@opensip-tools/fitness 1.0.4

package/src/framework/__tests__/ast-utilities.test.ts

@@ -0,0 +1,157 @@
+import * as ts from 'typescript';
+import { describe, expect, it } from 'vitest';
+
+import {
+  getIdentifierName,
+  getLineNumber,
+  getPropertyChain,
+  isInStringLiteral,
+  isLiteral,
+  isPropertyAccess,
+  parseSource,
+  walkNodes,
+} from '../ast-utilities.js';
+
+const parse = (content: string) => parseSource(content, 'x.ts');
+
+describe('parseSource', () => {
+  it('parses valid TypeScript', () => {
+    expect(parse('const x = 1;')).not.toBeNull();
+  });
+
+  it('returns null on parse failure', () => {
+    expect(parseSource(undefined as unknown as string, 'x.ts')).toBeNull();
+  });
+});
+
+describe('walkNodes', () => {
+  it('visits every descendant node', () => {
+    const sf = parse('const x = 1; const y = 2;');
+    if (!sf) throw new Error('parse failed');
+    let count = 0;
+    walkNodes(sf, () => count++);
+    expect(count).toBeGreaterThan(2);
+  });
+});
+
+describe('getIdentifierName / getPropertyChain', () => {
+  it('returns identifier text', () => {
+    const sf = parse('foo;');
+    if (!sf) throw new Error('parse failed');
+    let leaf = '';
+    walkNodes(sf, (n) => {
+      if (ts.isIdentifier(n) && leaf === '') leaf = getIdentifierName(n);
+    });
+    expect(leaf).toBe('foo');
+  });
+
+  it('returns property chain', () => {
+    const sf = parse('a.b.c;');
+    if (!sf) throw new Error('parse failed');
+    let result = '';
+    walkNodes(sf, (n) => {
+      if (ts.isPropertyAccessExpression(n) && result === '') result = getPropertyChain(n);
+    });
+    expect(result).toBe('a.b.c');
+  });
+
+  it('returns empty for non-identifier non-property nodes', () => {
+    const sf = parse('1 + 2;');
+    if (!sf) throw new Error('parse failed');
+    let result = '';
+    walkNodes(sf, (n) => {
+      if (ts.isBinaryExpression(n)) {
+        result = getIdentifierName(n);
+      }
+    });
+    expect(result).toBe('');
+  });
+
+  it('getPropertyChain returns empty for non-identifier non-property', () => {
+    const sf = parse('1 + 2;');
+    if (!sf) throw new Error('parse failed');
+    let result = '';
+    walkNodes(sf, (n) => {
+      if (ts.isBinaryExpression(n) && result === '') result = getPropertyChain(n);
+    });
+    expect(result).toBe('');
+  });
+});
+
+describe('getLineNumber', () => {
+  it('returns 1-based line numbers', () => {
+    const sf = parse('\n\nconst x = 1;');
+    if (!sf) throw new Error('parse failed');
+    let line = 0;
+    walkNodes(sf, (n) => {
+      if (ts.isVariableDeclaration(n)) {
+        line = getLineNumber(n, sf);
+      }
+    });
+    expect(line).toBe(3);
+  });
+});
+
+describe('isPropertyAccess', () => {
+  it('matches the right property name', () => {
+    const sf = parse('foo.bar();');
+    if (!sf) throw new Error('parse failed');
+    let matched = false;
+    walkNodes(sf, (n) => {
+      if (ts.isPropertyAccessExpression(n) && isPropertyAccess(n, 'bar')) matched = true;
+    });
+    expect(matched).toBe(true);
+  });
+
+  it('returns false for the wrong property name', () => {
+    const sf = parse('foo.bar();');
+    if (!sf) throw new Error('parse failed');
+    let matched = false;
+    walkNodes(sf, (n) => {
+      if (ts.isPropertyAccessExpression(n) && isPropertyAccess(n, 'baz')) matched = true;
+    });
+    expect(matched).toBe(false);
+  });
+});
+
+describe('isLiteral', () => {
+  it.each([
+    ['"hi"', true],
+    ['42', true],
+    ['true', true],
+    ['false', true],
+    ['null', true],
+    ['undefined', true],
+    ['x', false],
+  ])('isLiteral(%s) === %s', (src, expected) => {
+    const sf = parse(`(${src});`);
+    if (!sf) throw new Error('parse failed');
+    let result: boolean | null = null;
+    walkNodes(sf, (n) => {
+      if (ts.isParenthesizedExpression(n) && result === null) result = isLiteral(n.expression);
+    });
+    expect(result).toBe(expected);
+  });
+});
+
+describe('isInStringLiteral', () => {
+  it('returns true for nodes inside a template', () => {
+    const sf = parse('const x = `${foo}`;');
+    if (!sf) throw new Error('parse failed');
+    let found = false;
+    walkNodes(sf, (n) => {
+      if (ts.isIdentifier(n) && n.text === 'foo' && isInStringLiteral(n)) found = true;
+    });
+    expect(found).toBe(true);
+  });
+
+  it('returns false for nodes outside any string', () => {
+    const sf = parse('const x = 1; const y = x;');
+    if (!sf) throw new Error('parse failed');
+    let found = false;
+    walkNodes(sf, (n) => {
+      if (ts.isIdentifier(n) && n.text === 'y' && !isInStringLiteral(n)) found = true;
+    });
+    expect(found).toBe(true);
+  });
+});

