-profile-b-'));
-  try {
-    const result = materializeProfileMcpConfig({
-      profileId: 'profile-b',
-      claudeConfigDir,
-    });
-    assert.equal(result.bundleId, 'lean');
-    const inventory = readEffectiveMcpServerInventory(result.mcpConfigPath);
-    assert.deepEqual(inventory, listServerNamesForBundle('lean').sort());
-  } finally {
-    rmSync(claudeConfigDir, { recursive: true, force: true });
-  }
-});
-
-test('unknown profile id fails with an actionable message', () => {
-  assert.throws(
-    () => resolveProfileMcpBundleId('not-a-profile'),
-    /unknown profile id/,
-  );
-});
-
-test('malformed bundles document is rejected', () => {
-  assert.throws(
-    () => validateMcpBundlesDocument({ schemaVersion: 2 }),
-    /schemaVersion must be 1/,
-  );
-});
-
-test('missing mcp config readback fails closed', () => {
-  const claudeConfigDir = mkdtempSync(join(tmpdir(), 'mcp-missing-'));
-  try {
-    assert.throws(
-      () => readEffectiveMcpServerInventory(join(claudeConfigDir, 'mcp.json')),
-      /mcp config missing/,
-    );
-  } finally {
-    rmSync(claudeConfigDir, { recursive: true, force: true });
-  }
-});
-
-test('malformed mcp config readback fails closed', () => {
-  const claudeConfigDir = mkdtempSync(join(tmpdir(), 'mcp-bad-'));
-  try {
-    mkdirSync(claudeConfigDir, { recursive: true });
-    const path = join(claudeConfigDir, 'mcp.json');
-    writeFileSync(path, '{"notServers":true}\n', 'utf8');
-    assert.throws(
-      () => readEffectiveMcpServerInventory(path),
-      /malformed/,
-    );
-  } finally {
-    rmSync(claudeConfigDir, { recursive: true, force: true });
-  }
-});
-
-test('lean inventory must be a subset of full', () => {
-  assert.throws(
-    () => validateMcpBundlesDocument({
-      schemaVersion: 1,
-      supportedActivationInterface: SUPPORTED_ACTIVATION_INTERFACE,
-      mcpConfigFileName: 'mcp.json',
-      bundles: {
-        lean: { id: 'lean', allServerNames: ['only-lean'] },
-        full: { id: 'full', allServerNames: ['other'] },
-      },
-      serverByName: {
-        'only-lean': { command: 'npx', args: [] },
-        other: { command: 'npx', args: [] },
-      },
-    }),
-    /lean server only-lean must also appear in full/,
-  );
-});
-
-test('bundles and serverByName reject arrays', () => {
-  assert.throws(
-    () => validateMcpBundlesDocument({
-      schemaVersion: 1,
-      supportedActivationInterface: SUPPORTED_ACTIVATION_INTERFACE,
-      mcpConfigFileName: 'mcp.json',
-      bundles: [],
-      serverByName: {},
-    }),
-    /bundles must be an object/,
-  );
-});
-
-test('invalid JSON mcp config readback fails closed as malformed', () => {
-  const claudeConfigDir = mkdtempSync(join(tmpdir(), 'mcp-json-'));
-  try {
-    mkdirSync(claudeConfigDir, { recursive: true });
-    const path = join(claudeConfigDir, 'mcp.json');
-    writeFileSync(path, '{not-json', 'utf8');
-    assert.throws(
-      () => readEffectiveMcpServerInventory(path),
-      /malformed/,
-    );
-  } finally {
-    rmSync(claudeConfigDir, { recursive: true, force: true });
-  }
-});

package/scripts/profile-isolation-launchers/tests/shortcut-contract.test.ps1

@@ -1,102 +0,0 @@
-# Contract tests for N1 shortcut source semantics (read-only slice).
