@marcomigozzi/trailhead 0.12.1 → 0.14.0

package/plugins/trailhead/hooks/lib/gh-subcommand.js

@@ -49,6 +49,21 @@
 // stray keyword token in a genuinely non-write command from being
 // misclassified as a write.
 //
+// Third follow-up fix (#219): the walk compared raw, still-quoted tokens, but bash
+// removes quotes before `gh` runs, so `"gh" issue comment`, `gh 'issue' comment`,
+// `gh issue com""ment`, `\gh ...` or `$'gh' ...` hid the write from both guards.
+// Every token is now compared (and `sub`/`verb` returned) in its quote-removed
+// form. This slightly over-detects (a quote inside a single-quoted word is
+// dropped too), which is the safe direction for a guard.
+//
+// Fourth follow-up fix (#225): the verb was read as the token right after the
+// subcommand, so a flag between them (`gh issue -R o/r comment 5`,
+// `gh pr --repo=o/r edit 5`) made the verb the flag itself and hid the write
+// from both guards. Flags after the subcommand are now skipped with the same
+// arity model as the global walk (a glued `--flag=value` or a boolean global
+// flag takes no value, any other flag consumes one following non-flag token)
+// before the verb is read, in the primary walk and in the fail-safe fallback.
+//
 // Self-contained. No requires.
 
 // gh's boolean global flags (take NO value). gh's only value-taking global
@@ -62,11 +77,83 @@ const BOOLEAN_GLOBAL_FLAGS = new Set(['-h', '--help', '--version']);
 // below to recover from an unknown boolean flag swallowing the subcommand.
 const WRITE_SUBCOMMANDS = new Set(['issue', 'pr', 'api']);
 
