kiku-agent 1.3.1 → 1.3.3

package/server/agent/tests/realWorldValidation.test.js

@@ -0,0 +1,391 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import { createServer } from 'node:http';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { estimateTokens, calculateTokenCost, formatCostUsd, formatTokenCount, MODEL_PRICING } from '../telemetry.js';
+import { getProfile, listProfiles, BUILTIN_PROFILES } from '../profiles.js';
+import { extractCitations, formatCitationsBlock, resolveCitationReference } from '../citations.js';
+import { handleWebChatRequest } from '../../web-chat/router.js';
+import { checkChatRateLimit, applySecurityHeaders, resolveAllowedOrigin, extractApiKey } from '../../web-chat/core/security.js';
+import {
+  getUnifiedProfile,
+  getUnifiedWorks,
+  getUnifiedDiscography,
+  getUnifiedAwards,
+  getUnifiedBrands,
+  getUnifiedTimeline
+} from '../../mcp/dataAdapter.js';
+import { worksData as richWorks } from '../../../src/data/worksData.js';
+import { worksData as mcpWorks } from '../../mcp/data/works.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const rootDir = resolve(__dirname, '../../../');
+const cliPath = resolve(rootDir, 'server/agent/cli.js');
+const mcpPath = resolve(rootDir, 'server/mcp/stdio.js');
+
+
+function runProcessWithTimeout(cmd, args, { input = null, timeoutMs = 10000 } = {}) {
+  return new Promise((resolve) => {
+    const proc = spawn(cmd, args, {
+      cwd: rootDir,
+      env: { ...process.env, NODE_ENV: 'test', NO_COLOR: '1' },
+      stdio: ['pipe', 'pipe', 'pipe']
+    });
+
+    let stdout = '';
+    let stderr = '';
+    let timedOut = false;
+
+    const timer = setTimeout(() => {
+      timedOut = true;
+      try { proc.kill('SIGKILL'); } catch {}
+      resolve({
+        code: -1,
+        stdout,
+        stderr,
+        timedOut: true,
+        error: new Error(`Process timed out after ${timeoutMs}ms`)
+      });
+    }, timeoutMs);
+    timer.unref();
+
+    proc.stdout.on('data', d => { stdout += d.toString(); });
+    proc.stderr.on('data', d => { stderr += d.toString(); });
+
+    if (input) {
+      proc.stdin.write(input);
+    }
+    proc.stdin.end();
+
+    proc.on('close', code => {
+      clearTimeout(timer);
+      if (!timedOut) {
+        resolve({ code, stdout, stderr, timedOut: false });
+      }
+    });
+
+    proc.on('error', err => {
+      clearTimeout(timer);
+      resolve({ code: -1, stdout, stderr, timedOut: false, error: err });
+    });
+  });
+}
+
+
+
+test('Phase 1 Real-World: CLI --version exits cleanly in < 1s with exit code 0', async () => {
+
+  const res = await runProcessWithTimeout(process.execPath, [cliPath, '--version'], { timeoutMs: 8000 });
+  assert.equal(res.timedOut, false, 'CLI must not hang on --version');
+  assert.equal(res.code, 0);
+  assert.match(res.stdout.trim(), /^\d+\.\d+\.\d+/);
+});
+
+test('Phase 1 Real-World: CLI --help --plain produces zero ANSI garbage and exits code 0', async () => {
+  const res = await runProcessWithTimeout(process.execPath, [cliPath, '--help', '--plain'], { timeoutMs: 8000 });
+  assert.equal(res.timedOut, false, 'CLI must not hang on --help');
+  assert.equal(res.code, 0);
+
+  assert.equal(/\x1b\[[0-9;]*[a-zA-Z]/.test(res.stdout), false, 'Output must not contain ANSI escape codes in plain mode');
+  assert.ok(res.stdout.includes('CLI Flags & Options'));
+  assert.ok(res.stdout.includes('--profile'));
+  assert.ok(res.stdout.includes('--print'));
+});
+
+test('Phase 1 Real-World: CLI exits with code 3 on unknown flags without crashing', async () => {
