test(dcg): increase integration coverage

Author: navedmerchant

src/services/destructive-command-guard/__tests__/manager.spec.ts

@@ -1,11 +1,13 @@
 import { createHash } from "crypto"
 import { EventEmitter } from "events"
-import { access, mkdtemp, mkdir, readFile, rm, writeFile } from "fs/promises"
+import { access, chmod, mkdtemp, mkdir, readFile, rm, stat, writeFile } from "fs/promises"
 import { tmpdir } from "os"
 import path from "path"
 import { PassThrough } from "stream"
 
 import { spawn } from "child_process"
+import { get } from "https"
+import type { IncomingMessage, RequestOptions } from "http"
 
 import { DCG_ARCHIVES, DCG_MAX_ARCHIVE_BYTES, DCG_VERSION } from "../constants"
 import {
@@ -19,19 +21,23 @@ import {
 	isTrustedDownloadUrl,
 	promoteStagedInstallation,
 	resolveTrustedRedirect,
+	ensureDcgInstalled,
 	verifyChecksum,
 } from "../manager"
 
 vi.mock("child_process", () => ({ spawn: vi.fn() }))
+vi.mock("https", () => ({ get: vi.fn() }))
 
 const mockSpawn = vi.mocked(spawn)
+const mockGet = vi.mocked(get)
 
 describe("Destructive Command Guard manager", () => {
 	let tempDir: string
 
 	beforeEach(async () => {
 		tempDir = await mkdtemp(path.join(tmpdir(), "dcg-manager-"))
 		mockSpawn.mockReset()
+		mockGet.mockReset()
 	})
 
 	afterEach(async () => {
@@ -67,6 +73,7 @@ describe("Destructive Command Guard manager", () => {
 		expect(isTrustedDownloadUrl("https://cdn.objects.githubusercontent.com/release")).toBe(true)
 		expect(isTrustedDownloadUrl("http://github.com/release")).toBe(false)
 		expect(isTrustedDownloadUrl("https://evilgithub.com/release")).toBe(false)
+		expect(isTrustedDownloadUrl("not a URL")).toBe(false)
 	})
 
 	it("rejects untrusted download URLs before opening a destination", async () => {
@@ -147,6 +154,47 @@ describe("Destructive Command Guard manager", () => {
 		expect(mockSpawn).toHaveBeenCalledTimes(1)
 	})
 
+	it("extracts a validated tar archive containing only the managed binary", async () => {
+		const children = [0, 1].map(() =>
+			Object.assign(new EventEmitter(), {
+				stdout: new PassThrough(),
+				stderr: new PassThrough(),
+				kill: vi.fn(),
+			}),
+		)
+		mockSpawn.mockReturnValueOnce(children[0] as unknown as ReturnType<typeof spawn>)
+		mockSpawn.mockReturnValueOnce(children[1] as unknown as ReturnType<typeof spawn>)
+
+		const extraction = extractSingleBinary("/tmp/dcg.tar.xz", tempDir, DCG_ARCHIVES["linux-x64"])
+		children[0].stdout.write("./dcg\n")
+		children[0].emit("close", 0)
+		await new Promise<void>((resolve) => setImmediate(resolve))
+		children[1].emit("close", 0)
+
+		await extraction
+		expect(mockSpawn).toHaveBeenNthCalledWith(
+			2,
+			"tar",
+			["-xJf", "/tmp/dcg.tar.xz", "-C", tempDir, "dcg"],
+			expect.objectContaining({ shell: false }),
+		)
+	})
+
+	it("surfaces process failures during extraction", async () => {
+		const child = Object.assign(new EventEmitter(), {
+			stdout: new PassThrough(),
+			stderr: new PassThrough(),
+			kill: vi.fn(),
+		})
+		mockSpawn.mockReturnValue(child as unknown as ReturnType<typeof spawn>)
+
+		const extraction = extractSingleBinary("/tmp/dcg.tar.xz", tempDir, DCG_ARCHIVES["linux-x64"])
+		child.stderr.write("invalid archive")
+		child.emit("close", 2)
+
+		await expect(extraction).rejects.toThrow("invalid archive")
+	})
+
 	it("does not replace an installation completed by another process", async () => {
 		const stagingDir = path.join(tempDir, "staging")
 		const finalDir = path.join(tempDir, "final")
@@ -162,6 +210,19 @@ describe("Destructive Command Guard manager", () => {
 		expect(await readFile(path.join(stagingDir, "dcg"), "utf8")).toBe("staged")
 	})
 
