* feat(#3415): ship local/no-unbounded-quantifier, burn down ReDoS class Phase 4 of epic #3212 (ADR-3212 §5/§7, the final phase). New rule flags an unbounded */+/{n,} quantifier over a broad character class ([\s\S], dotAll ., or a 1-2-unit negated class like [^\n]/[^)\n] — the exact #2128-fixed shape) applied to a regex whose match target is data-flow-traced to readFileSync content. eslint-rules/lib/readfilesync-trace.cjs extracts the data-flow tracer shared with no-crlf-fragile-split (Phase 2) rather than a second copy — no-crlf-fragile-split refactored onto it with zero behavior change, parity-tested. Real triage, not 798 mechanical edits: the ADR's census (2026-08-08) screened every unbounded quantifier in the tree unscoped. Correctly scoped to readFileSync-derived content (matching Phase 2's own G2/G3 scoping), the rule found 162 real hits across two detection waves — the second wave (93) surfaced only after a genuine off-by-one bug in this rule's own first draft was caught while writing its RuleTester tests and fixed (the bug silently missed every directly-quantified [\s\S]* with no gap before the quantifier — exactly the class this rule exists to catch). 3 hits landed in production src/ (commands.cts, milestone.cts, roadmap.cts) and were each empirically timed against adversarial input (matching #2128's own measured-not-assumed precedent) — all confirmed linear-time/benign, left unbounded with a measured-evidence comment rather than mechanically bounded. The remaining 159 are test-file fixture parsing (test-author-controlled, fixed-size content, not adversarial input) — each suppressed with a specific, non-generic reason. Zero functional behavior changed anywhere in this diff. tests/no-pending-3212-markers.test.cjs locks the epic's own closing invariant (ADR §7: "assert zero pending #3212 markers remain") — ground truth confirmed trivially true today (no phase left any such marker behind), now regression-locked going forward. Design: .gsd/phase/chore-3415-prohibition-with-teeth/40-design.md Test matrix: .gsd/phase/chore-3415-prohibition-with-teeth/50-test-matrix.md Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(#3415): correct rule category mislabel, add CI test-scope entry An orthogonal Standards-axis review found eslint-rules/no-unbounded-quantifier.cjs mistakenly carried meta.docs.category: 'Portability', copied from a sibling rule without realizing what that implied: docs/contributing/cross-platform- portability-rules.md governs an ADR-1703 rule family under a hard "zero escape hatches" contract (tests/portability-rule-disable-ban.test.cjs's PROTECTED_RULES bans eslint-disable for those rules entirely). This rule is not part of that family — it's ADR-3212 (ReDoS/CWE-1333), a different epic — and its eslint-disable-next-line suppressions (159 of them, added earlier this same phase after empirical benign-verification) are an intentional, correct design, not a bypass. Corrected to category: 'Best Practices', matching the actual precedent (no-adhoc-regex-escape.cjs, Phase 1 of the same epic, which is also correctly outside PROTECTED_RULES), and the rule's own docstring now states this explicitly so a future reader doesn't have to re-derive it. Also registers a new scripts/ci-test-scope.cjs bucket so editing this rule or the shared eslint-rules/lib/readfilesync-trace.cjs helper re-runs their own test suites under targeted CI selection — was previously unregistered and invisible to that fast-path (this PR's own gsd-test checkpoint runs the full suite regardless, so this only affects future narrowly-scoped PRs). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(#3415): bound no-unbounded-quantifier's own scanner (CWE-1333, ironic) Security review found the rule meant to catch algorithmic-complexity bugs had one of its own: hasUnboundedBroadQuantifier's negated-class inner scan walked from each `[^` occurrence to the next `]` (or EOF) with no bound, while the outer loop only ever advanced by one character — O(n²) total work on a pattern with many unclosed `[^` runs. Runs unconditionally inside checkPattern on any `new RegExp('literal string')` argument in any linted file, before the (cheap) readFileSync data-flow gate — so a single crafted string literal, no valid regex syntax required, could make `npm run lint` / CI hang. Empirically confirmed both the bug and the fix: pre-fix, n=4000/8000/ 16000/32000 chars took 30.8/115.6/463.8/1874.3ms (~4x work per 2x n, quadratic); extrapolated, the 300000-char repro from the finding would run ~165s. Post-fix (bail the inner scan once units exceeds the rule's own 1-2-unit scope, rather than continuing to hunt for a closing `]`), the same 300000-char input runs in 8.7ms via the real rule module, independently reconfirmed at 18ms via a fresh Linter.verify() call. New regression row in tests/no-unbounded-quantifier.rule.test.cjs asserts the RuleTester run on a 50000-char adversarial pattern completes and returns a defined result — no wall-clock assertion (CLAUDE.md Clock Seams / local/no-elapsed-assertion). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(#3415): triage 3 new sites, re-raise ceiling after upstream batch next merged 12 more PRs during this PR's review. Two consequences: - tests/edit-phase.test.cjs (fix #3262, unrelated) added 3 new content.match(/<tag>([\s\S]*?)<\/tag>/) reads of this repo's own workflow .md content — the same Class A pattern as the ~159 sites already triaged elsewhere in this PR. Suppressed with the same established reason. - lint-allow-test-rule-refs' ratchet ceiling needed re-raising again (301 -> 303) for the same reason as the two prior bumps: organic growth from unrelated, already-reviewed PRs landing concurrently, not a defect in this branch's own diff. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: sim <sim@local> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
151 lines
7.6 KiB
JavaScript
151 lines
7.6 KiB
JavaScript
'use strict';
|
|
|
|
/**
|
|
* Copilot capability UPGRADES — ADR-1239 / #2099 (EoS/copilot).
