427 lines
16 KiB
JavaScript
427 lines
16 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import {
|
|
lstat,
|
|
mkdir,
|
|
readFile,
|
|
readdir,
|
|
rm,
|
|
symlink,
|
|
writeFile,
|
|
} from 'node:fs/promises';
|
|
import path from 'node:path';
|
|
import test from 'node:test';
|
|
import {
|
|
VALID_PRIVATE_KEY,
|
|
assertNativeHandler,
|
|
cliPath,
|
|
createFixture,
|
|
environment,
|
|
legacyManagedConfig,
|
|
managedHandler,
|
|
readJson,
|
|
registryModuleUrl,
|
|
runHook,
|
|
runNode,
|
|
runPlugin,
|
|
startApiServer,
|
|
writeJson,
|
|
} from '../test-support/copilot-test-helpers.mjs';
|
|
|
|
async function assertMissing(filePath) {
|
|
await assert.rejects(lstat(filePath), { code: 'ENOENT' });
|
|
}
|
|
|
|
async function assertNoTransactionFiles(fixture) {
|
|
const names = [];
|
|
for (const directory of [fixture.agentDir, fixture.hooksDir, path.dirname(fixture.legacyPath)]) {
|
|
try {
|
|
names.push(...await readdir(directory));
|
|
} catch (error) {
|
|
if (error?.code !== 'ENOENT') throw error;
|
|
}
|
|
}
|
|
assert.equal(names.some((name) => /\.(tmp|rollback)$/.test(name)), false, names.join(', '));
|
|
}
|
|
|
|
test('GitHub Copilot CLI is registered with its native user hook directory', async () => {
|
|
const { SUPPORTED_AGENTS } = await import(registryModuleUrl);
|
|
assert.deepEqual(SUPPORTED_AGENTS.get('copilot'), {
|
|
name: 'GitHub Copilot CLI',
|
|
configDir: '~/.copilot/hooks',
|
|
configFile: 'elydora-audit.json',
|
|
});
|
|
});
|
|
|
|
test('Copilot installs five managed files, preserves valid hooks, and migrates legacy entries', async () => {
|
|
const fixture = await createFixture({
|
|
userConfig: {
|
|
version: 1,
|
|
disableAllHooks: false,
|
|
owner: 'user',
|
|
hooks: {
|
|
sessionStart: [{ type: 'prompt', prompt: '/compact' }],
|
|
preToolUse: [{ type: 'command', command: 'user-pre-hook', timeout: 3 }],
|
|
postToolUse: [{ type: 'command', bash: 'user-post-hook' }],
|
|
postToolUseFailure: [{ command: 'user-failure-hook', matcher: 'powershell' }],
|
|
},
|
|
},
|
|
});
|
|
try {
|
|
await writeJson(fixture.legacyPath, legacyManagedConfig(fixture, {
|
|
notification: [{
|
|
type: 'command',
|
|
command: 'user-notification-hook',
|
|
matcher: 'agent_idle|permission_prompt',
|
|
}],
|
|
}));
|
|
const first = await fixture.install();
|
|
assert.equal(first.code, 0, first.stderr);
|
|
const managedFiles = [
|
|
fixture.guardScriptPath,
|
|
path.join(fixture.agentDir, 'config.json'),
|
|
path.join(fixture.agentDir, 'private.key'),
|
|
fixture.hookScriptPath,
|
|
fixture.configPath,
|
|
];
|
|
const snapshot = new Map(await Promise.all(managedFiles.map(async (filePath) => [
|
|
filePath,
|
|
await readFile(filePath, 'utf-8'),
|
|
])));
|
|
const config = JSON.parse(snapshot.get(fixture.configPath));
|
|
assert.equal(config.owner, 'user');
|
|
assert.equal(config.disableAllHooks, false);
|
|
assert.deepEqual(config.hooks.sessionStart, [{ type: 'prompt', prompt: '/compact' }]);
|
|
assert.equal(config.hooks.preToolUse.length, 2);
|
|
assert.equal(config.hooks.postToolUse.length, 2);
|
|
assert.equal(config.hooks.postToolUseFailure.length, 2);
|
|
assertNativeHandler(managedHandler(config, 'preToolUse', 'guard.js'));
|
|
assertNativeHandler(managedHandler(config, 'postToolUse', 'hook.js'));
|
|
assertNativeHandler(managedHandler(config, 'postToolUseFailure', 'hook.js'));
|
|
assert.deepEqual(await readJson(path.join(fixture.agentDir, 'config.json')), {
|
|
org_id: 'org-1',
|
|
agent_id: fixture.agentId,
|
|
kid: 'kid-1',
|
|
base_url: fixture.baseUrl,
|
|
token: 'token-1',
|
|
agent_name: 'copilot',
|
|
});
|
|
assert.equal(await readFile(path.join(fixture.agentDir, 'private.key'), 'utf-8'), VALID_PRIVATE_KEY);
|
|
assert.deepEqual(await readJson(fixture.legacyPath), {
|
|
version: 1,
|
|
hooks: {
|
|
notification: [{
|
|
type: 'command',
|
|
command: 'user-notification-hook',
|
|
matcher: 'agent_idle|permission_prompt',
|
|
}],
