Something went wrong. Try again.
This repository has no description
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507import assert from "node:assert/strict";import { test } from "node:test";import { createHash } from "node:crypto";import { build } from "esbuild";import { Miniflare, convertV4MiniflareOptions } from "miniflare";import { mkdtemp, rm } from "node:fs/promises";import { tmpdir } from "node:os";import { join } from "node:path";
const commit = "a".repeat(40);const folder = "https://github.com/example/library/tree/main/skills/harvest";const instructions = (metadata = "") => `---\nname: github-harvest\ndescription: Imported harvest guidance\nlicense: MIT\n${metadata}---\nUse the reviewed harvest instructions.`;const entry = (path, content = "reference", extra = {}) => ({ path, type: "blob", mode: "100644", sha: createHash("sha1") .update(`blob ${Buffer.byteLength(content)}\0`) .update(content) .digest("hex"), size: Buffer.byteLength(content), ...extra,});
test( "GitHub folder review imports a pinned Markdown snapshot through native fetch", { timeout: 60_000 }, async (t) => { const bundle = await build({ entryPoints: ["tests/fixtures/skill-installer-worker.ts"], alias: { path: "node:path" }, target: "es2022", bundle: true, write: false, format: "esm", platform: "neutral", conditions: ["workerd", "worker", "browser"], mainFields: ["module", "main"], external: ["cloudflare:*", "node:*"], }); const persistence = await mkdtemp(join(tmpdir(), "flarebot-github-skill-")); let worker, releaseHeld; t.after(async () => { releaseHeld?.(); await worker?.dispose(); await rm(persistence, { recursive: true, force: true }); }); const requests = []; let files, tree, intercept; const reset = (metadata = "") => { requests.length = 0; intercept = undefined; files = { "SKILL.md": instructions(metadata), "README.md": "Root sibling reference", "agents/helper.MD": "Nested uppercase Markdown", "references/guide.md": "Harvest: 3, 5, 8.", "references/empty.md": "", "permissions.json": JSON.stringify({ network: true, workspace: "read-write", }), "scripts/notes.md": "Script documentation stays inert.", "scripts/run.js": "throw new Error('must not execute')", "assets/image.png": "ignored binary", }; tree = { truncated: false, tree: Object.entries(files).map(([path, content]) => entry(path, content), ), }; }; reset(); const options = { ...convertV4MiniflareOptions({ modules: true, script: bundle.outputFiles[0].text, compatibilityDate: "2026-09-04", compatibilityFlags: ["nodejs_compat"], durableObjects: { MODEL: { className: "SkillInstallerFixture", useSQLite: true }, }, r2Buckets: ["PACKAGES"], async outboundService(request) { const url = new URL(request.url); requests.push({ url: request.url, accept: request.headers.get("Accept"), method: request.method, }); const custom = await intercept?.(url); if (custom) return custom; if ( url.hostname === "api.github.com" && url.pathname.includes("/commits/") ) return new Response(commit); if ( url.hostname === "api.github.com" && url.pathname.includes("/git/trees/") ) return Response.json(tree); const prefix = `/example/library/${commit}/skills/harvest/`; if ( url.hostname === "raw.githubusercontent.com" && url.pathname.startsWith(prefix) ) { const content = files[decodeURIComponent(url.pathname.slice(prefix.length))]; return new Response(content ?? "missing fixture file", { status: content === undefined ? 404 : 200, }); } return new Response("unexpected external request", { status: 500 }); }, }), resourcePersistencePath: persistence, }; worker = new Miniflare(options); const call = async (path, value, owner = "alice") => { const response = await worker.dispatchFetch( `https://fixture.example${path}`, { method: "POST", headers: { "X-Fixture-Owner": owner }, body: JSON.stringify(value), }, ); return { status: response.status, body: await response.json() }; }; const control = async (action, value, owner) => (await call("/control", { action, value }, owner)).body; const review = (url = folder, owner) => call("/api/skills/review-url", { url }, owner); const confirm = (value) => call("/api/skills/install", { reviewId: value.reviewId }); const failure = (result, status, code) => { assert.equal(result.status, status); assert.deepEqual(Object.keys(result.body.error).sort(), [ "code", "message", "path", ]); if (code) assert.equal(result.body.error.code, code); assert.ok( result.body.error.message.length > 0 && result.body.error.message.length <= 512, ); assert.equal( JSON.stringify(result.body).includes("private-provider-canary"), false, ); }; const rawRequests = () => requests.filter( ({ url }) => new URL(url).hostname === "raw.githubusercontent.com", );
