Files
msd-core/tests
Tom Boucher b6ebf9d4b4 fix(#2449): make tdd.review-checkpoint frontmatter regex CRLF-tolerant (#2477)
* test(#2449): failing-first CRLF regression for tdd.review-checkpoint

cmdTddReviewCheckpoint's frontmatter regex /^---\\n...\\n---/ (line 751)
cannot match CRLF PLAN.md, so a type:tdd plan with Windows line endings
was silently classified as 'no type:tdd plans' — output indistinguishable
from a phase that genuinely contains no TDD plans. The advisory gate then
short-circuited to a confident pass with no violations table.

Adds tddPlanCrlf() fixture helper (CRLF twin of tddPlan) and a [crlf]
test case that asserts tddPlans===1 for a CRLF type:tdd plan (would be 0
before the fix), plus block:true/violations:1 since the fixture has no
RED/GREEN commits.

* fix(#2449): make tdd-review-checkpoint frontmatter regex CRLF-tolerant

The frontmatter delimiter regex at src/check-command-router.cts:751 used
literal \\n which cannot match a CRLF PLAN.md delimiter (---\\r\\n).
frontmatterMatch was null, the plan was never classified type:tdd,
tddPlanFiles stayed empty, and the advisory gate short-circuited to a
confident pass with no violations table.

The fix replaces /^---\\n([\\s\\S]*?)\\n---/ with
/^---\\r?\\n([\\s\\S]*?)\\r?\\n---/ — the same CRLF-tolerant form
already used elsewhere in the same file at line 205
(extractPlanDesignatedSections). Same canonical pattern; one-line change.

Same bug class previously fixed in #1658, #1668, #2206; this instance is
in a different file and is not a duplicate of any of them.

* fix(#2444): re-resolve body-parser to 2.3.0 in lockfile (GHSA-v422-hmwv-36x6)

GHSA-v422-hmwv-36x6 (body-parser DoS via invalid limit value, low severity,
published 2026-07-20T23:23:26Z) made tests/npm-integrity-gate.test.cjs
(#3588: root workspace production tree has no advisories) fail any subsequent
npm audit --omit=dev. The advisory affects body-parser >=2.0.0 <2.3.0 pulled
transitively via @anthropic-ai/claude-agent-sdk -> @modelcontextprotocol/sdk
-> express -> body-parser@2.2.2.

express@5.2.1 already declares body-parser as ^2.2.1, so 2.3.0 is a valid
re-resolution within express's own compatibility range — no override needed.
Regenerated the lockfile via 'npm audit fix --omit=dev' which re-resolves
transitive deps within their declared ranges; package.json is unchanged.

Verified: npm audit --omit=dev reports 0/0/0/0/0 advisories; body-parser
now reads as 2.3.0 in 'npm ls body-parser --omit=dev'.

* test(#2449): add mixed-endings (CRLF frontmatter + LF body) variant

Per code-review Low finding: CONTRIBUTING.md:490 names 'Mixed CRLF/LF
newlines' as a required adversarial fixture class. The pure-CRLF [crlf]
test covers the reported bug (Windows editor + autocrlf=input). This
[crlf-mixed] variant covers the more adversarial case where frontmatter
delimiters are CRLF but the body is LF (editor that normalizes body text,
or a toolchain concatenating CRLF + LF fragments). The classifier only
reads frontmatter, so detection is unaffected — but the test locks the
behavior.

* docs(changeset): add Fixed fragment for #2449 PR

* docs(changeset): backfill PR number to 2477
2026-07-21 08:13:13 -04:00
..