+// Single-letter ANSI-C escapes (`$'\n'`).
+const ANSI_C_SIMPLE = { n: '\n', t: '\t', r: '\r', a: '\x07', b: '\b', f: '\f', v: '\v', e: '\x1b' };
+
+// Decode the escape at word[i] (the char after a backslash) inside a `$'...'` span:
+// { out, next }. Unknown pairs keep the escaped char, so nothing is lost.
+function ansiEscape(word, i) {
+  const n = word[i];
+  if (Object.prototype.hasOwnProperty.call(ANSI_C_SIMPLE, n)) return { out: ANSI_C_SIMPLE[n], next: i + 1 };
+  const rest = word.slice(i);
+  let m;
+  if ((m = /^x([0-9a-fA-F]{1,2})/.exec(rest)) || (m = /^u([0-9a-fA-F]{1,4})/.exec(rest)) || (m = /^U([0-9a-fA-F]{1,8})/.exec(rest))) {
+    const cp = parseInt(m[1], 16);
+    return { out: cp <= 0x10ffff ? String.fromCodePoint(cp) : m[0], next: i + m[0].length };
+  }
+  if ((m = /^[0-7]{1,3}/.exec(rest))) return { out: String.fromCharCode(parseInt(m[0], 8) & 0xff), next: i + m[0].length };
+  return { out: n, next: i + 1 };
+}
+
+// A word as bash passes it once quoting is removed: a `$'...'` span is decoded
+// (\xHH, \NNN, \uHHHH, \n ...), `$` before a `"` is dropped, a backslash escape keeps
+// the escaped char, quote characters are dropped (#219). Also returns, per output
+// char, the id of the quoted span it came from (-1 for unquoted text), so a caller can
+// tell `"-F x"` (one span, free text) from `-"F"/"p a"` (the flag, then a value).
+function dequoteSpans(word) {
+  const w = String(word);
+  let text = '';
+  const spans = [];
+  const put = (str, id) => { text += str; for (let k = 0; k < str.length; k++) spans.push(id); };
+  let q = null; // the open quote: ' or "
+  let id = 0;
+  for (let i = 0; i < w.length; i++) {
+    const c = w[i];
+    if (q === "'") { if (c === "'") q = null; else put(c, id); continue; }
+    if (q === '"') {
+      if (c === '"') q = null;
+      else if (c === '\\' && i + 1 < w.length && '$`"\\\n'.includes(w[i + 1])) {
+        // bash: inside "..." a backslash only escapes $ ` " \ and newline (which vanishes)
+        i++;
+        if (w[i] !== '\n') put(w[i], id);
+      } else put(c, id);
+      continue;
+    }
+    if (c === '$' && w[i + 1] === "'") {
+      id++;
+      i += 2;
+      while (i < w.length && w[i] !== "'") {
+        if (w[i] === '\\' && i + 1 < w.length) { const e = ansiEscape(w, i + 1); put(e.out, id); i = e.next; } else put(w[i++], id);
+      }
+    } else if (c === '$' && w[i + 1] === '"') {
+      continue; // locale quoting: the `$` vanishes, the double-quoted span follows
+    } else if (c === '\\' && i + 1 < w.length) put(w[++i], -1);
+    else if (c === "'" || c === '"') { q = c; id++; }
+    else put(c, -1);
+  }
+  return { text, spans };
+}
+
+const dequote = (word) => dequoteSpans(word).text;
+
+// Skip the flags starting at toks[i] and return the index of the first
+// non-flag token. A glued `--flag=value` or a BOOLEAN_GLOBAL_FLAGS member takes
+// no value; any other flag consumes one following non-flag token (#153, #225).
+function skipFlags(toks, i) {
+  while (i < toks.length && toks[i].startsWith('-')) {
+    const flag = toks[i];
+    i++; // the flag token itself
+    if (flag.includes('=') || BOOLEAN_GLOBAL_FLAGS.has(flag)) continue; // no separate value
+    if (i < toks.length && !toks[i].startsWith('-')) i++;               // consume its value
+  }
+  return i;
+}
+
 // Parse a raw shell command string and locate the gh subcommand/verb.
 // Returns { sub, verb } (verb may be undefined) or null when this is not a
 // gh invocation at all.
 function parseGhSubcommand(cmd) {
-  const toks = String(cmd).trim().split(/\s+/);
+  const toks = String(cmd).trim().split(/\s+/).map(dequote);
   let i = 0;
   while (i < toks.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(toks[i])) i++; // env prefix
   if (i >= toks.length || !/(^|\/)gh$/.test(toks[i])) return null;         // the gh binary
@@ -75,14 +162,9 @@ function parseGhSubcommand(cmd) {
   // Primary positional walk. -R/--repo (and any non-boolean, non-glued flag)
   // is treated as value-taking: consume one following non-flag token so an
   // unknown two-token global flag's value cannot shift the subcommand (#153).
-  while (i < toks.length && toks[i].startsWith('-')) {
-    const flag = toks[i];
-    i++; // the flag token itself
-    if (flag.includes('=') || BOOLEAN_GLOBAL_FLAGS.has(flag)) continue; // no separate value
-    if (i < toks.length && !toks[i].startsWith('-')) i++;               // consume its value
-  }
+  i = skipFlags(toks, i);
   let sub = toks[i];
-  let verb = toks[i + 1];
+  let verb = toks[skipFlags(toks, i + 1)];
   // Fail-safe fallback: if the walk did NOT land on a recognized write
   // subcommand, an unknown *boolean* flag before the subcommand may have
   // consumed the subcommand itself as if it were the flag's value (the mirror
@@ -93,10 +175,10 @@ function parseGhSubcommand(cmd) {
   // non-write command does not become a spurious write.
   if (!WRITE_SUBCOMMANDS.has(sub)) {
     for (let j = start; j < toks.length; j++) {
-      if (WRITE_SUBCOMMANDS.has(toks[j])) { sub = toks[j]; verb = toks[j + 1]; break; }
+      if (WRITE_SUBCOMMANDS.has(toks[j])) { sub = toks[j]; verb = toks[skipFlags(toks, j + 1)]; break; }
     }
   }
   return { sub, verb };
 }
 
