ruflo 3.42.3 → 3.42.5

package/src/mcp-bridge/test-runtime-security.mjs

@@ -1,208 +1,208 @@
-#!/usr/bin/env node
-/**
- * ADR-166 runtime verification — spawn each bridge with a test env and
- * assert the load-bearing behaviors observed OVER THE WIRE. Complements
- * test-security-lock.js (which is static-source only).
- *
- * Behaviors verified:
- *   R1. bridge starts on 127.0.0.1 by default
- *   R2. with MCP_AUTH_TOKEN set: unauthenticated POST /mcp → 401
- *   R3. with MCP_AUTH_TOKEN set: authenticated POST /mcp → 200 (or ≠401)
- *   R4. terminal_execute call → TOOL_DISABLED error unless MCP_ENABLE_TERMINAL=true
- *   R5. public bind without MCP_AUTH_TOKEN → process exits ≠0 within 3s
- *
- *   node test-runtime-security.mjs
- */
-
-import { spawn } from "node:child_process";
-import { setTimeout as sleep } from "node:timers/promises";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const HERE = path.dirname(fileURLToPath(import.meta.url));
-const BRIDGES = [
-  { label: "src/mcp-bridge",          entry: path.join(HERE, "index.js") },
-  { label: "src/ruvocal/mcp-bridge",  entry: path.join(HERE, "..", "ruvocal", "mcp-bridge", "index.js") },
-];
-
-const TOKEN = "test-token-" + Math.random().toString(36).slice(2);
-let passed = 0, failed = 0;
-const failures = [];
-
-function assert(cond, label) {
-  if (cond) { console.log(`    ✓ ${label}`); passed++; }
-  else      { console.log(`    ✗ ${label}`); failures.push(label); failed++; }
-}
-
-async function pickPort() {
-  // Pick a random port in the ephemeral range and hope for the best;
-  // if the bridge fails to bind, the fetch will time out and we fail.
-  return 20000 + Math.floor(Math.random() * 10000);
-}
-
-async function startBridge(entry, env, { waitMs = 1500 } = {}) {
-  const child = spawn("node", [entry], {
-    env: { ...process.env, ...env },
-    stdio: ["ignore", "pipe", "pipe"],
-  });
-  let stdout = "", stderr = "";
-  child.stdout.on("data", (d) => { stdout += d.toString(); });
-  child.stderr.on("data", (d) => { stderr += d.toString(); });
-  const exitPromise = new Promise((resolve) => {
-    child.on("exit", (code) => resolve({ exited: true, code }));
-  });
-  const ready = Promise.race([
-    exitPromise,
-    sleep(waitMs).then(() => ({ exited: false, code: null })),
-  ]);
-  return { child, stdout: () => stdout, stderr: () => stderr, ready };
-}
-
-async function killAndWait(child) {
-  if (child.exitCode !== null) return;
-  try { child.kill("SIGTERM"); } catch { /* ignore */ }
-  await sleep(100);
-  if (child.exitCode === null) try { child.kill("SIGKILL"); } catch { /* ignore */ }
-}
-
-async function testBridge(label, entry) {
-  console.log(`\n# ${label}`);
-
-  // R1 + R2 + R3 + R4 — bridge starts with token, auth behavior + terminal gate
-  {
-    const port = await pickPort();
-    const b = await startBridge(entry, {
-      PORT: String(port),
-      MCP_BIND_HOST: "127.0.0.1",
-      MCP_AUTH_TOKEN: TOKEN,
-      MCP_ENABLE_TERMINAL: "false",
-      MCP_GROUP_DEVTOOLS: "false",
-      MCP_GROUP_INTELLIGENCE: "false",
-      MCP_GROUP_AGENTS: "false",
-      MCP_GROUP_MEMORY: "false",
-    });
-    const state = await b.ready;
-    if (state.exited) {
-      assert(false, `R1. bridge starts on 127.0.0.1 (exited early, code=${state.code}; stderr=${b.stderr().slice(0, 200)})`);
-    } else {
-      assert(true, "R1. bridge starts on 127.0.0.1 (didn't exit within 1.5s)");
-
-      // R2 — unauthenticated POST /mcp → 401
-      try {
-        const r = await fetch(`http://127.0.0.1:${port}/mcp`, {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list" }),
-        });
-        assert(r.status === 401, `R2. unauthenticated POST /mcp → 401 (got ${r.status})`);
-      } catch (e) {
-        assert(false, `R2. unauthenticated POST /mcp threw: ${e.message}`);
-      }
-
-      // R3 — authenticated POST /mcp → not 401
-      try {
-        const r = await fetch(`http://127.0.0.1:${port}/mcp`, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "Authorization": `Bearer ${TOKEN}`,
