comisai 1.0.11 → 1.0.13

package/node_modules/@comis/core/dist/security/scoped-secret-manager.test.js

@@ -1,231 +0,0 @@
-import { describe, it, expect, beforeEach } from "vitest";
-import { createSecretManager } from "./secret-manager.js";
-import { createScopedSecretManager } from "./scoped-secret-manager.js";
-import { TypedEventBus } from "../event-bus/index.js";
-describe("ScopedSecretManager", () => {
-    const baseSecrets = {
-        OPENAI_API_KEY: "sk-test",
-        ANTHROPIC_API_KEY: "ak-test",
-        STRIPE_KEY: "sk_live_test",
-        UNRELATED: "value",
-    };
-    let base;
-    let bus;
-    let events;
-    beforeEach(() => {
-        base = createSecretManager(baseSecrets);
-        bus = new TypedEventBus();
-        events = [];
-        bus.on("secret:accessed", (e) => events.push(e));
-    });
-    it("get() delegates to base when pattern matches", () => {
-        const scoped = createScopedSecretManager(base, {
-            agentId: "agent-1",
-            allowPatterns: ["openai_*"],
-            eventBus: bus,
-        });
-        const value = scoped.get("OPENAI_API_KEY");
-        expect(value).toBe("sk-test");
-        expect(events).toHaveLength(1);
-        expect(events[0].outcome).toBe("success");
-    });
-    it("get() returns undefined when pattern denies", () => {
-        const scoped = createScopedSecretManager(base, {
-            agentId: "agent-1",
-            allowPatterns: ["openai_*"],
-            eventBus: bus,
-        });
-        const value = scoped.get("STRIPE_KEY");
-        expect(value).toBeUndefined();
-        expect(events).toHaveLength(1);
-        expect(events[0].outcome).toBe("denied");
-    });
-    it("get() emits not_found when base has no value", () => {
-        const scoped = createScopedSecretManager(base, {
-            agentId: "agent-1",
-            allowPatterns: ["openai_*"],
-            eventBus: bus,
-        });
-        const value = scoped.get("OPENAI_OTHER");
-        expect(value).toBeUndefined();
-        expect(events).toHaveLength(1);
-        expect(events[0].outcome).toBe("not_found");
-    });
-    it("has() returns false when pattern denies", () => {
-        const scoped = createScopedSecretManager(base, {
-            agentId: "agent-1",
-            allowPatterns: ["openai_*"],
-            eventBus: bus,
-        });
-        const result = scoped.has("STRIPE_KEY");
-        expect(result).toBe(false);
-        expect(events).toHaveLength(1);
-        expect(events[0].outcome).toBe("denied");
-    });
-    it("has() delegates when pattern allows", () => {
-        const scoped = createScopedSecretManager(base, {
-            agentId: "agent-1",
-            allowPatterns: ["openai_*"],
-            eventBus: bus,
-        });
-        const result = scoped.has("OPENAI_API_KEY");
-        expect(result).toBe(true);
-        expect(events).toHaveLength(1);
-        expect(events[0].outcome).toBe("success");
-    });
-    it("require() throws when pattern denies", () => {
-        const scoped = createScopedSecretManager(base, {
-            agentId: "agent-1",
-            allowPatterns: ["openai_*"],
-            eventBus: bus,
-        });
-        expect(() => scoped.require("STRIPE_KEY")).toThrow("not allowed");
-        expect(events).toHaveLength(1);
-        expect(events[0].outcome).toBe("denied");
-    });
-    it("require() throws when key not found in base", () => {
-        const scoped = createScopedSecretManager(base, {
-            agentId: "agent-1",
-            allowPatterns: ["openai_*"],
-            eventBus: bus,
-        });
-        expect(() => scoped.require("OPENAI_MISSING")).toThrow("not set");
-        expect(events).toHaveLength(1);
-        expect(events[0].outcome).toBe("not_found");
-    });
-    it("require() returns value when allowed and exists", () => {
-        const scoped = createScopedSecretManager(base, {
-            agentId: "agent-1",
-            allowPatterns: ["openai_*"],
-            eventBus: bus,
-        });
-        const value = scoped.require("OPENAI_API_KEY");
-        expect(value).toBe("sk-test");
-        expect(events).toHaveLength(1);
-        expect(events[0].outcome).toBe("success");
-    });
-    it("keys() filters by allow patterns", () => {
-        const scoped = createScopedSecretManager(base, {
-            agentId: "agent-1",
-            allowPatterns: ["openai_*", "anthropic_*"],
-            eventBus: bus,
-        });
-        const keys = scoped.keys();
-        expect(keys).toEqual(["OPENAI_API_KEY", "ANTHROPIC_API_KEY"]);
-        // keys() is a listing operation — no events emitted
-        expect(events).toHaveLength(0);
-    });
-    it("empty allow patterns = unrestricted access", () => {
-        const scoped = createScopedSecretManager(base, {
