comisai 1.0.11 → 1.0.12

package/node_modules/@comis/core/dist/security/secrets-audit.test.js

@@ -1,295 +0,0 @@
-/**
- * Unit tests for secrets audit scanner.
- *
- * Tests scanConfigForSecrets, scanEnvForSecrets, and auditSecrets
- * covering config YAML scanning, .env scanning, SecretRef detection,
- * and combined audit scenarios.
- *
- * @module
- */
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
-import { writeFileSync, rmSync, mkdtempSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { scanConfigForSecrets, scanEnvForSecrets, auditSecrets, } from "./secrets-audit.js";
-// ── scanConfigForSecrets ───────────────────────────────────────────
-describe("scanConfigForSecrets", () => {
-    it("detects plaintext botToken string", () => {
-        const config = {
-            channels: {
-                telegram: {
-                    botToken: "123456:ABC-DEF",
-                    enabled: true,
-                },
-            },
-        };
-        const findings = scanConfigForSecrets("/etc/comis/config.yaml", config);
-        expect(findings).toHaveLength(1);
-        expect(findings[0]).toEqual({
-            code: "PLAINTEXT_SECRET",
-            severity: "error",
-            file: "/etc/comis/config.yaml",
-            jsonPath: "channels.telegram.botToken",
-            message: expect.stringContaining("Plaintext secret detected in field 'botToken'"),
-        });
-    });
-    it("skips SecretRef objects (properly configured)", () => {
-        const config = {
-            channels: {
-                telegram: {
-                    botToken: {
-                        source: "env",
-                        provider: "comis",
-                        id: "TELEGRAM_BOT_TOKEN",
-                    },
-                },
-            },
-        };
-        const findings = scanConfigForSecrets("/etc/comis/config.yaml", config);
-        expect(findings).toHaveLength(0);
-    });
-    it("skips empty string values", () => {
-        const config = {
-            channels: {
-                telegram: {
-                    botToken: "",
-                },
-            },
-        };
-        const findings = scanConfigForSecrets("/etc/comis/config.yaml", config);
-        expect(findings).toHaveLength(0);
-    });
-    it("detects multiple nested secrets", () => {
-        const config = {
-            channels: {
-                telegram: {
-                    botToken: "tg-token-value",
-                },
-                slack: {
-                    appToken: "xapp-slack-token",
-                },
-            },
-        };
-        const findings = scanConfigForSecrets("/config.yaml", config);
-        expect(findings).toHaveLength(2);
-        expect(findings[0].jsonPath).toBe("channels.telegram.botToken");
-        expect(findings[1].jsonPath).toBe("channels.slack.appToken");
-    });
-    it("does not flag non-secret fields", () => {
-        const config = {
-            channels: {
-                telegram: {
-                    enabled: true,
-                    chatId: "12345",
-                    pollingTimeout: 30,
-                },
-            },
-        };
-        const findings = scanConfigForSecrets("/config.yaml", config);
-        expect(findings).toHaveLength(0);
-    });
-    it("handles array bracket notation in jsonPath", () => {
-        const config = {
-            gateway: {
-                tokens: [
-                    { secret: "my-secret-token", label: "admin" },
-                ],
-            },
-        };
-        const findings = scanConfigForSecrets("/config.yaml", config);
