serverless-ircd 0.8.0 → 0.10.0

package/packages/irc-server/tests/actor.test.ts

@@ -1,5 +1,4 @@
 import {
-  type AccountStore,
   type AwayStore,
   CapturingLogger,
   type ChanName,
@@ -26,8 +25,6 @@ import {
   type NickHistoryStore,
   Numerics,
   type RawLine,
-  type SaslPayload,
-  type SaslResult,
   SequentialIdFactory,
   type ServerConfig,
   type ServerStats,
@@ -219,7 +216,6 @@ function makeActor(opts: {
   logger?: Logger;
   traceId?: string;
   messages?: MessageStore;
-  accounts?: AccountStore;
   mtlsIdentity?: MtlsIdentityProvider;
   history?: NickHistoryStore;
   stats?: ServerStats;
@@ -280,9 +276,6 @@ function makeActor(opts: {
   if (opts.messages !== undefined) {
     finalOpts.messages = opts.messages;
   }
-  if (opts.accounts !== undefined) {
-    finalOpts.accounts = opts.accounts;
-  }
   if (opts.mtlsIdentity !== undefined) {
     finalOpts.mtlsIdentity = opts.mtlsIdentity;
   }
@@ -908,12 +901,13 @@ describe('ConnectionActor — additional routing', () => {
     expect(lines[0]?.text).toContain('462');
   });
 
-  it('routes PASS to passReducer (stashes the attempt)', async () => {
+  it('routes PASS to passReducer (bare post-registration PASS is a no-op)', async () => {
     const { actor, runtime } = makeActor({});
     await actor.receiveTextFrame('PASS sekrat\r\n');
-    // passReducer on an already-registered conn emits a 462 Send.
+    // passReducer on a registered conn with no AccountStore treats a bare
+    // server-password PASS as a silent no-op (no 462, no disconnect).
     const sends = runtime.calls.filter((c) => c.method === 'send');
-    expect(sends).toHaveLength(1);
+    expect(sends).toHaveLength(0);
   });
 
   it('routes PONG to pongReducer (no effects, lastSeen refreshed)', async () => {
@@ -2128,17 +2122,7 @@ describe('ConnectionActor — CHATHISTORY', () => {
 // SASL / AccountStore — actor plumbing (ctx.accounts threaded through buildCtx)
 // ===========================================================================
 
-describe('ConnectionActor — SASL AccountStore plumbing', () => {
-  /** Capture-and-respond fake AccountStore (mirrors the irc-core sasl tests). */
-  class FakeAccountStore implements AccountStore {
-    readonly calls: Array<{ mech: string; payload: SaslPayload }> = [];
-    constructor(private readonly result: SaslResult) {}
-    verify(mech: string, payload: SaslPayload): SaslResult {
-      this.calls.push({ mech, payload });
-      return this.result;
-    }
-  }
-
+describe('ConnectionActor — SASL ServicesStore plumbing', () => {
   /** Builds the PLAIN base64 payload `authzid\0authcid\0password`. */
   function plainPayload(authcid: string, password: string): string {
     return encodeBase64(`\0${authcid}\0${password}`);
@@ -2153,11 +2137,12 @@ describe('ConnectionActor — SASL AccountStore plumbing', () => {
     };
   }
 
-  it('completes SASL PLAIN with 900/903 when a bound AccountStore accepts creds', async () => {
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+  it('completes SASL PLAIN with 900/903 when a bound ServicesStore accepts creds', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(0) });
+    services.registerNick('alice', 'secret', 'alice@example.com');
     const { actor, runtime, conn } = makeActor({
       conn: saslReadyConn(),
-      accounts,
+      services,
     });
     conn.nick = 'alice';
     runtime.calls.length = 0;
@@ -2172,18 +2157,14 @@ describe('ConnectionActor — SASL AccountStore plumbing', () => {
     expect(lines.some((l) => l.text.includes(' 903 '))).toBe(true);
     // Critical: never 904 for valid creds.
     expect(lines.some((l) => l.text.includes(' 904 '))).toBe(false);
-    // The AccountStore was consulted with the parsed PLAIN credentials.
-    expect(accounts.calls).toEqual([
-      { mech: 'PLAIN', payload: { kind: 'PLAIN', username: 'alice', password: 'secret' } },
-    ]);
     // Account name recorded on the connection for extended-join/account-tag.
     expect(conn.account).toBe('alice');
   });
 