+  const res = await runProcessWithTimeout(process.execPath, [cliPath, '--non-existent-flag-xyz'], { timeoutMs: 8000 });
+  assert.equal(res.timedOut, false);
+  assert.equal(res.code, 3);
+  assert.ok(res.stderr.includes('Unknown option') || res.stdout.includes('Unknown option'));
+});
+
+test('Phase 1 Real-World: CLI piped stdin handles EOF gracefully without hanging', async () => {
+  const res = await runProcessWithTimeout(
+    process.execPath,
+    [cliPath, '--url', 'http://127.0.0.1:9999/v1', '--output', 'json'],
+    { input: 'Who is Ju Jingyi?', timeoutMs: 4000 }
+  );
+  assert.equal(res.timedOut, false, 'CLI piped input must not hang');
+  assert.equal(res.code, 2, 'Unreachable server exits code 2');
+
+  const payload = JSON.parse(res.stdout);
+  assert.equal(payload.status, 'error');
+  assert.equal(payload.query, 'Who is Ju Jingyi?');
+  assert.ok(payload.metrics);
+  assert.equal(typeof payload.metrics.costUsd, 'number');
+});
+
+
+
+test('Phase 2 Real-World: Security headers and CORS origins are strictly defended', () => {
+  assert.equal(resolveAllowedOrigin('http://localhost:3000'), 'http://localhost:3000');
+  assert.equal(resolveAllowedOrigin('http://127.0.0.1:3000'), 'http://127.0.0.1:3000');
+  assert.equal(resolveAllowedOrigin('https://jujingyi-kikuuu.vercel.app'), 'https://jujingyi-kikuuu.vercel.app');
+
+  const origEnv = process.env.WEBCHAT_CORS_ORIGINS;
+  try {
+    process.env.WEBCHAT_CORS_ORIGINS = 'https://jujingyi-kikuuu.vercel.app, https://portal.kiku.com';
+    assert.equal(resolveAllowedOrigin('https://malicious-attacker.com'), null);
+    assert.equal(resolveAllowedOrigin('https://portal.kiku.com'), 'https://portal.kiku.com');
+  } finally {
+    if (origEnv !== undefined) process.env.WEBCHAT_CORS_ORIGINS = origEnv;
+    else delete process.env.WEBCHAT_CORS_ORIGINS;
+  }
+
+  const mockHeaders = {};
+  const mockRes = {
+    setHeader: (k, v) => { mockHeaders[k] = v; }
+  };
+  applySecurityHeaders({ headers: { origin: 'http://localhost:3000' } }, mockRes);
+  assert.equal(mockHeaders['X-Content-Type-Options'], 'nosniff');
+  assert.equal(mockHeaders['X-Frame-Options'], 'SAMEORIGIN');
+  assert.equal(mockHeaders['Referrer-Policy'], 'strict-origin-when-cross-origin');
+  assert.equal(mockHeaders['Access-Control-Allow-Origin'], 'http://localhost:3000');
+});
+
+test('Phase 2 Real-World: Rate limiter handles burst traffic and rejects on limit without leaking memory', () => {
+  const testIp = '198.51.100.99';
+  let allowedCount = 0;
+  let rejectedCount = 0;
+
+  for (let i = 0; i < 70; i++) {
+    const check = checkChatRateLimit(testIp);
+    if (check.allowed) allowedCount++;
+    else rejectedCount++;
+  }
+
+  assert.equal(allowedCount, 60, 'Should allow exactly 60 requests per minute');
+  assert.equal(rejectedCount, 10, 'Should reject requests exceeding the 60 threshold');
+});
+
+test('Phase 2 Real-World: Real HTTP server routes /api/status with security headers without errors', async () => {
+  const server = createServer(async (req, res) => {
+    await handleWebChatRequest(req, res);
+  });
+
+  await new Promise(r => server.listen(0, '127.0.0.1', r));
+  const port = server.address().port;
+
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}/api/status`);
+    assert.equal(res.status, 200);
+    assert.equal(res.headers.get('x-content-type-options'), 'nosniff');
+    assert.equal(res.headers.get('x-frame-options'), 'SAMEORIGIN');
+    const data = await res.json();
+    assert.equal(data.status, 'ok');
+    assert.equal(data.server, 'Kiku Web Chatbot');
