Files
gstack/browse/test/bun-polyfill.test.ts
T
Garry TanandClaude Fable 5 c86e6472eb v1.67.1.0 fix: external-contributor security sweep — 6 findings hardened, regression-pinned (#2605)
* fix(redact): block real all-caps URL passwords, not just shape-match

urlPasswordIsPlaceholder skipped any password matching /^[A-Z][A-Z0-9_]*$/,
so a real DSN like postgres://admin:PROD2026SECRET@db-prod.internal/app slipped
the HIGH pre-push block. Replace the shape rule with an anchored, exact-match
set of doc-convention placeholder tokens (PASSWORD, PASS, CHANGEME, ...),
compared case-sensitively and never as a substring (PROD2026SECRET must not
match SECRET). The USER:PASSWORD doc convention still suppresses; real all-caps
and lowercase passwords block. Regression cases pinned both directions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(browse): write self-contained .gstack/.gitignore unconditionally

ensureStateDir only appended .gstack/ to the project .gitignore when that file
already existed, skipped silently on ENOENT, and swallowed other append
failures. With BROWSE_PERSIST_STATE=1, session-state.json (live cookies +
localStorage/sessionStorage tokens) and browse-network.log / browse-audit.jsonl
(request headers) then sat git-add-able under <git-root>/.gstack/. Write a
self-contained <stateDir>/.gitignore containing "*" unconditionally, before
return, so the state dir's contents can never be committed regardless of the
project .gitignore. The project-.gitignore append is kept as redundant safety.

The no-import-side-effects guard is relaxed to allow exactly this lone
.gitignore guard file (still fails on browse.json / session-state.json / logs /
listener binds) — the guard is written eagerly by ensureStateDir at import and
is not leaked state.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(browse): restore Bun.spawn exited/drain/OOM-cap contract on Node polyfill

The v1.65 fork-port squash silently dropped the `exited` promise, eager
stdout/stderr drain, and 16MB GSTACK_SPAWN_MAX_BUFFER cap that v1.64 added
(#2571), plus the five tests pinning them. On the Windows Node fallback,
`await proc.exited` then resolved to undefined immediately — cookie-import,
isBrowserRunning, and browser-skill children all read stdout before the child
produced it, a silent failure. Re-land the block (keeping v1.65's windowsHide
comment improvements) and re-add the pinning tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ios-qa): compile the private-API touch bridge out of Release builds

PR #2264 claimed DebugBridgeTouch.m (KIF-derived in-process touch synthesis
using private UIKit/IOKit symbols: _touchesEvent, IOHIDEventCreateDigitizer*,
_AXSSetAutomationEnabled) was "compiled out in Release," but the body was gated
only by TARGET_OS_IOS, so a Release iOS build carried the private symbols (App
Store rejection risk). The safety half of the fix (closed PR #2269) never
landed. Gate the body on `#if TARGET_OS_IOS && DEBUG` and add the cSettings
DEBUG define to the DebugBridgeTouch target so `#if DEBUG` is true in debug and
false in release (mirrors the Core/UI swiftSettings). A free static tripwire
pins both halves; the nm/strings symbol proof needs an iOS-SDK build and belongs
in the device/periodic tier.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(egress): state truncation/deletion of the ledger are out of scope

gstack-egress verify catches in-place edits, reordering, and mid-chain deletion
(the hash chain breaks) but not tail-truncation, whole-file re-fabrication, or
deletion — a same-user local actor who owns the ledger defeats those and verify
still exits 0. That matches the stated threat model (forensic observability, not
an exfiltration control). Document it in the header threat model and the usage
text rather than adding a count-sidecar, which would false-positive on every
legitimate rotation and barely raise the bar. Head-anchoring stays the tracked
rotation TODO in lib/egress-receipt.ts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ship): scope the App Store Connect key to one app and disclose it at exit

The release flow minted a non-expiring APP_MANAGER key with allAppsVisible:true
(standing authority over every app on the team) and was told never to mention
any credential to the user, so the durable key never reached their revocation
checklist. Scope the key to the app being released via the apps relationship
(allAppsVisible:false + an explicit apps association — required, since a
no-app key can see nothing and uploads fail), and disclose the key once in the
closing report with its ASC revocation path. Carve the exit disclosure as the
explicit exception to the mid-run no-credential-talk rule so the
one-authorization-moment contract still holds. Edited the .tmpl source and
regenerated the section.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* harden(browse): constant-time bearer-token comparison in validateAuth

