[Init] Initial commit - NetMesh terminal manager

electron/bridges/ai/commandSafety.test.cjs

@@ -0,0 +1,81 @@
+"use strict";
+
+const assert = require("node:assert/strict");
+const test = require("node:test");
+
+const {
+  checkBlocklistForShell,
+  checkBlocklistCommonOnly,
+  resolveSessionBlocklistShellKind,
+} = require("./commandSafety.cjs");
+
+test("checkBlocklistForShell selects default groups by shell kind", () => {
+  assert.equal(checkBlocklistForShell("echo $(whoami)", "").blocked, true);
+  assert.equal(checkBlocklistForShell("echo $(whoami)", "unknown").blocked, true);
+  assert.equal(checkBlocklistForShell("echo $(whoami)", "posix").blocked, true);
+  assert.equal(checkBlocklistForShell("echo $(whoami)", "fish").blocked, true);
+  assert.equal(checkBlocklistForShell('Write-Host "now: $(Get-Date)"', "powershell").blocked, false);
+  assert.equal(checkBlocklistForShell("Remove-Item -Recurse -Force C:\\x", "powershell").blocked, true);
+  assert.equal(checkBlocklistForShell("mkfs.ext4 /dev/sda", "powershell").blocked, true);
+  assert.equal(checkBlocklistForShell("dd if=/dev/zero of=/dev/sda", "powershell").blocked, true);
+  assert.equal(checkBlocklistForShell("chmod -R 777 /", "powershell").blocked, true);
+  assert.equal(checkBlocklistForShell("echo $(date)", "cmd").blocked, false);
+  assert.equal(checkBlocklistForShell("shutdown /r /t 0", "cmd").blocked, true);
+  assert.equal(checkBlocklistForShell("wsl dd if=/dev/zero of=/dev/sda", "cmd").blocked, true);
+  assert.equal(checkBlocklistForShell("wsl chmod -R 777 /", "cmd").blocked, true);
+});
+
+test("checkBlocklistCommonOnly never applies POSIX or PowerShell patterns", () => {
+  assert.equal(checkBlocklistCommonOnly("echo $(whoami)").blocked, false);
+  assert.equal(checkBlocklistCommonOnly("echo `whoami`").blocked, false);
+  assert.equal(checkBlocklistCommonOnly("Remove-Item -Recurse -Force C:\\x").blocked, false);
+  assert.equal(checkBlocklistCommonOnly("rm -rf /").blocked, true);
+  assert.equal(checkBlocklistCommonOnly("shutdown /r /t 0").blocked, true);
+});
+
+test("user-added settings patterns always apply regardless of shell kind", () => {
+  const settingsList = ["forbidden-thing"];
+  assert.equal(checkBlocklistForShell("forbidden-thing", "powershell", settingsList).blocked, true);
+  assert.equal(checkBlocklistCommonOnly("forbidden-thing", settingsList).blocked, true);
+  const withDefaults = ["\\$\\(", "forbidden-thing"];
+  assert.equal(checkBlocklistCommonOnly("echo $(date)", withDefaults).blocked, false);
+  assert.equal(checkBlocklistForShell("echo $(date)", "posix", withDefaults).blocked, true);
+});
+
+test("configured removal of defaults remains authoritative", () => {
+  const defaults = require("../../../lib/commandBlocklist.cjs");
+  const withoutRm = defaults.filter((pattern) => !pattern.startsWith("\\brm\\s+"));
+  assert.equal(checkBlocklistForShell("rm -rf /", "posix", withoutRm).blocked, false);
+  assert.equal(checkBlocklistForShell("rm -rf /", "posix", []).blocked, false);
+  assert.equal(checkBlocklistCommonOnly("rm -rf /", []).blocked, false);
+});
+
+test("resolveSessionBlocklistShellKind mirrors the PTY wrapper inputs", () => {
+  assert.equal(
+    resolveSessionBlocklistShellKind({ shellKind: "powershell" }),
+    "powershell",
+  );
+  assert.equal(
+    resolveSessionBlocklistShellKind({
+      shellKind: "",
+      lastIdlePrompt: "PS C:\\Users\\dev> ",
+      _promptTrackTail: "some output\r\nPS C:\\Users\\dev> ",
+    }),
+    "powershell",
+  );
+  assert.equal(
+    resolveSessionBlocklistShellKind({ shellKind: "", _loginShellKind: "powershell" }),
+    "powershell",
+  );
+  assert.equal(
+    resolveSessionBlocklistShellKind({
+      shellKind: "",
+      _loginShellKind: "cmd",
+      lastIdlePrompt: "user@host:~$ ",
+      _promptTrackTail: "\r\nuser@host:~$ ",
+    }),
+    "posix",
+  );
+  assert.equal(resolveSessionBlocklistShellKind({}), "");
+  assert.equal(resolveSessionBlocklistShellKind(null), "");
+});