-        expect(findings).toHaveLength(1);
-        expect(findings[0].jsonPath).toBe("gateway.tokens[0].secret");
-    });
-    it("handles deeply nested objects", () => {
-        const config = {
-            level1: {
-                level2: {
-                    level3: {
-                        apiKey: "deep-api-key",
-                    },
-                },
-            },
-        };
-        const findings = scanConfigForSecrets("/config.yaml", config);
-        expect(findings).toHaveLength(1);
-        expect(findings[0].jsonPath).toBe("level1.level2.level3.apiKey");
-    });
-    it("detects various secret field name patterns", () => {
-        const config = {
-            myPassword: "pass123",
-            someCredential: "cred456",
-            private_key: "key789",
-            api_key: "apikey000",
-        };
-        const findings = scanConfigForSecrets("/config.yaml", config);
-        expect(findings).toHaveLength(4);
-    });
-    it("handles empty config object", () => {
-        const findings = scanConfigForSecrets("/config.yaml", {});
-        expect(findings).toHaveLength(0);
-    });
-});
-// ── scanEnvForSecrets ──────────────────────────────────────────────
-describe("scanEnvForSecrets", () => {
-    it("detects ANTHROPIC_API_KEY", () => {
-        const env = {
-            ANTHROPIC_API_KEY: "sk-ant-test-key",
-        };
-        const findings = scanEnvForSecrets("/home/user/.comis/.env", env);
-        expect(findings).toHaveLength(1);
-        expect(findings[0]).toEqual({
-            code: "KNOWN_PROVIDER_ENV",
-            severity: "warn",
-            file: "/home/user/.comis/.env",
-            jsonPath: "ANTHROPIC_API_KEY",
-            message: expect.stringContaining("anthropic"),
-        });
-    });
-    it("skips PATH and HOME", () => {
-        const env = {
-            PATH: "/usr/bin:/usr/local/bin",
-            HOME: "/home/user",
-        };
-        const findings = scanEnvForSecrets("/.env", env);
-        expect(findings).toHaveLength(0);
-    });
-    it("skips COMIS_ prefixed vars", () => {
-        const env = {
-            COMIS_CONFIG_PATHS: "/etc/comis/config.yaml",
-        };
-        const findings = scanEnvForSecrets("/.env", env);
-        expect(findings).toHaveLength(0);
-    });
-    it("detects CUSTOM_API_KEY via wildcard pattern", () => {
-        const env = {
-            CUSTOM_API_KEY: "custom-key-value",
-        };
-        const findings = scanEnvForSecrets("/.env", env);
-        expect(findings).toHaveLength(1);
-        expect(findings[0].code).toBe("KNOWN_PROVIDER_ENV");
-        expect(findings[0].message).toContain("unknown");
-    });
-    it("skips empty values", () => {
-        const env = {
-            OPENAI_API_KEY: "",
-        };
-        const findings = scanEnvForSecrets("/.env", env);
-        expect(findings).toHaveLength(0);
-    });
-    it("skips undefined values", () => {
-        const env = {
-            OPENAI_API_KEY: undefined,
-        };
-        const findings = scanEnvForSecrets("/.env", env);
-        expect(findings).toHaveLength(0);
-    });
-    it("detects multiple known providers", () => {
-        const env = {
-            OPENAI_API_KEY: "sk-test",
-            DISCORD_BOT_TOKEN: "discord-token",
-            SLACK_SIGNING_SECRET: "slack-secret",
-        };
-        const findings = scanEnvForSecrets("/.env", env);
-        expect(findings).toHaveLength(3);
-        const providers = findings.map(f => f.message);
-        expect(providers.some(m => m.includes("openai"))).toBe(true);