|
|
*
|
|
* Drives the user-reachable surface (spawned `bin/install.js` via
|
|
* `runMinimalInstall`) plus a direct negotiation-contract check to prove the
|
|
* two real upgrades Copilot contributes as part of the EoS migration:
|
|
*
|
|
* UPGRADE 1 — multi-event hook bus: buildCopilotHookConfig() previously
|
|
* emitted only `sessionStart`. This PR wires four additional events —
|
|
* `preToolUse`, `postToolUse`, `userPromptSubmitted`, `sessionEnd` — each a
|
|
* static, deterministic advisory command (no node-runner invocation), so a
|
|
* live install's hooks/gsd-session.json registers all five events.
|
|
*
|
|
* UPGRADE 2 — dispatch.background: Copilot's capability.json already
|
|
* declares `dispatch.background: true`, which legitimately EXCEEDS the
|
|
* `declarative-cli` profile baseline (`false`, per
|
|
* `PROFILE_BASELINES['declarative-cli']` in src/host-integration.cts).
|
|
* NO agent-file/frontmatter change is involved — Copilot's .agent.md
|
|
* frontmatter has no background-dispatch field (fields are
|
|
* description/infer/mcp-servers/model/name/tools). This is surfaced
|
|
* purely through the negotiated contract: a documented `true` value must
|
|
* survive negotiation without a downgrade warning.
|
|
*/
|
|
|
|
const { test } = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const fs = require('node:fs');
|
|
const path = require('node:path');
|
|
|
|
const { runMinimalInstall } = require('./helpers/install-shared.cjs');
|
|
const { cleanup } = require('./helpers.cjs');
|
|
const {
|
|
profileOf,
|
|
negotiateHostCapabilities,
|
|
PROFILE_BASELINES,
|
|
} = require('../gsd-core/bin/lib/host-integration.cjs');
|
|
|
|
const COPILOT_CAP = JSON.parse(
|
|
fs.readFileSync(path.join(__dirname, '..', 'capabilities', 'copilot', 'capability.json'), 'utf8'),
|
|
);
|
|
const COPILOT_AXES = COPILOT_CAP.runtime.hostIntegration;
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// UPGRADE 1: multi-event hook bus — all 4 newly-wired events' live-install
|
|
// coverage, on top of the pre-existing sessionStart.
|
|
// ---------------------------------------------------------------------------
|
|
|
|
const NEWLY_WIRED_EVENTS = ['preToolUse', 'postToolUse', 'userPromptSubmitted', 'sessionEnd'];
|
|
const ALL_EXPECTED_EVENTS = ['sessionStart', ...NEWLY_WIRED_EVENTS];
|
|
|
|
test('copilot --global: hooks/gsd-session.json wires sessionStart plus all 4 newly-added events (UPGRADE 1)', (t) => {
|
|
const { configDir, root } = runMinimalInstall({ runtime: 'copilot', scope: 'global' });
|
|
t.after(() => cleanup(root));
|
|
|
|
const hookPath = path.join(configDir, 'hooks', 'gsd-session.json');
|
|
assert.ok(fs.existsSync(hookPath), `${hookPath} must exist`);
|
|
const parsed = JSON.parse(fs.readFileSync(hookPath, 'utf8'));
|
|
|
|
assert.strictEqual(parsed.version, 1, 'hook config version must be 1');
|
|
assert.ok(parsed.hooks && typeof parsed.hooks === 'object', 'has hooks object');
|
|
|
|
for (const eventName of ALL_EXPECTED_EVENTS) {
|
|
const eventHooks = parsed.hooks[eventName];
|
|
assert.ok(Array.isArray(eventHooks) && eventHooks.length > 0,
|
|
`hooks.${eventName} must exist and be non-empty`);
|
|
const entry = eventHooks[0];
|
|
assert.strictEqual(entry.type, 'command', `${eventName} entry type must be 'command'`);
|
|
assert.ok(typeof entry.bash === 'string' && entry.bash.length > 0,
|
|
`${eventName} entry must have a non-empty inline bash body`);
|
|
assert.ok(typeof entry.powershell === 'string' && entry.powershell.length > 0,
|
|
`${eventName} entry must have a non-empty inline powershell body`);
|
|
assert.strictEqual(entry.timeoutSec, 10, `${eventName} entry must use timeoutSec 10`);
|
|
}
|
|
});
|
|
|
|
test('each newly-wired event emits a distinct static advisory (no shared boilerplate, no node-runner invocation)', (t) => {
|
|
const { configDir, root } = runMinimalInstall({ runtime: 'copilot', scope: 'global' });
|
|
t.after(() => cleanup(root));
|
|
|
|