-          },
-          body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list" }),
-        });
-        assert(r.status !== 401, `R3. authenticated POST /mcp → ≠401 (got ${r.status})`);
-      } catch (e) {
-        assert(false, `R3. authenticated POST /mcp threw: ${e.message}`);
-      }
-
-      // R4 — terminal_execute → TOOL_DISABLED (denied at executeTool, not just autopilot)
-      try {
-        const r = await fetch(`http://127.0.0.1:${port}/mcp`, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "Authorization": `Bearer ${TOKEN}`,
-          },
-          body: JSON.stringify({
-            jsonrpc: "2.0", id: 1, method: "tools/call",
-            params: { name: "terminal_execute", arguments: { command: "id" } },
-          }),
-        });
-        const body = await r.json();
-        // The response wraps the executeTool result in `result.content[0].text` as JSON string.
-        const text = JSON.stringify(body);
-        assert(text.includes("TOOL_DISABLED") || text.includes("disabled by default"),
-          "R4. terminal_execute denied server-side (TOOL_DISABLED)");
-      } catch (e) {
-        assert(false, `R4. terminal_execute threw: ${e.message}`);
-      }
-
-      // R6 — #2425 djimit streamable-HTTP session cleanup: DELETE /mcp → 204
-      try {
-        const r = await fetch(`http://127.0.0.1:${port}/mcp`, {
-          method: "DELETE",
-          headers: {
-            "Authorization": `Bearer ${TOKEN}`,
-            "Mcp-Session-Id": "test-cleanup",
-          },
-        });
-        assert(r.status === 204, `R6. DELETE /mcp → 204 (got ${r.status})`);
-        assert(!!r.headers.get("Mcp-Session-Id"), "R6b. Mcp-Session-Id header echoed on /mcp*");
-      } catch (e) {
-        assert(false, `R6. DELETE /mcp threw: ${e.message}`);
-      }
-
-      // R7 — #2425 notifications/initialized returns 202 Accepted with empty body
-      try {
-        const r = await fetch(`http://127.0.0.1:${port}/mcp`, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "Authorization": `Bearer ${TOKEN}`,
-          },
-          body: JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }),
-        });
-        assert(r.status === 202, `R7. notifications/initialized → 202 (got ${r.status})`);
-        assert((await r.text()) === "", "R7b. notifications/initialized has empty body");
-      } catch (e) {
-        assert(false, `R7. notifications/initialized threw: ${e.message}`);
-      }
-    }
-    await killAndWait(b.child);
-  }
-
-  // R5 — public bind without token → process exits ≠0 within 3s
-  {
-    const port = await pickPort();
-    const b = await startBridge(entry, {
-      PORT: String(port),
-      MCP_BIND_HOST: "0.0.0.0",
-      MCP_AUTH_TOKEN: "",
-      MCP_GROUP_DEVTOOLS: "false",
-      MCP_GROUP_INTELLIGENCE: "false",
-      MCP_GROUP_AGENTS: "false",
-      MCP_GROUP_MEMORY: "false",
-    }, { waitMs: 3000 });
-    const state = await b.ready;
-    assert(state.exited && state.code !== 0,
-      `R5. public bind without token exits ≠0 (exited=${state.exited}, code=${state.code})`);
-    if (b.stderr().includes("FATAL")) {
-      assert(true, "R5b. FATAL message logged to stderr");
-    } else {
-      assert(false, "R5b. FATAL message expected in stderr");
-    }
-    await killAndWait(b.child);
-  }
-}
-
-(async () => {
-  for (const { label, entry } of BRIDGES) {
-    await testBridge(label, entry);
-  }
-  console.log(`\n${passed} passed, ${failed} failed`);
-  if (failed > 0) {
-    console.log("\nFailures:");
-    for (const f of failures) console.log(`  - ${f}`);
-    process.exit(1);
-  }
-  console.log("ADR-166 runtime verification: OK");
-})();
+#!/usr/bin/env node
+/**
+ * ADR-166 runtime verification — spawn each bridge with a test env and
+ * assert the load-bearing behaviors observed OVER THE WIRE. Complements
+ * test-security-lock.js (which is static-source only).