+	it("promotes a staged installation when no completed installation exists", async () => {
+		const stagingDir = path.join(tempDir, "staging")
+		const finalDir = path.join(tempDir, "final")
+		const binaryPath = path.join(finalDir, "dcg")
+		await mkdir(stagingDir)
+		await writeFile(path.join(stagingDir, "dcg"), "staged")
+
+		await promoteStagedInstallation(stagingDir, finalDir, binaryPath)
+
+		expect(await readFile(binaryPath, "utf8")).toBe("staged")
+		await expect(access(stagingDir)).rejects.toThrow()
+	})
+
 	it("removes only stale version directories after a successful update", async () => {
 		const currentDir = path.join(tempDir, DCG_VERSION)
 		const staleDir = path.join(tempDir, "v0.6.0")
@@ -176,4 +237,101 @@ describe("Destructive Command Guard manager", () => {
 			Promise.all([currentDir, stagingDir, unrelatedDir].map((dir) => access(dir))),
 		).resolves.toBeDefined()
 	})
+
+	it("treats stale-installation cleanup failures as cosmetic", async () => {
+		await expect(cleanupStaleInstallations(path.join(tempDir, "missing"))).resolves.toBeUndefined()
+	})
+
+	it("reuses an existing managed binary and restores its executable permissions", async () => {
+		const binaryPath = getDcgBinaryPath(tempDir)
+		expect(binaryPath).toBeDefined()
+		await mkdir(path.dirname(binaryPath!), { recursive: true })
+		await writeFile(binaryPath!, "existing binary")
+		if (process.platform !== "win32") {
+			await chmod(binaryPath!, 0o600)
+		}
+
+		await expect(ensureDcgInstalled(tempDir)).resolves.toBe(binaryPath)
+		expect(mockSpawn).not.toHaveBeenCalled()
+		if (process.platform !== "win32") {
+			expect((await stat(binaryPath!)).mode & 0o111).toBe(0o111)
+		}
+	})
+
+	it("downloads, verifies, extracts, and deduplicates a new installation", async () => {
+		const info = getDcgArchiveInfo()
+		expect(info).toBeDefined()
+		if (!info || info.archive.endsWith(".zip")) return
+
+		const archive = Buffer.from("test archive")
+		const originalChecksum = info.sha256
+		Object.defineProperty(info, "sha256", {
+			value: createHash("sha256").update(archive).digest("hex"),
+			configurable: true,
+		})
+		const now = vi.spyOn(Date, "now").mockReturnValue(1234)
+
+		const response = Object.assign(new PassThrough(), {
+			statusCode: 200,
+			headers: { "content-length": String(archive.length) },
+		})
+		const request = Object.assign(new EventEmitter(), {
+			setTimeout: vi.fn(),
+			destroy: vi.fn(),
+		})
+		mockGet.mockImplementation(
+			(
+				_url: string | URL,
+				optionsOrCallback: RequestOptions | ((response: IncomingMessage) => void),
+				optionalCallback?: (response: IncomingMessage) => void,
+			) => {
+				const callback = typeof optionsOrCallback === "function" ? optionsOrCallback : optionalCallback
+				setImmediate(() => {
+					// The downloader uses only the response stream/status subset supplied here.
+					callback?.(response as unknown as IncomingMessage)
+					response.end(archive)
+				})
+				// The downloader uses only timeout/error handling from ClientRequest.
+				return request as unknown as ReturnType<typeof get>
+			},
+		)
+
+		mockSpawn.mockImplementation((executable, args) => {
+			const child = Object.assign(new EventEmitter(), {
+				stdout: new PassThrough(),
+				stderr: new PassThrough(),
+				kill: vi.fn(),
+			})
+			setImmediate(async () => {
+				if (executable === "tar" && args[0] === "-tJf") {
+					child.stdout.write(`${info.binary}\n`)
+				} else if (executable === "tar") {
+					const stagingDir = args[args.indexOf("-C") + 1]
+					await writeFile(path.join(stagingDir, info.binary), "executable")
+				} else {
+					child.stdout.write(DCG_VERSION.replace(/^v/, ""))
+				}
+				child.emit("close", 0)
+			})
+			// The process runner uses only the event and stream subset supplied here.
+			return child as unknown as ReturnType<typeof spawn>
+		})
+
+		try {
+			const firstInstallation = ensureDcgInstalled(tempDir)
+			const concurrentInstallation = ensureDcgInstalled(tempDir)
+			expect(concurrentInstallation).toBe(firstInstallation)
+
+			const binaryPath = await firstInstallation
+			expect(await readFile(binaryPath, "utf8")).toBe("executable")
+			expect(mockGet).toHaveBeenCalledTimes(1)
+			expect(mockSpawn).toHaveBeenCalledTimes(3)
+			await expect(
+				access(path.join(tempDir, "destructive-command-guard", `${info.archive}.1234.download`)),
+			).rejects.toThrow()
+		} finally {
+			now.mockRestore()
+			Object.defineProperty(info, "sha256", { value: originalChecksum, configurable: true })
+		}
+	})
 })

webview-ui/src/components/settings/__tests__/AutoApproveSettings.spec.tsx

@@ -113,6 +113,21 @@ describe("AutoApproveSettings - Save/Discard contract", () => {
 		expect(screen.getByTestId("destructive-command-guard-checkbox")).not.toBeChecked()
 	})
 
+	it("renders destructive command guard enabled from cached settings", () => {
+		renderSettings({ destructiveCommandGuardEnabled: true })
+
+		expect(screen.getByTestId("destructive-command-guard-checkbox")).toBeChecked()
+	})
+
+	it("buffers disabling destructive command guard", () => {
+		const { setCachedStateField } = renderSettings({ destructiveCommandGuardEnabled: true })
+
+		fireEvent.click(screen.getByTestId("destructive-command-guard-checkbox"))
+
+		expect(setCachedStateField).toHaveBeenCalledWith("destructiveCommandGuardEnabled", false)
+		expectNoImmediateUpdateSettings()
+	})
+
 	it("hides Zoo command list editors while destructive command guard is enabled", () => {
 		renderSettings({ destructiveCommandGuardEnabled: true, deniedCommands: ["rm -rf"] })