npm - @principles/pd-cli - Versions diffs - 1.134.0 → 1.135.1 - Mend

@principles/pd-cli 1.134.0 → 1.135.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (54) hide show

package/dist/commands/console.d.ts.map +1 -1
package/dist/commands/console.js +2 -0
package/dist/commands/console.js.map +1 -1
package/dist/commands/legacy-cleanup.d.ts.map +1 -1
package/dist/commands/legacy-cleanup.js +19 -2
package/dist/commands/legacy-cleanup.js.map +1 -1
package/dist/commands/pain-evidence.d.ts +3 -1
package/dist/commands/pain-evidence.d.ts.map +1 -1
package/dist/commands/pain-evidence.js +12 -3
package/dist/commands/pain-evidence.js.map +1 -1
package/dist/commands/rulecode.d.ts +13 -0
package/dist/commands/rulecode.d.ts.map +1 -1
package/dist/commands/rulecode.js +23 -2
package/dist/commands/rulecode.js.map +1 -1
package/dist/resolve-workspace.d.ts.map +1 -1
package/dist/resolve-workspace.js +33 -12
package/dist/resolve-workspace.js.map +1 -1
package/dist/services/console-launcher.d.ts +14 -1
package/dist/services/console-launcher.d.ts.map +1 -1
package/dist/services/console-launcher.js +45 -3
package/dist/services/console-launcher.js.map +1 -1
package/dist/services/pd-config-loader.d.ts.map +1 -1
package/dist/services/pd-config-loader.js +34 -1
package/dist/services/pd-config-loader.js.map +1 -1
package/dist/services/quality-scorecard/strong-model-gate.d.ts +19 -0
package/dist/services/quality-scorecard/strong-model-gate.d.ts.map +1 -1
package/dist/services/quality-scorecard/strong-model-gate.js +44 -2
package/dist/services/quality-scorecard/strong-model-gate.js.map +1 -1
package/dist/utils/path-security.d.ts +60 -0
package/dist/utils/path-security.d.ts.map +1 -0
package/dist/utils/path-security.js +90 -0
package/dist/utils/path-security.js.map +1 -0
package/package.json +1 -1
package/src/commands/console.ts +1 -0
package/src/commands/legacy-cleanup.ts +19 -2
package/src/commands/pain-evidence.ts +11 -3
package/src/commands/rulecode.ts +25 -2
package/src/resolve-workspace.ts +41 -17
package/src/services/console-launcher.ts +51 -3
package/src/services/pd-config-loader.ts +35 -1
package/src/services/quality-scorecard/strong-model-gate.ts +44 -2
package/src/utils/path-security.ts +96 -0
package/tests/commands/console-open.test.ts +213 -35
package/tests/commands/legacy-cleanup.test.ts +148 -0
package/tests/commands/pain-evidence.test.ts +37 -0
package/tests/commands/pri-393-runtime-config-unification.test.ts +5 -1
package/tests/commands/product-path-regression.test.ts +9 -4
package/tests/commands/rulecode.test.ts +135 -0
package/tests/commands/runtime-diagnostics-export.test.ts +6 -2
package/tests/resolve-workspace.test.ts +21 -0
package/tests/services/console-launcher.test.ts +114 -0
package/tests/services/pd-config-loader.test.ts +8 -1
package/tests/services/quality-scorecard/strong-model-gate.test.ts +133 -0
package/tests/utils/path-security.test.ts +180 -0

package/tests/commands/console-open.test.ts CHANGED Viewed

@@ -496,14 +496,22 @@ describe('CLI command wiring (pd console open)', () => {
     workspaceRoot = path.resolve(__dirname, '../../../..');
     cliPath = path.join(workspaceRoot, 'packages', 'pd-cli', 'dist', 'index.js');
     tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pd-console-open-test-'));
-    // Fake a console install: create dir + dist/server.js with a minimal HTTP server
-    const consoleDir = path.join(os.homedir(), '.openclaw', 'extensions', 'principles-disciple', 'console');
-    fs.mkdirSync(path.join(consoleDir, 'dist'), { recursive: true });
-    // EP-06 regression guard: dist/web/index.html must exist (PR #1169 fix)
+    // Isolated fake HOME so the tests never read from — or rmSync-destroy — a
+    // real ~/.openclaw install on developer machines. runPd() points the CLI
+    // child at this home via __PD_CONSOLE_TEST_FAKE_HOME.
