refactor: export testable decision functions from content/index.ts for T-011-T-014 (v3.9.8)

@@ -0,0 +1,247 @@1+// T-009: License Ed25519 signature verification2+//3+// Why this test exists: validateLicense in license.ts has no direct test.4+// The only coverage it gets is via "isPro gate" tests that trigger the5+// pro-gate behavior — they don't actually verify that the Ed25519 signature6+// is checked correctly. A broken or short-circuited verifier would accept7+// any forged license string without a test failing.8+//9+// Integration contract note: T-009a–c (crypto paths) require the production10+// validateLicense to be refactored with an injectable public key, OR to export11+// a validateLicenseWithKey(keyString, pubKeyHex) helper. In the current12+// codebase, PUBLIC_KEY_HEX is read by a private function; the test below13+// uses a local reimplementation with an injected test key so real Ed2551914+// crypto is exercised without the production key.15+// The structural checks (T-009d/e) test the real export directly.16+17+import { beforeAll, describe, expect, it } from "vitest";18+import { validateLicense } from "./license";19+20+// ---------------------------------------------------------------------------21+// Base58 helpers (mirrored from license.ts for test use)22+// ---------------------------------------------------------------------------23+24+const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";25+26+function base58Encode(bytes: Uint8Array): string {27+  let num = 0n;28+  for (const b of bytes) num = num * 256n + BigInt(b);29+  let out = "";30+  while (num > 0n) {31+    out = BASE58_ALPHABET[Number(num % 58n)] + out;32+    num = num / 58n;33+  }34+  for (const b of bytes) {35+    if (b !== 0) break;36+    out = "1" + out;37+  }38+  return out;39+}40+41+function bytesToHex(bytes: Uint8Array): string {42+  return Array.from(bytes).map(b => b.toString(16).padStart(2, "0")).join("");43+}44+45+function hexToBytes(hex: string): Uint8Array {46+  const out = new Uint8Array(hex.length / 2);47+  for (let i = 0; i < hex.length; i += 2) out[i / 2] = parseInt(hex.slice(i, i + 2), 16);48+  return out;49+}50+51+// ---------------------------------------------------------------------------52+// Test keypair and license builder53+// ---------------------------------------------------------------------------54+55+let testPrivKey: CryptoKey;56+let testPubKeyHex: string;57+58+// Build a valid 76-byte license blob: 12-byte payload + 64-byte Ed25519 sig.59+// payload: [0x01, 0x01, 0x01, days(4 bytes LE), 0x00×5]60+async function buildTestLicense(61+  privKey: CryptoKey,62+  opts: { tamperPayloadByte?: number; tamperSigByte?: number } = {},63+): Promise<string> {64+  const payload = new Uint8Array(12);65+  payload[0] = 0x01; // version66+  payload[1] = 0x01; // plan marker67+  payload[2] = 0x01; // variant marker68+  const issuedDays = Math.floor(Date.now() / (86400 * 1000));69+  new DataView(payload.buffer).setUint32(3, issuedDays, true);70+  // bytes 7–11: reserved zeros71+72+  // Sign the original payload first; tamper happens on the assembled blob below73+  // so the signature binds to the un-tampered bytes, causing verify to fail.74+  const sigBytes = new Uint8Array(75+    await crypto.subtle.sign("Ed25519", privKey, payload),76+  );77+78+  if (opts.tamperSigByte !== undefined) {79+    sigBytes[opts.tamperSigByte] ^= 0x01;80+  }81+82+  const blob = new Uint8Array(76);83+  blob.set(payload, 0);84+  blob.set(sigBytes, 12);85+86+  if (opts.tamperPayloadByte !== undefined) {87+    blob[opts.tamperPayloadByte] ^= 0x01;88+  }89+90+  // Format as "PPK-AAAAA-BBBBB-CCCCC-DDDDD-EEEEE"91+  // The actual license format is 5 base58 groups; for testing we can use92+  // a single continuous base58 string split into 5 equal groups.93+  const b58 = base58Encode(blob);94+  // Pad to ensure we can split into 5 groups (actual production code joins them)95+  const chunk = Math.ceil(b58.length / 5);96+  const groups = Array.from({ length: 5 }, (_, i) => b58.slice(i * chunk, (i + 1) * chunk));97+  return "PPK-" + groups.join("-");98+}99+100+// validateLicense variant that uses a test public key instead of the production key.101+// This re-implements the license.ts logic with an injected key for test isolation.102+async function validateLicenseWithKey(103+  keyString: string,104+  pubKeyHex: string,105+): Promise<{ valid: boolean; plan: string }> {106+  const LICENSE_PREFIX = "PPK-";107+  if (!keyString || !keyString.trim().startsWith(LICENSE_PREFIX)) {108+    return { valid: false, plan: "free" };109+  }110+  try {111+    const withoutPrefix = keyString.trim().slice(LICENSE_PREFIX.length);112+    const groups = withoutPrefix.split("-");113+    if (groups.length !== 5) return { valid: false, plan: "free" };114+    const b58 = groups.join("");115+    // base58 decode116+    let num = 0n;117+    for (const char of b58) {118+      const idx = BASE58_ALPHABET.indexOf(char);119+      if (idx === -1) return { valid: false, plan: "free" };120+      num = num * 58n + BigInt(idx);121+    }122+    const hexStr = num.toString(16);123+    const paddedHex = hexStr.length % 2 ? "0" + hexStr : hexStr;124+    const decoded = new Uint8Array(paddedHex.length / 2);125+    for (let i = 0; i < paddedHex.length; i += 2) {126+      decoded[i / 2] = parseInt(paddedHex.slice(i, i + 2), 16);127+    }128+    if (decoded.length !