CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-11 07:29:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

test: consent-gate E2E suite + functional fs-capability probes

Browse Source 
Five hermetic gate-tier E2E cases (tpa-present / absent-linux / broken /
absent-darwin / apple-ban) drive the real contract section through
claude -p with PATH shims for aside and uname; the absent cases filter
any REAL aside binary out of the child PATH and assert absence with
Bun.which before spawning, so dev machines cannot leak into detection.
Registered per-case in E2E_TOUCHFILES/E2E_TIERS with template-level
deps (ship/SKILL.md.tmpl, gen-skill-docs.ts) and added to the evals.yml
matrix with tier: gate. eval:bg:periodic's detach timeout rises to
36000s for the grown periodic shard census (floor-enforced by
test/eval-detach-timeout-floor.test.ts); CLAUDE.md doc updated to match.

test/helpers/fs-caps.ts adds canRevokeWrites/canRevokeReads functional
probes; 13 chmod-based tests swap their uid-0-only guards for the
probes so suites skip honestly on CAP_DAC_OVERRIDE containers (this
sandbox: uid 1000 with full caps) instead of asserting revocations the
kernel ignores. path-validation's symlink test targets /etc/passwd
(exists everywhere; /etc/crontab is absent on Amazon Linux).
This commit is contained in:
Garry Tan
2026-08-28 04:47:50 +00:00
parent ade441afd0
commit 0873fce89a
21 changed files with 375 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/brain-sync.test.ts
+4 -3
View File
@@ -23,6 +23,7 @@ import * as fs from 'fs';
import * as path from 'path';
import * as os from 'os';
import { spawnSync } from 'child_process';
import { canRevokeWrites } from './helpers/fs-caps';
const ROOT = path.resolve(import.meta.dir, '..');
const BIN = path.join(ROOT, 'bin');
@@ -371,7 +372,7 @@ describe('gstack-brain-sync secret scan', () => {
// ---------------------------------------------------------------
describe('gstack-brain-sync egress receipt gate', () => {
test('refused receipt leaves the queue intact, makes no commit, and next run retries', () => {
if (process.platform === 'win32' || process.getuid?.() === 0) return; // chmod is advisory there
if (!canRevokeWrites()) return; // chmod is advisory here (win32, root, DAC-override containers)
run(['gstack-artifacts-init', '--remote', bareRemote]);
run(['gstack-config', 'set', 'artifacts_sync_mode', 'full']);
fs.mkdirSync(path.join(tmpHome, 'projects', 'p'), { recursive: true });
@@ -624,7 +625,7 @@ describe('#2549 queue integrity', () => {
});
test('receipt refusal at the detector skips the retry without wedging the drain', () => {
if (process.platform === 'win32' || process.getuid?.() === 0) return; // chmod advisory there
if (!canRevokeWrites()) return; // chmod is advisory here (win32, root, DAC-override containers)
initWithMode('full');
fs.mkdirSync(path.join(tmpHome, 'projects', 'p'), { recursive: true });
fs.writeFileSync(path.join(tmpHome, 'projects/p/learnings.jsonl'), '{"skill":"a","ts":"2026-01-01T00:00:00Z"}\n');
@@ -792,7 +793,7 @@ describe('C12 spool queue', () => {
});
test('at-least-once: a drain that fails before finalize leaves every spool file for the next run', () => {
if (process.platform === 'win32' || process.getuid?.() === 0) return; // chmod advisory there
if (!canRevokeWrites()) return; // chmod is advisory here (win32, root, DAC-override containers)
initWithMode('full');
fs.mkdirSync(path.join(tmpHome, 'projects', 'p'), { recursive: true });
fs.mkdirSync(path.join(tmpHome, 'retros'), { recursive: true });