@boyingliu01/xp-gate 0.7.0 → 0.8.0

package/lib/__tests__/install-skill.test.js

@@ -69,6 +69,7 @@ describe('install-skill', () => {
     vi.resetModules();
     delete require.cache[require.resolve('../install-skill')];
     delete require.cache[require.resolve('../detect-deps')];
+    delete require.cache[require.resolve('../shared-paths')];
     delete require.cache[require.resolve('../download-skill')];
     delete require.cache[require.resolve('../rollback')];
     vi.spyOn(console, 'log').mockImplementation(() => {});
@@ -323,49 +324,4 @@ describe('install-skill', () => {
     expect(console.warn).not.toHaveBeenCalled();
     expect(console.error).toHaveBeenCalledWith('Error: Failed to download test-spec');
   });
-
-  // --- Qoder platform tests ---
-
-  function qoderSkillsDir() {
-    return path.join(tmpHome, '.qoder', 'skills');
-  }
-
-  it('qoder platform skips dep check (installs without superpowers/gstack)', async () => {
-    // Do NOT call setupValidDeps() — no superpowers/gstack present
-    mockHttpsGet({ statusCode: 200, body: '# Sprint Flow Qoder' });
-
-    const { installSkill } = require('../install-skill');
-    const result = await installSkill('sprint-flow', { platform: 'qoder' });
-
-    expect(result).toBe(0);
-    expect(console.log).toHaveBeenCalledWith('✓ sprint-flow installed');
-  });
-
-  it('qoder platform installs to ~/.qoder/skills/ instead of ~/.config/opencode/skills/', async () => {
-    mockHttpsGet({ statusCode: 200, body: '# Qoder Skill' });
-
-    const { installSkill } = require('../install-skill');
-    const result = await installSkill('sprint-flow', { platform: 'qoder' });
-
-    expect(result).toBe(0);
-    // Verify installed in Qoder directory
-    const qoderFile = path.join(qoderSkillsDir(), 'sprint-flow', 'SKILL.md');
-    expect(fs.existsSync(qoderFile)).toBe(true);
-    expect(fs.readFileSync(qoderFile, 'utf8')).toContain('Qoder Skill');
-
-    // Verify NOT installed in opencode directory
-    const opencodeFile = path.join(skillsDir(), 'sprint-flow', 'SKILL.md');
-    expect(fs.existsSync(opencodeFile)).toBe(false);
-  });
-
-  it('default platform still requires deps and installs to opencode dir', async () => {
-    // Without setupValidDeps, default platform should fail on dep check
-    const { installSkill } = require('../install-skill');
-    const result = await installSkill('sprint-flow');
-
-    expect(result).toBe(1);
-    expect(console.error).toHaveBeenCalledWith(
-      expect.stringContaining('superpowers is required')
-    );
-  });
 });

package/lib/__tests__/ui-detector.test.ts

@@ -1,15 +1,32 @@
 /**
  * @test ui-detector
  * @intent Verify detectUiSprint correctly identifies UI file changes
+ * @covers Issue #155 — getChangedFiles must use spawnSync (array args) to prevent
+ *         shell-meta injection via baseBranch parameter
  */
 import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { execSync } from 'child_process';
+import { spawnSync } from 'child_process';
 
 vi.mock('child_process', () => ({
-  execSync: vi.fn(),
+  spawnSync: vi.fn(),
+  // Keep execSync as a vi.fn so any unintentional callers fail loudly
+  execSync: vi.fn(() => {
+    throw new Error('execSync must not be used: command injection risk (Issue #155)');
+  }),
 }));
 
-const mockExecSync = vi.mocked(execSync);
+const mockSpawnSync = vi.mocked(spawnSync);
+
+function mockSpawnReturn(stdout: string) {
+  mockSpawnSync.mockReturnValue({
+    pid: 1,
+    stdout: Buffer.from(stdout),
+    stderr: Buffer.from(''),
+    status: 0,
+    signal: null,
+    output: [null, stdout, ''],
+  } as unknown as ReturnType<typeof spawnSync>);
+}
 
 describe('ui-detector', () => {
   beforeEach(() => {
@@ -18,7 +35,7 @@ describe('ui-detector', () => {
 
