chore: publish from main

2026-07-17 03:13:25 +00:00 · 2026-07-16 00:30:12 +00:00
parent 6a843b5c57
commit d171be5b52
36 changed files with 7664 additions and 0 deletions
@@ -0,0 +1,139 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtemp, mkdir, readFile, realpath, rm, writeFile } from "node:fs/promises";
+import { delimiter, join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { armSegment, parseAzureCliToken, resolvePosixAzureCli, waitForProvisioning } from "./armClient.mjs";
+
+const here = new URL(".", import.meta.url);
+
+test("ARM path segments reject traversal aliases", () => {
+    assert.throws(() => armSegment("."), /Invalid ARM resource identifier/);
+    assert.throws(() => armSegment(".."), /Invalid ARM resource identifier/);
+    assert.equal(armSegment("valid.name"), "valid.name");
+});
+
+test("namespace creation is create-only and reports provisioning timeout", async () => {
+    const source = await readFile(new URL("armClient.mjs", here), "utf8");
+    const createResourceGroup = source.slice(
+        source.indexOf("export async function createResourceGroup"),
+        source.indexOf("export async function listUserAssignedIdentities"),
+    );
+    const createConnectorGateway = source.slice(
+        source.indexOf("export async function createConnectorGateway"),
+    );
+    assert.match(createResourceGroup, /"If-None-Match": "\*"/);
+    assert.match(createConnectorGateway, /"If-None-Match": "\*"/);
+    assert.match(source, /Provisioning timed out/);
+});
+
+test("namespace creation polls an empty 202 result until explicit success", async () => {
+    const states = [
+        { properties: { provisioningState: "InProgress" } },
+        { properties: { provisioningState: "Succeeded" } },
+    ];
+    let calls = 0;
+    const result = await waitForProvisioning(
+        undefined,
+        "gateway",
+        async () => {
+            calls++;
+            return states.shift();
+        },
+        { maxPolls: 2, delay: async () => {} },
+    );
+    assert.equal(calls, 2);
+    assert.equal(result.properties.provisioningState, "Succeeded");
+    await assert.rejects(
+        waitForProvisioning(undefined, "gateway", async () => undefined, { maxPolls: 1, delay: async () => {} }),
+        /last state: unknown/,
+    );
+});
+
+test("Azure authentication is brokered by Azure CLI", async () => {
+    const source = await readFile(new URL("armClient.mjs", here), "utf8");
+    assert.match(source, /account get-access-token --resource/);
+    assert.doesNotMatch(source, /04b07795-8ddb-461a-bbee-02f9e1bf7b46/);
+    assert.doesNotMatch(source, /refreshToken/);
+    assert.match(source, /await fs\.unlink\(LEGACY_AUTH_CACHE\)/);
+    assert.match(source, /resolveWindowsAzureCli/);
+    assert.match(source, /resolvePosixAzureCli/);
+    assert.match(source, /fs\.realpath\(path\)/);
+    assert.match(source, /windowsSystemExecutable\("cmd\.exe"\)/);
+    assert.match(source, /\{ cwd: homedir\(\), encoding: "utf8"/);
+    assert.deepEqual(
+        parseAzureCliToken(JSON.stringify({ accessToken: "token", expires_on: 2_000_000_000 })),
+        { token: "token", expiresAt: 2_000_000_000_000 },
+    );
+    assert.throws(() => parseAzureCliToken("{}"), /incomplete ARM token/);
+});
+
+test("POSIX Azure CLI resolution rejects workspace-controlled binaries", async () => {
+    const root = await mkdtemp(join(tmpdir(), "cn-az-path-"));
+    const workspace = join(root, "workspace");
+    const workspaceBin = join(workspace, "node_modules", ".bin");
+    const trustedBin = join(root, "trusted-bin");
+    await Promise.all([
+        mkdir(workspaceBin, { recursive: true }),
+        mkdir(trustedBin, { recursive: true }),
+    ]);
+    await Promise.all([
+        writeFile(join(workspaceBin, "az"), "workspace", { mode: 0o755 }),
+        writeFile(join(trustedBin, "az"), "trusted", { mode: 0o755 }),
+    ]);
+    try {
+        const resolved = await resolvePosixAzureCli(
+            [workspaceBin, trustedBin].join(delimiter),
+            workspace,
+        );
+        assert.equal(resolved, await realpath(join(trustedBin, "az")));
+        await assert.rejects(
+            resolvePosixAzureCli(workspaceBin, workspace),
+            /outside the current workspace/,
+        );
+    } finally {
+        await rm(root, { recursive: true, force: true });
+    }
+});
+
+test("installer preserves capability tokens and persists direct HTTP entries", async () => {
+    const source = await readFile(new URL("install.mjs", here), "utf8");
+    const fallbacks = source.match(/installConnector\(config, apiName, displayName, callbackBase, scope, capabilityToken\)/g);
+    assert.equal(fallbacks?.length, 1);
+    assert.match(source, /reauthConnectorWithAttempts\([\s\S]*?capabilityToken,[\s\S]*?attemptedConfigNames/);
+    assert.match(source, /headers: \{ "X-API-Key": key \}/);
+    assert.match(source, /const cacheKey = `\$\{sub\}:\$\{location\}:\$\{apiName\}:\$\{requireSwagger\}`/);
+    assert.match(source, /throwAfterCleanup\(error, \[\(\) => deleteConnection\(config, connName\)\]\)/);
+    assert.match(source, /freshConnection: true/);
+    assert.match(source, /freshConnection: false/);
+    assert.match(source, /await fs\.open\(lockPath, "wx", 0o600\)/);
+    assert.match(source, /await fs\.rename\(temporary, path\)/);
+    assert.match(source, /resolveSystemExecutable\("rundll32\.exe"\)/);
+});
+
+test("smoke cleanup runs from finally and reports cleanup failures", async () => {
+    const source = await readFile(new URL("test/smoke.mjs", here), "utf8");
+    assert.match(source, /finally \{\s*if \(record\.cleanup\)/);
+    assert.match(source, /record\.cleanupError/);
+    assert.match(source, /failed\.length > 0 \|\| orchestrationErrors\.length > 0/);
+    assert.match(source, /probe\.status === "passed"/);
+    assert.match(source, /probe\.status === "skipped"/);
+    assert.match(source, /mode: 0o700/);
+    assert.match(source, /mode: 0o600/);
+    assert.match(source, /chmodSync\(PENDING_FILE, 0o600\)/);
+});
+
+test("test reports do not persist successful tool response content", async () => {
+    const source = await readFile(new URL("test/mcp-probe.mjs", here), "utf8");
+    assert.doesNotMatch(source, /toolsCall\.preview\s*=/);
+    assert.match(source, /toolsCall\.result = "response received"/);
+});
+
+test("obsolete in-memory add and remove canvas actions are not advertised", async () => {
+    const source = await readFile(new URL("extension.mjs", here), "utf8");
+    assert.doesNotMatch(source, /name: "add_connector"/);
+    assert.doesNotMatch(source, /name: "remove_connector"/);
+    assert.doesNotMatch(source, /name: "list_connectors"/);
+    assert.match(source, /name: "open_sandbox"/);
+});