@lavralabs/lavra 0.7.0

package/scripts/test-compatibility.ts

@@ -0,0 +1,539 @@
+#!/usr/bin/env bun
+
+/**
+ * Compatibility and Security Testing Suite
+ * Tests conversion scripts, file formats, and security controls
+ */
+
+import { mkdir, writeFile, rm, readdir } from "node:fs/promises";
+import { join } from "node:path";
+import { $ } from "bun";
+
+const TEST_DIR = join(import.meta.dir, "../test-output");
+const PASSED: string[] = [];
+const FAILED: string[] = [];
+
+function pass(name: string) {
+  PASSED.push(name);
+  console.log(`✓ ${name}`);
+}
+
+function fail(name: string, error: string) {
+  FAILED.push(name);
+  console.log(`✗ ${name}: ${error}`);
+}
+
+/**
+ * Test 1: Path Traversal Protection
+ */
+async function testPathTraversal() {
+  console.log("\n🔒 Test 1: Path Traversal Protection");
+
+  await mkdir(TEST_DIR, { recursive: true });
+
+  // Create test file with normal name but test path validation in conversion
+  const testPath = join(TEST_DIR, "test-command.md");
+  await writeFile(testPath, "---\nname: test\n---\nMalicious content");
+
+  // Try to convert - should fail or sanitize
+  try {
+    await $`cd ${import.meta.dir} && bun run convert-opencode.ts`.quiet();
+
+    // Check if any files were written outside target directory
+    const opencodeDir = join(import.meta.dir, "../plugins/lavra/opencode");
+    const files = await $`find ${opencodeDir} -name "*shadow*"`.quiet().text();
+
+    if (files.trim() === "") {
+      pass("Path traversal blocked in conversion");
+    } else {
+      fail("Path traversal", "Malicious file found in output");
+    }
+  } catch (err: any) {
+    if (err.message.includes("Path traversal")) {
+      pass("Path traversal rejected with error");
+    } else {
+      fail("Path traversal", `Unexpected error: ${err.message}`);
+    }
+  } finally {
+    await rm(testPath, { force: true });
+  }
+}
+
+/**
+ * Test 2: Oversized File Rejection
+ */
+async function testOversizedFile() {
+  console.log("\n📏 Test 2: Oversized File Rejection");
+
+  await mkdir(TEST_DIR, { recursive: true });
+
+  // Create 11MB file
+  const largeContent = "x".repeat(11 * 1024 * 1024);
+  const largePath = join(TEST_DIR, "large-command.md");
+  await writeFile(largePath, `---\nname: large\n---\n${largeContent}`);
+
+  // Try to read with security controls
+  const { readFileSafe } = await import("./shared/security");
+
+  try {
+    await readFileSafe(largePath);
+    fail("Oversized file", "Should have rejected file >10MB");
+  } catch (err: any) {
+    if (err.message.includes("File too large")) {
+      pass("Oversized file rejected (>10MB)");
+    } else {
+      fail("Oversized file", `Wrong error: ${err.message}`);
+    }
+  } finally {
+    await rm(largePath, { force: true });
+  }
+}
+
+/**
+ * Test 3: Malicious YAML Protection
+ */
+async function testMaliciousYAML() {
+  console.log("\n📝 Test 3: Malicious YAML Protection");
+
+  const { parseFrontmatter } = await import("./shared/yaml-parser");
+
+  // Test code execution attempt
+  const maliciousYAML = `---
+!!python/object/apply:os.system
+args: ['echo pwned']
+---
+Body content`;
+
+  try {
+    parseFrontmatter(maliciousYAML);
+    fail("Malicious YAML", "Should have blocked code execution tag");
+  } catch (err: any) {
+    if (err.message.toLowerCase().includes("parse error") ||
+        err.message.toLowerCase().includes("unknown tag")) {
+      pass("Malicious YAML blocked (SAFE_SCHEMA)");
+    } else {
+      fail("Malicious YAML", `Wrong error: ${err.message}`);
+    }
+  }
+}
+
+/**
+ * Test 4: Template Injection Protection (Gemini)
+ */
+async function testTemplateInjection() {
