雷电芽衣
98c61a0b6f
Rebuilt from the standalone 2101cb7 tree (durable transactions, Kiro IDE adapter, hook retry with a bounded chain lock, version 2.0.1) with the Open-Source API trims re-applied: no webhooks, members, admin events, deep health, token rotation, or agent integration updates. Claude-Session: https://claude.ai/code/session_01QoUjdc7HGKTsgj5GhG8HvF
449 lines
17 KiB
JavaScript
449 lines
17 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import {
|
|
lstat,
|
|
mkdir,
|
|
readFile,
|
|
readdir,
|
|
rm,
|
|
stat,
|
|
symlink,
|
|
writeFile,
|
|
} from 'node:fs/promises';
|
|
import path from 'node:path';
|
|
import test from 'node:test';
|
|
import {
|
|
VALID_PRIVATE_KEY,
|
|
cliPath,
|
|
createFixture,
|
|
environment,
|
|
findV3Hook,
|
|
managedV2Document,
|
|
readJson,
|
|
registryModuleUrl,
|
|
runNode,
|
|
runPlugin,
|
|
runShell,
|
|
startApiServer,
|
|
} from '../test-support/kirocli-test-helpers.mjs';
|
|
|
|
async function assertMissing(filePath) {
|
|
await assert.rejects(lstat(filePath), { code: 'ENOENT' });
|
|
}
|
|
|
|
async function writeJson(filePath, value) {
|
|
await mkdir(path.dirname(filePath), { recursive: true });
|
|
await writeFile(filePath, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
|
|
}
|
|
|
|
function userV3Hook() {
|
|
return {
|
|
name: 'global-context',
|
|
trigger: 'SessionStart',
|
|
action: { type: 'agent', prompt: 'Read AGENTS.md' },
|
|
enabled: true,
|
|
};
|
|
}
|
|
|
|
function legacyCommand(scriptPath) {
|
|
if (process.platform === 'win32') return `"${process.execPath}" "${scriptPath}"`;
|
|
const quote = (value) => `'${value.replaceAll("'", `'"'"'`)}'`;
|
|
return `${quote(process.execPath)} ${quote(scriptPath)}`;
|
|
}
|
|
|
|
function legacyDocuments(fixture) {
|
|
const guard = legacyCommand(fixture.guardScriptPath);
|
|
const audit = legacyCommand(fixture.hookScriptPath);
|
|
return {
|
|
v2: managedV2Document({
|
|
hooks: {
|
|
preToolUse: [{ matcher: '*', command: guard, timeout_ms: 5000 }],
|
|
postToolUse: [{ matcher: '*', command: audit, timeout_ms: 5000 }],
|
|
},
|
|
}),
|
|
v3: {
|
|
version: 'v1',
|
|
hooks: [
|
|
{
|
|
name: 'elydora-guard',
|
|
description: 'Block tool use when the Elydora agent is frozen',
|
|
trigger: 'PreToolUse',
|
|
matcher: '.*',
|
|
action: { type: 'command', command: guard },
|
|
timeout: 5,
|
|
enabled: true,
|
|
},
|
|
{
|
|
name: 'elydora-audit',
|
|
description: 'Record tool use in the Elydora audit trail',
|
|
trigger: 'PostToolUse',
|
|
matcher: '.*',
|
|
action: { type: 'command', command: audit },
|
|
timeout: 5,
|
|
enabled: true,
|
|
},
|
|
],
|
|
},
|
|
};
|
|
}
|
|
|
|
test('Kiro CLI installs exact v2 and 2.13 v3 global contracts atomically', async () => {
|
|
const { SUPPORTED_AGENTS } = await import(registryModuleUrl);
|
|
assert.deepEqual(SUPPORTED_AGENTS.get('kirocli'), {
|
|
name: 'Kiro CLI',
|
|
configDir: '~/.kiro/hooks',
|
|
configFile: 'elydora-audit.json',
|
|
});
|
|
const fixture = await createFixture({
|
|
existingV2: managedV2Document({
|
|
owner: 'user',
|
|
hooks: {
|
|
agentSpawn: [{ command: 'existing-spawn' }],
|
|
preToolUse: [{ matcher: 'read', command: 'existing-v2' }],
|
|
},
|
|
}),
|
|
existingV3: { version: 'v1', owner: 'user', hooks: [userV3Hook()] },
|
|
});
|
|
try {
|
|
const first = await fixture.install();
|
|
assert.equal(first.code, 0, first.stderr);
|
|
assert.match(first.stdout, /2\.13\.0\+/);
|
|
