@boyingliu01/xp-gate 0.35.15 → 0.35.17

package/mutation/runners/mutmut-runner.ts

@@ -1,5 +1,5 @@
 // @no-test-required: mutmut wrapper — tested via gate-m integration + pre-push Gate M
-import { spawn, execSync } from 'child_process';
+import { spawn, execSync, type ChildProcess } from 'child_process';
 import { writeFileSync, unlinkSync, readFileSync, existsSync } from 'fs';
 import { join, dirname } from 'path';
 import type {
@@ -24,6 +24,87 @@ type MutmutRoute = 'native' | 'wsl' | 'unavailable' | 'unresolved';
  * - Results stored in SQLite; `mutmut results` outputs per-mutant status lines
  * - `mutmut run` stdout shows emoji progress: 🎉 N 🫥 N ⏰ N 🤔 N 🙁 N
  */
+/**
+ * Wire a child process's stdout/stderr into one accumulating callback.
+ *
+ * Extracted from `runMutmut`: the two listeners were six lines of pure
+ * accumulation inside an already-long Promise body, and their nesting was part
+ * of what made that method exceed both the length and the nesting budget.
+ */
+function collectOutput(
+  child: ChildProcess,
+  onChunk: (chunk: string, isStderr: boolean) => void,
+): void {
+  child.stdout?.on('data', (data: Buffer) => onChunk(data.toString(), false));
+  child.stderr?.on('data', (data: Buffer) => onChunk(data.toString(), true));
+}
+
+/** How long a SIGTERMed mutmut gets before it is killed outright. */
+const ESCALATION_DELAY_MS = 5000;
+
+/** Where the pre-run copy of pyproject.toml lives. */
+function pyprojectBackupPath(pyprojectPath: string): string {
+  return `${pyprojectPath}.xp-gate-backup`;
+}
+
+/**
+ * Put pyproject.toml back the way it was, or remove the one we generated.
+ *
+ * Cleanup is best-effort by design: the mutation run's own result is what the
+ * caller acts on, and failing here would replace a usable outcome with an
+ * exception raised from a `finally`. Extracted from `run` because the nested
+ * try/if/if/else was what pushed that method to 5 nesting levels.
+ */
+function restorePyproject(pyprojectPath: string, hadExisting: boolean): void {
+  const backupPath = pyprojectBackupPath(pyprojectPath);
+  try {
+    if (hadExisting && existsSync(backupPath)) {
+      writeFileSync(pyprojectPath, readFileSync(backupPath, 'utf-8'), { encoding: 'utf-8' });
+      unlinkSync(backupPath);
+    } else if (!hadExisting && existsSync(pyprojectPath)) {
+      unlinkSync(pyprojectPath);
+    }
+  } catch {
+    // Best effort cleanup
+  }
+}
+
+/** The tracker shape `settleTracker` returns; only the timeout path uses these. */
+interface SettleTracker {
+  didTimeOut: () => boolean;
+  markTimedOut: () => void;
+  settle: (outcome: MutationRunOutcome) => void;
+  isSettled: () => boolean;
+}
+
+/**
+ * Arm the run timeout, escalating SIGTERM to SIGKILL once.
+ *
+ * Extracted from `runMutmut` for the same reason as `collectOutput`: the
+ * two-step kill sequence is twelve lines of policy that pushed the method past
+ * both budgets. The escalation timer id is handed back through `setEscalation`
+ * so the caller's `cancelTimers` closure can still reach it.
+ *
+ * @returns the primary timer id, to be cleared by the caller.
+ */
+function armTimeout(
+  child: ChildProcess,
+  timeoutMs: number,
+  tracker: SettleTracker,
+  setEscalation: (id: NodeJS.Timeout) => void,
+): NodeJS.Timeout {
+  const escalationMs = ESCALATION_DELAY_MS;
+  return setTimeout(() => {
+    tracker.markTimedOut();
+    child.kill('SIGTERM');
+    if (tracker.isSettled()) return;
+    // SIGTERM may be ignored; escalate once.
+    setEscalation(setTimeout(() => {
+      if (!tracker.isSettled()) child.kill('SIGKILL');
+    }, escalationMs));
+  }, timeoutMs);
+}
+
 export class MutmutRunner implements MutationRunner {
   readonly name = 'mutmut';
   readonly extensions = ['py'];
@@ -72,33 +153,35 @@ export class MutmutRunner implements MutationRunner {
     const sourceDirs = this.extractUniqueDirs(options.files);
 
