chirp-sync-static.test.ts

1// IV.7 — Static safety assertions for Chirp Sync.2// These tests read source files to enforce structural invariants that3// are cheaper to verify statically than to exercise at runtime.45import { describe, expect, it } from "vitest";6import { readFileSync } from "node:fs";7import { resolve } from "node:path";89const here = __dirname;10const src = (rel: string) => readFileSync(resolve(here, rel), "utf8");1112describe("Chirp Sync — static safety assertions", () => {13  it("no WebSocket server in any browser-extension sync source file", () => {14    const files = [15      "./sync-trigger.ts",16      "./chirp-sync-runner.ts",17      "./chirp-sync-coordinator.ts",18      "./chirp-sync-vault-adapter.ts",19      "../shared/chirp-sync-transport.ts",20    ];21    const forbidden = /WebSocketServer|wss\.listen|createServer|http\.listen|net\.listen/;22    for (const f of files) {23      expect(src(f), `${f} must not start a WebSocket server`).not.toMatch(forbidden);24    }25  });2627  it("applyMergedRemoteEntries does not call fireSyncTrigger or TRIGGER_SYNC", () => {28    const vaultSrc = src("./vault.ts");29    const fnStart = vaultSrc.indexOf("applyMergedRemoteEntries");30    expect(fnStart, "applyMergedRemoteEntries must exist in vault.ts").toBeGreaterThan(-1);31    // Grab a generous slice starting from the function — large enough to cover32    // the implementation but not so large that it bleeds into unrelated code.33    const fnBody = vaultSrc.slice(fnStart, fnStart + 4000);34    expect(fnBody).not.toMatch(/triggerSyncIfReachable|TRIGGER_SYNC|fireSyncTrigger/);35  });3637  it("addEntryDirect / updateEntryDirect / deleteEntryDirect do not call fireSyncTrigger", () => {38    const vaultSrc = src("./vault.ts");39    for (const fn of ["addEntryDirect", "updateEntryDirect", "deleteEntryDirect"]) {40      const start = vaultSrc.indexOf(`function ${fn}`);41      if (start === -1) continue;42      // Slice up to the start of the very next export declaration so we don't43      // bleed into adjacent function bodies or their JSDoc comments.44      const nextExport = vaultSrc.indexOf("\nexport ", start + fn.length);45      const end = nextExport > start ? nextExport : start + 600;46      const body = vaultSrc.slice(start, end);47      expect(body, `${fn} must not call fireSyncTrigger`).not.toMatch(48        /triggerSyncIfReachable|TRIGGER_SYNC|fireSyncTrigger/,49      );50    }51  });5253  it("device registry is stored in chrome.storage.local, not chrome.storage.sync", () => {54    const registrySrc = src("./paired-devices.ts");55    expect(registrySrc).toContain("storage.local");56    expect(registrySrc).not.toMatch(57      /storage\.sync[^;]*peach_paired_devices|peach_paired_devices[^;]*storage\.sync/,58    );59  });6061  it("setSyncRunner and productionSyncRunner are called in entry.ts", () => {62    const entrySrc = src("./entry.ts");63    expect(entrySrc).toContain("setSyncRunner");64    expect(entrySrc).toContain("productionSyncRunner");65  });6667  it("sync-trigger syncs both direct and user-confirmed vouched hosts", () => {68    const triggerSrc = src("./sync-trigger.ts");69    expect(triggerSrc).toMatch(/trustSource === "direct"/);70    // Mesh introduction is pointless if a device the user confirmed out of the71    // MV-7 pending queue is then never dialled.72    expect(triggerSrc).toMatch(/trustSource === "vouched"/);73  });7475  it("the browser never listens — no pairing server or audio-chirp module survives", () => {76    const appSrc = src("../popup/App.tsx");77    expect(appSrc).not.toContain("startMDNSListener");78    expect(appSrc).not.toContain("openPairingServer");79    expect(appSrc).not.toContain("chirp-pair-capacitor");80    // Adoption dials out like everything else now.81    expect(appSrc).toContain("dialPairingChannel");82  });8384  it("vault_id uses the full 64-char BLAKE3 hex digest", () => {85    const identitySrc = src("../shared/sync-identity.ts");86    expect(identitySrc).toContain("VAULT_ID_HEX_LENGTH = 64");87    expect(identitySrc).not.toContain("VAULT_ID_HEX_LENGTH = 16");88  });8990  it("per-entry key derivation uses entryId as part of HKDF info", () => {91    const adapterSrc = src("./chirp-sync-vault-adapter.ts");92    expect(adapterSrc).toContain("ENTRY_KEY_INFO_SUFFIX");93    expect(adapterSrc).toContain("sync-entry-v1");94    // The info must be derived from entryId — look for the concat pattern.95    expect(adapterSrc).toMatch(/entryId.*ENTRY_KEY_INFO_SUFFIX|ENTRY_KEY_INFO_SUFFIX.*entryId/);96  });97});