assert.match(first.stdout, /agent validate/);
|
|
assert.match(first.stdout, /--agent elydora-audit/);
|
|
const firstV2Source = await readFile(fixture.v2Path, 'utf-8');
|
|
const firstV3Source = await readFile(fixture.v3Path, 'utf-8');
|
|
const v2 = JSON.parse(firstV2Source);
|
|
assert.equal(v2.owner, 'user');
|
|
assert.deepEqual(v2.hooks.agentSpawn, [{ command: 'existing-spawn' }]);
|
|
assert.equal(v2.hooks.preToolUse.length, 2);
|
|
assert.deepEqual(v2.hooks.preToolUse[1], {
|
|
matcher: '*',
|
|
command: v2.hooks.preToolUse[1].command,
|
|
timeout_ms: 10_000,
|
|
});
|
|
assert.deepEqual(v2.hooks.postToolUse[0], {
|
|
matcher: '*',
|
|
command: v2.hooks.postToolUse[0].command,
|
|
timeout_ms: 10_000,
|
|
});
|
|
const v3 = JSON.parse(firstV3Source);
|
|
assert.equal(v3.owner, 'user');
|
|
assert.deepEqual(v3.hooks[0], userV3Hook());
|
|
assert.deepEqual(findV3Hook(v3, 'elydora-guard'), {
|
|
name: 'elydora-guard',
|
|
description: 'Block tool use when the Elydora agent is frozen',
|
|
trigger: 'PreToolUse',
|
|
matcher: '.*',
|
|
action: { type: 'command', command: findV3Hook(v3, 'elydora-guard').action.command },
|
|
timeout: 10,
|
|
enabled: true,
|
|
});
|
|
assert.equal(findV3Hook(v3, 'elydora-audit').trigger, 'PostToolUse');
|
|
assert.deepEqual(await readJson(path.join(fixture.agentDir, 'config.json')), {
|
|
org_id: 'org-1',
|
|
agent_id: fixture.agentId,
|
|
kid: 'kid-1',
|
|
base_url: fixture.baseUrl,
|
|
token: 'token-1',
|
|
agent_name: 'kirocli',
|
|
});
|
|
assert.equal(await readFile(path.join(fixture.agentDir, 'private.key'), 'utf-8'), VALID_PRIVATE_KEY);
|
|
const second = await fixture.install();
|
|
assert.equal(second.code, 0, second.stderr);
|
|
assert.equal(await readFile(fixture.v2Path, 'utf-8'), firstV2Source);
|
|
assert.equal(await readFile(fixture.v3Path, 'utf-8'), firstV3Source);
|
|
const names = [
|
|
...await readdir(path.dirname(fixture.v2Path)),
|
|
...await readdir(path.dirname(fixture.v3Path)),
|
|
...await readdir(fixture.agentDir),
|
|
];
|
|
assert.equal(names.some((name) => /\.(tmp|rollback)$/.test(name)), false);
|
|
if (process.platform !== 'win32') {
|
|
assert.equal((await stat(fixture.v2Path)).mode & 0o777, 0o600);
|
|
assert.equal((await stat(fixture.guardScriptPath)).mode & 0o777, 0o700);
|
|
}
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
|
|
test('Kiro CLI commands block frozen agents and preserve native events', async () => {
|
|
const api = await startApiServer();
|
|
const fixture = await createFixture({ baseUrl: api.baseUrl });
|
|
try {
|
|
assert.equal((await fixture.install()).code, 0);
|
|
const v2 = await readJson(fixture.v2Path);
|
|
const v3 = await readJson(fixture.v3Path);
|
|
assert.equal(v2.hooks.preToolUse[0].command, findV3Hook(v3, 'elydora-guard').action.command);
|
|
const payload = {
|
|
hook_event_name: 'preToolUse',
|
|
cwd: fixture.projectDir,
|
|
session_id: 'session-1',
|
|
tool_name: 'execute_bash',
|
|
tool_input: { command: 'npm test' },
|
|
future_field: { retained: true },
|
|
};
|
|
await writeJson(path.join(fixture.agentDir, 'status-cache.json'), {
|
|
status: 'frozen',
|
|
cached_at: Date.now(),
|
|
});
|
|
const guard = await runShell(
|
|
findV3Hook(v3, 'elydora-guard').action.command,
|
|
environment(fixture),
|
|
fixture.projectDir,
|
|
JSON.stringify(payload),
|
|
);
|
|
assert.equal(guard.code, 2, guard.stderr);
|
|
await rm(path.join(fixture.agentDir, 'status-cache.json'));
|
|