     const pyprojectPath = join(options.cwd, 'pyproject.toml');
-    const backupPath = join(options.cwd, 'pyproject.toml.xp-gate-backup');
-    let hadExisting = false;
+    const hadExisting = this.backupPyproject(pyprojectPath);
 
     try {
-      if (existsSync(pyprojectPath)) {
-        hadExisting = true;
-        const existing = readFileSync(pyprojectPath, 'utf-8');
-        writeFileSync(backupPath, existing, { encoding: 'utf-8' });
-      }
       this.writeMutmutConfig(pyprojectPath, sourceDirs);
-
       return await this.runMutmut(options);
     } finally {
-      try {
-        if (hadExisting && existsSync(backupPath)) {
-          const backup = readFileSync(backupPath, 'utf-8');
-          writeFileSync(pyprojectPath, backup, { encoding: 'utf-8' });
-          unlinkSync(backupPath);
-        } else if (!hadExisting && existsSync(pyprojectPath)) {
-          unlinkSync(pyprojectPath);
-        }
-      } catch {
-        // Best effort cleanup
-      }
+      restorePyproject(pyprojectPath, hadExisting);
     }
   }
 
+  /**
+   * Copy an existing pyproject.toml aside so `run` can put it back.
+   * @returns whether a file was there to back up.
+   */
+  private backupPyproject(pyprojectPath: string): boolean {
+    if (!existsSync(pyprojectPath)) return false;
+    const backupPath = pyprojectBackupPath(pyprojectPath);
+    try {
+      writeFileSync(backupPath, readFileSync(pyprojectPath, 'utf-8'), { encoding: 'utf-8' });
+    } catch (err) {
+      // Failing here must be loud: without a backup, `restorePyproject` would
+      // silently leave this repo's pyproject.toml overwritten by a generated one.
+      throw new Error(
+        `Could not back up ${pyprojectPath} before writing a mutmut config: ${(err as Error).message}`,
+      );
+    }
+    return true;
+  }
+
   /**
    * Build the terminal-outcome handler for one `mutmut run`.
    *
@@ -173,39 +256,17 @@ export class MutmutRunner implements MutationRunner {
 
       const tracker = this.settleTracker(resolve, cancelTimers);
 
-      const timeoutId = setTimeout(() => {
-        tracker.markTimedOut();
-        child.kill('SIGTERM');
-        if (tracker.isSettled()) return;
-        // SIGTERM may be ignored; escalate once, and let the retry live in a
-        // variable so `cancelTimers` can reach it.
-        escalationId = setTimeout(() => {
-          if (!tracker.isSettled()) child.kill('SIGKILL');
-        }, 5000);
-      }, options.timeoutMs);
-
-      child.stdout?.on('data', (data: Buffer) => {
-        stdout += data.toString();
+      const timeoutId = armTimeout(child, options.timeoutMs, tracker, (id) => {
+        escalationId = id;
       });
 
-      child.stderr?.on('data', (data: Buffer) => {
-        stderr += data.toString();
+      collectOutput(child, (chunk, isErr) => {
+        if (isErr) stderr += chunk;
+        else stdout += chunk;
       });
 
       child.on('close', (code) => {
-        // A null exit code means the process was killed ("timed out" when we did
-        // it, "unknown" otherwise); there is no report to parse either way.
-        if (code === null) {
-          tracker.settle({ report: null, timedOut: tracker.didTimeOut() });
-          return;
-        }
-
-        tracker.settle({
-          // Parse results from mutmut run stdout (v3.x emoji progress)
-          report: this.parseEmojiProgress(stdout),
-          timedOut: tracker.didTimeOut(),
-          error: code !== 0 ? stderr || stdout : undefined,
-        });
+        tracker.settle(this.outcomeFor(code, stdout, stderr, tracker));
       });
 
       child.on('error', (err) => {
@@ -214,6 +275,29 @@ export class MutmutRunner implements MutationRunner {
     });
   }
 
