morluto
60149282fc
* test: strengthen integration oracles and verification * test: bound lifecycle gates and strengthen workflow checks * test: verify complete paged and extracted results * test: preserve bytecode and cancellation evidence * test: strengthen retained evidence and fixture cleanup * test: require cross-projection bridge identities * test: retain fixture owners through cleanup failures * test: verify graph examples and project selectors * test: tighten provider and lifecycle regressions * test: consolidate hex coverage and bound cutter cleanup * test: bound subprocess output waits and strengthen graph checks * test: check mcp recovery and preserve cleanup owners * test: verify structured mcp argument failures * test: preserve artifact cleanup and gdb limit evidence * test: preserve evidence identities and bound provider gates * test: retain browser and comparison cleanup owners * test: bound startup and strengthen fixture oracles * test: bound lifecycle gates and verify recovered evidence * test: verify public outcomes and lifecycle ownership * test: assert precise evidence and release lifecycle gates * test: verify selected facts and bound cleanup waits * test: check retained evidence and decoded records * test: verify final reports and retain cleanup ownership * test: bound reviewed startup gates and retain cleanup * test: verify PE errors and preserve MCP cleanup * test: preserve MCP fixture cleanup ownership * test: release provider gates before late startup
405 lines
14 KiB
TypeScript
405 lines
14 KiB
TypeScript
import { mkdir, realpath, symlink, writeFile } from "node:fs/promises";
|
|
import { dirname, join, parse, sep } from "node:path";
|
|
import { createHash } from "node:crypto";
|
|
import { expect } from "vitest";
|
|
|
|
import { toolContract } from "../../src/contracts/toolContracts.js";
|
|
import {
|
|
elfHeaderFuseImage,
|
|
OBSIDIAN_FUSE_BYTES,
|
|
peHeaderFuseImage,
|
|
sentinelFreeMacho,
|
|
thinFuseImage,
|
|
universalFuseImage,
|
|
} from "../fixtures/electron/fuseImage.js";
|
|
import { createTestTempDirectory } from "../fixtures/temporaryDirectory.js";
|
|
import { cliTest } from "../support/cli/cliFixture.js";
|
|
|
|
// Windows resolves dot components before directory links in Win32 paths.
|
|
cliTest.skipIf(process.platform === "win32").for([
|
|
{ kind: "binary", mode: "absolute" },
|
|
{ kind: "binary", mode: "relative" },
|
|
{ kind: "bundle", mode: "absolute" },
|
|
{ kind: "bundle", mode: "relative" },
|
|
] as const)(
|
|
"preserves $mode $kind selections containing a symlink before a parent segment",
|
|
async ({ kind, mode }, { cli }) => {
|
|
const root = await createTestTempDirectory("rea-electron-fuses-cli-path-");
|
|
const framework = "Contents/Frameworks/Electron Framework.framework";
|
|
const directory =
|
|
kind === "binary"
|
|
? join(root, "Fixture.app", framework, "Versions")
|
|
: root;
|
|
const selectedTail =
|
|
kind === "binary" ? "A/Electron Framework" : "Fixture.app";
|
|
const binaryTail =
|
|
kind === "binary"
|
|
? selectedTail
|
|
: `Fixture.app/${framework}/Versions/A/Electron Framework`;
|
|
const binary = join(directory, "nested", binaryTail);
|