+  console.log("\n💉 Test 4: Template Injection Protection");
+
+  // Check an existing converted file for proper escaping
+  const geminiDir = join(import.meta.dir, "../plugins/lavra/gemini/commands");
+
+  try {
+    // Read a command that has template variables
+    const content = await Bun.file(join(geminiDir, "lavra-plan.toml")).text();
+
+    // Verify $ARGUMENTS was converted to {{args}}
+    // and that any pre-existing {{ }} would have been escaped
+    if (content.includes("{{args}}")) {
+      pass("Template conversion works ({{args}} present)");
+
+      // Verify no unescaped malicious patterns
+      if (!content.includes("{{exec") && !content.includes("{{#each")) {
+        pass("Template injection prevented (no malicious patterns)");
+      } else {
+        fail("Template injection", "Found unescaped malicious template syntax");
+      }
+    } else {
+      fail("Template injection", "Template conversion may not be working");
+    }
+  } catch (err: any) {
+    fail("Template injection", `Could not verify: ${err.message}`);
+  }
+}
+
+/**
+ * Test 5: File Permission Verification
+ */
+async function testFilePermissions() {
+  console.log("\n🔐 Test 5: File Permission Verification");
+
+  const opencodeDir = join(import.meta.dir, "../plugins/lavra/opencode");
+
+  // Check commands (should be 644)
+  try {
+    const result = await $`find ${opencodeDir}/commands -type f -not -perm 644`.quiet().text();
+    if (result.trim() === "") {
+      pass("Commands have correct permissions (644)");
+    } else {
+      fail("Command permissions", `Found files with wrong permissions:\n${result}`);
+    }
+  } catch {
+    fail("Command permissions", "Could not check permissions");
+  }
+
+  // Check agents (should be 644)
+  try {
+    const result = await $`find ${opencodeDir}/agents -type f -not -perm 644`.quiet().text();
+    if (result.trim() === "") {
+      pass("Agents have correct permissions (644)");
+    } else {
+      fail("Agent permissions", `Found files with wrong permissions:\n${result}`);
+    }
+  } catch {
+    fail("Agent permissions", "Could not check permissions");
+  }
+
+  // Check skills (should be 644 - writable to allow conversion script re-runs)
+  try {
+    const result = await $`find ${opencodeDir}/skills -type f -name "SKILL.md" -not -perm 644`.quiet().text();
+    if (result.trim() === "") {
+      pass("Skills have correct permissions (644)");
+    } else {
+      fail("Skill permissions", `Found files with wrong permissions:\n${result}`);
+    }
+  } catch {
+    fail("Skill permissions", "Could not check permissions");
+  }
+
+  // Check cortex directories (same as opencode)
+  const cortexDir = join(import.meta.dir, "../plugins/lavra/cortex");
+
+  // Check commands (should be 644)
+  try {
+    const result = await $`find ${cortexDir}/commands -type f -not -perm 644`.quiet().text();
+    if (result.trim() === "") {
+      pass("Cortex commands have correct permissions (644)");
+    } else {
+      fail("Cortex command permissions", `Found files with wrong permissions:\n${result}`);
+    }
+  } catch {
+    fail("Cortex command permissions", "Could not check permissions");
+  }
+
+  // Check agents (should be 644)
+  try {
+    const result = await $`find ${cortexDir}/agents -type f -not -perm 644`.quiet().text();
+    if (result.trim() === "") {
+      pass("Cortex agents have correct permissions (644)");
+    } else {
+      fail("Cortex agent permissions", `Found files with wrong permissions:\n${result}`);
+    }
+  } catch {
+    fail("Cortex agent permissions", "Could not check permissions");
+  }
+
+  // Check skills (should be 644)
+  try {
