feat: v0.7.4 时序语义修正 · 防线实效补漏 · 全量测试翻倍 — 2406 用例 + jsdom 组件测试全量回归
P1 修复面收口: - 超时三态区分（aborted→USER_INTERRUPT / ETIMEDOUT→TIMEOUT / 其余→ERROR）， 根治"真实网络超时被误报为用户中断" - 流空闲超时统一（SSE/Ollama/Anthropic 读循环 60s 无数据抛 504 进重试通道） - 同会话并发 sendMessage 防重入（isRunning 守卫）+ 会话存在性预检 + 前置调用移入 try（ERROR+DONE 双事件保证，根治 isStreaming 假死） - 清空审计后 resetChainCache（根治 verifyChain 误报 TAMPERED） - DONE 不再提前清理 TRACE（TERMINATED 统一收尾，补全最终迭代录制） - IME 合成回车不发送（普通 Enter + Cmd/Ctrl+Enter 双分支）+ handleSend 闭包修复 P2 安全纵深: - preload 移除原始 electronAPI 暴露（渲染层零使用，关掉 XSS invoke 任意通道单点风险） - CORS 同源回显根治（仅当前浏览页面 Origin，did-navigate 同步） - MEMORY.md 命令保护正则扩展（括号/$/反引号/< 重定向边界 + 前导路径） - write_file append TOCTOU 统一（open 后 realpath 校验，新文件分支补漏） - 敏感键归一化（authKey 驼峰/连字符命中）+ MCP headers 鉴权值加密落库 - ReDoS 检测共享化（search_files/file_editor 统一拦截） - run_tests/lint_code 升风险 + 需确认 + npx --no-install（执行边界对齐 run_command） - MCP/SearXNG/llm.baseURL/updateFeedUrl 配置类 URL 高危目标校验（IPv6 去括号 + 十六进制映射解析 + 尾点剥离） P3 架构还债: - temperature/maxTokens 热生效（引擎/编排器/SubAgent 三处接线）+ setBatch 单事务落盘 - SessionRecorder flush 竞态根治（flushPromise 等待 + 超限内联落盘 + stopRecording async） - 内存收口（lastConsolidationBySession LRU / subTraces 清理 / 会话删除 disposeEngine） - i18n 全量收口（28 组件 + 353 key 双字典，状态标签改渲染时函数） - 死代码清理（updateTraceStep/HEADER_HEIGHT/void preA/失实注释） - 斜杠菜单 MUI 化 + 删除逻辑收敛 resetSessionState + Blob URL 统一释放 + 用户消息"仅保存"落库（saveMessage 透传前端 id 修复 id 错位） P4 能力演进: - 死循环检测拆分（驻留前置 + 乒乓后置带进度信号，合法交替不误报） - run-lock 30s 超时强制 abort（旧 run 卡死不无限排队） - RETRY 双通道 stream_reset（前端按 run 归属精确清空，根治重试文本重复） - FTS5 trigram 中文子串搜索（迁移 9 版本化 SCHEMA_VERSION=2，≤2 字符 LIKE 回退） - getContextWindow 兜底 1M→128K（未知模型防 413） 测试: - 855 → 2406 用例（+1551，2.8 倍）：服务层 +325（含 MemoryManager 51 新用例）、 工具实体 +483、IPC/适配器 +390（含 OpenAI/Anthropic/Ollama 独立套件）、 纯函数表格化 +330；引入 jsdom + @testing-library（14 组件测试文件 249 用例） - 修复 R1（saveMessage id 透传）/ R2（stream_reset 精确归属）两个回归缺陷 - 遗留低危项清零：git-tools 顺序耦合 / web-fetch 真实时间退避 / slo 内存断言 / mcp-security 多余 skipIf / deepseek-balance 命名误导 / 组件 mock 注入脆弱性 版本: 0.7.4; README 同步（工具风险表/版本徽章）; 依赖: 移除 @electron-toolkit/preload， 新增 jsdom/@testing-library（devDependencies 不打包） 回归: typecheck 双端 0 错误; ESLint 0/0; Electron ABI 全量 2406/2406 零跳过; 系统 Node 2110 通过 296 跳过（better-sqlite3 ABI）
This commit is contained in:
@@ -0,0 +1,204 @@
|
||||
/**
|
||||
* view_image 工具实体夹具套件（v0.7.5 覆盖补齐）
|
||||
*
|
||||
* 以真实临时目录为夹具，锁定：
|
||||
* - path 必填 / 工作空间越界拒绝 / 扩展名白名单（png/jpg/jpeg/gif/webp/bmp/svg）
|
||||
* - 5MB 大小闸门 / 文件不存在 / MIME 映射 / dataUrl 载荷形态
|
||||
* - 大小写扩展名归一 / 子目录路径
|
||||
*/
|
||||
|
||||
import { describe, it, expect, beforeAll, afterAll } from 'vitest';
|
||||
import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from 'fs';
|
||||
import { tmpdir } from 'os';
|
||||
import { join } from 'path';
|
||||
|
||||
import { ViewImageTool } from '../view-image';
|
||||
import type { ToolExecutionContext } from '../../../types/metona-tool';
|
||||
|
||||
const MAX_IMAGE_BYTES = 5 * 1024 * 1024;
|
||||
|
||||
interface ViewResult {
|
||||
success: boolean;
|
||||
error?: string;
|
||||
path?: string;
|
||||
size?: number;
|
||||
mimeType?: string;
|
||||
dataUrl?: string;
|
||||
supportedFormats?: string[];
|
||||
}
|
||||
|
||||
describe('view_image', () => {
|
||||
let ws: string;
|
||||
let tool: ViewImageTool;
|
||||
|
||||
const ctx = (): ToolExecutionContext => ({
|
||||
sessionId: 't',
|
||||
workspacePath: ws,
|
||||
iteration: 1,
|
||||
requestId: 'r',
|
||||
});
|
||||
|
||||
beforeAll(() => {
|
||||
