@crownpeak/dqm-react-component-dev-mcp 1.2.0

package/data/probe/npm/test-download-lock.js

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+/**
+ * Test script to verify download locking works correctly
+ * Tests both in-process and cross-process locking
+ */
+
+import { getBinaryPath } from './src/utils.js';
+import { spawn } from 'child_process';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+
+async function testInProcessLocking() {
+	console.log('=== Test 1: In-Process Locking ===\n');
+
+	// Simulate 5 concurrent calls to getBinaryPath with the same version
+	const version = '0.6.0-rc100'; // Use a specific version to trigger download
+
+	console.log(`Initiating 5 concurrent getBinaryPath calls for version ${version}...`);
+	const startTime = Date.now();
+
+	const promises = Array.from({ length: 5 }, (_, i) => {
+		return getBinaryPath({ version, forceDownload: false })
+			.then(path => {
+				console.log(`Call ${i + 1} completed: ${path}`);
+				return path;
+			})
+			.catch(err => {
+				console.error(`Call ${i + 1} failed:`, err.message);
+				throw err;
+			});
+	});
+
+	const results = await Promise.all(promises);
+	const endTime = Date.now();
+
+	console.log(`\nAll calls completed in ${endTime - startTime}ms`);
+	console.log('All calls returned the same path:', new Set(results).size === 1);
+	console.log('✅ In-process locking test passed\n');
+}
+
+async function testCrossProcessLocking() {
+	console.log('=== Test 2: Cross-Process Locking ===\n');
+
+	const version = '0.6.0-rc101'; // Different version for cross-process test
+
+	console.log(`Spawning 3 separate Node.js processes to download version ${version}...`);
+
+	const processes = Array.from({ length: 3 }, (_, i) => {
+		return new Promise((resolve, reject) => {
+			const child = spawn('node', [
+				'-e',
+				`import('${__filename.replace(/\\/g, '/')}').then(m => m.singleDownload('${version}'))`
+			], {
+				stdio: 'inherit',
+				shell: true
+			});
+
+			child.on('exit', (code) => {
+				if (code === 0) {
+					resolve();
+				} else {
+					reject(new Error(`Process ${i + 1} exited with code ${code}`));
+				}
+			});
+
+			child.on('error', reject);
+		});
+	});
+
+	await Promise.all(processes);
+	console.log('✅ Cross-process locking test passed\n');
+}
+
+// Helper function for spawned processes
+export async function singleDownload(version) {
+	console.log(`[Process ${process.pid}] Starting download for version ${version}`);
+	const path = await getBinaryPath({ version, forceDownload: false });
+	console.log(`[Process ${process.pid}] Download completed: ${path}`);
+}
+
+async function runTests() {
+	try {
+		console.log('Testing Download Locking Mechanism\n');
+		console.log('Lock features:');
+		console.log('- In-memory locks for same-process coordination');
+		console.log('- File-based locks for cross-process coordination');
+		console.log('- 5-minute timeout for stuck downloads');
+		console.log('- Automatic retry if locked download fails');
+		console.log('- Stale lock detection and cleanup');
+		console.log('- Poll-based waiting (500ms intervals)\n');
+
+		await testInProcessLocking();
+
+		// Uncomment to test cross-process locking
+		// Note: This requires the version to not already be downloaded
+		// await testCrossProcessLocking();
+
+		console.log('✅ All tests passed!');
+	} catch (error) {
+		console.error('Test failed:', error);
+		process.exit(1);
+	}
+}
+
+// Run tests if this is the main module
+if (process.argv[1] === __filename) {
+	runTests();
+}

