66 lines
2.7 KiB
TypeScript
66 lines
2.7 KiB
TypeScript
import { describe, expect, it } from 'vitest'
|
|
import { analyzeAgentOutput } from '../../src/utils/agentOutput'
|
|
import {
|
|
agentCommandAllowFingerprint,
|
|
agentCommandNeedsConfirmation,
|
|
assessAgentCommandRisk,
|
|
} from '../../src/utils/agentCommandRisk'
|
|
|
|
describe('Agent command guardrail', () => {
|
|
it.each([
|
|
['df -h', 'safe'],
|
|
['journalctl -u nginx -n 100', 'safe'],
|
|
['custom-health-check --json', 'low'],
|
|
['sudo cp /tmp/a /etc/a', 'high'],
|
|
['systemctl restart nginx', 'high'],
|
|
['rm -rf /', 'critical'],
|
|
['sudo rm -r -f -- /', 'critical'],
|
|
['dd if=/dev/zero of=/dev/sda', 'critical'],
|
|
['find /tmp -delete', 'high'],
|
|
['cat /etc/os-release && systemctl restart nginx', 'high'],
|
|
])('classifies %s as %s', (command, expected) => {
|
|
expect(assessAgentCommandRisk(command)).toBe(expected)
|
|
})
|
|
|
|
it('uses strict and relaxed confirmation thresholds', () => {
|
|
expect(agentCommandNeedsConfirmation('safe', 'strict')).toBe(false)
|
|
expect(agentCommandNeedsConfirmation('medium', 'strict')).toBe(true)
|
|
expect(agentCommandNeedsConfirmation('medium', 'relaxed')).toBe(false)
|
|
expect(agentCommandNeedsConfirmation('high', 'relaxed')).toBe(true)
|
|
expect(agentCommandNeedsConfirmation('critical', 'relaxed')).toBe(false)
|
|
expect(agentCommandNeedsConfirmation('critical', 'strict')).toBe(false)
|
|
})
|
|
|
|
it('confirm-all still auto-runs only the read-only whitelist', () => {
|
|
expect(agentCommandNeedsConfirmation('safe', 'relaxed', true)).toBe(false)
|
|
expect(agentCommandNeedsConfirmation('low', 'relaxed', true)).toBe(true)
|
|
expect(agentCommandNeedsConfirmation('medium', 'strict', true)).toBe(true)
|
|
expect(agentCommandNeedsConfirmation('high', 'relaxed', true)).toBe(true)
|
|
expect(agentCommandNeedsConfirmation('critical', 'relaxed', true)).toBe(false)
|
|
})
|
|
|
|
it('fingerprints similar temp-path commands for session Always', () => {
|
|
expect(agentCommandAllowFingerprint('rm /tmp/tmp.3RUZRHTwk2', 'high')).toBe(
|
|
agentCommandAllowFingerprint('rm /tmp/tmp.ABCDEFG123', 'high')
|
|
)
|
|
expect(agentCommandAllowFingerprint('rm /tmp/tmp.3RUZRHTwk2', 'high')).not.toBe(
|
|
agentCommandAllowFingerprint('rm -rf /var/log/nginx', 'high')
|
|
)
|
|
})
|
|
})
|
|
|
|
describe('Agent analyze_output tool', () => {
|
|
it('keeps error evidence while bounding long output by line count', () => {
|
|
const lines = Array.from({ length: 160 }, (_, index) =>
|
|
index === 150 ? 'FATAL connection refused' : `normal line ${index}`
|
|
)
|
|
const result = analyzeAgentOutput(lines.join('\n'))
|
|
|
|
expect(result.totalLines).toBe(160)
|
|
expect(result.truncated).toBe(true)
|
|
expect(result.errorLines).toBe(1)
|
|
expect(result.text).toContain('FATAL connection refused')
|
|
expect(result.text).toContain('已省略 80 行')
|
|
})
|
|
})
|