ws = mkdtempSync(join(tmpdir(), 'metona-img-'));
|
||||
tool = new ViewImageTool();
|
||||
// 最小合法 PNG 载荷（8 字节签名 + 少量内容）
|
||||
writeFileSync(
|
||||
join(ws, 'pic.png'),
|
||||
Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x01, 0x02]),
|
||||
);
|
||||
writeFileSync(join(ws, 'photo.JPG'), Buffer.from([0xff, 0xd8, 0xff, 0xe0, 0x00, 0x10]));
|
||||
writeFileSync(join(ws, 'anim.gif'), Buffer.from([0x47, 0x49, 0x46, 0x38, 0x39, 0x61]));
|
||||
writeFileSync(join(ws, 'vector.svg'), '<svg xmlns="http://www.w3.org/2000/svg"></svg>');
|
||||
writeFileSync(join(ws, 'bits.webp'), 'RIFF\x00\x00\x00\x00WEBPVP8 ');
|
||||
writeFileSync(join(ws, 'bitmap.bmp'), 'BM\x00\x00');
|
||||
writeFileSync(join(ws, 'doc.txt'), 'plain text');
|
||||
mkdirSync(join(ws, 'sub'), { recursive: true });
|
||||
writeFileSync(
|
||||
join(ws, 'sub', 'nested.png'),
|
||||
Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]),
|
||||
);
|
||||
// 超限文件（> 5MB）
|
||||
writeFileSync(join(ws, 'huge.png'), Buffer.alloc(MAX_IMAGE_BYTES + 5, 0x61));
|
||||
});
|
||||
|
||||
afterAll(() => {
|
||||
try {
|
||||
rmSync(ws, { recursive: true, force: true });
|
||||
} catch {
|
||||
/* ignore */
|
||||
}
|
||||
});
|
||||
|
||||
it('path 缺失 → 失败并提示 path is required', async () => {
|
||||
const r = (await tool.execute({}, ctx())) as ViewResult;
|
||||
expect(r.success).toBe(false);
|
||||
expect(String(r.error)).toContain('path is required');
|
||||
});
|
||||
|
||||
it('path 为 null → 同样失败', async () => {
|
||||
const r = (await tool.execute({ path: null }, ctx())) as ViewResult;
|
||||
expect(r.success).toBe(false);
|
||||
});
|
||||
|
||||
it('工作空间外绝对路径 → Path outside workspace', async () => {
|
||||
const outside = process.platform === 'win32' ? 'C:\\Windows\\notepad.exe' : '/etc/passwd';
|
||||
const r = (await tool.execute({ path: outside }, ctx())) as ViewResult;
|
||||
expect(r.success).toBe(false);
|
||||
expect(String(r.error)).toContain('Path outside workspace');
|
||||
});
|
||||
|
||||
it('路径遍历（../ 跳出）→ 拒绝', async () => {
|
||||
const r = (await tool.execute({ path: '../outside.png' }, ctx())) as ViewResult;
|
||||
expect(r.success).toBe(false);
|
||||
});
|
||||
|
||||
it('不支持扩展名（.txt）→ Unsupported image format 且列出支持列表', async () => {
|
||||
const r = (await tool.execute({ path: 'doc.txt' }, ctx())) as ViewResult;
|
||||
expect(r.success).toBe(false);
|
||||
expect(String(r.error)).toContain('Unsupported image format');
|
||||
expect(Array.isArray(r.supportedFormats)).toBe(true);
|
||||
expect(r.supportedFormats).toContain('.png');
|
||||
expect(r.supportedFormats).toContain('.svg');
|
||||
});
|
||||
|
||||
it('无扩展名文件 → 不支持格式', async () => {
|
||||
const r = (await tool.execute({ path: 'noext' }, ctx())) as ViewResult;
|
||||
expect(r.success).toBe(false);
|
||||
});
|
||||
|
||||
it('支持格式中不存在的文件 → File not found', async () => {
|
||||
const r = (await tool.execute({ path: 'missing.png' }, ctx())) as ViewResult;
|
||||
expect(r.success).toBe(false);
|
||||
expect(String(r.error)).toContain('File not found');
|
||||
});
|
||||
|
||||
it('超过 5MB → Image too large (max 5MB) 且回传 size', async () => {
|
||||
const r = (await tool.execute({ path: 'huge.png' }, ctx())) as ViewResult;
|
||||
expect(r.success).toBe(false);
|
||||
expect(String(r.error)).toContain('Image too large');
|
||||
expect(Number(r.size)).toBe(MAX_IMAGE_BYTES + 5);
|
||||
});
|
||||
|
||||
it('PNG 成功：mimeType=image/png、dataUrl 前缀正确', async () => {
|
||||
