dsh-hitl 0.1.1 → 0.2.0

package/tests/manifest.test.js

@@ -24,6 +24,22 @@ const manifest = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
 const LANGUAGES = ['en', 'zh']
 
 describe('manifest: what a profile reads about this plugin', () => {
+  it('keeps the tag-triggered release on stage-only trusted publishing', () => {
+    const workflow = readFileSync(join(root, '.github', 'workflows', 'release.yml'), 'utf8')
+    assert.equal(workflow.includes("tags: ['v*']"), true, 'the workflow must trigger on version tags')
+    assert.equal(workflow.includes('id-token: write'), true, 'OIDC publishing needs the id-token permission')
+    assert.equal(workflow.includes('contents: read'), true)
+    // Stage-only: the workflow may upload a release, but a maintainer approves
+    // it with 2FA before it becomes public, so it must never publish directly.
+    assert.equal(/run: npm stage publish/.test(workflow), true, 'the release step must stage')
+    assert.equal(/run: npm publish\b/.test(workflow), false, 'a direct publish would need "publish directly" granted')
+    // Provenance is automatic under trusted publishing — but this file *talks*
+    // about that, so assert on the command, not on the words.
+    assert.equal(/npm stage publish[^\n]*--provenance/.test(workflow), false, 'no --provenance flag on the command')
+    // npm matches the configured trusted publisher against this exact filename.
+    assert.equal(workflow.includes('release.yml'), true, 'the trusted publisher is configured with this filename')
+  })
+
   it('resolves the resources the Loader asks for by name', () => {
     assert.equal(manifest.name, 'dsh-hitl')
     assert.equal(typeof manifest.description, 'string')

package/tests/resolve.test.js

@@ -61,6 +61,7 @@ describe('resolve: normalizeMount', () => {
       whenUnavailable: 'reject',
       enabled: true,
       maxFieldChars: DEFAULT_OPTIONS.maxFieldChars,
+      resolveTimeoutMs: DEFAULT_OPTIONS.resolveTimeoutMs,
     })
   })
 
@@ -79,6 +80,25 @@ describe('resolve: normalizeMount', () => {
     assert.match(warnings[0], /countdown.seconds/)
   })
 
+  it('warns when a mount waits forever with nothing to end the wait', () => {
+    // Fail-open plus no deadline is legal, and it blocks an unattended call for
+    // as long as its session lives. The mount is still installed; the warning is
+    // the whole point, because the first unattended run must not be the discovery.
+    const open = normalizeMount({ tool: 'bash', whenUnavailable: 'wait' }, 'src')
+    assert.equal(open.ok, true)
+    assert.equal(open.mount.options.whenUnavailable, 'wait')
+    assert.equal(open.warnings.length, 1)
+    assert.match(open.warnings[0], /whenUnavailable: wait without a countdown/)
+
+    // A deadline is what bounds it, so the pairing is silent — and so is the
+    // fail-closed default, which needs no deadline to be safe.
+    const bounded = normalizeMount({ tool: 'bash', whenUnavailable: 'wait', countdown: { seconds: 300, action: 'reject' } }, 'src')
+    assert.equal(bounded.warnings.length, 0)
+    const closed = normalizeMount({ tool: 'bash' }, 'src')
+    assert.equal(closed.mount.options.whenUnavailable, 'reject')
+    assert.equal(closed.warnings.length, 0)
+  })
+
   it('normalizes field entries and drops invalid ones', () => {
     const { mount, warnings } = normalizeMount({
       tool: 'edit',
@@ -92,6 +112,48 @@ describe('resolve: normalizeMount', () => {
     assert.match(warnings[0], /fields\[2\]\.render/)
   })
 
+  it('keeps a literal or computed field value and drops an unusable one', () => {
+    const read = () => 'value'
+    const { mount, warnings } = normalizeMount({
+      tool: 'edit',
+      fields: [
+        { param: 'note', value: '固定文案' },
+        { param: 'computed', value: read },
+        { param: 'content', value: undefined, diff: { path: 'file_path', before: read, after: 'new_string' } },
+      ],
+    }, 'src')
+    assert.equal(mount.options.fields[0].value, '固定文案')
+    assert.equal(mount.options.fields[1].value, read)
+    assert.deepEqual(Object.keys(mount.options.fields[2].diff), ['before', 'after', 'path'])
+    assert.equal(mount.options.fields[2].diff.before, read)
+    assert.equal(warnings.length, 0)
+
+    const bad = normalizeMount({ tool: 'edit', fields: [{ param: 'x', value: 7 }] }, 'src')
+    assert.deepEqual(bad.mount.options.fields, [])
+    assert.equal(bad.warnings.length, 1)
+    assert.match(bad.warnings[0], /fields\[0\]\.value/)
+  })
+
+  it('drops a malformed diff instead of letting the field render as markdown', () => {
+    const bad = normalizeMount({ tool: 'edit', diff: { before: 'old_string' } }, 'src')
+    assert.equal(bad.mount.options.diff, undefined)
+    assert.equal(bad.warnings.length, 1)
+    assert.match(bad.warnings[0], /^src: diff\.before and diff\.after/)
+
+    const fieldLevel = normalizeMount({
+      tool: 'edit', fields: [{ param: 'x', diff: { before: 'a', after: 'b', path: 7 } }],
+    }, 'src')
+    assert.equal('diff' in fieldLevel.mount.options.fields[0], false)
+    assert.equal(fieldLevel.warnings.length, 1)
+    assert.match(fieldLevel.warnings[0], /fields\[0\]\.diff\.path/)
+  })
+
+  it('bounds a computed field with resolveTimeoutMs, defaulting from the protocol', () => {
+    assert.equal(normalizeMount({ tool: 'bash' }, 'src').mount.options.resolveTimeoutMs, DEFAULT_OPTIONS.resolveTimeoutMs)
+    assert.equal(normalizeMount({ tool: 'bash', resolveTimeoutMs: 250 }, 'src').mount.options.resolveTimeoutMs, 250)
+    assert.equal(normalizeMount({ tool: 'bash', resolveTimeoutMs: 0 }, 'src').mount.options.resolveTimeoutMs, DEFAULT_OPTIONS.resolveTimeoutMs)
+  })
+
   it('reports a bad layout, unavailable policy, and modify mode', () => {
     const { mount, warnings } = normalizeMount({
       tool: 'bash', layout: 'grid', whenUnavailable: 'maybe', modify: { mode: 'ignore' }, maxFieldChars: -1, labels: ['ok', 3],