|
|
},
|
|
});
|
|
|
|
const second = await fixture.install();
|
|
assert.equal(second.code, 0, second.stderr);
|
|
for (const [filePath, source] of snapshot) {
|
|
assert.equal(await readFile(filePath, 'utf-8'), source, filePath);
|
|
}
|
|
await assertNoTransactionFiles(fixture);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
|
|
test('Copilot migration removes a legacy file owned entirely by Elydora', async () => {
|
|
const fixture = await createFixture();
|
|
try {
|
|
await writeJson(fixture.legacyPath, legacyManagedConfig(fixture));
|
|
const result = await fixture.install();
|
|
assert.equal(result.code, 0, result.stderr);
|
|
await assertMissing(fixture.legacyPath);
|
|
assertNativeHandler(managedHandler(await readJson(fixture.configPath), 'preToolUse', 'guard.js'));
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
|
|
test('Copilot guard blocks frozen agents and audit records success and failure payloads', async () => {
|
|
const api = await startApiServer();
|
|
const fixture = await createFixture({ baseUrl: api.baseUrl });
|
|
try {
|
|
assert.equal((await fixture.install()).code, 0);
|
|
const config = await readJson(fixture.configPath);
|
|
const guard = managedHandler(config, 'preToolUse', 'guard.js');
|
|
const successAudit = managedHandler(config, 'postToolUse', 'hook.js');
|
|
const failureAudit = managedHandler(config, 'postToolUseFailure', 'hook.js');
|
|
const prePayload = {
|
|
sessionId: 'session-1',
|
|
timestamp: 1784486400000,
|
|
cwd: fixture.projectDir,
|
|
toolName: 'powershell',
|
|
toolArgs: { command: 'Get-ChildItem' },
|
|
};
|
|
await writeJson(path.join(fixture.agentDir, 'status-cache.json'), {
|
|
status: 'frozen',
|
|
cached_at: Date.now(),
|
|
});
|
|
let result = await runHook(guard, fixture, JSON.stringify(prePayload));
|
|
assert.equal(result.code, 2, result.stderr);
|
|
assert.equal(result.stdout, '');
|
|
assert.match(result.stderr, /Agent "copilot" is frozen/);
|
|
|
|
await writeJson(path.join(fixture.agentDir, 'status-cache.json'), {
|
|
status: 'active',
|
|
cached_at: Date.now(),
|
|
});
|
|
result = await runHook(guard, fixture, JSON.stringify(prePayload));
|
|
assert.equal(result.code, 0, result.stderr);
|
|
assert.equal(result.stdout, '');
|
|
|
|
const successPayload = {
|
|
...prePayload,
|
|
toolResult: { resultType: 'success', textResultForLlm: 'ok' },
|
|
};
|
|
result = await runHook(successAudit, fixture, JSON.stringify(successPayload));
|
|
assert.equal(result.code, 0, result.stderr);
|
|
const failurePayload = { ...prePayload, error: 'command failed' };
|
|
result = await runHook(failureAudit, fixture, JSON.stringify(failurePayload));
|
|
assert.equal(result.code, 0, result.stderr);
|
|
|
|
const operations = api.requests
|
|
.filter((request) => request.method === 'POST')
|
|
.map((request) => JSON.parse(request.raw));
|
|
assert.equal(operations.length, 2);
|
|
assert.deepEqual(operations[0].payload, successPayload);
|
|
assert.deepEqual(operations[1].payload, failurePayload);
|
|
assert.deepEqual(operations[1].subject, { session_id: 'session-1' });
|
|
assert.deepEqual(operations[1].action, { tool: 'powershell' });
|
|
} finally {
|
|
await api.close();
|
|
await fixture.close();
|
|
}
|
|
});
|
|
|
|
test('Copilot uses the official default for an empty COPILOT_HOME', async () => {
|
|
const fixture = await createFixture();
|
|
try {
|
|
const result = await fixture.install({}, '');
|
|
assert.equal(result.code, 0, result.stderr);
|
|
const defaultPath = path.join(fixture.homeDir, '.copilot', 'hooks', 'elydora-audit.json');
|
|
assertNativeHandler(managedHandler(await readJson(defaultPath), 'preToolUse', 'guard.js'));
|
|
const status = await runPlugin(fixture, 'status', null, '');
|
|
assert.equal(JSON.parse(status.stdout).configPath, defaultPath);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
|
|
test('Copilot status requires the complete active contract and exact runtime sources', async (t) => {
