@jwilger/pi-development-system 0.3.2 → 0.3.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jwilger/pi-development-system",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "A pi extension package representing a seasoned approach to software development using a full AI SDLC.",
   "keywords": [
     "pi-package"

package/src/core/redact.ts

@@ -6,5 +6,13 @@ export function redactSecrets(text: string): string {
     .replace(/\b(\w*(?:TOKEN|KEY|SECRET|PASSWORD)\w*)=("[^"]*"|'[^']*'|\S+)/gi, "$1=[redacted]")
     .replace(/\b(Authorization:\s*)\w+\s+[^\s'"]+/gi, "$1[redacted]")
     .replace(/\bBearer\s+[^\s'"]+/g, "Bearer [redacted]")
+    .replace(
+      /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g,
+      "[redacted private key]",
+    )
+    .replace(
+      /\b(\w*(?:token|key|secret|password|passwd)\w*["']?\s*[:=]\s*)(["'])[^"'\n]+\2/gi,
+      "$1$2[redacted]$2",
+    )
     .replace(/\bsk-[A-Za-z0-9_-]{16,}/g, "[redacted]");
 }

package/src/core/test-paths.ts

@@ -3,8 +3,13 @@ import { fileURLToPath } from "node:url";
 
 export type TestPathProfile = { readonly testGlobs?: readonly string[] };
 
+const TEST_DIR = /(^|\/)(test|tests|__tests__|spec|specs|e2e)(\/|$)/;
+const TEST_DIR_ITSELF = /(^|\/)(test|tests|__tests__|spec|specs|e2e)\/?$/;
+const SOURCE_EXT =
+  /\.(?:[cm]?[jt]sx?|py|rb|rs|go|java|kt|kts|scala|cs|ex|exs|php|swift|c|cc|cpp|h|hpp|sh|lua|clj|hs|ml)$/;
+const GLOBBY = /[*?[\]{]/;
+
 const PATTERNS: readonly RegExp[] = [
-  /(^|\/)(test|tests|__tests__|spec|specs|e2e)(\/|$)/,
   /\.(test|spec|cy)\.[cm]?[jt]sx?$/,
   /_test\.(go|rb|py|exs?|rs)$/,
   /(^|\/)test_[^/]+\.py$/,
@@ -26,6 +31,13 @@ function globToRegExp(glob: string): RegExp {
 export function isTestPath(path: string, profile?: TestPathProfile): boolean {
   const normalized = path.replace(/^\.\//, "");
   if (PATTERNS.some((p) => p.test(normalized))) return true;
+  // Inside a test directory only source files (or globs that may expand to them) are tests;
+  // logs, caches, snapshots and docs are not. The directory itself is, so `rm -rf tests` is caught.
+  if (TEST_DIR.test(normalized)) {
+    return (
+      TEST_DIR_ITSELF.test(normalized) || SOURCE_EXT.test(normalized) || GLOBBY.test(normalized)
+    );
+  }
   return (profile?.testGlobs ?? []).some((g) => globToRegExp(g).test(normalized));
 }
 

package/src/core/test-weakening.ts

@@ -4,7 +4,10 @@ import { parse } from "shell-quote";
 export type WeakeningSignals = { addsSkip: boolean; emptied: boolean; commentedOut: boolean };
 
 const SKIP_MARKERS: readonly RegExp[] = [
-  /\b(?:it|test|describe|context)\.(?:skip|todo|only)\b/,
+  /\b(?:it|test|describe|context)\.(?:skip|only)\b/,
+  /\.skip\(/,
+  /\bskip:\s*true\b/,
+  /\bskipTest\(/,
   /\bf(?:it|describe)\(/,
   /\bx(?:it|describe|test)\(/,
   /#\[ignore\b/,
@@ -48,12 +51,26 @@ function codeLineCount(text: string): number {
   return count;
 }
 