|
const sibling = join(directory, binaryTail);
|
|
const image = thinFuseImage([0x31, 0x30, 0x30, 0x31]);
|
|
const otherImage = thinFuseImage([0x30, 0x30, 0x30, 0x30]);
|
|
await mkdir(dirname(binary), { recursive: true });
|
|
await mkdir(dirname(sibling), { recursive: true });
|
|
await mkdir(join(directory, "nested", "B"), { recursive: true });
|
|
await writeFile(binary, image.bytes);
|
|
await writeFile(sibling, otherImage.bytes);
|
|
await symlink("nested/B", join(directory, "Current"));
|
|
const selected = `${directory}/Current/../${selectedTail}`;
|
|
expect(await realpath(selected)).toBe(
|
|
kind === "binary" ? binary : join(root, "nested", "Fixture.app"),
|
|
);
|
|
|
|
const result = await cli.run({
|
|
arguments: [
|
|
"inspect-electron-fuses",
|
|
mode === "absolute" ? selected : selected.slice(root.length + 1),
|
|
"--json",
|
|
],
|
|
cwd: root,
|
|
});
|
|
expect(result.exitCode, result.stderr).toBe(0);
|
|
const evidence = toolContract("inspect_electron_fuses").outputSchema.parse(
|
|
result.json,
|
|
);
|
|
const digest = createHash("sha256").update(image.bytes).digest("hex");
|
|
expect(evidence.normalized_result.artifact).toMatchObject({
|
|
selected_path: selected,
|
|
resolved_path:
|
|
kind === "binary"
|
|
? binary
|
|
: `${selected}/${framework}/Versions/A/Electron Framework`,
|
|
sha256: digest,
|
|
});
|
|
expect(
|
|
await realpath(evidence.normalized_result.artifact.resolved_path),
|
|
).toBe(binary);
|
|
expect(evidence.subject?.local_path).toBe(
|
|
evidence.normalized_result.artifact.resolved_path,
|
|
);
|
|
expect(evidence.subject?.digest.sha256).toBe(digest);
|
|
expect(evidence.normalized_result.runtime_implications).toEqual(
|
|
expect.arrayContaining([
|
|
expect.objectContaining({
|
|
subject: "electron_run_as_node",
|
|
outcome: "honored",
|
|
}),
|
|
expect.objectContaining({
|
|
subject: "node_cli_inspect_arguments",
|
|
outcome: "honored",
|
|
}),
|
|
]),
|
|
);
|
|
|
|
const control = await cli.run({
|
|
arguments: ["inspect-electron-fuses", sibling, "--json"],
|
|
});
|
|
expect(control.exitCode, control.stderr).toBe(0);
|
|
const siblingEvidence = toolContract(
|
|
"inspect_electron_fuses",
|
|
).outputSchema.parse(control.json);
|
|
expect(siblingEvidence.normalized_result.artifact.sha256).toBe(
|
|
createHash("sha256").update(otherImage.bytes).digest("hex"),
|
|
);
|
|
expect(siblingEvidence.normalized_result.runtime_implications).toEqual(
|
|
expect.arrayContaining([
|
|
expect.objectContaining({
|
|
subject: "electron_run_as_node",
|
|
outcome: "not_honored",
|
|
}),
|
|
expect.objectContaining({
|
|
subject: "node_cli_inspect_arguments",
|
|
outcome: "not_honored",
|
|
}),
|
|
]),
|
|
);
|
|
},
|
|
);
|
|
|
|
cliTest.skipIf(process.platform !== "win32")(
|
|
"retains Windows drive, root, and mixed-separator path resolution",
|
|
async ({ cli }) => {
|
|
const root = await createTestTempDirectory("rea-electron-fuses-win-path-");
|
|
const tail =
|
|
"Fixture.app/Contents\\Frameworks/Electron Framework.framework/Versions\\A/Electron Framework";
|
|
const binary = join(root, tail);
|
|
const image = thinFuseImage([0x31]);
|
|
await mkdir(dirname(binary), { recursive: true });
