Function main

scripts/test-security.js:54–480

()

  }
}

function main() {
  console.log('\nCitadel Security Test Suite\n' + '='.repeat(40));

  // ── 1. Path Traversal Protection ──

  console.log('\n▶ Path Traversal Protection');

  test('protect-files blocks ../../../etc/passwd', () => {
    const input = JSON.stringify({
      tool_name: 'Edit',
      tool_input: { file_path: '../../../etc/passwd' }
    });

    const result = spawnSync(process.execPath, [PROTECT_FILES_HOOK], {
      input,
      encoding: 'utf8',
      cwd: PLUGIN_ROOT,
    });

    assert(result.status === 2, `Expected exit code 2 (block), got ${result.status}`);
    assert(
      result.stdout.includes('traversal') || result.stdout.includes('outside'),
      'Expected traversal violation message in stdout'
    );
  });

  test('protect-files blocks absolute path outside project', () => {
    const input = JSON.stringify({
      tool_name: 'Write',
      tool_input: { file_path: '/etc/passwd' }
    });

    const result = spawnSync(process.execPath, [PROTECT_FILES_HOOK], {
      input,
      encoding: 'utf8',
      cwd: PLUGIN_ROOT,
    });

    assert(result.status === 2, `Expected exit code 2 (block), got ${result.status}`);
  });

  test('protect-files allows absolute read outside project for non-env files', () => {
    const input = JSON.stringify({
      tool_name: 'Read',
      tool_input: { file_path: path.join(os.tmpdir(), `citadel-reference-${process.pid}.md`) }
    });

    const result = spawnSync(process.execPath, [PROTECT_FILES_HOOK], {
      input,
      encoding: 'utf8',
      cwd: PLUGIN_ROOT,
    });

    assert(result.status === 0, `Expected exit code 0 (allow), got ${result.status}: ${result.stdout}`);
  });

  test('protect-files allows legitimate project-relative path', () => {