+    const fakeHome = path.join(tmp, 'home');
+    process.env.__PD_CONSOLE_TEST_FAKE_HOME = fakeHome;
+    // Fake a console install: dir + ESM package.json + dist/server.js with a
+    // minimal HTTP server. The package.json "type": "module" makes the fake
+    // server's module system deterministic regardless of whether a real
+    // extension-root package.json exists above the console dir.
+    const consoleDir = path.join(fakeHome, '.openclaw', 'extensions', 'principles-disciple', 'console');
     fs.mkdirSync(path.join(consoleDir, 'dist', 'web'), { recursive: true });
+    fs.writeFileSync(path.join(consoleDir, 'package.json'), JSON.stringify({ name: 'fake-pd-console', version: '0.0.0', type: 'module' }, null, 2));
+    // EP-06 regression guard: dist/web/index.html must exist (PR #1169 fix)
     fs.writeFileSync(path.join(consoleDir, 'dist', 'web', 'index.html'), '<!DOCTYPE html><html></html>');
     fs.writeFileSync(path.join(consoleDir, 'dist', 'server.js'), `
-      const http = require('http');
+      import http from 'node:http';
       const args = process.argv.slice(2);
       const portIdx = args.indexOf('--port');
       const port = portIdx >= 0 ? parseInt(args[portIdx + 1]) : 3100;
@@ -525,11 +533,8 @@ describe('CLI command wiring (pd console open)', () => {
   });
   afterEach(() => {
+    delete process.env.__PD_CONSOLE_TEST_FAKE_HOME;
     try { fs.rmSync(tmp, { recursive: true, force: true }); } catch { /* ignore */ }
-    try {
-      const consoleDir = path.join(os.homedir(), '.openclaw', 'extensions', 'principles-disciple', 'console');
-      fs.rmSync(consoleDir, { recursive: true, force: true });
-    } catch { /* ignore */ }
   });
   it('console open subcommand is registered (pd console open --help)', () => {
@@ -572,6 +577,58 @@ describe('CLI command wiring (pd console open)', () => {
     expect(parsed).toHaveProperty('browserOpened');
   }, 10_000);
+  it('pd console open --json fresh spawn includes a positive integer serverPid (PRI-526)', async () => {
+    // Async stream-parse + guaranteed teardown. execFileSync patterns are
+    // unreliable here on Windows: the CLI keeps running after printing JSON
+    // (fresh spawn) or may unexpectedly take another branch, and killing via
+    // timeout can leave the grandchild server holding pipe handles.
+    let run: CliJsonRun | undefined;
+    try {
+      run = await runPdUntilJson(
+        ['console', 'open', '--workspace', tmp, '--port', '49390', '--json', '--no-browser'],
+        workspaceRoot,
+      );
+      if (!isRecord(run.parsed)) throw new Error('CLI JSON output was not an object');
+      expect(run.parsed.status).toBe('started');
+      expect(run.parsed.reused).toBe(false);
+      const serverPid = run.parsed.serverPid;
+      expect(typeof serverPid === 'number' && Number.isInteger(serverPid) && serverPid > 0).toBe(true);
+    } finally {
+      await teardownCliTree(run);
+    }
+  }, 20_000);
+  it('pd console open --json reused path does NOT include serverPid (PRI-526)', async () => {
+    // Stand up a fake healthy console in-process, then point the CLI at its
+    // port: planConsoleLaunch probes /api/health → 200 → reused, no spawn.