const hookPath = path.join(configDir, 'hooks', 'gsd-session.json');
|
|
const parsed = JSON.parse(fs.readFileSync(hookPath, 'utf8'));
|
|
|
|
const bashBodies = new Set();
|
|
for (const eventName of ALL_EXPECTED_EVENTS) {
|
|
const entry = parsed.hooks[eventName][0];
|
|
assert.ok(entry.bash.includes('"additionalContext"'),
|
|
`${eventName} bash body must emit the additionalContext JSON envelope`);
|
|
assert.ok(!/hooks\/gsd-[\w-]+\.(js|cjs|sh)/.test(entry.bash),
|
|
`${eventName} bash body must not reference an external hook script (cannot dangle)`);
|
|
bashBodies.add(entry.bash);
|
|
}
|
|
assert.strictEqual(bashBodies.size, ALL_EXPECTED_EVENTS.length,
|
|
'each event must emit its own distinct advisory command, not a copy-pasted duplicate');
|
|
});
|
|
|
|
test('a runtime whose hook config omits the new events does NOT get them (descriptor-gated, not a global default)', (t) => {
|
|
const { configDir, root } = runMinimalInstall({ runtime: 'claude', scope: 'global' });
|
|
t.after(() => cleanup(root));
|
|
|
|
// Claude uses settings.json, not hooks/gsd-session.json — the Copilot
|
|
// multi-event bus additions are self-contained to buildCopilotHookConfig
|
|
// and must not leak into another runtime's hook surface.
|
|
const copilotHookPath = path.join(configDir, 'hooks', 'gsd-session.json');
|
|
assert.ok(!fs.existsSync(copilotHookPath),
|
|
'claude must not have a Copilot-style hooks/gsd-session.json file');
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// UPGRADE 2: dispatch.background negotiation — documented true survives,
|
|
// exceeding the declarative-cli profile baseline. No agent-file/frontmatter
|
|
// change; negotiated-contract only (Copilot .agent.md has no background field).
|
|
// ---------------------------------------------------------------------------
|
|
|
|
test("copilot classifies as the 'declarative-cli' profile, whose baseline dispatch.background is false", () => {
|
|
assert.equal(profileOf(COPILOT_AXES), 'declarative-cli');
|
|
assert.equal(PROFILE_BASELINES['declarative-cli'].dispatch.background, false,
|
|
'sanity: the declarative-cli baseline is false — copilot legitimately exceeds it');
|
|
});
|
|
|
|
test('negotiateHostCapabilities surfaces copilot\'s documented dispatch.background:true with no downgrade warning (UPGRADE 2)', () => {
|
|
assert.equal(COPILOT_AXES.dispatch.background, true,
|
|
'sanity: the descriptor declares dispatch.background: true (documented, not undocumented)');
|
|
|
|
const { effective, warnings } = negotiateHostCapabilities(COPILOT_AXES);
|
|
|
|
assert.equal(effective.dispatch.background, true,
|
|
'a documented true value must survive negotiation, exceeding the declarative-cli baseline of false');
|
|
assert.ok(
|
|
!warnings.some((w) => w.includes('dispatch.background')),
|
|
`no warning may be raised for the documented dispatch.background axis, got: ${JSON.stringify(warnings)}`,
|
|
);
|
|
});
|
|
|
|
test('copilot .agent.md frontmatter has no background-dispatch field (negotiated contract only, sanity)', (t) => {
|
|
const { configDir, root } = runMinimalInstall({ runtime: 'copilot', scope: 'global' });
|
|
t.after(() => cleanup(root));
|
|
|
|
const agentsDir = path.join(configDir, 'agents');
|
|
const agentFiles = fs.readdirSync(agentsDir).filter((f) => f.endsWith('.agent.md'));
|
|
assert.ok(agentFiles.length > 0, 'at least one .agent.md must be installed');
|
|
|
|
const sample = fs.readFileSync(path.join(agentsDir, agentFiles[0]), 'utf8');
|
|
// eslint-disable-next-line local/no-unbounded-quantifier -- parses this repo's own installed agent .md frontmatter, fixed-size author-controlled content
|
|
const frontmatterMatch = sample.match(/^---\r?\n([\s\S]*?)\r?\n---/);
|
|
assert.ok(frontmatterMatch, 'agent file must have a frontmatter block');
|
|
assert.ok(!/^background:/m.test(frontmatterMatch[1]),
|
|
'UPGRADE 2 must not add a background: frontmatter field — Copilot .agent.md has no such field');
|
|
});
|