+ *
+ * Behaviors verified:
+ *   R1. bridge starts on 127.0.0.1 by default
+ *   R2. with MCP_AUTH_TOKEN set: unauthenticated POST /mcp → 401
+ *   R3. with MCP_AUTH_TOKEN set: authenticated POST /mcp → 200 (or ≠401)
+ *   R4. terminal_execute call → TOOL_DISABLED error unless MCP_ENABLE_TERMINAL=true
+ *   R5. public bind without MCP_AUTH_TOKEN → process exits ≠0 within 3s
+ *
+ *   node test-runtime-security.mjs
+ */
+
+import { spawn } from "node:child_process";
+import { setTimeout as sleep } from "node:timers/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const BRIDGES = [
+  { label: "src/mcp-bridge",          entry: path.join(HERE, "index.js") },
+  { label: "src/ruvocal/mcp-bridge",  entry: path.join(HERE, "..", "ruvocal", "mcp-bridge", "index.js") },
+];
+
+const TOKEN = "test-token-" + Math.random().toString(36).slice(2);
+let passed = 0, failed = 0;
+const failures = [];
+
+function assert(cond, label) {
+  if (cond) { console.log(`    ✓ ${label}`); passed++; }
+  else      { console.log(`    ✗ ${label}`); failures.push(label); failed++; }
+}
+
+async function pickPort() {
+  // Pick a random port in the ephemeral range and hope for the best;
+  // if the bridge fails to bind, the fetch will time out and we fail.
+  return 20000 + Math.floor(Math.random() * 10000);
+}
+
+async function startBridge(entry, env, { waitMs = 1500 } = {}) {
+  const child = spawn("node", [entry], {
+    env: { ...process.env, ...env },
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  let stdout = "", stderr = "";
+  child.stdout.on("data", (d) => { stdout += d.toString(); });
+  child.stderr.on("data", (d) => { stderr += d.toString(); });
+  const exitPromise = new Promise((resolve) => {
+    child.on("exit", (code) => resolve({ exited: true, code }));
+  });
+  const ready = Promise.race([
+    exitPromise,
+    sleep(waitMs).then(() => ({ exited: false, code: null })),
+  ]);
+  return { child, stdout: () => stdout, stderr: () => stderr, ready };
+}
+
+async function killAndWait(child) {
+  if (child.exitCode !== null) return;
+  try { child.kill("SIGTERM"); } catch { /* ignore */ }
+  await sleep(100);
+  if (child.exitCode === null) try { child.kill("SIGKILL"); } catch { /* ignore */ }
+}
+
+async function testBridge(label, entry) {
+  console.log(`\n# ${label}`);
+
+  // R1 + R2 + R3 + R4 — bridge starts with token, auth behavior + terminal gate
+  {
+    const port = await pickPort();
+    const b = await startBridge(entry, {
+      PORT: String(port),
+      MCP_BIND_HOST: "127.0.0.1",
+      MCP_AUTH_TOKEN: TOKEN,
+      MCP_ENABLE_TERMINAL: "false",
+      MCP_GROUP_DEVTOOLS: "false",
+      MCP_GROUP_INTELLIGENCE: "false",
+      MCP_GROUP_AGENTS: "false",
+      MCP_GROUP_MEMORY: "false",
+    });
+    const state = await b.ready;
+    if (state.exited) {
+      assert(false, `R1. bridge starts on 127.0.0.1 (exited early, code=${state.code}; stderr=${b.stderr().slice(0, 200)})`);
+    } else {
+      assert(true, "R1. bridge starts on 127.0.0.1 (didn't exit within 1.5s)");
+
+      // R2 — unauthenticated POST /mcp → 401
+      try {
+        const r = await fetch(`http://127.0.0.1:${port}/mcp`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list" }),
+        });
+        assert(r.status === 401, `R2. unauthenticated POST /mcp → 401 (got ${r.status})`);
+      } catch (e) {
+        assert(false, `R2. unauthenticated POST /mcp threw: ${e.message}`);
+      }
+
+      // R3 — authenticated POST /mcp → not 401
+      try {
+        const r = await fetch(`http://127.0.0.1:${port}/mcp`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "Authorization": `Bearer ${TOKEN}`,
+          },
+          body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list" }),
+        });
+        assert(r.status !== 401, `R3. authenticated POST /mcp → ≠401 (got ${r.status})`);