== 76) return { valid: false, plan: "free" };129+130+    const payload = decoded.slice(0, 12);131+    const signature = decoded.slice(12, 76);132+133+    if (payload[0] !== 0x01 || payload[1] !== 0x01 || payload[2] !== 0x01) {134+      return { valid: false, plan: "free" };135+    }136+137+    const pubKey = await (crypto.subtle as Record<string, Function>).importKey(138+      "raw",139+      hexToBytes(pubKeyHex),140+      { name: "Ed25519" },141+      true,142+      ["verify"],143+    ) as CryptoKey;144+145+    const isValid = await (crypto.subtle as Record<string, Function>).verify(146+      "Ed25519",147+      pubKey,148+      signature,149+      payload,150+    ) as boolean;151+152+    return isValid ? { valid: true, plan: "pro" } : { valid: false, plan: "free" };153+  } catch {154+    return { valid: false, plan: "free" };155+  }156+}157+158+// ---------------------------------------------------------------------------159+// Tests160+// ---------------------------------------------------------------------------161+162+describe("T-009: License Ed25519 signature verification", () => {163+  beforeAll(async () => {164+    const kp = await crypto.subtle.generateKey(165+      "Ed25519",166+      true,167+      ["sign", "verify"],168+    );169+    testPrivKey = (kp as CryptoKeyPair).privateKey;170+    const rawPub = new Uint8Array(171+      await crypto.subtle.exportKey("raw", (kp as CryptoKeyPair).publicKey),172+    );173+    testPubKeyHex = bytesToHex(rawPub);174+  });175+176+  // T-009a: valid license payload + valid Ed25519 signature → verification succeeds.177+  // Bug this catches: a broken verifier (wrong algorithm, missing verify call,178+  // always-false return) would reject all licenses.179+  it("T-009a: valid license payload + valid Ed25519 signature → verification succeeds", async () => {180+    const license = await buildTestLicense(testPrivKey);181+    const result = await validateLicenseWithKey(license, testPubKeyHex);182+    expect(result.valid).toBe(true);183+    expect(result.plan).toBe("pro");184+  });185+186+  // T-009b: flipping the last byte of the signature invalidates it.187+  // Bug this catches: a verifier that doesn't call crypto.subtle.verify, or188+  // that ignores the result, would accept this tampered signature.189+  it("T-009b: tampered last byte of signature → verification fails", async () => {190+    const license = await buildTestLicense(testPrivKey, { tamperSigByte: 63 });191+    const result = await validateLicenseWithKey(license, testPubKeyHex);192+    expect(result.valid).toBe(false);193+  });194+195+  // T-009c: a single changed byte in the payload invalidates the signature.196+  // Bug this catches: a verifier that doesn't bind the signature to the payload197+  // would accept a payload with different data (e.g., injected plan byte).198+  it("T-009c: tampered payload byte → verification fails", async () => {199+    // Tamper byte 5 (part of the issuedDays field — always non-zero for recent dates)200+    const license = await buildTestLicense(testPrivKey, { tamperPayloadByte: 5 });201+    const result = await validateLicenseWithKey(license, testPubKeyHex);202+    // The signature was computed over the original payload; a changed payload203+    // produces a mismatch.204+    // Note: if the tampered byte happens to produce the same value (XOR 0x01 on 0x00205+    // changes to 0x01, but the odds of the verify still passing are astronomically small).206+    expect(result.valid).toBe(false);207+  });208+209+  // T-009d: wrong prefix — tests the real validateLicense export.210+  // The prefix check fires before any base58 decode or crypto, so this is211+  // safe to test against the production export.212+  it("T-009d: license without PPK- prefix → validation fails before signature check", async () => {213+    const result = await validateLicense("NOTPPK-AAAAA-BBBBB-CCCCC-DDDDD-EEEEE");214+    expect(result.valid).toBe(false);215+    expect(result.plan).toBe("free");216+  });217+218+  // T-009e: signature too short (truncated to < 64 bytes) — must be handled219+  // gracefully. This tests the 76-byte length check and the try/catch.220+  it("T-009e: signature too short (truncated blob) → handled gracefully, does not throw", async () => {221+    // Build a blob that's only 40 bytes (shorter than 76) and base58-encode it.222+    const short = new Uint8Array(40).fill(0x01);223+    const b58 = base58Encode(short);224+    const chunk = Math.ceil(b58.length / 5);225+    const groups = Array.from({ length: 5 }, (_, i) => b58.slice(i * chunk, (i + 1) * chunk));226+    const license = "PPK-" + groups.join("-");227+228+    const result = await validateLicense(license);229+    expect(result.valid).toBe(false);230+    expect(result.plan).toBe("free");231+  });232+233+  // T-009f: isPro returns true after a valid license is stored.234+  // This wires validateLicense to the chrome.storage path via getLicenseInfo.235+  // Integration contract: this test requires a chrome.storage mock.236+  // (Skipped in the current draft — add chrome mock via the vault test pattern.)237+  it.todo("T-009f: isPro returns true after valid license storage (requires chrome mock)");238+239+  // T-009g: isPro returns false after invalid license verification.240+  it.todo("T-009g: isPro returns false after invalid license (requires chrome mock)");241+242+  // T-009h: wrong group count (4 groups instead of 5) is caught before crypto.243+  it("T-009h: wrong group count → fails before crypto", async () => {244+    const result = await validateLicense("PPK-AAAA-BBBB-CCCC-DDDD");245+    expect(result.valid).toBe(false);246+  });247+});

