* feat(#3415): ship local/no-unbounded-quantifier, burn down ReDoS class Phase 4 of epic #3212 (ADR-3212 §5/§7, the final phase). New rule flags an unbounded */+/{n,} quantifier over a broad character class ([\s\S], dotAll ., or a 1-2-unit negated class like [^\n]/[^)\n] — the exact #2128-fixed shape) applied to a regex whose match target is data-flow-traced to readFileSync content. eslint-rules/lib/readfilesync-trace.cjs extracts the data-flow tracer shared with no-crlf-fragile-split (Phase 2) rather than a second copy — no-crlf-fragile-split refactored onto it with zero behavior change, parity-tested. Real triage, not 798 mechanical edits: the ADR's census (2026-08-08) screened every unbounded quantifier in the tree unscoped. Correctly scoped to readFileSync-derived content (matching Phase 2's own G2/G3 scoping), the rule found 162 real hits across two detection waves — the second wave (93) surfaced only after a genuine off-by-one bug in this rule's own first draft was caught while writing its RuleTester tests and fixed (the bug silently missed every directly-quantified [\s\S]* with no gap before the quantifier — exactly the class this rule exists to catch). 3 hits landed in production src/ (commands.cts, milestone.cts, roadmap.cts) and were each empirically timed against adversarial input (matching #2128's own measured-not-assumed precedent) — all confirmed linear-time/benign, left unbounded with a measured-evidence comment rather than mechanically bounded. The remaining 159 are test-file fixture parsing (test-author-controlled, fixed-size content, not adversarial input) — each suppressed with a specific, non-generic reason. Zero functional behavior changed anywhere in this diff. tests/no-pending-3212-markers.test.cjs locks the epic's own closing invariant (ADR §7: "assert zero pending #3212 markers remain") — ground truth confirmed trivially true today (no phase left any such marker behind), now regression-locked going forward. Design: .gsd/phase/chore-3415-prohibition-with-teeth/40-design.md Test matrix: .gsd/phase/chore-3415-prohibition-with-teeth/50-test-matrix.md Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(#3415): correct rule category mislabel, add CI test-scope entry An orthogonal Standards-axis review found eslint-rules/no-unbounded-quantifier.cjs mistakenly carried meta.docs.category: 'Portability', copied from a sibling rule without realizing what that implied: docs/contributing/cross-platform- portability-rules.md governs an ADR-1703 rule family under a hard "zero escape hatches" contract (tests/portability-rule-disable-ban.test.cjs's PROTECTED_RULES bans eslint-disable for those rules entirely). This rule is not part of that family — it's ADR-3212 (ReDoS/CWE-1333), a different epic — and its eslint-disable-next-line suppressions (159 of them, added earlier this same phase after empirical benign-verification) are an intentional, correct design, not a bypass. Corrected to category: 'Best Practices', matching the actual precedent (no-adhoc-regex-escape.cjs, Phase 1 of the same epic, which is also correctly outside PROTECTED_RULES), and the rule's own docstring now states this explicitly so a future reader doesn't have to re-derive it. Also registers a new scripts/ci-test-scope.cjs bucket so editing this rule or the shared eslint-rules/lib/readfilesync-trace.cjs helper re-runs their own test suites under targeted CI selection — was previously unregistered and invisible to that fast-path (this PR's own gsd-test checkpoint runs the full suite regardless, so this only affects future narrowly-scoped PRs). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(#3415): bound no-unbounded-quantifier's own scanner (CWE-1333, ironic) Security review found the rule meant to catch algorithmic-complexity bugs had one of its own: hasUnboundedBroadQuantifier's negated-class inner scan walked from each `[^` occurrence to the next `]` (or EOF) with no bound, while the outer loop only ever advanced by one character — O(n²) total work on a pattern with many unclosed `[^` runs. Runs unconditionally inside checkPattern on any `new RegExp('literal string')` argument in any linted file, before the (cheap) readFileSync data-flow gate — so a single crafted string literal, no valid regex syntax required, could make `npm run lint` / CI hang. Empirically confirmed both the bug and the fix: pre-fix, n=4000/8000/ 16000/32000 chars took 30.8/115.6/463.8/1874.3ms (~4x work per 2x n, quadratic); extrapolated, the 300000-char repro from the finding would run ~165s. Post-fix (bail the inner scan once units exceeds the rule's own 1-2-unit scope, rather than continuing to hunt for a closing `]`), the same 300000-char input runs in 8.7ms via the real rule module, independently reconfirmed at 18ms via a fresh Linter.verify() call. New regression row in tests/no-unbounded-quantifier.rule.test.cjs asserts the RuleTester run on a 50000-char adversarial pattern completes and returns a defined result — no wall-clock assertion (CLAUDE.md Clock Seams / local/no-elapsed-assertion). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(#3415): triage 3 new sites, re-raise ceiling after upstream batch next merged 12 more PRs during this PR's review. Two consequences: - tests/edit-phase.test.cjs (fix #3262, unrelated) added 3 new content.match(/<tag>([\s\S]*?)<\/tag>/) reads of this repo's own workflow .md content — the same Class A pattern as the ~159 sites already triaged elsewhere in this PR. Suppressed with the same established reason. - lint-allow-test-rule-refs' ratchet ceiling needed re-raising again (301 -> 303) for the same reason as the two prior bumps: organic growth from unrelated, already-reviewed PRs landing concurrently, not a defect in this branch's own diff. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: sim <sim@local> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
305 lines
14 KiB
JavaScript
305 lines
14 KiB
JavaScript
// allow-test-rule: structural-implementation-guard
|
|
// init.cjs cmdInitPlanPhase must expose text_mode in its returned flags object.
