@sun-asterisk/sungen 3.2.35 → 3.3.0-alpha.10

package/src/orchestrator/templates/specs-test-data.ts

@@ -329,19 +329,7 @@ function resolveDynamicVars(data: Record<string, any>): Record<string, any> {
   const ts = String(Date.now());
   const uid = crypto.randomUUID();
   const now = new Date();
-  // `{{$date}}` is the runner's LOCAL calendar date — the "today" the browser sees when
-  // playwright.config sets no `timezoneId`. toISOString() is UTC, so east of Greenwich it named
-  // yesterday until the offset passed (00:00–06:59 at UTC+7). Node reads the `TZ` env var, so a
-  // config that pins `timezoneId` pins this too by exporting the same zone as `TZ`.
-  // `{{$datetime}}` stays an ISO-8601 UTC instant: it names a moment, not a calendar day.
-  const pad = (n: number): string => String(n).padStart(2, '0');
-  // `{{$date:+1d}}` / `{{$date:-7d}}` shift by whole days; built from the local Y/M/D, so it stays
-  // the right calendar day across a DST change.
-  const localDate = (offsetDays: number): string => {
-    const d = new Date(now.getFullYear(), now.getMonth(), now.getDate() + offsetDays);
-    return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`;
-  };
-  const date = localDate(0);
+  const date = now.toISOString().split('T')[0];
   const datetime = now.toISOString();
 
   function resolveValue(value: any): any {
@@ -356,16 +344,10 @@ function resolveDynamicVars(data: Record<string, any>): Record<string, any> {
             const [min, max] = (args || '1:9999').split(':').map(Number);
             return String(Math.floor(Math.random() * (max - min + 1)) + min);
           }
-          case 'date': {
-            // An argument this does not understand stays literal, like an unknown variable — it used
-            // to be ignored, so `{{$date:+1d}}` silently produced today. Up to 5 digits (~270 years):
-            // a typo like +99999999999d would build an Invalid Date.
-            if (!args) return date;
-            const off = /^([+-]\d{1,5})d$/.exec(args.trim());
-            return off ? localDate(Number(off[1])) : match;
-          }
+          case 'date':
+            return date;
           case 'datetime':
-            return args ? match : datetime;
+            return datetime;
           default:
             return match;
         }

package/src/utils/safe-yaml-parse.ts

@@ -0,0 +1,44 @@
+/**
+ * Parse YAML that a person or an agent wrote into `qa/` — decisions, test-basis, locks — without
+ * letting the file attack the reader (red-team #14, DOS-13.8).
+ *
+ * - `maxAliasCount` small: a "billion laughs" document that multiplies one anchor through nested
+ *   aliases is refused instead of expanding to gigabytes. None of these files has a reason to
+ *   alias at all; a handful is allowed so a hand-written file with one shared block still reads.
+ * - YAML **core** schema and nothing else: `!!binary`, `!!timestamp`, `!!js/…` or any custom tag is
+ *   an error (the library would otherwise resolve "known" extra tags even under core), and yaml-1.1
+ *   merge keys (`<<`) are not merged. `2026-10-21` stays the string it was written as, so a hash
+ *   over the parsed value equals a hash over the text's intent.
+ * - duplicate keys are an error: two `reason:` lines must not let the second silently win.
+ * - a byte cap: these files are a few hundred bytes; a 100 MB one is an attack or an accident.
+ */
+import { parseDocument } from 'yaml';
+
+export const SAFE_YAML_MAX_ALIAS_COUNT = 10;
+export const SAFE_YAML_MAX_BYTES = 1024 * 1024;
+
+export class UnsafeYamlError extends Error {
+  constructor(public readonly source: string, detail: string) {
+    super(`${source}: ${detail}`);
+    this.name = 'UnsafeYamlError';
+  }
+}
+
+export function safeYamlParse(text: string, source = '<yaml>'): unknown {
+  if (Buffer.byteLength(text, 'utf8') > SAFE_YAML_MAX_BYTES) {
+    throw new UnsafeYamlError(source, `larger than ${SAFE_YAML_MAX_BYTES} bytes`);
+  }
+  let doc: ReturnType<typeof parseDocument>;
+  try {
+    doc = parseDocument(text, { schema: 'core', resolveKnownTags: false, merge: false, uniqueKeys: true, strict: true, prettyErrors: false });
+  } catch (err) {
+    throw new UnsafeYamlError(source, err instanceof Error ? err.message : String(err));
+  }
+  const problem = doc.errors[0] ?? doc.warnings[0];   // an unresolved tag is only a warning to the library
+  if (problem) throw new UnsafeYamlError(source, problem.message);
+  try {
+    return doc.toJS({ maxAliasCount: SAFE_YAML_MAX_ALIAS_COUNT });
+  } catch (err) {
+    throw new UnsafeYamlError(source, err instanceof Error ? err.message : String(err));
+  }
+}

package/dist/generators/test-generator/adapters/appium/templates/steps/assertions/expanded-assertion.hbs

