Files
msd-core/tests/execute-phase-worktree-artifacts.test.cjs
Tom Boucher 69e7afd0c7 chore(#3212): bounded quantifiers over document content — prohibition with teeth — Phase 4 (#3441)
* feat(#3415): ship local/no-unbounded-quantifier, burn down ReDoS class

Phase 4 of epic #3212 (ADR-3212 §5/§7, the final phase). New rule flags
an unbounded */+/{n,} quantifier over a broad character class
([\s\S], dotAll ., or a 1-2-unit negated class like [^\n]/[^)\n] — the
exact #2128-fixed shape) applied to a regex whose match target is
data-flow-traced to readFileSync content.

eslint-rules/lib/readfilesync-trace.cjs extracts the data-flow tracer
shared with no-crlf-fragile-split (Phase 2) rather than a second copy
— no-crlf-fragile-split refactored onto it with zero behavior change,
parity-tested.

Real triage, not 798 mechanical edits: the ADR's census (2026-08-08)
screened every unbounded quantifier in the tree unscoped. Correctly
scoped to readFileSync-derived content (matching Phase 2's own G2/G3
scoping), the rule found 162 real hits across two detection waves — the
second wave (93) surfaced only after a genuine off-by-one bug in this
rule's own first draft was caught while writing its RuleTester tests
and fixed (the bug silently missed every directly-quantified [\s\S]*
with no gap before the quantifier — exactly the class this rule exists
to catch). 3 hits landed in production src/ (commands.cts, milestone.cts,
roadmap.cts) and were each empirically timed against adversarial input
(matching #2128's own measured-not-assumed precedent) — all confirmed
linear-time/benign, left unbounded with a measured-evidence comment
rather than mechanically bounded. The remaining 159 are test-file
fixture parsing (test-author-controlled, fixed-size content, not
adversarial input) — each suppressed with a specific, non-generic
reason. Zero functional behavior changed anywhere in this diff.

tests/no-pending-3212-markers.test.cjs locks the epic's own closing
invariant (ADR §7: "assert zero pending #3212 markers remain") — ground
truth confirmed trivially true today (no phase left any such marker
behind), now regression-locked going forward.

Design: .gsd/phase/chore-3415-prohibition-with-teeth/40-design.md
Test matrix: .gsd/phase/chore-3415-prohibition-with-teeth/50-test-matrix.md

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(#3415): correct rule category mislabel, add CI test-scope entry

An orthogonal Standards-axis review found eslint-rules/no-unbounded-quantifier.cjs
mistakenly carried meta.docs.category: 'Portability', copied from a sibling
rule without realizing what that implied: docs/contributing/cross-platform-
portability-rules.md governs an ADR-1703 rule family under a hard "zero
escape hatches" contract (tests/portability-rule-disable-ban.test.cjs's
PROTECTED_RULES bans eslint-disable for those rules entirely). This rule is
not part of that family — it's ADR-3212 (ReDoS/CWE-1333), a different epic —
and its eslint-disable-next-line suppressions (159 of them, added earlier
this same phase after empirical benign-verification) are an intentional,
correct design, not a bypass. Corrected to category: 'Best Practices',
matching the actual precedent (no-adhoc-regex-escape.cjs, Phase 1 of the
same epic, which is also correctly outside PROTECTED_RULES), and the rule's
own docstring now states this explicitly so a future reader doesn't have to
re-derive it.

Also registers a new scripts/ci-test-scope.cjs bucket so editing this rule
or the shared eslint-rules/lib/readfilesync-trace.cjs helper re-runs their
own test suites under targeted CI selection — was previously unregistered
and invisible to that fast-path (this PR's own gsd-test checkpoint runs the
full suite regardless, so this only affects future narrowly-scoped PRs).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(#3415): bound no-unbounded-quantifier's own scanner (CWE-1333, ironic)

Security review found the rule meant to catch algorithmic-complexity bugs
had one of its own: hasUnboundedBroadQuantifier's negated-class inner
scan walked from each `[^` occurrence to the next `]` (or EOF) with no
bound, while the outer loop only ever advanced by one character — O(n²)
total work on a pattern with many unclosed `[^` runs. Runs unconditionally
inside checkPattern on any `new RegExp('literal string')` argument in any
linted file, before the (cheap) readFileSync data-flow gate — so a single
crafted string literal, no valid regex syntax required, could make
`npm run lint` / CI hang.

