* feat(#3415): ship local/no-unbounded-quantifier, burn down ReDoS class Phase 4 of epic #3212 (ADR-3212 §5/§7, the final phase). New rule flags an unbounded */+/{n,} quantifier over a broad character class ([\s\S], dotAll ., or a 1-2-unit negated class like [^\n]/[^)\n] — the exact #2128-fixed shape) applied to a regex whose match target is data-flow-traced to readFileSync content. eslint-rules/lib/readfilesync-trace.cjs extracts the data-flow tracer shared with no-crlf-fragile-split (Phase 2) rather than a second copy — no-crlf-fragile-split refactored onto it with zero behavior change, parity-tested. Real triage, not 798 mechanical edits: the ADR's census (2026-08-08) screened every unbounded quantifier in the tree unscoped. Correctly scoped to readFileSync-derived content (matching Phase 2's own G2/G3 scoping), the rule found 162 real hits across two detection waves — the second wave (93) surfaced only after a genuine off-by-one bug in this rule's own first draft was caught while writing its RuleTester tests and fixed (the bug silently missed every directly-quantified [\s\S]* with no gap before the quantifier — exactly the class this rule exists to catch). 3 hits landed in production src/ (commands.cts, milestone.cts, roadmap.cts) and were each empirically timed against adversarial input (matching #2128's own measured-not-assumed precedent) — all confirmed linear-time/benign, left unbounded with a measured-evidence comment rather than mechanically bounded. The remaining 159 are test-file fixture parsing (test-author-controlled, fixed-size content, not adversarial input) — each suppressed with a specific, non-generic reason. Zero functional behavior changed anywhere in this diff. tests/no-pending-3212-markers.test.cjs locks the epic's own closing invariant (ADR §7: "assert zero pending #3212 markers remain") — ground truth confirmed trivially true today (no phase left any such marker behind), now regression-locked going forward. Design: .gsd/phase/chore-3415-prohibition-with-teeth/40-design.md Test matrix: .gsd/phase/chore-3415-prohibition-with-teeth/50-test-matrix.md Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(#3415): correct rule category mislabel, add CI test-scope entry An orthogonal Standards-axis review found eslint-rules/no-unbounded-quantifier.cjs mistakenly carried meta.docs.category: 'Portability', copied from a sibling rule without realizing what that implied: docs/contributing/cross-platform- portability-rules.md governs an ADR-1703 rule family under a hard "zero escape hatches" contract (tests/portability-rule-disable-ban.test.cjs's PROTECTED_RULES bans eslint-disable for those rules entirely). This rule is not part of that family — it's ADR-3212 (ReDoS/CWE-1333), a different epic — and its eslint-disable-next-line suppressions (159 of them, added earlier this same phase after empirical benign-verification) are an intentional, correct design, not a bypass. Corrected to category: 'Best Practices', matching the actual precedent (no-adhoc-regex-escape.cjs, Phase 1 of the same epic, which is also correctly outside PROTECTED_RULES), and the rule's own docstring now states this explicitly so a future reader doesn't have to re-derive it. Also registers a new scripts/ci-test-scope.cjs bucket so editing this rule or the shared eslint-rules/lib/readfilesync-trace.cjs helper re-runs their own test suites under targeted CI selection — was previously unregistered and invisible to that fast-path (this PR's own gsd-test checkpoint runs the full suite regardless, so this only affects future narrowly-scoped PRs). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(#3415): bound no-unbounded-quantifier's own scanner (CWE-1333, ironic) Security review found the rule meant to catch algorithmic-complexity bugs had one of its own: hasUnboundedBroadQuantifier's negated-class inner scan walked from each `[^` occurrence to the next `]` (or EOF) with no bound, while the outer loop only ever advanced by one character — O(n²) total work on a pattern with many unclosed `[^` runs. Runs unconditionally inside checkPattern on any `new RegExp('literal string')` argument in any linted file, before the (cheap) readFileSync data-flow gate — so a single crafted string literal, no valid regex syntax required, could make `npm run lint` / CI hang. Empirically confirmed both the bug and the fix: pre-fix, n=4000/8000/ 16000/32000 chars took 30.8/115.6/463.8/1874.3ms (~4x work per 2x n, quadratic); extrapolated, the 300000-char repro from the finding would run ~165s. Post-fix (bail the inner scan once units exceeds the rule's own 1-2-unit scope, rather than continuing to hunt for a closing `]`), the same 300000-char input runs in 8.7ms via the real rule module, independently reconfirmed at 18ms via a fresh Linter.verify() call. New regression row in tests/no-unbounded-quantifier.rule.test.cjs asserts the RuleTester run on a 50000-char adversarial pattern completes and returns a defined result — no wall-clock assertion (CLAUDE.md Clock Seams / local/no-elapsed-assertion). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(#3415): triage 3 new sites, re-raise ceiling after upstream batch next merged 12 more PRs during this PR's review. Two consequences: - tests/edit-phase.test.cjs (fix #3262, unrelated) added 3 new content.match(/<tag>([\s\S]*?)<\/tag>/) reads of this repo's own workflow .md content — the same Class A pattern as the ~159 sites already triaged elsewhere in this PR. Suppressed with the same established reason. - lint-allow-test-rule-refs' ratchet ceiling needed re-raising again (301 -> 303) for the same reason as the two prior bumps: organic growth from unrelated, already-reviewed PRs landing concurrently, not a defect in this branch's own diff. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: sim <sim@local> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
167 lines
7.4 KiB
JavaScript
167 lines
7.4 KiB
JavaScript
// allow-test-rule: source-text-is-the-product
|
|
// Workflow .md / agent .md / command .md / reference .md files — their text
|
|
// IS what the runtime loads. Testing text content tests the deployed contract.
