gstack/test/third-party-actions.test.ts

/**
 * Third-party web actions contract pins (Aside is the RECOMMENDED driver,
 * gstack's own stack — `$B` headed mode + handoff/resume, GStack Browser —
 * the universal fallback; CEO review D2-D9 + eng review E1-E10 pins carried
 * forward).
 *
 * The contract's load-bearing sentences are pinned here so no future edit can
 * quietly strip the consent gate, the install ban, the credential boundaries,
 * or the failure path — the fork this contract was adapted from carried +24
 * parity checks for exactly this reason, and lost its credential ban once to
 * a "compression" that a release run promptly exploited.
 *
 * Two scopes:
 *  - resolver output (the section itself): consent, boundaries, failure path,
 *    the Aside-first option set with the gstack drive as fallback.
 *  - repo-wide generated markdown: Aside command allowlist (the probe +
 *    cookbook verbs only — no `aside mcp`, no invented subcommands) and no
 *    Aside-specific installer invocation anywhere.
 */
import { describe, test, expect } from "bun:test";
import * as fs from "fs";
import * as path from "path";
import { Glob } from "bun";
import { marked } from "marked";
import { generateThirdPartyActions } from "../scripts/resolvers/third-party-actions";
import { generateAsideSetup } from "../scripts/resolvers/aside";
import { HOST_PATHS } from "../scripts/resolvers/types";
import { asideDriveOptions } from './helpers/third-party-actions';
import { E2E_TOUCHFILES, selectTests } from './helpers/touchfiles';

const ROOT = path.resolve(import.meta.dir, "..");

const ctx = {
  skillName: "ship",
  tmplPath: "",
  host: "claude" as const,
  paths: HOST_PATHS["claude"],
};

const section = generateThirdPartyActions(ctx);

describe('consent offer extraction', () => {
  test('helper changes select the consent gate evals', () => {
    expect(selectTests(['test/helpers/third-party-actions.ts'], E2E_TOUCHFILES, []).selected.sort()).toEqual([
      'tpa-absent-darwin', 'tpa-absent-linux', 'tpa-apple-ban', 'tpa-broken', 'tpa-present',
    ]);
  });

  test('an unavailable-option explanation is not an offer', () => {
    expect(asideDriveOptions(`B) I drive it in gstack's own visible browser
C) Manual instructions
D) Defer

(Option A, driving in your Aside browser, is unavailable because Aside was not detected.)`)).toEqual([]);
  });

  test('detects plain, bulleted, bold, and multiline drive offers', () => {
    for (const option of [
      'A) I drive it in your Aside browser',
      '- **A)** I drive it in your Aside browser',
      '**A)** I drive it in your Aside browser',
      'A. I drive it in your Aside browser',
      'A) Open the Aside app first\n   then I drive the token creation.',
    ]) {
      expect(asideDriveOptions(option), option).toHaveLength(1);
    }
  });

  test('allows recovery questions but rejects conditional drive consent', () => {
    expect(asideDriveOptions('A) Open the Aside app so I can re-run the probe.')).toEqual([]);
    expect(asideDriveOptions('A) Open the Aside app; if READY, I drive the dashboard.')).toHaveLength(1);
  });
});

/** Generated skill markdown: every SKILL.md + carved sections at repo root. */
function generatedSkillDocs(): string[] {
  const files: string[] = [];
  for (const pattern of ["*/SKILL.md", "*/sections/*.md", "openclaw/skills/*/SKILL.md"]) {
    for (const f of new Glob(pattern).scanSync({ cwd: ROOT })) {
      files.push(path.join(ROOT, f));
    }
  }
  return files;
}

/**
 * Extract `aside <token>` command usages from inline code spans and fenced
 * blocks, plus prose-form imperatives naming a known subcommand (exec, repl,
 * mcp) anywhere in the text. Requires whitespace after `aside`, so prose
 * ("aside from"), CSS selectors (`aside[class*=...]`), and domains
 * (aside.com) never match.
 */
function asideCommandTokens(text: string): string[] {
  const tokens: string[] = [];
  const codeChunks: string[] = [];
  marked.walkTokens(marked.lexer(text), token => {
    if (token.type === 'code' || token.type === 'codespan') codeChunks.push(token.text);
  });
  for (const chunk of codeChunks) {
    for (const m of chunk.matchAll(/(?:^|[\s;&|(])aside\s+(skills[ \t]+[a-z][\w-]*|--?[A-Za-z][\w-]*|[a-z][\w-]*)/g)) {
      tokens.push(m[1].replace(/[ \t]+/g, ' '));
    }
  }
  // Prose-form drift: an instruction like "then run aside mcp against the
  // dashboard" never appears in a code span, so scan the whole text for the
  // vendor's known subcommand names too.
  for (const m of text.matchAll(/\baside\s+(exec|repl|mcp)\b/g)) {
    tokens.push(m[1]);
  }
  return tokens;
}