+    const result = await $`find ${cortexDir}/skills -type f -name "SKILL.md" -not -perm 644`.quiet().text();
+    if (result.trim() === "") {
+      pass("Cortex skills have correct permissions (644)");
+    } else {
+      fail("Cortex skill permissions", `Found files with wrong permissions:\n${result}`);
+    }
+  } catch {
+    fail("Cortex skill permissions", "Could not check permissions");
+  }
+
+  // Check for executables in data directories (should be none)
+  try {
+    // Use -perm /111 for POSIX compliance (checks if any execute bit is set)
+    const commands = await $`find ${opencodeDir}/commands -type f -perm /111 2>/dev/null || true`.text();
+    const agents = await $`find ${opencodeDir}/agents -type f -perm /111 2>/dev/null || true`.text();
+    const skills = await $`find ${opencodeDir}/skills -type f -perm /111 2>/dev/null || true`.text();
+
+    if (commands.trim() === "" && agents.trim() === "" && skills.trim() === "") {
+      pass("No unexpected executables in data directories");
+    } else {
+      fail("Executable check", "Found executable files in data directories");
+    }
+  } catch (err: any) {
+    // If find command itself fails, that's an error
+    fail("Executable check", `Could not check for executables: ${err.message}`);
+  }
+}
+
+/**
+ * Test 6: Model Name Validation
+ */
+async function testModelNameValidation() {
+  console.log("\n🎯 Test 6: Model Name Validation");
+
+  const { validateModelName } = await import("./shared/security");
+
+  const invalidModels = [
+    "; rm -rf /",
+    "../../../etc/passwd",
+    "$(whoami)",
+    "malicious' OR '1'='1",
+  ];
+
+  for (const model of invalidModels) {
+    try {
+      validateModelName(model);
+      fail(`Model validation: ${model}`, "Should have rejected invalid model");
+    } catch (err: any) {
+      if (err.message.includes("Invalid model name") || err.message.includes("Unsupported model")) {
+        pass(`Invalid model rejected: ${model}`);
+      } else {
+        fail(`Model validation: ${model}`, `Wrong error: ${err.message}`);
+      }
+    }
+  }
+}
+
+/**
+ * Test 7: Platform Flag Validation (Installer)
+ */
+async function testPlatformFlagValidation() {
+  console.log("\n🚩 Test 7: Platform Flag Validation");
+
+  const installerPath = join(import.meta.dir, "../install.sh");
+
+  // Test invalid platform
+  try {
+    const result = await $`${installerPath} -foobar 2>&1`.quiet().nothrow();
+    const output = await result.text();
+
+    // The -foobar flag should be treated as a path, not platform
+    // So it should try to install to a directory called "-foobar"
+    // This is actually correct behavior - unrecognized flags pass through
+    if (output.includes("Installing lavra for claude")) {
+      pass("Unrecognized flags pass through to default platform");
+    } else if (output.includes("Invalid platform")) {
+      pass("Invalid platform flag rejected");
+    } else {
+      fail("Platform validation", `Unexpected output: ${output.substring(0, 100)}`);
+    }
+  } catch {
+    pass("Invalid platform flag rejected (via error)");
+  }
+
+  // Test path traversal in platform
+  try {
+    const result = await $`${installerPath} "../../../etc" 2>&1`.quiet().nothrow();
+    const output = await result.text();
+
+    // Should either reject or treat as target path (not platform)
+    if (!output.includes("Installing lavra for") || output.includes("claude")) {
+      pass("Path traversal in platform handled safely");
+    } else {
+      fail("Platform validation", "Path traversal may have been accepted as platform");
+    }
+  } catch {
+    pass("Path traversal rejected");
+  }
+}
+
+/**
+ * Test 8: Directory Creation Safety
+ */