+    const server = http.createServer((req, res) => {
+      if (req.url === '/api/health') {
+        res.statusCode = 200;
+        res.end(JSON.stringify({ success: true }));
+        return;
+      }
+      res.statusCode = 404;
+      res.end();
+    });
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', () => resolve()));
+    const addr = server.address();
+    if (typeof addr !== 'object' || !addr) throw new Error('no addr');
+    let run: CliJsonRun | undefined;
+    try {
+      run = await runPdUntilJson(
+        ['console', 'open', '--workspace', tmp, '--port', String(addr.port), '--json', '--no-browser'],
+        workspaceRoot,
+      );
+      if (!isRecord(run.parsed)) throw new Error('CLI JSON output was not an object');
+      expect(run.parsed.status).toBe('reused');
+      expect(run.parsed.reused).toBe(true);
+      expect(run.parsed).not.toHaveProperty('serverPid');
+    } finally {
+      await teardownCliTree(run);
+      server.close();
+    }
+  }, 20_000);
   it('pd console open --port 99999 --json returns a structured failure (invalid port)', () => {
     const out = runPd(['console', 'open', '--workspace', tmp, '--port', '99999', '--json', '--no-browser'], workspaceRoot);
     const parsed = JSON.parse(out);
@@ -669,11 +726,22 @@ describe('CLI command wiring (pd console open)', () => {
     it('sets browserOpened: false when browser fails to open', async () => {
       const { handleConsoleOpen } = await import('../../src/commands/console.js');
       const exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => {}) as any);
       const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
       const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+      // The in-process handler resolves the console dir via getConsoleDir(),
+      // which reads HOME/USERPROFILE directly. Point them at the isolated
+      // fake home — a clean CI runner has no real ~/.openclaw console, and
+      // relying on one (as this test implicitly did before) makes the result
+      // machine-dependent.
+      const fakeHome = process.env.__PD_CONSOLE_TEST_FAKE_HOME ?? '';
+      const savedHome = process.env.HOME;
+      const savedUserProfile = process.env.USERPROFILE;
+      process.env.HOME = fakeHome;
+      process.env.USERPROFILE = fakeHome;
       const mockChild = new EventEmitter() as any;
       mockChild.unref = vi.fn();
       let spawnCalled = false;
@@ -701,23 +769,29 @@ describe('CLI command wiring (pd console open)', () => {
         };
       };
-      await handleConsoleOpen({
-        workspace: tmp,
-        json: false,
-      });
+      try {
+        await handleConsoleOpen({
+          workspace: tmp,
+          json: false,
+        });
-      await new Promise(resolve => setTimeout(resolve, 150));
+        await new Promise(resolve => setTimeout(resolve, 150));
-      const loggedOutput = logSpy.mock.calls.map(c => c.join(' ')).join('\n');
-      expect(exitSpy).not.toHaveBeenCalled();
-      expect(spawnCalled).toBe(true);
-      expect(loggedOutput).not.toContain('Browser opened');
-      expect(loggedOutput).toContain('Open http://127.0.0.1:3100 in your browser');
+        const loggedOutput = logSpy.mock.calls.map(c => c.join(' ')).join('\n');
+        expect(exitSpy).not.toHaveBeenCalled();
+        expect(spawnCalled).toBe(true);
-      exitSpy.mockRestore();
-      logSpy.mockRestore();
-      errorSpy.mockRestore();
+        expect(loggedOutput).not.toContain('Browser opened');
+        expect(loggedOutput).toContain('Open http://127.0.0.1:3100 in your browser');
+      } finally {
+        if (savedHome === undefined) delete process.env.HOME;
+        else process.env.HOME = savedHome;
+        if (savedUserProfile === undefined) delete process.env.USERPROFILE;
+        else process.env.USERPROFILE = savedUserProfile;
+        exitSpy.mockRestore();
+        logSpy.mockRestore();
+        errorSpy.mockRestore();
+      }
     });
   });
@@ -755,6 +829,13 @@ describe('CLI command wiring (pd console open)', () => {
     it('[::1] is accepted and normalized to ::1 (not refused)', () => {
       // May spawn a long-lived server, use timeout.
       const out = runPd(['console', 'open', '--workspace', tmp, '--host', '[::1]', '--json', '--no-browser'], workspaceRoot, 8_000);
+      if (out.trim() === '') {
+        // The CLI was still in its 15s ready-poll when execFileSync timed out.
+        // Known environment limitation: on Windows hosts where IPv6 loopback
+        // connections are refused (EACCES), the health probe on ::1 never
+        // succeeds. CI (Linux) is unaffected.
