📦 deps(thirdparty): update snapshots
This commit is contained in:
ci[bot]
@@ -0,0 +1,315 @@
|
||||
"use strict";
|
||||
|
||||
const assert = require("node:assert/strict");
|
||||
const crypto = require("node:crypto");
|
||||
const fs = require("node:fs");
|
||||
const fsp = require("node:fs/promises");
|
||||
const os = require("node:os");
|
||||
const path = require("node:path");
|
||||
const test = require("node:test");
|
||||
const zlib = require("node:zlib");
|
||||
const { spawnSync } = require("node:child_process");
|
||||
const core = require("../../lib/aas-v1");
|
||||
const { mcpBackupCleanup, mcpConfigure } = require("../../lib/aas-v1/cli/main");
|
||||
|
||||
function octal(value, length) {
|
||||
const encoded = value.toString(8).padStart(length - 1, "0");
|
||||
return `${encoded}\0`;
|
||||
}
|
||||
|
||||
function tar(entries) {
|
||||
const blocks = [];
|
||||
for (const [name, value] of entries) {
|
||||
const bytes = Buffer.from(value);
|
||||
const header = Buffer.alloc(512);
|
||||
header.write(name, 0, 100, "utf8");
|
||||
header.write(octal(0o644, 8), 100, 8, "ascii");
|
||||
header.write(octal(0, 8), 108, 8, "ascii");
|
||||
header.write(octal(0, 8), 116, 8, "ascii");
|
||||
header.write(octal(bytes.length, 12), 124, 12, "ascii");
|
||||
header.write(octal(0, 12), 136, 12, "ascii");
|
||||
header.fill(0x20, 148, 156);
|
||||
header[156] = "0".charCodeAt(0);
|
||||
header.write("ustar\0", 257, 6, "ascii");
|
||||
header.write("00", 263, 2, "ascii");
|
||||
let checksum = 0;
|
||||
for (const byte of header) checksum += byte;
|
||||
header.write(`${checksum.toString(8).padStart(6, "0")}\0 `, 148, 8, "ascii");
|
||||
blocks.push(header, bytes, Buffer.alloc((512 - (bytes.length % 512)) % 512));
|
||||
}
|
||||
blocks.push(Buffer.alloc(1024));
|
||||
return zlib.gzipSync(Buffer.concat(blocks));
|
||||
}
|
||||
|
||||
function releaseFixture() {
|
||||
const packageJson = JSON.stringify({
|
||||
name: "agentic-awesome-skills",
|
||||
version: "14.6.0",
|
||||
bin: { "agentic-awesome-skills": "tools/bin/install.js", aas: "tools/bin/aas.js", "aas-mcp": "tools/bin/aas-mcp.js" },
|
||||
bundledDependencies: ["ajv", "sanitize-filename", "yaml"],
|
||||
});
|
||||
const archive = tar([
|
||||
["package/package.json", packageJson],
|
||||
["package/tools/bin/aas-mcp.js", "#!/usr/bin/env node\nrequire('../lib/aas-v1/mcp');\n"],
|
||||
["package/tools/lib/aas-v1/index.js", "module.exports = {};\n"],
|
||||
["package/data/aas-v1/catalog-manifest.v1.json", "{}\n"],
|
||||
["package/data/catalog.json", '{"skills":[]}\n'],
|
||||
["package/data/plugin-compatibility.json", '{"skills":[]}\n'],
|
||||
["package/skills_index.json", "[]\n"],
|
||||
["package/node_modules/ajv/package.json", '{"name":"ajv","version":"8.20.0"}\n'],
|
||||
["package/node_modules/sanitize-filename/package.json", '{"name":"sanitize-filename","version":"1.6.4"}\n'],
|
||||
["package/node_modules/yaml/package.json", '{"name":"yaml","version":"2.9.0"}\n'],
|
||||
]);
|
||||
const integrity = `sha512-${crypto.createHash("sha512").update(archive).digest("base64")}`;
|
||||
const tarballUrl = "https://registry.npmjs.org/agentic-awesome-skills/-/agentic-awesome-skills-14.6.0.tgz";
|
||||
const metadataUrl = "https://registry.npmjs.org/agentic-awesome-skills/14.6.0";
|
||||
const metadata = Buffer.from(JSON.stringify({ name: "agentic-awesome-skills", version: "14.6.0", dist: { integrity, tarball: tarballUrl } }));
|
||||
const fetcher = async (url) => {
|
||||
if (url === metadataUrl) return metadata;
|
||||