Empirically confirmed both the bug and the fix: pre-fix, n=4000/8000/
16000/32000 chars took 30.8/115.6/463.8/1874.3ms (~4x work per 2x n,
quadratic); extrapolated, the 300000-char repro from the finding would
run ~165s. Post-fix (bail the inner scan once units exceeds the rule's
own 1-2-unit scope, rather than continuing to hunt for a closing `]`),
the same 300000-char input runs in 8.7ms via the real rule module,
independently reconfirmed at 18ms via a fresh Linter.verify() call.

New regression row in tests/no-unbounded-quantifier.rule.test.cjs
asserts the RuleTester run on a 50000-char adversarial pattern
completes and returns a defined result — no wall-clock assertion
(CLAUDE.md Clock Seams / local/no-elapsed-assertion).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(#3415): triage 3 new sites, re-raise ceiling after upstream batch

next merged 12 more PRs during this PR's review. Two consequences:

- tests/edit-phase.test.cjs (fix #3262, unrelated) added 3 new
  content.match(/<tag>([\s\S]*?)<\/tag>/) reads of this repo's own
  workflow .md content — the same Class A pattern as the ~159 sites
  already triaged elsewhere in this PR. Suppressed with the same
  established reason.
- lint-allow-test-rule-refs' ratchet ceiling needed re-raising again
  (301 -> 303) for the same reason as the two prior bumps: organic
  growth from unrelated, already-reviewed PRs landing concurrently,
  not a defect in this branch's own diff.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: sim <sim@local>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-14 10:02:28 -04:00

