@marcomigozzi/trailhead 0.13.0 → 0.15.0

package/plugins/trailhead/hooks/trailhead-mockup-link-guard.test.js

@@ -10,6 +10,8 @@ const {
   isMockupApprovalAsk,
   hasLink,
   proseBeforeAsk,
+  pendingAskIndex,
+  askHasLink,
 } = require('./trailhead-mockup-link-guard.js');
 
 const HOOK = path.join(__dirname, 'trailhead-mockup-link-guard.js');
@@ -20,7 +22,7 @@ const ok = (name, cond) => { assert.ok(cond, name); passed++; };
 // Costruttori di righe transcript (stesso shape JSONL di Claude Code)
 const text = (t) => ({ type: 'assistant', isSidechain: false, message: { content: [{ type: 'text', text: t }] } });
 const thinking = () => ({ type: 'assistant', isSidechain: false, message: { content: [{ type: 'thinking', thinking: '' }] } });
-const toolUse = (name, input = {}) => ({ type: 'assistant', isSidechain: false, message: { content: [{ type: 'tool_use', id: 'x', name, input }] } });
+const toolUse = (name, input = {}, id = 'x') => ({ type: 'assistant', isSidechain: false, message: { content: [{ type: 'tool_use', id, name, input }] } });
 const toolResult = (c) => ({ type: 'user', isSidechain: false, message: { content: [{ type: 'tool_result', tool_use_id: 'x', content: c }] } });
 const userPrompt = (c) => ({ type: 'user', isSidechain: false, message: { content: c } });
 
@@ -103,8 +105,45 @@ const sidechain = [
 ];
 ok('sidechain text is ignored', !hasLink(proseBeforeAsk(sidechain)));
 
-const noAskYet = [userPrompt('x'), text('Ecco https://a.b/c')];
-ok('works when the pending tool_use is not yet in the transcript', hasLink(proseBeforeAsk(noAskYet)));
+// Senza ancora: comportamento storico, si parte dalla coda del transcript
+const noAnchor = [userPrompt('x'), text('Ecco https://a.b/c')];
+ok('without an anchor the prose is read from the transcript tail', hasLink(proseBeforeAsk(noAnchor)));
+
+// Con ancora: si parte dall'ask trovato, non dalla coda
+const anchored = [
+  userPrompt('x'),
+  text('Mockup: https://a.b/c'),
+  toolUse('AskUserQuestion', approvalInput, 'ask1'),
+  toolResult('Approvo'),
+  text('Altro testo senza link'),
+];
+ok('with an anchor the prose is read back from the anchored ask', hasLink(proseBeforeAsk(anchored, 2)));
+
+// --- askHasLink ---
+const askWith = (over) => ({ questions: [{ ...approvalInput.questions[0], ...over }] });
+ok('link in the approval question counts', askHasLink(askWith({ question: 'Approvi il mockup https://claude.ai/artifact/AbC123?' })));
+ok('link in the approval header counts', askHasLink(askWith({ header: 'https://claude.ai/artifact/AbC123' })));
+ok('link in an approval option label counts', askHasLink(askWith({ options: [{ label: 'Apri https://a.b/c' }, { label: 'No' }] })));
+ok('link in an approval option description counts', askHasLink(askWith({ options: [{ label: 'Approvo', description: 'vedi mockups/faq.html' }] })));
+ok('approval ask without any link has none', !askHasLink(approvalInput));
+ok('link only in a different non-approval question does not count', !askHasLink({
+  questions: [
+    { question: 'Dove sta il piano?', options: [{ label: 'https://a.b/piano' }] },
+    approvalInput.questions[0],
+  ],
+}));
+ok('malformed input has no ask link', !askHasLink({}) && !askHasLink(null));
+
+// --- pendingAskIndex ---
+const withIds = [userPrompt('x'), toolUse('Bash', {}, 'b1'), toolResult('ok'), text('Prosa'), toolUse('AskUserQuestion', approvalInput, 'ask1')];
+ok('pendingAskIndex finds the entry by tool_use id', pendingAskIndex(withIds, 'ask1', approvalInput) === 4);
+ok('pendingAskIndex by id ignores a missing id', pendingAskIndex(withIds, 'nope', approvalInput) === -1);
+ok('pendingAskIndex without id falls back to input equality on the tail', pendingAskIndex(withIds, undefined, approvalInput) === 4);
+ok('pendingAskIndex without id is -1 when the tail ask has a different input',
+  pendingAskIndex(withIds, undefined, askWith({ question: 'Approvi il mockup B?' })) === -1);
+ok('pendingAskIndex is -1 when the tail is the previous tool_result',
+  pendingAskIndex([userPrompt('x'), toolUse('Bash', {}, 'b1'), toolResult('ok')], undefined, approvalInput) === -1);
+ok('pendingAskIndex ignores sidechain entries', pendingAskIndex([{ ...toolUse('AskUserQuestion', approvalInput, 'ask1'), isSidechain: true }], 'ask1', approvalInput) === -1);
 