+      } catch (e) {
+        assert(false, `R3. authenticated POST /mcp threw: ${e.message}`);
+      }
+
+      // R4 — terminal_execute → TOOL_DISABLED (denied at executeTool, not just autopilot)
+      try {
+        const r = await fetch(`http://127.0.0.1:${port}/mcp`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "Authorization": `Bearer ${TOKEN}`,
+          },
+          body: JSON.stringify({
+            jsonrpc: "2.0", id: 1, method: "tools/call",
+            params: { name: "terminal_execute", arguments: { command: "id" } },
+          }),
+        });
+        const body = await r.json();
+        // The response wraps the executeTool result in `result.content[0].text` as JSON string.
+        const text = JSON.stringify(body);
+        assert(text.includes("TOOL_DISABLED") || text.includes("disabled by default"),
+          "R4. terminal_execute denied server-side (TOOL_DISABLED)");
+      } catch (e) {
+        assert(false, `R4. terminal_execute threw: ${e.message}`);
+      }
+
+      // R6 — #2425 djimit streamable-HTTP session cleanup: DELETE /mcp → 204
+      try {
+        const r = await fetch(`http://127.0.0.1:${port}/mcp`, {
+          method: "DELETE",
+          headers: {
+            "Authorization": `Bearer ${TOKEN}`,
+            "Mcp-Session-Id": "test-cleanup",
+          },
+        });
+        assert(r.status === 204, `R6. DELETE /mcp → 204 (got ${r.status})`);
+        assert(!!r.headers.get("Mcp-Session-Id"), "R6b. Mcp-Session-Id header echoed on /mcp*");
+      } catch (e) {
+        assert(false, `R6. DELETE /mcp threw: ${e.message}`);
+      }
+
+      // R7 — #2425 notifications/initialized returns 202 Accepted with empty body
+      try {
+        const r = await fetch(`http://127.0.0.1:${port}/mcp`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "Authorization": `Bearer ${TOKEN}`,
+          },
+          body: JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }),
+        });
+        assert(r.status === 202, `R7. notifications/initialized → 202 (got ${r.status})`);
+        assert((await r.text()) === "", "R7b. notifications/initialized has empty body");
+      } catch (e) {
+        assert(false, `R7. notifications/initialized threw: ${e.message}`);
+      }
+    }
+    await killAndWait(b.child);
+  }
+
+  // R5 — public bind without token → process exits ≠0 within 3s
+  {
+    const port = await pickPort();
+    const b = await startBridge(entry, {
+      PORT: String(port),
+      MCP_BIND_HOST: "0.0.0.0",
+      MCP_AUTH_TOKEN: "",
+      MCP_GROUP_DEVTOOLS: "false",
+      MCP_GROUP_INTELLIGENCE: "false",
+      MCP_GROUP_AGENTS: "false",
+      MCP_GROUP_MEMORY: "false",
+    }, { waitMs: 3000 });
+    const state = await b.ready;
+    assert(state.exited && state.code !== 0,
+      `R5. public bind without token exits ≠0 (exited=${state.exited}, code=${state.code})`);
+    if (b.stderr().includes("FATAL")) {
+      assert(true, "R5b. FATAL message logged to stderr");
+    } else {
+      assert(false, "R5b. FATAL message expected in stderr");
+    }
+    await killAndWait(b.child);
+  }
+}
+
+(async () => {
+  for (const { label, entry } of BRIDGES) {
+    await testBridge(label, entry);
+  }
+  console.log(`\n${passed} passed, ${failed} failed`);
+  if (failed > 0) {
+    console.log("\nFailures:");
+    for (const f of failures) console.log(`  - ${f}`);
+    process.exit(1);
+  }
+  console.log("ADR-166 runtime verification: OK");
+})();

package/src/mcp-bridge/test-security-lock.js

@@ -1,121 +1,121 @@
-#!/usr/bin/env node
-/**
- * ADR-166 §6 acceptance #9 — anti-regression lock for the MCP-bridge
- * security surface. Runs on the source of BOTH bridge files (the ruvocal
- * variant that ships in docker-compose, and the sibling REST bridge).
