* feat(#3415): ship local/no-unbounded-quantifier, burn down ReDoS class Phase 4 of epic #3212 (ADR-3212 §5/§7, the final phase). New rule flags an unbounded */+/{n,} quantifier over a broad character class ([\s\S], dotAll ., or a 1-2-unit negated class like [^\n]/[^)\n] — the exact #2128-fixed shape) applied to a regex whose match target is data-flow-traced to readFileSync content. eslint-rules/lib/readfilesync-trace.cjs extracts the data-flow tracer shared with no-crlf-fragile-split (Phase 2) rather than a second copy — no-crlf-fragile-split refactored onto it with zero behavior change, parity-tested. Real triage, not 798 mechanical edits: the ADR's census (2026-08-08) screened every unbounded quantifier in the tree unscoped. Correctly scoped to readFileSync-derived content (matching Phase 2's own G2/G3 scoping), the rule found 162 real hits across two detection waves — the second wave (93) surfaced only after a genuine off-by-one bug in this rule's own first draft was caught while writing its RuleTester tests and fixed (the bug silently missed every directly-quantified [\s\S]* with no gap before the quantifier — exactly the class this rule exists to catch). 3 hits landed in production src/ (commands.cts, milestone.cts, roadmap.cts) and were each empirically timed against adversarial input (matching #2128's own measured-not-assumed precedent) — all confirmed linear-time/benign, left unbounded with a measured-evidence comment rather than mechanically bounded. The remaining 159 are test-file fixture parsing (test-author-controlled, fixed-size content, not adversarial input) — each suppressed with a specific, non-generic reason. Zero functional behavior changed anywhere in this diff. tests/no-pending-3212-markers.test.cjs locks the epic's own closing invariant (ADR §7: "assert zero pending #3212 markers remain") — ground truth confirmed trivially true today (no phase left any such marker behind), now regression-locked going forward. Design: .gsd/phase/chore-3415-prohibition-with-teeth/40-design.md Test matrix: .gsd/phase/chore-3415-prohibition-with-teeth/50-test-matrix.md Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(#3415): correct rule category mislabel, add CI test-scope entry An orthogonal Standards-axis review found eslint-rules/no-unbounded-quantifier.cjs mistakenly carried meta.docs.category: 'Portability', copied from a sibling rule without realizing what that implied: docs/contributing/cross-platform- portability-rules.md governs an ADR-1703 rule family under a hard "zero escape hatches" contract (tests/portability-rule-disable-ban.test.cjs's PROTECTED_RULES bans eslint-disable for those rules entirely). This rule is not part of that family — it's ADR-3212 (ReDoS/CWE-1333), a different epic — and its eslint-disable-next-line suppressions (159 of them, added earlier this same phase after empirical benign-verification) are an intentional, correct design, not a bypass. Corrected to category: 'Best Practices', matching the actual precedent (no-adhoc-regex-escape.cjs, Phase 1 of the same epic, which is also correctly outside PROTECTED_RULES), and the rule's own docstring now states this explicitly so a future reader doesn't have to re-derive it. Also registers a new scripts/ci-test-scope.cjs bucket so editing this rule or the shared eslint-rules/lib/readfilesync-trace.cjs helper re-runs their own test suites under targeted CI selection — was previously unregistered and invisible to that fast-path (this PR's own gsd-test checkpoint runs the full suite regardless, so this only affects future narrowly-scoped PRs). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(#3415): bound no-unbounded-quantifier's own scanner (CWE-1333, ironic) Security review found the rule meant to catch algorithmic-complexity bugs had one of its own: hasUnboundedBroadQuantifier's negated-class inner scan walked from each `[^` occurrence to the next `]` (or EOF) with no bound, while the outer loop only ever advanced by one character — O(n²) total work on a pattern with many unclosed `[^` runs. Runs unconditionally inside checkPattern on any `new RegExp('literal string')` argument in any linted file, before the (cheap) readFileSync data-flow gate — so a single crafted string literal, no valid regex syntax required, could make `npm run lint` / CI hang. Empirically confirmed both the bug and the fix: pre-fix, n=4000/8000/ 16000/32000 chars took 30.8/115.6/463.8/1874.3ms (~4x work per 2x n, quadratic); extrapolated, the 300000-char repro from the finding would run ~165s. Post-fix (bail the inner scan once units exceeds the rule's own 1-2-unit scope, rather than continuing to hunt for a closing `]`), the same 300000-char input runs in 8.7ms via the real rule module, independently reconfirmed at 18ms via a fresh Linter.verify() call. New regression row in tests/no-unbounded-quantifier.rule.test.cjs asserts the RuleTester run on a 50000-char adversarial pattern completes and returns a defined result — no wall-clock assertion (CLAUDE.md Clock Seams / local/no-elapsed-assertion). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(#3415): triage 3 new sites, re-raise ceiling after upstream batch next merged 12 more PRs during this PR's review. Two consequences: - tests/edit-phase.test.cjs (fix #3262, unrelated) added 3 new content.match(/<tag>([\s\S]*?)<\/tag>/) reads of this repo's own workflow .md content — the same Class A pattern as the ~159 sites already triaged elsewhere in this PR. Suppressed with the same established reason. - lint-allow-test-rule-refs' ratchet ceiling needed re-raising again (301 -> 303) for the same reason as the two prior bumps: organic growth from unrelated, already-reviewed PRs landing concurrently, not a defect in this branch's own diff. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: sim <sim@local> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
270 lines
12 KiB
JavaScript
270 lines
12 KiB
JavaScript
// allow-test-rule: source-text-is-the-product
|
|
// Workflow .md / agent .md / command .md / reference .md files — their text
|
|
// IS what the runtime loads. Testing text content tests the deployed contract.