-module.exports = { parseGhSubcommand, BOOLEAN_GLOBAL_FLAGS, WRITE_SUBCOMMANDS };
+module.exports = { parseGhSubcommand, dequote, dequoteSpans, BOOLEAN_GLOBAL_FLAGS, WRITE_SUBCOMMANDS };

package/plugins/trailhead/hooks/lib/gh-subcommand.test.js

@@ -96,4 +96,59 @@ ok('gh --foo --bar issue edit 5 resolves issue/edit (two unknown boolean flags)'
 ok('gh repo view owner/repo resolves sub "repo" (not forced into a write keyword)',
   (() => { const r = parseGhSubcommand('gh repo view owner/repo'); return r.sub === 'repo'; })());
 
+// --- #219: a quoted or split word is the same word for bash ---
+ok('"gh" issue comment resolves issue/comment',
+  (() => { const r = parseGhSubcommand('"gh" issue comment 5'); return r && r.sub === 'issue' && r.verb === 'comment'; })());
+ok("gh 'issue' comment resolves issue/comment",
+  (() => { const r = parseGhSubcommand("gh 'issue' comment 5"); return r.sub === 'issue' && r.verb === 'comment'; })());
+ok('gh issue com""ment resolves the verb comment',
+  (() => { const r = parseGhSubcommand('gh issue com""ment 5'); return r.sub === 'issue' && r.verb === 'comment'; })());
+ok('"/usr/bin/gh" api resolves api',
+  (() => { const r = parseGhSubcommand('"/usr/bin/gh" api x'); return r && r.sub === 'api'; })());
+ok('\\gh and g"h" and $\'gh\' are the gh binary',
+  ['\\gh issue edit 5', 'g"h" issue edit 5', "$'gh' issue edit 5"].every((c) => { const r = parseGhSubcommand(c); return r && r.sub === 'issue' && r.verb === 'edit'; }));
+ok('gh is\\sue comment resolves issue',
+  (() => { const r = parseGhSubcommand('gh is\\sue comment 5'); return r.sub === 'issue' && r.verb === 'comment'; })());
+ok('"ghx" issue is not the gh binary', parseGhSubcommand('"ghx" issue comment 5') === null);
+ok("gh 'repo' view still resolves repo",
+  (() => { const r = parseGhSubcommand("gh 'repo' view"); return r.sub === 'repo' && r.verb === 'view'; })());
+
+// --- #219: dequote decodes ANSI-C spans and drops quotes and escapes ---
+{
+  const { dequote } = require('./gh-subcommand.js');
+  ok('dequote drops quote characters', dequote(`a'b'"c"`) === 'abc');
+  ok('dequote keeps an escaped char', dequote('\\gh') === 'gh');
+  ok('dequote decodes a hex escape', dequote(`$'\\x67h'`) === 'gh');
+  ok('dequote decodes an octal escape', dequote(`$'\\151ssue'`) === 'issue');
+  ok('dequote decodes a unicode escape', dequote(`$'\\u0067h'`) === 'gh');
+  ok('dequote decodes single-letter escapes', dequote(`$'a\\tb\\\\c\\'d'`) === "a\tb\\c'd");
+  ok('dequote keeps a backslash that bash keeps inside double quotes', dequote('"\\nn"') === '\\nn');
+  ok('dequote drops the backslash of \\$ inside double quotes', dequote('"\\$x"') === '$x');
+  ok('dequote drops a backslash-newline inside double quotes', dequote('"a\\\nb"') === 'ab');
+  ok('dequote keeps a backslash literal inside single quotes', dequote("'a\\b'") === 'a\\b');
+  ok('dequote drops the $ of a locale-quoted span', dequote('$"gh"') === 'gh');
+  ok('dequote leaves a bare variable alone', dequote('$HOME') === '$HOME');
+  const { dequoteSpans } = require('./gh-subcommand.js');
+  ok('dequoteSpans tags each char with its quoted span', JSON.stringify(dequoteSpans(`-"F"/"p a"`)) === JSON.stringify({ text: '-F/p a', spans: [-1, 1, -1, 2, 2, 2] }));
+  ok('dequoteSpans keeps one span for "-F handling"', dequoteSpans('"-F x"').spans.every((x) => x === 1));
+  ok('body-sources re-exports the same dequote', require('./body-sources.js').dequote === dequote);
+  const { flagValues } = require('./body-sources.js');
+  const J = JSON.stringify;
+  ok("flagValues sees a quoted long flag", J(flagValues(["'--body-file'", 'f'], '--body-file', '-F')) === J(['f']));
+  ok('flagValues sees a split long flag', J(flagValues(['--body-fi""le', 'f'], '--body-file', '-F')) === J(['f']));
+  ok('flagValues sees a quoted short flag', J(flagValues([`"-F"`, 'f'], '--body-file', '-F')) === J(['f']));
+  ok('flagValues sees a fully quoted --flag=value', J(flagValues(['"--body-file=/p"'], '--body-file', '-F')) === J(['/p']));
+  ok('flagValues keeps a raw value untouched', J(flagValues(['--body', `'a b'`], '--body', '-b')) === J([`'a b'`]));
+}
+
+// --- #225: a flag between the subcommand and the verb is skipped ---
+{
+  const r = (c) => { const x = parseGhSubcommand(c); return x.sub + '/' + x.verb; };
+  ok('gh issue -R o/r comment 5 resolves issue/comment', r('gh issue -R o/r comment 5') === 'issue/comment');
+  ok('gh pr --repo o/r edit 5 resolves pr/edit', r('gh pr --repo o/r edit 5') === 'pr/edit');
+  ok('gh issue --repo=o/r comment 5 resolves issue/comment', r('gh issue --repo=o/r comment 5') === 'issue/comment');
+  ok('gh -R a/b issue -R o/r edit 5 resolves issue/edit', r('gh -R a/b issue -R o/r edit 5') === 'issue/edit');
+  ok('gh issue --help comment: boolean flag takes no value', r('gh issue --help comment') === 'issue/comment');
+}
+
 console.log(`✓ gh-subcommand: ${passed} assertions passed`);