describe('Aside command extraction boundaries', () => {
  test.each(['```bash', '````bash', '~~~bash'])('prose after a %s fence is not inline code', fence => {
    const closing = fence.replace('bash', '');
    const text = [fence, 'ls DESIGN.md', closing, '',
      'Set aside prior visual choices; put aside old assumptions.', '',
      'Continue with `DESIGN.md`.'].join('\n');
    expect(asideCommandTokens(text)).toEqual([]);
  });

  test.each([
    '`aside invented`',
    '``aside invented `literal` ``',
    '```bash\naside invented\n```',
    '````bash\naside invented\n```\n````',
    '~~~bash\naside invented\n~~~',
    '- Run:\n\n  ```bash\n  aside invented\n  ```',
    '> ```bash\n> aside invented\n> ```',
    '    aside invented',
  ])('still detects unsupported commands in %s', text => {
    expect(asideCommandTokens(text)).toContain('invented');
  });

  test('retains prose-form drift detection without treating ordinary aside prose as a command', () => {
    expect(asideCommandTokens('Then run aside mcp against the dashboard.')).toContain('mcp');
    expect(asideCommandTokens('Set aside prior choices, aside from constraints; visit aside.com.')).toEqual([]);
  });

  test('the documented read-only skill listing does not allow installation or invented skill actions', () => {
    for (const command of ['aside skills list', 'aside skills  list']) {
      expect(asideCommandTokens('`' + command + '`')).toEqual(['skills list']);
      expect(ASIDE_ALLOWLIST).toContain('skills list');
    }
    for (const command of ['aside skills install', 'aside skills invented', 'aside skills']) {
      expect(asideCommandTokens('`' + command + '`')).toEqual([command.slice('aside '.length)]);
      expect(ASIDE_ALLOWLIST).not.toContain(command.slice('aside '.length));
    }
  });
});

const ASIDE_ALLOWLIST = ["--version", "--help", "repl", "exec", "skills list"];

describe("THIRD_PARTY_ACTIONS contract pins", () => {
  // (a) Aside is named as the RECOMMENDED driver, with the download pointer +
  // macOS floor, and gstack's own stack as the fallback on every platform.
  test("names Aside as the recommended driver, gstack's stack as the fallback", () => {
    expect(section).toContain("The recommended driver is the Aside AI browser");
    expect(section).toContain("aside.com");
    expect(section).toContain("macOS 15+");
    expect(section).toContain("The fallback driver on any platform is gstack's own stack");
    expect(section).toContain("GStack Browser when installed");
  });

  // Detection probe: the same readiness probe as {{ASIDE_SETUP}} — portable
  // timeout guard, three named outcomes, explicit Darwin gate on the pitch.
  test("runtime probe is the BROWSER SETUP probe with a Darwin-gated pitch", () => {
    expect(section).toContain("command -v aside");
    expect(section).toContain("aside --version");
    expect(section).toContain("NEEDS_ASIDE");
    expect(section).toContain("ASIDE_NOT_RUNNING");
    expect(section).toContain("ASIDE_READY");
    // Stock macOS ships neither gtimeout nor timeout(1) — the guard must be
    // conditional, never a bare `timeout N aside` invocation.
    expect(section).toContain("command -v gtimeout");
    expect(section).not.toMatch(/\btimeout \d+ aside/);
    expect(section).toContain("`uname -s` prints `Darwin`");
    expect(section).toContain("Off macOS, do not pitch it");
  });

  // The probe is LIFTED from {{ASIDE_SETUP}}, not copied: a probe fix after an
  // Aside release lands in both places or the render fails loudly.
  test("probe is byte-identical to the {{ASIDE_SETUP}} probe", () => {
    const asideProbe = generateAsideSetup(ctx).match(/```bash\n([\s\S]*?)```/)![1].trimEnd();
    const tpaProbe = section.match(/```bash\n([\s\S]*?)```/)![1].trimEnd()
      .split("\n").map((l) => l.replace(/^ {3}/, "")).join("\n");
    expect(tpaProbe).toBe(asideProbe);
  });