if (url === tarballUrl) return archive;
|
||||
throw new Error(`unexpected URL: ${url}`);
|
||||
};
|
||||
return { archive, fetcher, integrity };
|
||||
}
|
||||
|
||||
async function temp(t) {
|
||||
const root = await fsp.mkdtemp(path.join(os.tmpdir(), "aas-runtime-config-"));
|
||||
t.after(() => fsp.rm(root, { recursive: true, force: true }));
|
||||
return root;
|
||||
}
|
||||
|
||||
test("runtime promotion is content addressed, verifies every cached byte, and is idempotent", async (t) => {
|
||||
const root = await temp(t);
|
||||
const cacheRoot = path.join(root, "cache");
|
||||
const fixture = releaseFixture();
|
||||
const installed = await core.cache.installRuntimeFromRegistry({ cacheRoot, version: "14.6.0", expectedIntegrity: fixture.integrity, fetcher: fixture.fetcher });
|
||||
assert.equal(installed.status, "promoted");
|
||||
assert.deepEqual(Object.keys(installed.runtimeIdentity), ["package", "version", "integrity", "closureDigest"]);
|
||||
assert.match(installed.targetPath, new RegExp(`/runtimes/14\\.6\\.0/${core.cache.filesystemSafeIntegrityKey(fixture.integrity)}$`));
|
||||
const status = await core.cache.runtimeStatus({ cacheRoot, packageVersion: "14.6.0", integrity: fixture.integrity, closureDigest: installed.runtimeIdentity.closureDigest });
|
||||
assert.equal(status.status, "verified");
|
||||
const again = await core.cache.installRuntimeFromRegistry({ cacheRoot, version: "14.6.0", expectedIntegrity: fixture.integrity, fetcher: fixture.fetcher });
|
||||
assert.equal(again.status, "alreadyPresent");
|
||||
await fsp.appendFile(core.cache.runtimeMcpPath({ cacheRoot, packageVersion: "14.6.0", integrity: fixture.integrity }), "tamper");
|
||||
assert.equal((await core.cache.runtimeStatus({ cacheRoot, packageVersion: "14.6.0", integrity: fixture.integrity })).status, "invalid");
|
||||
});
|
||||
|
||||
test("the packed runtime launches MCP from an isolated verified dependency closure", async (t) => {
|
||||
const root = await temp(t);
|
||||
const repoRoot = path.resolve(__dirname, "../../..");
|
||||
const npmCommand = process.platform === "win32" ? "npm.cmd" : "npm";
|
||||
const packed = spawnSync(npmCommand, [
|
||||
"pack",
|
||||
"--silent",
|
||||
"--pack-destination",
|
||||
root,
|
||||
"--cache",
|
||||
path.join(root, "npm-cache"),
|
||||
], {
|
||||
cwd: repoRoot,
|
||||
encoding: "utf8",
|
||||
shell: process.platform === "win32",
|
||||
maxBuffer: 2 * 1024 * 1024,
|
||||
});
|
||||
assert.equal(packed.status, 0, packed.stderr);
|
||||
const archiveName = packed.stdout.trim().split(/\r?\n/).at(-1);
|
||||
const archive = await fsp.readFile(path.join(root, archiveName));
|
||||
const integrity = `sha512-${crypto.createHash("sha512").update(archive).digest("base64")}`;
|
||||
const packageVersion = require(path.join(repoRoot, "package.json")).version;
|
||||
const tarballUrl = `https://registry.npmjs.org/agentic-awesome-skills/-/agentic-awesome-skills-${packageVersion}.tgz`;
|
||||
const metadataUrl = `https://registry.npmjs.org/agentic-awesome-skills/${packageVersion}`;
|
||||
const fetcher = async (url) => {
|
||||
if (url === metadataUrl) return Buffer.from(JSON.stringify({
|
||||
name: "agentic-awesome-skills",
|
||||
version: packageVersion,
|
||||
dist: { integrity, tarball: tarballUrl },
|
||||
}));
|
||||
if (url === tarballUrl) return archive;
|
||||
throw new Error(`unexpected URL: ${url}`);
|
||||
};
|
||||
const cacheRoot = path.join(root, "isolated-cache");
|
||||
const installed = await core.cache.installRuntimeFromRegistry({
|
||||
cacheRoot,
|
||||