|
|
// The behavioral alternative (run plan-phase init and inspect JSON output) is
|
|
// fragile across runtime variations. Structural inspection guards the contract
|
|
// until a stable behavioral API test is in place.
|
|
|
|
/**
|
|
* Discuss Mode Config Tests
|
|
*
|
|
* Validates workflow.discuss_mode config, routing, and assumptions workflow integration.
|
|
*/
|
|
|
|
const { test, describe } = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
|
|
describe('workflow.discuss_mode config', () => {
|
|
test('config template includes discuss_mode default', () => {
|
|
const template = JSON.parse(
|
|
fs.readFileSync(path.join(__dirname, '..', 'gsd-core', 'templates', 'config.json'), 'utf8')
|
|
);
|
|
assert.strictEqual(template.workflow.discuss_mode, 'discuss');
|
|
});
|
|
|
|
test('discuss-phase command references both workflow files', () => {
|
|
const command = fs.readFileSync(
|
|
path.join(__dirname, '..', 'commands', 'gsd', 'discuss-phase.md'), 'utf8'
|
|
);
|
|
assert.ok(command.includes('discuss-phase-assumptions.md'), 'should reference assumptions workflow');
|
|
assert.ok(command.includes('discuss-phase.md'), 'should reference discuss workflow');
|
|
assert.ok(command.includes('workflow.discuss_mode'), 'should reference config key');
|
|
});
|
|
|
|
test('discuss-phase command process block defers to workflow file (not inline instructions)', () => {
|
|
const command = fs.readFileSync(
|
|
path.join(__dirname, '..', 'commands', 'gsd', 'discuss-phase.md'), 'utf8'
|
|
);
|
|
// Extract the <process> block
|
|
// eslint-disable-next-line local/no-unbounded-quantifier -- parses this repo's own command .md content, fixed-size author-controlled content
|
|
const processMatch = command.match(/<process>([\s\S]*?)<\/process>/);
|
|
assert.ok(processMatch, 'should have a <process> block');
|
|
const processBlock = processMatch[1];
|
|
|
|
// The process block must explicitly tell the agent to read the workflow file
|
|
assert.ok(
|
|
processBlock.includes('Read and execute'),
|
|
'process block should direct agent to read and execute workflow file'
|
|
);
|
|
assert.ok(
|
|
processBlock.includes('MANDATORY'),
|
|
'process block should include MANDATORY instruction to read workflow files'
|
|
);
|
|
|
|
// The process block must NOT contain detailed step-by-step instructions
|
|
// that could substitute for the actual workflow file
|
|
assert.ok(
|
|
!processBlock.includes('Scout codebase'),
|
|
'process block should not contain detailed workflow steps (Scout codebase)'
|
|
);
|
|
assert.ok(
|
|
!processBlock.includes('Deep-dive each area'),
|
|
'process block should not contain detailed workflow steps (Deep-dive)'
|
|
);
|
|
assert.ok(
|
|
!processBlock.includes('Probing depth'),
|
|
'process block should not contain detailed workflow steps (Probing depth)'
|
|
);
|
|
});
|
|
|
|
test('discuss-phase command argument-hint includes --text', () => {
|
|
const command = fs.readFileSync(
|
|
path.join(__dirname, '..', 'commands', 'gsd', 'discuss-phase.md'), 'utf8'
|
|
);
|
|
assert.ok(command.includes('--text'), 'argument-hint should include --text');
|
|
});
|
|
|
|
test('assumptions workflow file exists and has required steps', () => {
|
|
const workflow = fs.readFileSync(
|
|
path.join(__dirname, '..', 'gsd-core', 'workflows', 'discuss-phase-assumptions.md'), 'utf8'
|
|
);
|
|
const requiredSteps = [
|
|
'initialize', 'check_existing', 'load_prior_context',
|
|