265 lines
11 KiB
JavaScript

// allow-test-rule: source-text-is-the-product
// Workflow .md / agent .md / command .md / reference .md files — their text
// IS what the runtime loads. Testing text content tests the deployed contract.
// Per CONTRIBUTING.md exception matrix.
/**
* Execute-phase worktree shared artifact ownership tests
*
* Guards against bug #1571: worktree executor agents independently writing
* STATE.md and ROADMAP.md, causing last-merge-wins overwrites.
*
* Fix: In parallel worktree mode, remove STATE.md/ROADMAP.md update requirements
* from the executor agent success_criteria. The orchestrator owns those writes
* after each wave via single-writer post-wave commands.
*/
const { test, describe } = require('node:test');
const assert = require('node:assert/strict');
const fs = require('fs');
const path = require('path');
const WORKFLOW_PATH = path.join(__dirname, '..', 'gsd-core', 'workflows', 'execute-phase.md');
const QUICK_WORKFLOW_PATH = path.join(__dirname, '..', 'gsd-core', 'workflows', 'quick.md');
const RECOVERY_POLICY_PATH = path.join(
__dirname,
'..',
'gsd-core',
'workflows',
'execute-phase',
'steps',
'worktree-recovery-policy.md'
);
describe('execute-phase worktree: shared artifact ownership (#1571)', () => {
test('workflow file exists', () => {
assert.ok(fs.existsSync(WORKFLOW_PATH), 'workflows/execute-phase.md should exist');
});
test('worktree executor agent success_criteria does NOT include STATE.md update', () => {
const content = fs.readFileSync(WORKFLOW_PATH, 'utf-8');
// Extract the worktree Task() block (between "Worktree mode" and "Sequential mode")
const worktreeMatch = content.match(
// eslint-disable-next-line local/no-unbounded-quantifier -- parses this repo's own workflow .md content, fixed-size author-controlled content
/\*\*Worktree mode\*\*[\s\S]*?<success_criteria>([\s\S]*?)<\/success_criteria>/
);
assert.ok(worktreeMatch, 'should find success_criteria inside the worktree mode Task block');
const criteria = worktreeMatch[1];
assert.ok(
!criteria.includes('STATE.md'),
'worktree executor success_criteria must NOT reference STATE.md (orchestrator owns this write)'
);
});
test('worktree executor agent success_criteria does NOT include ROADMAP.md update', () => {
const content = fs.readFileSync(WORKFLOW_PATH, 'utf-8');
// Extract the worktree Task() block
const worktreeMatch = content.match(
// eslint-disable-next-line local/no-unbounded-quantifier -- parses this repo's own workflow .md content, fixed-size author-controlled content
/\*\*Worktree mode\*\*[\s\S]*?<success_criteria>([\s\S]*?)<\/success_criteria>/
);
assert.ok(worktreeMatch, 'should find success_criteria inside the worktree mode Task block');
const criteria = worktreeMatch[1];
assert.ok(
!criteria.includes('ROADMAP.md'),
'worktree executor success_criteria must NOT reference ROADMAP.md (orchestrator owns this write)'
);
});
test('worktree executor agent success_criteria includes SUMMARY.md creation', () => {
const content = fs.readFileSync(WORKFLOW_PATH, 'utf-8');
// SUMMARY.md is plan-local and safe for worktree agents to create
const worktreeMatch = content.match(
// eslint-disable-next-line local/no-unbounded-quantifier -- parses this repo's own workflow .md content, fixed-size author-controlled content
/\*\*Worktree mode\*\*[\s\S]*?<success_criteria>([\s\S]*?)<\/success_criteria>/
);
assert.ok(worktreeMatch, 'should find success_criteria inside the worktree mode Task block');
const criteria = worktreeMatch[1];
assert.ok(
criteria.includes('SUMMARY.md'),
'worktree executor success_criteria should still require SUMMARY.md creation'
);
});
test('post-wave orchestrator runs roadmap update-plan-progress for each completed plan', () => {
const content = fs.readFileSync(WORKFLOW_PATH, 'utf-8');
assert.ok(
content.includes('roadmap update-plan-progress'),
'post-wave section should contain orchestrator-owned roadmap update-plan-progress command'
);
// Confirm it is in a post-wave context, not only inside an agent prompt
const postWaveIdx = content.indexOf('roadmap update-plan-progress');
const worktreeAgentStart = content.indexOf('isolation="worktree"');
const worktreeAgentEnd = content.indexOf('**Sequential mode**');
assert.ok(
postWaveIdx < worktreeAgentStart || postWaveIdx > worktreeAgentEnd,
'roadmap update-plan-progress must appear outside the worktree agent prompt (orchestrator-owned)'
);
});
test('ghost state update-position command removed from post-wave section (#1627)', () => {
const content = fs.readFileSync(WORKFLOW_PATH, 'utf-8');
assert.ok(
!content.includes('state update-position'),
'state update-position was a ghost reference (command never existed in CLI dispatcher) — should be removed'
);
});
test('sequential mode executor agent success_criteria still includes STATE.md update', () => {
const content = fs.readFileSync(WORKFLOW_PATH, 'utf-8');
// Extract the sequential mode Task() block
const seqMatch = content.match(
// eslint-disable-next-line local/no-unbounded-quantifier -- parses this repo's own workflow .md content, fixed-size author-controlled content
/\*\*Sequential mode\*\*[\s\S]*?<success_criteria>([\s\S]*?)<\/success_criteria>/
);
assert.ok(seqMatch, 'should find success_criteria inside the sequential mode Task block');
const criteria = seqMatch[1];
assert.ok(
criteria.includes('STATE.md'),