version: packageVersion,
|
||||
expectedIntegrity: integrity,
|
||||
fetcher,
|
||||
});
|
||||
const mcpPath = core.cache.runtimeMcpPath({ cacheRoot, packageVersion, integrity });
|
||||
const runtimeStatus = await core.cache.runtimeStatus({ cacheRoot, packageVersion, integrity });
|
||||
assert.equal(runtimeStatus.status, "verified");
|
||||
assert.ok(runtimeStatus.identity.assets.some((asset) => asset.path.startsWith("package/node_modules/ajv/")));
|
||||
assert.ok(runtimeStatus.identity.assets.some((asset) => asset.path.startsWith("package/skills/")));
|
||||
assert.ok(runtimeStatus.identity.assets.every((asset) => !asset.path.startsWith("package/docs/")));
|
||||
const request = `${JSON.stringify({
|
||||
jsonrpc: "2.0",
|
||||
id: 1,
|
||||
method: "initialize",
|
||||
params: {
|
||||
protocolVersion: core.protocolVersion,
|
||||
capabilities: {},
|
||||
clientInfo: { name: "isolated-runtime-test", version: "1" },
|
||||
},
|
||||
})}\n`;
|
||||
const launched = spawnSync(process.execPath, [mcpPath, "--cache-root", cacheRoot], {
|
||||
cwd: root,
|
||||
input: request,
|
||||
encoding: "utf8",
|
||||
env: { ...process.env, NODE_PATH: "" },
|
||||
maxBuffer: 2 * 1024 * 1024,
|
||||
});
|
||||
assert.equal(launched.status, 0, launched.stderr);
|
||||
const response = JSON.parse(launched.stdout.trim());
|
||||
assert.equal(response.result.protocolVersion, core.protocolVersion);
|
||||
assert.equal(response.result._meta.catalogDigest, core.loadBundledCatalog({ root: repoRoot }).digest);
|
||||
assert.equal(installed.runtimeIdentity.closureDigest.startsWith("sha256-"), true);
|
||||
});
|
||||
|
||||
test("mcp configure previews without writes, binds exact approval, then configures the cached runtime", async (t) => {
|
||||
const root = await temp(t);
|
||||
const cacheRoot = path.join(root, "cache");
|
||||
const config = path.join(root, ".mcp.json");
|
||||
const backups = path.join(root, "backups");
|
||||
await fsp.writeFile(config, '{"secret":"never-print","mcpServers":{}}\n', { mode: 0o600 });
|
||||
const fixture = releaseFixture();
|
||||
const options = { host: "claude", scope: "user", config, "cache-root": cacheRoot, "backup-dir": backups, version: "14.6.0" };
|
||||
const preview = await mcpConfigure(options, { fetcher: fixture.fetcher });
|
||||
assert.equal(preview.status, "approvalRequired");
|
||||
assert.equal(fs.existsSync(cacheRoot), false);
|
||||
assert.equal(fs.existsSync(backups), false);
|
||||
const serialized = JSON.stringify(preview);
|
||||
assert.ok(!serialized.includes("never-print"));
|
||||
assert.ok(!serialized.includes(config));
|
||||
assert.ok(!serialized.includes(cacheRoot));
|
||||
await assert.rejects(mcpConfigure({ ...options, approve: core.sha256("wrong") }, { fetcher: fixture.fetcher }), (error) => error.code === "AAS_ADAPTER_APPROVAL_MISMATCH");
|
||||
assert.equal(fs.existsSync(cacheRoot), false);
|
||||
const configured = await mcpConfigure({ ...options, approve: preview.approvalDigest }, { fetcher: fixture.fetcher });
|
||||
assert.equal(configured.status, "configured");
|
||||
assert.equal(configured.runtime.integrity, fixture.integrity);
|
||||
const parsed = JSON.parse(await fsp.readFile(config, "utf8"));
|
||||
assert.equal(parsed.secret, "never-print");
|
||||
assert.equal(parsed.mcpServers.aas.command, process.execPath);
|
||||
assert.deepEqual(parsed.mcpServers.aas.args, [core.cache.runtimeMcpPath({ cacheRoot, packageVersion: "14.6.0", integrity: fixture.integrity }), "--cache-root", cacheRoot]);
|
||||
assert.deepEqual(parsed.mcpServers.aas.env, {});
|
