feat(homecore): add WASM-first developer metaharness (#1477)

Adds the accepted ADR-285 Homecore metaharness, WASM-first kernel, read-only MCP guidance, guarded local host adapters, reviewed memory, and provenance-only npm release gates.
2026-08-02 19:11:46 +00:00 · 2026-07-29 19:51:21 -04:00
parent c798cc913c
commit 90b29595fb
54 changed files with 3722 additions and 16 deletions
@@ -0,0 +1,26 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { booleanFlag, run, validSkillName } from '../bin/cli.js';
+
+test('skill lookup rejects traversal and only accepts bounded slugs', async () => {
+  assert.equal(validSkillName('secure-plugin'), true);
+  assert.equal(validSkillName('../README'), false);
+  assert.equal(validSkillName('..\\README'), false);
+  assert.equal(validSkillName('a'.repeat(65)), false);
+
+  const original = console.error;
+  console.error = () => {};
+  try {
+    assert.equal(await run(['skill', '../../../README']), 2);
+    assert.equal(await run(['skill', '..\\..\\README']), 2);
+  } finally {
+    console.error = original;
+  }
+});
+
+test('security-relevant boolean flags accept explicit true/false without silent downgrade', () => {
+  assert.equal(booleanFlag(true, '--strict'), true);
+  assert.equal(booleanFlag('true', '--strict'), true);
+  assert.equal(booleanFlag('false', '--strict'), false);
+  assert.throws(() => booleanFlag('yes', '--strict'), /bare flag, true, or false/);
+});