await t.test( "review is lazy, Markdown-only, commit-pinned and durably installed disabled", async () => { const result = await review(`${folder}?ignored=1#readme`); assert.equal(result.status, 200, JSON.stringify(result.body)); const preview = result.body; assert.equal(preview.version, `0.0.0+git.${commit}`); assert.equal( preview.instructions, "Use the reviewed harvest instructions.", ); assert.equal(preview.license, "MIT"); assert.deepEqual(preview.origin, { kind: "url", url: folder.replace("/main/", `/${commit}/`), }); assert.equal(preview.fileCount, 6); assert.deepEqual(preview.scripts, []); assert.deepEqual(preview.permissions, { network: false, workspace: "none", externalCapabilities: [], }); assert.deepEqual( preview.resources.map(({ path }) => path), [ "README.md", "agents/helper.MD", "references/empty.md", "references/guide.md", "scripts/notes.md", ], ); assert.equal( preview.resources.find(({ path }) => path === "scripts/notes.md") .kind, "file", ); assert.equal((await control("metrics")).puts, 0); assert.deepEqual(await control("list"), []); assert.equal( requests[0].url, "https://api.github.com/repos/example/library/commits/main", ); assert.equal(requests[0].accept, "application/vnd.github.sha"); assert.equal( decodeURIComponent(new URL(requests[1].url).pathname), `/repos/example/library/git/trees/${commit}:skills/harvest`, ); assert.equal(new URL(requests[1].url).search, "?recursive=1"); assert.equal(rawRequests().length, 6); assert.ok( rawRequests().every(({ url }) => url.includes(`/${commit}/`)), ); const fetched = requests.length; files["SKILL.md"] = "Changed branch bytes must not be installed"; const installed = await confirm(preview); assert.equal(installed.status, 201); assert.equal(installed.body.enabled, false); assert.equal(installed.body.fingerprint, preview.fingerprint); assert.equal( requests.length, fetched, "confirmation must not refetch GitHub", ); await worker.dispose(); worker = new Miniflare(options); const loaded = await control("load", preview.name); assert.equal(loaded.entry.body, preview.instructions); assert.equal(loaded.version, preview.version); assert.equal(loaded.enabled, false); assert.equal( loaded.entry.resources.find( ({ path }) => path === "references/empty.md", ).content, "", ); assert.equal( loaded.files.some( ({ path }) => path === "permissions.json" || path === "scripts/run.js", ), false, ); assert.equal( loaded.entry.resources.find(({ path }) => path === "agents/helper.MD") .content, "Nested uppercase Markdown", ); assert.equal( requests.length, fetched, "restart loads the stored snapshot", ); }, ); await t.test( "UTF-8 BOMs survive reference reads and root frontmatter is recognized", async () => { for (const versioned of [false, true]) { reset(versioned ? 'metadata:\n version: "1.2.3"\n' : ""); files["SKILL.md"] = "\uFEFF" + files["SKILL.md"]; files["README.md"] = "\uFEFF# Reference"; tree.tree = Object.entries(files).map(([path, content]) => entry(path, content), ); const owner = versioned ? "bom-versioned" : "bom-default"; const result = await review(folder, owner); assert.equal(result.status, 200, JSON.stringify(result.body)); assert.equal( result.body.version, versioned ? "1.2.3" : `0.0.0+git.${commit}`, ); const installed = await call( "/api/skills/install", { reviewId: result.body.reviewId }, owner, ); assert.equal(installed.status, 201); const loaded = await control("load", "github-harvest", owner); assert.equal( loaded.entry.body, "Use the reviewed harvest instructions.", ); assert.equal( loaded.files.find(({ path }) => path === "README.md").content, "\uFEFF# Reference", ); } reset(); files["README.md"] = "X".repeat(Buffer.byteLength(files["README.md"])); failure(await review(), 400, "invalid_package"); reset(); files["README.md"] = Buffer.from([0xed, 0xa0, 0x80]); tree.tree = Object.entries(files).map(([path, content]) => entry(path, content), ); failure(await