package/data/probe/npm/test-grep-security.js

@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+
+import { grep } from './src/index.js';
+
+async function testSecurityFixes() {
+	console.log('Testing grep security (command injection prevention)...\n');
+
+	try {
+		// Test 1: Malicious pattern with shell metacharacters
+		console.log('Test 1: Pattern with shell metacharacters (should be safe)');
+		const maliciousPattern = 'test"; echo "INJECTED"; echo "';
+		try {
+			const result = await grep({
+				pattern: maliciousPattern,
+				paths: './src',
+				lineNumbers: true
+			});
+			console.log('✅ Pattern treated as literal string (no injection)');
+			console.log(`   Found ${result.split('\n').filter(l => l).length} lines`);
+		} catch (error) {
+			// This is expected - the pattern won't match
+			console.log('✅ No matches found (pattern treated as literal)');
+		}
+		console.log('\n---\n');
+
+		// Test 2: Path with shell metacharacters
+		console.log('Test 2: Path with shell metacharacters (should be safe)');
+		const maliciousPath = './src; echo INJECTED;';
+		try {
+			const result = await grep({
+				pattern: 'export',
+				paths: maliciousPath,
+				lineNumbers: true
+			});
+			console.log('⚠️  Unexpected: command should have failed');
+		} catch (error) {
+			console.log('✅ Path handled securely (command failed safely)');
+			console.log(`   Error: ${error.message.substring(0, 100)}`);
+		}
+		console.log('\n---\n');
+
+		// Test 3: Pattern with backticks (command substitution attempt)
+		console.log('Test 3: Pattern with backticks (should be safe)');
+		const backtickPattern = 'test`whoami`test';
+		try {
+			const result = await grep({
+				pattern: backtickPattern,
+				paths: './src',
+				lineNumbers: true
+			});
+			console.log('✅ Backticks treated as literal (no command substitution)');
+		} catch (error) {
+			console.log('✅ No matches found (backticks treated as literal)');
+		}
+		console.log('\n---\n');
+
+		// Test 4: Pattern with $() (command substitution attempt)
+		console.log('Test 4: Pattern with $() syntax (should be safe)');
+		const dollarPattern = 'test$(whoami)test';
+		try {
+			const result = await grep({
+				pattern: dollarPattern,
+				paths: './src',
+				lineNumbers: true
+			});
+			console.log('✅ $() treated as literal (no command substitution)');
+		} catch (error) {
+			console.log('✅ No matches found ($() treated as literal)');
+		}
+		console.log('\n---\n');
+
+		// Test 5: Normal regex patterns should still work
+		console.log('Test 5: Normal regex patterns work correctly');
+		const regexPattern = 'export.*function';
+		const result = await grep({
+			pattern: regexPattern,
+			paths: './src/grep.js',
+			lineNumbers: true
+		});
+		console.log('✅ Regex patterns work correctly');
+		console.log(`   Found ${result.split('\n').filter(l => l).length} matches`);
+		console.log('\n---\n');
+
+		console.log('✅ All security tests passed!');
+		console.log('\nThe grep function is now safe from command injection attacks.');
+		console.log('All shell metacharacters are treated as literal strings.');
+	} catch (error) {
+		console.error('❌ Security test failed:', error.message);
+		console.error(error);
+		process.exit(1);
+	}
+}
+
+testSecurityFixes();