+const LINE_COMMENT = /^(?:\/\/+|#+|--|;+)\s?(.*)$/;
+
+/** True when a line that was live code before survives only as a line comment after. */
+function lineCommentedOut(before: string, after: string): boolean {
+  const live = new Set(after.split("\n").map((l) => l.trim()));
+  const beforeLines = new Set(before.split("\n").map((l) => l.trim()));
+  return after.split("\n").some((raw) => {
+    const rest = LINE_COMMENT.exec(raw.trim())?.[1]?.trim();
+    return rest !== undefined && rest.length > 3 && beforeLines.has(rest) && !live.has(rest);
+  });
+}
+
 /** Deterministic weakening signals between two versions of a test file. */
 export function weakeningSignals(before: string, after: string): WeakeningSignals {
   return {
     addsSkip: countSkips(after) > countSkips(before),
     emptied: before.trim() !== "" && after.trim() === "",
-    commentedOut: codeLineCount(after) < codeLineCount(before) && isPureAddition(before, after),
+    commentedOut:
+      lineCommentedOut(before, after) ||
+      (codeLineCount(after) < codeLineCount(before) && isPureAddition(before, after)),
   };
 }
 
@@ -222,6 +239,12 @@ function findTargets(args: readonly string[]): string[] {
 
 const removers = (args: readonly string[]): string[] => operands(args);
 
+export type MutationKind = "remove" | "overwrite";
+export type Mutation = { readonly path: string; readonly kind: MutationKind };
+
+/** Commands whose targets cease to exist (or are emptied); every other target is rewritten in place. */
+const REMOVING = new Set(["rm", "unlink", "trash", "rmdir", "mv", "truncate", "find", "git"]);
+
 const gitTargets = (args: readonly string[]): string[] => {
   let i = 0;
   while (args[i]?.startsWith("-")) i += args[i] === "-C" || args[i] === "-c" ? 2 : 1;
@@ -229,8 +252,12 @@ const gitTargets = (args: readonly string[]): string[] => {
   return sub === "rm" || sub === "mv" ? operands(args.slice(i + 1)) : [];
 };
 
-const sedTargets = (args: readonly string[]): string[] =>
-  args.some((a) => /^-[A-Za-z]*i|^--in-place/.test(a)) ? operands(args) : [];
+const sedTargets = (args: readonly string[]): string[] => {
+  if (!args.some((a) => /^-[A-Za-z]*i|^--in-place/.test(a))) return [];
+  // Without -e/-f the first operand is the script, not a file.
+  const scripted = args.some((a) => /^-[A-Za-z]*[ef]$|^--(?:expression|file)/.test(a));
+  return scripted ? operands(args) : operands(args).slice(1);
+};
 
 /** The destination operand is overwritten, whatever the source is. */
 const cpTargets = (args: readonly string[]): string[] => operands(args).slice(-1);
@@ -256,24 +283,31 @@ const TARGETS: Readonly<Record<string, (args: readonly string[]) => string[]>> =
   git: gitTargets,
 };
 
-function commandTargets(words: readonly string[]): string[] {
+function commandTargets(words: readonly string[]): Mutation[] {
   const [head, ...args] = words;
   if (head === undefined) return [];
-  const targets = Object.hasOwn(TARGETS, base(head)) ? TARGETS[base(head)] : undefined;
-  return targets === undefined ? [] : targets(args);
+  const name = base(head);
+  const targets = Object.hasOwn(TARGETS, name) ? TARGETS[name] : undefined;
+  const kind: MutationKind = REMOVING.has(name) ? "remove" : "overwrite";
+  return targets === undefined ? [] : targets(args).map((path) => ({ path, kind }));
 }
 
 const joinCwd = (cwd: string, path: string): string =>
   cwd === "" || path.startsWith("/") ? path : posix.join(cwd, path);
 
