mirrors / wshobson--agents

项目文件夹

文件

T

tommylauren 120dc3ad6f test(protect-mcp): add test/ fixtures and round-trip verification

Follow-up to #484 closing the test-plan commitment. Adds a
plugins/protect-mcp/test/ directory with:

  - Six deterministic fixtures covering PreToolUse (allow + deny paths
    on Read / Bash safe / Bash destructive / Write) and PostToolUse
    (receipt signing input)
  - A Cedar test policy exercising both permit and forbid semantics
  - An expected receipt-schema.json (JSON Schema draft-07) pinned to
    draft-farley-acta-signed-receipts required fields
  - run-tests.sh: full round-trip, requires node >= 18 and python3.
    Eight tests covering evaluate (permit/forbid exit codes), sign
    (receipt file produced), schema conformance, verify (valid + tamper
    detection).
  - verify-fixtures.sh: static fixture validation, python3 only, safe
    to run in sandboxed CI without network access.
  - README.md explaining the layout, how to run, and the exit-code
    convention (including 77 = autotools "skip" for missing tools).

The critical regression guard is test 8: flipping the `decision` field
in a signed receipt MUST invalidate the Ed25519 signature, so
`@veritasacta/verify` MUST exit 1. This locks in the tamper-detection
property that the plugin claims.

No changes to the plugin itself. No new runtime dependencies. No
changes to marketplace.json or hooks.json.

2026-04-17 10:20:24 -04:00

11 行

169 B

JSON

原始文件 永久链接 Blame 文件历史

 {
   "tool_name": "Bash",
   "tool_input": {
     "command": "git status"
   },
   "session_id": "test-session-allow-bash",
   "context": {
     "command_pattern": "git"
   }
 }