 // --- end-to-end ---
 function writeTranscript(entries) {
@@ -138,6 +177,39 @@ ok('other tools are ignored', r4.code === 0);
 const r5 = runHook({ tool_name: 'AskUserQuestion', tool_input: { questions: [{ question: 'Approvi il piano?', options: [] }] }, transcript_path: writeTranscript(failing) });
 ok('non-mockup ask is allowed', r5.code === 0);
 
+// Shape reale di Claude Code 2.1.295: il messaggio corrente non e' ancora nel transcript
+const unflushed = [userPrompt('lavora #12'), toolUse('Bash', {}, 'b1'), toolResult('ok')];
+const ra = runHook({ tool_name: 'AskUserQuestion', tool_use_id: 'ask1', tool_input: approvalInput, transcript_path: writeTranscript(unflushed) });
+ok('(a) transcript ending at a previous tool_result fails open', ra.code === 0 && ra.out.trim() === '');
+
+const flushedNoLink = [...failing.slice(0, 5), toolUse('AskUserQuestion', approvalInput, 'ask1')];
+const rb = runHook({ tool_name: 'AskUserQuestion', tool_use_id: 'ask1', tool_input: approvalInput, transcript_path: writeTranscript(flushedNoLink) });
+ok('(b) tool_use_id with the ask entry present and no link in the prose is blocked', rb.code === 2 && /MOCKUP_LINK_MISSING/.test(rb.out));
+
+const linkedAsk = askWith({ question: 'Approvi il mockup https://claude.ai/artifact/AbC123?' });
+const rc = runHook({ tool_name: 'AskUserQuestion', tool_use_id: 'ask1', tool_input: linkedAsk, transcript_path: writeTranscript(failing) });
+ok('(c) link carried by the ask question is allowed', rc.code === 0 && rc.out.trim() === '');
+
+const otherPending = [userPrompt('x'), text('Niente link'), toolUse('AskUserQuestion', { questions: [{ question: 'Altro?', options: [] }] }, 'other')];
+const rd = runHook({ tool_name: 'AskUserQuestion', tool_use_id: 'ask1', tool_input: approvalInput, transcript_path: writeTranscript(otherPending) });
+ok('(d) transcript ending in a different pending ask fails open', rd.code === 0 && rd.out.trim() === '');
+
+// Testo e tool_use nella STESSA riga di transcript
+const sameEntry = (t) => ({ type: 'assistant', isSidechain: false, message: { content: [{ type: 'text', text: t }, { type: 'tool_use', id: 'ask1', name: 'AskUserQuestion', input: approvalInput }] } });
+ok('text before the tool_use in the same entry counts as prose', hasLink(proseBeforeAsk([userPrompt('x'), sameEntry('Vedi https://a.b/c')], 1)));
+ok('same-entry text is also read from the tail', hasLink(proseBeforeAsk([userPrompt('x'), sameEntry('Vedi https://a.b/c')])));
+const rs1 = runHook({ tool_name: 'AskUserQuestion', tool_use_id: 'ask1', tool_input: approvalInput, transcript_path: writeTranscript([userPrompt('x'), sameEntry('Vedi https://a.b/c')]) });
+ok('same-entry text with a link is allowed', rs1.code === 0 && rs1.out.trim() === '');
+const rs2 = runHook({ tool_name: 'AskUserQuestion', tool_use_id: 'ask1', tool_input: approvalInput, transcript_path: writeTranscript([userPrompt('x'), sameEntry('Mockup pronto su MyApp')]) });
+ok('same-entry text without a link is blocked', rs2.code === 2 && /MOCKUP_LINK_MISSING/.test(rs2.out));
+
+// Senza tool_use_id: ask in coda identico a tool_input (fallback per uguaglianza)
+const ri1 = runHook({ tool_name: 'AskUserQuestion', tool_input: approvalInput, transcript_path: writeTranscript(flushedNoLink) });
+ok('no id, identical tail ask, no link in the prose is blocked', ri1.code === 2 && /MOCKUP_LINK_MISSING/.test(ri1.out));
+const flushedLink = [...failing.slice(0, 4), text('Mockup: https://claude.ai/artifact/AbC123xyz'), toolUse('AskUserQuestion', approvalInput, 'ask1')];
+const ri2 = runHook({ tool_name: 'AskUserQuestion', tool_input: approvalInput, transcript_path: writeTranscript(flushedLink) });
+ok('no id, identical tail ask, link in the prose is allowed', ri2.code === 0 && ri2.out.trim() === '');
+
 let r6;
 try { execFileSync('node', [HOOK], { input: 'not json' }); r6 = 0; } catch (e) { r6 = e.status; }
 ok('unparseable input fails open', r6 === 0);