|
|
await writeFile(binary, image.bytes);
|
|
const volume = parse(root).root;
|
|
for (const input of [
|
|
binary.replaceAll("\\", "/"),
|
|
tail,
|
|
`${volume.slice(0, -1)}${tail}`,
|
|
binary.slice(volume.length - 1),
|
|
]) {
|
|
const result = await cli.run({
|
|
arguments: ["inspect-electron-fuses", input, "--json"],
|
|
cwd: root,
|
|
});
|
|
expect(result.exitCode, result.stderr).toBe(0);
|
|
const evidence = toolContract(
|
|
"inspect_electron_fuses",
|
|
).outputSchema.parse(result.json);
|
|
expect(evidence.normalized_result.artifact).toMatchObject({
|
|
selected_path: binary,
|
|
resolved_path: binary,
|
|
sha256: createHash("sha256").update(image.bytes).digest("hex"),
|
|
});
|
|
}
|
|
},
|
|
);
|
|
|
|
cliTest(
|
|
"reads thin and universal Electron fuse wires through the public CLI",
|
|
async ({ cli }) => {
|
|
const root = await createTestTempDirectory("rea-electron-fuses-cli-");
|
|
const thin = thinFuseImage(OBSIDIAN_FUSE_BYTES);
|
|
const universal = universalFuseImage();
|
|
await writeFile(join(root, "thin"), thin.bytes);
|
|
await writeFile(join(root, "universal"), universal.bytes);
|
|
|
|
const thinResult = await cli.run({
|
|
arguments: ["inspect-electron-fuses", "thin", "--json"],
|
|
cwd: root,
|
|
});
|
|
expect(thinResult.exitCode, thinResult.stderr).toBe(0);
|
|
const thinEvidence = toolContract(
|
|
"inspect_electron_fuses",
|
|
).outputSchema.parse(thinResult.json);
|
|
expect(thinEvidence.subject?.local_path).toBe(join(root, "thin"));
|
|
expect(thinEvidence.subject?.digest.sha256).toBe(
|
|
createHash("sha256").update(thin.bytes).digest("hex"),
|
|
);
|
|
expect(thinEvidence.subject?.architecture).toBe("arm64");
|
|
expect(
|
|
thinEvidence.normalized_result.slices[0]?.sentinels[0],
|
|
).toMatchObject({
|
|
sentinel_offset: thin.sentinelOffset,
|
|
wire_version: 1,
|
|
declared_length: 8,
|
|
});
|
|
expect(
|
|
thinEvidence.normalized_result.runtime_implications.find(
|
|
(item) => item.subject === "node_cli_inspect_arguments",
|
|
),
|
|
).toMatchObject({ outcome: "not_honored", fuse_index: 3 });
|
|
|
|
const universalResult = await cli.run({
|
|
arguments: ["inspect-electron-fuses", join(root, "universal"), "--json"],
|
|
});
|
|
expect(universalResult.exitCode, universalResult.stderr).toBe(0);
|
|
const universalEvidence = toolContract(
|
|
"inspect_electron_fuses",
|
|
).outputSchema.parse(universalResult.json);
|
|
expect(universalEvidence.normalized_result.artifact.format).toBe(
|
|
"mach-o-universal",
|
|
);
|
|
expect(universalEvidence.subject?.architecture).toBeNull();
|
|
expect(
|
|
universalEvidence.normalized_result.slices.map((slice) => ({
|
|
file_offset: slice.file_offset,
|
|
sentinel_offset: slice.sentinels[0]?.sentinel_offset,
|
|
})),
|
|
).toEqual([
|
|
{
|
|
file_offset: universal.left.fileOffset,
|
|
sentinel_offset: universal.left.sentinelOffset,
|
|
},
|
|
{
|
|
file_offset: universal.right.fileOffset,
|
|
sentinel_offset: universal.right.sentinelOffset,
|
|
},
|
|
]);
|
|
},
|
|
);
|
|
|
|
cliTest.for([
|
|
{ label: "ELF x86", format: "elf", machine: 3, architecture: "x86" },
|
|
{ label: "ELF x86-64", format: "elf", machine: 62, architecture: "x86_64" },