-function collect(command: string, startCwd: string, depth: number): string[] {
-  const found: string[] = [];
+/** With these (or nothing) as the command, a `>` redirect empties its target. */
+const PRODUCES_NOTHING = new Set(["", ":", "true", "false"]);
+
+function collect(command: string, startCwd: string, depth: number): Mutation[] {
+  const found: Mutation[] = [];
   let cwd = startCwd;
   for (const seg of segments(command)) {
     const words = realCommand(seg.words);
     const head = words[0] === undefined ? "" : base(words[0]);
     if (head === "cd") {
-      cwd = joinCwd(cwd, operands(words.slice(1))[0] ?? "~");
+      const target = operands(words.slice(1))[0] ?? "~";
+      // A computed directory cannot be resolved statically; keep the current one.
+      if (!/[$`]/.test(target)) cwd = joinCwd(cwd, target);
       continue;
     }
     if (head === "eval" && depth < 3) {
@@ -286,8 +320,14 @@ function collect(command: string, startCwd: string, depth: number): string[] {
       if (script !== undefined) found.push(...collect(script, cwd, depth + 1));
       continue;
     }
-    found.push(...commandTargets(words).map((p) => joinCwd(cwd, p)));
-    found.push(...seg.truncates.flatMap((p) => (p === "/dev/null" ? [] : [joinCwd(cwd, p)])));
+    found.push(...commandTargets(words).map((m) => ({ ...m, path: joinCwd(cwd, m.path) })));
+    found.push(
+      ...seg.truncates.flatMap((p): Mutation[] =>
+        p === "/dev/null"
+          ? []
+          : [{ path: joinCwd(cwd, p), kind: PRODUCES_NOTHING.has(head) ? "remove" : "overwrite" }],
+      ),
+    );
   }
   return found;
 }
@@ -297,6 +337,10 @@ function collect(command: string, startCwd: string, depth: number): string[] {
  * `git rm|mv`, `find -delete`, truncate, `sed -i`, tee and `>` redirects; sees through wrappers,
  * `bash -c`, `cd` and glob arguments.
  */
-export function bashMutatedPaths(command: string): string[] {
+export function bashMutations(command: string): Mutation[] {
   return collect(command, "", 0);
 }
+
+export function bashMutatedPaths(command: string): string[] {
+  return bashMutations(command).map((m) => m.path);
+}

package/src/gates/test-guard.ts

@@ -7,11 +7,12 @@ import {
   isToolCallEventType,
   type ToolCallEvent,
 } from "@earendil-works/pi-coding-agent";
+import { redactSecrets } from "../core/redact.ts";
 import { isTestPath, normalizeRepoPath } from "../core/test-paths.ts";
 import {
   addedLines,
   applyEdits,
-  bashMutatedPaths,
+  bashMutations,
   isPureAddition,
   type WeakeningSignals,
   weakeningSignals,
@@ -30,7 +31,13 @@ export type TestGuardDeps = {
   now?: () => Date;
 };
 
-type Change = { path: string; before: string; after: string | undefined };
+type Change = {
+  path: string;
+  before: string;
+  /** `undefined` means the file is gone; an `overwrite` carries the shell command instead. */
+  after: string | undefined;
+  rewritten?: string;
+};
 
 type Verdict =
   | { kind: "allow" }
@@ -93,12 +100,12 @@ export function registerTestGuard(deps: TestGuardDeps): void {
   };
 
   const judge = async (change: Change, ctx: ExtensionContext): Promise<Verdict> => {
-    const deleted = change.after === undefined;
+    const deleted = change.after === undefined && change.rewritten === undefined;
+    const after = change.after ?? change.rewritten ?? "";
     const signals = deleted
       ? { addsSkip: false, emptied: false, commentedOut: false }
-      : weakeningSignals(change.before, change.after ?? "");
+      : weakeningSignals(change.before, after);
     // Adding lines never weakens a test unless the added line itself is a skip marker.
-    const after = change.after ?? "";
     if (
       !deleted &&
       !signals.addsSkip &&
@@ -112,7 +119,7 @@ export function registerTestGuard(deps: TestGuardDeps): void {
     const judged = await judgeTestChange(deps.jev(ctx), {
       path: change.path,
       before: change.before,
-      ...(change.after !== undefined ? { after: change.after } : {}),
+      ...(after !== "" ? { after: redactSecrets(after) } : {}),
     });
     if (judged.ok) {
       const { weakens, motive } = judged.value;
@@ -137,12 +144,22 @@ export function registerTestGuard(deps: TestGuardDeps): void {
 
   const collectChanges = (event: ToolCallEvent, ctx: ExtensionContext): Change[] => {
     if (isToolCallEventType("bash", event)) {
-      return bashMutatedPaths(event.input.command).flatMap((raw) => {
+      const { command } = event.input;
+      return bashMutations(command).flatMap(({ path: raw, kind }) => {
         const path = repoPath(ctx.cwd, raw);
         // Missing plain paths have nothing to weaken; globs and directories may still hide tests.
         const touched = GLOB.test(path) || existsSync(join(ctx.cwd, path));
         return isTestPath(path) && touched
-          ? [{ path, before: readIfExists(join(ctx.cwd, path)) ?? "", after: undefined }]
+          ? [
+              {
+                path,
+                before: readIfExists(join(ctx.cwd, path)) ?? "",
+                after: undefined,
+                ...(kind === "overwrite"
+                  ? { rewritten: `(rewritten by shell command) ${command}` }
+                  : {}),
+              },
+            ]
           : [];
       });
     }