clckernel 1.2.6

package/test/technologies/detector.test.js

@@ -0,0 +1,342 @@
+/**
+ * CLC Forge — TechnologyDetector unit tests.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const path = require('path');
+const { TechnologyDetector } = require('../../src/technologies/detector');
+const { createTmpProject, teardown } = require('../helpers');
+
+describe('TechnologyDetector', () => {
+  describe('detect() — Celery', () => {
+    it('detects Celery via requirements.txt', () => {
+      const dir = createTmpProject({
+        'requirements.txt': 'celery>=5.3.0\nredis>=5.0.0',
+      });
+      try {
+        const detector = new TechnologyDetector();
+        const result = detector.detect(dir);
+        assert.ok(result.includes('celery'), 'should detect celery from requirements.txt');
+      } finally {
+        teardown(dir);
+      }
+    });
+
+    it('detects Celery via pyproject.toml', () => {
+      const dir = createTmpProject({
+        'pyproject.toml': '[project]\nname = "myapp"\ndependencies = ["celery>=5.3"]',
+      });
+      try {
+        const detector = new TechnologyDetector();
+        const result = detector.detect(dir);
+        assert.ok(result.includes('celery'), 'should detect celery from pyproject.toml');
+      } finally {
+        teardown(dir);
+      }
+    });
+
+    it('detects Celery via celery.py file', () => {
+      const dir = createTmpProject({
+        'celery.py': 'from celery import Celery\napp = Celery()',
+      });
+      try {
+        const detector = new TechnologyDetector();
+        const result = detector.detect(dir);
+        assert.ok(result.includes('celery'), 'should detect celery from celery.py');
+      } finally {
+        teardown(dir);
+      }
+    });
+
+    it('detects Celery via celeryconfig.py', () => {
+      const dir = createTmpProject({
+        'celeryconfig.py': 'broker_url = "redis://localhost"',
+      });
+      try {
+        const detector = new TechnologyDetector();
+        const result = detector.detect(dir);
+        assert.ok(result.includes('celery'), 'should detect celery from celeryconfig.py');
+      } finally {
+        teardown(dir);
+      }
+    });
+
+    it('detects Celery via celery_app.py', () => {
+      const dir = createTmpProject({
+        'celery_app.py': 'from celery import Celery\napp = Celery()',
+      });
+      try {
+        const detector = new TechnologyDetector();
+        const result = detector.detect(dir);
+        assert.ok(result.includes('celery'), 'should detect celery from celery_app.py');
+      } finally {
+        teardown(dir);
+      }
+    });
+  });
+
+  describe('detect() — Redis', () => {
+    it('detects Redis via requirements.txt', () => {
+      const dir = createTmpProject({
+        'requirements.txt': 'redis>=5.0.0\ncelery>=5.3',
+      });
+      try {
+        const detector = new TechnologyDetector();
+        const result = detector.detect(dir);
+        assert.ok(result.includes('redis'), 'should detect redis from requirements.txt');
+      } finally {
+        teardown(dir);
+      }
+    });
+
+    it('detects Redis via pyproject.toml', () => {
+      const dir = createTmpProject({
+        'pyproject.toml': '[project]\ndependencies = ["redis>=5.0"]',
+      });
+      try {
+        const detector = new TechnologyDetector();
+        const result = detector.detect(dir);
+        assert.ok(result.includes('redis'), 'should detect redis from pyproject.toml');
+      } finally {
+        teardown(dir);
+      }
+    });
+
+    it('detects Redis via redis.conf', () => {
+      const dir = createTmpProject({
+        'redis.conf': 'port 6379\nbind 127.0.0.1',
+      });
+      try {
+        const detector = new TechnologyDetector();
+        const result = detector.detect(dir);
+        assert.ok(result.includes('redis'), 'should detect redis from redis.conf');
+      } finally {
+        teardown(dir);
+      }
+    });
+
+    it('detects Redis via redis:// in .env', () => {
+      const dir = createTmpProject({
+        '.env': 'REDIS_URL=redis://localhost:6379/0\nSECRET_KEY=xyz',
