mirror of
https://github.com/jnMetaCode/superpowers-zh.git
synced 2026-09-03 07:23:56 +08:00
8ca12c26e3
上游 v6.0.0 给 brainstorm 可视化伴侣服务器重写了安全模型：之前服务器
监听 loopback 但无任何鉴权，任意本地浏览器标签页都能读取 brainstorm
屏幕/文件、或向正在运行的 agent 会话注入事件（prompt injection）。新模型
用每会话密钥（?key=<token> 或会话 cookie）门禁所有端点，并加一组安全头
（X-Frame-Options: DENY、CSP frame-ancestors none、Cross-Origin-Resource-Policy
same-origin 等）。本 fork 此前停留在旧无鉴权版本。
改动（全部逐字节对齐上游 main，本 fork 在这些文件无中文/品牌定制）：
- skills/brainstorming/scripts/server.cjs：旧 354 行 → 723 行，新鉴权模型
- skills/brainstorming/scripts/{frame-template.html,helper.js}：v6 重构拆出的
独立模板/客户端 helper，旧版与新 server.cjs 不匹配会导致 UI 崩坏
- skills/brainstorming/scripts/{start,stop}-server.sh：随之更新
- tests/brainstorm-server/：同步上游全套测试（auth/branding/server/lifecycle/
helper/ws-protocol/browser-launcher 等），否则旧测试与新 server 不匹配
验证：tests/brainstorm-server 全套 npm test 通过，exit 0
（ws-protocol 32 / helper 15 / browser-launcher 3 / auth 20 / branding 7 /
server 33 / lifecycle 13 / start 4 / stop 7，0 failed）。所有 17 个文件
与上游 main 逐字节一致。
修复 CI「全量审计」中 brainstorm script 漂移项。关联 #19（v6 同步追踪）
116 lines
3.0 KiB
Bash
Executable File
116 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Fast tests for start-server.sh shell-only platform decisions.
|
|
set -uo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
|
|
START_SCRIPT="$REPO_ROOT/skills/brainstorming/scripts/start-server.sh"
|
|
|
|
TEST_DIR="${TMPDIR:-/tmp}/brainstorm-start-test-$$"
|
|
passed=0
|
|
failed=0
|
|
|
|
cleanup() {
|
|
rm -rf "$TEST_DIR"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
pass() {
|
|
echo " PASS: $1"
|
|
passed=$((passed + 1))
|
|
}
|
|
|
|
fail() {
|
|
echo " FAIL: $1"
|
|
echo " $2"
|
|
failed=$((failed + 1))
|
|
}
|
|
|
|
make_fake_uname() {
|
|
local fake_bin="$1"
|
|
cat > "$fake_bin/uname" <<'EOF'
|
|
#!/usr/bin/env bash
|
|
if [[ "${1:-}" == "-s" ]]; then
|
|
echo "MINGW64_NT-10.0"
|
|
else
|
|
/usr/bin/uname "$@"
|
|
fi
|
|
EOF
|
|
chmod +x "$fake_bin/uname"
|
|
}
|
|
|
|
echo ""
|
|
echo "--- start-server.sh platform detection ---"
|
|
|
|
mkdir -p "$TEST_DIR/fake-bin" "$TEST_DIR/project"
|
|
make_fake_uname "$TEST_DIR/fake-bin"
|
|
|
|
cat > "$TEST_DIR/fake-bin/node" <<'EOF'
|
|
#!/usr/bin/env bash
|
|
echo "CAPTURED_OWNER_PID=${BRAINSTORM_OWNER_PID:-__UNSET__}"
|
|
printf 'CAPTURED_ARGV=%s\n' "$@"
|
|
exit 0
|
|
EOF
|
|
chmod +x "$TEST_DIR/fake-bin/node"
|
|
|
|
captured=$(
|
|
PATH="$TEST_DIR/fake-bin:$PATH" \
|
|
MSYSTEM="" \
|
|
bash "$START_SCRIPT" --project-dir "$TEST_DIR/project" --foreground 2>/dev/null || true
|
|
)
|
|
owner_pid_value=$(echo "$captured" | grep "CAPTURED_OWNER_PID=" | head -1 | sed 's/CAPTURED_OWNER_PID=//')
|
|
|
|
if [[ "$owner_pid_value" == "" || "$owner_pid_value" == "__UNSET__" ]]; then
|
|
pass "clears BRAINSTORM_OWNER_PID when uname reports a Windows-like shell"
|
|
else
|
|
fail "clears BRAINSTORM_OWNER_PID when uname reports a Windows-like shell" \
|
|
"expected empty or unset, got '$owner_pid_value'"
|
|
fi
|
|
|
|
if echo "$captured" | grep -Eq '^CAPTURED_ARGV=--brainstorm-server-id=[A-Za-z0-9_-]{32,64}$'; then
|
|
pass "passes shell-safe server instance id argv"
|
|
else
|
|
fail "passes shell-safe server instance id argv" \
|
|
"expected exact --brainstorm-server-id=<safe id> argv line, got: $captured"
|
|
fi
|
|
|
|
server_id_file=$(find "$TEST_DIR/project/.superpowers/brainstorm" -name server-instance-id -print 2>/dev/null | head -1)
|
|
server_id_value=""
|
|
if [[ -n "$server_id_file" ]]; then
|
|
server_id_value="$(tr -d '\r\n' < "$server_id_file")"
|
|
fi
|
|
if [[ "$server_id_value" =~ ^[A-Za-z0-9_-]{32,64}$ ]]; then
|
|
pass "writes shell-safe server-instance-id state file"
|
|
else
|
|
fail "writes shell-safe server-instance-id state file" \
|
|
"expected valid id in state, got '$server_id_value'"
|
|
fi
|
|
|
|
rm -rf "$TEST_DIR/project"/*
|
|
|
|
cat > "$TEST_DIR/fake-bin/node" <<'EOF'
|
|
#!/usr/bin/env bash
|
|
echo "FOREGROUND_MODE=true"
|
|
exit 0
|
|
EOF
|
|
chmod +x "$TEST_DIR/fake-bin/node"
|
|
|
|
captured=$(
|
|
PATH="$TEST_DIR/fake-bin:$PATH" \
|
|
MSYSTEM="" \
|
|
bash "$START_SCRIPT" --project-dir "$TEST_DIR/project" 2>/dev/null || true
|
|
)
|
|
|
|
if echo "$captured" | grep -q "FOREGROUND_MODE=true"; then
|
|
pass "auto-foregrounds when uname reports a Windows-like shell"
|
|
else
|
|
fail "auto-foregrounds when uname reports a Windows-like shell" \
|
|
"expected foreground node path, got: $captured"
|
|
fi
|
|
|
|
echo ""
|
|
echo "--- Results: $passed passed, $failed failed ---"
|
|
if [[ $failed -gt 0 ]]; then
|
|
exit 1
|
|
fi
|