|
|
const cases = [
|
|
['missing failure event', 'config', /"hookConfigured":false/],
|
|
['tampered guard', 'guard', /"installed":false/],
|
|
['malformed runtime config', 'runtime', /parse Elydora runtime config/i],
|
|
['invalid private key', 'key', /private key is invalid/i],
|
|
];
|
|
for (const [label, target, expected] of cases) {
|
|
await t.test(label, async () => {
|
|
const fixture = await createFixture();
|
|
try {
|
|
assert.equal((await fixture.install()).code, 0);
|
|
const healthy = await runPlugin(fixture, 'status', null);
|
|
assert.deepEqual(JSON.parse(healthy.stdout), {
|
|
installed: true,
|
|
agentName: 'copilot',
|
|
displayName: 'GitHub Copilot CLI',
|
|
hookConfigured: true,
|
|
hookScriptExists: true,
|
|
configPath: fixture.configPath,
|
|
});
|
|
if (target === 'config') {
|
|
const config = await readJson(fixture.configPath);
|
|
delete config.hooks.postToolUseFailure;
|
|
await writeJson(fixture.configPath, config);
|
|
} else if (target === 'guard') {
|
|
await writeFile(fixture.guardScriptPath, 'tampered\n');
|
|
} else if (target === 'runtime') {
|
|
await writeFile(path.join(fixture.agentDir, 'config.json'), '{ malformed');
|
|
} else {
|
|
await writeFile(path.join(fixture.agentDir, 'private.key'), 'invalid');
|
|
}
|
|
const status = await runPlugin(fixture, 'status', null);
|
|
assert.match(`${status.stdout}\n${status.stderr}`, expected);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
}
|
|
});
|
|
|
|
test('Copilot resolves disableAllHooks through the official settings precedence', async (t) => {
|
|
await t.test('managed file flag blocks installation', async () => {
|
|
const fixture = await createFixture({
|
|
userConfig: { version: 1, disableAllHooks: true, hooks: {} },
|
|
localSettings: { disableAllHooks: false },
|
|
});
|
|
try {
|
|
const result = await fixture.install();
|
|
assert.equal(result.code, 1);
|
|
assert.match(result.stderr, /hooks are disabled/i);
|
|
await assertMissing(fixture.agentDir);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
|
|
await t.test('local repository settings re-enable user-disabled hooks', async () => {
|
|
const fixture = await createFixture({
|
|
userSettings: '{\n // user pause\n "disableAllHooks": true,\n}\n',
|
|
localSettings: { disableAllHooks: false },
|
|
});
|
|
try {
|
|
const result = await fixture.install();
|
|
assert.equal(result.code, 0, result.stderr);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
|
|
await t.test('repository settings disable every non-policy source', async () => {
|
|
const fixture = await createFixture({
|
|
userSettings: { disableAllHooks: false },
|
|
repositorySettings: { disableAllHooks: true },
|
|
});
|
|
try {
|
|
const result = await fixture.install();
|
|
assert.equal(result.code, 1);
|
|
assert.match(result.stderr, /Copilot repository settings/);
|
|
await assertMissing(fixture.agentDir);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
|
|
await t.test('GitHub repository settings override Claude local settings', async () => {
|
|
const fixture = await createFixture({
|
|
claudeLocalSettings: { disableAllHooks: true },
|
|
repositorySettings: { disableAllHooks: false },
|
|
});
|
|
try {
|
|
const result = await fixture.install();
|
|
assert.equal(result.code, 0, result.stderr);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
});
|
|
|
|
test('Copilot rejects malformed current schemas and preserves every source', async () => {
|
|
const cases = [
|
|
'{ malformed',
|
|
'{"version":1,"version":1,"hooks":{}}',
|
|
{ version: 2, hooks: {} },
|
|
{ version: 1, hooks: { futureEvent: [] } },
|
|
{ version: 1, hooks: { preToolUse: [{ type: 'unknown' }] } },
|
|
{ version: 1, hooks: { postToolUse: [{ type: 'http', url: 'http://example.com' }] } },
|
|
{ version: 1, hooks: { sessionEnd: [{ type: 'prompt', prompt: 'continue' }] } },
|
|
];
|
|
for (const userConfig of cases) {
|
|
const fixture = await createFixture({ userConfig });