+    assert.ok(data.capabilities);
+  } finally {
+    server.close();
+  }
+});
+
+
+
+test('Phase 3 Real-World: Token heuristics handle Thai, CJK, English, and null edge cases safely', () => {
+  assert.equal(estimateTokens(''), 0);
+  assert.equal(estimateTokens(null), 0);
+  assert.equal(estimateTokens(undefined), 0);
+
+  const enCount = estimateTokens('Ju Jingyi is a talented Chinese singer and actress.');
+  assert.ok(enCount >= 10 && enCount <= 20);
+
+  const cnCount = estimateTokens('鞠婧祎是中国内地流行乐女歌手、影视演员。');
+  assert.ok(cnCount >= 15 && cnCount <= 35);
+
+  const thCount = estimateTokens('จวีจิ้งอี เป็นนักแสดงและนักร้องชาวจีนที่มีชื่อเสียง');
+  assert.ok(thCount >= 20 && thCount <= 75);
+
+  const mixedCount = estimateTokens('Ju Jingyi (鞠婧祎) แสดงในเรื่อง ตำนานหยุนซี (Legend of Yunxi) 2018');
+  assert.ok(mixedCount > 0 && !Number.isNaN(mixedCount));
+});
+
+test('Phase 3 Real-World: calculateTokenCost produces exact values across providers and local LM Studio', () => {
+  const localCost = calculateTokenCost({ prompt: 5000, completion: 2000, total: 7000 }, 'lmstudio', 'google/gemma-4-e4b');
+  assert.equal(localCost, 0);
+  assert.equal(formatCostUsd(localCost), '$0.00 (Local)');
+
+  const groqCost = calculateTokenCost({ prompt: 1_000_000, completion: 1_000_000, total: 2_000_000 }, 'groq');
+  assert.ok(groqCost > 0);
+
+  const deepseekCost = calculateTokenCost({ prompt: 1_000_000, completion: 1_000_000, total: 2_000_000 }, 'deepseek');
+  assert.ok(deepseekCost > 0);
+
+  assert.equal(formatCostUsd(0.00001), '<$0.0001');
+  assert.equal(formatCostUsd(0.01234), '$0.0123');
+  assert.equal(formatTokenCount(1500), '1,500');
+  assert.equal(formatTokenCount(1200000), '1,200,000');
+});
+
+test('Phase 3 Real-World: All built-in profiles are valid and have required runtime keys', () => {
+  const profiles = listProfiles();
+  assert.ok(profiles.length >= 5);
+
+  for (const p of profiles) {
+    assert.ok(p.id, 'Profile must have an id');
+    assert.ok(p.name, 'Profile must have a human-readable name');
+    assert.ok(p.provider, 'Profile must specify a provider');
+    assert.ok(p.model, 'Profile must specify a model');
+    assert.ok(typeof p.temperature === 'number', 'Profile must have numeric temperature');
+    assert.ok(typeof p.description === 'string', 'Profile must have a description');
+  }
+
+  const geminiProfile = getProfile('gemini');
+  assert.equal(geminiProfile.provider, 'gemini');
+  assert.equal(geminiProfile.model, 'gemini-3.7-flash');
+});
+
+
+test('Phase 4 Real-World: Citations extraction handles realistic multi-turn responses without corruption', () => {
+  const tools = [
+    {
+      name: 'search_works',
+      result: {
+        works: [
+          {
+            id: 'in-blossom',
+            titleTh: 'ฮวาเจียนลิ่ง ในม่านเมฆ (In Blossom)',
+            titleCn: '花间令',
+            titleEn: 'In Blossom',
+            year: 2024,
+            role: 'หยางไฉ่เวย / ซ่างกวนจื่อ',
+            category: 'ซีรีส์สืบสวนโบราณ'
+          },
+          {
+            id: 'veil-of-shadows',
+            titleTh: '月鳞绮纪 (Veil of Shadows)',
+            titleCn: '月鳞绮纪',
+            titleEn: 'Veil of Shadows',
+            year: 2026,
+            role: 'ลู่หวู่อี (Lu Wuyi)',
+            category: 'ซีรีส์แฟนตาซีโบราณ'
+          }
+        ]
+      }
+    }
+  ];
+
+  const answer = 'ผลงานเด่นในปี 2024 คือเรื่อง In Blossom (花间令) รับบทเป็น หยางไฉ่เวย และปี 2026 มีเรื่อง Veil of Shadows';
+  const citations = extractCitations(answer, tools);
+
+  assert.equal(citations.length, 2);
+  assert.equal(citations[0].id, 1);
