@toolkit-cli/toolkode 1.3.7

package/test/file/path-traversal.test.ts

@@ -0,0 +1,198 @@
+import { test, expect, describe } from "bun:test"
+import path from "path"
+import fs from "fs/promises"
+import { Filesystem } from "../../src/util/filesystem"
+import { File } from "../../src/file"
+import { Instance } from "../../src/project/instance"
+import { tmpdir } from "../fixture/fixture"
+
+describe("Filesystem.contains", () => {
+  test("allows paths within project", () => {
+    expect(Filesystem.contains("/project", "/project/src")).toBe(true)
+    expect(Filesystem.contains("/project", "/project/src/file.ts")).toBe(true)
+    expect(Filesystem.contains("/project", "/project")).toBe(true)
+  })
+
+  test("blocks ../ traversal", () => {
+    expect(Filesystem.contains("/project", "/project/../etc")).toBe(false)
+    expect(Filesystem.contains("/project", "/project/src/../../etc")).toBe(false)
+    expect(Filesystem.contains("/project", "/etc/passwd")).toBe(false)
+  })
+
+  test("blocks absolute paths outside project", () => {
+    expect(Filesystem.contains("/project", "/etc/passwd")).toBe(false)
+    expect(Filesystem.contains("/project", "/tmp/file")).toBe(false)
+    expect(Filesystem.contains("/home/user/project", "/home/user/other")).toBe(false)
+  })
+
+  test("handles prefix collision edge cases", () => {
+    expect(Filesystem.contains("/project", "/project-other/file")).toBe(false)
+    expect(Filesystem.contains("/project", "/projectfile")).toBe(false)
+  })
+})
+
+/*
+ * Integration tests for File.read() and File.list() path traversal protection.
+ *
+ * These tests verify the HTTP API code path is protected. The HTTP endpoints
+ * in server.ts (GET /file/content, GET /file) call File.read()/File.list()
+ * directly - they do NOT go through ReadTool or the agent permission layer.
+ *
+ * This is a SEPARATE code path from ReadTool, which has its own checks.
+ */
+describe("File.read path traversal protection", () => {
+  test("rejects ../ traversal attempting to read /etc/passwd", async () => {
+    await using tmp = await tmpdir({
+      init: async (dir) => {
+        await Bun.write(path.join(dir, "allowed.txt"), "allowed content")
+      },
+    })
+
+    await Instance.provide({
+      directory: tmp.path,
+      fn: async () => {
+        await expect(File.read("../../../etc/passwd")).rejects.toThrow("Access denied: path escapes project directory")
+      },
+    })
+  })
+
+  test("rejects deeply nested traversal", async () => {
+    await using tmp = await tmpdir()
+
+    await Instance.provide({
+      directory: tmp.path,
+      fn: async () => {
+        await expect(File.read("src/nested/../../../../../../../etc/passwd")).rejects.toThrow(
+          "Access denied: path escapes project directory",
+        )
+      },
+    })
+  })
+
+  test("allows valid paths within project", async () => {
+    await using tmp = await tmpdir({
+      init: async (dir) => {
+        await Bun.write(path.join(dir, "valid.txt"), "valid content")
+      },
+    })
+
+    await Instance.provide({
+      directory: tmp.path,
+      fn: async () => {
+        const result = await File.read("valid.txt")
+        expect(result.content).toBe("valid content")
+      },
+    })
+  })
+})
+
+describe("File.list path traversal protection", () => {
+  test("rejects ../ traversal attempting to list /etc", async () => {
+    await using tmp = await tmpdir()
+
+    await Instance.provide({
+      directory: tmp.path,
+      fn: async () => {
+        await expect(File.list("../../../etc")).rejects.toThrow("Access denied: path escapes project directory")
+      },
+    })
+  })
+
+  test("allows valid subdirectory listing", async () => {
+    await using tmp = await tmpdir({
+      init: async (dir) => {
+        await Bun.write(path.join(dir, "subdir", "file.txt"), "content")
+      },
+    })
+
+    await Instance.provide({
+      directory: tmp.path,
+      fn: async () => {
+        const result = await File.list("subdir")
+        expect(Array.isArray(result)).toBe(true)
+      },
+    })
+  })
+})
+
+describe("Instance.containsPath", () => {
+  test("returns true for path inside directory", async () => {
+    await using tmp = await tmpdir({ git: true })
+
+    await Instance.provide({
+      directory: tmp.path,
+      fn: () => {
+        expect(Instance.containsPath(path.join(tmp.path, "foo.txt"))).toBe(true)
+        expect(Instance.containsPath(path.join(tmp.path, "src", "file.ts"))).toBe(true)
+      },
+    })
+  })
+
+  test("returns true for path inside worktree but outside directory (monorepo subdirectory scenario)", async () => {
+    await using tmp = await tmpdir({ git: true })
+    const subdir = path.join(tmp.path, "packages", "lib")
+    await fs.mkdir(subdir, { recursive: true })
+
+    await Instance.provide({
+      directory: subdir,
+      fn: () => {
+        // .opencode at worktree root, but we're running from packages/lib
+        expect(Instance.containsPath(path.join(tmp.path, ".opencode", "state"))).toBe(true)
+        // sibling package should also be accessible
+        expect(Instance.containsPath(path.join(tmp.path, "packages", "other", "file.ts"))).toBe(true)
+        // worktree root itself
+        expect(Instance.containsPath(tmp.path)).toBe(true)
+      },
+    })
+  })
+
+  test("returns false for path outside both directory and worktree", async () => {
+    await using tmp = await tmpdir({ git: true })
+
+    await Instance.provide({
+      directory: tmp.path,
+      fn: () => {
+        expect(Instance.containsPath("/etc/passwd")).toBe(false)
+        expect(Instance.containsPath("/tmp/other-project")).toBe(false)
+      },
+    })
+  })
+
+  test("returns false for path with .. escaping worktree", async () => {
+    await using tmp = await tmpdir({ git: true })
+
+    await Instance.provide({
+      directory: tmp.path,
+      fn: () => {
+        expect(Instance.containsPath(path.join(tmp.path, "..", "escape.txt"))).toBe(false)
+      },
+    })
+  })
+
+  test("handles directory === worktree (running from repo root)", async () => {
+    await using tmp = await tmpdir({ git: true })
+
+    await Instance.provide({
+      directory: tmp.path,
+      fn: () => {
+        expect(Instance.directory).toBe(Instance.worktree)
+        expect(Instance.containsPath(path.join(tmp.path, "file.txt"))).toBe(true)
+        expect(Instance.containsPath("/etc/passwd")).toBe(false)
+      },
+    })
+  })
+
+  test("non-git project does not allow arbitrary paths via worktree='/'", async () => {
+    await using tmp = await tmpdir() // no git: true
+
+    await Instance.provide({
+      directory: tmp.path,
+      fn: () => {
+        // worktree is "/" for non-git projects, but containsPath should NOT allow all paths
+        expect(Instance.containsPath(path.join(tmp.path, "file.txt"))).toBe(true)
+        expect(Instance.containsPath("/etc/passwd")).toBe(false)
+        expect(Instance.containsPath("/tmp/other")).toBe(false)
+      },
+    })
+  })
+})