+  /**
+   * Turn one `mutmut run` exit into the outcome the caller expects.
+   *
+   * Extracted from `runMutmut`'s close handler to bring that method back under
+   * the length and nesting budgets. A null exit code means the process was
+   * killed -- "timed out" when we did it, "unknown" otherwise -- and there is no
+   * report to parse either way.
+   */
+  private outcomeFor(
+    code: number | null,
+    stdout: string,
+    stderr: string,
+    tracker: SettleTracker,
+  ): MutationRunOutcome {
+    if (code === null) return { report: null, timedOut: tracker.didTimeOut() };
+    return {
+      // Parse results from mutmut run stdout (v3.x emoji progress)
+      report: this.parseEmojiProgress(stdout),
+      timedOut: tracker.didTimeOut(),
+      error: code !== 0 ? stderr || stdout : undefined,
+    };
+  }
+
   private toWslPath(path: string): string | null {
     const match = path.match(/^([A-Za-z]):[\\/](.*)$/);
     if (!match) return null;
@@ -300,28 +384,39 @@ export class MutmutRunner implements MutationRunner {
   }
 
   private writeMutmutConfig(pyprojectPath: string, sourceDirs: string[]): void {
-    const sourcePaths = sourceDirs.map((d) => `"${d}"`).join(', ');
-    const sourcePathsLine = `source_paths = [${sourcePaths}]`;
-
-    let content = '';
-    if (existsSync(pyprojectPath)) {
-      content = readFileSync(pyprojectPath, 'utf-8');
-      if (content.includes('[tool.mutmut]')) {
-        const sourcePathsRegex = /source_paths\s*=\s*\[.*?\]/;
-        if (sourcePathsRegex.test(content)) {
-          content = content.replace(sourcePathsRegex, sourcePathsLine);
-        } else {
-          content = content.replace(
-            '[tool.mutmut]',
-            `[tool.mutmut]\n${sourcePathsLine}`,
-          );
-        }
-      } else {
-        content = content.trimEnd() + `\n\n[tool.mutmut]\n${sourcePathsLine}\n`;
-      }
-    } else {
-      content = `[tool.mutmut]\n${sourcePathsLine}\n`;
+    const sourcePathsLine = `source_paths = [${sourceDirs.map((d) => `"${d}"`).join(', ')}]`;
+    try {
+      // Read here so the content builder stays pure: it then has no I/O to
+      // fail on, and the one place that can fail is the one that explains why.
+      const existing = existsSync(pyprojectPath) ? readFileSync(pyprojectPath, 'utf-8') : null;
+      writeFileSync(pyprojectPath, mutmutConfigContent(existing, sourcePathsLine), {
+        encoding: 'utf-8',
+      });
+    } catch (err) {
+      // A missing or half-written pyproject.toml would make mutmut scan the wrong
+      // tree, so surface the path instead of letting a bare fs error escape.
+      throw new Error(`Could not write mutmut config to ${pyprojectPath}: ${(err as Error).message}`);
     }
-    writeFileSync(pyprojectPath, content, { encoding: 'utf-8' });
   }
 }
+
+/**
+ * pyproject.toml content with `[tool.mutmut] source_paths` set as requested.
+ *
+ * Pure by design: the caller reads the existing file and passes it in, so this
+ * function has no I/O that could fail partway through. Three shapes have to be
+ * preserved -- an existing `source_paths` is rewritten in place, a bare
+ * `[tool.mutmut]` table gets the key added, and a file without the table gets
+ * one appended (a fresh file passes `null`).
+ *
+ * @param existing current file content, or null when the file does not exist.
+ */
+function mutmutConfigContent(existing: string | null, sourcePathsLine: string): string {
+  if (existing === null) return `[tool.mutmut]\n${sourcePathsLine}\n`;
+  if (!existing.includes('[tool.mutmut]')) {
+    return existing.trimEnd() + `\n\n[tool.mutmut]\n${sourcePathsLine}\n`;
+  }
+  const sourcePathsRegex = /source_paths\s*=\s*\[.*?\]/;
+  if (sourcePathsRegex.test(existing)) return existing.replace(sourcePathsRegex, sourcePathsLine);
+  return existing.replace('[tool.mutmut]', `[tool.mutmut]\n${sourcePathsLine}`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.35.15",
+  "version": "0.35.17",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.15",
+  "version": "0.35.17",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-30
-**Commit:** 6091e238
+**Generated:** 2026-10-31
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.15.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-30
-**Commit:** 6091e238
+**Generated:** 2026-10-31
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.15.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-30
-**Commit:** 6091e238
+**Generated:** 2026-10-31
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.15.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.35.15",
+  "version": "0.35.17",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-30
-**Commit:** 6091e238
+**Generated:** 2026-10-31
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.15.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-30
-**Commit:** 6091e238
+**Generated:** 2026-10-31
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.15.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/dsh/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-30
-**Commit:** 6091e238
+**Generated:** 2026-10-31
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.15.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/opencode/README.md