package/plugins/trailhead/hooks/trailhead-search-guard.js

@@ -24,6 +24,21 @@
 // cannot see. Blocking a lone `cd` would be far too aggressive (a legitimate,
 // common shape) so it is deliberately left to the prose directive.
 //
+// Redirections are not reads of a relative path: before a verb's args are
+// walked, output redirections (`>`, `>>`, `2>`, `&>`, glued or with a separate
+// target), fd duplications (`2>&1`) and heredoc/herestring introducers are
+// dropped together with their target, so `cat /abs/a > out.txt` or
+// `tail /abs/log 2>/dev/null` are not reported. An input redirection `< f` IS a
+// read: only the operator is dropped and `f` stays in the arg list, so
+// `cd app && cat < rel.txt` still blocks while `wc -l < /abs/a` passes.
+//
+// cwd exemption: when the hook payload carries the session `cwd` (absolute), a
+// joined `cd X`/`pushd X` whose literal target resolves to exactly that cwd is
+// a no-op, so it does not make later relative reads non-static. Dynamic or
+// special targets (`$VAR`, backticks, `~`, `-`, a bare `cd`) always count as a
+// directory change, and an unknown cwd behaves as before. The exemption only
+// avoids ARMING: once a real cd has armed the guard, nothing disarms it.
+//
 // Blocks with exit 2 + {"decision":"block","code":...,"reason":...}; allows
 // everything else. Crash-safe: any error -> exit 0 (never wedge the user's
 // workflow). Self-contained (its own dependency is the sibling lib/ module,
@@ -36,12 +51,14 @@
 // machinery (SEARCH_VERB_CONFIG, scanArgsSkippingPattern) are shared with
 // trailhead-secret-read-guard.js via lib/shell-scan.js (#135 follow-up), so
 // the two guards can never drift into two divergent tokenizers.
+const path = require('path');
 const {
   basename,
   stripQuotes,
   splitStatements,
   tokenize,
   skipEnvPrefix,
+  stripRedirections,
   SEARCH_VERB_CONFIG,
   scanArgsSkippingPattern,
 } = require('./lib/shell-scan.js');
@@ -114,7 +131,7 @@ const VERB_CONFIG = {
 // Walk a verb's argument tokens (verb itself already stripped) for the first
 // relative FILE argument found, via the shared pattern/flag-skipping walker.
 function scanArgsForRelativeFile(args, config) {
-  return scanArgsSkippingPattern(args, config, isRelativeFileArg);
+  return scanArgsSkippingPattern(stripRedirections(args), config, isRelativeFileArg);
 }
 
 // `git grep`/`git log`/`git show`/`git diff` WITHOUT a `-C` (or --work-tree):
@@ -177,6 +194,22 @@ function isCdOrPushdStatement(stmt) {
   return bin === 'cd' || bin === 'pushd';
 }
 
+// Does this cd/pushd statement provably stay in the session cwd? Only with a
+// known absolute cwd and exactly one static literal target resolving to it.
+function cdTargetsSessionCwd(stmt, cwd) {
+  if (typeof cwd !== 'string' || !path.isAbsolute(cwd)) return false;
+  const tokens = normalizeStatementTokens(tokenize(stmt));
+  let i = skipEnvPrefix(tokens) + 1; // past cd/pushd
+  while (i < tokens.length && tokens[i].startsWith('-') && tokens[i] !== '-') {
+    if (tokens[i++] === '--') break; // option flags (-P/-L/--) before the target
+  }
+  if (i !== tokens.length - 1) return false; // bare cd goes to $HOME; extra targets are unsure
+  const target = stripQuotes(tokens[i]);
+  if (!target || target === '-' || target.startsWith('~')) return false;
+  if (target.includes('$') || target.includes('`')) return false;
+  return path.resolve(cwd, target) === path.resolve(cwd);
+}
+
 // `env -C <dir> <cmd> …`: the directory change and the read live in the SAME
 // statement (env execs its argument as a single command with that cwd), so
 // this is checked independently of the cross-statement `cwdChanged` flag.
@@ -215,7 +248,7 @@ function envDashCRelativeRead(stmt) {
 // with no path argument at all implicitly searches the (now-relative) cwd,
 // but adding that case risks false-positiving on legitimate stdin-reading
 // commands, so it is left to the prose directive.
-function detectSearchHygieneViolation(cmd) {
+function detectSearchHygieneViolation(cmd, { cwd } = {}) {
   const statements = splitStatements(cmd);
   let cwdChanged = false;
   for (let idx = 0; idx < statements.length; idx++) {
@@ -233,35 +266,48 @@ function detectSearchHygieneViolation(cmd) {
     // the sole statement) - a lone standalone `cd` is the known limitation
     // above and must never be blocked here.
     if (isCdOrPushdStatement(stmt) && idx < statements.length - 1) {
-      cwdChanged = true;
+      if (!cdTargetsSessionCwd(stmt, cwd)) cwdChanged = true;
     }
   }
   return null;
 }
 
