@bhargavvc/sdd-cc 1.35.0 → 1.42.3

package/scripts/lint-no-source-grep.cjs

@@ -0,0 +1,174 @@
+#!/usr/bin/env node
+/**
+ * lint-no-source-grep.cjs
+ *
+ * Enforces the "no source-grep tests" rule:
+ *   Tests must NOT read source-code .cjs files with readFileSync to assert string
+ *   presence. That pattern (source-grep theater) proves a literal exists in source,
+ *   not that the runtime behavior is correct.
+ *
+ * ALLOWED:
+ *   - require('../sdd/bin/lib/foo.cjs')  -- runs the module, not text inspection
+ *   - readFileSync on .md / .json / .txt files     -- product-content or config output
+ *   - Files annotated: // allow-test-rule: <reason>
+ *
+ * DISALLOWED (without allow-test-rule):
+ *   - readFileSync where the path argument ends in a .cjs filename literal
+ *   - A path constant (e.g. CONFIG_PATH) assigned to a .cjs lib file, used in readFileSync
+ *
+ * Exit 0 = clean. Exit 1 = violations found (with diagnostics).
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const TESTS_DIR = path.join(__dirname, '..', 'tests');
+const ALLOW_ANNOTATION = /\/\/\s*allow-test-rule:\s*\S/;
+
+// Matches constant definitions that hold a .cjs path in a SOURCE directory.
+// Requires a source-dir indicator ('bin', 'lib', 'sdd') to avoid
+// flagging temp files like path.join(tmpDir, 'example.cjs').
+//   const CONFIG_PATH = path.join(__dirname, '..', 'sdd', 'bin', 'lib', 'config-schema.cjs');
+const CJS_PATH_CONST_RE = /(?:const|let|var)\s+(\w+)\s*=\s*path\.join\s*\([^)]*(?:'bin'|"bin"|'lib'|"lib"|'sdd'|"sdd")[^)]*['"][^'"]*\.cjs['"]/gm;
+
+// Matches readFileSync with a named variable as first arg
+const READ_WITH_CONST_RE = /readFileSync\s*\(\s*([A-Za-z_][A-Za-z0-9_]*)\s*,/gm;
+
+// Matches readFileSync with an inline path.join(.cjs) as first arg
+const READ_WITH_INLINE_CJS_RE = /readFileSync\s*\([^,)]*path\.join\s*\([^)]*(?:'bin'|"bin"|'lib'|"lib"|'sdd'|"sdd")[^)]*['"][^'"]*\.cjs['"]/;
+
+/**
+ * #2962-class violations: raw text matching against process output or file
+ * content. The rule from CONTRIBUTING.md "Prohibited: Raw Text Matching on
+ * Test Outputs": tests assert on typed structured fields, never on rendered
+ * text. Patterns below are the obvious anti-patterns; subtler hidden forms
+ * (e.g. wrapping the same logic in a parser function) are still forbidden
+ * by the prose rule but cannot be detected lexically without an AST.
+ */
+const RAW_MATCH_PATTERNS = [
+  {
+    re: /assert\.(?:match|doesNotMatch)\s*\(\s*[A-Za-z_$][A-Za-z0-9_$]*\.(?:stdout|stderr)\b/,
+    label: 'assert.match/doesNotMatch on .stdout/.stderr (emit --json from the SUT and assert on typed fields)',
+  },
+  {
+    re: /\.(?:stdout|stderr)\.(?:includes|startsWith|endsWith)\s*\(/,
+    label: '.stdout/.stderr substring match (emit --json and assert on typed fields)',
+  },
+  {
+    re: /readFileSync\s*\([^)]*\)\s*\.(?:includes|startsWith|endsWith)\s*\(/,
+    label: 'readFileSync(...).<includes|startsWith|endsWith> (expose an IR from production code; assert on its fields)',
+  },
+];
+
+function setFromMatches(content, re) {
+  const found = new Set();
+  let m;
+  const cloned = new RegExp(re.source, re.flags);
+  while ((m = cloned.exec(content)) !== null) found.add(m[1]);
+  return found;
+}
+
+function check(filepath) {
+  const content = fs.readFileSync(filepath, 'utf-8');
+  const rel = path.relative(path.join(__dirname, '..'), filepath);
+
+  if (ALLOW_ANNOTATION.test(content)) return null;
+
+  const violations = [];
+
+  // Pattern A: readFileSync(path.join(..., 'foo.cjs'), ...)
+  if (READ_WITH_INLINE_CJS_RE.test(content)) {
+    violations.push({
+      reason: 'readFileSync with inline .cjs path literal',