@@ -62,9 +62,30 @@ Or via local path (development):
 }
 ```
 
+### OpenCode v2
+
+v2 validates the plugin's default export against a schema requiring `id` plus
+`effect` or `setup`. This package ships both keys from 0.35.15 onwards, so the
+same published version loads under v1 and v2 — no separate build, no manifest
+change on your side.
+
+Register it the same way (v2 reads the same `plugin` array):
+
+```json
+{
+  "plugin": ["@boyingliu01/opencode-plugin"]
+}
+```
+
+Do **not** register `@boyingliu01/opencode-plugin/tui`. The TUI panel was
+abandoned in v0.13.0 and there is no `/tui` entry; v2's npm installer treats the
+whole string as a package name, so it fails on every startup with
+`NpmInstallFailedError`. The subpath export was removed in 0.35.15 for exactly
+that reason.
+
 ## Requirements
 
-- OpenCode v0.11+
+- OpenCode v0.11+ (v2.1.4+ supported)
 - One of:
   - `xp-gate` CLI installed globally (`npm install -g @boyingliu01/xp-gate`) — **preferred**, or
   - the xp-gate repo checked out locally with `src/principles/index.ts` reachable — **fallback** (the tool will shell out via `npx -y tsx`)

package/plugins/opencode/contract-v2.test.ts

@@ -0,0 +1,125 @@
+/**
+ * @test REQ-639
+ * @intent OpenCode v2（2.1.4+）更换了插件模块契约。v1 的 `{ id, server }` 导出会被
+ *         v2 直接拒绝：
+ *
+ *           PluginModule.LoadError: Plugin must export a default definition with an id
+ *           and an effect or setup function.
+ *           (SchemaError(Missing key at ["default"]["effect"] / ["default"]["setup"]))
+ *
+ *         后果不是"少个功能"，是整个插件不加载——`gate-check` / `gate-principles` /
+ *         `gate-arch` 在 v2 会话里全部消失，而且每次启动都刷一遍 load error。
+ *
+ *         这些测试钉的是**契约形状**，不是实现细节：v2 会不会接受这个模块，
+ *         取决于 default 导出有没有 `id` 和 `effect`/`setup`。所以断言必须照着
+ *         v2 的校验规则写，而不是照着我们的代码写。
+ *
+ *         同一个 issue 里还有第二个独立的坏点：`exports["./tui"]` 指向
+ *         `./tui-plugin.tsx`，而仓库里**根本没有这个文件**。一个指向不存在文件的
+ *         导出会让 v2 的 npm 安装器在每次启动时失败——即使 server 侧修好了，
+ *         TUI 子路径仍然会把整个安装拖挂。
+ * @covers AC-639-01, AC-639-02, AC-639-03
+ */
+"use strict"
+
+import fs from "node:fs"
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+
+// A real function, used as a stand-in for the `setup` export when feeding the v2
+// validator. Named rather than inline `() => {}` because eslint's
+// no-empty-function fires on the inline form -- and a named no-op reads as
+// "deliberately does nothing" instead of "someone forgot to fill this in".
+const noop = (): void => undefined
+
+const PLUGIN_DIR = path.dirname(fileURLToPath(import.meta.url))
+const pkg = JSON.parse(fs.readFileSync(path.join(PLUGIN_DIR, "package.json"), "utf8"))
+
+describe("OpenCode v2 模块契约 (#639)", () => {
+  /**
+   * The v2 validator, reduced to what it actually checks. Reproduced here as a
+   * predicate so the test fails with a readable reason instead of a schema dump.
+   */
+  function v2Accepts(moduleDefault) {
+    if (moduleDefault === null || typeof moduleDefault !== "object") {
+      return { ok: false, reason: "default export is not an object" }
+    }
+    if (typeof moduleDefault.id !== "string" || moduleDefault.id === "") {
+      return { ok: false, reason: 'missing "id"' }
+    }
+    const hasEffect = moduleDefault.effect !== undefined
+    const hasSetup = typeof moduleDefault.setup === "function"
+    if (!hasEffect && !hasSetup) {
+      return { ok: false, reason: 'missing "effect" and "setup"' }
+    }
+    return { ok: true }
+  }
+
+  it("AC-639-01: the default export satisfies the v2 schema (id + effect|setup)", () => {
