113 lines
5.0 KiB
TypeScript
113 lines
5.0 KiB
TypeScript
import { describe, it, expect, vi } from 'vitest';
|
|
import { executeToolCall } from '../src/tool-executor.js';
|
|
import { LoopGuard } from '../src/loop-guard.js';
|
|
import { HookRegistry } from '../src/hooks.js';
|
|
import type { ToolDefinition } from '../src/tools.js';
|
|
|
|
/**
|
|
* SEC-GATE — defense-in-depth critical floor (tool-executor.ts step 4b).
|
|
*
|
|
* The confirmation-bypass let a spawn path constructed with `hooks: undefined`
|
|
* execute CRITICAL_NEVER_AUTOPASS commands (rm -rf ~, sudo, git push --force
|
|
* main, delete_skill, …) with no gate. These tests prove `executeToolCall`
|
|
* now fail-closes such ops when no approval mechanism is present, and still
|
|
* lets them through when an approval gate/hook is wired.
|
|
*
|
|
* WITHOUT the fix, every "denied" case below would EXECUTE the tool (the old
|
|
* behaviour: no hooks ⇒ skip all gate logic), so these tests fail pre-fix.
|
|
*/
|
|
|
|
function tool(name: string, output: string, spy?: () => void): ToolDefinition {
|
|
return {
|
|
name,
|
|
description: `test tool ${name}`,
|
|
parameters: { type: 'object', properties: {} },
|
|
execute: async () => { spy?.(); return output; },
|
|
} as unknown as ToolDefinition;
|
|
}
|
|
|
|
function call(name: string, args: Record<string, unknown> = {}) {
|
|
return { id: 'call_1', function: { name, arguments: JSON.stringify(args) } };
|
|
}
|
|
|
|
const CRITICAL_BASH = { command: 'rm -rf ~' };
|
|
const CRITICAL_FORCE_PUSH = { command: 'git push --force origin main' };
|
|
|
|
describe('tool-executor critical-destructive hard floor (SEC-GATE step 4b)', () => {
|
|
it('DENIES a critical bash command when no hook and no approval callback are wired', async () => {
|
|
const spy = vi.fn();
|
|
const toolMap = new Map([['bash', tool('bash', 'BASH_RAN', spy)]]);
|
|
const r = await executeToolCall(call('bash', CRITICAL_BASH), { toolMap, guard: new LoopGuard() });
|
|
expect(r.content).toContain('[BLOCKED]');
|
|
expect(r.countedAsUsed).toBe(false);
|
|
expect(spy).not.toHaveBeenCalled(); // tool never executed
|
|
});
|
|
|
|
it('DENIES a force-push to main with no gate', async () => {
|
|
const spy = vi.fn();
|
|
const toolMap = new Map([['bash', tool('bash', 'BASH_RAN', spy)]]);
|
|
const r = await executeToolCall(call('bash', CRITICAL_FORCE_PUSH), { toolMap, guard: new LoopGuard() });
|
|
expect(r.content).toContain('[BLOCKED]');
|
|
expect(spy).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it('DENIES delete_skill (critical regardless of args) with no gate', async () => {
|
|
const spy = vi.fn();
|
|
const toolMap = new Map([['delete_skill', tool('delete_skill', 'DELETED', spy)]]);
|
|
const r = await executeToolCall(call('delete_skill', { name: 'x' }), { toolMap, guard: new LoopGuard() });
|
|
expect(r.content).toContain('[BLOCKED]');
|
|
expect(spy).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it('ALLOWS a critical command when a pre:tool approval hook is wired (main-loop path)', async () => {
|
|
const spy = vi.fn();
|
|
const toolMap = new Map([['bash', tool('bash', 'BASH_RAN', spy)]]);
|
|
const hooks = new HookRegistry();
|
|
hooks.on('pre:tool', () => { /* approve — no cancel */ });
|
|
const r = await executeToolCall(call('bash', CRITICAL_BASH), { toolMap, guard: new LoopGuard(), hooks });
|
|
expect(r.content).toContain('BASH_RAN');
|
|
expect(r.countedAsUsed).toBe(true);
|
|
expect(spy).toHaveBeenCalledOnce();
|
|
});
|
|
|
|
it('still lets the pre:tool hook DENY a critical command (hook cancel wins)', async () => {
|
|
const spy = vi.fn();
|
|
const toolMap = new Map([['bash', tool('bash', 'BASH_RAN', spy)]]);
|
|
const hooks = new HookRegistry();
|
|
hooks.on('pre:tool', () => ({ cancel: true, reason: 'user denied' }));
|
|
const r = await executeToolCall(call('bash', CRITICAL_BASH), { toolMap, guard: new LoopGuard(), hooks });
|
|
expect(r.content).toContain('[BLOCKED]');
|
|
expect(r.content).toContain('user denied');
|
|
expect(spy).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it('ALLOWS a critical command when confirmCriticalAction approves (no hook)', async () => {
|
|
const spy = vi.fn();
|
|
const toolMap = new Map([['bash', tool('bash', 'BASH_RAN', spy)]]);
|
|
const r = await executeToolCall(call('bash', CRITICAL_BASH), {
|
|
toolMap, guard: new LoopGuard(), confirmCriticalAction: async () => true,
|
|
});
|
|
expect(r.content).toContain('BASH_RAN');
|
|
expect(spy).toHaveBeenCalledOnce();
|
|
});
|
|
|
|
it('DENIES a critical command when confirmCriticalAction rejects (no hook)', async () => {
|
|
const spy = vi.fn();
|
|
const toolMap = new Map([['bash', tool('bash', 'BASH_RAN', spy)]]);
|
|
const r = await executeToolCall(call('bash', CRITICAL_BASH), {
|
|
toolMap, guard: new LoopGuard(), confirmCriticalAction: async () => false,
|
|
});
|
|
expect(r.content).toContain('[BLOCKED]');
|
|
expect(spy).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it('does NOT block non-critical commands with no gate (floor is surgical)', async () => {
|
|
const spy = vi.fn();
|
|
const toolMap = new Map([['bash', tool('bash', 'LISTING', spy)]]);
|
|
const r = await executeToolCall(call('bash', { command: 'ls -la' }), { toolMap, guard: new LoopGuard() });
|
|
expect(r.content).toContain('LISTING');
|
|
expect(r.countedAsUsed).toBe(true);
|
|
expect(spy).toHaveBeenCalledOnce();
|
|
});
|
|
});
|