-function block(hit) {
+function blockVerdict(hit) {
   const reason =
     "trailhead search-hygiene: a 'cd <dir>' (or pushd/env -C) followed by a relative " +
     `${hit.verb} read (\`${hit.file}\`) makes the read target non-static, which trips the ` +
     'Read() deny rule under bypass permissions (prompting for manual approval instead of ' +
     'running headless). Pass explicit paths instead and never cd first: ' +
     'grep -niE "<patterns>" <abs>/<file>, git -C <abs> ..., or use the Grep/Read tools.';
-  process.stdout.write(JSON.stringify({ decision: 'block', code: 'SEARCH_HYGIENE_VIOLATION', reason }));
-  process.exit(2);
+  return { kind: 'block', payload: { decision: 'block', code: 'SEARCH_HYGIENE_VIOLATION', reason } };
+}
+
+// Pure verdict for one command: {kind:'allow'} or {kind:'block', payload}. Never
+// exits or writes; any internal error falls through to allow.
+function evaluate(cmd, { cwd } = {}) {
+  try {
+    const hit = detectSearchHygieneViolation(cmd, { cwd });
+    if (hit) return blockVerdict(hit);
+  } catch {
+    // fall through to allow: a guard must never wedge the workflow
+  }
+  return { kind: 'allow' };
 }
 
 function run(data) {
   let cmd = '';
+  let cwd;
   try {
-    cmd = (JSON.parse(data).tool_input || {}).command || '';
+    const input = JSON.parse(data);
+    cmd = (input.tool_input || {}).command || '';
+    cwd = typeof input.cwd === 'string' && input.cwd ? input.cwd : undefined;
   } catch {
     process.exit(0); // unparseable input: nothing to gate
   }
-  try {
-    const hit = detectSearchHygieneViolation(cmd);
-    if (hit) block(hit);
-  } catch {
-    // fall through to allow: a guard must never wedge the workflow
+  const v = evaluate(cmd, { cwd });
+  if (v.kind === 'block') {
+    process.stdout.write(JSON.stringify(v.payload));
+    process.exit(2);
   }
   process.exit(0);
 }
@@ -276,4 +322,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { detectSearchHygieneViolation };
+module.exports = { detectSearchHygieneViolation, evaluate };

package/plugins/trailhead/hooks/trailhead-search-guard.test.js

@@ -5,14 +5,17 @@ const assert = require('assert');
 const { execFileSync } = require('child_process');
 const path = require('path');
 
-const HOOK = path.join(__dirname, 'trailhead-search-guard.js');
+// TRAILHEAD_GUARD_HOOK re-runs this suite through the merged trailhead-bash-guards.js.
+const HOOK = process.env.TRAILHEAD_GUARD_HOOK || path.join(__dirname, 'trailhead-search-guard.js');
 
 let passed = 0;
 const ok = (name, cond) => { assert.ok(cond, name); passed++; };
 
 // Run the hook end-to-end: pipe tool_input JSON on stdin, capture {code, out}.
-function runHook(command) {
-  const input = JSON.stringify({ tool_input: { command } });
+function runHook(command, cwd) {
+  const payload = { tool_input: { command } };
+  if (cwd !== undefined) payload.cwd = cwd; // optional top-level session cwd
+  const input = JSON.stringify(payload);
   try {
     const out = execFileSync('node', [HOOK], { input });
     return { code: 0, out: out.toString() };
@@ -113,4 +116,66 @@ ok('cd + grep -- -x <relative file> is blocked (exit 2), `--` must not eat the f
 const f1 = runHook('cd app && rg -g "*.js" TODO src/foo.js');
 ok('cd + rg -g <glob> <pattern> <relative file> reports the real file, not the pattern (exit 2)', f1.code === 2 && /search-hygiene/.test(f1.out) && /src\/foo\.js/.test(f1.out) && !/`TODO`/.test(f1.out));
 