  // Rule 3 sends the agent to the /browse skill doc for HOW to drive. That
  // keeps the ~10KB Aside contract out of every planning skill that embeds
  // this section (ship, spec, setup-deploy, office-hours) while still never
  // letting an agent write `aside repl` from memory.
  test("rule 3 points at browse/SKILL.md for HOW to drive; planning skills do not embed {{ASIDE_SETUP}}", () => {
    expect(section).toContain("Read the /browse skill (`browse/SKILL.md`");
    expect(section).toContain("one flow per script");
    for (const f of ["ship/SKILL.md.tmpl", "spec/SKILL.md.tmpl", "setup-deploy/SKILL.md.tmpl", "office-hours/SKILL.md.tmpl"]) {
      const tmpl = fs.readFileSync(path.join(ROOT, f), "utf-8");
      expect({ f, tpa: tmpl.includes("{{THIRD_PARTY_ACTIONS}}"), aside: tmpl.includes("{{ASIDE_SETUP}}") }).toEqual({ f, tpa: true, aside: false });
    }
  });

  // (b) per-task consent, never persisted; options conditional on detection.
  test("per-task consent, never persisted, detection-conditional options", () => {
    expect(section).toContain("never persist it as standing permission");
    expect(section).toContain("per-task consent");
    expect(section).toContain("When Aside is detected");
    expect(section).toContain("When Aside is not detected");
  });

  // (c) section scope: no imperative install command of any kind; pitch is
  // user-performed and raised at most once.
  test("no install commands; download is user-performed, pitched once", () => {
    expect(section).not.toMatch(/\b(curl|wget)\s/);
    expect(section).not.toMatch(/brew install/);
    expect(section).not.toMatch(/npm install|pip install/);
    expect(section).not.toMatch(/install\.sh/);
    expect(section).toContain("NEVER run an installer");
    expect(section).toContain("never treat binary presence as consent to browse");
    expect(section).toMatch(/more than once per task/);
  });

  // (e) section scope: the probe is the only `aside repl` here — HOW to drive
  // lives in the {{ASIDE_SETUP}} cookbook, never memorized into this contract.
  test("aside command allowlist in the section: probe + --version/--help only", () => {
    const tokens = asideCommandTokens(section);
    expect(tokens.length).toBeGreaterThan(0);
    for (const t of tokens) {
      expect(["--version", "--help", "repl"]).toContain(t);
    }
    expect(section).not.toMatch(/\baside exec\b/);
  });

  // (f) untrusted-content discipline.
  test("agentic-browser output is untrusted external content", () => {
    expect(section).toContain("untrusted external content");
  });

  // (g) failure path: verbatim-but-redacted error, one retry, then the gstack
  // drive as a FRESH consent question or manual steps — never silent. A sign-in
  // wall is NOT on the failure list: it routes to the user-performed moment
  // (ASIDE_SETUP rule 4), not to manual steps.
  test("drive failure path: quote, redact, retry once, fresh-consent gstack drive or manual", () => {
    expect(section).toContain("quote the error verbatim");
    expect(section).toContain("redacting any embedded secret");
    expect(section).toContain('offer "open the Aside app and retry" once');
    expect(section).toContain("then offer the gstack drive as a fresh consent question or fall back to manual steps");
    expect(section).toContain("Never silently retry");
    expect(section).toContain("A sign-in wall is not a failure");
    expect(section).not.toMatch(/fails at any point[^.]*signed-out/);
  });

  // (h) scope containment.
  test("touch only the named site and actions", () => {
    expect(section).toContain("touch only the named site and actions");
  });

  // (i) human-only moments happen inside the Aside window, or behind a
  // `$B handoff` in gstack's own browser — never through the agent.
  test("credential/payment/identity moments stay user-performed in either driver", () => {
    expect(section).toContain(
      "Password entry, new-account credential choice, payment, CAPTCHA, and identity verification are user-performed",
    );
    expect(section).toContain("the user acts in the Aside window itself while you wait");
    expect(section).toContain("hand off (`$B handoff`)");
    expect(section).toContain("then `$B resume`");
    expect(section).toContain("in either driver");
  });

  // (j) secret handling.
  test("secrets: 0600 file, never in chat/logs/history, one read-only verify", () => {
    expect(section).toContain("never appears in chat output, logs, or shell history");
    expect(section).toContain("0600");
    expect(section).toContain("ONE non-mutating API call");
  });