||||
assert.equal((await fsp.stat(backups)).mode & 0o777, 0o700);
|
||||
});
|
||||
|
||||
test("mcp configure can bind an already verified runtime without registry access", async (t) => {
|
||||
const root = await temp(t);
|
||||
const cacheRoot = path.join(root, "cache");
|
||||
const config = path.join(root, ".mcp.json");
|
||||
await fsp.writeFile(config, '{"mcpServers":{}}\n', { mode: 0o600 });
|
||||
const fixture = releaseFixture();
|
||||
const installed = await core.cache.installRuntimeFromRegistry({
|
||||
cacheRoot,
|
||||
version: "14.6.0",
|
||||
expectedIntegrity: fixture.integrity,
|
||||
fetcher: fixture.fetcher,
|
||||
});
|
||||
let fetchAttempts = 0;
|
||||
const noNetwork = async () => {
|
||||
fetchAttempts += 1;
|
||||
throw new Error("registry access is forbidden for an explicitly pinned cached runtime");
|
||||
};
|
||||
const options = {
|
||||
host: "claude",
|
||||
scope: "project",
|
||||
config,
|
||||
"cache-root": cacheRoot,
|
||||
"backup-dir": path.join(root, "backups"),
|
||||
version: "14.6.0",
|
||||
"runtime-integrity": fixture.integrity,
|
||||
"runtime-closure-digest": installed.runtimeIdentity.closureDigest,
|
||||
};
|
||||
const preview = await mcpConfigure(options, { fetcher: noNetwork });
|
||||
assert.equal(preview.status, "approvalRequired");
|
||||
assert.deepEqual(preview.runtime, installed.runtimeIdentity);
|
||||
const configured = await mcpConfigure({ ...options, approve: preview.approvalDigest }, { fetcher: noNetwork });
|
||||
assert.equal(configured.status, "configured");
|
||||
assert.equal(configured.runtimeCacheStatus, "verified");
|
||||
assert.deepEqual(configured.runtime, installed.runtimeIdentity);
|
||||
assert.equal(fetchAttempts, 0);
|
||||
const parsed = JSON.parse(await fsp.readFile(config, "utf8"));
|
||||
assert.deepEqual(parsed.mcpServers.aas.args, [
|
||||
core.cache.runtimeMcpPath({ cacheRoot, packageVersion: "14.6.0", integrity: fixture.integrity }),
|
||||
"--cache-root",
|
||||
cacheRoot,
|
||||
]);
|
||||
});
|
||||
|
||||
test("mcp configure fails closed on incomplete, missing, or changed cached runtime identity", async (t) => {
|
||||
const root = await temp(t);
|
||||
const cacheRoot = path.join(root, "cache");
|
||||
const config = path.join(root, ".mcp.json");
|
||||
const initialConfig = '{"mcpServers":{}}\n';
|
||||
await fsp.writeFile(config, initialConfig, { mode: 0o600 });
|
||||
const fixture = releaseFixture();
|
||||
const base = { host: "claude", scope: "project", config, "cache-root": cacheRoot, version: "14.6.0" };
|
||||
await assert.rejects(
|
||||
mcpConfigure({ ...base, "runtime-integrity": fixture.integrity }),
|
||||
(error) => error.code === "AAS_CLI_RUNTIME_IDENTITY_INCOMPLETE",
|
||||
);
|
||||
await assert.rejects(
|
||||
mcpConfigure({ ...base, "runtime-closure-digest": core.sha256("missing") }),
|
||||
(error) => error.code === "AAS_CLI_RUNTIME_IDENTITY_INCOMPLETE",
|
||||
);
|
||||
await assert.rejects(
|
||||
mcpConfigure({ ...base, "runtime-integrity": fixture.integrity, "runtime-closure-digest": core.sha256("missing") }),
|
||||
(error) => error.code === "AAS_RUNTIME_NOT_VERIFIED" && error.details.status === "missing",
|
||||
);
|
||||
const installed = await core.cache.installRuntimeFromRegistry({
|
||||
cacheRoot,
|
||||
version: "14.6.0",
|
||||
expectedIntegrity: fixture.integrity,
|
||||
fetcher: fixture.fetcher,
|
||||
});
|
||||
const options = {
|
||||
...base,
|
||||
"runtime-integrity": fixture.integrity,
|
||||
"runtime-closure-digest": installed.runtimeIdentity.closureDigest,
|