+        throw new Error('CLI produced no JSON within 8s — ::1 health probe never succeeded (IPv6 loopback may be blocked on this machine)');
+      }
       const parsed = JSON.parse(out);
       // Should NOT be refused — [::1] is loopback
       expect(parsed.status).not.toBe('refused');
@@ -767,8 +848,8 @@ describe('CLI command wiring (pd console open)', () => {
     it('returns console_web_ui_missing when dist/web/index.html does not exist', () => {
       // beforeEach creates the fake console dir WITH dist/web/index.html.
       // Remove it to simulate a corrupted install (the PR #1169 regression).
-      const consoleDir = path.join(os.homedir(), '.openclaw', 'extensions', 'principles-disciple', 'console');
-      const webIndex = path.join(consoleDir, 'dist', 'web', 'index.html');
+      const fakeHome = process.env.__PD_CONSOLE_TEST_FAKE_HOME ?? '';
+      const webIndex = path.join(fakeHome, '.openclaw', 'extensions', 'principles-disciple', 'console', 'dist', 'web', 'index.html');
       fs.rmSync(webIndex, { force: true });
       const out = runPd(['console', 'open', '--workspace', tmp, '--json', '--no-browser'], workspaceRoot, 5_000);
@@ -782,18 +863,10 @@ describe('CLI command wiring (pd console open)', () => {
 function runPd(args: string[], cwd: string, timeoutMs?: number): string {
   try {
-    const env: Record<string, string> = { ...process.env };
-    if (!args.includes('--workspace') && !args.includes('--help') && !args.includes('-h')) {
-      env.USERPROFILE = '/nonexistent';
-      env.HOME = '/nonexistent';
-      env.HOMEPATH = '/nonexistent';
-      env.HOMEDRIVE = '/nonexistent';
-      delete env.PD_WORKSPACE_DIR;
-    }
     return execFileSync('node', [getBuiltPdCliPath(), ...args], {
       encoding: 'utf8',
       cwd,
-      env,
+      env: buildChildEnv(),
       timeout: timeoutMs,
     });
   } catch (err: unknown) {
@@ -806,3 +879,108 @@ function runPd(args: string[], cwd: string, timeoutMs?: number): string {
     throw err;
   }
 }
+/** Env for spawned CLI processes: isolated fake HOME, no workspace env leaks. */
+function buildChildEnv(): Record<string, string> {
+  const env = { ...process.env } as Record<string, string>;
+  const fakeHome = process.env.__PD_CONSOLE_TEST_FAKE_HOME;
+  if (fakeHome) {
+    env.USERPROFILE = fakeHome;
+    env.HOME = fakeHome;
+    delete env.HOMEPATH;
+    delete env.HOMEDRIVE;
+    delete env.PD_WORKSPACE_DIR;
+  }
+  return env;
+}
+/** Runtime type guard for unknown CLI JSON output (rc-1/rc-2). */
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null;
+}
+// ─── Async CLI runner with guaranteed teardown (PRI-526 tests) ───────────────
+interface CliJsonRun {
+  parsed: unknown;
+  child: childProcessModule.ChildProcess;
+}
+/**
+ * Spawn the CLI and resolve as soon as stdout contains one parseable JSON
+ * object. Fails fast (bounded timeout / early exit) with the collected
+ * stdout in the error message. The caller MUST call teardownCliTree(run)
+ * in a finally block — the CLI process may still be alive after the JSON
+ * is emitted (fresh-spawn mode keeps the console server attached).