The loopback auth check compared the Authorization header with `===`, whose
byte-by-byte early exit leaks the token prefix through response timing. Use
crypto.timingSafeEqual with a length gate (the length is not secret). Behavior
is unchanged for valid/invalid tokens; auth tests unaffected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test: pin the security-property regression guards from pre-landing review

The pre-landing review found the fixes were correct but three regression guards
were missing — each pins a property whose silent revert would keep behavior
identical while reopening the hole:
- validateAuth: a static tripwire asserting crypto.timingSafeEqual + the
  got.length===want.length gate + the null-header guard (a revert to `===`
  keeps accept/reject green but restores the timing side-channel).
- redact: a table-driven loop over the exported URL_PASSWORD_PLACEHOLDER_WORDS
  so a typo or dropped entry can't silently start blocking a doc placeholder;
  plus a substring-can't-rescue-a-real-secret assertion.
- config: assert the self-contained .gitignore is written even when git already
  ignores .gstack/, proving the write precedes the isIgnoredByGit early return.
- bun-polyfill: cover the 128+signal exit branch (POSIX only).

URL_PASSWORD_PLACEHOLDER_WORDS is exported so the table test can't drift.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore: bump version and changelog (v1.66.2.0)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs: sync egress-verify scope and layered iOS Release guard into user docs

ARCHITECTURE.md and README.md now carry the same gstack-egress verify
scope disclosure the CLI ships (edits/reordering/mid-chain deletion
detected; tail-truncation and ledger deletion out of scope for a
forensic log). docs/howto-ios-testing-with-gstack.md documents the
second Release-build guard: DebugBridgeTouch.m compiles out behind
#if TARGET_OS_IOS && DEBUG via the cSettings DEBUG define.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(ios-qa): call the DebugBridge targets SwiftPM targets, not Swift targets

DebugBridgeTouch is Objective-C (the same sentence says so); "Swift
targets" was the wrong word. Cross-model doc review catch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(changelog): describe the all-caps DSN examples without a scannable URL shape

The v1.66.2.0 entry quoted its own headline fix as three literal
postgres://user:PASSWORD@host examples — which the branch's stricter HIGH
gate now correctly flags, failing CI's quality scan on this very PR (the
local pre-push hook passed because the installed gstack still runs the old
engine). Rewrite the three mentions: the reproduce command uses a
fully-braced shell interpolation (suppressed in the diff scan by design,
expands to the real all-caps password at runtime, still exits 3 — verified),
and the table row + Fixed bullet name the password token without the URL
shape. Gate scan on the amended diff: 0 high.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ci(evals): pre-seed one-time preamble markers for PTY smokes

Root cause of the documented intermittent scope-gate-question-NOT-observed
failure (test/skill-e2e-plan-mode-no-op.test.ts, also PR #2593 rounds 3/11):
on a fresh runner every one-time preamble marker is missing, so each PTY
child runs first-run feature discovery before the behavior under test, and
touching .feature-prompted-model-overlay under ~/.claude/skills/gstack/
trips Claude Code's sensitive-file permission prompt — the run stalls on
that dialog (classified outcome=asked) and the scope gate never renders.
Dev machines never reproduce it because the operator's markers exist.

Seed ~/.gstack one-time markers (.activated, .first-loop-tip-shown,
.telemetry-prompted, .proactive-prompted, .completeness-intro-seen,
.plan-tune-nudge-shown) and both .feature-prompted-* markers (via the
gstack root symlink into the checkout) in the PTY-smoke registration step,
so no first-run prompt can preempt the assertion under test.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore: re-version release as v1.67.1.0

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: restore main's dependency manifest clobbered by the merge resolution

The v1.67.0.0 merge resolved the package.json conflict wholesale --ours,
which kept this branch's version stamp but erased main's dependency work
(playwright 1.58->1.62 + its patchedDependencies entry, transformers 4.1->4.2,
cross-spawn added, puppeteer-core removed — which is also why main dropped the
basic-ftp pin test: the pinned package left the tree with it — marked/socks
bumps, adm-zip override) while bun.lock auto-merged to main's side. Every CI
job that runs `bun install --frozen-lockfile` failed on the mismatch
(check-freshness, quality, free-tests, gate, windows x2).