const r = (await tool.execute({ path: 'pic.png' }, ctx())) as ViewResult;
|
||||
expect(r.success).toBe(true);
|
||||
expect(r.mimeType).toBe('image/png');
|
||||
expect(r.size).toBe(10);
|
||||
expect(String(r.dataUrl)).toMatch(/^data:image\/png;base64,/);
|
||||
});
|
||||
|
||||
it('dataUrl 载荷解码后与源文件字节一致', async () => {
|
||||
const r = (await tool.execute({ path: 'pic.png' }, ctx())) as ViewResult;
|
||||
const b64 = String(r.dataUrl).slice('data:image/png;base64,'.length);
|
||||
const decoded = Buffer.from(b64, 'base64');
|
||||
expect([...decoded]).toEqual([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x01, 0x02]);
|
||||
});
|
||||
|
||||
it('大写扩展名 .JPG 归一为 image/jpeg', async () => {
|
||||
const r = (await tool.execute({ path: 'photo.JPG' }, ctx())) as ViewResult;
|
||||
expect(r.success).toBe(true);
|
||||
expect(r.mimeType).toBe('image/jpeg');
|
||||
});
|
||||
|
||||
it('.jpeg 与 .jpg 共用 image/jpeg（同名映射）', async () => {
|
||||
writeFileSync(join(ws, 'dual.jpeg'), Buffer.from([0xff, 0xd8, 0xff]));
|
||||
const r = (await tool.execute({ path: 'dual.jpeg' }, ctx())) as ViewResult;
|
||||
expect(r.mimeType).toBe('image/jpeg');
|
||||
});
|
||||
|
||||
it('GIF → image/gif', async () => {
|
||||
const r = (await tool.execute({ path: 'anim.gif' }, ctx())) as ViewResult;
|
||||
expect(r.success).toBe(true);
|
||||
expect(r.mimeType).toBe('image/gif');
|
||||
});
|
||||
|
||||
it('WEBP → image/webp', async () => {
|
||||
const r = (await tool.execute({ path: 'bits.webp' }, ctx())) as ViewResult;
|
||||
expect(r.success).toBe(true);
|
||||
expect(r.mimeType).toBe('image/webp');
|
||||
});
|
||||
|
||||
it('BMP → image/bmp', async () => {
|
||||
const r = (await tool.execute({ path: 'bitmap.bmp' }, ctx())) as ViewResult;
|
||||
expect(r.success).toBe(true);
|
||||
expect(r.mimeType).toBe('image/bmp');
|
||||
});
|
||||
|
||||
it('SVG → image/svg+xml', async () => {
|
||||
const r = (await tool.execute({ path: 'vector.svg' }, ctx())) as ViewResult;
|
||||
expect(r.success).toBe(true);
|
||||
expect(r.mimeType).toBe('image/svg+xml');
|
||||
expect(String(r.dataUrl)).toMatch(/^data:image\/svg\+xml;base64,/);
|
||||
});
|
||||
|
||||
it('子目录路径可读取（仍在校验边界内）', async () => {
|
||||
const r = (await tool.execute({ path: 'sub/nested.png' }, ctx())) as ViewResult;
|
||||
expect(r.success).toBe(true);
|
||||
expect(r.size).toBe(8);
|
||||
});
|
||||
|
||||
it('空文件（0 字节）可正常读取', async () => {
|
||||
writeFileSync(join(ws, 'empty.png'), Buffer.alloc(0));
|
||||
const r = (await tool.execute({ path: 'empty.png' }, ctx())) as ViewResult;
|
||||
expect(r.success).toBe(true);
|
||||
expect(r.size).toBe(0);
|
||||
});
|
||||
|
||||
it('相对路径带 ./ 前缀可读', async () => {
|
||||
const r = (await tool.execute({ path: './pic.png' }, ctx())) as ViewResult;
|
||||
expect(r.success).toBe(true);
|
||||
});
|
||||
|
||||
it('目录路径（扩展名为 .png 的目录）→ 读取失败（stat 非文件）', async () => {
|
||||
mkdirSync(join(ws, 'dir.png'), { recursive: true });
|
||||
const r = (await tool.execute({ path: 'dir.png' }, ctx())) as ViewResult;
|
||||
expect(r.success).toBe(false);
|
||||
});
|
||||
|
||||
it('返回值不含 dataUrl 之外的泄露字段（path/size/mimeType 齐全）', async () => {
|
||||
const r = (await tool.execute({ path: 'pic.png' }, ctx())) as Record<string, unknown>;
|
||||
expect(r.success).toBe(true);
|
||||
expect(r.path).toBe('pic.png');
|
||||
expect(typeof r.dataUrl).toBe('string');
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user