+  assert.equal(citations[1].id, 2);
+
+
+  const block = formatCitationsBlock(citations, { lang: 'th' });
+  assert.ok(block.includes('📖 แหล่งข้อมูลและหลักฐานอ้างอิง'));
+  assert.ok(block.includes('[1]'));
+  assert.ok(block.includes('[2]'));
+  assert.ok(!block.includes('undefined'));
+  assert.ok(!block.includes('null'));
+});
+
+test('Phase 4 Real-World: resolveCitationReference is immune to crash on edge case queries', () => {
+  const mockCitations = [
+    { id: 1, title: 'ตำนานหยุนซี (芸汐传)', year: 2018 },
+    { id: 2, title: 'ฮวาเจียนลิ่ง ในม่านเมฆ (In Blossom)', year: 2024 }
+  ];
+
+
+  assert.equal(resolveCitationReference('', mockCitations), null);
+  assert.equal(resolveCitationReference('   ', mockCitations), null);
+  assert.equal(resolveCitationReference(null, mockCitations), null);
+  assert.equal(resolveCitationReference('!@#$%^&*()_+', mockCitations), null);
+
+ 
+  const matchBracket = resolveCitationReference('เล่าเนื้อเรื่องของ [2] ให้ฟังหน่อย', mockCitations);
+  assert.equal(matchBracket?.id, 2);
+
+  const matchHash = resolveCitationReference('ขอประวัติตัวละครใน #1', mockCitations);
+  assert.equal(matchHash?.id, 1);
+
+  const matchTitle = resolveCitationReference('หยุนซี ออกอากาศปีไหน', mockCitations);
+  assert.equal(matchTitle?.id, 1);
+
+  const matchEnglishTitle = resolveCitationReference('Tell me more about In Blossom', mockCitations);
+  assert.equal(matchEnglishTitle?.id, 2);
+});
+
+
+test('Phase 5 Real-World: 100% of 18 catalog works match with valid schema and release metadata', () => {
+  assert.equal(richWorks.length, 18, 'Expected exactly 18 works in rich catalog');
+
+  for (const w of richWorks) {
+    assert.ok(w.id, 'Work must have an id');
+    assert.ok(w.titleCn, `Work ${w.id} must have titleCn`);
+    assert.ok(w.titleEn, `Work ${w.id} must have titleEn`);
+    assert.ok(typeof w.year === 'number' && w.year >= 2013 && w.year <= 2026, `Work ${w.id} has invalid year ${w.year}`);
+
+  
+    if (w.themeSong?.youtubeId) {
+      assert.equal(w.themeSong.youtubeId.length, 11, `YouTube ID for ${w.id} theme song should be 11 characters`);
+    }
+
+  
+    const mcpMatch = mcpWorks.find(m => m.id === w.id || m.alias === w.id);
+    assert.ok(mcpMatch, `Work ${w.id} must exist in MCP worksData`);
+    assert.equal(mcpMatch.year, w.year);
+  }
+});
+
+test('Phase 5 Real-World: Unified DataAdapter models are structurally complete', () => {
+  const profile = getUnifiedProfile();
+  assert.equal(profile.nameEn, 'Ju Jingyi');
+  assert.equal(profile.nameCn, '鞠婧祎');
+  assert.ok(profile.bioSummary);
+
+  const works = getUnifiedWorks();
+  assert.equal(works.length, 18);
+
+  const discography = getUnifiedDiscography();
+  assert.ok(discography.length >= 25);
+
+  const ids = new Set();
+  for (const d of discography) {
+    assert.ok(d.id, 'Song must have id');
+    ids.add(d.id);
+  }
+  assert.equal(ids.size, discography.length, 'Unified discography must not have duplicate IDs');
+
+  const awards = getUnifiedAwards();
+  assert.ok(awards.length >= 10);
+
+  const brands = getUnifiedBrands();
+  assert.ok(brands.length >= 10);
+  assert.ok(brands.some(b => b.isGlobal && b.id === 'prsr'));
+  assert.ok(brands.some(b => b.isGlobal && b.id === 'versace'));
+
+  const timeline = getUnifiedTimeline();
+  assert.ok(timeline.length >= 10);
+});
+
+test('Phase 5 Real-World: MCP stdio server initializes properly over child process stdio', async () => {
+
+  const res = await runProcessWithTimeout(
+    process.execPath,
+    [mcpPath],
+    {
+      input: JSON.stringify({