Take main's package.json + bun.lock verbatim, re-stamp the version through
gstack-version-bump (1.67.1.0). bun.lock is now byte-identical to main's;
frozen install verified locally; full free suite green for the branch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-17 07:50:37 -07:00

265 lines
12 KiB
TypeScript

import { describe, test, expect, afterAll, setDefaultTimeout } from 'bun:test';
import * as path from 'path';
// Every test here spawnSync's a `node` child; Windows CI cold-start (AV scan,
// first-touch of node.exe) alone can blow bun's 5s default — observed 5,007ms
// on a 50ms sleep test. Subprocess budget, not assertion looseness.
setDefaultTimeout(20_000);
// Load the polyfill into a fresh object (don't clobber globalThis.Bun)
const polyfillPath = path.resolve(import.meta.dir, '../src/bun-polyfill.cjs');
describe('bun-polyfill', () => {
// We test the polyfill by requiring it in a subprocess under Node.js
// since it's designed for Node, not Bun.
test('Bun.sleep resolves after delay', async () => {
const result = Bun.spawnSync(['node', '-e', `
require(${JSON.stringify(polyfillPath)});
(async () => {
const start = Date.now();
await Bun.sleep(50);
const elapsed = Date.now() - start;
console.log(elapsed >= 40 ? 'OK' : 'TOO_FAST');
})();
`], { stdout: 'pipe', stderr: 'pipe' });
expect(result.stdout.toString().trim()).toBe('OK');
expect(result.exitCode).toBe(0);
});
test('Bun.spawnSync runs a command and returns stdout', () => {
const result = Bun.spawnSync(['node', '-e', `
require(${JSON.stringify(polyfillPath)});
const r = Bun.spawnSync(['echo', 'hello'], { stdout: 'pipe' });
console.log(r.stdout.toString().trim());
console.log('exit:' + r.exitCode);
`], { stdout: 'pipe', stderr: 'pipe' });
const lines = result.stdout.toString().trim().split('\n');
expect(lines[0]).toBe('hello');
expect(lines[1]).toBe('exit:0');
});
test('Bun.spawn launches a process with pid', async () => {
const result = Bun.spawnSync(['node', '-e', `
require(${JSON.stringify(polyfillPath)});
const p = Bun.spawn(['echo', 'test'], { stdio: ['pipe', 'pipe', 'pipe'] });
console.log(typeof p.pid === 'number' ? 'HAS_PID' : 'NO_PID');
console.log(typeof p.kill === 'function' ? 'HAS_KILL' : 'NO_KILL');
console.log(typeof p.unref === 'function' ? 'HAS_UNREF' : 'NO_UNREF');
`], { stdout: 'pipe', stderr: 'pipe' });
const lines = result.stdout.toString().trim().split('\n');
expect(lines[0]).toBe('HAS_PID');
expect(lines[1]).toBe('HAS_KILL');
expect(lines[2]).toBe('HAS_UNREF');
});
// Bun.spawn parity: `proc.exited` is a Promise resolving to the exit code.
// The DPAPI helper and isBrowserRunning both `await proc.exited`; without
// it the awaits resolve immediately to `undefined` and the caller reads
// stdout before the child has produced it — surfacing as a silent failure.
test('Bun.spawn exposes proc.exited that resolves to the exit code', async () => {
const result = Bun.spawnSync(['node', '-e', `
require(${JSON.stringify(polyfillPath)});
(async () => {
const p = Bun.spawn(['node', '-e', 'process.exit(0)'], { stdio: ['ignore', 'ignore', 'ignore'] });
console.log(typeof p.exited === 'object' && typeof p.exited.then === 'function' ? 'IS_PROMISE' : 'NOT_PROMISE');
console.log('exit:' + await p.exited);
})();
`], { stdout: 'pipe', stderr: 'pipe' });
const lines = result.stdout.toString().trim().split('\n');
expect(lines[0]).toBe('IS_PROMISE');
expect(lines[1]).toBe('exit:0');
});
test('Bun.spawn proc.exited reflects non-zero exit codes', async () => {
const result = Bun.spawnSync(['node', '-e', `
require(${JSON.stringify(polyfillPath)});
(async () => {
const p = Bun.spawn(['node', '-e', 'process.exit(3)'], { stdio: ['ignore', 'ignore', 'ignore'] });
console.log('exit:' + await p.exited);
})();
`], { stdout: 'pipe', stderr: 'pipe' });
expect(result.stdout.toString().trim()).toBe('exit:3');
});