payload.hook_event_name = 'postToolUse';
|
|
payload.tool_response = { success: true, result: '12 passed' };
|
|
const audit = await runShell(
|
|
findV3Hook(v3, 'elydora-audit').action.command,
|
|
environment(fixture),
|
|
fixture.projectDir,
|
|
JSON.stringify(payload),
|
|
);
|
|
assert.equal(audit.code, 0, audit.stderr);
|
|
const operation = JSON.parse(api.requests.find(({ method }) => method === 'POST').raw);
|
|
assert.deepEqual(operation.payload, payload);
|
|
assert.deepEqual(operation.action, { tool: 'execute_bash' });
|
|
assert.deepEqual(operation.subject, { session_id: 'session-1' });
|
|
} finally {
|
|
await api.close();
|
|
await fixture.close();
|
|
}
|
|
});
|
|
|
|
test('Kiro CLI status requires both exact contracts and physical runtime identity', async (t) => {
|
|
await t.test('missing home is an empty installation', async () => {
|
|
const fixture = await createFixture();
|
|
try {
|
|
await rm(fixture.homeDir, { recursive: true });
|
|
const status = await runPlugin(fixture, 'status', null);
|
|
assert.equal(status.code, 0, status.stderr);
|
|
assert.equal(JSON.parse(status.stdout).installed, false);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
await t.test('missing or disabled contract is degraded and reinstall repairs it', async () => {
|
|
const fixture = await createFixture();
|
|
try {
|
|
assert.equal((await fixture.install()).code, 0);
|
|
let status = await runPlugin(fixture, 'status', null);
|
|
assert.equal(JSON.parse(status.stdout).installed, true);
|
|
const v3 = await readJson(fixture.v3Path);
|
|
findV3Hook(v3, 'elydora-guard').enabled = false;
|
|
await writeJson(fixture.v3Path, v3);
|
|
status = await runPlugin(fixture, 'status', null);
|
|
assert.equal(JSON.parse(status.stdout).installed, false);
|
|
assert.equal((await fixture.install()).code, 0);
|
|
await rm(fixture.v2Path);
|
|
status = await runPlugin(fixture, 'status', null);
|
|
assert.equal(JSON.parse(status.stdout).hookConfigured, false);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
await t.test('recognized altered hooks degrade status', async () => {
|
|
const fixture = await createFixture();
|
|
try {
|
|
assert.equal((await fixture.install()).code, 0);
|
|
const v2 = await readJson(fixture.v2Path);
|
|
v2.hooks.preToolUse.push({ ...v2.hooks.preToolUse[0], timeout_ms: 5000 });
|
|
await writeJson(fixture.v2Path, v2);
|
|
let status = await runPlugin(fixture, 'status', null);
|
|
assert.equal(JSON.parse(status.stdout).hookConfigured, false);
|
|
|
|
assert.equal((await fixture.install()).code, 0);
|
|
const v3 = await readJson(fixture.v3Path);
|
|
v3.hooks.push({ ...findV3Hook(v3, 'elydora-guard'), enabled: false });
|
|
await writeJson(fixture.v3Path, v3);
|
|
status = await runPlugin(fixture, 'status', null);
|
|
assert.equal(JSON.parse(status.stdout).hookConfigured, false);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
for (const [label, target, contents, expected] of [
|
|
['guard runtime', 'guard', 'tampered\n', /"installed":false/],
|
|
['runtime config', 'config', '{ malformed', /parse Elydora runtime config/i],
|
|
['runtime identity', 'config', JSON.stringify({
|
|
org_id: 'org-1',
|
|
agent_id: 'agent-1',
|
|
kid: 'kid-1',
|
|
base_url: 'http://127.0.0.1:9',
|
|
token: 'token-1',
|
|
agent_name: 'kiroide',
|
|
}), /runtime identity/i],
|
|
['private key', 'key', 'invalid', /private key is invalid/i],
|
|
]) {
|
|
await t.test(label, async () => {