- *
- * Fails if any of the following load-bearing controls silently disappears:
- *   1. `MCP_BIND_HOST` default is `127.0.0.1` (loopback default — Phase 1a)
- *   2. Public bind without `MCP_AUTH_TOKEN` calls `process.exit(1)` at boot (Phase 1b)
- *   3. `requireAuth` middleware exists and is mounted with `app.use(requireAuth)` (Phase 1c)
- *   4. `requireAuth` uses `timingSafeEqual` (constant-time compare)
- *   5. `executeTool` denies terminal_execute unless `MCP_ENABLE_TERMINAL === "true"` (Phase 1d + 2a)
- *   6. CORS respects `MCP_CORS_ORIGIN` allowlist (Phase 3b)
- *   9. Both production images use the supported Node 24 LTS line (#2847)
- *
- * Runs offline (no server, no deps). CI-safe.
- *
- *   node test-security-lock.js       # → exit 0 on green, exit 1 on regression
- */
-
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const HERE = path.dirname(fileURLToPath(import.meta.url));
-const BRIDGES = [
-  path.join(HERE, "index.js"),                           // ruflo/src/mcp-bridge/index.js
-  path.join(HERE, "..", "ruvocal", "mcp-bridge", "index.js"), // ruvocal variant (deployed)
-];
-const DOCKERFILES = [
-  path.join(HERE, "Dockerfile"),
-  path.join(HERE, "..", "ruvocal", "mcp-bridge", "Dockerfile"),
-];
-
-const CHECKS = [
-  {
-    id: "1. bind-loopback-default",
-    rx: /BIND_HOST\s*=\s*process\.env\.MCP_BIND_HOST\s*\|\|\s*["']127\.0\.0\.1["']/,
-    hint: "MCP_BIND_HOST must default to 127.0.0.1 (ADR-166 §6 Phase 1a)",
-  },
-  {
-    id: "2. fail-closed-public-bind",
-    rx: /isPublic\s*&&\s*!process\.env\.MCP_AUTH_TOKEN[\s\S]*?process\.exit\(\s*1\s*\)/,
-    hint: "public bind without MCP_AUTH_TOKEN must process.exit(1) at boot (Phase 1b)",
-  },
-  {
-    id: "3. auth-middleware-mounted",
-    rx: /app\.use\(\s*requireAuth\s*\)/,
-    hint: "requireAuth middleware must be mounted via app.use() (Phase 1c)",
-  },
-  {
-    id: "4. constant-time-token-compare",
-    rx: /timingSafeEqual\s*\(/,
-    hint: "auth compare must use timingSafeEqual (Phase 1c)",
-  },
-  {
-    id: "5. terminal-gate-server-side",
-    rx: /MCP_ENABLE_TERMINAL[\s\S]*?executeTool[\s\S]*?TOOL_DISABLED|executeTool[\s\S]*?MCP_ENABLE_TERMINAL[\s\S]*?TOOL_DISABLED/,
-    hint: "terminal_execute must be denied at executeTool unless MCP_ENABLE_TERMINAL=true (Phase 1d + 2a)",
-  },
-  {
-    id: "6. cors-allowlist-respected",
-    rx: /MCP_CORS_ORIGIN[\s\S]*?CORS_ALLOWLIST/,
-    hint: "CORS must respect MCP_CORS_ORIGIN allowlist (Phase 3b)",
-  },
-  {
-    id: "7. streamable-http-delete-handler (#2425)",
-    rx: /app\.delete\(\s*["']\/mcp["']\s*,/,
