@securecode-ai/mcp 0.5.4 → 0.5.6

package/dist/utils/securityConfig.js

@@ -0,0 +1,192 @@
+"use strict";
+/**
+ * Security config discovery — finds and parses security-relevant config
+ * files in the workspace so the agent can reason about ACTUAL config
+ * instead of guessing from prompt rules.
+ *
+ * Replaces the system prompt's hardcoded FP-suppression rules ("config-gated
+ * rate limits are not vulnerabilities") with a tool that lets the agent
+ * check the config and reason about what it finds.
+ *
+ * Security rules:
+ *   - For .env files, return key NAMES and set/unset status only — never values
+ *   - Prefer .env.example over real .env
+ *   - All paths workspace-confined via resolveWorkspacePath
+ *   - Output truncated to 16KB
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readSecurityConfig = readSecurityConfig;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const files_1 = require("./files");
+const CONFIG_PATTERNS = [
+    { file: '.env.example', kind: 'env', description: 'Environment variable template (safe to show keys)' },
+    { file: '.env', kind: 'env', description: 'Environment variables (KEYS ONLY — values redacted)' },
+    { file: '.env.local', kind: 'env', description: 'Local environment overrides (KEYS ONLY)' },
+    { file: '.env.production', kind: 'env', description: 'Production environment (KEYS ONLY)' },
+    { file: 'helmet.config.js', kind: 'headers', description: 'Helmet security headers config' },
+    { file: 'helmet.config.ts', kind: 'headers', description: 'Helmet security headers config' },
+    { file: 'cors.config.js', kind: 'cors', description: 'CORS configuration' },
+    { file: 'cors.config.ts', kind: 'cors', description: 'CORS configuration' },
+    { file: 'next.config.js', kind: 'headers', description: 'Next.js config (may contain headers/CSP)' },
+    { file: 'next.config.ts', kind: 'headers', description: 'Next.js config (may contain headers/CSP)' },
+    { file: 'next.config.mjs', kind: 'headers', description: 'Next.js config (may contain headers/CSP)' },
+    { file: 'express-rate-limit.config.js', kind: 'rate_limit', description: 'Express rate limit config' },
+    { file: 'rate-limit.config.js', kind: 'rate_limit', description: 'Rate limit config' },
+    { file: 'rate-limit.config.ts', kind: 'rate_limit', description: 'Rate limit config' },
+];
+function findConfigFiles(workspaceRoot, kind) {
+    const out = [];
+    for (const pattern of CONFIG_PATTERNS) {
+        if (kind !== 'all' && pattern.kind !== kind)
+            continue;
+        const candidates = [
+            path.join(workspaceRoot, pattern.file),
+            path.join(workspaceRoot, 'config', pattern.file),
+            path.join(workspaceRoot, 'src', pattern.file),
+        ];
+        for (const candidate of candidates) {
+            if (fs.existsSync(candidate)) {
+                const rel = path.relative(workspaceRoot, candidate).replace(/\\/g, '/');
+                out.push({ path: rel, kind: pattern.kind, description: pattern.description });
+                break;
+            }
+        }
+    }
+    return out;
+}
+function redactEnvValues(content) {
+    return content
+        .split('\n')
+        .map(line => {
+        const trimmed = line.trim();
+        if (trimmed.startsWith('#') || trimmed === '')
+            return line;
+        const eqIdx = line.indexOf('=');
+        if (eqIdx === -1)
+            return line;
+        const key = line.slice(0, eqIdx).trim();
+        const isSecret = /SECRET|KEY|TOKEN|PASSWORD|PRIVATE|CREDENTIAL/i.test(key);
+        if (isSecret)
+            return `${key}=REDACTED`;
+        return `${key}=set`;
+    })
+        .join('\n');
+}
+function parseConfigFile(filePath, workspaceRoot) {
+    const abs = (0, files_1.resolveWorkspacePath)(workspaceRoot, filePath);
+    const content = fs.readFileSync(abs, 'utf8');
+    const ext = path.extname(filePath).toLowerCase();
+    if (filePath.includes('.env')) {
+        return redactEnvValues(content);
+    }
+    if (ext === '.js' || ext === '.ts' || ext === '.mjs' || ext === '.json') {
+        return content.slice(0, 12000);
+    }
+    return content.slice(0, 12000);
+}
+function searchInlineConfig(workspaceRoot, kind) {
+    const out = [];
+    const patterns = [
+        { regex: 'helmet\\s*\\(', kind: 'headers', label: 'helmet() call' },