-# Run: pwsh -NoProfile -File tests/shortcut-contract.test.ps1
-
-Set-StrictMode -Version Latest
-$ErrorActionPreference = 'Stop'
-
-$packageLaunchersRoot = Split-Path -Parent $PSScriptRoot
-$manifestPath = Join-Path $packageLaunchersRoot 'windows\shortcut-manifest.json'
-$inventoryScript = Join-Path $packageLaunchersRoot 'windows\shortcut-inventory.ps1'
-$reconcileScript = Join-Path $packageLaunchersRoot 'windows\shortcut-reconcile.ps1'
-
-$script:allFailures = @()
-
-function Assert-True {
-    param([bool]$Condition, [string]$Message)
-    if (-not $Condition) {
-        $script:allFailures += $Message
-        Write-Host "FAIL: $Message"
-    }
-    else {
-        Write-Host "PASS: $Message"
-    }
-}
-
-# Manifest loads with provisional native-Desktop-wins policy.
-$manifest = Get-Content -LiteralPath $manifestPath -Raw | ConvertFrom-Json
-Assert-True ($manifest.schemaVersion -eq 1) 'manifest schemaVersion is 1'
-Assert-True ($manifest.policy.liveMutationAuthorized -eq $false) 'live mutation stays unauthorized until owner confirmation'
-Assert-True ($manifest.policy.unsuffixedNames -match 'Native Desktop wins') 'provisional unsuffixed policy is native Desktop wins'
-Assert-True ($manifest.policy.browserNames -match 'Chrome') 'browser names require explicit Chrome/Web labels'
-
-# Every managed shortcut has one source, profile, and grouping identity.
-$allVisibleNames = @{}
-$allGrouping = @{}
-foreach ($eachShortcut in $manifest.allManagedShortcuts) {
-    Assert-True ([string]::IsNullOrWhiteSpace($eachShortcut.id) -eq $false) "shortcut id present"
-    Assert-True ([string]::IsNullOrWhiteSpace($eachShortcut.source) -eq $false) "$($eachShortcut.id) has source"
-    Assert-True ([string]::IsNullOrWhiteSpace($eachShortcut.profileId) -eq $false) "$($eachShortcut.id) has profileId"
-    Assert-True ([string]::IsNullOrWhiteSpace($eachShortcut.groupingIdentity) -eq $false) "$($eachShortcut.id) has groupingIdentity"
-    Assert-True ([string]::IsNullOrWhiteSpace($eachShortcut.visibleName) -eq $false) "$($eachShortcut.id) has visibleName"
-    if ($allVisibleNames.ContainsKey($eachShortcut.visibleName)) {
-        Assert-True $false "duplicate visible name: $($eachShortcut.visibleName)"
-    }
-    else {
-        $allVisibleNames[$eachShortcut.visibleName] = $eachShortcut.id
-        Assert-True $true "unique visible name: $($eachShortcut.visibleName)"
-    }
-    if ($allGrouping.ContainsKey($eachShortcut.groupingIdentity)) {
-        Assert-True $false "duplicate grouping identity: $($eachShortcut.groupingIdentity)"
-    }
-    else {
-        $allGrouping[$eachShortcut.groupingIdentity] = $eachShortcut.id
-        Assert-True $true "unique grouping identity: $($eachShortcut.groupingIdentity)"
-    }
-}
-
-# Native and Chrome variants retain distinct grouping identity for profile-a and profile-b.
-$profileANative = $manifest.allManagedShortcuts | Where-Object { $_.id -eq 'desktop-profile-a-native' }
-$profileAChrome = $manifest.allManagedShortcuts | Where-Object { $_.id -eq 'start-profile-a-chrome' }
-Assert-True ($profileANative.groupingIdentity -ne $profileAChrome.groupingIdentity) 'profile-a native/chrome grouping differs'
-Assert-True ($profileANative.source -eq 'native-desktop') 'profile-a desktop source is native-desktop'
-Assert-True ($profileAChrome.source -eq 'chrome-start-menu') 'profile-a start-menu source is chrome-start-menu'
-
-# Inventory is read-only against disposable paths.