+      fix: 'Replace with runSddTools() behavioral test, or add // allow-test-rule: <reason>',
+    });
+  }
+
+  // Pattern B: const FOO_PATH = path.join(..., 'foo.cjs')  +  readFileSync(FOO_PATH, ...)
+  const cjsConsts = setFromMatches(content, CJS_PATH_CONST_RE);
+  if (cjsConsts.size > 0) {
+    const readConsts = setFromMatches(content, READ_WITH_CONST_RE);
+    const overlap = [...cjsConsts].filter(c => readConsts.has(c));
+    if (overlap.length > 0) {
+      violations.push({
+        reason: `source .cjs path constant(s) used in readFileSync: ${overlap.join(', ')}`,
+        fix: 'Replace with runSddTools() behavioral test, or add // allow-test-rule: <reason>',
+      });
+    }
+  }
+
+  // Patterns C..E: raw text matching against process output or file content.
+  // See CONTRIBUTING.md "Prohibited: Raw Text Matching on Test Outputs".
+  for (const { re, label } of RAW_MATCH_PATTERNS) {
+    if (re.test(content)) {
+      violations.push({
+        reason: label,
+        fix: 'Expose typed IR from production code; assert on structured fields. Or add // allow-test-rule: <reason>',
+      });
+    }
+  }
+
+  // Patterns F..G (#2982): var-binding readFileSync().<text-method>() and
+  // assert.ok(<expr>.match(...)). These escape the simpler patterns above
+  // because the bind and the use are on different lines or wrapped.
+  const extras = require('./lint-no-source-grep-extras.cjs');
+  const varBindFindings = extras.detectVarBindingViolations(content);
+  if (varBindFindings.length > 0) {
+    const samples = varBindFindings.slice(0, 3)
+      .map((f) => `${f.variable}.${f.method}()`)
+      .join(', ');
+    violations.push({
+      reason: `readFileSync-bound variable used in text-match method: ${samples}${varBindFindings.length > 3 ? `, …+${varBindFindings.length - 3} more` : ''}`,
+      fix: 'Expose typed IR; assert on structured fields. Or // allow-test-rule: <reason>',
+    });
+  }
+  const wrappedFindings = extras.detectWrappedAssertOkMatch(content);
+  if (wrappedFindings.length > 0) {
+    violations.push({
+      reason: `assert.ok(<expr>.match(...)) — escapes assert.match rule (${wrappedFindings.length} occurrence${wrappedFindings.length > 1 ? 's' : ''})`,
+      fix: 'Use assert.equal on a typed field, not regex match on text. Or // allow-test-rule: <reason>',
+    });
+  }
+
+  if (violations.length === 0) return null;
+  return { file: rel, violations };
+}
+
+function findTestFiles(dir) {
+  const results = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      results.push(...findTestFiles(full));
+    } else if (entry.name.endsWith('.test.cjs')) {
+      results.push(full);
+    }
+  }
+  return results;
+}
+
+const testFiles = findTestFiles(TESTS_DIR);
+
+const violations = testFiles.map(check).filter(Boolean);
+
+if (violations.length === 0) {
+  console.log(`ok lint-no-source-grep: ${testFiles.length} test files checked, 0 violations`);
+  process.exit(0);
+}
+
+const totalIssues = violations.reduce((n, v) => n + v.violations.length, 0);
+process.stderr.write(`\nERROR lint-no-source-grep: ${totalIssues} violation(s) across ${violations.length} file(s)\n\n`);
+for (const f of violations) {
+  process.stderr.write(`  ${f.file}\n`);
+  for (const v of f.violations) {
+    process.stderr.write(`    Problem : ${v.reason}\n`);
+    process.stderr.write(`    Fix     : ${v.fix}\n`);
+  }
+  process.stderr.write('\n');
+}
+process.stderr.write('See CONTRIBUTING.md "Prohibited: Source-Grep Tests" and\n');
+process.stderr.write('"Prohibited: Raw Text Matching on Test Outputs" for guidance.\n');
+process.stderr.write('Structural tests that legitimately read source files: add // allow-test-rule: <reason>\n\n');
+process.exit(1);

