principles-disciple 1.126.0 → 1.128.0

package/tests/core/rule-host-adversarial-output.test.ts

@@ -1,242 +0,0 @@
-/**
- * PRI-437 Slice 5: Invalid tier/adversarial diagnostics cannot corrupt output
- *
- * PURPOSE: Verify that adversarial RuleCode cannot corrupt the RuleHost output
- * or merge logic through:
- *   1. Prototype pollution in diagnostics field
- *   2. Invalid tier in input (non-number epTier)
- *   3. Adversarial correctionProposal with prototype pollution
- *
- * ERR risk mitigation:
- *   - ERR-001: no `as` bypass on untrusted VM output
- *   - ERR-013: Object.hasOwn for untrusted keys
- *   - ERR-005: validate array element types
- *
- * Test approach:
- *   - Real SQLite activation with adversarial RuleCode
- *   - Real RuleHost.evaluate() (public interface)
- *   - Verify output is either rejected (undefined) or safely contained
- */
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import * as fs from 'fs';
-import * as os from 'os';
-import * as path from 'path';
-import { SqliteConnection, SqliteActivationStateStore } from '@principles/core/runtime-v2';
-import type { RuleHostInput } from '@principles/core/runtime-v2';
-import { RuleHost } from '../../src/core/rule-host.js';
-
-// ── Test helpers ───────────────────────────────────────────────────────────
-
-let tempWorkspaceDir: string;
-let tempStateDir: string;
-let sqliteConn: SqliteConnection;
-
-function setupTempDirs(): void {
-  const baseTmp = os.tmpdir();
-  tempWorkspaceDir = fs.mkdtempSync(path.join(baseTmp, 'pd-rulehost-adversarial-'));
-  tempStateDir = path.join(tempWorkspaceDir, '.principles');
-  fs.mkdirSync(tempStateDir, { recursive: true });
-}
-
-function insertRuleArtifact(
-  artifactId: string,
-  ruleId: string,
-  sourceTaskId: string,
-  code: string,
-): void {
-  const db = sqliteConn.getDb();
-  const now = new Date().toISOString();
-  const contentJson = JSON.stringify({
-    principleId: `P_${ruleId}`,
-    ruleId,
-    implementationCode: code,
-    goldenTrace: { traceId: `trace-${ruleId}`, cases: [], createdAt: now, version: 1 },
-    ruleHostGateDecision: 'accepted_shadow',
-    affectedTools: ['write_file'],
-    painReasonSummary: 'Test: adversarial',
-  });
-
-  db.prepare(`
-    INSERT INTO pi_artifacts (artifact_id, artifact_kind, source_task_id, source_principle_id, source_rule_id, lineage_artifact_ids, validation_status, content_json, created_at, updated_at)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-  `).run(
-    artifactId, 'rule', sourceTaskId, `P_${ruleId}`, ruleId,
-    '[]', 'validated', contentJson, now, now,
-  );
-}
-
-async function insertActivation(
-  activationId: string,
-  artifactId: string,
-  ruleId: string,
-): Promise<void> {
-  const store = new SqliteActivationStateStore(sqliteConn);
-  const now = new Date().toISOString();
-  await store.recordActivation({
-    activationId,
-    idempotencyKey: `${artifactId}::code_tool_hook`,
-    artifactId,
-    channel: 'code_tool_hook',
-    action: 'code_tool_hook_shadow_activate',
-    targetRef: `impl://${ruleId}`,
-    activatedAt: now,
-    deactivatedAt: null,
-  });
-}
-
-function makeInput(normalizedPath: string, epTier?: unknown): RuleHostInput {
-  return {
-    action: {
-      toolName: 'write_file',
-      normalizedPath,
-      paramsSummary: { path: normalizedPath },
-    },
-    workspace: { isRiskPath: false, planStatus: 'NONE' as const, hasPlanFile: false },
-    session: { sessionId: 'test-session-adversarial', currentGfi: 0, recentThinking: false },
-    evolution: { epTier: epTier as number },
-    derived: { estimatedLineChanges: 1, bashRisk: 'safe' as const },
-  };
-}
-
-// ── Setup / Teardown ───────────────────────────────────────────────────────
-
-beforeEach(() => {