   describe('detectUiSprint', () => {
     it('should return false for empty diff', async () => {
-      mockExecSync.mockReturnValue('');
+      mockSpawnReturn('');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint();
       expect(result.isUiSprint).toBe(false);
@@ -27,14 +44,14 @@ describe('ui-detector', () => {
     });
 
     it('should return false for pure backend changes', async () => {
-      mockExecSync.mockReturnValue('src/auth.ts\nsrc/db.ts\n');
+      mockSpawnReturn('src/auth.ts\nsrc/db.ts\n');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint('main');
       expect(result.isUiSprint).toBe(false);
     });
 
     it('should return true for template files in view directories', async () => {
-      mockExecSync.mockReturnValue('views/index.njk\n');
+      mockSpawnReturn('views/index.njk\n');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint();
       expect(result.isUiSprint).toBe(true);
@@ -43,7 +60,7 @@ describe('ui-detector', () => {
     });
 
     it('should return true for component files in view directories', async () => {
-      mockExecSync.mockReturnValue('src/components/Button.tsx\n');
+      mockSpawnReturn('src/components/Button.tsx\n');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint();
       expect(result.isUiSprint).toBe(true);
@@ -51,43 +68,36 @@ describe('ui-detector', () => {
     });
 
     it('should return false for component files NOT in view directories', async () => {
-      mockExecSync.mockReturnValue('src/hooks/useAuth.tsx\n');
+      mockSpawnReturn('src/hooks/useAuth.tsx\n');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint();
       expect(result.isUiSprint).toBe(false);
     });
 
     it('should return true for style files in view directories', async () => {
-      mockExecSync.mockReturnValue('views/styles/main.css\n');
+      mockSpawnReturn('views/styles/main.css\n');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint();
       expect(result.isUiSprint).toBe(true);
     });
 
     it('should return false for style files NOT in view directories', async () => {
-      mockExecSync.mockReturnValue('src/index.css\n');
+      mockSpawnReturn('src/index.css\n');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint();
       expect(result.isUiSprint).toBe(false);
     });
 
     it('should return true for mixed changes (backend + UI)', async () => {
-      mockExecSync.mockReturnValue('src/auth.ts\nviews/login.html\n');
+      mockSpawnReturn('src/auth.ts\nviews/login.html\n');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint();
       expect(result.isUiSprint).toBe(true);
       expect(result.matchedFiles).toContain('views/login.html');
     });
 
-    it('should return true for deleted UI files', async () => {
-      mockExecSync.mockReturnValue('views/old.html\n');
-      const { detectUiSprint } = await import('../ui-detector');
-      const result = detectUiSprint();
-      expect(result.isUiSprint).toBe(true);
-    });
-
-    it('should handle renamed files correctly', async () => {
-      mockExecSync.mockReturnValue('views/a.html → views/b.html\n');
+    it('should return true for renamed UI files', async () => {
+      mockSpawnReturn('views/a.html → views/b.html\n');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint();
       expect(result.isUiSprint).toBe(true);
@@ -95,24 +105,25 @@ describe('ui-detector', () => {
     });
 
     it('should return false for pure documentation changes', async () => {
-      mockExecSync.mockReturnValue('docs/README.md\n');
+      mockSpawnReturn('docs/README.md\n');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint();
       expect(result.isUiSprint).toBe(false);
     });
 
     it('should use main as default base branch', async () => {
-      mockExecSync.mockReturnValue('');
+      mockSpawnReturn('');
       const { detectUiSprint } = await import('../ui-detector');
       detectUiSprint();
-      expect(mockExecSync).toHaveBeenCalledWith(
-        expect.stringContaining('git diff --name-only main..HEAD'),
+      expect(mockSpawnSync).toHaveBeenCalledWith(
+        'git',
+        ['diff', '--name-only', 'main..HEAD'],
         expect.any(Object)
       );
     });
 
     it('should handle git command failure gracefully', async () => {
-      mockExecSync.mockImplementation(() => {
+      mockSpawnSync.mockImplementation(() => {
         throw new Error('git not available');
       });
       const { detectUiSprint } = await import('../ui-detector');
@@ -120,8 +131,36 @@ describe('ui-detector', () => {
       expect(result.isUiSprint).toBe(false);
     });
 