+        { regex: 'cors\\s*\\(', kind: 'cors', label: 'cors() call' },
+        { regex: 'rateLimit\\s*\\(', kind: 'rate_limit', label: 'rateLimit() call' },
+        { regex: 'rate-limit', kind: 'rate_limit', label: 'rate-limit import' },
+        { regex: 'express-rate-limit', kind: 'rate_limit', label: 'express-rate-limit import' },
+        { regex: 'Content-Security-Policy|contentSecurityPolicy|CSP', kind: 'headers', label: 'CSP header' },
+        { regex: 'HSTS|strict-Transport-Security', kind: 'headers', label: 'HSTS header' },
+        { regex: 'X-Frame-Options|xFrameOptions', kind: 'headers', label: 'X-Frame-Options' },
+        { regex: 'X-Content-Type-Options|xContentTypeOptions', kind: 'headers', label: 'X-Content-Type-Options' },
+    ];
+    for (const p of patterns) {
+        if (kind !== 'all' && p.kind !== kind)
+            continue;
+        try {
+            const { searchCode } = require('../utils/searchCode');
+            const result = searchCode(workspaceRoot, p.regex, '*.{js,ts,mjs,jsx,tsx}');
+            if (result && result.hits) {
+                for (const hit of result.hits.slice(0, 3)) {
+                    out.push({
+                        file: hit.path,
+                        snippet: hit.text.slice(0, 200),
+                        line: hit.line,
+                    });
+                }
+            }
+        }
+        catch { /* best-effort */ }
+    }
+    return out;
+}
+async function readSecurityConfig(workspaceRoot, kind = 'all') {
+    const configFiles = findConfigFiles(workspaceRoot, kind);
+    const inlineConfigs = searchInlineConfig(workspaceRoot, kind);
+    if (configFiles.length === 0 && inlineConfigs.length === 0) {
+        return `No ${kind === 'all' ? '' : kind + ' '}security config files found. The project may not have explicit security config — check if it relies on framework defaults or environment variables.`;
+    }
+    const lines = [`Security config (${kind === 'all' ? 'all' : kind}):`];
+    if (configFiles.length > 0) {
+        lines.push('', 'Config files:');
+        for (const cf of configFiles.slice(0, 10)) {
+            lines.push(`  ${cf.path} — ${cf.description}`);
+            try {
+                const content = parseConfigFile(cf.path, workspaceRoot);
+                lines.push('  ```');
+                for (const line of content.split('\n').slice(0, 40)) {
+                    lines.push(`  ${line}`);
+                }
+                if (content.split('\n').length > 40) {
+                    lines.push('  ... (truncated)');
+                }
+                lines.push('  ```');
+            }
+            catch (e) {
+                lines.push(`  (error reading: ${e.message})`);
+            }
+        }
+    }
+    if (inlineConfigs.length > 0) {
+        lines.push('', 'Inline config found in source:');
+        for (const ic of inlineConfigs.slice(0, 10)) {
+            lines.push(`  ${ic.file}:${ic.line}`);
+            lines.push(`    ${ic.snippet}`);
+        }
+    }
+    lines.push('');
+    lines.push('Use this evidence to determine if a security control is actually configured before reporting it as a vulnerability. A missing config file does not mean the control is absent — check inline config too.');
+    return lines.join('\n');
+}
+//# sourceMappingURL=securityConfig.js.map

package/dist/utils/securityConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityConfig.js","sourceRoot":"","sources":["../../src/utils/securityConfig.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyHH,gDA6CC;AApKD,uCAAyB;AACzB,2CAA6B;AAC7B,mCAA+C;AAU/C,MAAM,eAAe,GAA8D;IAC/E,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,mDAAmD,EAAE;IACvG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,qDAAqD,EAAE;IACjG,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,yCAAyC,EAAE;IAC3F,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,oCAAoC,EAAE;IAC3F,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,gCAAgC,EAAE;IAC5F,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,gCAAgC,EAAE;IAC5F,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,oBAAoB,EAAE;IAC3E,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,oBAAoB,EAAE;IAC3E,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,0CAA0C,EAAE;IACpG,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,0CAA0C,EAAE;IACpG,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,0CAA0C,