Harden M9: Ed25519 attestation, full SHA-256 integrity, locked-by-default, prompt improvements, registry verification

2026-07-20 16:50:49 -03:00
parent 04153a4bbd
commit 56cb34276e
34 changed files with 2549 additions and 257 deletions
@@ -650,3 +650,76 @@ def test_switch_to_existing_tool_closes_creation_page_first():
        call.close_tool_builder(),
        call.open_tool_builder("existing"),
    ]
+
+
+def test_guided_extraction_builds_new_tool_without_mutating_draft():
+    pytest.importorskip("PySide6")
+    from cmdforge.gui.pages.tool_builder_page import (
+        build_extracted_tool,
+        extraction_diff,
+    )
+
+    schema = {"type": "string"}
+    repeated = [
+        PromptStep(
+            prompt="First {input}", provider="mock", output_var="first",
+            output_schema=schema,
+        ),
+        PromptStep(
+            prompt="Second {first}", provider="mock", output_var="second",
+            output_schema=schema,
+        ),
+    ]
+    draft = Tool(
+        name="draft", steps=repeated + [
+            PromptStep(
+                prompt="First {input}", provider="mock", output_var="first_copy",
+                output_schema=schema,
+            ),
+            PromptStep(
+                prompt="Second {first}", provider="mock", output_var="second_copy",
+                output_schema=schema,
+            ),
+        ], input_schema=schema,
+    )
+    before = draft.to_dict()
+
+    extracted = build_extracted_tool(
+        draft,
+        {"type": "repeated_sequence", "locations": [1, 3], "length": 2},
+        "draft-shared",
+    )
+
+    assert len(extracted.steps) == 2
+    assert extracted.output == "{second}"
+    assert extracted.output_schema == schema
+    assert draft.to_dict() == before
+    assert "+++ draft-shared/config.yaml" in extraction_diff(extracted)
+
+
+def test_guided_extraction_rejects_hidden_external_step_dependency():
+    pytest.importorskip("PySide6")
+    from cmdforge.gui.pages.tool_builder_page import build_extracted_tool
+
+    schema = {"type": "string"}
+    draft = Tool(name="draft", steps=[
+        PromptStep(
+            prompt="Produce", provider="mock", output_var="earlier",
+            output_schema=schema,
+        ),
+        PromptStep(
+            prompt="Use {earlier}", provider="mock", output_var="one",
+            output_schema=schema,
+        ),
+        PromptStep(
+            prompt="Finish {one}", provider="mock", output_var="two",
+            output_schema=schema,
+        ),
+    ])
+
+    with pytest.raises(ValueError, match="outside its boundary"):
+        build_extracted_tool(
+            draft,
+            {"type": "repeated_sequence", "locations": [2, 4], "length": 2},
+            "draft-shared",
+        )