+    it('should treat non-zero git exit status as failure (Issue #155)', async () => {
+      mockSpawnSync.mockReturnValue({
+        pid: 1,
+        stdout: Buffer.from(''),
+        stderr: Buffer.from('fatal: bad revision'),
+        status: 128,
+        signal: null,
+        output: [null, '', 'fatal: bad revision'],
+      } as unknown as ReturnType<typeof spawnSync>);
+      const { detectUiSprint } = await import('../ui-detector');
+      const result = detectUiSprint('main');
+      expect(result.isUiSprint).toBe(false);
+    });
+
+    it('should not interpret shell metacharacters in baseBranch (Issue #155)', async () => {
+      mockSpawnReturn('');
+      const { getChangedFiles } = await import('../ui-detector');
+      const malicious = 'main; touch /tmp/xp-gate-pwned';
+      getChangedFiles(malicious);
+      expect(mockSpawnSync).toHaveBeenCalledWith(
+        'git',
+        ['diff', '--name-only', `${malicious}..HEAD`],
+        expect.objectContaining({ shell: false })
+      );
+      const callArgs = mockSpawnSync.mock.calls[0];
+      expect(Array.isArray(callArgs[1])).toBe(true);
+    });
+
     it('should handle multiple UI files across different types', async () => {
-      mockExecSync.mockReturnValue('views/index.njk\nsrc/components/Button.tsx\nsrc/auth.ts\n');
+      mockSpawnReturn('views/index.njk\nsrc/components/Button.tsx\nsrc/auth.ts\n');
       const { detectUiSprint } = await import('../ui-detector');
       const result = detectUiSprint();
       expect(result.isUiSprint).toBe(true);
@@ -129,6 +168,29 @@ describe('ui-detector', () => {
     });
   });
 