-$tempRoot = Join-Path ([IO.Path]::GetTempPath()) ("shortcut-contract-" + [guid]::NewGuid().ToString('n'))
-$desktop = Join-Path $tempRoot 'Desktop'
-$startMenu = Join-Path $tempRoot 'StartMenu'
-New-Item -ItemType Directory -Path $desktop, $startMenu | Out-Null
-try {
-    $inventoryJson = & $inventoryScript -ManifestPath $manifestPath -DesktopPath $desktop -StartMenuPath $startMenu
-    $inventory = $inventoryJson | ConvertFrom-Json
-    Assert-True ($inventory.mode -eq 'read-only-inventory') 'inventory mode is read-only'
-    Assert-True ($inventory.shortcuts.Count -eq $manifest.allManagedShortcuts.Count) 'inventory rows match manifest'
-    Assert-True (-not (Get-ChildItem -LiteralPath $desktop -Force | Where-Object { $_.Extension -eq '.lnk' })) 'inventory does not create desktop shortcuts'
-    Assert-True (-not (Get-ChildItem -LiteralPath $startMenu -Force | Where-Object { $_.Extension -eq '.lnk' })) 'inventory does not create start-menu shortcuts'
-
-    $previewJson = & $reconcileScript -ManifestPath $manifestPath -DesktopPath $desktop -StartMenuPath $startMenu
-    $preview = $previewJson | ConvertFrom-Json
-    Assert-True ($preview.mode -eq 'preview-only') 'reconcile defaults to preview-only'
-    Assert-True ($preview.liveMutationAuthorized -eq $false) 'preview reports mutation unauthorized'
-    Assert-True ($preview.actions.Count -eq $manifest.allManagedShortcuts.Count) 'preview lists every managed shortcut'
-
-    $applyFailed = $false
-    try {
-        & $reconcileScript -ManifestPath $manifestPath -DesktopPath $desktop -StartMenuPath $startMenu -Apply | Out-Null
-    }
-    catch {
-        $applyFailed = $true
-        Assert-True ($_.Exception.Message -match 'live shortcut mutation refused') 'apply refuses without owner authorization'
-    }
-    Assert-True $applyFailed 'apply path must throw while unauthorized'
-}
-finally {
-    Remove-Item -Recurse -Force -Confirm:$false -LiteralPath $tempRoot
-}
-
-if ($script:allFailures.Count -gt 0) {
-    Write-Host ("FAILED {0} assertion(s)" -f $script:allFailures.Count)
-    exit 1
-}
-Write-Host 'shortcut-contract: all assertions passed'
-exit 0

package/scripts/profile-isolation-launchers/tests/version-compatibility.test.mjs

@@ -1,210 +0,0 @@
-/**
- * CLI / Desktop version compatibility contract (control-plane K1 / P-26).
- */
-
-import { test } from 'node:test';
-import { strict as assert } from 'node:assert';
-import { existsSync, readFileSync } from 'node:fs';
-import { join, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { spawnSync } from 'node:child_process';
-import {
-    classifyVersionCompatibility,
-    shouldBlockLaunch,
-    parseSemver,
-    COMPATIBILITY_POLICY_VERSION,
-    COMPATIBILITY_ACTION_BY_CLASS,
-} from '../version-compatibility.mjs';
-import {
-    evaluateLauncherVersionCompatibility,
-    formatCompatibilityPreflightFailure,
-} from '../launcher-runtime.mjs';
-
-const PACKAGE_ROOT = join(
-    dirname(fileURLToPath(import.meta.url)),
-    '..',
-    '..',
-    '..',
-);
-
-test('action table covers every compatibility class and fails closed', () => {
-    const allExpectedClasses = [
-        'equal',
-        'patch-drift',
-        'minor-drift',
-        'major-drift',
-        'missing-binary',
-        'unreadable',
-        'process-error',
-        'non-semver',
-    ];
-    for (const eachClass of allExpectedClasses) {
-        assert.ok(
-            Object.hasOwn(COMPATIBILITY_ACTION_BY_CLASS, eachClass),
-            `missing action for ${eachClass}`,
-        );
-    }
-    assert.equal(COMPATIBILITY_ACTION_BY_CLASS.equal, 'pass');