||||
};
|
||||
const preview = await mcpConfigure(options);
|
||||
await fsp.appendFile(core.cache.runtimeMcpPath({ cacheRoot, packageVersion: "14.6.0", integrity: fixture.integrity }), "tamper");
|
||||
await assert.rejects(
|
||||
mcpConfigure({ ...options, approve: preview.approvalDigest }),
|
||||
(error) => error.code === "AAS_RUNTIME_NOT_VERIFIED" && error.details.status === "invalid",
|
||||
);
|
||||
assert.equal(await fsp.readFile(config, "utf8"), initialConfig);
|
||||
});
|
||||
|
||||
test("mcp configure rejects relative machine paths and a registry identity change", async (t) => {
|
||||
const root = await temp(t);
|
||||
const config = path.join(root, "config.toml");
|
||||
await fsp.writeFile(config, "");
|
||||
const fixture = releaseFixture();
|
||||
await assert.rejects(mcpConfigure({ host: "codex", scope: "project", config: "config.toml", "cache-root": path.join(root, "cache") }, { fetcher: fixture.fetcher }), (error) => error.code === "AAS_CLI_ABSOLUTE_PATH_REQUIRED");
|
||||
await assert.rejects(core.cache.installRuntimeFromRegistry({ cacheRoot: path.join(root, "cache"), version: "14.6.0", expectedIntegrity: `sha512-${Buffer.alloc(64).toString("base64")}`, fetcher: fixture.fetcher }), (error) => error.code === "AAS_RUNTIME_RELEASE_CHANGED");
|
||||
assert.equal(fs.existsSync(path.join(root, "cache")), false);
|
||||
});
|
||||
|
||||
test("backup cleanup has a path-redacted exact approval and preserves retained records", async (t) => {
|
||||
const root = await temp(t);
|
||||
const cacheRoot = path.join(root, "cache");
|
||||
const config = path.join(root, ".mcp.json");
|
||||
const backups = path.join(root, "backups");
|
||||
await fsp.writeFile(config, '{"mcpServers":{}}\n', { mode: 0o600 });
|
||||
const fixture = releaseFixture();
|
||||
const options = { host: "claude", scope: "user", config, "cache-root": cacheRoot, "backup-dir": backups, version: "14.6.0" };
|
||||
let preview = await mcpConfigure(options, { fetcher: fixture.fetcher });
|
||||
await mcpConfigure({ ...options, approve: preview.approvalDigest }, { fetcher: fixture.fetcher });
|
||||
await fsp.writeFile(config, '{"mcpServers":{},"changed":true}\n', { mode: 0o600 });
|
||||
preview = await mcpConfigure(options, { fetcher: fixture.fetcher });
|
||||
await mcpConfigure({ ...options, approve: preview.approvalDigest }, { fetcher: fixture.fetcher });
|
||||
const cleanupOptions = { config, "backup-dir": backups, keep: "1" };
|
||||
const cleanupPreview = await mcpBackupCleanup(cleanupOptions);
|
||||
assert.equal(cleanupPreview.removeCount, 1);
|
||||
assert.ok(!JSON.stringify(cleanupPreview).includes(config));
|
||||
await assert.rejects(mcpBackupCleanup({ ...cleanupOptions, approve: core.sha256("wrong") }), (error) => error.code === "AAS_ADAPTER_APPROVAL_MISMATCH");
|
||||
await fsp.writeFile(config, '{"mcpServers":{},"changed":2}\n', { mode: 0o600 });
|
||||
preview = await mcpConfigure(options, { fetcher: fixture.fetcher });
|
||||
await mcpConfigure({ ...options, approve: preview.approvalDigest }, { fetcher: fixture.fetcher });
|
||||
await assert.rejects(mcpBackupCleanup({ ...cleanupOptions, approve: cleanupPreview.approvalDigest }), (error) => error.code === "AAS_ADAPTER_APPROVAL_MISMATCH");
|
||||
const freshCleanup = await mcpBackupCleanup(cleanupOptions);
|
||||
const cleaned = await mcpBackupCleanup({ ...cleanupOptions, approve: freshCleanup.approvalDigest });
|
||||
assert.equal(cleaned.removedCount, 2);
|
||||
assert.equal(cleaned.retained, 1);
|
||||
});
|
||||
Reference in New Issue
Block a user