@@ -0,0 +1,198 @@1+// T-008: PCH-01-016 batch-add canary/tag sanitization2+//3+// Why this test exists: the MV-6 import whitelist was applied to the4+// RESTORE_ENTRIES path (vault.restoreEntries) but the BATCH_ADD_ENTRIES5+// path was a separate code path that also called sanitizeEntryDraft.6+// PCH-01-016 added sanitizeCanary and sanitizeTags to sanitizeEntryDraft7+// so both entry-add paths apply the same sanitization. This is the actual8+// attacker-reachable bulk surface — a content-script XSS or a rogue extension9+// API caller could POST to BATCH_ADD_ENTRIES with a poisoned canary webhook10+// URL or unbounded tags. No test previously exercised this path.11+12+import { beforeEach, describe, expect, it, vi } from "vitest";13+14+type StorageShape = Record<string, unknown>;15+16+describe("T-008: PCH-01-016 batch-add canary/tag sanitization", () => {17+  let storage: StorageShape;18+  let vault: typeof import("./vault");19+20+  beforeEach(async () => {21+    vi.resetModules();22+    storage = {};23+24+    const chromeMock = {25+      storage: {26+        local: {27+          get: vi.fn(async (key?: string | string[]) => {28+            if (!key) return storage;29+            if (typeof key === "string") return { [key]: storage[key] };30+            return (Array.isArray(key) ? key : [key]).reduce<StorageShape>(31+              (acc, k) => { acc[k] = storage[k]; return acc; },32+              {},33+            );34+          }),35+          set: vi.fn(async (next: StorageShape) => { Object.assign(storage, next); }),36+          remove: vi.fn(async (keys: string | string[]) => {37+            const ks = Array.isArray(keys) ? keys : [keys];38+            for (const k of ks) delete storage[k];39+          }),40+        },41+        session: {42+          get: vi.fn(async () => ({})),43+          set: vi.fn(async () => {}),44+          remove: vi.fn(async () => {}),45+        },46+      },47+      alarms: {48+        clear: vi.fn(),49+        create: vi.fn(),50+        onAlarm: { addListener: vi.fn() },51+      },52+      idle: {53+        setDetectionInterval: vi.fn(),54+        onStateChanged: { addListener: vi.fn() },55+      },56+    } as unknown as typeof chrome;57+58+    (globalThis as Record<string, unknown>).chrome = chromeMock;59+    vi.stubGlobal("fetch", vi.fn(async () => { throw new Error("no network"); }));60+61+    vault = await import("./vault");62+    await vault.createVault("test-batch-sanitize-pass");63+  });64+65+  // T-008a: non-HTTPS canary webhook URL is stripped from the entry.66+  // The entry itself must be saved (canary stripped, not entry rejected).67+  // Bug this catches: a poisoned canary could exfiltrate entry titles to an68+  // attacker-controlled endpoint; HTTP (non-TLS) allows plaintext interception.69+  it("T-008a: non-HTTPS canary webhook stripped (entry saved, canary absent)", async () => {70+    const added = await vault.batchAddEntries([71+      {72+        type: "login",73+        title: "Canary Test",74+        username: "u",75+        password: "p",76+        url: "https://example.com",77+        canary: { webhookUrl: "http://attacker.example.com/steal" },78+      },79+    ]);80+81+    expect(added).toHaveLength(1);82+    expect(added[0].title).toBe("Canary Test");83+    // Bug this catches: non-HTTPS canary passes through and gets stored84+    expect(added[0].canary).toBeUndefined();85+  });86+87+  // T-008b: HTTPS canary webhook URL is preserved.88+  // This is the "legitimate canary" control case — HTTPS webhooks must work.89+  it("T-008b: HTTPS canary webhook URL is preserved", async () => {90+    const added = await vault.batchAddEntries([91+      {92+        type: "login",93+        title: "Legit Canary",94+        username: "u",95+        password: "p",96+        url: "https://example.com",97+        canary: { webhookUrl: "https://legit.example.com/notify" },98+      },99+    ]);100+101+    expect(added).toHaveLength(1);102+    expect(added[0].canary?.webhookUrl).toBe("https://legit.example.com/notify");103+  });104+105+  // T-008c: tags are capped at 255 items and each tag is capped at 256 chars.106+  // Bug this catches: unbounded tags could consume storage quota or cause UI107+  // rendering issues; server-side (sync) tags that exceed the codec cap could108+  // break Codex encode/decode.109+  it("T-008c: oversized tags array is capped at 255 items", async () => {110+    const massiveTags = Array.from({ length: 500 }, (_, i) => `tag-${i}`);111+    const added = await vault.batchAddEntries([112+      {113+        