'deep_codebase_analysis', 'present_assumptions', 'correct_assumptions',
|
|
'write_context', 'write_discussion_log', 'auto_advance'
|
|
];
|
|
for (const step of requiredSteps) {
|
|
assert.ok(workflow.includes(`<step name="${step}"`), `missing step: ${step}`);
|
|
}
|
|
});
|
|
|
|
test('assumptions workflow produces same CONTEXT.md sections', () => {
|
|
const workflow = fs.readFileSync(
|
|
path.join(__dirname, '..', 'gsd-core', 'workflows', 'discuss-phase-assumptions.md'), 'utf8'
|
|
);
|
|
const sections = ['<domain>', '<decisions>', '<canonical_refs>', '<code_context>', '<specifics>', '<deferred>'];
|
|
for (const section of sections) {
|
|
assert.ok(workflow.includes(section), `missing CONTEXT.md section: ${section}`);
|
|
}
|
|
});
|
|
|
|
test('plan-phase gate references discuss_mode config', () => {
|
|
const planPhase = fs.readFileSync(
|
|
path.join(__dirname, '..', 'gsd-core', 'workflows', 'plan-phase.md'), 'utf8'
|
|
);
|
|
assert.ok(planPhase.includes('workflow.discuss_mode'), 'should reference config key');
|
|
assert.ok(planPhase.includes('assumptions mode'), 'should mention assumptions mode');
|
|
});
|
|
|
|
test('assumptions workflow handles --auto flag', () => {
|
|
const workflow = fs.readFileSync(
|
|
path.join(__dirname, '..', 'gsd-core', 'workflows', 'discuss-phase-assumptions.md'), 'utf8'
|
|
);
|
|
assert.ok(workflow.includes('--auto'), 'should handle --auto');
|
|
assert.ok(workflow.includes('auto-select'), 'should auto-select in --auto mode');
|
|
assert.ok(workflow.includes('auto_advance'), 'should support auto_advance');
|
|
});
|
|
|
|
test('assumptions workflow handles --text flag', () => {
|
|
const workflow = fs.readFileSync(
|
|
path.join(__dirname, '..', 'gsd-core', 'workflows', 'discuss-phase-assumptions.md'), 'utf8'
|
|
);
|
|
assert.ok(workflow.includes('text_mode'), 'should reference text_mode config');
|
|
assert.ok(workflow.includes('--text'), 'should handle --text flag');
|
|
});
|
|
|
|
test('plan-phase workflow references text_mode', () => {
|
|
const planPhase = fs.readFileSync(
|
|
path.join(__dirname, '..', 'gsd-core', 'workflows', 'plan-phase.md'), 'utf8'
|
|
);
|
|
assert.ok(planPhase.includes('text_mode'), 'plan-phase workflow should reference text_mode');
|
|
assert.ok(planPhase.includes('TEXT_MODE'), 'plan-phase workflow should use TEXT_MODE variable');
|
|
assert.ok(planPhase.includes('--text'), 'plan-phase workflow should handle --text flag');
|
|
});
|
|
|
|
test('plan-phase command argument-hint includes --text', () => {
|
|
const command = fs.readFileSync(
|
|
path.join(__dirname, '..', 'commands', 'gsd', 'plan-phase.md'), 'utf8'
|
|
);
|
|
assert.ok(command.includes('--text'), 'argument-hint should include --text flag');
|
|
});
|
|
|
|
test('plan-phase init exposes text_mode in workflow flags', () => {
|
|
const initSrc = fs.readFileSync(
|
|
path.join(__dirname, '..', 'gsd-core', 'bin', 'lib', 'init.cjs'), 'utf8'
|
|
);
|
|
// The cmdInitPlanPhase result object must include text_mode
|
|
const planPhaseBlock = initSrc.slice(initSrc.indexOf('function cmdInitPlanPhase'));
|
|
assert.ok(planPhaseBlock.includes('text_mode: config.text_mode'), 'init plan-phase must expose text_mode');
|
|
});
|
|
|
|
test('progress workflow references discuss_mode', () => {
|
|
const progress = fs.readFileSync(
|
|
path.join(__dirname, '..', 'gsd-core', 'workflows', 'progress.md'), 'utf8'
|
|
);
|
|
assert.ok(progress.includes('workflow.discuss_mode'), 'should read discuss_mode config');