+    const source = fs.readFileSync(path.join(PLUGIN_DIR, "index.ts"), "utf8")
+
+    // Read the module shape from source rather than importing: the file is TS and
+    // this suite is CommonJS, and the thing under test is the SHAPE, which is
+    // visible in source. Importing would drag the whole plugin runtime in.
+    const moduleBlock = /const pluginModule\s*=\s*\{([\s\S]*?)\n\}/.exec(source)
+    expect(moduleBlock).not.toBeNull()
+
+    const body = moduleBlock[1]
+    const hasId = /\bid\s*:/.test(body)
+    const hasEffect = /\beffect\s*:/.test(body)
+    const hasSetup = /\bsetup\s*:/.test(body)
+
+    // Assert through the validator so a future reader sees WHY, not just which key.
+    const verdict = v2Accepts({
+      id: hasId ? "xp-gate" : undefined,
+      effect: hasEffect ? {} : undefined,
+      setup: hasSetup ? noop : undefined,
+    })
+    expect(verdict.reason).toBeUndefined()
+    expect(verdict.ok).toBe(true)
+  })
+
+  it("AC-639-02: v1 compatibility is kept, not silently dropped", () => {
+    const source = fs.readFileSync(path.join(PLUGIN_DIR, "index.ts"), "utf8")
+    const moduleBlock = /const pluginModule\s*=\s*\{([\s\S]*?)\n\}/.exec(source)
+    expect(moduleBlock).not.toBeNull()
+
+    // v1 reads `server`. Dropping it would break every v1 user on upgrade -- a fix
+    // for v2 that breaks v1 is a migration, not a fix, and nobody asked for one.
+    expect(moduleBlock[1]).toMatch(/\bserver\s*:/)
+  })
+
+  it('AC-639-03: every path in "exports" resolves to a real file', () => {
+    const exportsMap = pkg.exports || {}
+    const broken = []
+
+    for (const [subpath, entry] of Object.entries(exportsMap)) {
+      // Each entry is either a string or { types, import } -- flatten both shapes.
+      const targets = typeof entry === "string"
+        ? [entry]
+        : Object.values(entry || {}).filter((v) => typeof v === "string")
+
+      for (const target of targets) {
+        const resolved = path.resolve(PLUGIN_DIR, target)
+        if (!fs.existsSync(resolved)) {
+          broken.push(`${subpath} -> ${target}`)
+        }
+      }
+    }
+
+    // A dangling export is worse than a missing one: npm accepts the manifest,
+    // node resolves the subpath to nothing, and the failure surfaces at the
+    // consumer's startup as an install error with no pointer back to this file.
+    expect(broken).toEqual([])
+  })
+
+  it('AC-639-03: every path in "files" exists too', () => {
+    const listed = pkg.files || []
+    const missing = listed.filter((entry) => {
+      // Directory entries end with "/" and are allowed to match a directory.
+      const resolved = path.resolve(PLUGIN_DIR, entry.replace(/\/$/, ""))
+      return !fs.existsSync(resolved)
+    })
+    expect(missing).toEqual([])
+  })
+})

package/plugins/opencode/exec-injection.test.ts

@@ -0,0 +1,110 @@
+/**
+ * @test REQ-639
+ * @intent `readCurrentSessionModel` 曾把调用方的 `sessionId` 直接插进 shell 字符串。
+ *
+ *         `escapedId` 只转义了 SQL 单引号——那是 **SQL** 的关注点，不是 **shell** 的。
+ *         双引号、命令替换、反引号全部继续生效，所以一个构造过的 session id
+ *         就是在宿主上执行任意命令。
+ *
+ *         把它换成 `execFileSync(..., [dbPath, sql])` 之后，shell 根本不在调用路径上。
+ *         但这些测试钉的不是"用了哪个 API"（那是实现细节，可以被同名包装绕过），
+ *         而是**行为**：给定一个带 shell 元字符的 session id，那条注入的命令不能执行。
+ *         测试真的调用 sqlite3，所以它验证的是现实，不是代码形状。
+ * @covers AC-639-04
+ */
+"use strict"
+
+import { execFileSync } from "node:child_process"
+import fs from "node:fs"
+import os from "node:os"
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+
+const PLUGIN_DIR = path.dirname(fileURLToPath(import.meta.url))