+      });
+      try {
+        const detector = new TechnologyDetector();
+        const result = detector.detect(dir);
+        assert.ok(result.includes('redis'), 'should detect redis from .env');
+      } finally {
+        teardown(dir);
+      }
+    });
+
+    it('detects Redis via .env.development', () => {
+      const dir = createTmpProject({
+        '.env.development': 'REDIS_URL=redis://localhost:6379/0',
+      });
+      try {
+        const detector = new TechnologyDetector();
+        const result = detector.detect(dir);
+        assert.ok(result.includes('redis'), 'should detect redis from .env.development');
+      } finally {
+        teardown(dir);
+      }
+    });
+  });
+
+  describe('detect() — PostgreSQL', () => {
+    it('detects PostgreSQL via psycopg2 in requirements.txt', () => {
+      const dir = createTmpProject({
+        'requirements.txt': 'psycopg2>=2.9.0\ncelery>=5.3',
+      });
+      try {
+        const detector = new TechnologyDetector();
+        const result = detector.detect(dir);
+        assert.ok(result.includes('postgresql'), 'should detect postgresql from psycopg2');
+      } finally {
+        teardown(dir);
+      }
+    });
+
+    it('detects PostgreSQL via asyncpg in requirements.txt', () => {
+      const dir = createTmpProject({
+        'requirements.txt': 'asyncpg>=0.29.0',
+      });
+      try {
+        const detector = new TechnologyDetector();
+        const result = detector.detect(dir);
+        assert.ok(result.includes('postgresql'), 'should detect postgresql from asyncpg');
+      } finally {
+        teardown(dir);
+      }
+    });
+
+    it('detects PostgreSQL via psycopg2-binary in requirements.txt', () => {
+      const dir = createTmpProject({
+        'requirements.txt': 'psycopg2-binary>=2.9.0',
+      });
+      try {
+        const detector = new TechnologyDetector();
+        const result = detector.detect(dir);
+        assert.ok(result.includes('postgresql'), 'should detect postgresql from psycopg2-binary');
+      } finally {
+        teardown(dir);
+      }
+    });
+
+    it('detects PostgreSQL via pyproject.toml', () => {
+      const dir = createTmpProject({
+        'pyproject.toml': '[project]\ndependencies = ["asyncpg>=0.29"]',
+      });
+      try {
+        const detector = new TechnologyDetector();
+        const result = detector.detect(dir);
+        assert.ok(result.includes('postgresql'), 'should detect postgresql from pyproject.toml');
+      } finally {
+        teardown(dir);
+      }
+    });
+  });
+
+  describe('detect() — Docker', () => {
+    it('detects Docker via Dockerfile', () => {
+      const dir = createTmpProject({
+        'Dockerfile': 'FROM node:18-alpine\nRUN echo "hello"',
+      });
+      try {
+        const detector = new TechnologyDetector();
+        const result = detector.detect(dir);
+        assert.ok(result.includes('docker'), 'should detect docker from Dockerfile');
+      } finally {
+        teardown(dir);
+      }
+    });
+
+    it('detects Docker via docker-compose.yml', () => {
+      const dir = createTmpProject({
+        'docker-compose.yml': 'version: "3.8"\nservices:\n  web:\n    image: node:18',
+      });
+      try {
+        const detector = new TechnologyDetector();
+        const result = detector.detect(dir);
+        assert.ok(result.includes('docker'), 'should detect docker from docker-compose.yml');
+      } finally {
+        teardown(dir);
+      }
+    });
+  });
+
+  describe('detect() — case insensitivity', () => {
+    it('detects celery in mixed-case requirements.txt', () => {
+      const dir = createTmpProject({
+        'requirements.txt': 'CELERY>=5.3.0\nREDIS>=5.0.0',
+      });
+      try {
+        const detector = new TechnologyDetector();
+        const result = detector.detect(dir);
+        assert.ok(result.includes('celery'), 'should detect celery case-insensitively');
+        assert.ok(result.includes('redis'), 'should detect redis case-insensitively');
+      } finally {
+        teardown(dir);
+      }
+    });
+
+    it('detects CELERY in pyproject.toml', () => {