-        expect(providers.some(m => m.includes("discord"))).toBe(true);
-        expect(providers.some(m => m.includes("slack"))).toBe(true);
-    });
-    it("skips NODE_ prefixed vars", () => {
-        const env = {
-            NODE_ENV: "production",
-            NODE_OPTIONS: "--max-old-space-size=4096",
-        };
-        const findings = scanEnvForSecrets("/.env", env);
-        expect(findings).toHaveLength(0);
-    });
-});
-// ── auditSecrets ───────────────────────────────────────────────────
-describe("auditSecrets", () => {
-    let tempDir;
-    beforeEach(() => {
-        tempDir = mkdtempSync(join(tmpdir(), "comis-audit-test-"));
-    });
-    afterEach(() => {
-        rmSync(tempDir, { recursive: true, force: true });
-    });
-    it("returns empty array when no files exist", () => {
-        const findings = auditSecrets({
-            configPaths: [join(tempDir, "nonexistent.yaml")],
-            envPath: join(tempDir, "nonexistent.env"),
-        });
-        expect(findings).toEqual([]);
-    });
-    it("returns empty array for empty config paths", () => {
-        const findings = auditSecrets({
-            configPaths: [],
-        });
-        expect(findings).toEqual([]);
-    });
-    it("scans YAML config file for plaintext secrets", () => {
-        const configPath = join(tempDir, "config.yaml");
-        writeFileSync(configPath, `
-channels:
-  telegram:
-    botToken: "plaintext-token"
-    enabled: true
-`);
-        const findings = auditSecrets({
-            configPaths: [configPath],
-        });
-        expect(findings).toHaveLength(1);
-        expect(findings[0].code).toBe("PLAINTEXT_SECRET");
-        expect(findings[0].jsonPath).toBe("channels.telegram.botToken");
-    });
-    it("scans .env file for known provider secrets", () => {
-        const envPath = join(tempDir, ".env");
-        writeFileSync(envPath, `
-ANTHROPIC_API_KEY=sk-ant-test
-OPENAI_API_KEY=sk-test
-NODE_ENV=production
-`);
-        const findings = auditSecrets({
-            configPaths: [],
-            envPath,
-        });
-        expect(findings).toHaveLength(2);
-        expect(findings.every(f => f.code === "KNOWN_PROVIDER_ENV")).toBe(true);
-    });
-    it("sorts findings by severity (errors first, then warnings)", () => {
-        const configPath = join(tempDir, "config.yaml");
-        writeFileSync(configPath, `
-channels:
-  telegram:
-    botToken: "plaintext-token"
-`);
-        const envPath = join(tempDir, ".env");
-        writeFileSync(envPath, `OPENAI_API_KEY=sk-test`);
-        const findings = auditSecrets({
-            configPaths: [configPath],
-            envPath,
-        });
-        expect(findings).toHaveLength(2);
-        expect(findings[0].severity).toBe("error");
-        expect(findings[1].severity).toBe("warn");
-    });
-    it("handles quoted values in .env", () => {
-        const envPath = join(tempDir, ".env");
-        writeFileSync(envPath, `ANTHROPIC_API_KEY="sk-ant-quoted"`);
-        const findings = auditSecrets({
-            configPaths: [],
-            envPath,
-        });
-        expect(findings).toHaveLength(1);
-    });
-    it("gracefully handles invalid YAML", () => {
-        const configPath = join(tempDir, "bad.yaml");
-        writeFileSync(configPath, "{{invalid yaml: [}");
-        // Should not throw
-        const findings = auditSecrets({
-            configPaths: [configPath],
-        });
-        // Findings may be empty or contain whatever the parser manages to extract
-        expect(Array.isArray(findings)).toBe(true);
-    });
-});

package/node_modules/@comis/core/dist/security/ssrf-guard.test.d.ts

@@ -1 +0,0 @@
-export {};

package/node_modules/@comis/core/dist/security/ssrf-guard.test.js

@@ -1,127 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-import { validateUrl, BLOCKED_RANGES, CLOUD_METADATA_IPS } from "./ssrf-guard.js";
-// Mock dns/promises so we get deterministic results without real DNS
-vi.mock("node:dns/promises", () => ({
-    lookup: vi.fn(),
-}));
-// Import the mock after vi.mock
-import { lookup } from "node:dns/promises";
-const mockLookup = vi.mocked(lookup);
-beforeEach(() => {
-    vi.clearAllMocks();
-});
-describe("SSRF Guard", () => {
-    describe("exports", () => {
-        it("exports BLOCKED_RANGES with expected entries", () => {
-            expect(BLOCKED_RANGES).toContain("private");
-            expect(BLOCKED_RANGES).toContain("loopback");
-            expect(BLOCKED_RANGES).toContain("linkLocal");
-            expect(BLOCKED_RANGES).toContain("uniqueLocal");
-            expect(BLOCKED_RANGES).toContain("unspecified");
-            expect(BLOCKED_RANGES).toContain("reserved");
-        });
-        it("exports CLOUD_METADATA_IPS with known addresses", () => {
-            expect(CLOUD_METADATA_IPS).toContain("169.254.169.254");
-            expect(CLOUD_METADATA_IPS).toContain("169.254.170.2");
-            expect(CLOUD_METADATA_IPS).toContain("100.100.100.200");
-        });
-    });
-    describe("validateUrl", () => {
-        it("blocks loopback addresses (127.0.0.1)", async () => {
-            mockLookup.mockResolvedValue({ address: "127.0.0.1", family: 4 });
-            const result = await validateUrl("http://127.0.0.1/secret");
-            expect(result.ok).toBe(false);
-            if (!result.ok) {
-                expect(result.error.message).toContain("loopback");
-            }
-        });
-        it("blocks private addresses (192.168.x.x)", async () => {
-            mockLookup.mockResolvedValue({ address: "192.168.1.1", family: 4 });
-            const result = await validateUrl("http://192.168.1.1/admin");
-            expect(result.ok).toBe(false);
-            if (!result.ok) {
-                expect(result.error.message).toContain("private");
-            }
-        });
-        it("blocks private addresses (10.x.x.x)", async () => {
-            mockLookup.mockResolvedValue({ address: "10.0.0.1", family: 4 });
-            const result = await validateUrl("http://10.0.0.1/internal");
-            expect(result.ok).toBe(false);
-            if (!result.ok) {
-                expect(result.error.message).toContain("private");
-            }
-        });
-        it("blocks cloud metadata addresses (169.254.169.254)", async () => {
-            mockLookup.mockResolvedValue({ address: "169.254.169.254", family: 4 });
-            const result = await validateUrl("http://169.254.169.254/latest/meta-data/");
-            expect(result.ok).toBe(false);
-            if (!result.ok) {
-                expect(result.error.message).toMatch(/cloud metadata|linkLocal/i);
-            }
-        });
-        it("blocks non-http protocols (ftp)", async () => {
-            const result = await validateUrl("ftp://example.com");
-            expect(result.ok).toBe(false);
-            if (!result.ok) {
-                expect(result.error.message).toContain("Blocked protocol");
-            }
-        });
-        it("rejects invalid URLs", async () => {
-            const result = await validateUrl("not-a-url");
-            expect(result.ok).toBe(false);
-            if (!result.ok) {
-                expect(result.error.message).toContain("Invalid URL");
-            }
-        });
-        it("allows public IPs (example.com resolving to 93.184.216.34)", async () => {
-            mockLookup.mockResolvedValue({ address: "93.184.216.34", family: 4 });
-            const result = await validateUrl("https://example.com");
-            expect(result.ok).toBe(true);
-            if (result.ok) {
-                expect(result.value.hostname).toBe("example.com");
-                expect(result.value.ip).toBe("93.184.216.34");
-                expect(result.value.url.protocol).toBe("https:");
-            }
-        });
-        it("blocks IPv6 loopback (::1)", async () => {
-            mockLookup.mockResolvedValue({ address: "::1", family: 6 });
-            const result = await validateUrl("http://[::1]/secret");
-            expect(result.ok).toBe(false);
-            if (!result.ok) {
-                expect(result.error.message).toContain("loopback");
-            }
-        });
-        it("handles DNS resolution failures gracefully", async () => {
-            mockLookup.mockRejectedValue(new Error("getaddrinfo ENOTFOUND bad.invalid"));
-            const result = await validateUrl("http://bad.invalid");
-            expect(result.ok).toBe(false);
-            if (!result.ok) {
-                expect(result.error.message).toContain("ENOTFOUND");
-            }
-        });
-        it("blocks Alibaba Cloud metadata (100.100.100.200)", async () => {
-            mockLookup.mockResolvedValue({ address: "100.100.100.200", family: 4 });
-            const result = await validateUrl("http://metadata.tencentyun.com/");
-            expect(result.ok).toBe(false);
-            if (!result.ok) {
-                expect(result.error.message).toContain("cloud metadata");
-            }
-        });
-        it("blocks AWS ECS metadata (169.254.170.2)", async () => {
-            mockLookup.mockResolvedValue({ address: "169.254.170.2", family: 4 });
-            const result = await validateUrl("http://169.254.170.2/v2/metadata");
-            expect(result.ok).toBe(false);
-            if (!result.ok) {
-                expect(result.error.message).toMatch(/cloud metadata|linkLocal/i);
-            }
-        });
-        it("blocks unspecified address (0.0.0.0)", async () => {
-            mockLookup.mockResolvedValue({ address: "0.0.0.0", family: 4 });
-            const result = await validateUrl("http://0.0.0.0/");
-            expect(result.ok).toBe(false);
-            if (!result.ok) {
-                expect(result.error.message).toContain("unspecified");
-            }
-        });
-    });
-});