-  setupTempDirs();
-  sqliteConn = new SqliteConnection(tempWorkspaceDir);
-  sqliteConn.getDb();
-});
-
-afterEach(() => {
-  try { sqliteConn?.close(); } catch { /* best-effort */ }
-  try { fs.rmSync(tempWorkspaceDir, { recursive: true, force: true }); } catch { /* Windows */ }
-});
-
-// ── Slice 5: Adversarial diagnostics cannot corrupt output ─────────────────
-
-describe('PRI-437 Slice 5: Invalid tier/adversarial diagnostics cannot corrupt output', () => {
-  it('prototype pollution in diagnostics field is rejected by validator', async () => {
-    const RULE_ID = 'R_TEST_PROTO_005';
-    const ARTIFACT_ID = 'art-proto-005';
-    const ACTIVATION_ID = `act_code_${RULE_ID}`;
-
-    // RuleCode that tries to inject __proto__ as an own property in diagnostics
-    const ADVERSARIAL_CODE = `
-function evaluate(input, helpers) {
-  var diag = {};
-  Object.defineProperty(diag, '__proto__', { value: { polluted: true }, enumerable: true, configurable: true });
-  Object.defineProperty(diag, 'constructor', { value: { polluted: true }, enumerable: true, configurable: true });
-  return { decision: 'block', matched: true, reason: 'adversarial', diagnostics: diag };
-}
-var meta = { name: 'proto-rule', version: '1', ruleId: '${RULE_ID}', coversCondition: 'all' };
-`;
-
-    insertRuleArtifact(ARTIFACT_ID, RULE_ID, 'task-proto-005', ADVERSARIAL_CODE);
-    await insertActivation(ACTIVATION_ID, ARTIFACT_ID, RULE_ID);
-
-    const warnCalls: string[] = [];
-    const spyLogger = {
-      warn: (message: string) => { warnCalls.push(message); },
-      error: () => {},
-      info: () => {},
-    };
-
-    const ruleHost = new RuleHost(tempStateDir, spyLogger, { workspaceDir: tempWorkspaceDir });
-    const result = ruleHost.evaluate(makeInput('/etc/passwd'));
-
-    // PRI-437 fail-closed contract: adversarial results must be rejected entirely,
-    // resulting in conservative degradation (undefined). Not "accepted but sanitized".
-    expect(result).toBeUndefined();
-
-    // Must emit warn evidence about the invalid result
-    expect(warnCalls.length).toBeGreaterThan(0);
-  });
-
-  it('invalid tier (string) in input does not corrupt output validation', async () => {
-    const RULE_ID = 'R_TEST_TIER_005';
-    const ARTIFACT_ID = 'art-tier-005';
-    const ACTIVATION_ID = `act_code_${RULE_ID}`;
-
-    // RuleCode that tries to use epTier as a string and produces invalid output
-    const ADVERSARIAL_CODE = `
-function evaluate(input, helpers) {
-  var tier = input.evolution.epTier;
-  // If tier is a string, try to use it to bypass validation
-  if (typeof tier === 'string') {
-    return { decision: 'BLOCK', matched: 'yes', reason: 123 };
-  }
-  return { decision: 'block', matched: true, reason: 'valid block' };
-}
-var meta = { name: 'tier-rule', version: '1', ruleId: '${RULE_ID}', coversCondition: 'all' };
-`;
-
-    insertRuleArtifact(ARTIFACT_ID, RULE_ID, 'task-tier-005', ADVERSARIAL_CODE);
-    await insertActivation(ACTIVATION_ID, ARTIFACT_ID, RULE_ID);
-
-    const warnCalls: string[] = [];
-    const spyLogger = {
-      warn: (message: string) => { warnCalls.push(message); },
-      error: () => {},
-      info: () => {},
-    };
-
-    const ruleHost = new RuleHost(tempStateDir, spyLogger, { workspaceDir: tempWorkspaceDir });
-
-    // Pass invalid tier (string instead of number)
-    const result = ruleHost.evaluate(makeInput('/etc/passwd', 'invalid_tier_string'));
-
-    // The invalid output (decision='BLOCK' instead of 'block', matched='yes' instead of boolean)
-    // must be rejected by the validator → undefined (conservative degradation)
-    expect(result).toBeUndefined();
-
-    // Must emit warn evidence about the invalid result
-    expect(warnCalls.length).toBeGreaterThan(0);
