This folder contains the test fixture (shield.md) and integration test that run conversion and verify. The scope adapters live in ../adapters/: index.js imports each scope adapter (e.g. system-command-execute.js for tool.call → system.command.execute) and is also the CLI entry point when run as a script.

File	Description
`shield.md`	Example SHIELD v0 threat feed (tool scope: block `rm -rf`, require approval for `sudo`). Policy is always generated from this file via the adapters.
`test-shield-to-verify.js`	Integration tests: (1) conversion via adapters, (2) APort verify with policy-in-body, (3) response shape.

Flow

SHIELD (shield.md) defines threats.
Adapters (../adapters/index.js) parse the feed and delegate by scope; system-command-execute.js handles tool.call → OAP system.command.execute policy + limits.
Verify: POST /api/verify/policy/IN_BODY with that policy and passport.
Response fits OAP; deny can follow SHIELD block format.

Run the adapter (CLI)

Run ../adapters/index.js as a script:

# From repo root (default: test/shield.md)
node spec/integrations/shield/adapters/index.js
# Explicit path
node spec/integrations/shield/adapters/index.js spec/integrations/shield/test/shield.md

Output: JSON with policy, limitsFragment, and threats. For policy-only or limits-only:

SHIELD_OUTPUT=policy  node spec/integrations/shield/adapters/index.js spec/integrations/shield/test/shield.md
SHIELD_OUTPUT=limits  node spec/integrations/shield/adapters/index.js spec/integrations/shield/test/shield.md

Run the tests

API base URL:

Not local (default, e.g. CI): Uses live API https://api.aport.io. No env needed.
Local: Set LOCAL=1 (or RUN_LOCAL=1 or APORT_VERIFY_LOCAL=1) and start the dev server (e.g. npm run dev or wrangler dev) at http://localhost:8787.
Override: APORT_API_BASE_URL overrides the default (e.g. APORT_API_BASE_URL=http://localhost:8787).

# Use live API (default when not local)
node spec/integrations/shield/test/test-shield-to-verify.js

# Use local dev server
LOCAL=1 node spec/integrations/shield/test/test-shield-to-verify.js

# Explicit base URL
APORT_API_BASE_URL=https://api.aport.io node spec/integrations/shield/test/test-shield-to-verify.js

Test coverage: Conversion (shield.md → policy + limits via adapters), APort verify (allow/deny), response shape (deny code and message).

See ../README.md for SHIELD↔OAP mapping and adapter strategy.

Product Specifications

File Tree

SHIELD integration test folder

Contents

Flow

Run the adapter (CLI)

Run the tests