+async function testDirectoryCreationSafety() {
+  console.log("\n📁 Test 8: Directory Creation Safety");
+
+  // Test symlink rejection
+  const symlinkPath = join(TEST_DIR, "symlink-test");
+  const targetPath = join(TEST_DIR, "real-dir");
+
+  await mkdir(targetPath, { recursive: true });
+  await $`ln -s ${targetPath} ${symlinkPath}`.quiet();
+
+  // Installers should reject symlinks
+  // This is a conceptual test - actual check is in installer scripts
+  try {
+    const stat = await Bun.file(symlinkPath).stat();
+    // In production, installer would check and reject
+    pass("Symlink detection capability verified");
+  } catch {
+    fail("Symlink detection", "Could not verify symlink handling");
+  } finally {
+    await rm(symlinkPath, { force: true });
+    await rm(targetPath, { recursive: true, force: true });
+  }
+}
+
+/**
+ * Test 9: Conversion Output Verification
+ */
+async function testConversionOutputs() {
+  console.log("\n✅ Test 9: Conversion Output Verification");
+
+  const opencodeDir = join(import.meta.dir, "../plugins/lavra/opencode");
+  const geminiDir = join(import.meta.dir, "../plugins/lavra/gemini");
+
+  // Verify OpenCode outputs exist
+  try {
+    const commandsExist = await Bun.file(join(opencodeDir, "commands/lavra-plan.md")).exists();
+    const agentsExist = await Bun.file(join(opencodeDir, "agents/review/agent-native-reviewer.md")).exists();
+    const skillsExist = await Bun.file(join(opencodeDir, "skills/git-worktree/SKILL.md")).exists();
+
+    if (commandsExist && agentsExist && skillsExist) {
+      pass("OpenCode conversion outputs exist");
+    } else {
+      fail("OpenCode outputs", "Missing expected files");
+    }
+  } catch {
+    fail("OpenCode outputs", "Could not verify outputs");
+  }
+
+  // Verify Gemini outputs exist
+  try {
+    const commandsExist = await Bun.file(join(geminiDir, "commands/lavra-plan.toml")).exists();
+    const agentsExist = await Bun.file(join(geminiDir, "agents/review/agent-native-reviewer.md")).exists();
+    const skillsExist = await Bun.file(join(geminiDir, "skills/git-worktree/SKILL.md")).exists();
+
+    if (commandsExist && agentsExist && skillsExist) {
+      pass("Gemini conversion outputs exist");
+    } else {
+      fail("Gemini outputs", "Missing expected files");
+    }
+  } catch {
+    fail("Gemini outputs", "Could not verify outputs");
+  }
+
+  // Verify generation headers
+  try {
+    const content = await Bun.file(join(opencodeDir, "commands/lavra-plan.md")).text();
+    if (content.includes("Generated by lavra")) {
+      pass("Generation headers present in OpenCode files");
+    } else {
+      fail("Generation headers", "Missing generation marker");
+    }
+  } catch {
+    fail("Generation headers", "Could not read file");
+  }
+
+  // Verify Cortex outputs exist
+  const cortexDir2 = join(import.meta.dir, "../plugins/lavra/cortex");
+  try {
+    const commandsExist = await Bun.file(join(cortexDir2, "commands/lavra-plan.md")).exists();
+    const agentsExist = await Bun.file(join(cortexDir2, "agents/review/agent-native-reviewer.md")).exists();
+    const skillsExist = await Bun.file(join(cortexDir2, "skills/git-worktree/SKILL.md")).exists();
+
+    if (commandsExist && agentsExist && skillsExist) {
+      pass("Cortex conversion outputs exist");
+    } else {
+      fail("Cortex outputs", "Missing expected files");
+    }
+  } catch {
+    fail("Cortex outputs", "Could not verify outputs");
+  }
+
+  // Verify generation headers in Cortex files
+  try {
+    const content = await Bun.file(join(cortexDir2, "commands/lavra-plan.md")).text();
+    if (content.includes("Generated by lavra")) {
+      pass("Generation headers present in Cortex files");
