Uh oh!
There was an error while loading. Please reload this page.
chore(contracts): add TESTING.md + PERMISSIONS.md#33
Uh oh!
There was an error while loading. Please reload this page.
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| # PERMISSIONS | ||
| What an agent may do in this repository without asking, what it must ask | ||
| before, and what it may never do. The fenced `yaml permissions-contract` block | ||
| below is the machine surface: `contracts eval` renders a verdict for one | ||
| tool call, the PreToolUse gate refuses or asks citing the rule, and | ||
| `permd compile` turns it into a Claude Code settings fragment. Semantics are | ||
| deny > ask > allow — when several rules match, the most restrictive wins. | ||
| Edit the YAML, keep the fence line exactly as-is. Never soften a rule to get | ||
| past a gate: the gate is the contract. | ||
| ```yaml permissions-contract | ||
| version: "0.1" | ||
| rules: | ||
| - verdict: deny | ||
| tool: Bash | ||
| cmd_pattern: "rm -rf *" | ||
| reason: destructive shell | ||
| - verdict: deny | ||
| tool: Bash | ||
| cmd_pattern: "git push --force*" | ||
| reason: rewriting shared history is operator-owned | ||
| - verdict: ask | ||
| tool: Bash | ||
| cmd_pattern: "git push*" | ||
| reason: remote mutation | ||
| - verdict: deny | ||
| path_glob: "**/*.pem" | ||
| reason: key material stays unread | ||
| - verdict: allow | ||
| tool: Bash | ||
| cmd_pattern: "npm test*" | ||
| - verdict: allow | ||
| tool: Read | ||
| floors: | ||
| merge: | ||
| default: pr-review | ||
| prod: ask | ||
| deploy: | ||
| default: staged | ||
| prod: ask | ||
| crossings: | ||
| - name: prod-merge | ||
| verdict: ask | ||
| - name: credential-mint | ||
| verdict: deny | ||
| reason: operator-owned, never autonomous | ||
| ``` | ||
| ## Notes for contributors | ||
| - `cmd_pattern` and `path_glob` use `*` and `?` only (a linear matcher, never a | ||
| regex) — a pattern is matched against the whole command string. | ||
| - Add rules; do not delete `deny` rules to unblock an agent. If a deny is | ||
| wrong, change it in a reviewed PR with the reason in the commit. | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| # TESTING | ||
| How to run this project's tests, for people and for agents. The fenced | ||
| `yaml test-contract` block below is the machine surface: `testmd validate` | ||
| checks it, `testmd run` executes it and writes receipts, and the stop gate | ||
| verifies receipts before an agent may claim DONE. Edit the YAML, keep the | ||
| fence line exactly as-is, and never paste secret values into it (fixture | ||
| NAMES only). | ||
| ```yaml test-contract | ||
| version: "0.1" | ||
| entry: npm test | ||
| suites: | ||
| unit: | ||
| cmd: npm test | ||
| timeout_s: 600 | ||
| lint: | ||
| cmd: npm run lint | ||
Comment on lines
+12
to
+18
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: printf'%s\n''--- TESTING.md ---'
sed -n '1,80p' TESTING.md
printf'%s\n''--- repository metadata ---'
git ls-files | grep -E '(^|/)(package\.json|pyproject\.toml|tox\.ini|pytest\.ini|setup\.cfg|Makefile|\.github/workflows/.*\.ya?ml)$'| sort
printf'%s\n''--- package.json scripts ---'if [ -f package.json ];then
node -e 'const p=require("./package.json"); console.log(JSON.stringify(p.scripts ?? {}, null, 2))'elseecho'package.json: absent'fiprintf'%s\n''--- Python tool declarations and CI command references ---'
rg -n -C 2 'pytest|ruff|npm test|npm run lint|testmd' pyproject.toml tox.ini pytest.ini setup.cfg .github 2>/dev/null ||trueRepository: wave-av/sdk-python Length of output: 3937 🏁 Script executed: printf'%s\n''--- pyproject test configuration ---'
sed -n '55,75p;105,118p' pyproject.toml
printf'%s\n''--- CI test and lint commands ---'
rg -n -C 3 'run:|pytest|ruff' .github/workflows/_checks.yml .github/workflows/foundation-gate.yml .github/workflows/python-lint.ymlRepository: wave-av/sdk-python Length of output: 4739 🌐 Web query:
💡 Result: When you run npm test, the command specifically looks for a "test" script defined within the "scripts" object of a package.json file [1][2]. If the package.json file is absent in the current working directory, npm will be unable to locate the required "scripts" configuration [3][4]. Consequently, npm will typically fail with an error, such as "npm ERR! enoent ENOENT: no such file or directory, open '.../package.json'" or a message indicating that the package.json is missing, because npm relies on this file as the manifest to define project behavior [3]. It is important to distinguish this from the scenario where a package.json file exists but the "test" script itself is undefined. In earlier versions of npm (specifically prior to version 7), running npm test without a defined "test" script would execute a default echo command and exit with a code of 0 [5][6]. Starting with npm version 7, this behavior was changed to align with standard CLI practices, and npm now reports a "missing script" error and returns a non-zero exit code when the "test" script is missing [5][7]. Citations:
Use repository-owned commands. Because this repository has no 🤖 Prompt for AI AgentsThere was a problem hiding this comment. 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: printf'%s\n''--- TESTING.md ---'
sed -n '1,45p' TESTING.md
printf'%s\n''--- PERMISSIONS.md ---'
sed -n '1,120p' PERMISSIONS.md
printf'%s\n''--- package and tooling files ---'
git ls-files | grep -E '(^|/)(package\.json|pyproject\.toml|tox\.ini|\.pre-commit-config\.yaml|Makefile|setup\.cfg)$'| head -80Repository: wave-av/sdk-python Length of output: 3051 🏁 Script executed: printf'%s\n''--- pyproject.toml ---'
sed -n '1,180p' pyproject.toml
printf'%s\n''--- contract/testmd/permd references ---'
rg -n --glob '!*.lock' --glob '!*.json''testmd run|contracts eval|permd compile|cmd_pattern|unmatched|default.*ask|Bash'.| head -160
printf'%s\n''--- likely contract files ---'
git ls-files | grep -E '(^|/)(contracts|permissions|testing|testmd|permd|scripts)(/|\.|$)'| head -120Repository: wave-av/sdk-python Length of output: 3941 Add permission coverage for
🤖 Prompt for AI Agents | ||
| required: false | ||
| timeout_s: 120 | ||
Comment on lines
+11
to
+20
There was a problem hiding this comment. 🚨 Bug: test-contract uses npm commands in a Python-only repoTESTING.md's Replace the npm-based entry/suite commands with the repo's actual pytest/ruff commands.: Was this helpful? React with 👍 / 👎 | ||
| pass: | ||
| exit: 0 | ||
| forbidden: | ||
| - skip-failing | ||
| - delete-tests | ||
| - mock-prod | ||
| - claim-pass-on-timeout | ||
| flake: | ||
| retries: 0 | ||
| on_flaky: fail | ||
| receipt: | ||
| format: json | ||
| path: .testmd/receipts | ||
| bind: gitCommit | ||
| ``` | ||
| ## Notes for contributors | ||
| - `testmd run` executes every suite and writes one receipt per suite under | ||
| `.testmd/receipts/` (add that directory to `.gitignore`). | ||
There was a problem hiding this comment. 💡 Quality: .testmd/receipts referenced but repo has no .gitignoreTESTING.md instructs contributors to add Add a .gitignore file (or entry) excluding the receipts directory.: Was this helpful? React with 👍 / 👎 | ||
| - A receipt is bound to the contract text AND the git commit it ran at; edit | ||
| either and the receipt goes stale — re-run. | ||
| - Optional suites (`required: false`) may fail without failing the gate. | ||
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: wave-av/sdk-python
Length of output: 2239
Authorization Bypass (CWE-862): Missing Authorization
Exploitability: Moderate
Block shell metacharacters in
npm test*.The whole-string wildcard allows
npm test && cat server.pem. Bash then executescat server.pem, bypassing the.pemread restriction. Require a valid argument boundary or use command-aware matching.🤖 Prompt for AI Agents