package/scripts/lint-shell-command-projection-drift.cjs

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Focused drift guard for issue #3442:
+ * prevent installer-owned inline shim/wrapper text builders from bypassing the
+ * Shell Command Projection Module seam.
+ *
+ * Scope intentionally excludes subprocess execution helpers (spawnSync /
+ * execFileSync) because those are safe internal execution primitives, not
+ * serialized shell-command rendering.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..');
+const targetArg = process.argv[2] || path.join(ROOT, 'bin', 'install.js');
+const target = path.resolve(targetArg);
+const rel = path.relative(ROOT, target);
+
+let content;
+try {
+  content = fs.readFileSync(target, 'utf8');
+} catch (error) {
+  process.stderr.write(`lint-shell-command-projection-drift: failed to read ${target}: ${error.message}\n`);
+  process.exit(1);
+}
+
+const forbidden = [
+  {
+    label: 'inline cmd shim builder',
+    pattern: /@ECHO OFF\\r\\n@SETLOCAL\\r\\n@node /,
+  },
+  {
+    label: 'inline pwsh shim builder',
+    pattern: /#!\/usr\/bin\/env pwsh\\n& node /,
+  },
+  {
+    label: 'inline sh shim builder',
+    pattern: /#!\/usr\/bin\/env sh\\nexec node /,
+  },
+];
+
+const matches = forbidden.filter((rule) => rule.pattern.test(content));
+if (matches.length === 0) {
+  process.stdout.write(`ok shell-projection-drift: ${rel}\n`);
+  process.exit(0);
+}
+
+process.stderr.write(`ERROR shell-projection-drift: inline serialized shim builders found in ${rel}\n`);
+for (const match of matches) {
+  process.stderr.write(`  - ${match.label}\n`);
+}
+process.stderr.write('Route shim/wrapper rendering through sdd/bin/lib/shell-command-projection.cjs\n');
+process.stderr.write('Safe subprocess execution via spawnSync/execFileSync is intentionally allowed.\n');
+process.exit(1);