type: "login",114+        title: "Tag Test",115+        username: "u",116+        password: "p",117+        url: "https://example.com",118+        tags: massiveTags,119+      },120+    ]);121+122+    expect(added).toHaveLength(1);123+    expect(added[0].tags!.length).toBeLessThanOrEqual(255);124+  });125+126+  it("T-008c: individual tag exceeding 256 chars is truncated to 256 chars", async () => {127+    const longTag = "x".repeat(300);128+    const added = await vault.batchAddEntries([129+      {130+        type: "login",131+        title: "Long Tag Test",132+        username: "u",133+        password: "p",134+        url: "https://example.com",135+        tags: [longTag],136+      },137+    ]);138+139+    expect(added).toHaveLength(1);140+    expect(added[0].tags![0].length).toBeLessThanOrEqual(256);141+  });142+143+  // T-008d: __proto__ key in entry payload must not appear on the saved entry.144+  // Bug this catches: prototype pollution via imported entries; normalizeEntry145+  // whitelists only known fields so __proto__ should be dropped entirely.146+  it("T-008d: __proto__ key in payload is absent from the saved entry", async () => {147+    const maliciousDraft = {148+      type: "login" as const,149+      title: "Proto Test",150+      username: "u",151+      password: "p",152+      url: "https://example.com",153+      // TypeScript won't let us assign __proto__ directly, so cast154+      ...({ __proto__: { poisoned: true } } as object),155+    };156+157+    const added = await vault.batchAddEntries([maliciousDraft]);158+    expect(added).toHaveLength(1);159+    // Bug this catches: prototype pollution persists in the saved entry160+    expect((added[0] as Record<string, unknown>).poisoned).toBeUndefined();161+    expect(Object.getPrototypeOf(added[0])).toBe(Object.prototype);162+  });163+164+  // T-008e: passkey entry with missing credentialId is rejected.165+  // sanitizeEntryDraft validates the passkey sub-object; a passkey without a166+  // credentialId cannot be used for authentication and must not silently import167+  // as a broken credential.168+  it("T-008e: passkey entry missing credentialId is rejected (null from sanitizeEntryDraft)", async () => {169+    const added = await vault.batchAddEntries([170+      {171+        type: "login" as const,172+        title: "Bad Passkey",173+        username: "u",174+        password: "",175+        url: "https://example.com",176+        passkey: {177+          rpId: "example.com",178+          rpName: "Example",179+          credentialId: "", // empty — invalid180+          publicKeyCose: "a401020326",181+          privateKeyJwk: { kty: "EC", crv: "P-256" },182+          userHandle: "uh",183+          userName: "user",184+          userDisplayName: "User",185+          algorithm: -7 as const,186+          signCount: 0,187+          aaguid: "AAAAAAAAAAAAAAAAAAAAAA",188+          backupEligible: false,189+          backupState: false,190+          createdAt: Date.now(),191+        },192+      },193+    ]);194+195+    // The entry should be skipped (batchAddEntries silently drops invalid drafts)196+    expect(added).toHaveLength(0);197+  });198+});

@@ -0,0 +1,257 @@1+// T-005: peachPayload declared-length decompression bomb (MV-4)2+//3+// Why this test exists: MV-4 added two guards in peachPayload.ts's section4+// parsing loop:5+//   1. length > MAX_DECLARED_LENGTH → throw BEFORE calling decompressZstd6+//   2. totalDecompressed > MAX_DECOMPRESSED_BYTES → throw BEFORE calling7+//      decompressZstd on the next section8+//9+// The existing decompression-bomb.test.ts only exercises the zstd output cap10+// (MAX_DECOMPRESSED_BYTES applied inside decompressZstd itself). It does NOT11+// test that the *declared-length* field check fires before decompression is12+// attempted. Without this test, the declared-length guard could be removed13+// (allowing a 100-byte section to claim a 100 GiB decompressed size) and no14+// existing test would fail — because if the zstd frame is honest the output15+// cap catches it, but the declared-length check is the FIRST line of defense16+// and exists to reject before even calling the decompressor.17+18+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";19+import { argon2id, blake3 } from "hash-wasm";20+21+// Spy on decompressZstd before it is imported by peachPayload.22+// vi.mock is hoisted to the top of the file so the spy is in place23+// before any module that imports decompressZstd is evaluated.24+vi.mock("./zstd", async (importOriginal) => {25+  const mod = await importOriginal<typeof import("./zstd")>();26+  return {27+    ...mod,28+    decompressZstd: vi.fn(mod.decompressZstd),29+  };30+});31+32+import { parsePayload } from "./peachPayload";33+import { decompressZstd } from "./zstd";34+import { IMPORT_LIMITS } from "../shared/import-limits";35+36+// ---------------------------------------------------------------------------37+// Helpers38+// ---------------------------------------------------------------------------39+40+const PASSPHRASE = "test-bomb-passphrase";41+42+// Argon2id parameters must match peachPayload.ts exactly or decryption fails.43+const ARGON2_PARAMS = {44+  parallelism: 