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'initialize',
+        params: {
+          protocolVersion: '2024-11-05',
+          capabilities: {},
+          clientInfo: { name: 'real-world-tester', version: '1.0.0' }
+        }
+      }) + '\n',
+      timeoutMs: 4000
+    }
+  );
+
+  assert.equal(res.timedOut, false, 'MCP server must not hang on initialize');
+
+  assert.ok(res.stdout.includes('"jsonrpc":"2.0"'), 'MCP must return valid JSON-RPC');
+  assert.ok(res.stdout.includes('"capabilities"'), 'MCP must advertise capabilities');
+});

package/server/agent/tests/resilienceAndConcurrency.test.js

@@ -0,0 +1,117 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import { mapConcurrent } from '../suggestions.js';
+import { LLMClient } from '../llmClient.js';
+import { routeCommand } from '../commands.js';
+
+test('mapConcurrent limits active concurrency strictly to specified limit', async () => {
+  const items = [1, 2, 3, 4, 5, 6];
+  let activeWorkers = 0;
+  let maxObservedActive = 0;
+  const executionOrder = [];
+
+  const results = await mapConcurrent(items, 2, async (item) => {
+    activeWorkers++;
+    maxObservedActive = Math.max(maxObservedActive, activeWorkers);
+    await new Promise((r) => setTimeout(r, 25));
+    executionOrder.push(item);
+    activeWorkers--;
+    return item * 10;
+  });
+
+  assert.equal(maxObservedActive, 2, 'Max active concurrent workers must not exceed limit 2');
+  assert.equal(results.length, 6);
+  assert.deepEqual(results.map(r => r.value), [10, 20, 30, 40, 50, 60]);
+});
+
+test('mapConcurrent with limit 1 processes strictly sequentially for local models', async () => {
+  const items = ['task1', 'task2', 'task3'];
+  let activeWorkers = 0;
+  let maxObservedActive = 0;
+
+  const results = await mapConcurrent(items, 1, async (item) => {
+    activeWorkers++;
+    maxObservedActive = Math.max(maxObservedActive, activeWorkers);
+    await new Promise((r) => setTimeout(r, 15));
+    activeWorkers--;
+    return `${item}_done`;
+  });
+
+  assert.equal(maxObservedActive, 1, 'Local inference concurrency must stay strictly 1');
+  assert.deepEqual(results.map(r => r.value), ['task1_done', 'task2_done', 'task3_done']);
+});
+
+test('LLMClient retries on transient 500 error and recovers', async () => {
+  let callCount = 0;
+  const originalFetch = globalThis.fetch;
+
+  try {
+    globalThis.fetch = async () => {
+      callCount++;
+      if (callCount === 1) {
+        return {
+          ok: false,
+          status: 500,
+          text: async () => 'Internal Server Error',
+        };
+      }
+      return {
+        ok: true,
+        status: 200,
+        json: async () => ({
+          choices: [
+            {
+              message: {
+                role: 'assistant',
+                content: 'Recovered after retry',
+              },
+            },
+          ],
+        }),
+      };
+    };
+
+    const client = new LLMClient({
+      provider: 'openai',
+      apiKey: 'test-key',
+      model: 'gpt-4o-mini',
+    });
+
+    const response = await client.chat({
+      messages: [{ role: 'user', content: 'Hello' }],
+      stream: false,
+    });
+    assert.equal(response.content, 'Recovered after retry');
+    assert.equal(callCount, 2, 'Should have retried once after 500 error');
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test('Commands populate recordQueryDiagnostics for inspection via /details', async () => {
+  let recorded = null;
+  const ctx = {
+    sub: 'Ju Jingyi 2026',
+    agent: {
+      runSubagent: async (task) => ({
