@deftai/directive-content 0.82.0 → 0.84.0

package/tasks/engine-pm-run.test.cjs

@@ -0,0 +1,201 @@
+#!/usr/bin/env node
+"use strict";
+
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const { describe, it } = require("node:test");
+const {
+  buildDispatchSteps,
+  executeAllowlisted,
+  hasCmd,
+  parsePnpmPin,
+  runPackageScript,
+  validateScriptName,
+} = require("./engine-pm-run.cjs");
+
+describe("parsePnpmPin", () => {
+  it("accepts stable, prerelease, and build-metadata pins", () => {
+    for (const pin of ["pnpm@11.8.0", "pnpm@1.0.0-alpha.1", "pnpm@1.0.0+build.1"]) {
+      const result = parsePnpmPin(pin);
+      assert.equal(result.ok, true);
+    }
+  });
+
+  it("accepts missing/empty pins for unpinned fallback", () => {
+    assert.deepEqual(parsePnpmPin(undefined), { ok: true, semver: null, pin: null });
+    assert.deepEqual(parsePnpmPin(""), { ok: true, semver: null, pin: null });
+  });
+
+  it("rejects shell metacharacters and malformed pins before spawn", () => {
+    for (const pin of [
+      "pnpm@9.0.0; echo pwned",
+      "pnpm@9.0.0 & echo pwned",
+      "pnpm@^1.0.0",
+      "npm@1.0.0",
+      "pnpm@1.0.0 extra",
+      " pnpm@1.0.0",
+      "pnpm@1.0.0 ",
+      "pnpm@1.0.0\n",
+    ]) {
+      const result = parsePnpmPin(pin);
+      assert.equal(result.ok, false, pin);
+    }
+  });
+});
+
+describe("validateScriptName", () => {
+  it("accepts only declared script keys with safe names", () => {
+    const scripts = { build: "tsc", "test:unit": "vitest" };
+    assert.equal(validateScriptName("build", scripts), true);
+    assert.equal(validateScriptName("test:unit", scripts), true);
+    assert.equal(validateScriptName("missing", scripts), false);
+    assert.equal(validateScriptName("build;rm", scripts), false);
+  });
+});
+
+describe("buildDispatchSteps", () => {
+  it("preserves installed pnpm -> pinned corepack -> unpinned corepack order", () => {
+    const steps = buildDispatchSteps({
+      hasPnpm: true,
+      hasCorepack: true,
+      semver: "11.8.0",
+      script: "build",
+    });
+    assert.deepEqual(steps, [
+      { cmd: "pnpm", args: ["run", "build"] },
+      { cmd: "corepack", args: ["pnpm@11.8.0", "run", "build"] },
+      { cmd: "corepack", args: ["pnpm", "run", "build"] },
+    ]);
+  });
+});
+
+describe("runPackageScript security", () => {
+  function mkFixture(/** @type {Record<string, unknown>} */ pkgExtra) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "deft-engine-pm-run-"));
+    fs.writeFileSync(path.join(dir, "package.json"), JSON.stringify(pkgExtra, null, 2), "utf8");
+    return dir;
+  }
+
+  it("rejects malicious pins before any execution call", () => {
+    const dir = mkFixture({
+      packageManager: "pnpm@9.0.0; echo pwned",
+      scripts: { build: "node -e \"\"" },
+    });
+    const sentinel = path.join(dir, "sentinel.txt");
+    let execCalls = 0;
+    const code = runPackageScript(dir, "build", {
+      execFileSync() {
+        execCalls += 1;
+        fs.writeFileSync(sentinel, "pwned", "utf8");
+      },
+    });
+    assert.equal(code, 3);
+    assert.equal(execCalls, 0);
+    assert.equal(fs.existsSync(sentinel), false);
+    fs.rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("records exact argv on execution without shell:true", () => {
+    const dir = mkFixture({
+      packageManager: "pnpm@11.8.0",
+      scripts: { build: "tsc" },
+    });
+    /** @type {Array<{ cmd: string, args: string[], shell?: boolean, stdio?: string }>} */
+    const calls = [];
+    const code = runPackageScript(dir, "build", {
+      execFileSync(cmd, args, opts) {
+        calls.push({ cmd, args: [...args], shell: opts?.shell, stdio: opts?.stdio });
+        if (opts?.stdio === "inherit") {
+          return;
+        }
+      },
+    });
+    assert.equal(code, 0);
+    const execCalls = calls.filter((c) => c.stdio === "inherit");
+    assert.equal(execCalls.length, 1);
+    assert.equal(execCalls[0].shell, false);
+    assert.equal(execCalls[0].stdio, "inherit");
+    if (process.platform === "win32") {
+      assert.equal(execCalls[0].cmd, "cmd.exe");
+      assert.deepEqual(execCalls[0].args.slice(0, 3), ["/d", "/s", "/c"]);
+      assert.match(execCalls[0].args[3], /pnpm.*run.*build/);
+    } else {
+      assert.deepEqual(execCalls[0], {
+        cmd: "pnpm",
+        args: ["run", "build"],
+        shell: false,
+        stdio: "inherit",
+      });
+    }
+    fs.rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("allows probe hasCmd to use shell:true separately from execution", () => {
+    /** @type {Array<{ shell?: boolean, stdio?: string }>} */
+    const calls = [];
+    let probeAttempts = 0;
+    const execFn = (/** @type {string} */ _cmd, /** @type {string[]} */ _args, /** @type {{ shell?: boolean, stdio?: string }} */ opts) => {
+      if (opts?.stdio === "ignore") {
+        probeAttempts += 1;
+        if (probeAttempts === 1 && !opts.shell) {
+          throw new Error("probe without shell failed");
+        }
+      }
+      calls.push({ shell: opts?.shell, stdio: opts?.stdio });
+    };
+    assert.equal(hasCmd(execFn, "pnpm"), true);
+    assert.ok(calls.some((c) => c.shell === true && c.stdio === "ignore"));
+    const execCalls = calls.filter((c) => c.stdio === "inherit");
+    assert.equal(execCalls.length, 0);
+  });
+
+  it("rejects invalid package.json before probing PATH", () => {
+    const dir = mkFixture({ packageManager: "pnpm@11.8.0", scripts: { build: "tsc" } });
+    fs.writeFileSync(path.join(dir, "package.json"), "null", "utf8");
+    let execCalls = 0;
+    const code = runPackageScript(dir, "build", {
+      execFileSync() {
+        execCalls += 1;
+      },
+    });
+    assert.equal(code, 2);
+    assert.equal(execCalls, 0);
+    fs.rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("rejects unknown scripts before probing PATH", () => {
+    const dir = mkFixture({ packageManager: "pnpm@11.8.0", scripts: { build: "tsc" } });
+    let execCalls = 0;
+    const code = runPackageScript(dir, "lint", {
+      execFileSync() {
+        execCalls += 1;
+      },
+    });
+    assert.equal(code, 2);
+    assert.equal(execCalls, 0);
+    fs.rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("uses cmd.exe on win32 without shell:true on the Node spawn", () => {
+    if (process.platform !== "win32") {
+      return;
+    }
+    /** @type {{ cmd?: string, args?: string[], shell?: boolean } | null} */
+    let recorded = null;
+    executeAllowlisted(
+      (cmd, args, opts) => {
+        recorded = { cmd, args: [...args], shell: opts?.shell };
+      },
+      "pnpm",
+      ["run", "build"],
+      { cwd: process.cwd() },
+    );
+    assert.ok(recorded);
+    assert.equal(recorded.cmd, "cmd.exe");
+    assert.equal(recorded.args[0], "/d");
+    assert.equal(recorded.shell, false);
+    assert.match(recorded.args[3], /^pnpm run build$|^"pnpm" "run" "build"$/);
+  });
+});