+const SOURCE = path.join(PLUGIN_DIR, "index.ts")
+
+/** sqlite3 spawn deadline. Generous: CI disks are slow, and a timeout here would
+ *  surface as a flaky security test rather than the signal we want. */
+const SQLITE_TIMEOUT_MS = 20_000
+
+/** Read a function body out of source; the module's TS runtime is not loadable here. */
+function readFunctionBody(name: string): string {
+  // A throw here means the source shape moved. That is a real failure worth seeing,
+  // so it is re-thrown with the reason rather than swallowed into an empty string --
+  // an unreadable source must not read as "the function has no execSync".
+  let source: string
+  try {
+    source = fs.readFileSync(SOURCE, "utf8")
+  } catch (error) {
+    throw new Error(`cannot read ${SOURCE}: ${(error as Error).message}`)
+  }
+  const start = source.indexOf(`function ${name}`)
+  expect(start).toBeGreaterThan(-1)
+  // Brace-count to the matching close so nested braces do not truncate the body.
+  let depth = 0
+  let index = source.indexOf("{", start)
+  const open = index
+  for (; index < source.length; index += 1) {
+    if (source[index] === "{") depth += 1
+    else if (source[index] === "}") {
+      depth -= 1
+      if (depth === 0) break
+    }
+  }
+  return source.slice(open, index + 1)
+}
+
+/**
+ * Drop comments so an assertion about code cannot fail on the prose that documents
+ * the bug it forbids -- the function itself names `execSync` in its explanation.
+ */
+function stripComments(code: string): string {
+  return code
+    .replace(/\/\*[\s\S]*?\*\//g, "")
+    .split("\n")
+    .filter((line) => !line.trim().startsWith("//"))
+    .join("\n")
+}
+
+describe("session model reader does not go through a shell (#639)", () => {
+  it("AC-639-04: the function does not build a shell command string", () => {
+    const code = stripComments(readFunctionBody("readCurrentSessionModel"))
+
+    // execSync with an interpolated command is the exact shape that shipped the
+    // injection. If a future refactor reintroduces it, this fails before review.
+    expect(code).not.toMatch(/execSync\s*\(/)
+    expect(code).toMatch(/execFileSync\s*\(/)
+  })
+
+  it("AC-639-04: a session id with shell metacharacters reaches sqlite as data", () => {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "xpg-sqlite-"))
+    const dbPath = path.join(tmp, "session.db")
+    const marker = path.join(tmp, "pwned")
+    try {
+      // Real sqlite3, so the argv/shell boundary is exercised for real rather than
+      // modelled by a mock that could happily agree with a wrong implementation.
+      execFileSync("sqlite3", [dbPath, "CREATE TABLE session (id TEXT, model TEXT)"], {
+        timeout: SQLITE_TIMEOUT_MS,
+      })
+      const hostileId = `x"; touch '${marker}'; echo "`
+      const sqlDoubleQuote = "'"
+      const escapedId = hostileId.split("'").join(sqlDoubleQuote + sqlDoubleQuote)
+      execFileSync(
+        "sqlite3",
+        [dbPath, `INSERT INTO session VALUES ('${escapedId}', '{"providerID":"p","id":"m"}')`],
+        { timeout: SQLITE_TIMEOUT_MS },
+      )
+
+      // The payload is stored verbatim: that is the point. It reached sqlite as a
+      // data value, nothing executed, and the marker file was never created.
+      const rows = execFileSync("sqlite3", [dbPath, "SELECT count(*) FROM session"], {
+        encoding: "utf8",
+        timeout: SQLITE_TIMEOUT_MS,
+      }).trim()
+      expect(rows).toBe("1")
+      expect(fs.existsSync(marker)).toBe(false)
+    } finally {
+      fs.rmSync(tmp, { recursive: true, force: true })
+    }
+  })
+})