|
|
try {
|
|
const before = await readFile(fixture.configPath, 'utf-8');
|
|
const result = await fixture.install();
|
|
assert.equal(result.code, 1, `${JSON.stringify(userConfig)}\n${result.stderr}`);
|
|
assert.equal(await readFile(fixture.configPath, 'utf-8'), before);
|
|
await assertMissing(fixture.agentDir);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
}
|
|
});
|
|
|
|
test('Copilot uninstall removes exact ownership and preserves adjacent handlers', async () => {
|
|
const fixture = await createFixture({
|
|
userConfig: { version: 1, hooks: { notification: [{ command: 'keep' }] } },
|
|
});
|
|
try {
|
|
assert.equal((await fixture.install()).code, 0);
|
|
const config = await readJson(fixture.configPath);
|
|
config.hooks.preToolUse.push({
|
|
type: 'command',
|
|
bash: `'${process.execPath}' '${path.join(fixture.homeDir, '.elydora', 'agent-10', 'guard.js')}'`,
|
|
powershell: 'user-decoy',
|
|
timeoutSec: 10,
|
|
});
|
|
await writeJson(fixture.configPath, config);
|
|
assert.equal((await runPlugin(fixture, 'uninstall', 'agent-10')).code, 0);
|
|
assert.equal((await readJson(fixture.configPath)).hooks.postToolUseFailure.length, 1);
|
|
|
|
const result = await runPlugin(fixture, 'uninstall', fixture.agentId);
|
|
assert.equal(result.code, 0, result.stderr);
|
|
const remaining = await readJson(fixture.configPath);
|
|
assert.deepEqual(remaining.hooks.notification, [{ command: 'keep' }]);
|
|
assert.equal(remaining.hooks.postToolUse, undefined);
|
|
assert.equal(remaining.hooks.postToolUseFailure, undefined);
|
|
assert.equal(remaining.hooks.preToolUse.length, 1);
|
|
assert.match(remaining.hooks.preToolUse[0].bash, /agent-10/);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
|
|
test('Copilot rejects linked hook and runtime paths before writes', async (t) => {
|
|
for (const kind of ['home', 'hook', 'runtime']) {
|
|
await t.test(kind, async () => {
|
|
const fixture = await createFixture();
|
|
try {
|
|
const target = path.join(fixture.rootDir, `${kind}-target`);
|
|
await mkdir(target, { recursive: true });
|
|
if (kind === 'home') {
|
|
await rm(fixture.copilotHome, { recursive: true, force: true });
|
|
await symlink(target, fixture.copilotHome, 'junction');
|
|
} else if (kind === 'hook') {
|
|
await mkdir(fixture.hooksDir, { recursive: true });
|
|
const targetFile = path.join(target, 'config.json');
|
|
await writeJson(targetFile, { version: 1, hooks: {} });
|
|
await symlink(targetFile, fixture.configPath, 'file');
|
|
} else {
|
|
await mkdir(fixture.homeDir, { recursive: true });
|
|
await symlink(target, path.join(fixture.homeDir, '.elydora'), 'junction');
|
|
}
|
|
const result = await fixture.install();
|
|
assert.equal(result.code, 1);
|
|
assert.match(result.stderr, /physical (directory|file)/i);
|
|
} catch (error) {
|
|
if (error?.code === 'EPERM') {
|
|
t.skip(`symbolic links unavailable: ${error.message}`);
|
|
return;
|
|
}
|
|
throw error;
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
}
|
|
});
|
|
|
|
test('Copilot CLI preflight blocks disabled hooks before runtime creation', async () => {
|
|
const fixture = await createFixture({ repositorySettings: { disableAllHooks: true } });
|
|
const privateKeyFile = path.join(fixture.rootDir, 'private-key');
|
|
try {
|
|
await writeFile(privateKeyFile, VALID_PRIVATE_KEY, { mode: 0o600 });
|
|
const result = await runNode([
|
|
'--no-warnings',
|
|
cliPath,
|
|
'install',
|
|
'--agent', 'copilot',
|
|
'--org_id', 'org-1',
|
|
'--agent_id', fixture.agentId,
|
|
'--kid', 'kid-1',
|
|
'--private_key_file', privateKeyFile,
|
|
'--base_url', fixture.baseUrl,
|
|
], environment(fixture), fixture.projectDir);
|
|
assert.equal(result.code, 1);
|
|
assert.match(result.stderr, /hooks are disabled/i);
|
|
await assertMissing(path.join(fixture.homeDir, '.elydora'));
|
|
await assertMissing(fixture.configPath);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|