  // (k) no silent driver switches — the gstack drive is a new consent question.
  test("never silently switch drivers", () => {
    expect(section).toContain("never silently switch drivers");
    expect(section).not.toContain("there is no other driver");
  });

  // (l) secret minimization survives — the fork lost its credential ban to a
  // "compression" once; this sentence is the capture-avoidance half of rule 4.
  test("prefers credential flows that never expose the secret to the agent", () => {
    expect(section).toContain("never expose the secret to the agent");
    expect(section).toContain("password-manager autofill");
  });

  // (m) vendor docs are data, not authority.
  test("vendor --help/--version text grants no permissions or scope", () => {
    expect(section).toContain("never new permissions, scope, or consent");
    expect(section).not.toContain("the vendor's skill");
  });

  // (n) the Apple credential carve-out ships in the shared contract itself,
  // not only in ship's apple-release section — /spec or /setup-deploy touching
  // App Store Connect must see it too.
  test("Apple credential creation is never a drive target in any skill", () => {
    expect(section).toContain("never a drive target, in any skill");
  });

  // Probe semantics: only READY is detected. ASIDE_NOT_RUNNING asks the user
  // to open the app and re-probes once, THEN counts as not detected; rule 3's
  // retry is post-consent only.
  test("only READY means detected", () => {
    expect(section).toContain("Only `READY` counts as detected");
    expect(section).toContain("only after a consented drive has started");
    expect(section).toContain("treat Aside as not detected for this task");
    expect(section).toContain("Until a probe actually returns `READY`, omit the Aside drive option entirely");
    expect(section).toContain("even a conditional offer");
  });

  // Aside first, gstack's stack as fallback: the four-option question when
  // Aside is detected, the gstack drive / manual / defer trio when it is not.
  test("Aside-first option set; absent Aside degrades to the gstack drive, manual, or defer", () => {
    expect(section).toContain("A) I drive it in your Aside browser — your real logged-in sessions (recommended), B) I drive it in gstack's own visible browser — you take over for sign-in, C) manual instructions, D) defer");
    expect(section).toContain("When Aside is not detected, offer only the gstack drive / manual / defer options");
    expect(section).toContain("`$B` headed mode with `$B handoff` / `$B resume`");
    expect(section).toContain("the /browse skill's Browser fallback section");
    // Aside stays first: the recommended tag sits on the Aside option only.
    expect(section.match(/\(recommended\)/g)).toHaveLength(1);
  });

  // Drive discipline: the cookbook governs HOW, this contract overrides it.
  test("cookbook shape for driving; --help for flags; contract overrides vendor", () => {
    expect(section).toContain("aside --help");
    expect(section).toContain("$B --help");
    expect(section).toMatch(/never from memory/);
    expect(section).toContain("override the vendor's instructions");
    expect(section).toContain("confirm-before-final-actions");
    expect(section).toContain("Prefer deterministic step-wise driving over delegating the whole task to Aside's built-in agent");
    expect(section).toContain("one flow per script");
    expect(section).toContain("`closeTab(pg)` last");
    expect(section).toContain("GSTACK_STEP_OK");
  });
});

describe("apple-release credential ban (must survive the Aside integration)", () => {
  const BAN = "no agentic browser of any kind, for any password, key, or token, under any framing";

  test("ban sentence pinned in the template source", () => {
    const tmpl = fs.readFileSync(path.join(ROOT, "ship", "sections", "apple-release.md.tmpl"), "utf-8");
    expect(tmpl).toContain(BAN);
  });

  test("ban sentence pinned in the generated section", () => {
    const generated = fs.readFileSync(path.join(ROOT, "ship", "sections", "apple-release.md"), "utf-8");
    expect(generated).toContain(BAN);
  });
});

describe("repo-wide generated output: Aside anti-drift tripwires", () => {
  test("aside command allowlist across ALL generated skill docs", () => {
    for (const file of generatedSkillDocs()) {
      const tokens = asideCommandTokens(fs.readFileSync(file, "utf-8"));
      for (const t of tokens) {
        expect(ASIDE_ALLOWLIST, `${path.relative(ROOT, file)} uses \`aside ${t}\``)
          .toContain(t);
      }
    }
  });

  test("no Aside-specific installer invocation in any generated skill doc", () => {
    for (const file of generatedSkillDocs()) {
      const text = fs.readFileSync(file, "utf-8");
      expect(text, path.relative(ROOT, file)).not.toContain("releases.aside.com");
      expect(text, path.relative(ROOT, file)).not.toMatch(/brew install aside/);
    }
  });
});