-  it('emits 904 ERR_SASLFAIL when no AccountStore is bound (regression guard)', async () => {
+  it('emits 904 ERR_SASLFAIL when no ServicesStore is bound (regression guard)', async () => {
     const { actor, runtime, conn } = makeActor({
       conn: saslReadyConn(),
-      // No `accounts` option → ctx.accounts is undefined.
+      // No `services` option → ctx.services is undefined.
     });
     conn.nick = 'alice';
     runtime.calls.length = 0;
@@ -2201,11 +2182,12 @@ describe('ConnectionActor — SASL AccountStore plumbing', () => {
     expect(conn.account).toBeUndefined();
   });
 
-  it('emits 904 when a bound AccountStore rejects the credentials', async () => {
-    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
+  it('emits 904 when a bound ServicesStore rejects the credentials', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(0) });
+    services.registerNick('alice', 'secret', 'alice@example.com');
     const { actor, runtime, conn } = makeActor({
       conn: saslReadyConn(),
-      accounts,
+      services,
     });
     conn.nick = 'alice';
     runtime.calls.length = 0;
@@ -2222,16 +2204,6 @@ describe('ConnectionActor — SASL AccountStore plumbing', () => {
 });
 
 describe('ConnectionActor — SASL EXTERNAL + mTLS plumbing', () => {
-  /** Fake AccountStore that accepts EXTERNAL with a known cert subject. */
-  class FakeAccountStore implements AccountStore {
-    readonly calls: Array<{ mech: string; payload: SaslPayload }> = [];
-    constructor(private readonly result: SaslResult) {}
-    verify(mech: string, payload: SaslPayload): SaslResult {
-      this.calls.push({ mech, payload });
-      return this.result;
-    }
-  }
-
   /** Fake MtlsIdentityProvider returning a canned subject for 'c1'. */
   class FakeMtlsProvider implements MtlsIdentityProvider {
     constructor(private readonly identity: string | undefined) {}
@@ -2249,11 +2221,13 @@ describe('ConnectionActor — SASL EXTERNAL + mTLS plumbing', () => {
   }
 
   it('completes SASL EXTERNAL with 900/903 when mTLS provider and store accept', async () => {
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = new InMemoryServicesStore({ clock: new FakeClock(0) });
+    services.registerNick('alice', 'secret', 'alice@example.com');
+    services.addCertFP('alice', 'CN=alice');
     const mtlsIdentity = new FakeMtlsProvider('CN=alice');
     const { actor, runtime, conn } = makeActor({
       conn: saslReadyConn(),
-      accounts,
+      services,
       mtlsIdentity,
     });
     conn.nick = 'alice';
@@ -2267,17 +2241,16 @@ describe('ConnectionActor — SASL EXTERNAL + mTLS plumbing', () => {
     expect(lines.some((l) => l.text.includes(' 900 '))).toBe(true);
     expect(lines.some((l) => l.text.includes(' 903 '))).toBe(true);
     expect(lines.some((l) => l.text.includes(' 904 '))).toBe(false);
-    expect(accounts.calls).toEqual([
-      { mech: 'EXTERNAL', payload: { kind: 'EXTERNAL', identity: 'CN=alice' } },
-    ]);
     expect(conn.account).toBe('alice');
   });
 
