test: add --allow-host-ports validation tests

src/cli.test.ts

@@ -1,5 +1,5 @@
 import { Command } from 'commander';
-import { parseEnvironmentVariables, parseDomains, parseDomainsFile, escapeShellArg, joinShellArgs, parseVolumeMounts, isValidIPv4, isValidIPv6, parseDnsServers, validateAgentImage, isAgentImagePreset, AGENT_IMAGE_PRESETS, processAgentImageOption, processLocalhostKeyword, validateSkipPullWithBuildLocal, validateFormat, validateApiProxyConfig, buildRateLimitConfig, validateRateLimitFlags } from './cli';
+import { parseEnvironmentVariables, parseDomains, parseDomainsFile, escapeShellArg, joinShellArgs, parseVolumeMounts, isValidIPv4, isValidIPv6, parseDnsServers, validateAgentImage, isAgentImagePreset, AGENT_IMAGE_PRESETS, processAgentImageOption, processLocalhostKeyword, validateSkipPullWithBuildLocal, validateAllowHostPorts, validateFormat, validateApiProxyConfig, buildRateLimitConfig, validateRateLimitFlags } from './cli';
 import { redactSecrets } from './redact-secrets';
 import * as fs from 'fs';
 import * as path from 'path';
@@ -48,14 +48,14 @@
 
     afterEach(() => {
       // Clean up the test directory
       if (fs.existsSync(testDir)) {
         fs.rmSync(testDir, { recursive: true, force: true });
       }
     });
 
     it('should parse domains from file with one domain per line', () => {
       const filePath = path.join(testDir, 'domains.txt');
       fs.writeFileSync(filePath, 'github.com\napi.github.com\nnpmjs.org');
 
       const result = parseDomainsFile(filePath);
 
@@ -64,7 +64,7 @@
 
     it('should parse comma-separated domains from file', () => {
       const filePath = path.join(testDir, 'domains.txt');
       fs.writeFileSync(filePath, 'github.com, api.github.com, npmjs.org');
 
       const result = parseDomainsFile(filePath);
 
@@ -73,7 +73,7 @@
 
     it('should handle mixed formats (lines and commas)', () => {
       const filePath = path.join(testDir, 'domains.txt');
       fs.writeFileSync(filePath, 'github.com\napi.github.com, npmjs.org\nexample.com');
 
       const result = parseDomainsFile(filePath);
 
@@ -82,7 +82,7 @@
 
     it('should skip empty lines', () => {
       const filePath = path.join(testDir, 'domains.txt');
       fs.writeFileSync(filePath, 'github.com\n\n\napi.github.com\n\nnpmjs.org');
 
       const result = parseDomainsFile(filePath);
 
@@ -91,7 +91,7 @@
 
     it('should skip lines with only whitespace', () => {
       const filePath = path.join(testDir, 'domains.txt');
       fs.writeFileSync(filePath, 'github.com\n   \n\t\napi.github.com');
 
       const result = parseDomainsFile(filePath);
 
@@ -100,7 +100,7 @@
 
     it('should skip comments starting with #', () => {
       const filePath = path.join(testDir, 'domains.txt');
       fs.writeFileSync(filePath, '# This is a comment\ngithub.com\n# Another comment\napi.github.com');
 
       const result = parseDomainsFile(filePath);
 
@@ -109,7 +109,7 @@
 
     it('should handle inline comments (after domain)', () => {
       const filePath = path.join(testDir, 'domains.txt');
       fs.writeFileSync(filePath, 'github.com # GitHub main domain\napi.github.com # API endpoint');
 
       const result = parseDomainsFile(filePath);
 
@@ -118,7 +118,7 @@
 
     it('should handle domains with inline comments in comma-separated format', () => {
       const filePath = path.join(testDir, 'domains.txt');
       fs.writeFileSync(filePath, 'github.com, api.github.com # GitHub domains\nnpmjs.org');
 
       const result = parseDomainsFile(filePath);
 
@@ -133,7 +133,7 @@
 
     it('should return empty array for file with only comments and whitespace', () => {
       const filePath = path.join(testDir, 'domains.txt');
       fs.writeFileSync(filePath, '# Comment 1\n\n# Comment 2\n   \n');
 
       const result = parseDomainsFile(filePath);
 
@@ -1495,4 +1495,48 @@
       expect(r.valid).toBe(true);
     });
   });
+
+  describe('validateAllowHostPorts', () => {
+    it('should fail when --allow-host-ports is used without --enable-host-access', () => {
+      const result = validateAllowHostPorts('3000', undefined);
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('--allow-host-ports requires --enable-host-access');
+    });
+
+    it('should fail when --allow-host-ports is used with enableHostAccess=false', () => {
+      const result = validateAllowHostPorts('8080', false);
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('--allow-host-ports requires --enable-host-access');
+    });
+
+    it('should pass when --allow-host-ports is used with --enable-host-access', () => {
+      const result = validateAllowHostPorts('3000', true);
+      expect(result.valid).toBe(true);
+      expect(result.error).toBeUndefined();
+    });
+
+    it('should pass when --allow-host-ports is not provided', () => {
+      const result = validateAllowHostPorts(undefined, undefined);
+      expect(result.valid).toBe(true);
+      expect(result.error).toBeUndefined();
+    });
+
+    it('should pass when only --enable-host-access is set without ports', () => {
+      const result = validateAllowHostPorts(undefined, true);
+      expect(result.valid).toBe(true);
+      expect(result.error).toBeUndefined();
+    });
+
+    it('should fail for port ranges without --enable-host-access', () => {
+      const result = validateAllowHostPorts('3000-3010,8080', undefined);
+      expect(result.valid).toBe(false);
+      expect(result.error).toContain('--allow-host-ports requires --enable-host-access');
+    });
+
+    it('should pass for port ranges with --enable-host-access', () => {
+      const result = validateAllowHostPorts('3000-3010,8000-8090', true);
+      expect(result.valid).toBe(true);
+      expect(result.error).toBeUndefined();
+    });
+  });
 });

src/cli.ts

@@ -403,6 +403,25 @@ export function validateSkipPullWithBuildLocal(
   return { valid: true };
 }
 
+/**
+ * Validates that --allow-host-ports is only used with --enable-host-access
+ * @param allowHostPorts - The --allow-host-ports value (undefined if not provided)
+ * @param enableHostAccess - Whether --enable-host-access flag was provided
+ * @returns FlagValidationResult with validation status and error message
+ */
+export function validateAllowHostPorts(
+  allowHostPorts: string | undefined,
+  enableHostAccess: boolean | undefined
+): FlagValidationResult {
+  if (allowHostPorts && !enableHostAccess) {
+    return {
+      valid: false,
+      error: '--allow-host-ports requires --enable-host-access to be set',
+    };
+  }
+  return { valid: true };
+}
+
 /**
  * Parses and validates DNS servers from a comma-separated string
  * @param input - Comma-separated DNS server string (e.g., "8.8.8.8,1.1.1.1")
@@ -1110,9 +1129,10 @@ program
       logger.warn('   This may expose sensitive credentials if logs or configs are shared');
     }
 
-    // Warn if --allow-host-ports is used without --enable-host-access
-    if (config.allowHostPorts && !config.enableHostAccess) {
-      logger.error('❌ --allow-host-ports requires --enable-host-access to be set');
+    // Validate --allow-host-ports requires --enable-host-access
+    const hostPortsValidation = validateAllowHostPorts(config.allowHostPorts, config.enableHostAccess);
+    if (!hostPortsValidation.valid) {
+      logger.error(`❌ ${hostPortsValidation.error}`);
       process.exit(1);
     }