4,45+  iterations: 3,46+  memorySize: 65536, // 64 MiB47+  hashLength: 32,48+} as const;49+50+function concat(arrays: Uint8Array[]): Uint8Array {51+  const total = arrays.reduce((s, a) => s + a.length, 0);52+  const out = new Uint8Array(total);53+  let cursor = 0;54+  for (const a of arrays) { out.set(a, cursor); cursor += a.length; }55+  return out;56+}57+58+function hexToBytes(hex: string): Uint8Array {59+  const out = new Uint8Array(hex.length / 2);60+  for (let i = 0; i < hex.length; i += 2) {61+    out[i / 2] = parseInt(hex.slice(i, i + 2), 16);62+  }63+  return out;64+}65+66+/**67+ * Build a fully-encrypted peachPayload envelope whose section header68+ * declares `declaredLength` for the decompressed size. The compressed69+ * data is a minimal zstd frame so the structure parses, but the70+ * declared-length check fires first.71+ *72+ * By constructing the payload ourselves (using the same Argon2id KDF and73+ * AES-GCM as peachPayload.ts), we avoid mocking the crypto layer while74+ * still controlling the section header bytes.75+ */76+async function buildBombPayload(77+  passphrase: string,78+  declaredLength: number,79+  sectionCount = 1,80+): Promise<Uint8Array> {81+  const MAGIC = 0x50434853; // "PCHS"82+  const VERSION = 0x01;83+  const FORMAT_V3 = 0x03;84+  const SECTION_ENTRIES = 0x01;85+  const CHECKSUM_LEN = 4;86+87+  // Valid zstd frame for compress(new Uint8Array([0x00]), 1).88+  // Generated via @bokuweb/zstd-wasm compress([0x00], 1) → decompresses to 1 zero byte.89+  const minimalCompressed = new Uint8Array([90+    0x28, 0xb5, 0x2f, 0xfd, 0x20, 0x01, 0x09, 0x00, 0x00, 0x00,91+  ]);92+93+  // Build section: type(1) + declared_length(4 LE) + compressed_length(4 LE) + data94+  const sections: Uint8Array[] = [];95+  for (let i = 0; i < sectionCount; i++) {96+    const sec = new Uint8Array(9 + minimalCompressed.length);97+    sec[0] = SECTION_ENTRIES;98+    new DataView(sec.buffer).setUint32(1, declaredLength, true);99+    new DataView(sec.buffer).setUint32(5, minimalCompressed.length, true);100+    sec.set(minimalCompressed, 9);101+    sections.push(sec);102+  }103+104+  // Build body: header(8) + sections105+  const header = new Uint8Array(8);106+  new DataView(header.buffer).setUint32(0, MAGIC, false);107+  header[4] = VERSION;108+  header[5] = sections.length;109+  const body = concat([header, ...sections]);110+111+  // BLAKE3 checksum (first 4 bytes of the 32-byte hash)112+  const checksumHex = await blake3(body, 32);113+  const checksum = hexToBytes(checksumHex).slice(0, CHECKSUM_LEN);114+115+  const inner = concat([body, checksum]);116+117+  // v3 format wrapper: [FORMAT_V3(1)][inner_len(4 LE)][inner]118+  const wrapper = new Uint8Array(5);119+  wrapper[0] = FORMAT_V3;120+  new DataView(wrapper.buffer).setUint32(1, inner.length, true);121+  const plaintext = concat([wrapper, inner]);122+123+  // Derive the encryption key (same Argon2id params as peachPayload.ts)124+  const salt = new Uint8Array(16).fill(0x42); // deterministic for tests125+  const nonce = new Uint8Array(12).fill(0x13);126+  const keyBytes = await argon2id({127+    password: passphrase.normalize("NFC"),128+    salt,129+    ...ARGON2_PARAMS,130+    outputType: "binary",131+  });132+133+  // AES-256-GCM encrypt134+  const cryptoKey = await crypto.subtle.importKey(135+    "raw",136+    keyBytes.buffer as ArrayBuffer,137+    { name: "AES-GCM", length: 256 },138+    false,139+    ["encrypt"],140+  );141+  const rawCt = new Uint8Array(142+    await crypto.subtle.encrypt(143+      { name: "AES-GCM", iv: nonce.buffer as ArrayBuffer, tagLength: 128 },144+      cryptoKey,145+      plaintext.buffer.slice(146+        plaintext.byteOffset,147+        plaintext.byteOffset + plaintext.byteLength,148+      ) as ArrayBuffer,149+    ),150+  );151+  // WebCrypto appends the 16-byte tag to the ciphertext.152+  // peachPayload's format: salt(16) + nonce(12) + ciphertext + tag(16)153+  const ciphertext = rawCt.slice(0, rawCt.length - 16);154+  const tag = rawCt.slice(rawCt.length - 16);155+  return concat([salt, nonce, ciphertext, tag]);156+}157+158+// ---------------------------------------------------------------------------159+// Tests160+// ---------------------------------------------------------------------------161+162+describe("T-005: peachPayload declared-length decompression bomb (MV-4)", () => {163+  beforeEach(() => {164+    vi.clearAllMocks();165+  });166+167+  afterEach(() => {168+    vi.clearAllMocks();169+  });170+171+  // T-005a: a single section declaring length > MAX_DECLARED_LENGTH must throw172+  // BEFORE decompressZstd is called. The spy on decompressZstd must not be173+  // invoked — the guard fires at the declared-length check, not at inflate time.174+  it("T-005a: declared length > MAX_DECLARED_LENGTH throws before decompressZstd", async () => {175+    const bombPayload = await buildBombPayload(176+      PASSPHRASE,177+      IMPORT_LIMITS.MAX_DECLARED_LENGTH + 1,178+    );179+180+    const decompress = decompressZstd as ReturnType<typeof vi.fn>;181+    decompress.mockClear();182+183+    await expect(parsePayload(bombPayload, PASSPHRASE)).rejects.toThrow(184+      /IMPORT_TOO_LARGE/,185+    );186+187+    // Bug this catches: if the declared-length check is removed, decompressZstd188+    // would be called and this assertion would fail.189+    expect(decompress).not.toHaveBeenCalled();190+  }, 30_000); // Argon2id is slow191+192+  // T-005b: multiple sections summing to > MAX_DECOMPRESSED_BYTES must reject193+  // even if each individual section is under MAX_DECLARED_LENGTH.194+  // We use 2 sections each declaring half + 1 of MAX so the running total195+  // exceeds MAX_DECOMPRESSED_BYTES on the second section.196+  //197+  // Section 0's decompressZstd call is mocked to return exactly `half` bytes198+  // so the declared/actual check passes and section 0 completes cleanly.199+  // The cumulative check then fires for section 1 BEFORE its decompressZstd200+  // call — verifiable by asserting the spy was called exactly once.201+  it("T-005b: cumulative section sum > MAX_DECOMPRESSED_BYTES throws before decompress", async () => {202+    const half = Math.floor(IMPORT_LIMITS.MAX_DECOMPRESSED_BYTES / 2) + 1;203+    const bombPayload = await buildBombPayload(PASSPHRASE, half, 2);204+205+    const decompress = decompressZstd as ReturnType<typeof vi.fn>;206+    decompress.mockClear();207+    // Let section 0 decompress "successfully" to the declared length so the208+    // SECTION_LENGTH_MISMATCH guard doesn't fire before the cumulative check.209+    decompress.mockImplementationOnce(async () => new Uint8Array(half));210+211+    await expect(parsePayload(bombPayload, PASSPHRASE)).rejects.toThrow(212+      /IMPORT_TOO_LARGE/,213+    );214+    // The cumulative check fired for section 1 before its decompressZstd call.215+    // If this were 2, the guard failed to stop the second decompress.216+    expect(decompress).toHaveBeenCalledTimes(1);217+  }, 30_000);218+219+  // T-005c: a section declaring exactly MAX_DECLARED_LENGTH - 1 is at the220+  // boundary and must NOT throw on the declared-length check alone.221+  // (The actual decompression may fail for other reasons — zstd output cap,222+  // or decompressed size mismatch — but not on the declared-length guard.)223+  it("T-005c: declared length at MAX_DECLARED_LENGTH - 1 passes the declared-length check", async () => {224+    const justUnder = IMPORT_LIMITS.MAX_DECLARED_LENGTH - 1;225+    const bombPayload = await buildBombPayload(PASSPHRASE, justUnder);226+227+    // Should NOT throw IMPORT_TOO_LARGE for the declared-length reason.228+    // It may fail with SECTION_LENGTH_MISMATCH, a zstd error, or PAYLOAD_TOO_SHORT —229+    // any proves the declared-length guard (which throws IMPORT_TOO_LARGE) did NOT fire.230+    const err = await parsePayload(bombPayload, PASSPHRASE).catch((e: Error) => e);231+    expect(err).toBeInstanceOf(Error);232+    expect((err as Error).message).not.toMatch(/IMPORT_TOO_LARGE/);233+  }, 30_000);234+235+  // T-005d: the size check fires before AES-GCM authentication failure.236+  // (This is implicitly tested by T-005a: we decrypt successfully and THEN237+  // the size check fires. If the order were reversed, the AES-GCM tag would238+  // need to match before we could tamper with the payload, which is a239+  // contradiction. The actual order is: AES-GCM decrypt → declared-length check.)240+  // This test documents the ordering explicitly.241+  it("T-005d: AES-GCM decryption succeeds; bomb is rejected at the section-size guard", async () => {242+    const bombPayload = await buildBombPayload(243+      PASSPHRASE,244+      IMPORT_LIMITS.MAX_DECLARED_LENGTH + 1,245+    );246+247+    // The error must be IMPORT_TOO_LARGE (size guard), not INVALID_PASSPHRASE248+    // (auth tag failure). This confirms the payload decrypts successfully before249+    // the bomb is detected.250+    await expect(parsePayload(bombPayload, PASSPHRASE)).rejects.toThrow(251+      /IMPORT_TOO_LARGE/,252+    );253+    await expect(parsePayload(bombPayload, PASSPHRASE)).rejects.not.toThrow(254+      /INVALID_PASSPHRASE/,255+    );256+  }, 30_000);257+});

@@ -0,0 +1,139 @@1+// T-004: TOTP RFC 6238 known-answer vectors2+//3+// Why this test exists: the TOTP implementation delegates to the `otpauth`4+// library. Without independent RFC vectors, a library regression (wrong5+// byte-order, wrong HMAC variant, wrong time-step math) ships a wrong 2FA6+// code silently — users are locked out of every TOTP-protected account with7+// no failing test to catch it. RFC 6238 Appendix B vectors are the canonical8+// ground truth for this check.9+10+import { describe, expect, it } from "vitest";11+import { TOTP, Secret } from "otpauth";12+13+// RFC 6238 Appendix B test secrets are ASCII byte strings, not base32.14+// otpauth treats plain strings as base32, so we use Secret.fromHex with15+// the hex encoding of the ASCII bytes to pass raw bytes unambiguously.16+function asciiToHex(s: string): string {17+  return Array.from(s).map(c => c.charCodeAt(0).toString(16).padStart(2, "0")).join("");18+}19+20+const RFC_SECRET_SHA1   = Secret.fromHex(asciiToHex("12345678901234567890"));21+const RFC_SECRET_SHA256 = Secret.fromHex(asciiToHex("12345678901234567890123456789012"));22+const RFC_SECRET_SHA512 = Secret.fromHex(asciiToHex("1234567890123456789012345678901234567890123456789012345678901234"));23+24+// Helper: call otpauth's generate with a pinned Unix timestamp (in seconds).25+function generateAt(secret: Secret, algorithm: string, digits: number, period: number, t: number): string {26+  const totp = new TOTP({ secret, algorithm, digits, period });27+  return totp.generate({ timestamp: t * 1000 });28+}29+30+describe("T-004: TOTP RFC 6238 known-answer vectors", () => {31+  // T-004a: RFC 6238 Appendix B SHA-1 vectors.32+  // The secret is the 20-byte ASCII string "12345678901234567890".33+  // Each vector uses 8 digits and a 30-second period.34+  //35+  // Bug this catches: wrong HMAC variant, wrong byte-order in counter,36+  // truncation off-by-one, or library API regression.37+  describe("T-004a: RFC 6238 SHA-1 vectors (8 digits, 30s period)", () => {38+    const sha1Vectors: Array<{ t: number; expected: string }> = [39+      { t: 59,           expected: "94287082" },40+      { t: 1111111109,   expected: "07081804" },41+      { t: 1111111111,   expected: "14050471" },42+      { t: 1234567890,   expected: "89005924" },43+      { t: 2000000000,   expected: "69279037" },44+      { t: 20000000000,  expected: "65353130" },45+    ];46+47+    for (const { t, expected } of sha1Vectors) {48+      it(`t=${t} → ${expected}`, () => {49+        const code = generateAt(RFC_SECRET_SHA1, "SHA1", 8, 30, t);50+        expect(code).toBe(expected);51+      });52+    }53+  });54+55+  // T-004a (SHA-256): RFC 6238 Appendix B SHA-256 vectors.56+  // The SHA-256 secret is the 32-byte ASCII string repeated from the same base.57+  describe("T-004a: RFC 6238 SHA-256 vectors (8 digits, 30s period)", () => {58+    const sha256Vectors: Array<{ t: number; expected: string }> = [59+      { t: 59,           expected: "46119246" },60+      { t: 1111111109,   expected: "68084774" },61+      { t: 1111111111,   expected: "67062674" },62+      { t: 1234567890,   expected: "91819424" },63+      { t: 2000000000,   expected: "90698825" },64+      { t: 20000000000,  expected: "77737706" },65+    ];66+67+    for (const { t, expected } of sha256Vectors) {68+      it(`t=${t} → ${expected}`, () => {69+        const code = generateAt(RFC_SECRET_SHA256, "SHA256", 8, 30, t);70+        expect(code).toBe(expected);71+      });72+    }73+  });74+75+  // T-004a (SHA-512): RFC 6238 Appendix B SHA-512 vectors.76+  describe("T-004a: RFC 6238 SHA-512 vectors (8 digits, 30s period)", () => {77+    const sha512Vectors: Array<{ t: number; expected: string }> = [78+      { t: 59,           expected: "90693936" },79+      { t: 1111111109,   expected: "25091201" },80+      { t: 1111111111,   expected: "99943326" },81+      { t: 1234567890,   expected: "93441116" },82+      { t: 2000000000,   expected: "38618901" },83+      { t: 20000000000,  expected: "47863826" },84+    ];85+86+    for (const { t, expected } of sha512Vectors) {87+      it(`t=${t} → ${expected}`, () => {88+        const code = generateAt(RFC_SECRET_SHA512, "SHA512", 8, 30, t);89+        expect(code).toBe(expected);90+      });91+    }92+  });93+94+  // T-004b: period boundary roll.95+  // t=29 is in period-counter 0 (floor(29/30) = 0).96+  // t=30 is in period-counter 1 (floor(30/30) = 1).97+  // They must produce DIFFERENT codes; this pins the "30-second window"98+  // boundary and would catch a truncation error that keeps counter=0 for t=30.99+  it("T-004b: period-boundary roll — t=29 and t=30 produce different codes", () => {100+    const code29 = generateAt(RFC_SECRET_SHA1, "SHA1", 6, 30, 29);101+    const code30 = generateAt(RFC_SECRET_SHA1, "SHA1", 6, 30, 30);102+    expect(code29).not.toBe(code30);103+  });104+105+  // T-004c: parseOtpauthURI correctly extracts algorithm, digits, and period.106+  // This is the real entry point for TOTP entries imported from an authenticator107+  // app. A missing or wrong field silently produces wrong codes.108+  it("T-004c: parseOtpauthURI extracts algorithm, digits, and period", async () => {109+    const { parseOtpauthURI } = await import("./totp");110+    const uri = "otpauth://totp/Example:[email protected]?secret=JBSWY3DPEHPK3PXP&algorithm=SHA256&digits=8&period=60&issuer=Example";111+    const params = parseOtpauthURI(uri);112+113+    expect(params).not.toBeNull();114+    expect(params!.algorithm).toBe("SHA256");115+    expect(params!.digits).toBe(8);116+    expect(params!.period).toBe(60);117+    expect(params!.secret).toBeTruthy();118+  });119+120+  // T-004d: non-standard period (60s) produces the correct code.121+  // t=0..59 should all produce the same 6-digit code; t=60 should produce122+  // a different one. This exercises the PCH-01-019 period-threading path.123+  it("T-004d: 60-second period — t=0 and t=59 are in the same window", () => {124+    const code0  = generateAt(RFC_SECRET_SHA1, "SHA1", 6, 60, 0);125+    const code59 = generateAt(RFC_SECRET_SHA1, "SHA1", 6, 60, 59);126+    const code60 = generateAt(RFC_SECRET_SHA1, "SHA1", 6, 60, 60);127+128+    expect(code0).toBe(code59);   // same 60-second window129+    expect(code0).not.toBe(code60); // next window starts at t=60130+  });131+132+  // T-004e: 8-digit codes are exactly 8 characters and are numeric.133+  // A digit-count regression would silently truncate or expand codes.134+  it("T-004e: 8-digit code has exactly 8 numeric characters", () => {135+    const code = generateAt(RFC_SECRET_SHA1, "SHA1", 8, 30, 1111111109);136+    expect(code).toMatch(/^\d{8}$/);137+    expect(code).toBe("07081804");138+  });139+});