package/data/probe/npm/test-grep-simplified.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+
+import { grep } from './src/index.js';
+
+async function testSimplifiedGrep() {
+	console.log('Testing simplified grep API...\n');
+
+	try {
+		// Test 1: Basic search (line numbers enabled by default)
+		console.log('Test 1: Basic search for "export" in src directory');
+		const result1 = await grep({
+			pattern: 'export',
+			paths: './src',
+			lineNumbers: true  // This should be the default
+		});
+		console.log('First 5 lines:');
+		console.log(result1.split('\n').slice(0, 5).join('\n'));
+		console.log('\n---\n');
+
+		// Test 2: Case-insensitive search
+		console.log('Test 2: Case-insensitive search for "TODO"');
+		const result2 = await grep({
+			pattern: 'todo',
+			paths: './src',
+			ignoreCase: true,
+			lineNumbers: true
+		});
+		console.log('Result:');
+		console.log(result2);
+		console.log('\n---\n');
+
+		// Test 3: Count matches
+		console.log('Test 3: Count "function" occurrences');
+		const result3 = await grep({
+			pattern: 'function',
+			paths: './src',
+			count: true
+		});
+		console.log('First 5 files:');
+		console.log(result3.split('\n').slice(0, 5).join('\n'));
+		console.log('\n---\n');
+
+		// Test 4: Search with context
+		console.log('Test 4: Search with 1 line of context');
+		const result4 = await grep({
+			pattern: 'export.*grep',
+			paths: './src/index.js',
+			context: 1,
+			lineNumbers: true
+		});
+		console.log('Result:');
+		console.log(result4);
+		console.log('\n---\n');
+
+		console.log('✅ All simplified grep tests passed!');
+	} catch (error) {
+		console.error('❌ Test failed:', error.message);
+		console.error(error);
+		process.exit(1);
+	}
+}
+
+testSimplifiedGrep();

package/data/probe/npm/test-grep.js

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+
+import { grep } from './src/index.js';
+
+async function testGrep() {
+	console.log('Testing grep functionality...\n');
+
+	try {
+		// Test 1: Basic search
+		console.log('Test 1: Basic search for "TODO" in src directory');
+		const result1 = await grep({
+			pattern: 'TODO',
+			paths: './src',
+			lineNumbers: true
+		});
+		console.log('Result:');
+		console.log(result1);
+		console.log('\n---\n');
+
+		// Test 2: Case-insensitive search with count
+		console.log('Test 2: Count "function" occurrences (case-insensitive)');
+		const result2 = await grep({
+			pattern: 'function',
+			paths: './src',
+			ignoreCase: true,
+			count: true
+		});
+		console.log('Result:');
+		console.log(result2);
+		console.log('\n---\n');
+
+		// Test 3: Files with matches
+		console.log('Test 3: Files containing "export"');
+		const result3 = await grep({
+			pattern: 'export',
+			paths: './src',
+			filesWithMatches: true
+		});
+		console.log('Result:');
+		console.log(result3);
+		console.log('\n---\n');
+
+		console.log('✅ All grep tests passed!');
+	} catch (error) {
+		console.error('❌ Test failed:', error.message);
+		console.error(error);
+		process.exit(1);
+	}
+}
+
+testGrep();

package/data/probe/npm/tests/README.md

@@ -0,0 +1,96 @@
+# Test Suite for Bundled Binaries
+
+This directory contains tests for the bundled binary extraction functionality.
+
+## Test Files
+
+### `extractor.test.js`
+Unit tests for the binary extractor module (`src/extractor.js`).
+
+**Coverage:**
+- ✅ Platform detection (Linux, macOS, Windows)
+- ✅ Unsupported platform error handling
+- ✅ tar.gz archive extraction
+- ✅ ZIP archive extraction (Windows)
+- ✅ Path traversal security validation
+- ✅ Error handling for missing binaries
+- ✅ Error handling for empty archives
+
+**Security Tests:**
+- Path traversal attacks (../ sequences)
+- Absolute path rejection
+- Malicious archive handling
+
+### `extractor-integration.test.js`
+Integration tests that verify the extraction logic without requiring actual binary files.
+
+**Coverage:**
+- ✅ Platform detection logic for all 5 supported platforms
+- ✅ Path safety validation
+- ✅ Archive naming conventions
+- ✅ Binary name detection (Windows vs Unix)
+- ✅ Security validations
+
+**Security Tests:**
+- `isPathSafe()` logic verification
+- Path normalization
+- Relative path validation
+- Directory traversal prevention
+
+## Running Tests
+
+```bash
+# Run all tests
+npm test
+
+# Run with coverage
+npm run test:coverage
+
+# Run in watch mode
+npm run test:watch
+
+# Run verbose
+npm run test:verbose
+```
+
+## Security Test Coverage
+
+All security-critical functions have test coverage:
+
+1. **Path Traversal Prevention** ✅
+   - Tests verify `../ `sequences are rejected
+   - Tests verify absolute paths are rejected
+   - Tests verify safe relative paths are accepted
+
+2. **Archive Extraction** ✅
+   - tar.gz extraction with path validation
+   - ZIP extraction with path validation
+   - Malicious archive rejection
+
+3. **Platform Detection** ✅
+   - All 5 platforms correctly mapped
+   - Unsupported platforms throw errors
+   - Correct file extensions selected
+
+## Test Dependencies
+
+- `@jest/globals` - Test framework
+- `fs-extra` - File system operations
+- `tar` - tar.gz extraction
+- `adm-zip` - ZIP extraction (dynamically imported)
+
+## Notes
+
+- Tests use dynamic imports for `adm-zip` to handle cases where it's not yet installed
+- Tests skip platform-specific functionality (e.g., Windows ZIP tests on macOS)
+- Security tests run on all platforms and verify the core logic
+- Integration tests don't require actual binary files, only test the logic
+
+## Coverage Goals
+
+- ✅ Lines: >70%
+- ✅ Functions: >70%
+- ✅ Branches: >70%
+- ✅ Statements: >70%
+
+Security-critical functions should aim for 100% coverage.