-    const invalidWarn = warnCalls.find(m =>
-      m.toLowerCase().includes('invalid') ||
-      m.toLowerCase().includes('evaluation failed')
-    );
-    expect(invalidWarn).toBeDefined();
-  });
-
-  it('adversarial correctionProposal with prototype pollution is rejected', async () => {
-    const RULE_ID = 'R_TEST_CORR_005';
-    const ARTIFACT_ID = 'art-corr-005';
-    const ACTIVATION_ID = `act_code_${RULE_ID}`;
-
-    // RuleCode that returns auto_correct with adversarial correctionProposal
-    const ADVERSARIAL_CODE = `
-function evaluate(input, helpers) {
-  var proposal = {
-    ruleId: '${RULE_ID}',
-    correctedFields: [{ field: 'file_path', reason: 'x' }],
-    proposedParams: { file_path: '/safe/path' },
-    applicationMode: 'live',
-    confidence: 0.9,
-  };
-  // Try to inject __proto__ into the proposal
-  Object.defineProperty(proposal, '__proto__', { value: { polluted: true }, enumerable: true });
-  return { decision: 'auto_correct', matched: true, reason: 'adversarial correction', correctionProposal: proposal };
-}
-var meta = { name: 'corr-rule', version: '1', ruleId: '${RULE_ID}', coversCondition: 'all' };
-`;
-
-    insertRuleArtifact(ARTIFACT_ID, RULE_ID, 'task-corr-005', ADVERSARIAL_CODE);
-    await insertActivation(ACTIVATION_ID, ARTIFACT_ID, RULE_ID);
-
-    const warnCalls: string[] = [];
-    const spyLogger = {
-      warn: (message: string) => { warnCalls.push(message); },
-      error: () => {},
-      info: () => {},
-    };
-
-    const ruleHost = new RuleHost(tempStateDir, spyLogger, { workspaceDir: tempWorkspaceDir });
-    const result = ruleHost.evaluate(makeInput('/etc/passwd'));
-
-    // PRI-437 fail-closed contract: adversarial correctionProposal must be rejected
-    // entirely, resulting in conservative degradation (undefined).
-    expect(result).toBeUndefined();
-
-    // Must emit warn evidence
-    expect(warnCalls.length).toBeGreaterThan(0);
-  });
-});

package/tests/core/rule-host-autocorrect-vm.test.ts

@@ -1,163 +0,0 @@
-/**
- * PRI-437 Adversarial Self-Review: Valid auto_correct from VM must be accepted
- *
- * PURPOSE: Verify that a valid auto_correct proposal created INSIDE the vm
- * context is accepted by the validator (not rejected due to prototype realm
- * mismatch).
- *
- * CONTEXT: validateCorrectionProposal uses isPlainObject which checks
- * Object.getPrototypeOf() === Object.prototype. VM-created objects have
- * prototypes from the VM realm, not the host realm, so isPlainObject
- * returns false and rejects all VM-created proposals.
- *
- * ERR risk mitigation:
- *   - ERR-001: no `as` bypass on untrusted VM output
- *   - ERR-002: fail-closed with reason (not silent rejection)
- */
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import * as fs from 'fs';
-import * as os from 'os';
-import * as path from 'path';
-import { SqliteConnection, SqliteActivationStateStore } from '@principles/core/runtime-v2';
-import type { RuleHostInput } from '@principles/core/runtime-v2';
-import { RuleHost } from '../../src/core/rule-host.js';
-
-let tempWorkspaceDir: string;
-let tempStateDir: string;
-let sqliteConn: SqliteConnection;
-
-function setupTempDirs(): void {
-  const baseTmp = os.tmpdir();
-  tempWorkspaceDir = fs.mkdtempSync(path.join(baseTmp, 'pd-rulehost-autocorrect-'));
-  tempStateDir = path.join(tempWorkspaceDir, '.principles');
-  fs.mkdirSync(tempStateDir, { recursive: true });
-}
-
-function insertRuleArtifact(
-  artifactId: string,
-  ruleId: string,
-  sourceTaskId: string,
-  code: string,
-): void {
-  const db = sqliteConn.getDb();
-  const now = new Date().toISOString();
-  const contentJson = JSON.stringify({
-    principleId: `P_${ruleId}`,
-    ruleId,
-    implementationCode: code,