   it('returns 908 for EXTERNAL when no mTLS provider is bound', async () => {
-    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = new InMemoryServicesStore({ clock: new FakeClock(0) });
+    services.registerNick('alice', 'secret', 'alice@example.com');
+    services.addCertFP('alice', 'CN=alice');
     const { actor, runtime, conn } = makeActor({
       conn: saslReadyConn(),
-      accounts,
+      services,
       // No mtlsIdentity → EXTERNAL should 908 at mechanism phase.
     });
     conn.nick = 'alice';
@@ -4261,6 +4234,39 @@ describe('ConnectionActor — draft/read-marker MARKREAD verb', () => {
     const lines = sends[0]?.args[1] as RawLine[];
     expect(lines[0]?.text).toBe(':irc.example.com 421 alice MARKREAD :Unknown command');
   });
+
+  it('silently ignores a nick-target MARKREAD (read markers are channel-scoped)', async () => {
+    const store = new InMemoryMessageStore();
+    const { actor, runtime, conn } = makeActor({ messages: store });
+    conn.caps = new Set<string>(['draft/read-marker']);
+    runtime.calls.length = 0;
+
+    // A nick (non-channel) target falls through to the `return []` arm — the
+    // deployment has no nick-scoped read markers, so the verb is a no-op
+    // rather than a 421 or a FAIL.
+    await actor.receiveTextFrame(`MARKREAD alice ${TS(2_000)}\r\n`);
+
+    expect(runtime.calls).toHaveLength(0);
+  });
+
+  it('routes a parameterless MARKREAD through the reducer (NEED_MORE_PARAMS, never 421 fallthrough)', async () => {
+    const store = new InMemoryMessageStore();
+    const { actor, runtime, conn } = makeActor({ messages: store });
+    conn.caps = new Set<string>(['draft/read-marker']);
+    runtime.calls.length = 0;
+
+    // No params at all → `msg.params[0] ?? ''` falls back to the empty
+    // string, which is routed into the reducer so it can FAIL
+    // NEED_MORE_PARAMS rather than hitting the generic 421 fallthrough.
+    await actor.receiveTextFrame('MARKREAD\r\n');
+
+    const sends = runtime.calls.filter((c) => c.method === 'send');
+    expect(sends).toHaveLength(1);
+    const lines = sends[0]?.args[1] as RawLine[];
+    expect(lines[0]?.text).toContain('NEED_MORE_PARAMS');
+    // Critical: never the generic 421 fallthrough for a cap-enabled client.
+    expect(lines[0]?.text).not.toContain(' 421 ');
+  });
 });
 