+      const dir = createTmpProject({
+        'pyproject.toml': '[project]\ndependencies = ["CELERY>=5.3"]',
+      });
+      try {
+        const detector = new TechnologyDetector();
+        const result = detector.detect(dir);
+        assert.ok(result.includes('celery'), 'should detect CELERY case-insensitively');
+      } finally {
+        teardown(dir);
+      }
+    });
+  });
+
+  describe('detect() — multiple technologies', () => {
+    it('detects all four technologies at once', () => {
+      const dir = createTmpProject({
+        'requirements.txt': 'celery>=5.3\nredis>=5.0\npsycopg2-binary>=2.9',
+        'Dockerfile': 'FROM python:3.11-alpine',
+      });
+      try {
+        const detector = new TechnologyDetector();
+        const result = detector.detect(dir);
+        assert.ok(result.includes('celery'), 'should detect celery');
+        assert.ok(result.includes('redis'), 'should detect redis');
+        assert.ok(result.includes('postgresql'), 'should detect postgresql');
+        assert.ok(result.includes('docker'), 'should detect docker');
+        assert.strictEqual(result.length, 4, 'should detect exactly 4 technologies');
+      } finally {
+        teardown(dir);
+      }
+    });
+
+    it('detects two technologies (celery + redis)', () => {
+      const dir = createTmpProject({
+        'requirements.txt': 'celery>=5.3\nredis>=5.0',
+      });
+      try {
+        const detector = new TechnologyDetector();
+        const result = detector.detect(dir);
+        assert.ok(result.includes('celery'), 'should detect celery');
+        assert.ok(result.includes('redis'), 'should detect redis');
+        assert.strictEqual(result.length, 2, 'should detect exactly 2 technologies');
+      } finally {
+        teardown(dir);
+      }
+    });
+  });
+
+  describe('detect() — no technology found', () => {
+    it('returns empty array when no tech signatures are present', () => {
+      const dir = createTmpProject({
+        'README.md': '# My Project\nJust a simple project.',
+        'package.json': JSON.stringify({ name: 'myapp', version: '1.0.0' }),
+      });
+      try {
+        const detector = new TechnologyDetector();
+        const result = detector.detect(dir);
+        assert.ok(Array.isArray(result), 'should return an array');
+        assert.strictEqual(result.length, 0, 'should return empty array');
+      } finally {
+        teardown(dir);
+      }
+    });
+
+    it('returns empty array for non-existent directory', () => {
+      const detector = new TechnologyDetector();
+      const result = detector.detect('/non/existent/path');
+      assert.ok(Array.isArray(result), 'should return an array');
+      assert.strictEqual(result.length, 0, 'should return empty array');
+    });
+  });
+
+  describe('getToolsForTech()', () => {
+    it('returns tool manifest for all four technologies', () => {
+      const detector = new TechnologyDetector();
+      const tools = detector.getToolsForTech(['celery', 'redis', 'postgresql', 'docker']);
+      assert.strictEqual(tools.length, 4, 'should return 4 tools');
+      const names = tools.map((t) => t.name);
+      assert.ok(names.includes('celery_guard'));
+      assert.ok(names.includes('redis_guard'));
+      assert.ok(names.includes('postgres_guard'));
+      assert.ok(names.includes('docker_guard'));
+    });
+
+    it('returns empty array for empty input', () => {
+      const detector = new TechnologyDetector();
+      const tools = detector.getToolsForTech([]);
+      assert.strictEqual(tools.length, 0, 'should return empty array');
+    });
+
+    it('celery_guard has correct structure', () => {
+      const detector = new TechnologyDetector();
+      const tools = detector.getToolsForTech(['celery']);
+      assert.strictEqual(tools[0].name, 'celery_guard');
+      assert.strictEqual(tools[0].language, 'py');
+      assert.strictEqual(tools[0].path, 'celery_guard.py');
+    });
+  });
+});

package/test/technologies/docker_guard.test.js

@@ -0,0 +1,187 @@
+/**
+ * CLC Forge — Docker guard integration tests.