+
+// --- #238: redirections are not relative reads; a cd to the session cwd is static ---
+const blocked = (r) => r.code === 2 && /search-hygiene/.test(r.out);
+const allowed = (r) => r.code === 0 && r.out.trim() === '';
+
+for (const [name, cmd] of [
+  ['heredoc-fed cat > abs', 'cd /x && cat > /abs/file <<EOF\nhi\nEOF'],
+  ['append redirect target', 'cd /x && cat /abs/a >> out.txt'],
+  ['output redirect target', 'cd /x && cat /abs/a > out.txt'],
+  ['glued 2>/dev/null', 'cd /x && tail -5 /abs/log 2>/dev/null'],
+  ['separate 2> target', 'cd /x && tail -5 /abs/log 2> err.log'],
+  ['&> target', 'cd /x && cat /abs/a &> out.txt'],
+  ['2>&1 duplication', 'cd /x && cat /abs/a 2>&1'],
+  ['absolute input redirect', 'cd /x && wc -l < /abs/a'],
+  ['grep with 2>/dev/null', 'cd /x && grep -n foo /abs/a 2>/dev/null'],
+  ['herestring', 'cd /x && cat <<<hello'],
+]) ok(`#238 allow: ${name}`, allowed(runHook(cmd)));
+
+for (const [name, cmd, file] of [
+  ['input redirect from relative file', 'cd app && cat < rel.txt', 'rel.txt'],
+  ['relative read before output redirect', 'cd app && cat rel.txt > /abs/out', 'rel.txt'],
+  ['relative read before 2>/dev/null', 'cd app && tail -5 rel.log 2>/dev/null', 'rel.log'],
+  ['relative read before 2>&1', 'cd app && grep -n x rel.txt 2>&1', 'rel.txt'],
+]) {
+  const r = runHook(cmd);
+  ok(`#238 block: ${name}`, blocked(r) && r.out.includes('`' + file + '`'));
+}
+
+const CWD = '/home/u/p';
+for (const [name, cmd] of [
+  ['cd to session cwd', 'cd /home/u/p && cat rel.txt'],
+  ['cd to session cwd with trailing slash', 'cd /home/u/p/ && grep -n x rel.txt'],
+  ['cd .', 'cd . && cat rel.txt'],
+]) ok(`#238 allow with cwd: ${name}`, allowed(runHook(cmd, CWD)));
+
+for (const [name, cmd] of [
+  ['cd elsewhere', 'cd /home/u/other && cat rel.txt'],
+  ['cd relative subdir', 'cd sub && cat rel.txt'],
+  ['cd $HOME', 'cd $HOME && cat rel.txt'],
+  ['cd ~', 'cd ~ && cat rel.txt'],
+  ['cd -', 'cd - && cat rel.txt'],
+]) ok(`#238 block with cwd: ${name}`, blocked(runHook(cmd, CWD)));
+ok('#238 block: cd to would-be cwd without payload cwd', blocked(runHook('cd /home/u/p && cat rel.txt')));
+
+// pure unit checks on the exported detector
+const { detectSearchHygieneViolation } = require('./trailhead-search-guard.js');
+ok('#238 unit: cd <cwd> is static when cwd is known',
+  detectSearchHygieneViolation('cd "/home/u/p" && cat rel.txt', { cwd: CWD }) === null);
+ok('#238 unit: cd <cwd> still violates when cwd unknown',
+  detectSearchHygieneViolation('cd /home/u/p && cat rel.txt').file === 'rel.txt');
+ok('#238 unit: relative cd after a real cd stays armed',
+  detectSearchHygieneViolation('cd sub && cd . && cat rel.txt', { cwd: CWD }).file === 'rel.txt');
+// once armed by a real cd, nothing disarms: a cd to the session cwd only avoids arming
+for (const cmd of [
+  'cd sub || cd /home/u/p && cat rel.txt',
+  'cd sub && (cd /home/u/p) && cat rel.txt',
+  'cd sub && cd /home/u/p && cat rel.txt',
+]) ok(`#238 unit: stays armed: ${cmd}`, detectSearchHygieneViolation(cmd, { cwd: CWD }).file === 'rel.txt');
+ok('#238 unit: cd with an extra target is not a no-op',
+  detectSearchHygieneViolation('cd /home/u/p /other && cat rel.txt', { cwd: CWD }).file === 'rel.txt');
+ok('#238 allow: separate-token >& target', allowed(runHook('cd app && cat /abs/a >& out.txt')));
+
 console.log(`✓ search-guard: ${passed} assertions passed`);