|
|
// Per CONTRIBUTING.md exception matrix.
|
|
|
|
/**
|
|
* Tests for modular decomposition of agents/gsd-planner.md
|
|
*
|
|
* Verifies that:
|
|
* 1. gsd-planner.md stays under the 100K agent file threshold
|
|
* 2. gsd-planner.md is under 45K chars (proving the three mode sections were extracted)
|
|
* 3. The three reference files exist
|
|
* 4. gsd-planner.md contains reference pointers to each extracted file
|
|
* 5. Each reference file contains key content from the original mode section
|
|
*/
|
|
'use strict';
|
|
|
|
const { describe, test } = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
|
|
const PROJECT_ROOT = path.join(__dirname, '..');
|
|
|
|
// ─── Size thresholds ─────────────────────────────────────────────────────────
|
|
|
|
const AGENT_FILE_SIZE_LIMIT = 100 * 1024; // 100K — appropriate for version-controlled source
|
|
const PLANNER_EXTRACTED_LIMIT = 48 * 1024; // 48K — proves extraction happened
|
|
|
|
// ─── File paths ──────────────────────────────────────────────────────────────
|
|
|
|
const PLANNER_PATH = path.join(PROJECT_ROOT, 'agents', 'gsd-planner.md');
|
|
const GAP_CLOSURE_REF = path.join(PROJECT_ROOT, 'gsd-core', 'references', 'planner-gap-closure.md');
|
|
const REVISION_REF = path.join(PROJECT_ROOT, 'gsd-core', 'references', 'planner-revision.md');
|
|
const REVIEWS_REF = path.join(PROJECT_ROOT, 'gsd-core', 'references', 'planner-reviews.md');
|
|
|
|
// ─── gsd-planner.md size ─────────────────────────────────────────────────────
|
|
|
|
describe('gsd-planner.md size constraints', () => {
|
|
test('planner file exists', () => {
|
|
assert.ok(fs.existsSync(PLANNER_PATH), `Missing: ${PLANNER_PATH}`);
|
|
});
|
|
|
|
test('planner is under 100K chars (agent file threshold)', () => {
|
|
const raw = fs.readFileSync(PLANNER_PATH, 'utf-8');
|
|
// Normalize CRLF → LF before measuring — Windows checkouts inflate length by ~1 char/line
|
|
const content = raw.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
|
|
assert.ok(
|
|
content.length < AGENT_FILE_SIZE_LIMIT,
|
|
`gsd-planner.md is ${content.length} chars, exceeds 100K agent threshold`
|
|
);
|
|
});
|
|
|
|
test('planner is under 45K chars (proves mode sections were extracted)', () => {
|
|
const raw = fs.readFileSync(PLANNER_PATH, 'utf-8');
|
|
// Normalize CRLF → LF before measuring — Windows checkouts inflate length by ~1 char/line
|
|
const content = raw.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
|
|
assert.ok(
|
|
content.length < PLANNER_EXTRACTED_LIMIT,
|
|
`gsd-planner.md is ${content.length} chars, expected < 45K after extracting mode sections`
|
|
);
|
|
});
|
|
});
|
|
|
|
// ─── Reference files exist ───────────────────────────────────────────────────
|
|
|
|
describe('extracted reference files exist', () => {
|
|
test('planner-gap-closure.md exists', () => {
|
|
assert.ok(fs.existsSync(GAP_CLOSURE_REF), `Missing: ${GAP_CLOSURE_REF}`);
|
|
});
|
|
|
|
test('planner-revision.md exists', () => {
|
|
assert.ok(fs.existsSync(REVISION_REF), `Missing: ${REVISION_REF}`);
|
|
});
|
|
|
|
test('planner-reviews.md exists', () => {
|
|
assert.ok(fs.existsSync(REVIEWS_REF), `Missing: ${REVIEWS_REF}`);
|
|
});
|
|
});
|
|
|
|
// ─── gsd-planner.md contains reference pointers ──────────────────────────────
|
|
|
|
describe('gsd-planner.md contains reference pointers to extracted files', () => {
|
|
let plannerContent;
|
|
|
|
test('planner references planner-gap-closure.md', () => {
|
|
plannerContent = plannerContent || fs.readFileSync(PLANNER_PATH, 'utf-8');
|
|
assert.ok(
|
|
plannerContent.includes('planner-gap-closure.md'),
|
|
'gsd-planner.md must reference planner-gap-closure.md'
|
|
);
|
|
});
|
|
|
|
test('planner references planner-revision.md', () => {
|
|
plannerContent = plannerContent || fs.readFileSync(PLANNER_PATH, 'utf-8');
|
|
assert.ok(
|
|