-    hint: "DELETE /mcp must be handled for streamable-HTTP session cleanup (#2425)",
-  },
-  {
-    id: "8. mcp-session-id-header (#2425)",
-    rx: /Mcp-Session-Id/,
-    hint: "Mcp-Session-Id header must be echoed on /mcp* responses (#2425)",
-  },
-];
-
-let hardFail = false;
-for (const bridge of BRIDGES) {
-  if (!fs.existsSync(bridge)) {
-    console.error(`FAIL: bridge missing: ${bridge}`);
-    hardFail = true;
-    continue;
-  }
-  const src = fs.readFileSync(bridge, "utf-8");
-  const rel = path.relative(path.join(HERE, "..", ".."), bridge);
-  console.log(`\n# ${rel}`);
-  for (const check of CHECKS) {
-    if (check.rx.test(src)) {
-      console.log(`  ✓ ${check.id}`);
-    } else {
-      console.log(`  ✗ ${check.id}`);
-      console.log(`    hint: ${check.hint}`);
-      hardFail = true;
-    }
-  }
-}
-
-for (const dockerfile of DOCKERFILES) {
-  if (!fs.existsSync(dockerfile)) {
-    console.error(`FAIL: Dockerfile missing: ${dockerfile}`);
-    hardFail = true;
-    continue;
-  }
-  const source = fs.readFileSync(dockerfile, "utf-8");
-  const rel = path.relative(path.join(HERE, "..", ".."), dockerfile);
-  console.log(`\n# ${rel}`);
-  if (/^FROM\s+node:24(?:[.-][^\s]+)?\s*$/m.test(source)) {
-    console.log("  ✓ 9. supported-node-lts-runtime (#2847)");
-  } else {
-    console.log("  ✗ 9. supported-node-lts-runtime (#2847)");
-    console.log("    hint: production images must use the supported node:24 LTS line");
-    hardFail = true;
-  }
-}
-
-if (hardFail) {
-  console.error("\nADR-166 security lock FAILED — a load-bearing control was removed or drifted.");
-  process.exit(1);
-}
-console.log("\nADR-166 security lock: OK");
+#!/usr/bin/env node
+/**
+ * ADR-166 §6 acceptance #9 — anti-regression lock for the MCP-bridge
+ * security surface. Runs on the source of BOTH bridge files (the ruvocal
+ * variant that ships in docker-compose, and the sibling REST bridge).
+ *
+ * Fails if any of the following load-bearing controls silently disappears:
+ *   1. `MCP_BIND_HOST` default is `127.0.0.1` (loopback default — Phase 1a)
+ *   2. Public bind without `MCP_AUTH_TOKEN` calls `process.exit(1)` at boot (Phase 1b)
+ *   3. `requireAuth` middleware exists and is mounted with `app.use(requireAuth)` (Phase 1c)
+ *   4. `requireAuth` uses `timingSafeEqual` (constant-time compare)
+ *   5. `executeTool` denies terminal_execute unless `MCP_ENABLE_TERMINAL === "true"` (Phase 1d + 2a)
+ *   6. CORS respects `MCP_CORS_ORIGIN` allowlist (Phase 3b)
+ *   9. Both production images use the supported Node 24 LTS line (#2847)
+ *
+ * Runs offline (no server, no deps). CI-safe.