-    assert.equal(COMPATIBILITY_ACTION_BY_CLASS['patch-drift'], 'warn');
-    assert.equal(COMPATIBILITY_ACTION_BY_CLASS['minor-drift'], 'block');
-    assert.equal(COMPATIBILITY_ACTION_BY_CLASS['major-drift'], 'block');
-    assert.equal(COMPATIBILITY_ACTION_BY_CLASS['missing-binary'], 'block');
-    assert.equal(COMPATIBILITY_ACTION_BY_CLASS.unreadable, 'block');
-    assert.equal(COMPATIBILITY_ACTION_BY_CLASS['process-error'], 'block');
-    assert.equal(COMPATIBILITY_ACTION_BY_CLASS['non-semver'], 'block');
-});
-
-test('equal versions pass with both paths, versions, and policy version', () => {
-    const result = classifyVersionCompatibility({
-        cli: { path: 'C:\\cli\\claude.exe', versionText: '2.1.220' },
-        desktop: { path: 'C:\\desktop\\claude.exe', versionText: '2.1.220' },
-    });
-    assert.equal(result.class, 'equal');
-    assert.equal(result.action, 'pass');
-    assert.equal(result.policyVersion, COMPATIBILITY_POLICY_VERSION);
-    assert.equal(result.cliPath, 'C:\\cli\\claude.exe');
-    assert.equal(result.desktopPath, 'C:\\desktop\\claude.exe');
-    assert.equal(result.cliVersion, '2.1.220');
-    assert.equal(result.desktopVersion, '2.1.220');
-    assert.equal(shouldBlockLaunch(result), false);
-});
-
-test('patch drift warns and identifies the runtime pair', () => {
-    const result = classifyVersionCompatibility({
-        cli: { path: 'cli', versionText: '2.1.220' },
-        desktop: { path: 'desktop', versionText: '2.1.219' },
-    });
-    assert.equal(result.class, 'patch-drift');
-    assert.equal(result.action, 'warn');
-    assert.match(result.message, /patch drift/i);
-    assert.equal(shouldBlockLaunch(result), false);
-});
-
-test('minor and major drift block before mutation', () => {
-    const minor = classifyVersionCompatibility({
-        cli: { path: 'cli', versionText: '2.1.220' },
-        desktop: { path: 'desktop', versionText: '2.0.100' },
-    });
-    assert.equal(minor.class, 'minor-drift');
-    assert.equal(minor.action, 'block');
-    assert.equal(shouldBlockLaunch(minor), true);
-
-    const major = classifyVersionCompatibility({
-        cli: { path: 'cli', versionText: '2.1.220' },
-        desktop: { path: 'desktop', versionText: '1.9.0' },
-    });
-    assert.equal(major.class, 'major-drift');
-    assert.equal(major.action, 'block');
-    assert.equal(shouldBlockLaunch(major), true);
-});
-
-test('missing, unreadable, process-error, and non-semver block', () => {
-    const missing = classifyVersionCompatibility({
-        cli: { path: null, versionText: null, errorCode: 'missing' },
-        desktop: { path: 'desktop', versionText: '2.1.220' },
-    });
-    assert.equal(missing.class, 'missing-binary');
-    assert.equal(missing.action, 'block');
-
-    const unreadable = classifyVersionCompatibility({
-        cli: { path: 'cli', versionText: null, errorCode: 'unreadable' },
-        desktop: { path: 'desktop', versionText: '2.1.220' },
-    });
-    assert.equal(unreadable.class, 'unreadable');
-    assert.equal(unreadable.action, 'block');
-
-    const processError = classifyVersionCompatibility({
-        cli: {
-            path: 'cli',
-            versionText: null,
-            errorCode: 'process-error',
-            errorMessage: 'exit 127',
-        },
-        desktop: { path: 'desktop', versionText: '2.1.220' },
-    });
-    assert.equal(processError.class, 'process-error');
-    assert.equal(processError.action, 'block');
-    assert.match(processError.message, /exit 127/);
-
-    const nonSemver = classifyVersionCompatibility({
-        cli: { path: 'cli', versionText: 'unknown' },