-            agentId: "agent-1",
-            allowPatterns: [],
-            eventBus: bus,
-        });
-        expect(scoped.get("OPENAI_API_KEY")).toBe("sk-test");
-        expect(scoped.get("STRIPE_KEY")).toBe("sk_live_test");
-        expect(scoped.has("UNRELATED")).toBe(true);
-        expect(scoped.require("ANTHROPIC_API_KEY")).toBe("ak-test");
-        expect(scoped.keys()).toEqual(expect.arrayContaining([
-            "OPENAI_API_KEY",
-            "ANTHROPIC_API_KEY",
-            "STRIPE_KEY",
-            "UNRELATED",
-        ]));
-        // All access events should be "success"
-        expect(events.every((e) => e.outcome === "success")).toBe(true);
-    });
-    it("works without eventBus (no audit events)", () => {
-        const scoped = createScopedSecretManager(base, {
-            agentId: "agent-1",
-            allowPatterns: ["openai_*"],
-            // eventBus intentionally omitted
-        });
-        // All methods should work without crashing
-        expect(scoped.get("OPENAI_API_KEY")).toBe("sk-test");
-        expect(scoped.get("STRIPE_KEY")).toBeUndefined();
-        expect(scoped.has("OPENAI_API_KEY")).toBe(true);
-        expect(scoped.has("STRIPE_KEY")).toBe(false);
-        expect(scoped.require("OPENAI_API_KEY")).toBe("sk-test");
-        expect(() => scoped.require("STRIPE_KEY")).toThrow("not allowed");
-        expect(scoped.keys()).toEqual(["OPENAI_API_KEY"]);
-        // No events emitted to the bus we set up separately
-        expect(events).toHaveLength(0);
-    });
-    it("event payload includes agentId and timestamp", () => {
-        const scoped = createScopedSecretManager(base, {
-            agentId: "agent-audit-test",
-            allowPatterns: ["openai_*"],
-            eventBus: bus,
-        });
-        scoped.get("OPENAI_API_KEY");
-        expect(events).toHaveLength(1);
-        const event = events[0];
-        expect(event.agentId).toBe("agent-audit-test");
-        expect(event.secretName).toBe("OPENAI_API_KEY");
-        expect(event.outcome).toBe("success");
-        expect(typeof event.timestamp).toBe("number");
-        expect(event.timestamp).toBeGreaterThan(0);
-    });
-});
-describe("security:warn for unrestricted access (CORE-02)", () => {
-    const baseSecrets = {
-        OPENAI_API_KEY: "sk-test",
-        ANTHROPIC_API_KEY: "ak-test",
-    };
-    it("emits security:warn on first access when allowPatterns is empty", () => {
-        const base = createSecretManager(baseSecrets);
-        const bus = new TypedEventBus();
-        const warnEvents = [];
-        bus.on("security:warn", (e) => warnEvents.push(e));
-        const scoped = createScopedSecretManager(base, {
-            agentId: "agent-unrestricted",
-            allowPatterns: [],
-            eventBus: bus,
-        });
-        scoped.get("OPENAI_API_KEY");
-        expect(warnEvents).toHaveLength(1);
-        expect(warnEvents[0].category).toBe("secret_access");
-        expect(warnEvents[0].agentId).toBe("agent-unrestricted");
-        expect(warnEvents[0].message).toContain("secrets.allow");
-        expect(warnEvents[0].message).toContain("agent-unrestricted");
-        expect(typeof warnEvents[0].timestamp).toBe("number");
-    });
-    it("emits security:warn only once (subsequent accesses do not re-emit)", () => {
-        const base = createSecretManager(baseSecrets);
-        const bus = new TypedEventBus();
-        const warnEvents = [];
-        bus.on("security:warn", (e) => warnEvents.push(e));
-        const scoped = createScopedSecretManager(base, {
-            agentId: "agent-once",
-            allowPatterns: [],
-            eventBus: bus,
-        });
-        scoped.get("OPENAI_API_KEY");
-        scoped.has("ANTHROPIC_API_KEY");
-        scoped.require("OPENAI_API_KEY");
-        expect(warnEvents).toHaveLength(1);
-    });
-    it("does NOT emit security:warn when allowPatterns is non-empty", () => {
-        const base = createSecretManager(baseSecrets);
-        const bus = new TypedEventBus();
-        const warnEvents = [];
-        bus.on("security:warn", (e) => warnEvents.push(e));
-        const scoped = createScopedSecretManager(base, {
-            agentId: "agent-restricted",
-            allowPatterns: ["OPENAI_*"],
-            eventBus: bus,
-        });
-        scoped.get("OPENAI_API_KEY");
-        expect(warnEvents).toHaveLength(0);
-    });
-    it("does NOT emit security:warn when no eventBus is provided", () => {
-        const base = createSecretManager(baseSecrets);
-        const scoped = createScopedSecretManager(base, {
-            agentId: "agent-no-bus",
-            allowPatterns: [],
-            // eventBus intentionally omitted
-        });
-        // Should not throw
-        expect(() => scoped.get("OPENAI_API_KEY")).not.toThrow();
-    });
-});