package/tasks/engine.yml

@@ -20,71 +20,7 @@ tasks:
     cmds:
       - |
         set -eu
-        node -e "
-          const {execFileSync}=require('child_process');
-          const fs=require('fs');
-          const root=process.argv[1];
-          const script=process.argv[2];
-          const pkgPath=root+'/package.json';
-          if(!fs.existsSync(pkgPath)){
-            console.error('deft: package.json missing at '+root);
-            process.exit(2);
-          }
-          const pkg=JSON.parse(fs.readFileSync(pkgPath,'utf8'));
-          // Cross-platform probe (#2415): do NOT use Unix `sh -c 'command -v'` —
-          // Windows native Task often has no `sh` on PATH, so Corepack.cmd was
-          // invisible after #2411. Prefer a direct spawn (POSIX / real binaries);
-          // fall back to shell:true so PATHEXT resolves .cmd/.exe on win32.
-          // windowsHide (#2563): CREATE_NO_WINDOW so Cursor Task shells do not
-          // flood visible cmd.exe/conhost windows on every probe/build.
-          const spawnOpts=(extra)=>({stdio:'ignore',windowsHide:true,...extra});
-          const hasCmd=(name)=>{
-            try{
-              execFileSync(name,['--version'],spawnOpts());
-              return true;
-            }catch{
-              try{
-                execFileSync(name,['--version'],spawnOpts({shell:true}));
-                return true;
-              }catch{
-                return false;
-              }
-            }
-          };
-          const run=(cmd,args)=>{
-            execFileSync(cmd,args,{cwd:root,stdio:'inherit',shell:true,windowsHide:true});
-          };
-          const trySteps=(steps)=>{
-            for(const [cmd,args] of steps){
-              try{
-                run(cmd,args);
-                process.exit(0);
-              }catch{
-                // fall through to Corepack / next resolver
-              }
-            }
-          };
-          const envPm=String(process.env.DEFT_PACKAGE_MANAGER||'').trim().toLowerCase();
-          if(envPm==='npm'){
-            run('npm',['run',script]);
-            process.exit(0);
-          }
-          const pin=String(pkg.packageManager||'').trim();
-          const match=pin.match(/^pnpm@(.+)$/);
-          const steps=[];
-          if(hasCmd('pnpm')) steps.push(['pnpm',['run',script]]);
-          if(hasCmd('corepack')&&match) steps.push(['corepack',['pnpm@'+match[1],'run',script]]);
-          if(hasCmd('corepack')) steps.push(['corepack',['pnpm','run',script]]);
-          trySteps(steps);
-          console.error('deft: neither pnpm nor corepack is available to run \"'+script+'\".');
-          if(pin){
-            console.error('  Enable Corepack for the pinned manager: corepack enable && corepack prepare '+pin+' --activate');
-          }else{
-            console.error('  Install pnpm or enable Corepack (see package.json#packageManager).');
-          }
-          console.error('  Or set DEFT_PACKAGE_MANAGER=npm for an explicit npm build path.');
-          process.exit(127);
-        " "{{.DEFT_ROOT}}" "{{.PM_SCRIPT}}"
+        node "{{.TASKFILE_DIR}}/engine-pm-run.cjs" "{{.DEFT_ROOT}}" "{{.PM_SCRIPT}}"
 