plannerContent.includes('planner-revision.md'),
|
|
'gsd-planner.md must reference planner-revision.md'
|
|
);
|
|
});
|
|
|
|
test('planner references planner-reviews.md', () => {
|
|
plannerContent = plannerContent || fs.readFileSync(PLANNER_PATH, 'utf-8');
|
|
assert.ok(
|
|
plannerContent.includes('planner-reviews.md'),
|
|
'gsd-planner.md must reference planner-reviews.md'
|
|
);
|
|
});
|
|
});
|
|
|
|
// ─── Reference files contain key content ────────────────────────────────────
|
|
|
|
describe('reference files contain key content from original mode sections', () => {
|
|
test('planner-gap-closure.md contains gap closure content', () => {
|
|
const content = fs.readFileSync(GAP_CLOSURE_REF, 'utf-8');
|
|
const hasGapContent = content.toLowerCase().includes('gap_closure') ||
|
|
content.toLowerCase().includes('gap closure') ||
|
|
content.includes('GAP CLOSURE') ||
|
|
content.includes('--gaps');
|
|
assert.ok(hasGapContent, 'planner-gap-closure.md must contain gap closure mode content');
|
|
});
|
|
|
|
// #3440: the planner's gap-closure return has NO completion marker — nothing
|
|
// consumed `## GAP CLOSURE PLANS CREATED` (no dispatch branch anywhere), so
|
|
// emitting it was a lie about the return contract. Completion is detected via
|
|
// the `gap_closure: true` fix-plan artifacts. This guard goes red if the
|
|
// marker (or an equivalent unconsumed sentinel) reappears in either producer.
|
|
test('gap-closure return is artifact-based — no unconsumed completion marker (#3440)', () => {
|
|
const guidance = fs.readFileSync(
|
|
path.join(PROJECT_ROOT, 'gsd-core', 'references', 'planner-guidance.md'), 'utf-8');
|
|
const planner = fs.readFileSync(
|
|
path.join(PROJECT_ROOT, 'agents', 'gsd-planner.md'), 'utf-8');
|
|
for (const [label, content] of [['planner-guidance.md', guidance], ['gsd-planner.md', planner]]) {
|
|
assert.ok(
|
|
!content.includes('## GAP CLOSURE PLANS CREATED'),
|
|
`${label} must not emit the retired marker — no workflow dispatches on it (#3440)`,
|
|
);
|
|
}
|
|
assert.ok(
|
|
guidance.includes('gap_closure: true'),
|
|
'planner-guidance.md must document the artifact return contract (gap_closure: true plans)',
|
|
);
|
|
assert.ok(
|
|
guidance.includes('--gaps-only'),
|
|
'planner-guidance.md must name the consumer route (execute-phase --gaps-only)',
|
|
);
|
|
});
|
|
|
|
test('planner-revision.md contains revision content', () => {
|
|
const content = fs.readFileSync(REVISION_REF, 'utf-8');
|
|
const hasRevisionContent = content.includes('revision') ||
|
|
content.includes('Revision') ||
|
|
content.includes('REVISION') ||
|
|
content.includes('revision_context');
|
|
assert.ok(hasRevisionContent, 'planner-revision.md must contain revision mode content');
|
|
});
|
|
|
|
test('planner-reviews.md contains reviews content', () => {
|
|
const content = fs.readFileSync(REVIEWS_REF, 'utf-8');
|
|
const hasReviewsContent = content.includes('reviews') ||
|
|
content.includes('Reviews') ||
|
|
content.includes('REVIEWS') ||
|
|
content.includes('REVIEWS.md');
|
|
assert.ok(hasReviewsContent, 'planner-reviews.md must contain reviews mode content');
|
|
});
|
|
});
|
|
|
|
|
|
// ────────────────────────────────────────────────────────────────────────
|
|
// Folded from tests/bug-3320-planner-deep-work-rules.test.cjs — consolidation epic #1969 (B4 #1973)
|
|
// ────────────────────────────────────────────────────────────────────────
|
|
{
|
|
const { describe: __foldDescribe } = require('node:test');
|
|
__foldDescribe("folded:bug-3320-planner-deep-work-rules (consolidation epic #1969 B4 #1973)", () => {
|
|
'use strict';
|
|
|
|
// allow-test-rule: source-text-is-the-product [#3320]
|
|
// The bug is a contradiction in prompt/workflow source text. These assertions
|
|
// intentionally pin the contract words that planner agents consume.