+  describe('getChangedFiles', () => {
+    it('parses git diff output into file array', async () => {
+      mockSpawnReturn('src/a.ts\nsrc/b.ts\n');
+      const { getChangedFiles } = await import('../ui-detector');
+      const files = getChangedFiles('main');
+      expect(files).toEqual(['src/a.ts', 'src/b.ts']);
+    });
+
+    it('returns empty array for empty diff', async () => {
+      mockSpawnReturn('');
+      const { getChangedFiles } = await import('../ui-detector');
+      const files = getChangedFiles('main');
+      expect(files).toEqual([]);
+    });
+
+    it('filters out empty lines', async () => {
+      mockSpawnReturn('src/a.ts\n\nsrc/b.ts\n');
+      const { getChangedFiles } = await import('../ui-detector');
+      const files = getChangedFiles('main');
+      expect(files).toEqual(['src/a.ts', 'src/b.ts']);
+    });
+  });
+
   describe('parseRenamedFile', () => {
     it('should extract new path from renamed file', async () => {
       const { parseRenamedFile } = await import('../ui-detector');
@@ -197,4 +259,102 @@ describe('ui-detector', () => {
       expect(rules).toContain('style-.css');
     });
   });
+
+  describe('collectUiMatches', () => {
+    it('should detect UI files in components directory', async () => {
+      const { collectUiMatches } = await import('../ui-detector');
+      const result = collectUiMatches(['src/components/Button.tsx', 'src/utils/helper.ts']);
+      expect(result.isUiSprint).toBe(true);
+      expect(result.matchedFiles).toEqual(['src/components/Button.tsx']);
+      expect(result.matchedRules.length).toBeGreaterThan(0);
+    });
+
+    it('should exclude __tests__ directory files', async () => {
+      const { collectUiMatches } = await import('../ui-detector');
+      const result = collectUiMatches(['src/__tests__/Button.test.tsx']);
+      expect(result.isUiSprint).toBe(false);
+    });
+
+    it('excludes files under src/coverage/', async () => {
+      const { collectUiMatches } = await import('../ui-detector');
+      const result = collectUiMatches(['src/coverage/components/Coverage.tsx']);
+      expect(result.isUiSprint).toBe(false);
+    });
+
+    it('should handle empty file list', async () => {
+      const { collectUiMatches } = await import('../ui-detector');
+      const result = collectUiMatches([]);
+      expect(result.isUiSprint).toBe(false);
+      expect(result.matchedFiles).toEqual([]);
+    });
+
+    it('should collect multiple UI files', async () => {
+      const { collectUiMatches } = await import('../ui-detector');
+      const result = collectUiMatches([
+        'src/components/Header.tsx',
+        'src/utils/api.ts',
+        'views/styles/app.css',
+      ]);
+      expect(result.isUiSprint).toBe(true);
+      expect(result.matchedFiles).toHaveLength(2);
+    });
+
+    it('should aggregate unique rules across files', async () => {
+      const { collectUiMatches } = await import('../ui-detector');
+      const result = collectUiMatches([
+        'src/components/Button.tsx',
+        'src/components/Card.tsx',
+      ]);
+      expect(result.isUiSprint).toBe(true);
+      expect(result.matchedFiles.length).toBeGreaterThan(0);
+    });
+
+    it('should respect .ui-gate-ignore patterns', async () => {
+      const { collectUiMatches } = await import('../ui-detector');
+      const withoutIgnore = collectUiMatches(['legacy/components/Old.tsx']);
+      expect(withoutIgnore.isUiSprint).toBe(true);
+    });
+  });
+
+  describe('isExcluded and loadUiGateIgnore', () => {
+    it('excludes paths matching **/coverage/** with leading directory', async () => {
+      const { isExcluded } = await import('../ui-detector');
+      expect(isExcluded('src/coverage/report.html', ['**/coverage/**'])).toBe(true);
+    });
+
+    it('does not match non-excluded paths', async () => {
+      const { isExcluded } = await import('../ui-detector');
+      expect(isExcluded('src/app.ts', ['**/coverage/**'])).toBe(false);
+    });
+
+    it('returns empty array when .ui-gate-ignore does not exist', async () => {
+      const { loadUiGateIgnore } = await import('../ui-detector');
+      expect(loadUiGateIgnore('/tmp')).toEqual([]);
+    });
+
+    it('excludes paths matching **/node_modules/** with leading directory', async () => {
+      const { isExcluded } = await import('../ui-detector');
+      expect(isExcluded('lib/node_modules/pkg/index.js', ['**/node_modules/**'])).toBe(true);
+    });
+
+    it('excludes paths matching **/dist/** with leading directory', async () => {
+      const { isExcluded } = await import('../ui-detector');
+      expect(isExcluded('src/dist/bundle.js', ['**/dist/**'])).toBe(true);
+    });
+
+    it('excludes paths matching **/build/** with leading directory', async () => {
+      const { isExcluded } = await import('../ui-detector');
+      expect(isExcluded('src/build/output.js', ['**/build/**'])).toBe(true);
+    });
+
+    it('excludes paths matching **/__tests__/**', async () => {
+      const { isExcluded } = await import('../ui-detector');
+      expect(isExcluded('src/__tests__/Button.test.tsx', ['**/__tests__/**'])).toBe(true);
+    });
+
+    it('excludes paths matching **/*.test.*', async () => {
+      const { isExcluded } = await import('../ui-detector');
+      expect(isExcluded('src/Button.test.tsx', ['**/*.test.*'])).toBe(true);
+    });
+  });
 });