package/scripts/lint-skill-deps.cjs

@@ -0,0 +1,180 @@
+#!/usr/bin/env node
+/**
+ * lint-skill-deps.cjs
+ *
+ * Two checks:
+ *
+ * a) Frontmatter to body consistency:
+ *    For each commands/sdd/*.md, parse requires: and walk the body for
+ *    references to other SDD skills (pattern: /sdd:<stem> or sdd:<stem>).
+ *    Fail if a skill body references a skill not listed in requires:.
+ *
+ * b) Profile closure satisfaction:
+ *    Load PROFILES from install-profiles.cjs. For each non-full profile,
+ *    compute closure(profile.base) using the manifest. If any skill in
+ *    the closure references a skill NOT in the closure, fail.
+ *
+ * Usage:
+ *   node scripts/lint-skill-deps.cjs               # scans commands/sdd/
+ *   node scripts/lint-skill-deps.cjs --dir <path>  # scan a custom dir (testing)
+ *
+ * Exits 0 if all pass; exits 1 if any violation.
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const PROFILES_MODULE = path.join(__dirname, '..', 'sdd', 'bin', 'lib', 'install-profiles.cjs');
+const { PROFILES, loadSkillsManifest, resolveProfile } = require(PROFILES_MODULE);
+
+// ---------------------------------------------------------------------------
+// Argument parsing
+// ---------------------------------------------------------------------------
+
+let commandsDir = path.join(__dirname, '..', 'commands', 'sdd');
+const args = process.argv.slice(2);
+for (let i = 0; i < args.length; i++) {
+  if (args[i] === '--dir' && args[i + 1]) {
+    commandsDir = args[i + 1];
+    i++;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Reference extraction from skill body
+// ---------------------------------------------------------------------------
+
+function extractBodyReferences(body) {
+  const refs = new Set();
+  const re = /(?:\/?)sdd:([a-z0-9_-]+)/g;
+  let m;
+  while ((m = re.exec(body)) !== null) {
+    refs.add(m[1]);
+  }
+  return refs;
+}
+
+function extractBody(content) {
+  const fmEnd = content.match(/^---\r?\n[\s\S]*?\r?\n---\r?\n/m);
+  if (!fmEnd) return content;
+  return content.slice(fmEnd[0].length);
+}
+
+// ---------------------------------------------------------------------------
+// Check a: frontmatter to body consistency
+// ---------------------------------------------------------------------------
+
+function checkFrontmatterBodyConsistency(manifest, allStems) {
+  const violations = [];
+
+  for (const [stem, declared] of manifest) {
+    if (stem.startsWith('_calls_agents_')) continue;
+    const filePath = path.join(commandsDir, stem + '.md');
+    let content;
+    try {
+      content = fs.readFileSync(filePath, 'utf8');
+    } catch {
+      continue;
+    }
+    const body = extractBody(content);
+    const referenced = extractBodyReferences(body);
+    const declaredSet = new Set(declared);
+    for (const ref of referenced) {
+      if (ref === stem) continue;
+      if (!allStems.has(ref)) {
+        violations.push({
+          stem,
+          filePath,
+          undeclared: ref,
+          message: 'body references unknown skill sdd:' + ref,
+        });
+        continue;
+      }
+      if (!declaredSet.has(ref)) {
+        violations.push({
+          stem,
+          filePath,
+          undeclared: ref,
+          message: 'body references sdd:' + ref + ' but requires: does not list it',
+        });
+      }
+    }
+  }
+
+  return violations;
+}
+
+// ---------------------------------------------------------------------------
+// Check b: profile closure satisfaction
+// ---------------------------------------------------------------------------
+
+function checkProfileClosure(manifest) {
+  const violations = [];
+
+  for (const profileName of Object.keys(PROFILES)) {
+    const base = PROFILES[profileName];
+    if (base === '*') continue;
+    const resolved = resolveProfile({ modes: [profileName], manifest });
+    if (resolved.skills === '*') continue;
+
+    const closure = resolved.skills;
+    for (const stem of closure) {
+      const deps = manifest.get(stem) || [];
+      for (const dep of deps) {
+        if (!closure.has(dep)) {
+          violations.push({
+            profile: profileName,
+            stem,
+            missingDep: dep,
+            message: 'profile "' + profileName + '" includes "' + stem + '" which requires "' + dep + '", but "' + dep + '" is not in the closure',
+          });
+        }
+      }
+    }
+  }
+
+  return violations;
+}
+
+// ---------------------------------------------------------------------------
+// Main
+// ---------------------------------------------------------------------------
+
+const manifest = loadSkillsManifest(commandsDir);
+const allStems = new Set(
+  [...manifest.keys()].filter((k) => !k.startsWith('_calls_agents_'))
+);
+
+const consistencyViolations = checkFrontmatterBodyConsistency(manifest, allStems);
+const closureViolations = checkProfileClosure(manifest);
+
+const totalViolations = consistencyViolations.length + closureViolations.length;
+
+if (totalViolations === 0) {
+  const checked = manifest.size;
+  process.stdout.write('ok lint-skill-deps: ' + checked + ' skill(s) checked, 0 violations\n');
+  process.exit(0);
+}
+
+process.stderr.write('\nERROR lint-skill-deps: ' + totalViolations + ' violation(s) found\n\n');
+
+if (consistencyViolations.length > 0) {
+  process.stderr.write('Frontmatter to body consistency violations (' + consistencyViolations.length + '):\n\n');
+  for (const v of consistencyViolations) {
+    process.stderr.write('  ' + v.filePath + '\n');
+    process.stderr.write('    ' + v.message + '\n\n');
+  }
+  process.stderr.write('Fix: add missing deps to requires: in the skill frontmatter.\n\n');
+}
+
+if (closureViolations.length > 0) {
+  process.stderr.write('Profile closure violations (' + closureViolations.length + '):\n\n');
+  for (const v of closureViolations) {
+    process.stderr.write('  ' + v.message + '\n');
+  }
+  process.stderr.write('\nFix: add the missing skills to the profile base set in install-profiles.cjs.\n\n');
+}
+
+process.exit(1);