+ * Tests docker_guard.py via subprocess against fixture projects.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const { spawn, spawnSync } = require('child_process');
+const path = require('path');
+const fs = require('fs');
+const { createTmpProject, teardown } = require('../helpers');
+
+function runDockerGuard(targetDir) {
+  return new Promise((resolve, reject) => {
+    const script = path.join(__dirname, '../../tools/docker_guard.py');
+    const proc = spawn('python3', [script, targetDir], { cwd: targetDir });
+    let stdout = '';
+    proc.stdout.on('data', (d) => (stdout += d));
+    proc.on('close', () => {
+      try {
+        resolve(JSON.parse(stdout));
+      } catch {
+        reject(new Error(`Failed to parse: ${stdout}`));
+      }
+    });
+    proc.on('error', reject);
+  });
+}
+
+function initGitRepo(dir) {
+  fs.writeFileSync(path.join(dir, '.gitkeep'), '');
+  spawnSync('git', ['init'], { cwd: dir });
+  spawnSync('git', ['config', 'user.email', 'test@test.com'], { cwd: dir });
+  spawnSync('git', ['config', 'user.name', 'Test'], { cwd: dir });
+  spawnSync('git', ['add', '.'], { cwd: dir });
+  spawnSync('git', ['commit', '-m', 'initial'], { cwd: dir });
+}
+
+describe('docker_guard', () => {
+  it('skips when no git repo', async () => {
+    const dir = createTmpProject({});
+    try {
+      const result = await runDockerGuard(dir);
+      assert.strictEqual(result.skipped, true);
+    } finally {
+      teardown(dir);
+    }
+  });
+
+  it('finds violations: missing USER directive', async () => {
+    const dir = createTmpProject({});
+    initGitRepo(dir);
+
+    fs.writeFileSync(
+      path.join(dir, 'Dockerfile'),
+      `FROM node:18-alpine\nRUN apk add --no-cache python3\nCMD ["node", "server.js"]\n`
+    );
+    spawnSync('git', ['add', 'Dockerfile'], { cwd: dir });
+
+    try {
+      const result = await runDockerGuard(dir);
+      assert.strictEqual(result.exit_code, 1);
+      const issues = result.data.findings.map((f) => f.issue);
+      assert.ok(issues.includes('missing_user'), 'should detect missing USER directive');
+    } finally {
+      teardown(dir);
+    }
+  });
+
+  it('finds violations: USER runs as root', async () => {
+    const dir = createTmpProject({});
+    initGitRepo(dir);
+
+    fs.writeFileSync(
+      path.join(dir, 'Dockerfile'),
+      `FROM node:18-alpine\nUSER root\nCMD ["node", "server.js"]\n`
+    );
+    spawnSync('git', ['add', 'Dockerfile'], { cwd: dir });
+
+    try {
+      const result = await runDockerGuard(dir);
+      assert.strictEqual(result.exit_code, 1);
+      const issues = result.data.findings.map((f) => f.issue);
+      assert.ok(issues.includes('user_is_root'), 'should detect root USER');
+    } finally {
+      teardown(dir);
+    }
+  });
+
+  it('finds violations: missing HEALTHCHECK', async () => {
+    const dir = createTmpProject({});
+    initGitRepo(dir);
+
+    fs.writeFileSync(
+      path.join(dir, 'Dockerfile'),
+      `FROM node:18-alpine\nUSER node\nCMD ["node", "server.js"]\n`
+    );
+    spawnSync('git', ['add', 'Dockerfile'], { cwd: dir });
+
+    try {
+      const result = await runDockerGuard(dir);
+      assert.strictEqual(result.exit_code, 1);
+      const issues = result.data.findings.map((f) => f.issue);
+      assert.ok(issues.includes('missing_healthcheck'), 'should detect missing HEALTHCHECK');
+    } finally {
+      teardown(dir);
+    }
+  });
+
+  it('finds violations: ENV secret exposure', async () => {
+    const dir = createTmpProject({});
+    initGitRepo(dir);
+
+    fs.writeFileSync(
+      path.join(dir, 'Dockerfile'),
+      `FROM node:18-alpine\nENV AWS_SECRET_ACCESS_KEY=abcd1234\nENV DB_PASSWORD=secret\nUSER node\nHEALTHCHECK --interval=30s CMD curl -f http://localhost/ || exit 1\nCMD ["node", "server.js"]\n`
+    );
+    spawnSync('git', ['add', 'Dockerfile'], { cwd: dir });
+
+    try {
+      const result = await runDockerGuard(dir);