 describe('ConnectionActor — draft/multiline BATCH to a nick target', () => {
@@ -4978,3 +4984,331 @@ describe('ConnectionActor — OperServ routing', () => {
     );
   });
 });
+
+// ============================================================================
+// echo-message — services PRIVMSG echo (IRCv3)
+//
+// When a client that negotiated `echo-message` sends `PRIVMSG <ServiceNick>`
+// the server must echo the sender's own PRIVMSG line back, BEFORE the service
+// reducer's NOTICE reply — matching how every other PRIVMSG renders (your
+// outgoing line first, then any reply). Without this echo,
+// modern IRCv3 clients optimistically show the outgoing message as "sending"
+// and flip it to "failed" when no delivery confirmation arrives.
+// ============================================================================
+
+describe('ConnectionActor — echo-message on service PRIVMSG', () => {
+  function makeOnlineConn(id: string, nick: string): ConnectionState {
+    const c = createConnection({ id, connectedSince: 0 });
+    c.nick = nick;
+    c.user = nick;
+    c.host = `${nick}.org`;
+    c.realname = nick;
+    c.registration = 'registered';
+    return c;
+  }
+
+  it('echoes the sender PRIVMSG back when echo-message is negotiated (NickServ)', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const { actor, runtime } = makeActor({
+      services,
+      conn: { caps: new Set<string>(['echo-message']) },
+    });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG NickServ :IDENTIFY hunter2\r\n');
+
+    const toAlice = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const allText = toAlice.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(allText).toContain(':alice!alice@example.com PRIVMSG NickServ :IDENTIFY hunter2');
+  });
+
+  it('does NOT echo when echo-message is not negotiated', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const { actor, runtime } = makeActor({ services });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG NickServ :IDENTIFY hunter2\r\n');
+
+    const toAlice = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const allText = toAlice.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    for (const t of allText) {
+      expect(t).not.toMatch(/PRIVMSG NickServ :IDENTIFY hunter2$/);
+    }
+  });
+
+  it('emits the echo BEFORE the NickServ NOTICE reply (ordering)', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const { actor, runtime } = makeActor({
+      services,
+      conn: { caps: new Set<string>(['echo-message']) },
+    });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG NickServ :IDENTIFY hunter2\r\n');
+
+    const sendCalls = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const findIdx = (needle: string): number =>
+      sendCalls.findIndex((c) => (c.args[1] as RawLine[]).some((l) => l.text.includes(needle)));
+    const noticeIdx = findIdx('NickServ!NickServ@services NOTICE');
+    const echoIdx = findIdx('PRIVMSG NickServ :IDENTIFY hunter2');
+    expect(noticeIdx).toBeGreaterThanOrEqual(0);
+    expect(echoIdx).toBeGreaterThanOrEqual(0);
+    expect(echoIdx).toBeLessThan(noticeIdx);
+  });
+
+  it('echoes the sender PRIVMSG back for ChanServ (shared fix, not NickServ-specific)', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const { actor, runtime } = makeActor({
+      services,
+      conn: { caps: new Set<string>(['echo-message']) },
+    });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG ChanServ :HELP\r\n');
+
+    const toAlice = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const allText = toAlice.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(allText).toContain(':alice!alice@example.com PRIVMSG ChanServ :HELP');
+  });
+
+  it('preserves the sender target casing in the echo', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const { actor, runtime } = makeActor({
+      services,
+      conn: { caps: new Set<string>(['echo-message']) },
+    });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG nickserv :IDENTIFY hunter2\r\n');
+
+    const toAlice = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const allText = toAlice.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(allText).toContain(':alice!alice@example.com PRIVMSG nickserv :IDENTIFY hunter2');
+  });
+
+  it('does NOT intercept PRIVMSG to a non-service nick when services are bound', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const { actor, runtime } = makeActor({ services });
+    runtime.addConnection(makeOnlineConn('c2', 'bob'));
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG bob :hi\r\n');
+
+    // With services bound, a non-service nick still routes through the normal