package/plugins/trailhead/hooks/lib/mockup-link.js

@@ -25,12 +25,28 @@ function questionText(q) {
   return [q.question, q.header, ...labels].filter((s) => typeof s === 'string').join('\n');
 }
 
+const questionsOf = (input) => ((input && Array.isArray(input.questions)) ? input.questions : []);
+
+// Is this single question itself a mockup-approval ask?
+function isApprovalQuestion(q) {
+  const t = q ? questionText(q) : '';
+  return MOCKUP_WORD.test(t) && APPROVAL_WORD.test(t);
+}
+
 // AskUserQuestion input: does any single question ask to approve a mockup?
 function isMockupApprovalAsk(input) {
-  const qs = (input && Array.isArray(input.questions)) ? input.questions : [];
-  return qs.some((q) => {
-    const t = q ? questionText(q) : '';
-    return MOCKUP_WORD.test(t) && APPROVAL_WORD.test(t);
+  return questionsOf(input).some(isApprovalQuestion);
+}
+
+// Does a mockup-approval question carry the link itself (question, header,
+// option label or description)? A link in an unrelated question of the same
+// ask does not count.
+function askHasLink(input) {
+  return questionsOf(input).some((q) => {
+    if (!isApprovalQuestion(q)) return false;
+    const opts = Array.isArray(q.options) ? q.options : [];
+    const parts = [q.question, q.header, ...opts.flatMap((o) => [o && o.label, o && o.description])];
+    return parts.some(hasLink);
   });
 }
 
@@ -47,4 +63,4 @@ const BLOCK_REASON =
   'screen/variant) in the plain prose immediately before the question, not the project ' +
   'name, then ask again. See "Surface the mockup" in _shared/techniques/prototype.md.';
 
-module.exports = { hasLink, isMockupApprovalAsk, isMockupApprovalMessage, BLOCK_REASON };
+module.exports = { hasLink, isMockupApprovalAsk, askHasLink, isMockupApprovalMessage, BLOCK_REASON };