|
|
assert.ok(progress.includes('Discuss mode'), 'should display discuss mode');
|
|
});
|
|
|
|
test('documentation file exists', () => {
|
|
const docPath = path.join(__dirname, '..', 'docs', 'workflow-discuss-mode.md');
|
|
assert.ok(fs.existsSync(docPath), 'docs/workflow-discuss-mode.md should exist');
|
|
const doc = fs.readFileSync(docPath, 'utf8');
|
|
assert.ok(doc.includes('assumptions'), 'doc should mention assumptions');
|
|
assert.ok(doc.includes('discuss'), 'doc should mention discuss');
|
|
assert.ok(doc.includes('config-set'), 'doc should show how to configure');
|
|
});
|
|
|
|
test('discuss-phase command mode-routing uses gsd_run (shim-safe) not bare gsd-tools', () => {
|
|
const command = fs.readFileSync(
|
|
path.join(__dirname, '..', 'commands', 'gsd', 'discuss-phase.md'), 'utf8'
|
|
);
|
|
// Must contain the canonical shim probe marker
|
|
assert.ok(
|
|
command.includes('_GSD_SHIM_NAME'),
|
|
'discuss-phase.md must define _GSD_SHIM_NAME shim probe before mode routing'
|
|
);
|
|
// Must use gsd_run for the config lookup
|
|
assert.ok(
|
|
command.includes('gsd_run query config-get workflow.discuss_mode'),
|
|
'discuss-phase.md must use gsd_run (not bare gsd-tools) for discuss_mode lookup'
|
|
);
|
|
// Must NOT contain the bare footgun pattern: gsd-tools immediately before the silent default
|
|
assert.ok(
|
|
!command.includes('gsd-tools query config-get workflow.discuss_mode 2>/dev/null || echo'),
|
|
'discuss-phase.md must NOT use bare gsd-tools binary for discuss_mode lookup (shim-only install footgun)'
|
|
);
|
|
});
|
|
});
|
|
|
|
|
|
// ────────────────────────────────────────────────────────────────────────
|
|
// Folded from tests/bug-2549-2550-2552-discuss-phase-context.test.cjs — consolidation epic #1969 (B4 #1973)
|
|
// ────────────────────────────────────────────────────────────────────────
|
|
{
|
|
const { describe: __foldDescribe } = require('node:test');
|
|
__foldDescribe("folded:bug-2549-2550-2552-discuss-phase-context (consolidation epic #1969 B4 #1973)", () => {
|
|
// allow-test-rule: source-text-is-the-product (see #2549)
|
|
// Workflow .md / agent .md / command .md / reference .md files — their text
|
|
// IS what the runtime loads. Testing text content tests the deployed contract.
|
|
// Per CONTRIBUTING.md exception matrix.
|
|
'use strict';
|
|
|
|
|
|
/**
|
|
* Bugs #2549, #2550, #2552: discuss-phase context bloat and cache invalidation.
|
|
*
|
|
* #2549: load_prior_context must cap prior CONTEXT.md reads (was O(phases))
|
|
* #2550: scout_codebase must select maps by phase type (was always all 7)
|
|
* #2552: scout_codebase must not instruct split reads of the same file
|
|
*/
|
|
|
|
const { test, describe } = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const fs = require('node:fs');
|
|
const path = require('node:path');
|
|
|
|
const DISCUSS_PHASE = path.join(
|
|
__dirname, '..', 'gsd-core', 'workflows', 'discuss-phase.md',
|
|
);
|
|
// After the discuss-phase progressive-disclosure split (#717), the scout_codebase phase-type
|
|
// table and split-reads warning live in references/scout-codebase.md.
|
|
const SCOUT_REF = path.join(
|
|
__dirname, '..', 'gsd-core', 'references', 'scout-codebase.md',
|
|
);
|
|
|
|
function readDiscussContext() {
|
|
// Both files are required after the discuss-phase/modes split — fail loudly if either is missing
|
|
// rather than silently weakening the regression coverage.