+      assert.strictEqual(result.exit_code, 1);
+      const issues = result.data.findings.map((f) => f.issue);
+      assert.ok(issues.includes('env_secret'), 'should detect ENV secrets');
+    } finally {
+      teardown(dir);
+    }
+  });
+
+  it('finds violations: docker-compose env secret', async () => {
+    const dir = createTmpProject({});
+    initGitRepo(dir);
+
+    fs.writeFileSync(
+      path.join(dir, 'docker-compose.yml'),
+      `version: "3.8"\nservices:\n  web:\n    image: node:18\n    environment:\n      - DB_PASSWORD="secret123"\n      - API_KEY="key456"\n`
+    );
+    spawnSync('git', ['add', 'docker-compose.yml'], { cwd: dir });
+
+    try {
+      const result = await runDockerGuard(dir);
+      assert.strictEqual(result.exit_code, 1);
+      const issues = result.data.findings.map((f) => f.issue);
+      assert.ok(issues.includes('compose_env_secret'), 'should detect compose env secrets');
+    } finally {
+      teardown(dir);
+    }
+  });
+
+  it('no violations: properly configured Dockerfile', async () => {
+    const dir = createTmpProject({});
+    initGitRepo(dir);
+
+    fs.writeFileSync(
+      path.join(dir, 'Dockerfile'),
+      `FROM node:18-alpine\nUSER node\nHEALTHCHECK --interval=30s CMD curl -f http://localhost/ || exit 1\nCMD ["node", "server.js"]\n`
+    );
+    spawnSync('git', ['add', 'Dockerfile'], { cwd: dir });
+
+    try {
+      const result = await runDockerGuard(dir);
+      assert.strictEqual(result.exit_code, 0);
+      assert.strictEqual(result.data.findings.length, 0, 'should have no findings');
+    } finally {
+      teardown(dir);
+    }
+  });
+
+  it('no violations: no docker files in project', async () => {
+    const dir = createTmpProject({});
+    initGitRepo(dir);
+
+    fs.writeFileSync(
+      path.join(dir, 'main.py'),
+      `def hello():\n    return "world"\n`
+    );
+    spawnSync('git', ['add', 'main.py'], { cwd: dir });
+
+    try {
+      const result = await runDockerGuard(dir);
+      assert.strictEqual(result.exit_code, 0);
+      assert.strictEqual(result.data.findings.length, 0, 'should have no findings');
+    } finally {
+      teardown(dir);
+    }
+  });
+});

package/test/technologies/integration.test.js

@@ -0,0 +1,123 @@
+/**
+ * CLC Forge — Technology detection integration tests.
+ * Tests the full autoDetectStack pipeline with Phase-1 technology signatures.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const path = require('path');
+const { autoDetectStack } = require('../../src/detector');
+const { createTmpProject, teardown } = require('../helpers');
+
+describe('TechnologyDetector integration', () => {
+  describe('autoDetectStack — techTools for Celery project', () => {
+    it('populates techTools with celery_guard for a Django+Celery project', () => {
+      const dir = createTmpProject({
+        'manage.py': '',
+        'requirements.txt': 'celery>=5.3\ndjango>=4.0\npsycopg2-binary',
+      });
+      try {
+        const config = autoDetectStack(dir);
+        assert.ok(config.techTools, 'techTools should be populated');
+        const names = config.techTools.map((t) => t.name);
+        assert.ok(names.includes('celery_guard'), 'should include celery_guard');
+        assert.ok(names.includes('postgres_guard'), 'should include postgres_guard');
+        assert.strictEqual(names.includes('redis_guard'), false, 'should not include redis_guard');
+        assert.strictEqual(names.includes('docker_guard'), false, 'should not include docker_guard');
+      } finally {
+        teardown(dir);
+      }
+    });
+
+    it('populates techTools with all four guards for full-stack project', () => {
+      const dir = createTmpProject({
+        'manage.py': '',
+        'requirements.txt': 'celery>=5.3\nredis>=5.0\npsycopg2-binary\ndjango>=4.0',
+        'Dockerfile': 'FROM python:3.11-alpine',
+      });
+      try {