test('Bun.spawn proc.exited resolves before reading stdout (no race)', async () => {
const result = Bun.spawnSync(['node', '-e', `
require(${JSON.stringify(polyfillPath)});
(async () => {
// Real-world pattern: write to stdout, then exit. Awaiting proc.exited
// before reading must guarantee the bytes are flushed.
const p = Bun.spawn(['node', '-e', 'process.stdout.write("ready"); process.exit(0)'], {
stdio: ['ignore', 'pipe', 'ignore']
});
const code = await p.exited;
const out = await new Response(p.stdout).text();
console.log(out + ':' + code);
})();
`], { stdout: 'pipe', stderr: 'pipe' });
expect(result.stdout.toString().trim()).toBe('ready:0');
});
// Spawn-failure case: Node emits 'error' but not 'exit' when the binary
// is missing, so listening only for 'exit' hangs `await proc.exited`
// forever. The lifecycle promise must resolve on either event.
test('Bun.spawn proc.exited resolves on spawn failure (missing binary)', async () => {
const result = Bun.spawnSync(['node', '-e', `
require(${JSON.stringify(polyfillPath)});
(async () => {
const p = Bun.spawn(['this-binary-does-not-exist-zzz-' + Date.now()], {
stdio: ['ignore', 'pipe', 'pipe']
});
const code = await Promise.race([
p.exited,
new Promise((_, r) => setTimeout(() => r(new Error('timeout')), 3000))
]).catch(() => 'TIMEOUT');
console.log('exit:' + code);
})();
`], { stdout: 'pipe', stderr: 'pipe' });
// Anything other than 'TIMEOUT' (and ideally a non-zero number) means the
// lifecycle promise resolved on the spawn error.
const out = result.stdout.toString().trim();
expect(out).not.toBe('exit:TIMEOUT');
expect(out).toMatch(/^exit:\d+$/);
});
// Signal-exit branch: Bun reports 128 + signal number when a child is killed
// by a signal (code === null). Skipped on Windows, whose kill() semantics
// don't produce the POSIX 128+n mapping.
test.skipIf(process.platform === 'win32')('Bun.spawn proc.exited maps a killing signal to 128+signal', async () => {
const result = Bun.spawnSync(['node', '-e', `
require(${JSON.stringify(polyfillPath)});
(async () => {
const p = Bun.spawn(['node', '-e', 'setInterval(() => {}, 1000)'], { stdio: ['ignore', 'ignore', 'ignore'] });
setTimeout(() => p.kill('SIGTERM'), 150);
console.log('exit:' + await p.exited);
})();
`], { stdout: 'pipe', stderr: 'pipe' });
// SIGTERM = 15 → 128 + 15 = 143.
expect(result.stdout.toString().trim()).toBe('exit:143');
});
// GSTACK_SPAWN_MAX_BUFFER caps the drain so a runaway child can't OOM the
// server. Past the cap, the pipe keeps flowing (child doesn't block) but
// further bytes are dropped. Set a small cap, write more than that, assert
// the captured stdout equals the cap and the child exits cleanly.
test('Bun.spawn caps buffered output at GSTACK_SPAWN_MAX_BUFFER', async () => {
const result = Bun.spawnSync(['node', '-e', `
process.env.GSTACK_SPAWN_MAX_BUFFER = '${1024}';
require(${JSON.stringify(polyfillPath)});
(async () => {
// Child writes 10 KB; cap is 1 KB; drained output should be exactly 1 KB
// and exit should still resolve cleanly (child not back-pressured to death).
const p = Bun.spawn(
['node', '-e', 'process.stdout.write("y".repeat(10 * 1024)); process.exit(0)'],
{ stdio: ['ignore', 'pipe', 'ignore'] }
);
const code = await Promise.race([
p.exited,
new Promise((_, r) => setTimeout(() => r(new Error('timeout')), 3000))
]).catch(() => 'TIMEOUT');
const out = await new Response(p.stdout).text();
console.log(out.length + ':' + code);
})();
`], { stdout: 'pipe', stderr: 'pipe' });
expect(result.stdout.toString().trim()).toBe('1024:0');
});
// Regression for the pipe-blocking case: if the child writes more than the
// OS pipe buffer (~16-64 KB) and the polyfill doesn't drain eagerly, the
// child blocks in write() and `exit` never fires. 1 MB is well past every
// OS pipe buffer size. Pre-fix this test hangs forever; post-fix it returns
// in <500ms. Bun's default per-test timeout is 5s — generous here.