package/lib/__tests__/ui-review.test.ts

@@ -0,0 +1,119 @@
+/**
+ * @test ui-review
+ * @intent Verify UI review file generation helpers
+ * @covers UI-REVIEW-001
+ */
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { execSync } from 'child_process';
+import { existsSync, mkdirSync, readFileSync, rmSync } from 'fs';
+import { join } from 'path';
+
+vi.mock('child_process', () => ({
+  execSync: vi.fn(),
+}));
+
+const mockExecSync = vi.mocked(execSync);
+const TEST_DIR = join(process.cwd(), '.ui-review-test');
+
+describe('ui-review', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    if (existsSync(TEST_DIR)) {
+      rmSync(TEST_DIR, { recursive: true, force: true });
+    }
+    mkdirSync(TEST_DIR, { recursive: true });
+  });
+
+  afterEach(() => {
+    if (existsSync(TEST_DIR)) {
+      rmSync(TEST_DIR, { recursive: true, force: true });
+    }
+  });
+
+  it('should parse file list and renamed paths', async () => {
+    const { parseFileList } = await import('../ui-review');
+    expect(parseFileList('views/a.html → views/b.html\n\nsrc/auth.ts\n')).toEqual([
+      'views/b.html',
+      'src/auth.ts',
+    ]);
+  });
+
+  it('should return changed files from staged and modified diff', async () => {
+    mockExecSync.mockReturnValue('src/components/Button.tsx\nviews/index.html\n');
+    const { getChangedFilesForReview } = await import('../ui-review');
+    expect(getChangedFilesForReview()).toEqual(['src/components/Button.tsx', 'views/index.html']);
+  });
+
+  it('should fall back to tracked files when no changes are present', async () => {
+    mockExecSync
+      .mockReturnValueOnce('')
+      .mockReturnValueOnce('src/components/Fallback.tsx\n');
+    const { getChangedFilesForReview } = await import('../ui-review');
+    expect(getChangedFilesForReview()).toEqual(['src/components/Fallback.tsx']);
+  });
+
+  it('should fall back to find command when git ls-files fails', async () => {
+    mockExecSync
+      .mockReturnValueOnce('')
+      .mockImplementationOnce(() => { throw new Error('not git'); })
+      .mockReturnValueOnce('views/index.html\n');
+    const { getChangedFilesForReview } = await import('../ui-review');
+    expect(getChangedFilesForReview()).toEqual(['views/index.html']);
+  });
+
+  it('should build an approved review result with 24h expiry', async () => {
+    mockExecSync.mockReturnValue('abc123\n');
+    const { buildUiReviewResult } = await import('../ui-review');
+    const now = new Date('2026-06-02T00:00:00.000Z');
+    const result = buildUiReviewResult(['views/index.html'], now);
+    expect(result).toMatchObject({
+      commit: 'abc123',
+      verdict: 'APPROVED',
+      design_review: 'APPROVED',
+      browser_qa: 'APPROVED',
+      ui_changes_detected: ['views/index.html'],
+    });
+    expect(result.expires).toBe('2026-06-03T00:00:00.000Z');
+  });
+
+  it('should run main and exit 0 when no UI changes are detected', async () => {
+    mockExecSync.mockReturnValue('src/auth.ts\n');
+    const exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => undefined) as never);
+    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => undefined);
+    const { main } = await import('../ui-review');
+    main();
+    expect(exitSpy).toHaveBeenCalledWith(0);
+    expect(logSpy).toHaveBeenCalledWith('ℹ️ No UI changes detected in staged/modified files.');
+    exitSpy.mockRestore();
+    logSpy.mockRestore();
+  });
+
+  it('should run main and write result when UI changes are detected', async () => {
+    const cwdSpy = vi.spyOn(process, 'cwd').mockReturnValue(TEST_DIR);
+    mockExecSync
+      .mockReturnValueOnce('views/index.html\n')
+      .mockReturnValueOnce('abc123\n');
+    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => undefined);
+    const { main } = await import('../ui-review');
+    main();
+    expect(existsSync(join(TEST_DIR, '.ui-gate-result.json'))).toBe(true);
+    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('Generated .ui-gate-result.json'));
+    cwdSpy.mockRestore();
+    logSpy.mockRestore();
+  });
+
+  it('should write .ui-gate-result.json', async () => {
+    const { writeUiReviewResult } = await import('../ui-review');
+    const result = {
+      commit: 'abc123',
+      verdict: 'APPROVED',
+      expires: '2026-06-03T00:00:00.000Z',
+      design_review: 'APPROVED',
+      browser_qa: 'APPROVED',
+      ui_changes_detected: ['views/index.html'],
+    };
+    writeUiReviewResult(result, TEST_DIR);
+    const parsed = JSON.parse(readFileSync(join(TEST_DIR, '.ui-gate-result.json'), 'utf8'));
+    expect(parsed.ui_changes_detected).toEqual(['views/index.html']);
+  });
+});

package/lib/__tests__/uninstall.test.js

@@ -27,6 +27,7 @@ describe('uninstall', () => {
     delete require.cache[require.resolve('../uninstall')];
     delete require.cache[require.resolve('../init')];
     delete require.cache[require.resolve('../detect-deps.js')];
+    delete require.cache[require.resolve('../shared-paths')];
     logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
     warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
     errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});