CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

desktop: a Fix button on scan and validate findings storebound can fix itself. Findings carry action { method, args } (cli/lib/fix-actions.ts); privacy-labels runs scan.write (scan --write-only, the dialog shows the config diff), Play listing gaps play.listing, a missing App Store localization or copyright apple.listing (editable version only), the App Review contact apple.review_details; each a dry run, the native dialog, then the confirmed run. --write-only is forbidden for MCP tools; tests pin the mapping, the round trip on a fixture and that no fix reaches a submit, release or publish

Browse source
This commit is contained in:
CRTkafa 2026-10-15 06:14:49 +08:00
parent bd83d036ba
commit 992f5bcc0e
18 changed files with 257 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

5
tests/serve.test.ts
View file

@ -6,7 +6,7 @@ import { canonical, mac, MAX_TTL_MS, mint, parseSecret, TokenGuard } from '../cl
import { ERR } from '../cli/lib/desktop-protocol';
import { childEnv, pickCallEnv, type RunOptions, type Running } from '../cli/lib/runner';
import { FORBIDDEN_ARGS, TOOLS, toArgv, validateInput } from '../cli/mcp-tools';
import { describeMethods, DESKTOP_ONLY, DESKTOP_TOOLS, FORBIDDEN_METHOD_WORDS, JSON_TOOLS, methodName, OWNER_SUBMIT, OWNER_TOOLS, Session } from '../cli/serve';
import { describeMethods, DESKTOP_LOCAL_WRITES, DESKTOP_ONLY, DESKTOP_TOOLS, FORBIDDEN_METHOD_WORDS, JSON_TOOLS, methodName, OWNER_SUBMIT, OWNER_TOOLS, Session } from '../cli/serve';
import { buildOne, hostTarget, leaks } from '../tools/build-sidecars';
type J = Record<string, unknown>;
@ -113,7 +113,8 @@ describe('serve --stdio: methods', () => {
}
expect(TOOLS.some(t => OWNER_SUBMIT.has(t.name) || t.name.startsWith('owner_'))).toBe(false);
// every desktop tool still goes through the MCP rules: no forbidden flag can come out of any of them
for (const t of DESKTOP_TOOLS) expect(t.command.some(c => FORBIDDEN_ARGS.includes(c))).toBe(false);
for (const t of DESKTOP_TOOLS) expect(t.command.some(c => FORBIDDEN_ARGS.includes(c) && !DESKTOP_LOCAL_WRITES[t.name]?.includes(c))).toBe(false);
expect(Object.keys(DESKTOP_LOCAL_WRITES)).toEqual(['scan_write']);
expect(new Set(names).size).toBe(names.length);
});
test('typed descriptors for every tool; json flags only on read tools', () => {