+ */
+async function runPdUntilJson(args: string[], cwd: string, timeoutMs = 12_000): Promise<CliJsonRun> {
+  const child = childProcessModule.spawn('node', [getBuiltPdCliPath(), ...args], {
+    cwd,
+    env: buildChildEnv(),
+  });
+  let stdout = '';
+  child.stdout?.on('data', (d: Buffer) => { stdout += d.toString('utf8'); });
+  const parsed: unknown = await new Promise<unknown>((resolve, reject) => {
+    let done = false;
+    const fail = (msg: string): void => {
+      if (done) return;
+      done = true;
+      reject(new Error(`${msg}; stdout so far: ${stdout.slice(0, 400)}`));
+    };
+    const timer = setTimeout(() => fail('timed out waiting for CLI JSON'), timeoutMs);
+    const tryParse = (): boolean => {
+      const trimmed = stdout.trim();
+      if (!trimmed.startsWith('{')) return false;
+      try {
+        const value = JSON.parse(trimmed) as unknown;
+        done = true;
+        clearTimeout(timer);
+        resolve(value);
+        return true;
+      } catch {
+        return false; // partial pretty-printed JSON — wait for more chunks
+      }
+    };
+    if (tryParse()) return;
+    const onData = (): void => {
+      if (tryParse()) child.stdout?.off('data', onData);
+    };
+    child.stdout?.on('data', onData);
+    child.on('error', (err: Error) => fail(`CLI spawn error: ${err.message}`));
+    child.on('exit', (code: number | null) => fail(`CLI exited with code ${code} before emitting JSON`));
+  });
+  return { parsed, child };
+}
+/**
+ * Deterministic teardown of a runPdUntilJson run: kill the reported console
+ * server PID (grandchild) first so the CLI can exit on its own, then wait a
+ * bounded time, then force-kill the whole CLI tree. Safe to call multiple
+ * times and with undefined.
+ */
+async function teardownCliTree(run: CliJsonRun | undefined): Promise<void> {
+  if (!run) return;
+  const record = isRecord(run.parsed) ? run.parsed : undefined;
+  const serverPid = record !== undefined && typeof record.serverPid === 'number' ? record.serverPid : undefined;
+  if (serverPid !== undefined) {
+    try { process.kill(serverPid); } catch { /* already gone */ }
+  }
+  await new Promise<void>((resolve) => {
+    const t = setTimeout(() => { killTreeForce(run.child); resolve(); }, 4_000);
+    run.child.once('exit', () => { clearTimeout(t); resolve(); });
+  });
+  killTreeForce(run.child);
+}
+/**
+ * Last-resort kill of the CLI child process. The console server grandchild is
+ * reaped separately via its reported serverPid (see teardownCliTree), so a
+ * plain signal kill suffices — no shell/argv command wrapper needed.
+ */
+function killTreeForce(child: childProcessModule.ChildProcess): void {
+  try {
+    child.kill('SIGKILL');
+  } catch { /* already gone */ }
+}

package/tests/commands/legacy-cleanup.test.ts ADDED Viewed

@@ -0,0 +1,148 @@
+/**
+ * Tests for pd legacy cleanup command.
+ *
+ * Covers:
+ * - Relative workspace root works (regression: canonical containment)
+ * - Traversal escape rejected
+ * - Filesystem root rejected
+ * - Dry-run default with no artifacts found
+ * - Apply mode with legacy targets
+ * - V1 artifact identification
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import * as fs from 'fs';
+import * as path from 'path';
+import os from 'os';
+import {
+  handleLegacyCleanup,
+  isV1ArtificerArtifact,
+} from '../../src/commands/legacy-cleanup.js';
+// ── Pure logic: V1 artifact identification ─────────────────────────────────
+describe('isV1ArtificerArtifact', () => {
+  it('returns false for V2 artifact (non-empty implementationCode)', () => {
+    const v2 = JSON.stringify({ id: 'a', implementationCode: 'code here', plan: 'plan' });
+    expect(isV1ArtificerArtifact(v2)).toBe(false);
+  });
+  it('returns true for V1 artifact (plan-only, no implementationCode)', () => {
+    const v1 = JSON.stringify({ id: 'b', plan: 'plan only', implementationCode: '' });
+    expect(isV1ArtificerArtifact(v1)).toBe(true);
+  });
+  it('returns false for invalid JSON', () => {
+    expect(isV1ArtificerArtifact('{not json')).toBe(false);
+  });
+  it('returns false for non-object JSON', () => {
+    expect(isV1ArtificerArtifact('"string"')).toBe(false);
+    expect(isV1ArtificerArtifact('42')).toBe(false);
+  });
+  it('returns false for null JSON', () => {
+    expect(isV1ArtificerArtifact('null')).toBe(false);
+  });
+});
+// ── Integration: relative workspace + boundary validation ─────────────────
+describe('legacy cleanup workspace boundary', () => {
+  it('accepts a relative workspace root (regression: canonical containment)', async () => {
+    // A relative workspace must canonicalize consistently so cleanup scans
+    // inside it, without the old startsWith-on-relative-root failure.