EAAE;IACrG,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,2BAA2B,EAAE;IACtG,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE;IACtF,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE;CACzF,CAAC;AAEF,SAAS,eAAe,CAAC,aAAqB,EAAE,IAAgB;IAC5D,MAAM,GAAG,GAAiB,EAAE,CAAC;IAE7B,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,IAAI,KAAK,KAAK,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;YAAE,SAAS;QAEtD,MAAM,UAAU,GAAG;YACf,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC;SAChD,CAAC;QAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACjC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACxE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC9E,MAAM;YACV,CAAC;QACL,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACpC,OAAO,OAAO;SACT,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,IAAI,CAAC,EAAE;QACR,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,+CAA+C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3E,IAAI,QAAQ;YAAE,OAAO,GAAG,GAAG,WAAW,CAAC;QACvC,OAAO,GAAG,GAAG,MAAM,CAAC;IACxB,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,aAAqB;IAC5D,MAAM,GAAG,GAAG,IAAA,4BAAoB,EAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAEjD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACtE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,kBAAkB,CAAC,aAAqB,EAAE,IAAgB;IAC/D,MAAM,GAAG,GAAsD,EAAE,CAAC;IAClE,MAAM,QAAQ,GAAyD;QACnE,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE;QACnE,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE;QAC5D,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE;QAC5E,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,mBAAmB,EAAE;QACvE,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,2BAA2B,EAAE;QACvF,EAAE,KAAK,EAAE,mDAAmD,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE;QACpG,EAAE,KAAK,EAAE,gCAAgC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE;QAClF,EAAE,KAAK,EAAE,+BAA+B,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,iBAAiB,EAAE;QACrF,EAAE,KAAK,EAAE,4CAA4C,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,wBAAwB,EAAE;KAC5G,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACvB,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;YAAE,SAAS;QAChD,IAAI,CAAC;YACD,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;YAC3E,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBACxB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;oBACxC,GAAG,CAAC,IAAI,CAAC;wBACL,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBAC/B,IAAI,EAAE,GAAG,CAAC,IAAI;qBACjB,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;QACL,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,GAAG,CAAC;AACf,CAAC;AAEM,KAAK,UAAU,kBAAkB,CACpC,aAAqB,EACrB,OAAmB,KAAK;IAExB,MAAM,WAAW,GAAG,eAAe,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,kBAAkB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAE9D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,MAAM,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,qJAAqJ,CAAC;IACvM,CAAC;IAED,MAAM,KAAK,GAAa,CAAC,oBAAoB,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAEhF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;QAChC,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC/C,IAAI,CAAC;gBACD,MAAM,OAAO,GAAG,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;gBACxD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACpB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;oBAClD,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC5B,CAAC;gBACD,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;oBAClC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBACpC,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBACd,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;YAClD,CAAC;QACL,CAAC;IACL,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,gCAAgC,CAAC,CAAC;QACjD,KAAK,MAAM,EAAE,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,0MAA0M,CAAC,CAAC;IAEvN,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC"}

package/dist/utils/testCommandPolicy.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Test command policy — strict validation for existing-test mode of run_tests.
+ *
+ * Allows only known package-manager test commands (npm/pnpm/yarn/bun test,
+ * pytest) with optional file/pattern arguments. Rejects shell operators,
+ * arbitrary executables, lifecycle commands other than test, absolute paths
+ * outside the workspace, and path traversal.