package/src/framework/__tests__/check-config.test.ts

@@ -0,0 +1,65 @@
+import { describe, it, expect } from 'vitest'
+
+import { validateCheckConfig } from '../check-config.js'
+
+const BASE_CONFIG = {
+  id: 'a1b2c3d4-e5f6-7890-abcd-ef1234567890',
+  slug: 'test-check',
+  description: 'A test check',
+  tags: ['quality'],
+  analyze: () => [],
+}
+
+describe('validateCheckConfig', () => {
+  it('accepts a check with tags array', () => {
+    expect(() => validateCheckConfig(BASE_CONFIG)).not.toThrow()
+  })
+
+  it('rejects a check without tags', () => {
+    const config = { ...BASE_CONFIG, tags: undefined }
+    expect(() => validateCheckConfig(config)).toThrow()
+  })
+
+  it('rejects a check with empty tags array', () => {
+    const config = { ...BASE_CONFIG, tags: [] }
+    expect(() => validateCheckConfig(config)).toThrow()
+  })
+
+  it('accepts arbitrary tag strings', () => {
+    const config = { ...BASE_CONFIG, tags: ['custom-tag', 'another-one', 'cwe-89'] }
+    expect(() => validateCheckConfig(config)).not.toThrow()
+  })
+
+  it('validates all three analysis modes with tags', () => {
+    // analyze mode
+    expect(() => validateCheckConfig({
+      ...BASE_CONFIG,
+      analyze: (_content: string) => [],
+    })).not.toThrow()
+
+    // analyzeAll mode
+    // eslint-disable-next-line sonarjs/no-unused-vars -- destructure-omit pattern: drop `analyze` from spread copy
+    const { analyze: _, ...noAnalyze } = BASE_CONFIG
+    expect(() => validateCheckConfig({
+      ...noAnalyze,
+      // eslint-disable-next-line @typescript-eslint/require-await -- arrow must match `(files: FileAccessor) => Promise<CheckViolation[]>`
+      analyzeAll: async () => [],
+    })).not.toThrow()
+
+    // command mode
+    expect(() => validateCheckConfig({
+      ...noAnalyze,
+      command: {
+        bin: 'echo',
+        args: [],
+        parseOutput: () => [],
+      },
+    })).not.toThrow()
+  })
+
+  it('rejects config without any analysis mode', () => {
+    // eslint-disable-next-line sonarjs/no-unused-vars -- destructure-omit pattern: drop `analyze` from spread copy
+    const { analyze: _, ...noMode } = BASE_CONFIG
+    expect(() => validateCheckConfig(noMode)).toThrow()
+  })
+})