test('Bun.spawn drains large stdout so proc.exited still resolves', async () => {
const result = Bun.spawnSync(['node', '-e', `
require(${JSON.stringify(polyfillPath)});
(async () => {
const ONE_MB = 1024 * 1024;
// Exit in the write callback, not straight after write(): on modern
// Node a pipe write past the OS buffer is async, and process.exit()
// right after write() truncates at ~64 KB even with a live reader.
// The callback only fires once the full MB is flushed — which still
// requires the parent to drain, so the regression (no eager drain →
// child blocks → timeout) is still caught.
const p = Bun.spawn(
['node', '-e', 'process.stdout.write("x".repeat(' + ONE_MB + '), () => process.exit(0))'],
{ stdio: ['ignore', 'pipe', 'ignore'] }
);
const code = await Promise.race([
p.exited,
new Promise((_, r) => setTimeout(() => r(new Error('timeout')), 10000))
]).catch(e => 'TIMEOUT');
const out = await new Response(p.stdout).text();
console.log(out.length + ':' + code);
})().catch((e) => { console.log('THREW:' + e.message); });
`], { stdout: 'pipe', stderr: 'pipe' });
expect(result.stdout.toString().trim()).toBe('1048576:0');
}, 15000);
test('Bun.serve creates an HTTP server that responds', async () => {
const result = Bun.spawnSync(['node', '-e', `
require(${JSON.stringify(polyfillPath)});
const server = Bun.serve({
port: 0, // Note: polyfill uses port directly, so we pick one
hostname: '127.0.0.1',
fetch(req) {
return new Response(JSON.stringify({ ok: true }), {
headers: { 'Content-Type': 'application/json' },
});
},
});
// The polyfill doesn't support port 0, so we test the object shape
console.log(typeof server.stop === 'function' ? 'HAS_STOP' : 'NO_STOP');
console.log(typeof server.port === 'number' ? 'HAS_PORT' : 'NO_PORT');
server.stop();
`], { stdout: 'pipe', stderr: 'pipe' });
const lines = result.stdout.toString().trim().split('\n');
expect(lines[0]).toBe('HAS_STOP');
expect(lines[1]).toBe('HAS_PORT');
});
// windowsHide is the one option where Node's default is the opposite of
// Bun's: Node shows the child's console window, Bun hides it. Dropping it
// in translation makes every spawned child pop a window on Windows, which
// is the platform this whole file exists for. Both shims are covered, and
// an explicit windowsHide:false must survive forwarding (#2523 + #2539).
test('Bun.spawn defaults windowsHide to true', () => {
const result = Bun.spawnSync(['node', '-e', `
const cp = require('child_process');
const orig = cp.spawn;
let seen;
cp.spawn = (c, a, o) => { seen = o; return orig(c, a, o); };
require(${JSON.stringify(polyfillPath)});
Bun.spawn(['node', '-e', ''], { stdio: ['ignore', 'ignore', 'ignore'] });
console.log('windowsHide:' + seen.windowsHide);
`], { stdout: 'pipe', stderr: 'pipe' });
expect(result.stdout.toString().trim()).toBe('windowsHide:true');
});
test('Bun.spawnSync defaults windowsHide to true', () => {
const result = Bun.spawnSync(['node', '-e', `
const cp = require('child_process');
const orig = cp.spawnSync;
let seen;
cp.spawnSync = (c, a, o) => { seen = o; return orig(c, a, o); };
require(${JSON.stringify(polyfillPath)});
Bun.spawnSync(['node', '-e', '']);
console.log('windowsHide:' + seen.windowsHide);
`], { stdout: 'pipe', stderr: 'pipe' });
expect(result.stdout.toString().trim()).toBe('windowsHide:true');
});
test('an explicit windowsHide:false is honored', () => {
const result = Bun.spawnSync(['node', '-e', `
const cp = require('child_process');
const orig = cp.spawn;
let seen;
cp.spawn = (c, a, o) => { seen = o; return orig(c, a, o); };
require(${JSON.stringify(polyfillPath)});
Bun.spawn(['node', '-e', ''], { stdio: ['ignore', 'ignore', 'ignore'], windowsHide: false });
console.log('windowsHide:' + seen.windowsHide);
`], { stdout: 'pipe', stderr: 'pipe' });
expect(result.stdout.toString().trim()).toBe('windowsHide:false');
});
});