+    // user-target path (sendToNick), never the service reducer or echo path.
+    const toNick = runtime.calls.filter((c) => c.method === 'sendToNick');
+    expect(toNick).toHaveLength(1);
+  });
+
+  it('echoes with empty text when the PRIVMSG carries no trailing parameter', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const { actor, runtime } = makeActor({
+      services,
+      conn: { caps: new Set<string>(['echo-message']) },
+    });
+    runtime.calls.length = 0;
+
+    // No `:text` argument → `singleParamMsg.params[1] ?? ''` falls back to an
+    // empty string in the echo line.
+    await actor.receiveTextFrame('PRIVMSG NickServ\r\n');
+
+    const toAlice = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const echo = toAlice
+      .flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text))
+      .find((t) => t.endsWith('PRIVMSG NickServ :'));
+    expect(echo).toBe(':alice!alice@example.com PRIVMSG NickServ :');
+  });
+
+  it('falls back to "?" hostmask in the echo when the sender has no nick', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const { actor, runtime, conn } = makeActor({
+      services,
+      conn: { caps: new Set<string>(['echo-message']) },
+    });
+    // A connection that negotiated echo-message but has no NICK/USER/HOST —
+    // exercises the `hostmaskOf(state) ?? state.nick ?? '?'` fallback chain
+    // in the service-PRIVMSG echo. `delete` is required because
+    // exactOptionalPropertyTypes forbids `= undefined`.
+    // biome-ignore lint/performance/noDelete: exactOptionalPropertyTypes requires delete
+    delete conn.nick;
+    // biome-ignore lint/performance/noDelete: exactOptionalPropertyTypes requires delete
+    delete conn.user;
+    // biome-ignore lint/performance/noDelete: exactOptionalPropertyTypes requires delete
+    delete conn.host;
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG NickServ :IDENTIFY hunter2\r\n');
+
+    const toSender = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const echo = toSender
+      .flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text))
+      .find((t) => t.includes('PRIVMSG NickServ :IDENTIFY hunter2'));
+    // Both `??` arms fire: hostmaskOf returns undefined (no nick), then
+    // state.nick is undefined, so the final '?' fallback is used.
+    expect(echo).toBe(':? PRIVMSG NickServ :IDENTIFY hunter2');
+  });
+});
+
+// ============================================================================
+// Service shortcut commands — NICKSERV/NS/CHANSERV/CS/HOSTSERV/HS/MEMOSERV/MS/
+// OPERSERV/OS (Atheme/Anope-convention aliases rewritten to
+// PRIVMSG <ServiceNick> :<joined args> by the dispatcher).
+// ============================================================================
+
+describe('ConnectionActor — service shortcut commands', () => {
+  it('NICKSERV IDENTIFY behaves identically to PRIVMSG NickServ :IDENTIFY (never 421)', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const { actor, runtime, conn } = makeActor({ services });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('NICKSERV IDENTIFY hunter2\r\n');
+
+    expect(conn.account).toBe('alice');
+    expect(conn.userModes.registered).toBe(true);
+    const sends = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const allText = sends.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(allText).toContain(
+      ':NickServ!NickServ@services NOTICE alice :You are now identified for nick alice.',
+    );
+    // Critical: the shortcut must reach the reducer, never the 421 fallthrough.
+    for (const t of allText) {
+      expect(t).not.toContain(' 421 ');
+    }
+  });
+
+  // Each alias must resolve to its service. Sending the bare alias (no args)
+  // reaches the reducer, which emits a help NOTICE sourced from the matching
+  // pseudo-client — so the NOTICE source nick identifies the routed service.
+  const aliasToService: ReadonlyArray<[string, string]> = [
+    ['NICKSERV', 'NickServ'],
+    ['NS', 'NickServ'],
+    ['CHANSERV', 'ChanServ'],
+    ['CS', 'ChanServ'],
+    ['HOSTSERV', 'HostServ'],
+    ['HS', 'HostServ'],
+    ['MEMOSERV', 'MemoServ'],
+    ['MS', 'MemoServ'],
+    ['OPERSERV', 'OperServ'],
+    ['OS', 'OperServ'],
+  ];
+
+  for (const [alias, service] of aliasToService) {
+    it(`${alias} (no args) routes to ${service} via the help NOTICE`, async () => {
+      const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+      const { actor, runtime } = makeActor({ services });
+      runtime.calls.length = 0;
+
+      await actor.receiveTextFrame(`${alias}\r\n`);
+
