open source is social v-it.org
add trust-gate module for dangerous-accept flag
New shared module that checks .vit/dangerous-accept flag file.
checkDangerousAccept() reads the flag, shouldBypassVet() provides
the bypass decision. No TTL, no env vars — one mechanism.
Includes unit tests for all paths: missing file, valid JSON,
malformed JSON, old timestamps, bypass/no-bypass.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
+108
+39
src/lib/trust-gate.js
+39
src/lib/trust-gate.js
···
1
+
// SPDX-License-Identifier: AGPL-3.0-only
2
+
// Copyright (c) 2026 sol pbc
3
+
4
+
import { existsSync, readFileSync } from 'node:fs';
5
+
import { join } from 'node:path';
6
+
import { vitDir } from './vit-dir.js';
7
+
8
+
const ACCEPT_FILE = 'dangerous-accept';
9
+
10
+
/**
11
+
* Check if dangerous-accept flag is active.
12
+
* Returns { accepted: true } or { accepted: false }.
13
+
* No TTL — once set, it's permanent until deleted.
14
+
*/
15
+
export function checkDangerousAccept() {
16
+
const p = join(vitDir(), ACCEPT_FILE);
17
+
if (!existsSync(p)) return { accepted: false };
18
+
try {
19
+
JSON.parse(readFileSync(p, 'utf-8'));
20
+
return { accepted: true };
21
+
} catch {
22
+
return { accepted: false };
23
+
}
24
+
}
25
+
26
+
/**
27
+
* Check if the vet gate should be bypassed.
28
+
* Returns { bypass: true, reason } or { bypass: false }.
29
+
*
30
+
* Bypass condition: dangerous-accept flag is active.
31
+
* Caller checks trusted.jsonl before calling this.
32
+
*/
33
+
export function shouldBypassVet() {
34
+
const accept = checkDangerousAccept();
35
+
if (accept.accepted) {
36
+
return { bypass: true, reason: 'dangerous-accept' };
37
+
}
38
+
return { bypass: false };
39
+
}
+69
test/trust-gate.test.js
+69
test/trust-gate.test.js
···
1
+
// SPDX-License-Identifier: AGPL-3.0-only
2
+
// Copyright (c) 2026 sol pbc
3
+
4
+
import { describe, test, expect, beforeEach, afterEach } from 'bun:test';
5
+
import { mkdirSync, writeFileSync, rmSync } from 'node:fs';
6
+
import { join } from 'node:path';
7
+
import { tmpdir } from 'node:os';
8
+
9
+
describe('trust-gate', () => {
10
+
let tmp;
11
+
let originalCwd;
12
+
13
+
beforeEach(() => {
14
+
tmp = join(tmpdir(), '.test-trust-gate-' + Math.random().toString(36).slice(2));
15
+
mkdirSync(join(tmp, '.vit'), { recursive: true });
16
+
originalCwd = process.cwd();
17
+
process.chdir(tmp);
18
+
});
19
+
20
+
afterEach(() => {
21
+
process.chdir(originalCwd);
22
+
rmSync(tmp, { recursive: true, force: true });
23
+
});
24
+
25
+
// Fresh import each test to avoid cached module state
26
+
async function loadModule() {
27
+
// Dynamic import with cache-busting
28
+
const mod = await import('../src/lib/trust-gate.js');
29
+
return mod;
30
+
}
31
+
32
+
describe('checkDangerousAccept', () => {
33
+
test('returns accepted false when no file exists', async () => {
34
+
const { checkDangerousAccept } = await loadModule();
35
+
expect(checkDangerousAccept()).toEqual({ accepted: false });
36
+
});
37
+
38
+
test('returns accepted true when file exists with valid JSON', async () => {
39
+
const { checkDangerousAccept } = await loadModule();
40
+
writeFileSync(join(tmp, '.vit', 'dangerous-accept'), JSON.stringify({ acceptedAt: '2026-03-26T14:30:00.000Z' }));
41
+
expect(checkDangerousAccept()).toEqual({ accepted: true });
42
+
});
43
+
44
+
test('returns accepted false when file is malformed JSON', async () => {
45
+
const { checkDangerousAccept } = await loadModule();
46
+
writeFileSync(join(tmp, '.vit', 'dangerous-accept'), 'not json');
47
+
expect(checkDangerousAccept()).toEqual({ accepted: false });
48
+
});
49
+
50
+
test('no TTL — old timestamps still accepted', async () => {
51
+
const { checkDangerousAccept } = await loadModule();
52
+
writeFileSync(join(tmp, '.vit', 'dangerous-accept'), JSON.stringify({ acceptedAt: '2020-01-01T00:00:00.000Z' }));
53
+
expect(checkDangerousAccept()).toEqual({ accepted: true });
54
+
});
55
+
});
56
+
57
+
describe('shouldBypassVet', () => {
58
+
test('returns bypass true with reason when flag active', async () => {
59
+
const { shouldBypassVet } = await loadModule();
60
+
writeFileSync(join(tmp, '.vit', 'dangerous-accept'), JSON.stringify({ acceptedAt: '2026-03-26T14:30:00.000Z' }));
61
+
expect(shouldBypassVet()).toEqual({ bypass: true, reason: 'dangerous-accept' });
62
+
});
63
+
64
+
test('returns bypass false when flag absent', async () => {
65
+
const { shouldBypassVet } = await loadModule();
66
+
expect(shouldBypassVet()).toEqual({ bypass: false });
67
+
});
68
+
});
69
+
});