package/node_modules/@comis/core/dist/security/token-generator.test.d.ts

@@ -1 +0,0 @@
-export {};

package/node_modules/@comis/core/dist/security/token-generator.test.js

@@ -1,35 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { generateStrongToken, generateRotationId } from "./token-generator.js";
-describe("generateStrongToken", () => {
-    it("returns a string of exactly 64 characters", () => {
-        const token = generateStrongToken();
-        expect(token).toHaveLength(64);
-    });
-    it("output is URL-safe (base64url characters only)", () => {
-        const token = generateStrongToken();
-        expect(token).toMatch(/^[A-Za-z0-9_-]+$/);
-    });
-    it("produces different values on successive calls", () => {
-        const token1 = generateStrongToken();
-        const token2 = generateStrongToken();
-        expect(token1).not.toBe(token2);
-    });
-});
-describe("generateRotationId", () => {
-    it("returns baseId-{suffix} where suffix is 11 chars", () => {
-        const result = generateRotationId("my-token");
-        const parts = result.split("my-token-");
-        expect(parts).toHaveLength(2);
-        expect(parts[1]).toHaveLength(11);
-    });
-    it("produces different suffixes for the same baseId on successive calls", () => {
-        const id1 = generateRotationId("tok");
-        const id2 = generateRotationId("tok");
-        expect(id1).not.toBe(id2);
-    });
-    it("preserves the baseId prefix exactly", () => {
-        const baseId = "complex-base-id-123";
-        const result = generateRotationId(baseId);
-        expect(result.startsWith(`${baseId}-`)).toBe(true);
-    });
-});

package/node_modules/@comis/core/dist/tool-metadata.test.d.ts

@@ -1 +0,0 @@
-export {};