package/src/framework/__tests__/command-executor.test.ts

@@ -0,0 +1,79 @@
+import { describe, expect, it } from 'vitest';
+
+import { executeCommand } from '../command-executor.js';
+
+import type { CommandConfig } from '../check-config.js';
+
+const cwd = process.cwd();
+
+describe('executeCommand', () => {
+  it('runs a command with array args and parses stdout', async () => {
+    const config: CommandConfig = {
+      bin: 'echo',
+      args: ['hello'],
+      parseOutput: (stdout) => [{
+        line: 1,
+        message: stdout.trim(),
+        severity: 'warning',
+      }],
+    };
+    const result = await executeCommand(config, [], { cwd });
+    expect(result.aborted).toBe(false);
+    expect(result.exitCode).toBe(0);
+    expect(result.violations).toHaveLength(1);
+    expect(result.violations[0]?.message).toBe('hello');
+  });
+
+  it('runs a command with function args derived from files', async () => {
+    const config: CommandConfig = {
+      bin: 'echo',
+      args: (files) => [`got-${files.length}`],
+      parseOutput: (stdout) => [{
+        line: 1,
+        message: stdout.trim(),
+        severity: 'warning',
+      }],
+    };
+    const result = await executeCommand(config, ['a', 'b', 'c'], { cwd });
+    expect(result.violations[0]?.message).toBe('got-3');
+  });
+
+  it('returns an error when the bin is not installed (ENOENT)', async () => {
+    const config: CommandConfig = {
+      bin: 'definitely-not-a-real-binary-xyz123',
+      args: [],
+      parseOutput: () => [],
+    };
+    const result = await executeCommand(config, [], { cwd });
+    expect(result.error).toContain('not installed');
+    expect(result.violations).toEqual([]);
+  });
+
+  it('returns an error when exit code is unexpected', async () => {
+    const config: CommandConfig = {
+      bin: 'sh',
+      args: ['-c', 'exit 5'],
+      parseOutput: () => [],
+      expectedExitCodes: [0],
+    };
+    const result = await executeCommand(config, [], { cwd });
+    expect(result.error).toContain('unexpected code 5');
+    expect(result.violations).toEqual([]);
+  });
+
+  it('honors expectedExitCodes when set', async () => {
+    const config: CommandConfig = {
+      bin: 'sh',
+      args: ['-c', 'echo done; exit 1'],
+      parseOutput: (stdout) => [{
+        line: 1,
+        message: stdout.trim(),
+        severity: 'warning',
+      }],
+      expectedExitCodes: [0, 1],
+    };
+    const result = await executeCommand(config, [], { cwd });
+    expect(result.violations).toHaveLength(1);
+    expect(result.exitCode).toBe(1);
+  });
+});

