Security validation

Alpha security validation runs at three layers. pnpm test is the single required entry point and fails if any layer fails.

Contract and regression tests

Vitest covers schemas, permissions, session signatures, OAuth state/PKCE, request origin rules, guarded commands, cache eligibility, plugin signatures/capabilities, MCP catalog visibility, media validation, and deployment-configuration allowlists. The public MCP Wrangler configuration is parsed as a test artifact: adding D1, R2, a service, secrets, or non-public KV to it fails the suite. Browser-extension permissions are similarly pinned to tabs and the localhost POC host.

Real workerd integration

Cloudflare’s Vitest integration runs Workers in workerd with isolated storage per test file.

• The tenant suite applies the real D1 migrations, verifies verified-domain lookup, exercises two separate SQLite Durable Object identities, atomically saves/publishes the pages-navigation-redirects bundle and proves stale-version rollback, writes/reads an R2 object, proves a cross-tenant key miss, processes a publish queue batch, deletes a real Cache API entry, writes the public KV index, and checks explicit queue acknowledgement/durable status.
• The public MCP suite boots the actual Agents SDK Worker and its Durable Objects, writes only to PUBLIC_CONTENT, performs a Streamable HTTP MCP initialization, and verifies the server identity. This complements dry-run deployment binding output.

These suites use local emulations of Cloudflare bindings, not mocks of their storage APIs. They do not contact or mutate a Cloudflare account.

Browser E2E

Playwright starts Morning Bell in a foreground Astro dev process and validates the public/edit split in a real Chromium browser. It visits all five public routes, verifies shared navigation and anonymous metadata isolation, submits the schema-defined contact form, rejects an invalid extension handoff, logs in through the development extension route, waits for the React overlay to hydrate, saves a schema-defined field, verifies draft preview, confirms public isolation before publish, publishes, and verifies the public result. It also completes the guided page lifecycle from template creation through rename, synchronized navigation, atomic publication, deletion, and old-route redirects. A separate test executes the extension popup with the Chrome tabs surface and asserts the exact same-site handoff URL.

The browser suite deliberately uses only the local POC identity. Production OAuth cryptographic and authorization behavior remains covered at the contract/workerd layers without sending credentials to a test browser.

CI commands

pnpm test
pnpm check
pnpm build

pnpm test runs Node Vitest, tenant workerd, public MCP workerd, and Chromium E2E in order. Install the pinned browser once on a new runner with pnpm exec playwright install chromium. Missing production secrets during the local Astro build are expected warnings; production deployment must supply them through Wrangler secrets.