|
|
// Per CONTRIBUTING.md exception matrix.
|
|
|
|
/**
|
|
* GSD Tools Tests - autonomous --to N flag
|
|
*
|
|
* Validates that the autonomous workflow and command definition
|
|
* correctly document and support the --to N flag to stop after
|
|
* a specific phase completes.
|
|
*
|
|
* Closes: #1644
|
|
*/
|
|
|
|
const { test, describe } = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
|
|
describe('autonomous --to N flag (#1644)', () => {
|
|
const workflowPath = path.join(__dirname, '..', 'gsd-core', 'workflows', 'autonomous.md');
|
|
const commandPath = path.join(__dirname, '..', 'commands', 'gsd', 'autonomous.md');
|
|
|
|
// --- Command definition tests ---
|
|
|
|
test('command definition includes --to N in argument-hint', () => {
|
|
const content = fs.readFileSync(commandPath, 'utf8');
|
|
assert.ok(content.includes('--to N') || content.includes('--to'),
|
|
'command argument-hint should include --to flag');
|
|
// Verify it's in the argument-hint frontmatter line specifically
|
|
const hintMatch = content.match(/argument-hint:.*--to/);
|
|
assert.ok(hintMatch, 'argument-hint frontmatter should contain --to');
|
|
});
|
|
|
|
test('command definition describes --to N behavior in context', () => {
|
|
const content = fs.readFileSync(commandPath, 'utf8');
|
|
assert.ok(content.includes('--to N') || content.includes('--to'),
|
|
'command should document --to flag');
|
|
assert.ok(content.includes('stop') || content.includes('halt'),
|
|
'command should describe stopping behavior');
|
|
});
|
|
|
|
// --- Workflow parsing tests ---
|
|
|
|
test('workflow parses --to N flag into TO_PHASE variable', () => {
|
|
const content = fs.readFileSync(workflowPath, 'utf8');
|
|
assert.ok(content.includes('--to') && content.includes('TO_PHASE'),
|
|
'workflow should parse --to into TO_PHASE variable');
|
|
});
|
|
|
|
test('workflow parsing handles --to with numeric argument', () => {
|
|
const content = fs.readFileSync(workflowPath, 'utf8');
|
|
// Should have grep pattern that extracts the number after --to
|
|
// The workflow uses escaped dashes in grep: \-\-to\s+[0-9]
|
|
assert.ok(
|
|
content.includes('--to') && content.includes('TO_PHASE') && content.includes('[0-9]'),
|
|
'workflow should extract numeric value after --to flag');
|
|
});
|
|
|
|
// --- --to N stops after phase N completes ---
|
|
|
|
test('workflow iterate step checks TO_PHASE to halt after target phase', () => {
|
|
const content = fs.readFileSync(workflowPath, 'utf8');
|
|
// The iterate step should check if current phase >= TO_PHASE
|
|
assert.ok(content.includes('TO_PHASE'),
|
|
'iterate step should reference TO_PHASE');
|
|
// Should have logic to stop/halt when target phase is reached
|
|
const iterateSection = content.substring(content.indexOf('<step name="iterate">'));
|
|
assert.ok(iterateSection.includes('TO_PHASE'),
|
|
'iterate step section should check TO_PHASE to decide whether to continue');
|
|
});
|
|
|
|
// --- --to without a number shows error ---
|
|
|
|
test('workflow validates --to requires a numeric argument', () => {
|
|
const content = fs.readFileSync(workflowPath, 'utf8');
|
|
// The grep pattern requires a digit after --to, so --to without a number won't match
|
|
// and TO_PHASE stays empty (no error needed — it simply doesn't activate)
|
|
assert.ok(content.includes('TO_PHASE=""'),
|
|
'TO_PHASE defaults to empty when --to has no number (grep requires digit)');
|
|
// Verify the grep requires a numeric character after --to
|
|
assert.ok(content.includes('\\-\\-to\\s+[0-9]') || content.includes("--to\\s+[0-9]") || content.includes("--to") && content.includes('[0-9]'),
|
|
'workflow grep pattern should require a digit after --to');
|
|