+    const relTmp = fs.mkdtempSync(path.join(process.cwd(), '.tmp-rel-cleanup-'));
+    try {
+      // Create a legacy artifact the scanner looks for
+      const stateDir = path.join(relTmp, '.state');
+      fs.mkdirSync(stateDir, { recursive: true });
+      const legacyDb = path.join(stateDir, 'sessions.db');
+      fs.writeFileSync(legacyDb, 'not a real db', 'utf8');
+      const relWorkspace = path.relative(process.cwd(), relTmp);
+      expect(path.isAbsolute(relWorkspace)).toBe(false);
+      const result = await handleLegacyCleanup({
+        workspacePath: relWorkspace,
+        dryRun: true,
+      });
+      expect(result.status).toBe('ok');
+      expect(result.mode).toBe('dry-run');
+    } finally {
+      fs.rmSync(relTmp, { recursive: true, force: true });
+    }
+  });
+  it('rejects parent traversal escape', async () => {
+    await expect(
+      handleLegacyCleanup({ workspacePath: '../evil', dryRun: true }),
+    ).rejects.toThrow(/parent traversal/);
+  });
+  it('rejects empty workspace', async () => {
+    await expect(
+      handleLegacyCleanup({ workspacePath: '', dryRun: true }),
+    ).rejects.toThrow(/path is empty/);
+  });
+  it('rejects filesystem root', async () => {
+    await expect(
+      handleLegacyCleanup({ workspacePath: path.parse(process.cwd()).root, dryRun: true }),
+    ).rejects.toThrow(/filesystem root/);
+  });
+});
+// ── Integration: normal cleanup flow ───────────────────────────────────────
+describe('legacy cleanup flow', () => {
+  let tmpDir: string;
+  beforeEach(() => {
+    // mkdtempSync: CodeQL-safe random directory under os.tmpdir
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pd-test-cleanup-'));
+  });
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+  it('dry-run with no artifacts returns ok with zero targets', async () => {
+    const result = await handleLegacyCleanup({ workspacePath: tmpDir, dryRun: true });
+    expect(result.status).toBe('ok');
+    expect(result.mode).toBe('dry-run');
+    expect(result.fileTargets).toEqual([]);
+    expect(result.errors).toEqual([]);
+  });
+  it('scans legacy session files under .state/sessions', async () => {
+    const sessionsDir = path.join(tmpDir, '.state', 'sessions');
+    fs.mkdirSync(sessionsDir, { recursive: true });
+    fs.writeFileSync(
+      path.join(sessionsDir, 'old-session.json'),
+      JSON.stringify({ sessionKey: 'cron:pd-empathy-optimizer-abc' }),
+      'utf8',
+    );
+    const result = await handleLegacyCleanup({ workspacePath: tmpDir, dryRun: true });
+    expect(result.status).toBe('ok');
+    expect(result.fileTargets.length).toBeGreaterThanOrEqual(1);
+    expect(result.fileTargets.some((t) => t.path.endsWith('old-session.json'))).toBe(true);
+  });
+  it('apply mode deletes legacy session files', async () => {
+    const sessionsDir = path.join(tmpDir, '.state', 'sessions');
+    fs.mkdirSync(sessionsDir, { recursive: true });
+    const legacyFile = path.join(sessionsDir, 'old-session.json');
+    fs.writeFileSync(
+      legacyFile,
+      JSON.stringify({ sessionKey: 'cron:pd-empathy-optimizer-abc' }),
+      'utf8',
+    );
+    const result = await handleLegacyCleanup({ workspacePath: tmpDir, apply: true });
+    expect(result.status).toBe('ok');
+    expect(result.mode).toBe('apply');
+    expect(fs.existsSync(legacyFile)).toBe(false);
+  });
+});

package/tests/commands/pain-evidence.test.ts CHANGED Viewed

@@ -271,6 +271,43 @@ describe('real SYSTEM log fixture', () => {
     logSpy.mockRestore();
     exitSpy.mockRestore();
   });
+  it('FIXTURE-06: relative --workspace reads SYSTEM logs (regression)', async () => {
+    // Regression: a relative workspace root must not break containment.