package/data/probe/npm/tests/agent-compact-history.test.js

@@ -0,0 +1,174 @@
+/**
+ * Tests for ProbeAgent.compactHistory() method
+ */
+
+import { jest } from '@jest/globals';
+import { ProbeAgent } from '../src/agent/ProbeAgent.js';
+
+describe('ProbeAgent.compactHistory()', () => {
+  let agent;
+
+  beforeEach(() => {
+    // Create agent with mock provider to avoid actual API calls
+    agent = new ProbeAgent({
+      sessionId: 'test-session',
+      path: '/tmp/test',
+      provider: 'mock',
+      debug: false
+    });
+  });
+
+  afterEach(async () => {
+    if (agent) {
+      await agent.cleanup();
+    }
+  });
+
+  it('should compact history and return statistics', async () => {
+    // Populate history with multiple segments
+    agent.history = [
+      { role: 'system', content: 'You are a helpful assistant' },
+      // Segment 1
+      { role: 'user', content: 'Search for functions' },
+      { role: 'assistant', content: '<thinking>I need to search</thinking>' },
+      { role: 'assistant', content: '<search>function</search>' },
+      { role: 'user', content: '<tool_result>Found 10 functions</tool_result>' },
+      // Segment 2
+      { role: 'user', content: 'Extract the first one' },
+      { role: 'assistant', content: '<thinking>Let me extract</thinking>' },
+      { role: 'assistant', content: '<extract>file.js:10</extract>' },
+      { role: 'user', content: '<tool_result>function code here</tool_result>' },
+      // Segment 3 (active)
+      { role: 'user', content: 'Modify it' },
+      { role: 'assistant', content: '<thinking>I will modify</thinking>' }
+    ];
+
+    const stats = await agent.compactHistory();
+
+    // Check stats
+    expect(stats.originalCount).toBe(11);
+    expect(stats.compactedCount).toBeLessThan(11);
+    expect(stats.removed).toBeGreaterThan(0);
+    expect(stats.reductionPercent).toBeGreaterThan(0);
+    expect(stats.tokensSaved).toBeGreaterThan(0);
+
+    // Check history was actually compacted
+    expect(agent.history.length).toBeLessThan(11);
+
+    // System message should be preserved
+    expect(agent.history[0].role).toBe('system');
+
+    // All user messages should be preserved
+    const userMessages = agent.history.filter(
+      m => m.role === 'user' && !m.content.includes('tool_result')
+    );
+    expect(userMessages.length).toBe(3);
+
+    // Old segment thinking should be removed
+    const hasOldThinking = agent.history.some(
+      m => m.content && m.content.includes('I need to search')
+    );
+    expect(hasOldThinking).toBe(false);
+
+    // Active segment thinking should be preserved
+    const hasActiveThinking = agent.history.some(
+      m => m.content && m.content.includes('I will modify')
+    );
+    expect(hasActiveThinking).toBe(true);
+  });
+
+  it('should handle empty history gracefully', async () => {
+    agent.history = [];
+
+    const stats = await agent.compactHistory();
+
+    expect(stats.originalCount).toBe(0);
+    expect(stats.compactedCount).toBe(0);
+    expect(stats.removed).toBe(0);
