Hermes
f4f2c26de3
Audit P0-5 + deploy_app truth (batch 5 of the 2026-10-27 sweep, AUDIT-2026-10-27.md committed here): ROUTE ADDITIONS: - routes/containers.js GET / — container list (dockerode listContainers); the router had NO list route, so dashcaddy_list_containers 404'd always - routes/dns.js GET /records — record list via active provider with a list-records capability guard (501 + guidance for push-only providers like RFC2136); dashcaddy_list_dns called GET /dns, never existed HANDLER FIXES (src/mcp/mcp-core.js): - get_service resolves from GET /services by id/name (single-service GET never existed) with a known-ids 404 - check_health + diagnose -> /health/service/:id and /health/services (both previously hit nonexistent routes) - container_action remove -> DELETE /containers/:id (was /:id/remove) - system_health/system_metrics via apiCall error envelope (metrics text capped at 64KB) - search_catalog applies category filter client-side (/catalog/search has no category param — constraint was silently dropped) - generate_caddyfile defaults authService=status when auth:true (auth flag alone silently produced UNGATED Caddyfiles) - deploy_app honest re-contract: registers service + generates Caddyfile, does NOT claim image pull/container creation/deployed:true; base domain read from /config (hardcoded owner .sami TLD removed); caddy-code failure now surfaces as caddyfileError + FAILED message - list_fleet description gains Premium hint VERIFIER (audit #40): EXPECTED table 12 -> 34 rows covering EVERY tool's (method,path); NEW Layer-3 handler-derived test drives the real createToolHandler for all 28 tools and strictly resolves every captured call mount-aware (a vacuous first draft of this gate was caught and fixed pre-grade); extractRoutes regex extended to apiRouter.get inline decls; Bearer credential-passthrough test added (DC-162 coverage gap) NEW TESTS: dns-records.routes.test.js (5 route-level cases incl. 501 capability behavior); deploy_app partial-failure + no-.sami tests HOST RELIABILITY (same sweep, evidenced here): jest maxWorkers 50% — default 5-worker runs repeatedly OOM-killed this host's gateway (dmesg 2026-10-29 00:58:40; swap was 4G/4G full). Gateway protected separately via systemd OOMScoreAdjust=-500 drop-in + /swapfile2 (host ops, graded B urn:ump:35dpnggtxsqrxvlqm2d2buqkbnggw3acflbccnkqpqyiiijcxx3q). DC-171 DNS provider-parity ticket (Sami, plug-in-directly) appended to backlog. Full suite: 173/173 suites, 3740/3740 tests. Judge B r1 (urn:ump:jsobkg2t2omzvpinel2fufk7sspoy3vubsrth3e6lat3ygolvffq) blockers all fixed: dns.js 501 arg order (the file aliases error() message-first — the sweep's 'reversed-arg' finding was a false positive for its 7 sites; lesson #14), deploy_app partial-failure honesty, handler-derived verifier.
43 lines
1.1 KiB
JavaScript
43 lines
1.1 KiB
JavaScript
module.exports = {
|
|
testEnvironment: 'node',
|
|
// DC-170: cap workers at half the cores — default (cores-1 = 5 workers ≈
|
|
// 1.5-3GB spike) repeatedly OOM-killed the host gateway (swap-full box,
|
|
// 12GB RAM, ~5.5GB always-on services). 50% keeps the suite fast (~2min)
|
|
// without the memory cliff.
|
|
maxWorkers: '50%',
|
|
testTimeout: 15000,
|
|
testMatch: ['**/__tests__/**/*.test.js'],
|
|
collectCoverageFrom: [
|
|
'state-manager.js',
|
|
'input-validator.js',
|
|
'crypto-utils.js',
|
|
'health-checker.js',
|
|
'backup-manager.js',
|
|
'update-manager.js',
|
|
'resource-monitor.js',
|
|
'credential-manager.js',
|
|
'app-templates.js',
|
|
'auth-manager.js',
|
|
'csrf-protection.js',
|
|
'errors.js',
|
|
'error-handler.js',
|
|
'routes/health.js',
|
|
'routes/services.js',
|
|
'routes/containers.js',
|
|
'url-resolver.js',
|
|
'pagination.js',
|
|
'platform-paths.js',
|
|
'port-lock-manager.js'
|
|
],
|
|
coverageThreshold: {
|
|
global: {
|
|
branches: 65,
|
|
functions: 76,
|
|
lines: 80,
|
|
statements: 80
|
|
}
|
|
},
|
|
restoreMocks: true,
|
|
clearMocks: true
|
|
};
|