-    goldenTrace: { traceId: `trace-${ruleId}`, cases: [], createdAt: now, version: 1 },
-    ruleHostGateDecision: 'accepted_shadow',
-    affectedTools: ['write_file'],
-    painReasonSummary: 'Test: auto_correct',
-  });
-
-  db.prepare(`
-    INSERT INTO pi_artifacts (artifact_id, artifact_kind, source_task_id, source_principle_id, source_rule_id, lineage_artifact_ids, validation_status, content_json, created_at, updated_at)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-  `).run(
-    artifactId, 'rule', sourceTaskId, `P_${ruleId}`, ruleId,
-    '[]', 'validated', contentJson, now, now,
-  );
-}
-
-async function insertActivation(
-  activationId: string,
-  artifactId: string,
-  ruleId: string,
-): Promise<void> {
-  const store = new SqliteActivationStateStore(sqliteConn);
-  const now = new Date().toISOString();
-  await store.recordActivation({
-    activationId,
-    idempotencyKey: `${artifactId}::code_tool_hook`,
-    artifactId,
-    channel: 'code_tool_hook',
-    action: 'code_tool_hook_shadow_activate',
-    targetRef: `impl://${ruleId}`,
-    activatedAt: now,
-    deactivatedAt: null,
-  });
-}
-
-function makeInput(normalizedPath: string): RuleHostInput {
-  return {
-    action: {
-      toolName: 'write_file',
-      normalizedPath,
-      paramsSummary: { path: normalizedPath },
-    },
-    workspace: { isRiskPath: false, planStatus: 'NONE' as const, hasPlanFile: false },
-    session: { sessionId: 'test-session-autocorrect', currentGfi: 0, recentThinking: false },
-    evolution: { epTier: 0 },
-    derived: { estimatedLineChanges: 1, bashRisk: 'safe' as const },
-  };
-}
-
-beforeEach(() => {
-  setupTempDirs();
-  sqliteConn = new SqliteConnection(tempWorkspaceDir);
-  sqliteConn.getDb();
-});
-
-afterEach(() => {
-  try { sqliteConn?.close(); } catch { /* best-effort */ }
-  try { fs.rmSync(tempWorkspaceDir, { recursive: true, force: true }); } catch { /* Windows */ }
-});
-
-describe('PRI-437 Adversarial Self-Review: Valid auto_correct from VM must be accepted', () => {
-  it('valid auto_correct proposal created inside VM is accepted (not rejected by isPlainObject)', async () => {
-    const RULE_ID = 'R_TEST_AUTOCORRECT_VALID';
-    const ARTIFACT_ID = 'art-autocorrect-valid';
-    const ACTIVATION_ID = `act_code_${RULE_ID}`;
-
-    // RuleCode that returns a valid auto_correct proposal.
-    // The proposal object is created INSIDE the vm context, so its prototype
-    // is the VM realm's Object.prototype, not the host's.
-    const VALID_AUTOCORRECT_CODE = `
-function evaluate(input, helpers) {
-  return {
-    decision: 'auto_correct',
-    matched: true,
-    reason: 'path should be within workspace',
-    correctionProposal: {
-      ruleId: '${RULE_ID}',
-      correctedFields: [{ field: 'file_path', original: input.action.normalizedPath, proposed: '/safe/path', reason: 'redirect to safe path' }],
-      proposedParams: { file_path: '/safe/path' },
-      applicationMode: 'shadow',
-      confidence: 0.9,
-      notifyAgent: true
-    }
-  };
-}
-var meta = { name: 'autocorrect-rule', version: '1', ruleId: '${RULE_ID}', coversCondition: 'all' };
-`;
-
-    insertRuleArtifact(ARTIFACT_ID, RULE_ID, 'task-autocorrect-valid', VALID_AUTOCORRECT_CODE);
-    await insertActivation(ACTIVATION_ID, ARTIFACT_ID, RULE_ID);
-
-    const warnCalls: string[] = [];
-    const spyLogger = {
-      warn: (message: string) => { warnCalls.push(message); },
-      error: () => {},
-      info: () => {},
-    };
-
-    const ruleHost = new RuleHost(tempStateDir, spyLogger, { workspaceDir: tempWorkspaceDir });
-    const result = ruleHost.evaluate(makeInput('/etc/passwd'));
-
-    // The valid auto_correct proposal MUST be accepted — not rejected due to
-    // VM prototype realm mismatch.
-    expect(result).toBeDefined();
-    expect(result?.decision).toBe('auto_correct');
-    expect(result?.matched).toBe(true);
-    expect(result?.correctionProposal).toBeDefined();
-    expect(result?.correctionProposal?.ruleId).toBe(RULE_ID);
-
-    // No warnings should be emitted about invalid results
-    const invalidWarn = warnCalls.find(m =>
-      m.toLowerCase().includes('invalid') ||
-      m.toLowerCase().includes('must be a plain object')
-    );
-    expect(invalidWarn).toBeUndefined();
-  });
-});

package/tests/core/rule-host-helpers.test.ts

@@ -1,120 +0,0 @@
-/**
- * Rule Host Helpers Tests
- *
- * PURPOSE: Verify that the helper whitelist:
- *   - Returns correct values from the frozen input snapshot
- *   - Is a frozen object that cannot be mutated
- *   - All helpers are pure functions with no side effects
- */
-
-import { describe, it, expect } from 'vitest';
-import { createRuleHostHelpers } from '../../src/core/rule-host-helpers.js';
-import type { RuleHostInput } from '../../src/core/rule-host-types.js';
-
-function makeInput(overrides?: Partial<RuleHostInput>): RuleHostInput {
-  return {
-    action: {
-      toolName: 'write',
-      normalizedPath: 'src/test.ts',
-      paramsSummary: {},
-    },
-    workspace: {
-      isRiskPath: false,
-      planStatus: 'NONE',
-      hasPlanFile: false,
-    },
-    session: {
-      sessionId: 'session-123',
-      currentGfi: 10,
-      recentThinking: false,
-    },
-    evolution: {
-      epTier: 2,
-    },
-    derived: {
-      estimatedLineChanges: 50,
-      bashRisk: 'normal',
-    },
-    ...overrides,
-  };
-}
-
-describe('createRuleHostHelpers', () => {
-  it('should return a frozen object', () => {
-    const helpers = createRuleHostHelpers(makeInput());
-    expect(Object.isFrozen(helpers)).toBe(true);
-  });
-
-  it('should throw TypeError when attempting to mutate helpers', () => {
-    const helpers = createRuleHostHelpers(makeInput()) as Record<string, unknown>;
-    expect(() => {
-      (helpers as any).isRiskPath = () => true;
-    }).toThrow(TypeError);
-  });
-
-  it('should return correct isRiskPath from input snapshot', () => {
-    const helpers = createRuleHostHelpers(makeInput({
-      workspace: { isRiskPath: true, planStatus: 'READY', hasPlanFile: true },
-    }));
-    expect(helpers.isRiskPath()).toBe(true);
-  });
-
-  it('should return false isRiskPath by default', () => {
-    const helpers = createRuleHostHelpers(makeInput());
-    expect(helpers.isRiskPath()).toBe(false);
-  });
-
-  it('should return correct toolName from input snapshot', () => {
-    const helpers = createRuleHostHelpers(makeInput());
-    expect(helpers.getToolName()).toBe('write');
-  });
-
-  it('should return correct estimatedLineChanges from input snapshot', () => {
-    const helpers = createRuleHostHelpers(makeInput({
-      derived: { estimatedLineChanges: 200, bashRisk: 'dangerous' },
-    }));
-    expect(helpers.getEstimatedLineChanges()).toBe(200);
-  });
-
-  it('should return correct bashRisk from input snapshot', () => {
-    const helpers = createRuleHostHelpers(makeInput({
-      derived: { estimatedLineChanges: 50, bashRisk: 'safe' },
-    }));
-    expect(helpers.getBashRisk()).toBe('safe');
-  });
-
-  it('should return correct hasPlanFile from input snapshot', () => {
-    const helpers = createRuleHostHelpers(makeInput({
-      workspace: { isRiskPath: false, planStatus: 'READY', hasPlanFile: true },
-    }));
-    expect(helpers.hasPlanFile()).toBe(true);
-  });
-
-  it('should return correct planStatus from input snapshot', () => {
-    const helpers = createRuleHostHelpers(makeInput({
-      workspace: { isRiskPath: false, planStatus: 'DRAFT', hasPlanFile: true },
-    }));
-    expect(helpers.getPlanStatus()).toBe('DRAFT');
-  });
-
-  it('should return correct epTier from input snapshot', () => {
-    const helpers = createRuleHostHelpers(makeInput({
-      evolution: { epTier: 4 },
-    }));
-    expect(helpers.getEpTier()).toBe(4);
-  });
-
-  it('all helpers should be pure functions with no side effects', () => {
-    const input = makeInput();
-    const helpers = createRuleHostHelpers(input);
-
-    // Call each helper multiple times — should always return the same value
-    expect(helpers.isRiskPath()).toBe(helpers.isRiskPath());
-    expect(helpers.getToolName()).toBe(helpers.getToolName());
-    expect(helpers.getEstimatedLineChanges()).toBe(helpers.getEstimatedLineChanges());
-    expect(helpers.getBashRisk()).toBe(helpers.getBashRisk());
-    expect(helpers.hasPlanFile()).toBe(helpers.hasPlanFile());
-    expect(helpers.getPlanStatus()).toBe(helpers.getPlanStatus());
-    expect(helpers.getEpTier()).toBe(helpers.getEpTier());
-  });
-});