+        answer: 'Ju Jingyi is starring in upcoming 2026 drama.',
+        thinking: 'Gathering drama data.',
+        toolCalls: [{ name: 'search_catalog', args: { query: '2026' }, result: { count: 2 }, duration: 120 }],
+        iterations: 1,
+      }),
+    },
+    setIsProcessing: () => {},
+    recordQueryDiagnostics: (details) => {
+      recorded = details;
+    },
+  };
+
+  const res = await routeCommand('/subagent Ju Jingyi 2026', ctx);
+  assert.equal(res, 'HANDLED');
+  assert.ok(recorded, 'Diagnostics should have been recorded for subagent run');
+  assert.equal(recorded.prompt, 'Ju Jingyi 2026');
+  assert.equal(recorded.answer, 'Ju Jingyi is starring in upcoming 2026 drama.');
+  assert.equal(recorded.tools.length, 1);
+  assert.equal(recorded.tools[0].name, 'search_catalog');
+});

package/server/agent/tests/runtimeWatchdog.test.js

@@ -0,0 +1,32 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { RuntimeWatchdog } from '../telemetry/runtimeWatchdog.js';
+
+test('RuntimeWatchdog: samples telemetry and tracks spillover thresholds', async () => {
+  const watchdog = new RuntimeWatchdog({ spilloverThresholdMb: 10.0 });
+  const sample = await watchdog.sampleTelemetry();
+
+  assert.ok(typeof sample.sharedMemoryUsedMb === 'number');
+  assert.ok(typeof sample.hasSpillover === 'boolean');
+  assert.equal(watchdog.metricsHistory.length, 1);
+});
+
+test('RuntimeWatchdog: triggers self-healing context eviction of 50% older messages', () => {
+  const watchdog = new RuntimeWatchdog();
+  const fakeAgent = {
+    conversationHistory: [
+      { role: 'system', content: 'system persona' },
+      { role: 'user', content: 'q1' },
+      { role: 'assistant', content: 'a1' },
+      { role: 'user', content: 'q2' },
+      { role: 'assistant', content: 'a2' },
+      { role: 'user', content: 'q3' },
+      { role: 'assistant', content: 'a3' },
+    ]
+  };
+
+  const evicted = watchdog.selfHealContext(fakeAgent);
+  assert.ok(evicted >= 3);
+  assert.equal(fakeAgent.conversationHistory[0].role, 'system');
+  assert.ok(fakeAgent.conversationHistory.some(m => m.content?.includes('WATCHDOG SELF-HEALING')));
+});

package/server/agent/tests/sanitizer.test.js

@@ -0,0 +1,37 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+
+import { sanitizeFilePath, sanitizeToolArgs, sanitizeUrl } from '../sanitizer.js';
+
+const projectRoot = path.resolve('C:/workspace/project');
+
+test('dangerous file extensions are rejected case-insensitively', () => {
+  const executable = sanitizeFilePath('scripts/launch.EXE', projectRoot);
+  const script = sanitizeFilePath('scripts/setup.sh', projectRoot);
+  const text = sanitizeFilePath('notes/readme.txt', projectRoot);
+
+  assert.equal(executable.safe, false);
+  assert.match(executable.reason, /dangerous file extension/i);
+  assert.equal(script.safe, false);
+  assert.equal(text.safe, true);
+});
+
+test('directory validation does not reject a directory name that resembles a script', () => {
+  const result = sanitizeToolArgs('list_directory', { path: 'fixtures.js' });
+  assert.equal(result.safe, true);
+});
+
+test('IPv6 loopback and private literals are rejected after bracket normalization', () => {
+  for (const url of [
+    'http://[::1]/admin',
+    'http://[0:0:0:0:0:0:0:1]/admin',
+    'http://[::ffff:127.0.0.1]/admin',
+    'http://[fd00::1]/admin',
+  ]) {
+    const result = sanitizeUrl(url);
+    assert.equal(result.safe, false, `${url} should be blocked`);
+  }
+
+  assert.equal(sanitizeUrl('https://[2606:4700:4700::1111]/').safe, true);
+});