-        desktop: { path: 'desktop', versionText: '2.1.220' },
-    });
-    assert.equal(nonSemver.class, 'non-semver');
-    assert.equal(nonSemver.action, 'block');
-});
-
-test('parseSemver reads the first major.minor.patch triple', () => {
-    assert.deepEqual(parseSemver('2.1.220'), { major: 2, minor: 1, patch: 220 });
-    assert.deepEqual(parseSemver('claude 2.1.219 (win)'), { major: 2, minor: 1, patch: 219 });
-    assert.equal(parseSemver('unknown'), null);
-    assert.equal(parseSemver(''), null);
-});
-
-test('launcher preflight evaluates probes and blocks incompatible pairs', () => {
-    const blocked = evaluateLauncherVersionCompatibility({
-        cli: { path: 'cli', versionText: '2.1.220' },
-        desktop: { path: 'desktop', versionText: '1.0.0' },
-    });
-    assert.equal(blocked.class, 'major-drift');
-    assert.equal(blocked.action, 'block');
-    assert.equal(shouldBlockLaunch(blocked), true);
-    const message = formatCompatibilityPreflightFailure(blocked);
-    assert.match(message, /version compatibility/i);
-    assert.match(message, /major drift/i);
-
-    const allowed = evaluateLauncherVersionCompatibility({
-        cli: { path: 'cli', versionText: '2.1.220' },
-        desktop: { path: 'desktop', versionText: '2.1.220' },
-    });
-    assert.equal(allowed.action, 'pass');
-});
-
-test('live CLI version diagnostic records a real probe when CLAUDE_CLI_PATH is set', () => {
-    const cliPath = process.env.CLAUDE_CLI_PATH;
-    if (!cliPath || !existsSync(cliPath)) {
-        // Policy matrix above is the unit evidence. Live readback is optional and
-        // activated by CLAUDE_CLI_PATH so the suite stays free of host-private paths.
-        const missing = classifyVersionCompatibility({
-            cli: { path: null, versionText: null, errorCode: 'missing' },
-            desktop: { path: null, versionText: null, errorCode: 'missing' },
-        });
-        assert.equal(missing.class, 'missing-binary');
-        return;
-    }
-    const probe = spawnSync(cliPath, ['--version'], {
-        encoding: 'utf8',
-        timeout: 15_000,
-    });
-    const versionText = `${probe.stdout || ''}${probe.stderr || ''}`.trim();
-    assert.equal(probe.error, undefined);
-    assert.ok(versionText.length > 0, 'claude --version produced empty output');
-    const parsed = parseSemver(versionText);
-    assert.ok(parsed, `expected semver in: ${versionText}`);
-
-    // Self-pair: equal pass against the same live CLI text (desktop diagnostic-only).
-    const result = classifyVersionCompatibility({
-        cli: { path: cliPath, versionText },
-        desktop: { path: cliPath, versionText },
-    });
-    assert.equal(result.class, 'equal');
-    assert.equal(result.action, 'pass');
-    assert.equal(result.policyVersion, COMPATIBILITY_POLICY_VERSION);
-});
-
-test('package ships version-compatibility module and test paths', () => {
-    const allPaths = [
-        join(PACKAGE_ROOT, 'scripts/profile-isolation-launchers/version-compatibility.mjs'),
-        join(PACKAGE_ROOT, 'scripts/profile-isolation-launchers/tests/version-compatibility.test.mjs'),
-        join(PACKAGE_ROOT, 'scripts/profile-isolation-launchers/launcher-runtime.mjs'),
-    ];
-    for (const eachPath of allPaths) {
-        assert.ok(existsSync(eachPath), `missing ${eachPath}`);
-    }
-    const runtimeSource = readFileSync(
-        join(PACKAGE_ROOT, 'scripts/profile-isolation-launchers/launcher-runtime.mjs'),
-        'utf8',
-    );
-    assert.match(runtimeSource, /version-compatibility\.mjs/);
-    assert.match(runtimeSource, /evaluateLauncherVersionCompatibility/);
-});