review(), 400, "invalid_package"); }, ); await t.test( "publisher version and encoded branch names are retained", async () => { reset('metadata:\n version: "2.3.4"\n author: Publisher\n'); const result = await review( folder.replace("/main/", "/release%2Fstable/"), ); assert.equal(result.status, 200, JSON.stringify(result.body)); assert.equal(result.body.version, "2.3.4"); assert.equal(result.body.metadata.author, "Publisher"); assert.equal( new URL(requests[0].url).pathname, "/repos/example/library/commits/release%2Fstable", ); }, ); await t.test( "incomplete or unsafe trees are rejected before file downloads", async () => { const invalidTrees = [ [ "truncated", () => { tree.truncated = true; }, ], [ "missing root", () => { tree.tree = [entry("nested/SKILL.md")]; }, ], [ "symlink", () => { tree.tree[0].mode = "120000"; }, ], [ "submodule", () => { tree.tree[0].type = "commit"; }, ], [ "129 files", () => { tree.tree = [ entry("SKILL.md"), ...Array.from({ length: 128 }, (_, i) => entry(`ref-${i}.md`)), ]; }, ], [ "oversized file", () => { tree.tree[1].size = 256 * 1024 + 1; }, ], [ "oversized package", () => { tree.tree = [ entry("SKILL.md"), ...Array.from({ length: 8 }, (_, i) => entry(`ref-${i}.md`, "", { size: 256 * 1024 }), ), ]; }, ], ...[ "../outside.md", "references/../outside.md", "refs\\escape.md", "/absolute.md", "refs/%2e%2e.md", ].map((path) => [ path, () => { tree.tree.push(entry(path)); }, ]), [ "case collision", () => { tree.tree.push(entry("readme.MD")); }, ], ]; for (const [name, mutate] of invalidTrees) { reset(); mutate(); failure(await review(), 400, "invalid_github_folder"); assert.equal(rawRequests().length, 0, name); } }, ); await t.test( "download errors, redirects and actual byte mismatches stay bounded", async () => { for (const stage of ["/commits/", "/git/trees/", "/SKILL.md"]) { for (const status of [302, 503]) { reset(); intercept = (url) => url.pathname.includes(stage) ? new Response("private-provider-canary", { status, headers: { location: "https://other.example/secret" }, }) : undefined; failure(await review(), 502, "download_failed"); assert.equal( requests.some(({ url }) => url.startsWith("https://other.example"), ), false, ); } } reset(); files["README.md"] = "wrong advertised size"; failure(await review(), 400, "invalid_package"); reset(); files["README.md"] = "é".repeat(128 * 1024 + 1); failure(await review(), 502, "download_failed"); }, ); await t.test( "malformed URLs, invalid metadata and path collisions cannot create a review", async () => { for (const url of [ folder.replace("https:", "http:"), folder.replace("github.com/", "secret@github.com/"), folder.replace("/tree/", "/blob/"), folder.replace("/harvest", "/%2Fescape"), "https://github.com/example/library/tree/main", ]) { reset(); failure(await review(url), 400, "invalid_url"); assert.equal(requests.length, 0); } reset('metadata:\n version: "invalid-version"\n'); failure(await review(), 400, "invalid_metadata"); reset(); files["guide.md"] = "file"; files["guide.md/nested.md"] = "nested"; tree.tree.push( entry("guide.md", "file"), entry("guide.md/nested.md", "nested"), ); failure(await review(), 400); }, ); assert.equal( (await control("metrics")).puts, 0, "review and validation must never write R2", ); await t.test( "aborting a held native download leaves no installable snapshot", { timeout: 10_000 }, async () => { reset(); const started = Promise.withResolvers(); intercept = async (url) => { if (!url.pathname.includes("/commits/")) return; started.resolve(); await new Promise((resolve) => { releaseHeld = resolve; }); return new Response(commit); }; const pending = control( "cancellable-review", { path: "review-url", body: { url: folder } }, "cancelled", ); try { await started.promise; assert.equal( (await control("abort-review", undefined, "cancelled")).aborted, true, ); assert.deepEqual(await pending, { rejected: true }); assert.equal( requests.length, 1, "cancellation stops before tree discovery", ); assert.equal( (await control("metrics", undefined, "cancelled")).leases, 0, ); assert.deepEqual(await control("list", undefined, "cancelled"), []); assert.equal( (await control("metrics", undefined, "cancelled")).puts, 0, ); } finally { releaseHeld?.(); releaseHeld = undefined; } }, ); },);