@@ -1,2 +0,0 @@
-{{!-- aria-expanded has no native-mobile equivalent; the appium expand action is a bare tap. --}}
-throw new Error("[sungen] 'is expanded' / 'is collapsed' (aria-expanded) is web-only and has no native-mobile equivalent. Assert what the open panel shows instead (e.g. see [X] section), or tag this scenario @manual.");

package/dist/generators/test-generator/adapters/playwright/templates/steps/actions/date-picker-unsupported.hbs

@@ -1,5 +0,0 @@
-{{!-- A date-picker whose trigger is a <button> (a calendar popover, #907) has no value to type:
-      fill() throws "Element is not an <input>". With no recipe there is no honest compilation, so
-      fail loud and name the way forward — the appium twin of this template does the same for a
-      native picker dialog. --}}
-throw new Error('[sungen] {{escapeQuotes reason}}');

package/dist/generators/test-generator/adapters/playwright/templates/steps/assertions/expanded-assertion.hbs

@@ -1,12 +0,0 @@
-{{!-- `see [X] is expanded | is collapsed` (#911). Reads the signal expand-action.hbs drives — a class
-      on a descendant, a declared boolean attribute, else aria-expanded — but with no "only if the
-      element exposes it" escape: an assertion that can skip itself asserts nothing. --}}
-{{#if expanded.class}}
-{{#if (eq direction 'expand')}}
-await expect({{> locator}}.locator('.{{escapeQuotes expanded.class}}')).toBeVisible();
-{{~else~}}
-await expect({{> locator}}.locator('.{{escapeQuotes expanded.class}}')).toHaveCount(0);
-{{~/if}}
-{{~else~}}
-await expect({{> locator}}).toHaveAttribute('{{#if expanded.attribute}}{{escapeQuotes expanded.attribute}}{{else}}aria-expanded{{/if}}', '{{#if (eq direction 'expand')}}true{{else}}false{{/if}}');
-{{~/if}}

package/src/generators/test-generator/adapters/appium/templates/steps/assertions/expanded-assertion.hbs

@@ -1,2 +0,0 @@
-{{!-- aria-expanded has no native-mobile equivalent; the appium expand action is a bare tap. --}}
-throw new Error("[sungen] 'is expanded' / 'is collapsed' (aria-expanded) is web-only and has no native-mobile equivalent. Assert what the open panel shows instead (e.g. see [X] section), or tag this scenario @manual.");

package/src/generators/test-generator/adapters/playwright/templates/steps/actions/date-picker-unsupported.hbs

@@ -1,5 +0,0 @@
-{{!-- A date-picker whose trigger is a <button> (a calendar popover, #907) has no value to type:
-      fill() throws "Element is not an <input>". With no recipe there is no honest compilation, so
-      fail loud and name the way forward — the appium twin of this template does the same for a
-      native picker dialog. --}}
-throw new Error('[sungen] {{escapeQuotes reason}}');

package/src/generators/test-generator/adapters/playwright/templates/steps/assertions/expanded-assertion.hbs

@@ -1,12 +0,0 @@
-{{!-- `see [X] is expanded | is collapsed` (#911). Reads the signal expand-action.hbs drives — a class
-      on a descendant, a declared boolean attribute, else aria-expanded — but with no "only if the
-      element exposes it" escape: an assertion that can skip itself asserts nothing. --}}
-{{#if expanded.class}}
-{{#if (eq direction 'expand')}}
-await expect({{> locator}}.locator('.{{escapeQuotes expanded.class}}')).toBeVisible();
-{{~else~}}
-await expect({{> locator}}.locator('.{{escapeQuotes expanded.class}}')).toHaveCount(0);
-{{~/if}}
-{{~else~}}
-await expect({{> locator}}).toHaveAttribute('{{#if expanded.attribute}}{{escapeQuotes expanded.attribute}}{{else}}aria-expanded{{/if}}', '{{#if (eq direction 'expand')}}true{{else}}false{{/if}}');
-{{~/if}}