+ *
+ * Security rules:
+ *   - No shell operators (&&, ||, ;, |, >, <, $(), backticks)
+ *   - Only the `test` lifecycle command (no build/install/publish/run/exec)
+ *   - No --shell/--script-shell escape flags
+ *   - All file paths workspace-confined via resolveWorkspacePath
+ *   - Output is a validated executable + args array (never a shell string)
+ */
+export type TestPackageManager = 'npm' | 'pnpm' | 'yarn' | 'bun' | 'pytest';
+export interface ValidatedTestCommand {
+    packageManager: TestPackageManager;
+    executable: string;
+    args: string[];
+    cwd: string;
+    selectedFiles: string[];
+    timeoutMs: number;
+}
+export interface CommandPolicyResult {
+    ok: boolean;
+    command?: ValidatedTestCommand;
+    error?: string;
+}
+export declare function validateTestCommand(input: {
+    packageManager?: string;
+    testFiles?: string[];
+    testPattern?: string;
+    timeoutMs?: number;
+}, workspaceRoot: string): CommandPolicyResult;
+export declare function formatValidatedCommand(cmd: ValidatedTestCommand): string;

package/dist/utils/testCommandPolicy.js

@@ -0,0 +1,252 @@
+"use strict";
+/**
+ * Test command policy — strict validation for existing-test mode of run_tests.
+ *
+ * Allows only known package-manager test commands (npm/pnpm/yarn/bun test,
+ * pytest) with optional file/pattern arguments. Rejects shell operators,
+ * arbitrary executables, lifecycle commands other than test, absolute paths
+ * outside the workspace, and path traversal.
+ *
+ * Security rules:
+ *   - No shell operators (&&, ||, ;, |, >, <, $(), backticks)
+ *   - Only the `test` lifecycle command (no build/install/publish/run/exec)
+ *   - No --shell/--script-shell escape flags
+ *   - All file paths workspace-confined via resolveWorkspacePath
+ *   - Output is a validated executable + args array (never a shell string)
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateTestCommand = validateTestCommand;
+exports.formatValidatedCommand = formatValidatedCommand;
+const path = __importStar(require("path"));
+const files_1 = require("./files");
+const SUPPORTED_PMS = ['npm', 'pnpm', 'yarn', 'bun', 'pytest'];
+const SHELL_OPERATORS = ['&&', '||', ';', '|', '>', '<', '$(', '`', '>&', '<&'];
+const BLOCKED_FLAGS = new Set([
+    '--shell', '--script-shell', '--foreground-scripts', '--no-shell',
+    '-S', '--bash', '--sh', '--cmd', '--exec', '--host',
+]);
+const NPM_TEST_SUBCOMMANDS = new Set(['test', 't', 'tst']);
+const NPM_FORBIDDEN_SUBCOMMANDS = new Set([
+    'run', 'run-script', 'exec', 'x', 'install', 'i', 'add', 'isntall',
+    'uninstall', 'r', 'rm', 'publish', 'unpublish', 'build', 'rebuild',
+    'start', 'stop', 'restart', 'pack', 'ci', 'fund', 'link', 'unlink',
+    'create', 'init', 'hook', 'org', 'team', 'token', 'owner', 'access',
+    'dist-tag', 'version', 'deprecate', 'profile', 'config', 'cache',
+    'clean-install', 'ci-install', 'force-clean-install',
+]);
+const MAX_PATTERN_LENGTH = 200;
+const MAX_FILES = 50;
+const DEFAULT_TIMEOUT_MS = 60_000;
+const MAX_TIMEOUT_MS = 300_000;
+function isWorkspaceRelative(p) {
+    if (!p)
+        return false;
+    if (path.isAbsolute(p))
+        return false;
+    if (p.includes('..'))
+        return false;
+    if (p.startsWith('~'))
+        return false;
+    return true;
+}
+function isSafeFilePath(p, workspaceRoot) {
+    if (!isWorkspaceRelative(p))
+        return false;
+    try {
+        (0, files_1.resolveWorkspacePath)(workspaceRoot, p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function containsShellOperators(s) {
+    return SHELL_OPERATORS.some(op => s.includes(op));
+}
+function normalizePackageManager(pm) {
+    const lower = (pm || '').toLowerCase();
+    return SUPPORTED_PMS.includes(lower) ? lower : null;
+}
+function validateTimeoutMs(timeoutMs) {
+    if (timeoutMs === undefined || timeoutMs === null)
+        return DEFAULT_TIMEOUT_MS;
+    const n = Number(timeoutMs);
+    if (!Number.isFinite(n) || n <= 0)
+        return DEFAULT_TIMEOUT_MS;
+    return Math.min(Math.floor(n), MAX_TIMEOUT_MS);
+}
+function buildNpmArgs(testFiles, testPattern) {
+    const args = ['test'];
+    if (testFiles.length > 0 || testPattern) {
+        args.push('--');
+        if (testPattern)
+            args.push(testPattern);
+        for (const f of testFiles)
+            args.push(f);
+    }
+    return args;
+}
+function buildPnpmArgs(testFiles, testPattern) {
+    const args = ['test'];
+    if (testFiles.length > 0 || testPattern) {
+        args.push('--');
+        if (testPattern)
+            args.push(testPattern);
+        for (const f of testFiles)
+            args.push(f);
+    }
+    return args;
+}
+function buildYarnArgs(testFiles, testPattern) {
+    const args = ['test'];
+    if (testPattern)
+        args.push(testPattern);
+    for (const f of testFiles)
+        args.push(f);
+    return args;
+}
+function buildBunArgs(testFiles, testPattern) {
+    const args = ['test'];
+    if (testPattern)
+        args.push(testPattern);
+    for (const f of testFiles)
+        args.push(f);
+    return args;
+}
+function buildPytestArgs(testFiles, testPattern) {
+    const args = [];
+    if (testPattern)
+        args.push('-k', testPattern);
+    for (const f of testFiles)
+        args.push(f);
+    return args;
+}
+function detectSubcommand(arg) {
+    if (NPM_TEST_SUBCOMMANDS.has(arg))
+        return 'test';
+    if (NPM_FORBIDDEN_SUBCOMMANDS.has(arg))
+        return arg;
+    return null;
+}
+function validateTestCommand(input, workspaceRoot) {
+    const pm = input.packageManager
+        ? normalizePackageManager(input.packageManager)
+        : null;
+    if (input.packageManager && !pm) {
+        return { ok: false, error: `Unsupported package manager: ${input.packageManager}. Supported: ${SUPPORTED_PMS.join(', ')}` };
+    }
+    const testFilesRaw = Array.isArray(input.testFiles) ? input.testFiles : [];
+    if (testFilesRaw.length > MAX_FILES) {
+        return { ok: false, error: `Too many test files (max ${MAX_FILES})` };
+    }
+    const testPattern = input.testPattern;
+    if (testPattern !== undefined && testPattern !== null) {
+        if (typeof testPattern !== 'string') {
+            return { ok: false, error: 'testPattern must be a string' };
+        }
+        if (testPattern.length > MAX_PATTERN_LENGTH) {
+            return { ok: false, error: `testPattern too long (max ${MAX_PATTERN_LENGTH} chars)` };
+        }
+        if (containsShellOperators(testPattern)) {
+            return { ok: false, error: `testPattern contains forbidden shell operators` };
+        }
+    }
+    const testFiles = [];
+    for (const f of testFilesRaw) {
+        if (typeof f !== 'string' || f.length === 0) {
+            return { ok: false, error: 'testFiles must be non-empty strings' };
+        }
+        if (containsShellOperators(f)) {
+            return { ok: false, error: `test file path contains forbidden shell operators: ${f}` };
+        }
+        if (!isSafeFilePath(f, workspaceRoot)) {
+            return { ok: false, error: `test file path is outside workspace or unsafe: ${f}` };
+        }
+        testFiles.push(f.replace(/\\/g, '/'));
+    }
+    const timeoutMs = validateTimeoutMs(input.timeoutMs);
+    const packageManager = pm || 'npm';
+    let executable;
+    let args;
+    switch (packageManager) {
+        case 'npm':
+            executable = 'npm';
+            args = buildNpmArgs(testFiles, testPattern);
+            break;
+        case 'pnpm':
+            executable = 'pnpm';
+            args = buildPnpmArgs(testFiles, testPattern);
+            break;
+        case 'yarn':
+            executable = 'yarn';
+            args = buildYarnArgs(testFiles, testPattern);
+            break;
+        case 'bun':
+            executable = 'bun';
+            args = buildBunArgs(testFiles, testPattern);
+            break;
+        case 'pytest':
+            executable = 'pytest';
+            args = buildPytestArgs(testFiles, testPattern);
+            break;
+        default:
+            return { ok: false, error: `Unhandled package manager: ${packageManager}` };
+    }
+    for (const a of args) {
+        if (BLOCKED_FLAGS.has(a)) {
+            return { ok: false, error: `Forbidden flag in test command: ${a}` };
+        }
+    }
+    const sub = detectSubcommand(args[0] || '');
+    if (sub && sub !== 'test') {
+        return { ok: false, error: `Forbidden npm subcommand: ${sub}. Only "test" is allowed.` };
+    }
+    return {
+        ok: true,
+        command: {
+            packageManager,
+            executable,
+            args,
+            cwd: workspaceRoot,
+            selectedFiles: testFiles,
+            timeoutMs,
+        },
+    };
+}
+function formatValidatedCommand(cmd) {
+    return `${cmd.executable} ${cmd.args.join(' ')}`;
+}
+//# sourceMappingURL=testCommandPolicy.js.map

package/dist/utils/testCommandPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testCommandPolicy.js","sourceRoot":"","sources":["../../src/utils/testCommandPolicy.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgIH,kDAoGC;AAED,wDAEC;AAtOD,2CAA6B;AAC7B,mCAA+C;AAmB/C,MAAM,aAAa,GAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;AAErF,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAEhF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC1B,SAAS,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,YAAY;IACjE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ;CACtD,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3D,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACtC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS;IAClE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS;IAClE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ;IAClE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ;IACnE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO;IAChE,eAAe,EAAE,YAAY,EAAE,qBAAqB;CACvD,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,SAAS,mBAAmB,CAAC,CAAS;IAClC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,CAAS,EAAE,aAAqB;IACpD,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC;QACD,IAAA,4BAAoB,EAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,CAAS;IACrC,OAAO,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,uBAAuB,CAAC,EAAU;IACvC,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvC,OAAO,aAAa,CAAC,QAAQ,CAAC,KAA2B,CAAC,CAAC,CAAC,CAAE,KAA4B,CAAC,CAAC,CAAC,IAAI,CAAC;AACtG,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAc;IACrC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,kBAAkB,CAAC;IAC7E,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,kBAAkB,CAAC;IAC7D,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,YAAY,CAAC,SAAmB,EAAE,WAA+B;IACtE,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,IAAI,WAAW;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,SAAmB,EAAE,WAA+B;IACvE,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,IAAI,WAAW;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,SAAmB,EAAE,WAA+B;IACvE,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,IAAI,WAAW;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,SAAmB,EAAE,WAA+B;IACtE,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,IAAI,WAAW;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,SAAmB,EAAE,WAA+B;IACzE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,WAAW;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACjC,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACjD,IAAI,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACnD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAgB,mBAAmB,CAC/B,KAKC,EACD,aAAqB;IAErB,MAAM,EAAE,GAAG,KAAK,CAAC,cAAc;QAC3B,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,cAAc,CAAC;QAC/C,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,EAAE,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,KAAK,CAAC,cAAc,gBAAgB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAChI,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,IAAI,YAAY,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,SAAS,GAAG,EAAE,CAAC;IAC1E,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACpD,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,kBAAkB,SAAS,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,sBAAsB,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;QAClF,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;QACvE,CAAC;QACD,IAAI,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sDAAsD,CAAC,EAAE,EAAE,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kDAAkD,CAAC,EAAE,EAAE,CAAC;QACvF,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,EAAE,IAAI,KAAK,CAAC;IACnC,IAAI,UAAkB,CAAC;IACvB,IAAI,IAAc,CAAC;IAEnB,QAAQ,cAAc,EAAE,CAAC;QACrB,KAAK,KAAK;YACN,UAAU,GAAG,KAAK,CAAC;YACnB,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAC5C,MAAM;QACV,KAAK,MAAM;YACP,UAAU,GAAG,MAAM,CAAC;YACpB,IAAI,GAAG,aAAa,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAC7C,MAAM;QACV,KAAK,MAAM;YACP,UAAU,GAAG,MAAM,CAAC;YACpB,IAAI,GAAG,aAAa,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAC7C,MAAM;QACV,KAAK,KAAK;YACN,UAAU,GAAG,KAAK,CAAC;YACnB,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAC5C,MAAM;QACV,KAAK,QAAQ;YACT,UAAU,GAAG,QAAQ,CAAC;YACtB,IAAI,GAAG,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAC/C,MAAM;QACV;YACI,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,cAAc,EAAE,EAAE,CAAC;IACpF,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACnB,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,CAAC,EAAE,EAAE,CAAC;QACxE,CAAC;IACL,CAAC;IAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,IAAI,GAAG,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,GAAG,2BAA2B,EAAE,CAAC;IAC7F,CAAC;IAED,OAAO;QACH,EAAE,EAAE,IAAI;QACR,OAAO,EAAE;YACL,cAAc;YACd,UAAU;YACV,IAAI;YACJ,GAAG,EAAE,aAAa;YAClB,aAAa,EAAE,SAAS;YACxB,SAAS;SACZ;KACJ,CAAC;AACN,CAAC;AAED,SAAgB,sBAAsB,CAAC,GAAyB;IAC5D,OAAO,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACrD,CAAC"}

package/dist/utils/testRunner.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Shared test runner — the core service for run_tests (both public MCP tool
+ * and agent action). Handles:
+ *   - Request validation
+ *   - Human approval (every execution, no exceptions)
+ *   - Sandbox execution via localTestRunner (generated) or runTestCommand (existing)
+ *   - Bounded, redacted output
+ *
+ * Security model:
+ *   - Approval is required before every execution — no batch grants, no timed grants.
+ *   - The approval hash binds to mode, command/script hash, runner, timeout, workspace.
+ *   - No execution occurs if approval is denied or times out.
+ *   - No host fallback when no sandbox is available.
+ */
+import { ApprovalBroker } from '../approval/broker';
+import { type ValidatedTestCommand } from './testCommandPolicy';
+export type RunTestsMode = 'existing' | 'generated';
+export interface RunTestsRequest {
+    mode: RunTestsMode;
+    testFiles?: string[];
+    testPattern?: string;
+    packageManager?: string;
+    script?: string;
+    runner?: string;
+    setupScript?: string;
+    timeoutMs?: number;
+}
+export type RunTestsStatus = 'passed' | 'failed' | 'error' | 'timeout' | 'blocked' | 'sandbox-unavailable' | 'denied';
+export interface RunTestsResult {
+    approved: boolean;
+    requestId?: string;
+    mode: RunTestsMode;
+    status: RunTestsStatus;
+    exitCode: number;
+    output: string;
+    backend?: string;
+    command?: {
+        executable: string;
+        args: string[];
+    };
+    durationMs: number;
+}
+export interface ValidationFailure {
+    ok: false;
+    error: string;
+}
+export declare function validateRunTestsRequest(req: RunTestsRequest, workspaceRoot: string): {
+    ok: true;
+    command?: ValidatedTestCommand;
+} | ValidationFailure;
+export declare function runTests(req: RunTestsRequest, workspaceRoot: string, options?: {
+    signal?: AbortSignal;
+    sandboxBackend?: any;
+    /** Skip approval — for agent executor internal use only when the broker is managed externally. */
+    broker?: ApprovalBroker;
+}): Promise<RunTestsResult>;