|
|
|
|
const { describe, test } = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
|
|
const ROOT = path.join(__dirname, '..');
|
|
const PLANNER_AGENT = path.join(ROOT, 'agents', 'gsd-planner.md');
|
|
const PLAN_PHASE_WORKFLOW = path.join(ROOT, 'gsd-core', 'workflows', 'plan-phase.md');
|
|
|
|
function read(relativePath) {
|
|
return fs.readFileSync(path.join(ROOT, relativePath), 'utf8');
|
|
}
|
|
|
|
function extractDeepWorkRules() {
|
|
const workflow = fs.readFileSync(PLAN_PHASE_WORKFLOW, 'utf8');
|
|
// eslint-disable-next-line local/no-unbounded-quantifier -- parses this repo's own workflow .md content, fixed-size author-controlled content
|
|
const match = workflow.match(/<deep_work_rules>[\s\S]*?<\/deep_work_rules>/);
|
|
assert.ok(match, 'plan-phase.md must contain a deep_work_rules block');
|
|
return match[0];
|
|
}
|
|
|
|
describe('bug #3320 planner action contract', () => {
|
|
test('planner agent explicitly keeps implementation code out of action blocks', () => {
|
|
const planner = fs.readFileSync(PLANNER_AGENT, 'utf8');
|
|
|
|
assert.match(
|
|
planner,
|
|
/NEVER place fenced code blocks \(```\) inside `<action>`/,
|
|
'gsd-planner.md must explicitly forbid fenced implementation code in <action>'
|
|
);
|
|
assert.match(
|
|
planner,
|
|
/Code excerpts belong in `<read_first>` source files or referenced context/,
|
|
'gsd-planner.md must route code excerpts to context/read-first material'
|
|
);
|
|
});
|
|
|
|
test('plan-phase deep_work_rules no longer requires self-sufficient code dumps', () => {
|
|
const deepWorkRules = extractDeepWorkRules();
|
|
|
|
assert.doesNotMatch(
|
|
deepWorkRules,
|
|
/copy them into the action verbatim/,
|
|
'deep_work_rules must not tell planners to copy source material verbatim into <action>'
|
|
);
|
|
assert.doesNotMatch(
|
|
deepWorkRules,
|
|
/complete the task from the action text alone/,
|
|
'deep_work_rules must not make <action> self-sufficient without read_first/context'
|
|
);
|
|
assert.match(
|
|
deepWorkRules,
|
|
/Do not include full file contents, fenced code blocks, or complete implementations in `<action>`/,
|
|
'deep_work_rules must explicitly bound concrete values to avoid code dumping'
|
|
);
|
|
});
|
|
|
|
test('plan-phase acceptance criteria allow behavior and test assertions', () => {
|
|
const deepWorkRules = extractDeepWorkRules();
|
|
|
|
assert.match(
|
|
deepWorkRules,
|
|
/behavior assertion/,
|
|
'acceptance criteria must allow behavior assertions, not just grep checks'
|
|
);
|
|
assert.match(
|
|
deepWorkRules,
|
|
/test command/,
|
|
'acceptance criteria must allow test-command assertions'
|
|
);
|
|
});
|
|
|
|
test('quality gate matches the reconciled planner contract', () => {
|
|
const workflow = read('gsd-core/workflows/plan-phase.md');
|
|
|
|
assert.match(
|
|
workflow,
|
|
/Every task has `<acceptance_criteria>` with behavior, test-command, CLI, or source assertions/,
|
|
'quality gate must not narrow acceptance criteria back to grep-only checks'
|
|
);
|
|
assert.match(
|
|
workflow,
|
|
/Every `<action>` contains concrete identifiers without fenced code blocks or full implementations/,
|
|
'quality gate must enforce concrete prose without implementation dumps'
|
|
);
|
|
});
|
|
});
|
|
});
|
|
}
|