   _ts-build:
     internal: true
@@ -115,76 +51,7 @@ tasks:
           if node "{{.TASKFILE_DIR}}/ts-build-fresh.cjs" "{{.DEFT_ROOT}}"; then
             exit 0
           fi
-          node -e "
-            const {execFileSync}=require('child_process');
-            const fs=require('fs');
-            const root=process.argv[1];
-            const script='build';
-            const pkgPath=root+'/package.json';
-            const pkg=JSON.parse(fs.readFileSync(pkgPath,'utf8'));
-            // Cross-platform probe (#2415): do NOT use Unix `sh -c 'command -v'` —
-            // Windows native Task often has no `sh` on PATH, so Corepack.cmd was
-            // invisible after #2411. Prefer a direct spawn (POSIX / real binaries);
-            // fall back to shell:true so PATHEXT resolves .cmd/.exe on win32.
-            // windowsHide (#2563): CREATE_NO_WINDOW so Cursor Task shells do not
-            // flood visible cmd.exe/conhost windows on every probe/build.
-            const spawnOpts=(extra)=>({stdio:'ignore',windowsHide:true,...extra});
-            const hasCmd=(name)=>{
-              try{
-                execFileSync(name,['--version'],spawnOpts());
-                return true;
-              }catch{
-                try{
-                  execFileSync(name,['--version'],spawnOpts({shell:true}));
-                  return true;
-                }catch{
-                  return false;
-                }
-              }
-            };
-            const run=(cmd,args)=>{
-              execFileSync(cmd,args,{cwd:root,stdio:'inherit',shell:true,windowsHide:true});
-            };
-            const markWarm=()=>{
-              try{
-                const dist=root+'/packages/cli/dist';
-                fs.mkdirSync(dist,{recursive:true});
-                fs.writeFileSync(dist+'/.deft-ts-build-stamp',new Date().toISOString());
-              }catch{}
-            };
-            const trySteps=(steps)=>{
-              for(const [cmd,args] of steps){
-                try{
-                  run(cmd,args);
-                  markWarm();
-                  process.exit(0);
-                }catch{
-                  // fall through to Corepack / next resolver
-                }
-              }
-            };
-            const envPm=String(process.env.DEFT_PACKAGE_MANAGER||'').trim().toLowerCase();
-            if(envPm==='npm'){
-              run('npm',['run',script]);
-              markWarm();
-              process.exit(0);
-            }
-            const pin=String(pkg.packageManager||'').trim();
-            const match=pin.match(/^pnpm@(.+)$/);
-            const steps=[];
-            if(hasCmd('pnpm')) steps.push(['pnpm',['run',script]]);
-            if(hasCmd('corepack')&&match) steps.push(['corepack',['pnpm@'+match[1],'run',script]]);
-            if(hasCmd('corepack')) steps.push(['corepack',['pnpm','run',script]]);
-            trySteps(steps);
-            console.error('deft: neither pnpm nor corepack is available to run \"'+script+'\".');
-            if(pin){
-              console.error('  Enable Corepack for the pinned manager: corepack enable && corepack prepare '+pin+' --activate');
-            }else{
-              console.error('  Install pnpm or enable Corepack (see package.json#packageManager).');
-            }
-            console.error('  Or set DEFT_PACKAGE_MANAGER=npm for an explicit npm build path.');
-            process.exit(127);
-          " "{{.DEFT_ROOT}}"
+          node "{{.TASKFILE_DIR}}/engine-pm-run.cjs" "{{.DEFT_ROOT}}" build --mark-warm
         fi
 
   invoke: