@rahul05ranjan/dhruv-cli 1.3.0 → 1.5.0

package/__tests__/file-workflows.test.ts

@@ -0,0 +1,195 @@
+import { describe, expect, it, jest, beforeEach, afterEach } from '@jest/globals';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { review } from '../src/commands/review';
+import { securityCheck } from '../src/commands/security-check';
+import { generate } from '../src/commands/generate';
+import { optimize } from '../src/commands/optimize';
+import { setAIClient } from '../src/core/ai';
+import type { AIClient, AIRequest } from '../src/core/ai';
+
+jest.mock('chalk', () => {
+  const identity = (value: unknown) => String(value);
+  const makeChalk = (): unknown => new Proxy(identity, {
+    get: (_target, property: string | symbol) => property === 'level' ? 0 : makeChalk(),
+    apply: (_target, _thisArg, args: unknown[]) => String(args[0]),
+  });
+  const chalk = makeChalk() as Record<string, unknown>;
+  return { __esModule: true, default: chalk, ...chalk };
+});
+
+jest.mock('ora', () => ({
+  __esModule: true,
+  default: jest.fn(() => ({
+    start: jest.fn().mockReturnThis(),
+    stop: jest.fn().mockReturnThis(),
+  })),
+}));
+
+jest.mock('../src/utils/ux', () => ({
+  printError: jest.fn(),
+  printSuccess: jest.fn(),
+  printWarning: jest.fn(),
+  printInfo: jest.fn(),
+  createSpinner: jest.fn(),
+  themed: jest.fn((value: string) => value),
+  highlightCode: jest.fn((value: string) => value),
+  createProgressBar: jest.fn(),
+}));
+
+jest.mock('../src/core/logger', () => ({
+  logger: {
+    info: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+    debug: jest.fn(),
+    command: jest.fn(),
+    performance: jest.fn(),
+    security: jest.fn(),
+    getSessionId: jest.fn(() => 'test-session'),
+    flush: jest.fn(),
+  },
+  logCommand: jest.fn(),
+  logPerformance: jest.fn(),
+  logSecurity: jest.fn(),
+  logError: jest.fn(),
+  logInfo: jest.fn(),
+  logWarn: jest.fn(),
+  logDebug: jest.fn(),
+}));
+
+class RecordingClient implements AIClient {
+  requests: AIRequest[] = [];
+
+  async ask(request: AIRequest): Promise<string> {
+    this.requests.push(request);
+    return 'review complete';
+  }
+
+  async listModels(): Promise<string[]> {
+    return ['test-model'];
+  }
+}
+
+describe('file analysis commands', () => {
+  let root: string;
+  let client: RecordingClient;
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), 'dhruv-review-'));
+    client = new RecordingClient();
+    setAIClient(client);
+  });
+
+  afterEach(() => {
+    fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  it('reviews nested source files without sending dependency directories', async () => {
+    fs.mkdirSync(path.join(root, 'src', 'nested'), { recursive: true });
+    fs.mkdirSync(path.join(root, 'node_modules', 'library'), { recursive: true });
+    fs.writeFileSync(path.join(root, 'src', 'nested', 'feature.ts'), 'export const feature = true;');
+    fs.writeFileSync(path.join(root, 'node_modules', 'library', 'ignored.ts'), 'export const ignored = true;');
+
+    await review(root);
+
+    expect(client.requests).toHaveLength(1);
+    expect(client.requests[0].prompt).toContain('src/nested/feature.ts');
+    expect(client.requests[0].prompt).not.toContain('node_modules/library/ignored.ts');
+  });
+
+  it('includes detected project context in review requests', async () => {
+    fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({ devDependencies: { typescript: '^5.0.0' } }));
+    fs.writeFileSync(path.join(root, 'index.ts'), 'export const value = 1;');
+
+    await review(root);
+
+    expect(client.requests[0].prompt).toContain('node-typescript');
+  });
+
+  it('redacts credential-like values before security analysis', async () => {
+    const source = path.join(root, 'config.ts');
+    fs.writeFileSync(source, 'const API_KEY = "sk-live-super-secret";');
+
+    await securityCheck(source);
+
+    expect(client.requests).toHaveLength(1);
+    expect(client.requests[0].prompt).not.toContain('sk-live-super-secret');
+    expect(client.requests[0].prompt).toContain('[REDACTED]');
+  });
+
+  it('includes location and remediation for deterministic security findings', async () => {
+    const source = path.join(root, 'config.ts');
+    fs.writeFileSync(source, 'const API_KEY = "sk-live-super-secret";');
+
+    await securityCheck(source);
+
+    expect(client.requests[0].prompt).toContain('line 1');
+    expect(client.requests[0].prompt).toContain('rotate the credential');
+  });
+
+  it('scans nested project files without sending dependency directories', async () => {
+    fs.mkdirSync(path.join(root, 'src', 'nested'), { recursive: true });
+    fs.mkdirSync(path.join(root, 'node_modules', 'library'), { recursive: true });
+    fs.writeFileSync(path.join(root, 'src', 'nested', 'config.ts'), 'const API_KEY = "sk-live-super-secret";');
+    fs.writeFileSync(path.join(root, 'node_modules', 'library', 'ignored.ts'), 'const API_KEY = "sk-dependency-secret";');
+
+    await securityCheck(root);
+
+    expect(client.requests[0].prompt).toContain('src/nested/config.ts');
+    expect(client.requests[0].prompt).not.toContain('sk-dependency-secret');
+  });
+
+  it('sets a failing exit code in strict mode for high-confidence findings', async () => {
+    const source = path.join(root, 'unsafe.ts');
+    fs.writeFileSync(source, 'const API_KEY = "sk-live-super-secret";');
+    process.exitCode = undefined;
+
+    try {
+      await securityCheck(source, { strict: true });
+      expect(process.exitCode).toBe(1);
+    } finally {
+      process.exitCode = undefined;
+    }
+  });
+
+  it('does not overwrite an existing generated file', async () => {
+    const source = path.join(root, 'sample.ts');
+    const generated = path.join(root, 'sample.test.ts');
+    fs.writeFileSync(source, 'export const value = 1;');
+    fs.writeFileSync(generated, 'keep this work');
+
+    await generate('tests', source, { apply: true });
+
+    expect(fs.readFileSync(generated, 'utf8')).toBe('keep this work');
+  });
+
+  it('preserves the target language when generating tests', async () => {
+    const source = path.join(root, 'sample.ts');
+    fs.writeFileSync(source, 'export const value = 1;');
+
+    await generate('tests', source, { apply: true });
+
+    expect(fs.existsSync(path.join(root, 'sample.test.ts'))).toBe(true);
+  });
+
+  it('previews generated tests without writing by default', async () => {
+    const source = path.join(root, 'preview.ts');
+    fs.writeFileSync(source, 'export const value = 1;');
+
+    await generate('tests', source);
+
+    expect(fs.existsSync(path.join(root, 'preview.test.ts'))).toBe(false);
+  });
+
+  it('asks optimization responses to explain impact and trade-offs', async () => {
+    const source = path.join(root, 'sample.ts');
+    fs.writeFileSync(source, 'export const value = 1;');
+
+    await optimize(source);
+
+    expect(client.requests[0].prompt).toContain('expected impact');
+    expect(client.requests[0].prompt).toContain('trade-offs');
+  });
+});

package/__tests__/interactive.test.ts

@@ -0,0 +1,119 @@
+import { describe, expect, it, jest } from '@jest/globals';
+import inquirer from 'inquirer';
+import { menu } from '../src/commands/menu';
+import { init } from '../src/commands/init';
+import { listModels } from '../src/core/ai';
+
+jest.mock('chalk', () => {
+  const identity = (value: unknown) => String(value);
+  const makeChalk = (): unknown => new Proxy(identity, {
+    get: (_target, property: string | symbol) => property === 'level' ? 0 : makeChalk(),
+    apply: (_target, _thisArg, args: unknown[]) => String(args[0]),
+  });
+  const chalk = makeChalk() as Record<string, unknown>;
+  return { __esModule: true, default: chalk, ...chalk };
+});
+
+jest.mock('ora', () => ({
+  __esModule: true,
+  default: jest.fn(() => ({
+    start: jest.fn().mockReturnThis(),
+    stop: jest.fn().mockReturnThis(),
+  })),
+}));
+
+jest.mock('../src/utils/ux', () => ({
+  printError: jest.fn(),
+  printSuccess: jest.fn(),
+  printWarning: jest.fn(),
+  printInfo: jest.fn(),
+  createSpinner: jest.fn(),
+  themed: jest.fn((value: string) => value),
+  highlightCode: jest.fn((value: string) => value),
+  createProgressBar: jest.fn(),
+}));
+
+jest.mock('../src/core/ai', () => ({
+  listModels: jest.fn(),
+}));
+
+jest.mock('inquirer', () => ({
+  __esModule: true,
+  default: { prompt: jest.fn() },
+}));
+
+describe('interactive commands', () => {
+  it('handles menu cancellation without an unhandled rejection', async () => {
+    const prompt = jest.mocked(inquirer.prompt);
+    prompt.mockRejectedValueOnce(new Error('User force closed the prompt with 0 null'));
+    process.exitCode = undefined;
+
+    try {
+      await menu();
+      expect(process.exitCode).toBe(130);
+    } finally {
+      prompt.mockReset();
+      process.exitCode = undefined;
+    }
+  });
+
+  it('handles init cancellation with a cancellation exit code', async () => {
+    jest.mocked(listModels).mockResolvedValue(['test-model']);
+    const prompt = jest.mocked(inquirer.prompt);
+    prompt.mockRejectedValueOnce(new Error('User force closed the prompt with 0 null'));
+    process.exitCode = undefined;
+
+    try {
+      await init();
+      expect(process.exitCode).toBe(130);
+    } finally {
+      prompt.mockReset();
+      process.exitCode = undefined;
+    }
+  });
+
+  it('asks whether init should save project-local or user-global settings', async () => {
+    jest.mocked(listModels).mockResolvedValue(['test-model']);
+    const prompt = jest.mocked(inquirer.prompt);
+    prompt.mockResolvedValueOnce({
+      model: 'test-model',
+      responseFormat: 'text',
+      verbose: false,
+      theme: 'default',
+      scope: 'local',
+    });
+
+    await init();
+
+    const questions = prompt.mock.calls[0][0] as unknown as Array<{ name: string; choices?: string[] }>;
+    expect(questions.find((question) => question.name === 'scope')?.choices).toEqual(['local', 'global']);
+    prompt.mockReset();
+  });
+
+  it('offers diagnostic commands from the interactive menu', async () => {
+    const prompt = jest.mocked(inquirer.prompt);
+    prompt.mockResolvedValueOnce({ filter: '' }).mockResolvedValueOnce({ cmd: 'exit' });
+
+    await menu();
+
+    const choices = (prompt.mock.calls[1][0] as unknown as Array<{ choices: Array<{ value: string }> }>)[0].choices;
+    expect(choices.map(choice => choice.value)).toEqual(expect.arrayContaining([
+      'status',
+      'health',
+      'metrics',
+      'completion',
+    ]));
+  });
+
+  it('offers command filtering before opening the menu', async () => {
+    const prompt = jest.mocked(inquirer.prompt);
+    prompt.mockRejectedValueOnce(new Error('User force closed the prompt with 0 null'));
+
+    await menu();
+
+    expect((prompt.mock.calls[0][0] as unknown as Array<{ name: string; type: string }>)[0]).toMatchObject({
+      name: 'filter',
+      type: 'input',
+    });
+  });
+});

package/__tests__/setup.ts

@@ -0,0 +1,62 @@
+import { jest } from '@jest/globals';
+
+// Setup test environment
+beforeAll(async () => {
+  // Set test environment
+  process.env.NODE_ENV = 'test';
+
+  // Mock console methods to reduce noise during tests
+  global.console = {
+    ...console,
+    log: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+  };
+});
+
+afterAll(async () => {
+  // Cleanup
+  delete process.env.NODE_ENV;
+});
+
+// Mock process.exit to prevent tests from exiting
+const mockExit = jest.spyOn(process, 'exit').mockImplementation(() => {
+  throw new Error('process.exit() was called');
+});
+
+afterEach(() => {
+  mockExit.mockClear();
+  process.exitCode = undefined;
+});
+
+// Global test utilities
+(global as Record<string, unknown>).testUtils = {
+  // Helper to wait for async operations
+  wait: (ms: number) => new Promise(resolve => setTimeout(resolve, ms)),
+
+  // Helper to create temporary files for testing
+  createTempFile: (content: string, filename: string = 'test.txt') => {
+    const fs = require('fs');
+    const path = require('path');
+    const tempDir = path.join(process.cwd(), '.test-temp');
+
+    if (!fs.existsSync(tempDir)) {
+      fs.mkdirSync(tempDir, { recursive: true });
+    }
+
+    const filePath = path.join(tempDir, filename);
+    fs.writeFileSync(filePath, content);
+    return filePath;
+  },
+
+  // Helper to clean up temporary files
+  cleanupTempFiles: () => {
+    const fs = require('fs');
+    const path = require('path');
+    const tempDir = path.join(process.cwd(), '.test-temp');
+
+    if (fs.existsSync(tempDir)) {
+      fs.rmSync(tempDir, { recursive: true, force: true });
+    }
+  }
+};

package/__tests__/workflows.test.ts

@@ -0,0 +1,118 @@
+import { describe, expect, it } from '@jest/globals';
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { parse } from 'yaml';
+
+interface Step {
+  uses?: string;
+  run?: string;
+  with?: Record<string, string | number>;
+}
+
+interface Workflow {
+  on: Record<string, unknown>;
+  env?: Record<string, string>;
+  permissions?: Record<string, string>;
+  jobs: Record<string, { steps: Step[]; if?: string }>;
+}
+
+const root = resolve(__dirname, '..');
+const workflow = (name: string): Workflow =>
+  parse(readFileSync(resolve(root, '.github/workflows', name), 'utf8'));
+
+const atLeast = (version: string, minimum: string): boolean =>
+  /^\d+\.\d+\.\d+$/.test(version) && version.localeCompare(minimum, 'en', { numeric: true }) >= 0;
+
+describe('release workflow requirements', () => {
+  it('does not retain redundant publishing or deployment workflows', () => {
+    for (const name of ['auto-assign.yml', 'build-publish.yml', 'deploy.yml', 'monitoring.yml']) {
+      expect(existsSync(resolve(root, '.github/workflows', name))).toBe(false);
+    }
+  });
+
+  it('installs an OIDC-capable npm CLI where semantic-release looks for executables', () => {
+    // The plugin uses preferLocal: true. A global npm upgrade cannot fix an
+    // older CLI hoisted here by a conflicting @semantic-release/npm version.
+    const npm = JSON.parse(readFileSync(resolve(root, 'node_modules/npm/package.json'), 'utf8'));
+    expect(atLeast(npm.version, '11.5.1')).toBe(true);
+  });
+
+  it.each(['release.yml'])(
+    '%s provisions a supported Node and npm before publishing',
+    name => {
+      const config = workflow(name);
+      for (const job of Object.values(config.jobs)) {
+        const publishIndex = job.steps.findIndex(step =>
+          /npm publish|npx semantic-release/.test(step.run ?? ''));
+        if (publishIndex < 0) continue;
+        const setup = job.steps.slice(0, publishIndex).find(step =>
+          step.uses?.startsWith('actions/setup-node@'));
+        const nodeVersion = String(setup?.with?.['node-version']).replace(
+          /\$\{\{ env\.(\w+) \}\}/g, (_, key: string) => config.env?.[key] ?? '');
+        expect(atLeast(nodeVersion, '22.14.0')).toBe(true);
+        const npmSetup = job.steps.slice(0, publishIndex).find(step =>
+          /npm install --global npm@/.test(step.run ?? ''));
+        const npmVersion = npmSetup?.run?.match(/npm@(\d+\.\d+\.\d+)/)?.[1] ?? '0.0.0';
+        expect(atLeast(npmVersion, '11.5.1')).toBe(true);
+      }
+    });
+
+  it('has one automatic publisher for main pushes', () => {
+    const publishers = ['ci.yml', 'release.yml']
+      .filter(name => {
+        const config = workflow(name);
+        return config.on.push && Object.values(config.jobs).some(job =>
+          job.steps.some(step => /npx semantic-release|npm publish(?! --dry-run)/.test(step.run ?? '')));
+      });
+    expect(publishers).toEqual(['release.yml']);
+  });
+});
+
+describe('workflow trigger boundaries', () => {
+  it('runs branch and pull-request validation only for the default branch', () => {
+    for (const name of ['ci.yml', 'contribution.yml', 'labeler.yml', 'dependabot-auto-merge.yml']) {
+      const config = workflow(name);
+      const event = config.on[name === 'ci.yml' ? 'push' : 'pull_request'] as { branches?: string[] };
+      expect(event.branches).toEqual(['main']);
+    }
+  });
+
+  it('keeps expensive security jobs off pull-request runs', () => {
+    const config = workflow('security.yml');
+    for (const name of ['license-check', 'supply-chain', 'sbom-generation']) {
+      expect(config.jobs[name]?.if).toBe("github.event_name != 'pull_request'");
+    }
+  });
+});
+
+describe('security workflow requirements', () => {
+  it('lets TruffleHog select the commit range for push, PR, schedule and manual events', () => {
+    const steps = workflow('security.yml').jobs['secret-scan'].steps;
+    const scanner = steps.find(step => step.uses?.startsWith('trufflesecurity/trufflehog@'));
+    expect(scanner).toBeDefined();
+    // Hard-coding main/HEAD makes push-to-main scans fail before scanning.
+    expect(scanner?.with?.base).toBeUndefined();
+    expect(scanner?.with?.head).toBeUndefined();
+    const checkout = steps.find(step => step.uses?.startsWith('actions/checkout@'));
+    expect(checkout?.with?.['fetch-depth']).toBe(0);
+  });
+
+  it('uploads the Anchore report instead of uploading the Scorecard report twice', () => {
+    const steps = Object.values(workflow('security.yml').jobs).flatMap(job => job.steps);
+    const uploads = steps.filter(step => step.uses?.includes('/upload-sarif@'));
+    expect(uploads.map(step => step.with?.sarif_file)).toEqual([
+      'results.sarif', '${{ steps.scan.outputs.sarif }}',
+    ]);
+  });
+
+  it('meets Scorecard publishing restrictions on permissions and job isolation', () => {
+    const config = workflow('security.yml');
+    expect(Object.values(config.permissions ?? {})).not.toContain('write');
+    // Scorecard's results API accepts only these actions in the producing job.
+    const allowed = ['actions/checkout', 'actions/upload-artifact',
+      'github/codeql-action/upload-sarif', 'ossf/scorecard-action', 'step-security/harden-runner'];
+    for (const step of config.jobs['security-scorecard'].steps) {
+      expect(allowed).toContain(step.uses?.split('@')[0]);
+    }
+  });
+});

package/dist/commands/explain.js

@@ -1,46 +1,15 @@
-import { askOllama } from '../core/ai.js';
-import ora from 'ora';
-import chalk from 'chalk';
-import { loadConfig } from '../config/config.js';
-import { highlightCode, printError } from '../utils/ux.js';
+import { runCommand } from '../core/command-runner.js';
+import { getSystemMessage } from '../core/prompts.js';
 export async function explain(query) {
-    const config = loadConfig();
-    const spinner = ora('Thinking...').start();
-    let streamed = '';
-    const dhruvIntro = chalk.yellowBright('Dhruv CLI: Your AI-powered CLI assistant for developers using Ollama.\n');
-    try {
-        spinner.stop();
-        process.stdout.write(dhruvIntro); // Print Dhruv intro before explanation
-        process.stdout.write(chalk.green('Explanation: '));
-        await askOllama({
-            prompt: `Explain: ${query}`,
-            model: config.model,
-            onToken: (token) => {
-                streamed += token;
-                process.stdout.write(chalk.cyan(token));
-            }
-        });
-        process.stdout.write('\n');
-        if (typeof highlightCode === 'function' && streamed.match(/```[a-z]*[\s\S]*?```/)) {
-            const codeBlocks = streamed.match(/```([a-z]*)\n([\s\S]*?)```/g) || [];
-            for (const block of codeBlocks) {
-                const [, lang, code] = block.match(/```([a-z]*)\n([\s\S]*?)```/) || [];
-                if (code) {
-                    try {
-                        console.log(highlightCode(code, lang || 'js'));
-                    }
-                    catch (err) {
-                        // Only log highlight errors in development
-                        if (process.env.NODE_ENV === 'development') {
-                            console.error('Highlight error:', err);
-                        }
-                    }
-                }
-            }
-        }
-    }
-    catch (err) {
-        printError('Failed to get explanation.');
-        console.error(chalk.red(err.message));
-    }
+    await runCommand({
+        name: 'explain',
+        input: { query },
+        header: '📚 Explanation: ',
+        buildRequest: (input, model) => ({
+            prompt: input.query,
+            systemMessage: getSystemMessage('explain'),
+            model,
+        }),
+        footer: `💡 Need more help? Try: dhruv suggest "${query}"`,
+    });
 }

package/dist/commands/fix.js

@@ -1,40 +1,15 @@
-import { askOllama } from '../core/ai.js';
-import ora from 'ora';
-import chalk from 'chalk';
-import { loadConfig } from '../config/config.js';
-import { highlightCode, printError } from '../utils/ux.js';
+import { runCommand } from '../core/command-runner.js';
+import { getSystemMessage } from '../core/prompts.js';
 export async function fix(query) {
-    const config = loadConfig();
-    const spinner = ora('Analyzing issue...').start();
-    let streamed = '';
-    try {
-        spinner.stop();
-        process.stdout.write(chalk.green('Fix suggestion: '));
-        await askOllama({
-            prompt: `Fix: ${query}`,
-            model: config.model,
-            onToken: (token) => {
-                streamed += token;
-                process.stdout.write(chalk.cyan(token));
-            }
-        });
-        process.stdout.write('\n');
-        if (typeof highlightCode === 'function' && streamed.match(/```[a-z]*[\s\S]*?```/)) {
-            const codeBlocks = streamed.match(/```([a-z]*)\n([\s\S]*?)```/g) || [];
-            for (const block of codeBlocks) {
-                const [, lang, code] = block.match(/```([a-z]*)\n([\s\S]*?)```/) || [];
-                if (code)
-                    try {
-                        console.log(highlightCode(code, lang || 'js'));
-                    }
-                    catch (err) {
-                        console.error('Highlight error:', err);
-                    }
-            }
-        }
-    }
-    catch (err) {
-        printError('Failed to get fix suggestion.');
-        console.error(chalk.red(err.message));
-    }
+    await runCommand({
+        name: 'fix',
+        input: { query },
+        header: '🔧 Fix Analysis: ',
+        buildRequest: (input, model) => ({
+            prompt: input.query,
+            systemMessage: getSystemMessage('fix'),
+            model,
+        }),
+        footer: `🧪 Want to test this? Try: dhruv generate tests <your-file>`,
+    });
 }

package/dist/commands/generate.d.ts

@@ -1 +1,6 @@
-export declare function generate(type: string, target: string): Promise<void>;
+export interface GenerateOptions {
+    apply?: boolean;
+    output?: string;
+    overwrite?: boolean;
+}
+export declare function generate(type: string, target: string, options?: GenerateOptions): Promise<void>;