|
|
{ label: "ELF AArch64", format: "elf", machine: 183, architecture: "arm64" },
|
|
{ label: "ELF unknown", format: "elf", machine: 0xfffe, architecture: null },
|
|
{ label: "PE x86", format: "pe", machine: 0x14c, architecture: "x86" },
|
|
{ label: "PE AMD64", format: "pe", machine: 0x8664, architecture: "x86_64" },
|
|
{ label: "PE ARM64", format: "pe", machine: 0xaa64, architecture: "arm64" },
|
|
{ label: "PE unknown", format: "pe", machine: 0x01f0, architecture: null },
|
|
] as const)(
|
|
"reports the $label header architecture beside unchanged fuse wires",
|
|
async ({ format, machine, architecture }, { cli }) => {
|
|
const root = await createTestTempDirectory("rea-electron-fuses-cli-arch-");
|
|
const image =
|
|
format === "elf"
|
|
? elfHeaderFuseImage(machine, OBSIDIAN_FUSE_BYTES, {
|
|
bits: architecture === "x86" ? 32 : 64,
|
|
byteOrder: "little",
|
|
})
|
|
: peHeaderFuseImage(machine, OBSIDIAN_FUSE_BYTES);
|
|
const path = join(root, "electron");
|
|
await writeFile(path, image.bytes);
|
|
const result = await cli.run({
|
|
arguments: ["inspect-electron-fuses", path, "--json"],
|
|
});
|
|
expect(result.exitCode, result.stderr).toBe(0);
|
|
const evidence = toolContract("inspect_electron_fuses").outputSchema.parse(
|
|
result.json,
|
|
);
|
|
expect(evidence.normalized_result.artifact.format).toBe(format);
|
|
expect(evidence.subject?.architecture).toBe(architecture);
|
|
expect(evidence.normalized_result.slices).toMatchObject([
|
|
{
|
|
architecture,
|
|
sentinel_count: 1,
|
|
sentinels: [
|
|
{
|
|
sentinel_offset: image.sentinelOffset,
|
|
wire_version: 1,
|
|
complete: true,
|
|
},
|
|
],
|
|
},
|
|
]);
|
|
expect(
|
|
evidence.normalized_result.slices[0]?.sentinels[0]?.fuses.map(
|
|
(fuse) => fuse.raw_byte,
|
|
),
|
|
).toEqual(OBSIDIAN_FUSE_BYTES);
|
|
},
|
|
);
|
|
|
|
cliTest(
|
|
"reports a missing sentinel as unknown fuse state through the public CLI",
|
|
async ({ cli }) => {
|
|
const root = await createTestTempDirectory("rea-electron-fuses-cli-empty-");
|
|
const path = join(root, "empty");
|
|
await writeFile(path, sentinelFreeMacho());
|
|
const result = await cli.run({
|
|
arguments: ["inspect-electron-fuses", path, "--json"],
|
|
});
|
|
expect(result.exitCode, result.stderr).toBe(0);
|
|
const evidence = toolContract("inspect_electron_fuses").outputSchema.parse(
|
|
result.json,
|
|
);
|
|
expect(evidence.normalized_result.slices[0]?.sentinel_count).toBe(0);
|
|
expect(evidence.normalized_result.runtime_implications).toEqual([]);
|
|
expect(evidence.limitations.join(" ")).toContain(
|
|
"unknown, not that every fuse is disabled",
|
|
);
|
|
expect(evidence.limitations.join(" ")).toContain(
|
|
"fuse state for that slice is unknown, not disabled",
|
|
);
|
|
},
|
|
);
|
|
|
|
cliTest(
|
|
"resolves an Electron app bundle to its framework binary through the public CLI",
|
|
async ({ cli }) => {
|
|
const root = await createTestTempDirectory("rea-electron-fuses-cli-app-");
|
|
const image = thinFuseImage(OBSIDIAN_FUSE_BYTES);
|
|
const app = join(root, "Fixture.app");
|
|
const binary = join(
|
|
app,
|
|
"Contents",
|
|
"Frameworks",
|
|
"Electron Framework.framework",
|
|