});
|
|
|
|
// --- No --to flag runs all phases (existing behavior preserved) ---
|
|
|
|
test('workflow defaults TO_PHASE to empty when --to not provided', () => {
|
|
const content = fs.readFileSync(workflowPath, 'utf8');
|
|
assert.ok(content.includes('TO_PHASE=""'),
|
|
'TO_PHASE should default to empty string when --to is not provided');
|
|
});
|
|
|
|
test('workflow only halts at iterate when TO_PHASE is set', () => {
|
|
const content = fs.readFileSync(workflowPath, 'utf8');
|
|
// The halt logic should be conditional on TO_PHASE being set
|
|
const iterateSection = content.substring(content.indexOf('<step name="iterate">'));
|
|
assert.ok(
|
|
iterateSection.includes('TO_PHASE') &&
|
|
(iterateSection.includes('If `TO_PHASE`') || iterateSection.includes('TO_PHASE" is set') || iterateSection.includes('TO_PHASE` is set')),
|
|
'iterate step should only halt when TO_PHASE is set (preserving default run-all behavior)'
|
|
);
|
|
});
|
|
|
|
// --- --to N where N < current phase shows message ---
|
|
|
|
test('workflow handles --to N where target is already passed', () => {
|
|
const content = fs.readFileSync(workflowPath, 'utf8');
|
|
// Should detect when TO_PHASE is less than the first incomplete phase
|
|
assert.ok(
|
|
content.includes('TO_PHASE') &&
|
|
(content.includes('already past') || content.includes('already beyond') || content.includes('already completed')),
|
|
'workflow should handle case where --to N target is already completed/passed'
|
|
);
|
|
});
|
|
|
|
// --- Display / UX ---
|
|
|
|
test('workflow displays --to target in startup banner', () => {
|
|
const content = fs.readFileSync(workflowPath, 'utf8');
|
|
// Similar to how --from and --only display in the banner
|
|
assert.ok(
|
|
content.includes('TO_PHASE') && (content.includes('Stopping after') || content.includes('stop') || content.includes('through phase')),
|
|
'startup banner should display --to target phase'
|
|
);
|
|
});
|
|
|
|
test('workflow displays completion message when --to target reached', () => {
|
|
const content = fs.readFileSync(workflowPath, 'utf8');
|
|
const iterateSection = content.substring(content.indexOf('<step name="iterate">'));
|
|
assert.ok(
|
|
iterateSection.includes('--to') || iterateSection.includes('TO_PHASE'),
|
|
'iterate section should have --to completion messaging'
|
|
);
|
|
});
|
|
|
|
// --- Success criteria ---
|
|
|
|
test('success criteria include --to N requirements', () => {
|
|
const content = fs.readFileSync(workflowPath, 'utf8');
|
|
// eslint-disable-next-line local/no-unbounded-quantifier -- parses this repo's own workflow .md content, fixed-size author-controlled content
|
|
const criteriaMatch = content.match(/<success_criteria>([\s\S]*?)<\/success_criteria>/);
|
|
const criteria = criteriaMatch ? criteriaMatch[1] : '';
|
|
assert.ok(criteria.includes('--to'),
|
|
'success criteria should include --to requirements');
|
|
});
|
|
|
|
// --- Compatibility ---
|
|
|
|
test('--to is compatible with --from (documented or implied)', () => {
|
|
const content = fs.readFileSync(workflowPath, 'utf8');
|
|
// --to and --from should be usable together (run phases from N to M)
|
|
assert.ok(
|
|
content.includes('--to') && content.includes('--from'),
|
|
'workflow should support both --to and --from flags'
|
|
);
|
|
});
|
|
|
|
test('--to flag does not interfere with --only flag parsing', () => {
|
|
const content = fs.readFileSync(workflowPath, 'utf8');
|
|
// --only should still work independently; --to parsing should not capture --only values
|
|
const onlyParsing = content.match(/ONLY_PHASE[\s\S]{0,200}--only/);
|
|
assert.ok(onlyParsing, '--only parsing should still be present and independent');
|
|
});
|
|
});
|