+    } else {
+      fail("Cortex generation headers", "Missing generation marker");
+    }
+  } catch {
+    fail("Cortex generation headers", "Could not read file");
+  }
+}
+
+/**
+ * Test 10: Format Compatibility
+ */
+async function testFormatCompatibility() {
+  console.log("\n📋 Test 10: Format Compatibility");
+
+  const opencodeDir = join(import.meta.dir, "../plugins/lavra/opencode");
+  const geminiDir = join(import.meta.dir, "../plugins/lavra/gemini");
+
+  // OpenCode: Commands should be .md
+  try {
+    const mdFiles = await $`find ${opencodeDir}/commands -name "*.md"`.quiet().text();
+    const mdCount = mdFiles.trim().split("\n").length;
+
+    if (mdCount >= 25) {
+      pass(`OpenCode commands in .md format (${mdCount} files)`);
+    } else {
+      fail("OpenCode format", `Expected 25+ .md files, found ${mdCount}`);
+    }
+  } catch {
+    fail("OpenCode format", "Could not verify command format");
+  }
+
+  // Gemini: Commands should be .toml
+  try {
+    const tomlFiles = await $`find ${geminiDir}/commands -name "*.toml"`.quiet().text();
+    const tomlCount = tomlFiles.trim().split("\n").length;
+
+    if (tomlCount >= 25) {
+      pass(`Gemini commands in .toml format (${tomlCount} files)`);
+    } else {
+      fail("Gemini format", `Expected 25+ .toml files, found ${tomlCount}`);
+    }
+  } catch {
+    fail("Gemini format", "Could not verify command format");
+  }
+
+  // Verify template syntax conversion
+  try {
+    const tomlContent = await Bun.file(join(geminiDir, "commands/lavra-plan.toml")).text();
+
+    // Check that template variable conversion happened ({{args}} exists)
+    // Note: $ARGUMENTS may still appear in code blocks, which is correct
+    if (tomlContent.includes("#{{args}}")) {
+      pass("Template syntax converted ($ARGUMENTS → {{args}})");
+    } else {
+      fail("Template syntax", "Conversion not applied correctly");
+    }
+  } catch {
+    fail("Template syntax", "Could not verify conversion");
+  }
+
+  // Cortex: Commands should be .md (same format as OpenCode)
+  try {
+    const cortexDir3 = join(import.meta.dir, "../plugins/lavra/cortex");
+    const mdFiles = await $`find ${cortexDir3}/commands -name "*.md"`.quiet().text();
+    const mdCount = mdFiles.trim().split("\n").length;
+
+    if (mdCount >= 25) {
+      pass(`Cortex commands in .md format (${mdCount} files)`);
+    } else {
+      fail("Cortex format", `Expected 25+ .md files, found ${mdCount}`);
+    }
+  } catch {
+    fail("Cortex format", "Could not verify command format");
+  }
+}
+
+/**
+ * Main test runner
+ */
+async function main() {
+  console.log("🧪 Compatibility and Security Test Suite\n");
+  console.log("Testing lavra multi-platform conversion...\n");
+
+  try {
+    await testPathTraversal();
+    await testOversizedFile();
+    await testMaliciousYAML();
+    await testTemplateInjection();
+    await testFilePermissions();
+    await testModelNameValidation();
+    await testPlatformFlagValidation();
+    await testDirectoryCreationSafety();
+    await testConversionOutputs();
+    await testFormatCompatibility();
+  } finally {
+    // Cleanup
+    await rm(TEST_DIR, { recursive: true, force: true });
+  }
+
+  console.log("\n" + "=".repeat(70));
+  console.log(`✓ Passed: ${PASSED.length}`);
+  console.log(`✗ Failed: ${FAILED.length}`);
+  console.log("=".repeat(70));
+
+  if (FAILED.length > 0) {
+    console.log("\n❌ Some tests failed:");
+    FAILED.forEach((test) => console.log(`  - ${test}`));
+    process.exit(1);
+  } else {
+    console.log("\n✅ All compatibility and security tests passed!");
+  }
+}
+
+if (import.meta.main) {
+  main();
+}