+ *
+ *   node test-security-lock.js       # → exit 0 on green, exit 1 on regression
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const BRIDGES = [
+  path.join(HERE, "index.js"),                           // ruflo/src/mcp-bridge/index.js
+  path.join(HERE, "..", "ruvocal", "mcp-bridge", "index.js"), // ruvocal variant (deployed)
+];
+const DOCKERFILES = [
+  path.join(HERE, "Dockerfile"),
+  path.join(HERE, "..", "ruvocal", "mcp-bridge", "Dockerfile"),
+];
+
+const CHECKS = [
+  {
+    id: "1. bind-loopback-default",
+    rx: /BIND_HOST\s*=\s*process\.env\.MCP_BIND_HOST\s*\|\|\s*["']127\.0\.0\.1["']/,
+    hint: "MCP_BIND_HOST must default to 127.0.0.1 (ADR-166 §6 Phase 1a)",
+  },
+  {
+    id: "2. fail-closed-public-bind",
+    rx: /isPublic\s*&&\s*!process\.env\.MCP_AUTH_TOKEN[\s\S]*?process\.exit\(\s*1\s*\)/,
+    hint: "public bind without MCP_AUTH_TOKEN must process.exit(1) at boot (Phase 1b)",
+  },
+  {
+    id: "3. auth-middleware-mounted",
+    rx: /app\.use\(\s*requireAuth\s*\)/,
+    hint: "requireAuth middleware must be mounted via app.use() (Phase 1c)",
+  },
+  {
+    id: "4. constant-time-token-compare",
+    rx: /timingSafeEqual\s*\(/,
+    hint: "auth compare must use timingSafeEqual (Phase 1c)",
+  },
+  {
+    id: "5. terminal-gate-server-side",
+    rx: /MCP_ENABLE_TERMINAL[\s\S]*?executeTool[\s\S]*?TOOL_DISABLED|executeTool[\s\S]*?MCP_ENABLE_TERMINAL[\s\S]*?TOOL_DISABLED/,
+    hint: "terminal_execute must be denied at executeTool unless MCP_ENABLE_TERMINAL=true (Phase 1d + 2a)",
+  },
+  {
+    id: "6. cors-allowlist-respected",
+    rx: /MCP_CORS_ORIGIN[\s\S]*?CORS_ALLOWLIST/,
+    hint: "CORS must respect MCP_CORS_ORIGIN allowlist (Phase 3b)",
+  },
+  {
+    id: "7. streamable-http-delete-handler (#2425)",
+    rx: /app\.delete\(\s*["']\/mcp["']\s*,/,
+    hint: "DELETE /mcp must be handled for streamable-HTTP session cleanup (#2425)",
+  },
+  {
+    id: "8. mcp-session-id-header (#2425)",
+    rx: /Mcp-Session-Id/,
+    hint: "Mcp-Session-Id header must be echoed on /mcp* responses (#2425)",
+  },
+];
+
+let hardFail = false;
+for (const bridge of BRIDGES) {
+  if (!fs.existsSync(bridge)) {
+    console.error(`FAIL: bridge missing: ${bridge}`);
+    hardFail = true;
+    continue;
+  }
+  const src = fs.readFileSync(bridge, "utf-8");
+  const rel = path.relative(path.join(HERE, "..", ".."), bridge);
+  console.log(`\n# ${rel}`);
+  for (const check of CHECKS) {
+    if (check.rx.test(src)) {
+      console.log(`  ✓ ${check.id}`);
+    } else {
+      console.log(`  ✗ ${check.id}`);
+      console.log(`    hint: ${check.hint}`);
+      hardFail = true;
+    }
+  }
+}
+
+for (const dockerfile of DOCKERFILES) {
+  if (!fs.existsSync(dockerfile)) {
+    console.error(`FAIL: Dockerfile missing: ${dockerfile}`);
+    hardFail = true;
+    continue;
+  }
+  const source = fs.readFileSync(dockerfile, "utf-8");
+  const rel = path.relative(path.join(HERE, "..", ".."), dockerfile);
+  console.log(`\n# ${rel}`);
+  if (/^FROM\s+node:24(?:[.-][^\s]+)?\s*$/m.test(source)) {
+    console.log("  ✓ 9. supported-node-lts-runtime (#2847)");
+  } else {
+    console.log("  ✗ 9. supported-node-lts-runtime (#2847)");
+    console.log("    hint: production images must use the supported node:24 LTS line");
+    hardFail = true;
+  }
+}
+
+if (hardFail) {
+  console.error("\nADR-166 security lock FAILED — a load-bearing control was removed or drifted.");
+  process.exit(1);
+}
+console.log("\nADR-166 security lock: OK");