package/node_modules/@comis/core/dist/security/secret-access.test.d.ts

@@ -1 +0,0 @@
-export {};

package/node_modules/@comis/core/dist/security/secret-access.test.js

@@ -1,41 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { matchesSecretPattern, isSecretAccessible } from "./secret-access.js";
-describe("matchesSecretPattern", () => {
-    it("exact match (case-insensitive)", () => {
-        expect(matchesSecretPattern("OPENAI_API_KEY", "openai_api_key")).toBe(true);
-    });
-    it("exact match fails on different name", () => {
-        expect(matchesSecretPattern("OPENAI_API_KEY", "anthropic_api_key")).toBe(false);
-    });
-    it("wildcard prefix match", () => {
-        expect(matchesSecretPattern("OPENAI_API_KEY", "openai_*")).toBe(true);
-    });
-    it("wildcard suffix match", () => {
-        expect(matchesSecretPattern("MY_OPENAI_KEY", "*_openai_*")).toBe(true);
-    });
-    it("wildcard star-only matches everything", () => {
-        expect(matchesSecretPattern("ANYTHING", "*")).toBe(true);
-    });
-    it("no wildcard requires exact match", () => {
-        expect(matchesSecretPattern("OPENAI_API_KEY", "OPENAI_API")).toBe(false);
-    });
-    it("handles regex special characters in pattern", () => {
-        // Dot should be literal, not regex wildcard
-        expect(matchesSecretPattern("my.key", "my.key")).toBe(true);
-        expect(matchesSecretPattern("myXkey", "my.key")).toBe(false);
-    });
-});
-describe("isSecretAccessible", () => {
-    it("empty array allows all", () => {
-        expect(isSecretAccessible("ANY_KEY", [])).toBe(true);
-    });
-    it("matching pattern allows", () => {
-        expect(isSecretAccessible("OPENAI_KEY", ["openai_*"])).toBe(true);
-    });
-    it("no matching pattern denies", () => {
-        expect(isSecretAccessible("STRIPE_KEY", ["openai_*", "anthropic_*"])).toBe(false);
-    });
-    it("multiple patterns, one matches", () => {
-        expect(isSecretAccessible("ANTHROPIC_KEY", ["openai_*", "anthropic_*"])).toBe(true);
-    });
-});

package/node_modules/@comis/core/dist/security/secret-crypto.test.d.ts

@@ -1 +0,0 @@
-export {};