+        const config = autoDetectStack(dir);
+        assert.ok(Array.isArray(config.techTools), 'techTools should be an array');
+        const names = config.techTools.map((t) => t.name);
+        assert.strictEqual(names.includes('celery_guard'), true, 'should include celery_guard');
+        assert.strictEqual(names.includes('redis_guard'), true, 'should include redis_guard');
+        assert.strictEqual(names.includes('postgres_guard'), true, 'should include postgres_guard');
+        assert.strictEqual(names.includes('docker_guard'), true, 'should include docker_guard');
+        assert.strictEqual(config.techTools.length, 4, 'should have exactly 4 tech tools');
+      } finally {
+        teardown(dir);
+      }
+    });
+
+    it('populates techTools with docker_guard for Docker-only detection', () => {
+      const dir = createTmpProject({
+        'Dockerfile': 'FROM node:18-alpine\nCMD ["node", "server.js"]',
+        'package.json': JSON.stringify({ name: 'myapp', version: '1.0.0' }),
+      });
+      try {
+        const config = autoDetectStack(dir);
+        const names = config.techTools.map((t) => t.name);
+        assert.ok(names.includes('docker_guard'), 'should include docker_guard');
+        assert.strictEqual(config.techTools.length, 1, 'should have exactly 1 tech tool');
+      } finally {
+        teardown(dir);
+      }
+    });
+
+    it('returns empty techTools for project with no Phase-1 signatures', () => {
+      const dir = createTmpProject({
+        'package.json': JSON.stringify({ name: 'myapp', version: '1.0.0' }),
+        'README.md': '# My Project',
+      });
+      try {
+        const config = autoDetectStack(dir);
+        assert.ok(Array.isArray(config.techTools), 'techTools should be an array');
+        assert.strictEqual(config.techTools.length, 0, 'techTools should be empty');
+      } finally {
+        teardown(dir);
+      }
+    });
+
+    it('returns empty techTools for non-existent directory', () => {
+      const config = autoDetectStack('/non/existent/path');
+      assert.ok(Array.isArray(config.techTools));
+      assert.strictEqual(config.techTools.length, 0, 'techTools should be empty');
+    });
+
+    it('tool entries have correct language, path, command, and description', () => {
+      const dir = createTmpProject({
+        'Dockerfile': 'FROM node:18-alpine',
+        'package.json': JSON.stringify({ name: 'myapp' }),
+      });
+      try {
+        const config = autoDetectStack(dir);
+        const dockerTool = config.techTools.find((t) => t.name === 'docker_guard');
+        assert.ok(dockerTool, 'should have docker_guard tool');
+        assert.strictEqual(dockerTool.language, 'py', 'language should be py');
+        assert.strictEqual(dockerTool.path, 'docker_guard.py', 'path should be docker_guard.py');
+        assert.ok(dockerTool.command.startsWith('python3 tools/'), 'command should run python3');
+        assert.ok(dockerTool.description.length > 0, 'description should be non-empty');
+      } finally {
+        teardown(dir);
+      }
+    });
+
+    it('Redis + Docker project returns redis_guard and docker_guard', () => {
+      const dir = createTmpProject({
+        'requirements.txt': 'redis>=5.0\ncelery>=5.3',
+        'Dockerfile': 'FROM python:3.11-slim',
+        'docker-compose.yml': 'version: "3.8"\nservices:\n  app:\n    build: .',
+      });
+      try {
+        const config = autoDetectStack(dir);
+        const names = config.techTools.map((t) => t.name);
+        assert.ok(names.includes('celery_guard'), 'should include celery_guard');
+        assert.ok(names.includes('redis_guard'), 'should include redis_guard');
+        assert.ok(names.includes('docker_guard'), 'should include docker_guard');
+        assert.strictEqual(names.includes('postgres_guard'), false, 'should not include postgres_guard');
+      } finally {
+        teardown(dir);
+      }
+    });
+  });
+});