|
|
const fixture = await createFixture();
|
|
try {
|
|
assert.equal((await fixture.install()).code, 0);
|
|
const targets = {
|
|
guard: fixture.guardScriptPath,
|
|
config: path.join(fixture.agentDir, 'config.json'),
|
|
key: path.join(fixture.agentDir, 'private.key'),
|
|
};
|
|
await writeFile(targets[target], contents);
|
|
const status = await runPlugin(fixture, 'status', null);
|
|
assert.match(`${status.stdout}${status.stderr}`, expected);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
}
|
|
});
|
|
|
|
test('Kiro CLI rejects malformed, colliding, invalid, and linked inputs before writes', async (t) => {
|
|
for (const [label, options, pattern] of [
|
|
['duplicate v2', { existingV2: '{"name":"elydora-audit","name":"other"}' }, /duplicate/i],
|
|
['v2 path collision', { existingV2: { name: 'user-agent', hooks: {} } }, /v2 agent path conflicts/i],
|
|
['v3 name collision', { existingV3: { version: 'v1', hooks: [{ name: 'elydora-guard', trigger: 'PreToolUse', action: { type: 'command', command: 'user-command' } }] } }, /hook name.*conflicts/i],
|
|
]) {
|
|
await t.test(label, async () => {
|
|
const fixture = await createFixture(options);
|
|
try {
|
|
const result = await fixture.install();
|
|
assert.equal(result.code, 1);
|
|
assert.match(result.stderr, pattern);
|
|
await assertMissing(fixture.guardScriptPath);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
}
|
|
await t.test('non-canonical private key', async () => {
|
|
const fixture = await createFixture();
|
|
try {
|
|
const result = await fixture.install({ privateKey: 'invalid' });
|
|
assert.equal(result.code, 1);
|
|
assert.match(result.stderr, /canonical 32-byte/);
|
|
await assertMissing(fixture.v2Path);
|
|
await assertMissing(fixture.v3Path);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
await t.test('linked Kiro directory', async () => {
|
|
const fixture = await createFixture();
|
|
const external = path.join(fixture.rootDir, 'external');
|
|
try {
|
|
await mkdir(external);
|
|
await symlink(external, path.join(fixture.homeDir, '.kiro'), 'junction');
|
|
const result = await fixture.install();
|
|
assert.equal(result.code, 1);
|
|
assert.match(result.stderr, /not a physical directory|symbolic link/i);
|
|
await assertMissing(path.join(external, 'agents', 'elydora-audit.json'));
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
});
|
|
|
|
test('Kiro CLI migrates exact legacy commands and repairs both schemas', async () => {
|
|
const fixture = await createFixture();
|
|
try {
|
|
const legacy = legacyDocuments(fixture);
|
|
await writeJson(fixture.v2Path, legacy.v2);
|
|
await writeJson(fixture.v3Path, legacy.v3);
|
|
const result = await fixture.install();
|
|
assert.equal(result.code, 0, result.stderr);
|
|
const v2 = await readJson(fixture.v2Path);
|
|
const v3 = await readJson(fixture.v3Path);
|
|
assert.equal(v2.hooks.preToolUse.length, 1);
|
|
assert.equal(v2.hooks.preToolUse[0].timeout_ms, 10_000);
|
|
assert.equal(findV3Hook(v3, 'elydora-guard').timeout, 10);
|
|
assert.equal(findV3Hook(v3, 'elydora-guard').action.command, v2.hooks.preToolUse[0].command);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
|
|
test('Kiro CLI uninstall preserves user hooks and removes fully owned files', async (t) => {
|
|
await t.test('mixed files', async () => {
|
|
const fixture = await createFixture({
|
|
existingV2: managedV2Document({ hooks: { agentSpawn: [{ command: 'existing-spawn' }] } }),