|
|
for (const p of [DISCUSS_PHASE, SCOUT_REF]) {
|
|
assert.ok(fs.existsSync(p), `Required discuss-phase context source missing: ${p}`);
|
|
}
|
|
return [DISCUSS_PHASE, SCOUT_REF].map(p => fs.readFileSync(p, 'utf-8')).join('\n');
|
|
}
|
|
|
|
describe('discuss-phase context fixes (#2549, #2550, #2552)', () => {
|
|
let src;
|
|
test('discuss-phase.md source exists', () => {
|
|
assert.ok(fs.existsSync(DISCUSS_PHASE), 'discuss-phase.md must exist');
|
|
assert.ok(
|
|
fs.existsSync(SCOUT_REF),
|
|
'references/scout-codebase.md must exist after the discuss-phase/modes progressive-disclosure split',
|
|
);
|
|
src = readDiscussContext();
|
|
});
|
|
|
|
// ─── #2549: load_prior_context cap ──────────────────────────────────────
|
|
test('#2549: load_prior_context must NOT instruct reading ALL prior CONTEXT.md files', () => {
|
|
if (!src) src = readDiscussContext();
|
|
assert.ok(
|
|
!src.includes('For each CONTEXT.md where phase number < current phase'),
|
|
'load_prior_context must not unboundedly read all prior CONTEXT.md files',
|
|
);
|
|
});
|
|
|
|
test('#2549: load_prior_context must reference a bounded read (3 phases or DECISIONS-INDEX)', () => {
|
|
// Read ONLY the parent file — `src.includes('3')` against the
|
|
// concatenated source can be satisfied by unrelated occurrences of "3"
|
|
// in scout-codebase.md (e.g., "3-5 most relevant files"), masking a
|
|
// regression where the parent drops the bounded-read instruction.
|
|
const parent = fs.readFileSync(DISCUSS_PHASE, 'utf-8');
|
|
const hasBound = /\b(?:most recent|latest|last|up to)\s+3\b[\s\S]{0,160}\bprior CONTEXT\.md\b/i.test(parent);
|
|
const hasIndex = parent.includes('DECISIONS-INDEX.md');
|
|
assert.ok(
|
|
hasBound || hasIndex,
|
|
'load_prior_context must reference a bounded read (e.g., most recent 3 phases) or DECISIONS-INDEX.md',
|
|
);
|
|
});
|
|
|
|
// ─── #2550: scout_codebase phase-type selection ──────────────────────────
|
|
test('#2550: scout_codebase must not instruct reading all 7 codebase maps', () => {
|
|
if (!src) src = readDiscussContext();
|
|
assert.ok(
|
|
!src.includes('Read the most relevant ones (CONVENTIONS.md, STRUCTURE.md, STACK.md based on phase type)'),
|
|
'scout_codebase must not use the old vague "most relevant" instruction without a selection table',
|
|
);
|
|
});
|
|
|
|
test('#2550: scout_codebase must include a phase-type-to-maps selection table', () => {
|
|
if (!src) src = readDiscussContext();
|
|
// The table maps phase types to specific map selections
|
|
assert.ok(
|
|
src.includes('Phase type') && src.includes('Read these maps'),
|
|
'scout_codebase must include a phase-type to map-selection table',
|
|
);
|
|
// Key phase types must be covered
|
|
assert.ok(src.includes('UI') || src.includes('frontend'), 'Table must cover UI/frontend phases');
|
|
assert.ok(src.includes('Backend') || src.includes('API'), 'Table must cover backend phases');
|
|
assert.ok(src.includes('Testing'), 'Table must cover testing phases');
|
|
assert.ok(src.includes('Mixed'), 'Table must have a fallback for mixed/unclear phases');
|
|
});
|
|
|
|
// ─── #2552: no split reads ───────────────────────────────────────────────
|
|
test('#2552: scout_codebase must explicitly prohibit split reads of the same file', () => {
|
|
if (!src) src = readDiscussContext();
|
|
const prohibitsSplit = src.includes('split reads') || src.includes('split read');
|
|
assert.ok(
|
|
prohibitsSplit,
|
|
'scout_codebase must explicitly warn against split reads (same file, two offsets) that break prompt cache',
|
|
);
|
|
});
|
|
});
|
|
});
|
|
}
|