"Versions",
|
|
"A",
|
|
"Electron Framework",
|
|
);
|
|
await mkdir(join(binary, ".."), { recursive: true });
|
|
await writeFile(binary, image.bytes);
|
|
await symlink("A", join(binary, "..", "..", "Current"));
|
|
for (const { input, cwd, selected } of [
|
|
{ input: app, cwd: root, selected: app },
|
|
{ input: `${app}/./`, cwd: root, selected: `${app}/./` },
|
|
{ input: "Fixture.app/.", cwd: root, selected: `${app}/.` },
|
|
{ input: ".", cwd: app, selected: `${app}${sep}.` },
|
|
{
|
|
input: "..",
|
|
cwd: join(app, "Contents"),
|
|
selected: `${app}${sep}Contents${sep}..`,
|
|
},
|
|
{
|
|
input: ".././..",
|
|
cwd: join(app, "Contents", "Frameworks"),
|
|
selected: `${app}${sep}Contents${sep}Frameworks${sep}.././..`,
|
|
},
|
|
]) {
|
|
const result = await cli.run({
|
|
arguments: ["inspect-electron-fuses", input, "--json"],
|
|
cwd,
|
|
});
|
|
expect(result.exitCode, result.stderr).toBe(0);
|
|
const evidence = toolContract(
|
|
"inspect_electron_fuses",
|
|
).outputSchema.parse(result.json);
|
|
expect(evidence.normalized_result.artifact).toMatchObject({
|
|
selected_path: process.platform === "win32" ? app : selected,
|
|
resolved_path: binary,
|
|
format: "mach-o",
|
|
});
|
|
expect(evidence.subject?.local_path).toBe(binary);
|
|
}
|
|
|
|
const empty = await cli.run({
|
|
arguments: ["inspect-electron-fuses", "", "--json"],
|
|
cwd: app,
|
|
});
|
|
expect(empty.exitCode, empty.stderr).toBe(1);
|
|
expect(empty.json).toMatchObject({
|
|
code: "invalid_request",
|
|
details: { operation: "inspect_electron_fuses" },
|
|
});
|
|
},
|
|
);
|
|
|
|
cliTest.skipIf(process.platform === "win32")(
|
|
"refuses a terminal bundle parent segment after a directory symlink",
|
|
async ({ cli }) => {
|
|
const root = await createTestTempDirectory(
|
|
"rea-electron-fuses-cli-parent-",
|
|
);
|
|
const app = join(root, "Fixture.app");
|
|
const binary = join(
|
|
app,
|
|
"Contents",
|
|
"Frameworks",
|
|
"Electron Framework.framework",
|
|
"Electron Framework",
|
|
);
|
|
await mkdir(dirname(binary), { recursive: true });
|
|
await writeFile(binary, thinFuseImage([0x31]).bytes);
|
|
await symlink("Contents", join(app, "linked"));
|
|
const result = await cli.run({
|
|
arguments: ["inspect-electron-fuses", `${app}/linked//..`, "--json"],
|
|
});
|
|
expect(result.exitCode, result.stderr).toBe(1);
|
|
expect(result.json).toMatchObject({
|
|
code: "invalid_request",
|
|
details: {
|
|
operation: "inspect_electron_fuses",
|
|
issues: [
|
|
expect.objectContaining({ path: ["path"], reason: "invalid_value" }),
|
|
],
|
|
},
|
|
});
|
|
},
|
|
);
|
|
|
|
cliTest(
|
|
"rejects an unrecognized container through the public CLI",
|
|
async ({ cli }) => {
|
|
const root = await createTestTempDirectory("rea-electron-fuses-cli-text-");
|
|
const path = join(root, "notes.txt");
|
|
await writeFile(path, "This is not an executable container.");
|
|
const result = await cli.run({
|
|
arguments: ["inspect-electron-fuses", path, "--json"],
|
|
});
|
|
expect(result.exitCode).toBe(1);
|
|
expect(result.json).toMatchObject({
|
|
code: "unsupported_target",
|
|
details: { operation: "inspect_electron_fuses", path },
|
|
});
|
|
},
|
|
);
|