+      const sends = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+      const allText = sends.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+      // The help NOTICE source hostmask identifies which service was routed.
+      expect(
+        allText.some((t) => t.startsWith(`:${service}!${service}@services NOTICE alice :`)),
+      ).toBe(true);
+      // And it never produces a 421.
+      for (const t of allText) {
+        expect(t).not.toContain(' 421 ');
+      }
+    });
+  }
+
+  it('aliases are case-insensitive (ns lower-case maps to NickServ)', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const { actor, runtime } = makeActor({ services });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('ns\r\n');
+
+    const sends = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const allText = sends.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(allText.some((t) => t.startsWith(':NickServ!NickServ@services NOTICE alice :'))).toBe(
+      true,
+    );
+  });
+
+  it('joins multi-word args into the PRIVMSG trailing body (NICKSERV REGISTER pw email)', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const { actor, runtime } = makeActor({ services });
+    runtime.calls.length = 0;
+
+    // Three trailing tokens must be joined and delivered as the body, exactly
+    // mirroring `PRIVMSG NickServ :REGISTER hunter2 alice@example.com`.
+    await actor.receiveTextFrame('NICKSERV REGISTER hunter2 alice@example.com\r\n');
+
+    expect(services.isRegisteredNick('alice')).toBe(true);
+    const sends = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const allText = sends.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(allText).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Nickname alice is now registered.',
+    );
+  });
+
+  it('joins a colon-trailing arg shape into the PRIVMSG body (NS :IDENTIFY hunter2)', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const { actor, conn } = makeActor({ services });
+
+    // `NS :IDENTIFY hunter2` parses to params=['IDENTIFY hunter2']; joining
+    // reproduces the body `IDENTIFY hunter2` so the identify succeeds.
+    await actor.receiveTextFrame('NS :IDENTIFY hunter2\r\n');
+
+    expect(conn.account).toBe('alice');
+  });
+
+  it('shortcut with no args is equivalent to PRIVMSG <ServiceNick> (help NOTICE)', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const { actor: a1, runtime: r1 } = makeActor({ services });
+    r1.calls.length = 0;
+    await a1.receiveTextFrame('CS\r\n');
+    const shortcutText = r1.calls
+      .filter((c) => c.method === 'send' && c.args[0] === 'c1')
+      .flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+
+    const { actor: a2, runtime: r2 } = makeActor({ services });
+    r2.calls.length = 0;
+    await a2.receiveTextFrame('PRIVMSG ChanServ :\r\n');
+    const privmsgText = r2.calls
+      .filter((c) => c.method === 'send' && c.args[0] === 'c1')
+      .flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+
+    expect(shortcutText).toEqual(privmsgText);
+  });
+
+  it('when services are unavailable, the shortcut matches a direct PRIVMSG to the service (401, never 421)', async () => {
+    // No services store bound → the rewritten PRIVMSG NickServ falls through
+    // to the normal user-target path (sendToNick + 401), exactly like a
+    // direct PRIVMSG NickServ. The shortcut must NOT produce a bare 421.
+    const { actor: shortcutActor, runtime: shortcutRuntime } = makeActor({});
+    shortcutRuntime.calls.length = 0;
+    await shortcutActor.receiveTextFrame('NICKSERV IDENTIFY hunter2\r\n');
+
+    const shortcutToNick = shortcutRuntime.calls.filter((c) => c.method === 'sendToNick');
+    expect(shortcutToNick).toHaveLength(1);
+    const shortcutNotFound = shortcutToNick[0]?.args[3] as RawLine[] | undefined;
+    expect(shortcutNotFound?.[0]?.text).toContain('401');
+
+    // Equivalence: a direct PRIVMSG NickServ with no store produces the same
+    // 401 path, confirming the shortcut delegates identically.
+    const { actor: directActor, runtime: directRuntime } = makeActor({});
+    directRuntime.calls.length = 0;
+    await directActor.receiveTextFrame('PRIVMSG NickServ :IDENTIFY hunter2\r\n');
+    const directToNick = directRuntime.calls.filter((c) => c.method === 'sendToNick');
+    expect(directToNick).toHaveLength(1);
+
+    // Critical: neither path emits a bare 421 for the shortcut verb.
+    const allShortcutText = shortcutRuntime.calls
+      .filter((c) => c.method === 'send' && c.args[0] === 'c1')
+      .flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    for (const t of allShortcutText) {
+      expect(t).not.toContain(' 421 ');
+    }
+  });
+});