package/node_modules/@comis/core/dist/tool-metadata.test.js

@@ -1,112 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { registerToolMetadata, getToolMetadata, getAllToolMetadata, truncateContentBlocks, _clearRegistryForTest, } from "./tool-metadata.js";
-// ---------------------------------------------------------------------------
-// Registry tests
-// ---------------------------------------------------------------------------
-describe("tool metadata registry", () => {
-    it("getToolMetadata returns undefined for unregistered tool", () => {
-        expect(getToolMetadata("nonexistent_tool_xyz")).toBeUndefined();
-    });
-    it("registerToolMetadata stores and retrieves metadata", () => {
-        registerToolMetadata("reg_test_store", {
-            maxResultSizeChars: 5000,
-            isReadOnly: true,
-        });
-        const meta = getToolMetadata("reg_test_store");
-        expect(meta).toBeDefined();
-        expect(meta.maxResultSizeChars).toBe(5000);
-        expect(meta.isReadOnly).toBe(true);
-    });
-    it("registerToolMetadata merges metadata incrementally", () => {
-        registerToolMetadata("reg_test_merge", { isReadOnly: true });
-        registerToolMetadata("reg_test_merge", { maxResultSizeChars: 10000 });
-        const meta = getToolMetadata("reg_test_merge");
-        expect(meta).toEqual({ isReadOnly: true, maxResultSizeChars: 10000 });
-    });
-    it("registerToolMetadata overwrites fields on re-register", () => {
-        registerToolMetadata("reg_test_overwrite", { maxResultSizeChars: 5000 });
-        registerToolMetadata("reg_test_overwrite", { maxResultSizeChars: 10000 });
-        const meta = getToolMetadata("reg_test_overwrite");
-        expect(meta.maxResultSizeChars).toBe(10000);
-    });
-    it("getAllToolMetadata returns ReadonlyMap", () => {
-        registerToolMetadata("reg_test_all_a", { isReadOnly: true });
-        registerToolMetadata("reg_test_all_b", { maxResultSizeChars: 2000 });
-        const all = getAllToolMetadata();
-        expect(all.has("reg_test_all_a")).toBe(true);
-        expect(all.has("reg_test_all_b")).toBe(true);
-    });
-    it("_clearRegistryForTest clears all entries", () => {
-        registerToolMetadata("reg_test_clear", { isReadOnly: true });
-        expect(getToolMetadata("reg_test_clear")).toBeDefined();
-        _clearRegistryForTest();
-        expect(getToolMetadata("reg_test_clear")).toBeUndefined();
-        // Clean up (registry already clear, but be explicit)
-        _clearRegistryForTest();
-    });
-});
-// ---------------------------------------------------------------------------
-// Truncation tests
-// ---------------------------------------------------------------------------
-describe("truncateContentBlocks", () => {
-    it("returns original array when total chars under budget", () => {
-        const content = [{ type: "text", text: "x".repeat(100) }];
-        const result = truncateContentBlocks(content, 200);
-        expect(result).toBe(content); // Same reference
-    });
-    it("returns original array when total chars equal to budget", () => {
-        const content = [{ type: "text", text: "x".repeat(100) }];
-        const result = truncateContentBlocks(content, 100);
-        expect(result).toBe(content); // Same reference
-    });
-    it("truncates text blocks proportionally with 60/40 split", () => {
-        const content = [{ type: "text", text: "x".repeat(10000) }];
-        const result = truncateContentBlocks(content, 2000);
-        expect(result[0].text).toContain("chars truncated");
-        // Verify the truncated text has head (60%) + marker + tail (40%) structure
-        const text = result[0].text;
-        const markerIdx = text.indexOf("\n[...");
-        expect(markerIdx).toBeGreaterThan(0);
-        // Head should be roughly 60% of budget (2000 * 0.6 = 1200)
-        expect(markerIdx).toBeGreaterThanOrEqual(1100);
-        expect(markerIdx).toBeLessThanOrEqual(1300);
-    });
-    it("preserves non-text blocks unchanged", () => {
-        const imageBlock = { type: "image", url: "https://example.com/img.png" };
-        const textBlock = { type: "text", text: "x".repeat(5000) };
-        const content = [imageBlock, textBlock];
-        const result = truncateContentBlocks(content, 1000);
-        // Image block should be the exact same object reference
-        expect(result[0]).toBe(imageBlock);
-        // Text block should be truncated
-        expect(result[1].text).toContain("chars truncated");
-    });
-    it("enforces 500-char minimum per block", () => {
-        const content = [
-            { type: "text", text: "x".repeat(8000) },
-            { type: "text", text: "y".repeat(200) },
-        ];
-        const result = truncateContentBlocks(content, 100);
-        // The small block (200 chars) gets minimum budget of 500, which is > its length
-        // so it should NOT be truncated (200 < 500 min budget)
-        expect(result[1].text).toBe("y".repeat(200));
-    });
-    it("marker text includes char count and guidance", () => {
-        const content = [{ type: "text", text: "x".repeat(10000) }];
-        const result = truncateContentBlocks(content, 2000);
-        const text = result[0].text;
-        expect(text).toContain("chars truncated");
-        expect(text).toContain("Reduce output scope");
-    });
-    it("handles empty content array", () => {
-        const content = [];
-        const result = truncateContentBlocks(content, 1000);
-        expect(result).toBe(content); // Same reference
-    });
-    it("handles blocks with no text field", () => {
-        const content = [{ type: "text" }]; // no text property
-        const result = truncateContentBlocks(content, 100);
-        // Total chars is 0 (no text), 0 <= 100, returns original
-        expect(result).toBe(content);
-    });
-});

package/node_modules/@comis/memory/dist/compaction.test.d.ts

@@ -1 +0,0 @@
-export {};