|
|
existingV3: { version: 'v1', hooks: [userV3Hook()] },
|
|
});
|
|
try {
|
|
assert.equal((await fixture.install()).code, 0);
|
|
const result = await runPlugin(fixture, 'uninstall', fixture.agentId);
|
|
assert.equal(result.code, 0, result.stderr);
|
|
const v2 = await readJson(fixture.v2Path);
|
|
assert.deepEqual(v2.hooks, { agentSpawn: [{ command: 'existing-spawn' }] });
|
|
const v3 = await readJson(fixture.v3Path);
|
|
assert.deepEqual(v3.hooks, [userV3Hook()]);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
await t.test('fully owned files', async () => {
|
|
const fixture = await createFixture();
|
|
try {
|
|
assert.equal((await fixture.install()).code, 0);
|
|
const result = await runPlugin(fixture, 'uninstall', fixture.agentId);
|
|
assert.equal(result.code, 0, result.stderr);
|
|
await assertMissing(fixture.v2Path);
|
|
await assertMissing(fixture.v3Path);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
await t.test('legacy files', async () => {
|
|
const fixture = await createFixture();
|
|
try {
|
|
const legacy = legacyDocuments(fixture);
|
|
await writeJson(fixture.v2Path, legacy.v2);
|
|
await writeJson(fixture.v3Path, legacy.v3);
|
|
const result = await runPlugin(fixture, 'uninstall', fixture.agentId);
|
|
assert.equal(result.code, 0, result.stderr);
|
|
await assertMissing(fixture.v2Path);
|
|
await assertMissing(fixture.v3Path);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
await t.test('unrelated v3 source bytes', async () => {
|
|
const source = '{ "version": "v1", "hooks": [{ "name": "user", "trigger": "SessionStart", "action": { "type": "command", "command": "echo user" } }] }\n';
|
|
const fixture = await createFixture({ existingV3: source });
|
|
try {
|
|
const result = await runPlugin(fixture, 'uninstall', fixture.agentId);
|
|
assert.equal(result.code, 0, result.stderr);
|
|
assert.equal(await readFile(fixture.v3Path, 'utf-8'), source);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|
|
});
|
|
|
|
test('Kiro CLI command completes install, status, and uninstall end to end', async () => {
|
|
const fixture = await createFixture();
|
|
const privateKeyFile = path.join(fixture.projectDir, 'private-key.txt');
|
|
const tokenFile = path.join(fixture.projectDir, 'token.txt');
|
|
try {
|
|
await writeFile(privateKeyFile, `${VALID_PRIVATE_KEY}\n`, { mode: 0o600 });
|
|
await writeFile(tokenFile, 'token-1\n', { mode: 0o600 });
|
|
const install = await runNode([
|
|
cliPath, 'install', '--agent', 'kirocli', '--org_id', 'org-1',
|
|
'--agent_id', fixture.agentId, '--kid', 'kid-1',
|
|
'--private_key_file', privateKeyFile, '--token_file', tokenFile,
|
|
'--base_url', fixture.baseUrl,
|
|
], environment(fixture), fixture.projectDir);
|
|
assert.equal(install.code, 0, install.stderr);
|
|
const status = await runNode([cliPath, 'status'], environment(fixture), fixture.projectDir);
|
|
assert.equal(status.code, 0, status.stderr);
|
|
assert.match(status.stdout, /Kiro CLI \(kirocli\) \[installed\]/);
|
|
const uninstall = await runNode([
|
|
cliPath, 'uninstall', '--agent', 'kirocli', '--agent_id', fixture.agentId,
|
|
], environment(fixture), fixture.projectDir);
|
|
assert.equal(uninstall.code, 0, uninstall.stderr);
|
|
await assertMissing(fixture.v2Path);
|
|
await assertMissing(fixture.v3Path);
|
|
await assertMissing(fixture.agentDir);
|
|
} finally {
|
|
await fixture.close();
|
|
}
|
|
});
|