'sequential executor success_criteria should still require STATE.md update (no conflict risk)'
);
});
test('sequential mode executor agent success_criteria still includes ROADMAP.md update', () => {
const content = fs.readFileSync(WORKFLOW_PATH, 'utf-8');
// Extract the sequential mode Task() block
const seqMatch = content.match(
// eslint-disable-next-line local/no-unbounded-quantifier -- parses this repo's own workflow .md content, fixed-size author-controlled content
/\*\*Sequential mode\*\*[\s\S]*?<success_criteria>([\s\S]*?)<\/success_criteria>/
);
assert.ok(seqMatch, 'should find success_criteria inside the sequential mode Task block');
const criteria = seqMatch[1];
assert.ok(
criteria.includes('ROADMAP.md'),
'sequential executor success_criteria should still require ROADMAP.md update (no conflict risk)'
);
});
});
describe('isolated-run recovery fail-safe (#1292)', () => {
test('worktree-recovery-policy.md fragment exists', () => {
assert.ok(
fs.existsSync(RECOVERY_POLICY_PATH),
'execute-phase/steps/worktree-recovery-policy.md must exist (ADR-857 extraction pattern)'
);
});
test('execute-phase.md references the worktree-recovery-policy.md fragment', () => {
const content = fs.readFileSync(WORKFLOW_PATH, 'utf-8');
assert.ok(
content.includes('execute-phase/steps/worktree-recovery-policy.md'),
'execute-phase.md must reference the extracted worktree-recovery-policy.md fragment'
);
assert.ok(
content.includes('#1292'),
'execute-phase.md must reference #1292 in the worktree recovery policy pointer'
);
});
test('worktree-recovery-policy.md fragment contains ISOLATED-RUN RECOVERY guardrail referencing #1292', () => {
const content = fs.readFileSync(RECOVERY_POLICY_PATH, 'utf-8');
assert.ok(
content.includes('ISOLATED-RUN RECOVERY'),
'worktree-recovery-policy.md must contain the ISOLATED-RUN RECOVERY guardrail label'
);
assert.ok(
content.includes('#1292'),
'worktree-recovery-policy.md ISOLATED-RUN RECOVERY guardrail must reference #1292'
);
});
test('worktree-recovery-policy.md fragment forbids defaulting recovery to main/primary checkout', () => {
const content = fs.readFileSync(RECOVERY_POLICY_PATH, 'utf-8');
assert.ok(
content.includes('never the proposed or default'),
'worktree-recovery-policy.md guardrail must state editing main is "never the proposed or default" option'
);
});
test('worktree-recovery-policy.md fragment offers fresh narrowly-scoped worktree as recovery path', () => {
const content = fs.readFileSync(RECOVERY_POLICY_PATH, 'utf-8');
assert.ok(
content.includes('fresh, narrowly-scoped worktree'),
'worktree-recovery-policy.md guardrail must offer a "fresh, narrowly-scoped worktree" as recovery path'
);
});
test('worktree-recovery-policy.md fragment requires explicit confirmation before editing primary checkout', () => {
const content = fs.readFileSync(RECOVERY_POLICY_PATH, 'utf-8');
assert.ok(
content.includes('explicit, clearly-labeled confirmation'),
'worktree-recovery-policy.md guardrail must require "explicit, clearly-labeled confirmation" before editing the primary checkout'
);
});
test('worktree-recovery-policy.md fragment contains FAIL-CLOSED rule (#48) with exit-42 content', () => {
const content = fs.readFileSync(RECOVERY_POLICY_PATH, 'utf-8');
assert.ok(
content.includes('worktree_branch_check'),
'worktree-recovery-policy.md must contain "worktree_branch_check" from the FAIL-CLOSED rule (#48)'
);
assert.ok(
content.includes('42'),
'worktree-recovery-policy.md must contain "42" (exit 42) from the FAIL-CLOSED rule (#48)'
);
});
test('execute-phase.md step 5.5 decline/over-reach sentence references fragment and forbids main-default', () => {
const content = fs.readFileSync(WORKFLOW_PATH, 'utf-8');
assert.ok(
content.includes('declines to merge a worktree'),
'execute-phase.md step 5.5 pointer must mention "declines to merge a worktree" as the trigger for fail-safe policy'
);
assert.ok(
content.includes('never default to editing'),
'execute-phase.md step 5.5 pointer must state "never default to editing" main'
);
});
test('quick.md contains ISOLATED-RUN RECOVERY guardrail referencing #1292', () => {
const content = fs.readFileSync(QUICK_WORKFLOW_PATH, 'utf-8');
assert.ok(
content.includes('ISOLATED-RUN RECOVERY'),
'quick.md must contain the ISOLATED-RUN RECOVERY guardrail label'
);
assert.ok(
content.includes('#1292'),
'quick.md ISOLATED-RUN RECOVERY guardrail must reference #1292'
);
});
test('quick.md guardrail forbids defaulting recovery to main/primary checkout', () => {
const content = fs.readFileSync(QUICK_WORKFLOW_PATH, 'utf-8');
assert.ok(
content.includes('never the proposed or default'),
'quick.md guardrail must state editing main is "never the proposed or default" option'
);
});
test('quick.md guardrail offers fresh narrowly-scoped worktree as recovery path', () => {
const content = fs.readFileSync(QUICK_WORKFLOW_PATH, 'utf-8');
assert.ok(
content.includes('fresh, narrowly-scoped worktree'),
'quick.md guardrail must offer a "fresh, narrowly-scoped worktree" as recovery path'
);
});
test('quick.md guardrail requires explicit confirmation before editing primary checkout', () => {
const content = fs.readFileSync(QUICK_WORKFLOW_PATH, 'utf-8');
assert.ok(
content.includes('explicit, clearly-labeled confirmation'),
'quick.md guardrail must require "explicit, clearly-labeled confirmation" before editing the primary checkout'
);
});
});