package/packages/irc-test-support/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/irc-test-support",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "private": true,
   "description": "Shared IRC scenario runner + harness seam used by every adapter's integration suite",
   "license": "BSD-3-Clause",

package/packages/irc-test-support/src/in-memory-harness.ts

@@ -263,12 +263,13 @@ class InMemoryClientHarness implements ClientHarness {
   }
 
   async feed(chunk: string): Promise<void> {
-    /* istanbul ignore next -- defensive: bindActor is called by the
+    /* istanbul ignore start -- defensive: bindActor is called by the
        harness before the client is returned, so the unbound-actor branch
        is unreachable through the public API. */
     if (this.actor === undefined) {
       throw new Error(`client ${this.id} has no bound actor`);
     }
+    /* istanbul ignore stop */
     await this.actor.receive(chunk);
   }
 
@@ -305,16 +306,18 @@ class InMemoryClientHarness implements ClientHarness {
     this.closed = true;
     // Best-effort QUIT so peers see the part broadcast; the runtime's
     // disconnect handler is wired by the harness to unregister.
+    /* istanbul ignore start -- defensive: spawnClient binds the actor
+       before returning the client, so `this.actor` is never undefined
+       here. The guard exists purely as a teardown safety net. */
     if (this.actor !== undefined) {
       try {
         await this.actor.receive('QUIT :client closed\r\n');
-        /* istanbul ignore next -- defensive: receive swallows
-           every error internally; the catch is purely a teardown safety
-           net for catastrophic runtime failures. */
       } catch {
-        // no-op
+        // no-op -- receive swallows every error internally; this catch is
+        // purely a teardown safety net for catastrophic runtime failures.
       }
     }
+    /* istanbul ignore stop */
   }
 }
 

package/packages/irc-test-support/src/scenarios.ts

@@ -182,7 +182,10 @@ export function runIrcScenarios(factories: readonly IrcHarnessFactory[]): void {
         await alice.waitForNumeric('366');
         const namesLine = alice.received.find((l) => numericOf(l) === '353');
         expect(namesLine).toBeDefined();
-        expect(namesLine ?? '').toContain('@alice');
+        // namesLine is still `string | undefined` to TS (expect() does not
+        // narrow), so we route it back through expect() rather than a
+        // non-null assertion — toContain fails loudly if it were undefined.
+        expect(namesLine).toContain('@alice');
         await harness.close();
       });
 
@@ -246,7 +249,10 @@ export function runIrcScenarios(factories: readonly IrcHarnessFactory[]): void {
         await alice.send('JOIN #room');
         await bob.send('JOIN #room');
         await untilAliceSeesBobJoin(alice, '#room');
-        alice.received.length = 0;
+        // NOTE: alice.received is intentionally NOT cleared here. Keeping
+        // the registration + JOIN burst makes the no-self-echo assertion
+        // below non-vacuous: it scans real traffic and confirms the
+        // sender never receives her own PRIVMSG among any of it.
         bob.received.length = 0;
         await alice.send('PRIVMSG #room :hello team');
         await bob.waitForLine((l) => l.includes('PRIVMSG #room :hello team'));
@@ -453,7 +459,10 @@ export function runIrcScenarios(factories: readonly IrcHarnessFactory[]): void {
         await alice.send('JOIN #notice');
         await bob.send('JOIN #notice');
         await untilAliceSeesBobJoin(alice, '#notice');
-        alice.received.length = 0;
+        // NOTE: alice.received is intentionally NOT cleared here. Keeping
+        // the registration + JOIN burst makes the NOTICE-no-error filter
+        // below non-vacuous: it scans real numeric traffic (353/366/…)
+        // and confirms none of it is a NOTICE error code.
         bob.received.length = 0;
         await alice.send('NOTICE #notice :quiet note');
         await bob.waitForLine((l) => l.includes('NOTICE #notice :quiet note'));
@@ -469,13 +478,19 @@ export function runIrcScenarios(factories: readonly IrcHarnessFactory[]): void {
         await harness.close();
       });
 
-      it('scenario 27: PASS after registration is rejected with 462', async () => {
+      it('scenario 27: bare PASS after registration is a silent no-op (no 462)', async () => {
         harness = await factory.create();
         const c = await harness.spawnClient({ nick: 'alice' });
         await c.waitForNumeric('001');
         c.received.length = 0;
-        await c.send('PASS hunter2');
-        await c.waitForNumeric('462');
+        // A bare server-password PASS is meaningless once registration has
+        // completed: it must be ignored (no 462, no disconnect). Send a
+        // PING in the same frame so ordering is guaranteed — by the time
+        // the PONG arrives, any 462 from the PASS would already be queued.
+        await c.send('PASS hunter2\r\nPING :post-pass');
+        await c.waitForLine((l) => l === 'PONG :post-pass');
+        const errAlreadyRegistered = c.received.filter((l) => numericOf(l) === '462');
+        expect(errAlreadyRegistered).toEqual([]);
         await harness.close();
       });