package/scripts/pr-template-policy.cjs

@@ -0,0 +1,169 @@
+#!/usr/bin/env node
+
+const TRUSTED_AUTHOR_ASSOCIATIONS = new Set([
+  'CONTRIBUTOR',
+  'COLLABORATOR',
+  'MEMBER',
+  'OWNER',
+]);
+
+const DEFAULT_TEMPLATE_MARKERS = [
+  'Wrong template',
+  'Every PR must use a typed template',
+  'Select the template that matches your PR',
+];
+
+const TEMPLATES = [
+  {
+    name: 'fix',
+    heading: 'Fix PR',
+    requiredHeadings: [
+      'Fix PR',
+      'Linked Issue',
+      'What was broken',
+      'What this fix does',
+      'Testing',
+      'Checklist',
+    ],
+  },
+  {
+    name: 'enhancement',
+    heading: 'Enhancement PR',
+    requiredHeadings: [
+      'Enhancement PR',
+      'Linked Issue',
+      'What this enhancement improves',
+      'Before / After',
+      'How it was implemented',
+      'Testing',
+      'Scope confirmation',
+      'Checklist',
+    ],
+  },
+  {
+    name: 'feature',
+    heading: 'Feature PR',
+    requiredHeadings: [
+      'Feature PR',
+      'Linked Issue',
+      'Feature summary',
+      'What changed',
+      'Implementation notes',
+      'Spec compliance',
+      'Testing',
+      'Scope confirmation',
+      'Checklist',
+    ],
+  },
+];
+
+function stripMarkdownDecoration(value) {
+  return value
+    .replace(/^\s*#+\s*/, '')
+    .replace(/\s*#+\s*$/, '')
+    .replace(/\*\*/g, '')
+    .trim()
+    .toLowerCase();
+}
+
+function extractHeadings(body) {
+  const headings = new Set();
+  for (const line of String(body || '').split(/\r?\n/)) {
+    if (/^\s*#{1,6}\s+\S/.test(line)) {
+      headings.add(stripMarkdownDecoration(line));
+    }
+  }
+  return headings;
+}
+
+function includesDefaultTemplate(body) {
+  const text = String(body || '').toLowerCase();
+  return DEFAULT_TEMPLATE_MARKERS.some((marker) => text.includes(marker.toLowerCase()));
+}
+
+function matchingTemplate(body) {
+  const headings = extractHeadings(body);
+  for (const template of TEMPLATES) {
+    if (!headings.has(stripMarkdownDecoration(template.heading))) continue;
+    const missingHeadings = template.requiredHeadings.filter((heading) => {
+      return !headings.has(stripMarkdownDecoration(heading));
+    });
+    return {
+      template: template.name,
+      missingHeadings,
+    };
+  }
+  return {
+    template: null,
+    missingHeadings: [],
+  };
+}
+
+function evaluatePrTemplate(body, authorAssociation) {
+  const association = String(authorAssociation || '').toUpperCase();
+  const trusted = TRUSTED_AUTHOR_ASSOCIATIONS.has(association);
+  const normalizedBody = String(body || '').trim();
+
+  let valid = true;
+  let reason = 'PR body uses a typed pull request template.';
+  let template = null;
+  let missingHeadings = [];
+
+  if (!normalizedBody) {
+    valid = false;
+    reason = 'PR body is empty; a typed pull request template is required.';
+  } else {
+    const match = matchingTemplate(normalizedBody);
+    template = match.template;
+    missingHeadings = match.missingHeadings;
+    if (template && missingHeadings.length === 0) {
+      valid = true;
+    } else if (template && missingHeadings.length > 0) {
+      valid = false;
+      reason = `PR body appears to use the ${template} template but is missing required headings.`;
+    } else if (includesDefaultTemplate(normalizedBody)) {
+      valid = false;
+      reason = 'PR body still contains the default wrong-template guidance.';
+    } else {
+      valid = false;
+      reason = 'PR body does not match the fix, enhancement, or feature template.';
+    }
+  }
+
+  let action = 'pass';
+  if (!valid) {
+    action = trusted ? 'warn' : 'close';
+  }
+
+  return {
+    valid,
+    action,
+    trusted,
+    authorAssociation: association || 'UNKNOWN',
+    template,
+    reason,
+    missingHeadings,
+  };
+}
+
+function main() {
+  const result = evaluatePrTemplate(process.env.PR_BODY || '', process.env.AUTHOR_ASSOCIATION || '');
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+  if (process.env.GITHUB_OUTPUT) {
+    const fs = require('fs');
+    fs.appendFileSync(process.env.GITHUB_OUTPUT, `result=${JSON.stringify(result)}\n`);
+    fs.appendFileSync(process.env.GITHUB_OUTPUT, `action=${result.action}\n`);
+    fs.appendFileSync(process.env.GITHUB_OUTPUT, `valid=${result.valid ? 'true' : 'false'}\n`);
+  }
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = {
+  evaluatePrTemplate,
+  extractHeadings,
+  includesDefaultTemplate,
+  matchingTemplate,
+};