package/src/framework/__tests__/content-filter-dispatch.test.ts

@@ -0,0 +1,132 @@
+/**
+ * @fileoverview Pin the contentFilter dispatch in define-check.ts and
+ * file-accessor.ts. Two modes are intentional and distinct:
+ *
+ *   - `strip-strings`             → strings blanked, COMMENTS PRESERVED.
+ *                                   Use when a rule reads comment markers
+ *                                   (e.g. `// @swallow-ok`).
+ *   - `strip-strings-and-comments` → both blanked. Use when the same
+ *                                    forbidden phrase could appear in a
+ *                                    comment and would false-fire.
+ *
+ * Mixing them was the bug behind a 2026-05-05 mis-fix that mapped both
+ * modes to codeNoComments, breaking every rule that scans comments for
+ * directives. This test pins the contract.
+ *
+ * The legacy `'code-only'` / `'no-strings-no-comments'` aliases were
+ * removed in 0.5.0; this file used to assert the alias mapping and now
+ * just asserts the canonical names.
+ */
+import { mkdtemp, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+
+import { defaultLanguageRegistry } from '@opensip-tools/core'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+
+import { filterContent } from '../content-filter.js'
+import { createFileAccessor } from '../file-accessor.js'
+
+import type { LanguageAdapter } from '@opensip-tools/core'
+
+// FileAccessor.read dispatches strip via the registered LanguageAdapter
+// for the file's extension. Register a minimal TS adapter for the test
+// scope so the dispatch resolves and the existing core filterContent
+// implementation produces the expected output. Lang packages live in
+// their own workspaces and core can't depend on @opensip-tools/lang-typescript
+// directly without creating a cycle.
+const inProcessTypescriptAdapter: LanguageAdapter = {
+  id: 'typescript-test-shim',
+  fileExtensions: ['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs'],
+  parse: () => null,
+  stripStrings: (s) => filterContent(s).code,
+  stripComments: (s) => filterContent(s).codeNoComments,
+}
+
+beforeAll(() => {
+  defaultLanguageRegistry.register(inProcessTypescriptAdapter)
+})
+
+afterAll(() => {
+  defaultLanguageRegistry.clear()
+})
+
+async function writeTempFile(content: string): Promise<string> {
+  const dir = await mkdtemp(join(tmpdir(), 'cf-dispatch-'))
+  const filePath = join(dir, 'sample.ts')
+  await writeFile(filePath, content, 'utf8')
+  return filePath
+}
+
+describe('FileAccessor contentFilter dispatch', () => {
+  describe('strip-strings — strings blanked, comments preserved', () => {
+    it('preserves line-comment text so rules can scan markers', async () => {
+      const filePath = await writeTempFile(
+        `const a = 1\n// @swallow-ok intentional fallthrough\nconst b = 2`,
+      )
+      const accessor = createFileAccessor([filePath], { contentFilter: 'strip-strings' })
+      const content = await accessor.read(filePath)
+
+      expect(content).toContain('@swallow-ok')
+      expect(content).toContain('const a = 1')
+      expect(content).toContain('const b = 2')
+    })
+
+    it('preserves block-comment text including JSDoc directives', async () => {
+      const filePath = await writeTempFile(
+        `/** @deprecated use Y instead */\nexport function legacy() {}`,
+      )
+      const accessor = createFileAccessor([filePath], { contentFilter: 'strip-strings' })
+      const content = await accessor.read(filePath)
+
+      expect(content).toContain('@deprecated')
+      expect(content).toContain('export function legacy')
+    })
+
+    it('blanks string-literal contents', async () => {
+      const filePath = await writeTempFile(`const url = 'phrase_in_string'`)
+      const accessor = createFileAccessor([filePath], { contentFilter: 'strip-strings' })
+      const content = await accessor.read(filePath)
+
+      expect(content).not.toContain('phrase_in_string')
+      expect(content).toContain('const url = ')
+    })
+  })
+
+  describe('strip-strings-and-comments — both blanked', () => {
+    it('blanks comment text so rules don\'t false-fire on prose', async () => {
+      const filePath = await writeTempFile(
+        `const a = 1\n// forbidden_phrase_in_comment\nconst b = 2`,
+      )
+      const accessor = createFileAccessor([filePath], { contentFilter: 'strip-strings-and-comments' })
+      const content = await accessor.read(filePath)
+
+      expect(content).not.toContain('forbidden_phrase_in_comment')
+      expect(content).toContain('const a = 1')
+      expect(content).toContain('const b = 2')
+    })
+
+    it('blanks both strings and comments in the same content', async () => {
+      const filePath = await writeTempFile(
+        `const url = 'phrase_in_string' // phrase_in_comment`,
+      )
+      const accessor = createFileAccessor([filePath], { contentFilter: 'strip-strings-and-comments' })
+      const content = await accessor.read(filePath)
+
+      expect(content).not.toContain('phrase_in_string')
+      expect(content).not.toContain('phrase_in_comment')
+    })
+  })
+
+  describe('default (raw) — no filter applied', () => {
+    it('preserves both strings and comments verbatim', async () => {
+      const src = `const url = 'phrase'\n// also phrase`
+      const filePath = await writeTempFile(src)
+      const accessor = createFileAccessor([filePath]) // no contentFilter → raw passthrough
+      const content = await accessor.read(filePath)
+
+      expect(content).toBe(src)
+    })
+  })
+})