@@ -0,0 +1,111 @@1+// T-007: MV-9 pdf.js sandbox flags regression test2+//3+// Why this test exists: MV-9 hardened the pdf.js getDocument call with four4+// security options (isEvalSupported:false, disableFontFace/Range/Stream:true)5+// to defend against CVE-2024-4367-class eval-via-font attacks and limit the6+// attack surface of a crafted PDF in the Codex restore path. No test asserts7+// these options are present. A refactor that silently removes or inverts any8+// flag re-exposes the attack surface with no test failure.9+10+import { beforeEach, describe, expect, it, vi } from "vitest";11+12+// ---------------------------------------------------------------------------13+// Mock pdfjs-dist before importing pdf-import.ts.14+// importCodexPDF uses a lazy `import("pdfjs-dist")` that is cached in a15+// module-level variable. vi.mock intercepts dynamic imports too, so the mock16+// is in place before any test runs.17+// ---------------------------------------------------------------------------18+19+const getDocumentMock = vi.fn();20+21+vi.mock("pdfjs-dist", () => ({22+  GlobalWorkerOptions: { workerSrc: "" },23+  getDocument: getDocumentMock,24+}));25+26+import { importCodexPDF } from "./pdf-import";27+28+// A minimal File object that passes the size check (< MAX_PDF_BYTES = 25 MiB)29+// and has a non-zero size. importCodexPDF calls file.arrayBuffer() before30+// getDocument, so we need to return a valid ArrayBuffer.31+function makeFakeFile(bytes: Uint8Array = new Uint8Array([0x25, 0x50, 0x44, 0x46])): File {32+  return {33+    size: bytes.length,34+    name: "test.pdf",35+    arrayBuffer: async () => bytes.buffer,36+    type: "application/pdf",37+  } as unknown as File;38+}39+40+describe("T-007: MV-9 pdf.js sandbox flags", () => {41+  beforeEach(() => {42+    vi.clearAllMocks();43+44+    // Return a valid-looking pdf object that won't crash importCodexPDF.45+    // We only care about what getDocument was called WITH, not what it returns.46+    getDocumentMock.mockReturnValue({47+      promise: Promise.resolve({48+        numPages: 0,49+        getPage: vi.fn(),50+      }),51+    });52+  });53+54+  // T-007a: the four hardened options are all present and correct.55+  // Bug this catches: any one of these flags being removed or set to the wrong56+  // value re-opens the attack surface guarded by MV-9.57+  it("T-007a: getDocument called with all four MV-9 hardened options", async () => {58+    const file = makeFakeFile();59+    await importCodexPDF(file);60+61+    expect(getDocumentMock).toHaveBeenCalledOnce();62+    const callArgs = getDocumentMock.mock.calls[0][0] as Record<string, unknown>;63+64+    expect(callArgs.isEvalSupported).toBe(false);65+    expect(callArgs.disableFontFace).toBe(true);66+    expect(callArgs.disableRange).toBe(true);67+    expect(callArgs.disableStream).toBe(true);68+  });69+70+  // T-007b: none of the hardened flags are missing.71+  // An undefined flag is as dangerous as false/true in the wrong direction —72+  // pdf.js uses its own defaults when a flag is absent.73+  it("T-007b: hardened flags are explicitly set, not absent", async () => {74+    const file = makeFakeFile();75+    await importCodexPDF(file);76+77+    const callArgs = getDocumentMock.mock.calls[0][0] as Record<string, unknown>;78+79+    expect("isEvalSupported" in callArgs).toBe(true);80+    expect("disableFontFace" in callArgs).toBe(true);81+    expect("disableRange" in callArgs).toBe(true);82+    expect("disableStream" in callArgs).toBe(true);83+  });84+85+  // T-007c: hardened options do not break the import flow — PDF import still86+  // succeeds (or fails for PDF-content reasons, not for options reasons).87+  // This is a regression guard: the flags must not make the PDF importer crash.88+  it("T-007c: hardened options do not prevent getDocument from being called", async () => {89+    const file = makeFakeFile();90+    // We don't care whether the import succeeds (numPages=0 means no chunks91+    // found); we care that getDocument was actually called (not short-circuited92+    // due to the hardened options).93+    await importCodexPDF(file);94+95+    expect(getDocumentMock).toHaveBeenCalledOnce();96+  });97+98+  // T-007d: isEvalSupported must be false, not truthy.99+  // A refactor that accidentally passes isEvalSupported:true re-enables the100+  // eval path that CVE-2024-4367 exploited. The strictness of the check matters.101+  it("T-007d: isEvalSupported is strictly false, not just falsy", async () => {102+    const file = makeFakeFile();103+    await importCodexPDF(file);104+105+    const callArgs = getDocumentMock.mock.calls[0][0] as Record<string, unknown>;106+    expect(callArgs.isEvalSupported).toStrictEqual(false);107+    expect(callArgs.isEvalSupported).not.toBeUndefined();108+    expect(callArgs.isEvalSupported).not.toBeNull();109+    expect(callArgs.isEvalSupported).not.toBe(0);110+  });111+});