package/scripts/prompt-injection-scan.sh

@@ -75,6 +75,8 @@ ALLOWLIST=(
   'tests/verify.test.cjs'
   'sdd/bin/lib/security.cjs'
   'hooks/sdd-prompt-guard.js'
+  'hooks/sdd-read-injection-scanner.js'
+  'tests/read-injection-scanner.test.cjs'
   'SECURITY.md'
 )
 

package/scripts/rebrand-gsd-to-sdd.sh

@@ -81,7 +81,8 @@ echo "  Done."
 echo ""
 echo "[3/5] Finding files with content to replace..."
 
-grep -rl --include="*.md" --include="*.js" --include="*.cjs" \
+grep -rl --include="*.md" --include="*.js" --include="*.cjs" --include="*.mjs" \
+  --include="*.ts" --include="*.tsx" \
   --include="*.json" --include="*.sh" --include="*.yml" --include="*.yaml" \
   -E "${OLD_LC}|${OLD_UC}|${OLD_DIR}" . 2>/dev/null \
   | grep -v '\.git/' | grep -v 'node_modules/' \
@@ -164,12 +165,12 @@ if [ -f "package.json" ]; then
     package.json
 
   # Fix bin entry: the key might already be partially renamed
-  # Ensure bin is exactly: "sdd-cc": "bin/install.js"
+  # Ensure bin includes sdd-cc (installer) + sdd-sdk (back-compat shim, fix #2441)
   node -e "
     const pkg = require('./package.json');
     const fs = require('fs');
     pkg.name = '@bhargavvc/sdd-cc';
-    pkg.bin = { 'sdd-cc': 'bin/install.js' };
+    pkg.bin = { 'sdd-cc': 'bin/install.js', 'sdd-sdk': 'bin/sdd-sdk.js', 'sdd-tools': 'bin/sdd-sdk.js' };
     pkg.description = pkg.description
       .replace(/Get Shit Done/gi, 'Spec-Driven Development')
       .replace(/GSD/g, 'SDD')