mirror of
https://github.com/ruvnet/RuView
synced 2026-07-30 18:41:42 +00:00
rUv
90b29595fb
Adds the accepted ADR-285 Homecore metaharness, WASM-first kernel, read-only MCP guidance, guarded local host adapters, reviewed memory, and provenance-only npm release gates.
27 lines
1.0 KiB
JavaScript
27 lines
1.0 KiB
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { booleanFlag, run, validSkillName } from '../bin/cli.js';
|
|
|
|
test('skill lookup rejects traversal and only accepts bounded slugs', async () => {
|
|
assert.equal(validSkillName('secure-plugin'), true);
|
|
assert.equal(validSkillName('../README'), false);
|
|
assert.equal(validSkillName('..\\README'), false);
|
|
assert.equal(validSkillName('a'.repeat(65)), false);
|
|
|
|
const original = console.error;
|
|
console.error = () => {};
|
|
try {
|
|
assert.equal(await run(['skill', '../../../README']), 2);
|
|
assert.equal(await run(['skill', '..\\..\\README']), 2);
|
|
} finally {
|
|
console.error = original;
|
|
}
|
|
});
|
|
|
|
test('security-relevant boolean flags accept explicit true/false without silent downgrade', () => {
|
|
assert.equal(booleanFlag(true, '--strict'), true);
|
|
assert.equal(booleanFlag('true', '--strict'), true);
|
|
assert.equal(booleanFlag('false', '--strict'), false);
|
|
assert.throws(() => booleanFlag('yes', '--strict'), /bare flag, true, or false/);
|
|
});
|