package/node_modules/@comis/core/dist/security/secret-crypto.test.js

@@ -1,113 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { randomBytes } from "node:crypto";
-import { createSecretsCrypto, parseMasterKey } from "./secret-crypto.js";
-describe("SecretsCrypto", () => {
-    const masterKey = randomBytes(32);
-    const crypto = createSecretsCrypto(masterKey);
-    it("encrypts and decrypts round-trip", () => {
-        const plaintext = "sk-abc123-secret-value";
-        const encResult = crypto.encrypt(plaintext);
-        expect(encResult.ok).toBe(true);
-        if (!encResult.ok)
-            return;
-        const decResult = crypto.decrypt(encResult.value);
-        expect(decResult.ok).toBe(true);
-        if (!decResult.ok)
-            return;
-        expect(decResult.value).toBe(plaintext);
-    });
-    it("handles empty string", () => {
-        const encResult = crypto.encrypt("");
-        expect(encResult.ok).toBe(true);
-        if (!encResult.ok)
-            return;
-        const decResult = crypto.decrypt(encResult.value);
-        expect(decResult.ok).toBe(true);
-        if (!decResult.ok)
-            return;
-        expect(decResult.value).toBe("");
-    });
-    it("handles unicode content", () => {
-        const plaintext = "Hello World! Emoji test: \u{1F680}\u{1F30D}\u{2764}\uFE0F CJK: \u4F60\u597D\u4E16\u754C \u3053\u3093\u306B\u3061\u306F";
-        const encResult = crypto.encrypt(plaintext);
-        expect(encResult.ok).toBe(true);
-        if (!encResult.ok)
-            return;
-        const decResult = crypto.decrypt(encResult.value);
-        expect(decResult.ok).toBe(true);
-        if (!decResult.ok)
-            return;
-        expect(decResult.value).toBe(plaintext);
-    });
-    it("produces different ciphertexts for same plaintext (random nonce)", () => {
-        const encResult1 = crypto.encrypt("same-value");
-        const encResult2 = crypto.encrypt("same-value");
-        expect(encResult1.ok && encResult2.ok).toBe(true);
-        if (!encResult1.ok || !encResult2.ok)
-            return;
-        expect(encResult1.value.iv).not.toEqual(encResult2.value.iv);
-        expect(encResult1.value.ciphertext).not.toEqual(encResult2.value.ciphertext);
-    });
-    it("returns err() with wrong master key", () => {
-        const wrongCrypto = createSecretsCrypto(randomBytes(32));
-        const encResult = crypto.encrypt("secret");
-        expect(encResult.ok).toBe(true);
-        if (!encResult.ok)
-            return;
-        const decResult = wrongCrypto.decrypt(encResult.value);
-        expect(decResult.ok).toBe(false);
-    });
-    it("returns err() with corrupted auth tag", () => {
-        const encResult = crypto.encrypt("secret");
-        expect(encResult.ok).toBe(true);
-        if (!encResult.ok)
-            return;
-        // Corrupt the auth tag by flipping a byte
-        const corrupted = { ...encResult.value };
-        const corruptedTag = Buffer.from(corrupted.authTag);
-        corruptedTag[0] = corruptedTag[0] ^ 0xff;
-        corrupted.authTag = corruptedTag;
-        const decResult = crypto.decrypt(corrupted);
-        expect(decResult.ok).toBe(false);
-    });
-    it("throws on master key shorter than 32 bytes", () => {
-        expect(() => createSecretsCrypto(randomBytes(16))).toThrow("Master key must be at least 32 bytes");
-    });
-    it("defensive copy: caller buffer mutation does not affect encryption (CORE-03)", () => {
-        const mutableKey = Buffer.alloc(32, 0xaa);
-        const cryptoEngine = createSecretsCrypto(mutableKey);
-        // Encrypt with original key
-        const encResult = cryptoEngine.encrypt("test-value");
-        expect(encResult.ok).toBe(true);
-        if (!encResult.ok)
-            return;
-        // Mutate the caller's buffer after creation
-        mutableKey.fill(0x00);
-        // Decryption should still work (engine has its own copy)
-        const decResult = cryptoEngine.decrypt(encResult.value);
-        expect(decResult.ok).toBe(true);
-        if (!decResult.ok)
-            return;
-        expect(decResult.value).toBe("test-value");
-    });
-});
-describe("parseMasterKey", () => {
-    it("parses hex string", () => {
-        const original = randomBytes(32);
-        const hex = original.toString("hex");
-        const parsed = parseMasterKey(hex);
-        expect(parsed).toEqual(original);
-        expect(parsed.length).toBe(32);
-    });
-    it("parses base64 string", () => {
-        const original = randomBytes(32);
-        const b64 = original.toString("base64");
-        const parsed = parseMasterKey(b64);
-        expect(parsed).toEqual(original);
-        expect(parsed.length).toBe(32);
-    });
-    it("rejects short key", () => {
-        const short = randomBytes(16).toString("hex"); // 32 hex chars = 16 bytes
-        expect(() => parseMasterKey(short)).toThrow("Master key must be at least 32 bytes");
-    });
-});

package/node_modules/@comis/core/dist/security/secret-manager.test.d.ts

@@ -1 +0,0 @@
-export {};