+    // getLogDir canonicalizes via assertSafeDirectoryRoot and the log-file
+    // check uses isPathInside (canonical-vs-canonical), so a relative root
+    // must resolve and contain its own log dir.
+    const { handlePainEvidence } = await import('../../src/commands/pain-evidence.js');
+    // Create a workspace under cwd so a true relative path is possible.
+    const relTmp = fs.mkdtempSync(path.join(process.cwd(), '.tmp-rel-ws-'));
+    try {
+      const relLogDir = path.join(relTmp, 'memory', 'logs');
+      fs.mkdirSync(relLogDir, { recursive: true });
+      fs.writeFileSync(path.join(relLogDir, 'SYSTEM_2026-06-08.log'), FULL_LOG_CONTENT, 'utf8');
+      const relWorkspace = path.relative(process.cwd(), relTmp);
+      expect(path.isAbsolute(relWorkspace)).toBe(false);
+      const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+      const exitSpy = vi.spyOn(process, 'exit').mockImplementation((() => undefined) as () => never);
+      await handlePainEvidence({ workspace: relWorkspace, limit: 10, json: true });
+      const jsonCall = logSpy.mock.calls.find((call) => {
+        try { JSON.parse(call[0] as string); return true; } catch { return false; }
+      });
+      expect(jsonCall).toBeDefined();
+      const output = JSON.parse(jsonCall![0] as string);
+      expect(output.count).toBe(3);
+      expect(output.searchedPath).toContain(path.join('memory', 'logs', 'SYSTEM_*.log'));
+      expect(output.decisions[0].outcome).toBe('manual_owner_admitted');
+      logSpy.mockRestore();
+      exitSpy.mockRestore();
+    } finally {
+      fs.rmSync(relTmp, { recursive: true, force: true });
+    }
+  });
 });
 // ── Commander Registration Tests ───────────────────────────────────────────

package/tests/commands/pri-393-runtime-config-unification.test.ts CHANGED Viewed

@@ -100,7 +100,11 @@ describe('PRI-393: runtime config unification', () => {
       ];
       for (const file of commandFiles) {
-        const fullPath = path.resolve(file);
+        // CWE-22: resolve against the repo root (this test file lives at
+        // packages/pd-cli/tests/commands/) and refuse paths that escape it.
+        const repoRoot = path.resolve(__dirname, '../../..');
+        const fullPath = path.resolve(repoRoot, file);
+        if (!fullPath.startsWith(repoRoot + path.sep)) continue;
         if (!fs.existsSync(fullPath)) continue;
         const source = fs.readFileSync(fullPath, 'utf8');

package/tests/commands/product-path-regression.test.ts CHANGED Viewed

@@ -2,7 +2,7 @@ import { describe, it, expect } from 'vitest';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import { fileURLToPath } from 'url';
 // Resolve __dirname in ESM
@@ -40,11 +40,16 @@ ui:
     // Resolve CLI binary path relative to this file to be workspace-independent
     const cliBin = path.resolve(__dirname, '../../dist/index.js');
-    const cmd = `node "${cliBin}" pain record --reason "Regression test frustration" --json --workspace "${tmpDir}"`;
+    // Parameterized exec (no shell): tmpDir and reason are passed as separate
+    // argv entries, so shell metacharacters in them cannot be interpreted as
+    // commands (CWE-78 mitigation).
     let stdoutStr: string;
     try {
-      stdoutStr = execSync(cmd, { encoding: 'utf8', stdio: ['pipe', 'pipe', 'inherit'] });
+      stdoutStr = execFileSync(
+        process.execPath,
+        [cliBin, 'pain', 'record', '--reason', 'Regression test frustration', '--json', '--workspace', tmpDir],
+        { encoding: 'utf8', stdio: ['pipe', 'pipe', 'inherit'], windowsHide: true },
+      );
     } finally {
       fs.rmSync(tmpDir, { recursive: true, force: true });
     }