package/src/framework/__tests__/content-filter.test.ts

@@ -0,0 +1,136 @@
+import { describe, expect, it } from 'vitest'
+
+import { clearFilterCache, filterContent } from '../content-filter.js'
+
+describe('filterContent', () => {
+  describe('string and comment masking', () => {
+    it('replaces string-literal content with spaces but preserves length', () => {
+      clearFilterCache()
+      const src = `const x = 'hello'`
+      const { code } = filterContent(src)
+      expect(code.length).toBe(src.length)
+      expect(code).toBe(`const x = '     '`)
+    })
+
+    it('preserves comment content verbatim (comments tracked, not masked)', () => {
+      clearFilterCache()
+      const src = `const x = 1 // loadConfig() mentioned here\nconst y = 2`
+      const { code } = filterContent(src)
+      // Line comments are left intact — directives live in comments
+      expect(code).toContain('loadConfig() mentioned here')
+    })
+  })
+
+  describe('template literals', () => {
+    it('masks simple template body text', () => {
+      clearFilterCache()
+      const src = `const x = \`hello world\``
+      const { code } = filterContent(src)
+      expect(code).toBe(`const x = \`           \``)
+    })
+
+    it('masks template-head and template-tail text, preserves expressions', () => {
+      clearFilterCache()
+      const src = `const x = \`pre \${value} post\``
+      const { code } = filterContent(src)
+      // Expression `value` is code — preserved. Text around `${ ... }` is masked.
+      expect(code).toContain('value')
+      expect(code).not.toContain('pre ')
+      expect(code).not.toContain(' post')
+    })
+
+    // Regression: nested templates inside `${...}` expressions used to desync the
+    // scanner state (a plain `inTemplate` boolean flipped off by the inner
+    // TemplateTail left the outer's CloseBrace unrescanned, which caused every
+    // token after the inner template to be misinterpreted as part of a string).
+    // The symptom was that real code — `loadConfig(process.cwd())`, type
+    // annotations, anything — below the nested template got wiped to whitespace
+    // silently, producing false negatives in every `contentFilter: 'strip-strings'`
+    // check that scanned the affected file. Fix replaced the boolean with a
+    // depth counter; this test keeps it fixed.
+    it('handles nested templates inside ${} expressions — code below is preserved', () => {
+      clearFilterCache()
+      const src = [
+        'const lines = items.map(f => `- ${sanitize(f)}`).join("\\n")',
+        'const after = loadConfig(process.cwd())',
+        'export function helper(cfg: ReturnType<typeof loadConfig>): string { return "" }',
+      ].join('\n')
+      const { code } = filterContent(src)
+      // The nested template's inner text `- ` should be masked, but sanitize(f),
+      // the .map/.join chain, and everything below must survive intact.
+      expect(code).toContain('sanitize(f)')
+      expect(code).toContain('loadConfig(process.cwd())')
+      expect(code).toContain('ReturnType<typeof loadConfig>')
+    })
+
+    it('handles doubly-nested templates', () => {
+      clearFilterCache()
+      const src = [
+        'const s = `a ${`b ${c}`} d`',
+        'const survives = loadConfig(process.cwd())',
+      ].join('\n')
+      const { code } = filterContent(src)
+      expect(code).toContain('survives')
+      expect(code).toContain('loadConfig(process.cwd())')
+      // The identifier `c` inside the innermost expression is code and must survive
+      expect(code).toContain('${c}')
+    })
+  })
+
+  describe('codeNoComments — strings AND comments masked', () => {
+    it('masks line comments while preserving line/column offsets', () => {
+      clearFilterCache()
+      const src = `const x = 1 // calls getDatabase() somewhere\nconst y = 2`
+      const { code, codeNoComments } = filterContent(src)
+      // `code` (strings-only) leaves the line comment intact
+      expect(code).toContain('getDatabase()')
+      // `codeNoComments` masks the comment text but keeps length
+      expect(codeNoComments.length).toBe(src.length)
+      expect(codeNoComments).not.toContain('getDatabase')
+      // Code BEFORE the comment survives
+      expect(codeNoComments).toContain('const x = 1')
+      // Newlines are preserved so line numbers stay accurate
+      expect(codeNoComments.split('\n')).toHaveLength(2)
+      expect(codeNoComments.split('\n')[1]).toBe('const y = 2')
+    })
+
+    it('masks block / JSDoc comments across multiple lines', () => {
+      clearFilterCache()
+      const src = [
+        '/**',
+        ' * Replace getDatabase() with the constructor StoreDeps.',
+        ' * The check guards against process-wide tenant accessors.',
+        ' */',
+        'export class TicketStore {}',
+      ].join('\n')
+      const { codeNoComments } = filterContent(src)
+      expect(codeNoComments).not.toContain('getDatabase')
+      expect(codeNoComments).not.toContain('StoreDeps')
+      expect(codeNoComments).not.toContain('process-wide')
+      // Code AFTER the JSDoc survives
+      expect(codeNoComments).toContain('export class TicketStore')
+      // Line count preserved
+      expect(codeNoComments.split('\n')).toHaveLength(5)
+    })
+
+    it('masks both strings and comments in the same content', () => {
+      clearFilterCache()
+      const src = `const url = 'https://api.example.com' // call openai.messages.create() here`
+      const { codeNoComments } = filterContent(src)
+      expect(codeNoComments).not.toContain('https')
+      expect(codeNoComments).not.toContain('messages.create')
+      expect(codeNoComments).toContain('const url = ')
+    })
+
+    it('does not strip comments when only `code` is requested', () => {
+      // Regression guard: codeNoComments is a sibling field, not a replacement.
+      // `code` must continue to leave comments intact (some checks scan
+      // comments for `@deprecated` / `@fitness-ignore` directives).
+      clearFilterCache()
+      const src = `const x = 1 // @deprecated — use Y instead`
+      const { code, codeNoComments } = filterContent(src)
+      expect(code).toContain('@deprecated')
+      expect(codeNoComments).not.toContain('@deprecated')
+    })
+  })
+})