+    expect(stats.reductionPercent).toBe(0);
+    expect(stats.tokensSaved).toBe(0);
+  });
+
+  it('should respect custom options', async () => {
+    agent.history = [
+      { role: 'user', content: 'Query 1' },
+      { role: 'assistant', content: '<thinking>Thought 1</thinking>' },
+      { role: 'user', content: '<tool_result>Result 1</tool_result>' },
+      { role: 'user', content: 'Query 2' },
+      { role: 'assistant', content: '<thinking>Thought 2</thinking>' },
+      { role: 'user', content: '<tool_result>Result 2</tool_result>' },
+      { role: 'user', content: 'Query 3' },
+      { role: 'assistant', content: '<thinking>Thought 3</thinking>' }
+    ];
+
+    // Keep last 2 segments fully
+    const stats = await agent.compactHistory({
+      keepLastSegment: true,
+      minSegmentsToKeep: 2
+    });
+
+    expect(stats.removed).toBeGreaterThan(0);
+
+    // Segment 1 should be compacted
+    const hasThought1 = agent.history.some(
+      m => m.content && m.content.includes('Thought 1')
+    );
+    expect(hasThought1).toBe(false);
+
+    // Segments 2 and 3 should be preserved
+    const hasThought2 = agent.history.some(
+      m => m.content && m.content.includes('Thought 2')
+    );
+    const hasThought3 = agent.history.some(
+      m => m.content && m.content.includes('Thought 3')
+    );
+    expect(hasThought2).toBe(true);
+    expect(hasThought3).toBe(true);
+  });
+
+  it('should handle history with only system message', async () => {
+    agent.history = [
+      { role: 'system', content: 'You are a helpful assistant' }
+    ];
+
+    const stats = await agent.compactHistory();
+
+    expect(stats.removed).toBe(0);
+    expect(agent.history.length).toBe(1);
+    expect(agent.history[0].role).toBe('system');
+  });
+
+  it('should handle history with incomplete segments', async () => {
+    agent.history = [
+      { role: 'user', content: 'Query' },
+      { role: 'assistant', content: '<thinking>Processing...</thinking>' }
+    ];
+
+    const stats = await agent.compactHistory();
+
+    // Should not crash, incomplete segment should be preserved
+    expect(agent.history.length).toBeGreaterThan(0);
+    expect(stats).toBeDefined();
+  });
+
+  it('should preserve message order', async () => {
+    agent.history = [
+      { role: 'system', content: 'System' },
+      { role: 'user', content: 'Query 1' },
+      { role: 'assistant', content: '<search>test</search>' },
+      { role: 'user', content: '<tool_result>Result 1</tool_result>' },
+      { role: 'user', content: 'Query 2' },
+      { role: 'assistant', content: '<thinking>Active</thinking>' }
+    ];
+
+    await agent.compactHistory();
+
+    // First message should still be system
+    expect(agent.history[0].role).toBe('system');
+
+    // User messages should maintain their relative order
+    const userMessages = agent.history.filter(m => m.role === 'user');
+    expect(userMessages[0].content).toBe('Query 1');
+    expect(userMessages[2].content).toBe('Query 2');
+  });
+});