package/test/file/ripgrep.test.ts

@@ -0,0 +1,54 @@
+import { describe, expect, test } from "bun:test"
+import fs from "fs/promises"
+import path from "path"
+import { tmpdir } from "../fixture/fixture"
+import { Ripgrep } from "../../src/file/ripgrep"
+
+describe("file.ripgrep", () => {
+  test("defaults to include hidden", async () => {
+    await using tmp = await tmpdir({
+      init: async (dir) => {
+        await Bun.write(path.join(dir, "visible.txt"), "hello")
+        await fs.mkdir(path.join(dir, ".opencode"), { recursive: true })
+        await Bun.write(path.join(dir, ".opencode", "thing.json"), "{}")
+      },
+    })
+
+    const files = await Array.fromAsync(Ripgrep.files({ cwd: tmp.path }))
+    const hasVisible = files.includes("visible.txt")
+    const hasHidden = files.includes(path.join(".opencode", "thing.json"))
+    expect(hasVisible).toBe(true)
+    expect(hasHidden).toBe(true)
+  })
+
+  test("hidden false excludes hidden", async () => {
+    await using tmp = await tmpdir({
+      init: async (dir) => {
+        await Bun.write(path.join(dir, "visible.txt"), "hello")
+        await fs.mkdir(path.join(dir, ".opencode"), { recursive: true })
+        await Bun.write(path.join(dir, ".opencode", "thing.json"), "{}")
+      },
+    })
+
+    const files = await Array.fromAsync(Ripgrep.files({ cwd: tmp.path, hidden: false }))
+    const hasVisible = files.includes("visible.txt")
+    const hasHidden = files.includes(path.join(".opencode", "thing.json"))
+    expect(hasVisible).toBe(true)
+    expect(hasHidden).toBe(false)
+  })
+
+  test("search returns empty when nothing matches", async () => {
+    await using tmp = await tmpdir({
+      init: async (dir) => {
+        await Bun.write(path.join(dir, "match.ts"), "const value = 'other'\n")
+      },
+    })
+
+    const hits = await Ripgrep.search({
+      cwd: tmp.path,
+      pattern: "needle",
+    })
+
+    expect(hits).toEqual([])
+  })
+})

package/test/file/time.test.ts

@@ -0,0 +1,354 @@
+import { describe, test, expect, afterEach } from "bun:test"
+import path from "path"
+import fs from "fs/promises"
+import { FileTime } from "../../src/file/time"
+import { Instance } from "../../src/project/instance"
+import { SessionID } from "../../src/session/schema"
+import { Filesystem } from "../../src/util/filesystem"
+import { tmpdir } from "../fixture/fixture"
+
+afterEach(async () => {
+  await Instance.disposeAll()
+})
+
+async function touch(file: string, time: number) {
+  const date = new Date(time)
+  await fs.utimes(file, date, date)
+}
+
+function gate() {
+  let open!: () => void
+  const wait = new Promise<void>((resolve) => {
+    open = resolve
+  })
+  return { open, wait }
+}
+
+describe("file/time", () => {
+  const sessionID = SessionID.make("ses_00000000000000000000000001")
+
+  describe("read() and get()", () => {
+    test("stores read timestamp", async () => {
+      await using tmp = await tmpdir()
+      const filepath = path.join(tmp.path, "file.txt")
+      await fs.writeFile(filepath, "content", "utf-8")
+
+      await Instance.provide({
+        directory: tmp.path,
+        fn: async () => {
+          const before = await FileTime.get(sessionID, filepath)
+          expect(before).toBeUndefined()
+
+          await FileTime.read(sessionID, filepath)
+
+          const after = await FileTime.get(sessionID, filepath)
+          expect(after).toBeInstanceOf(Date)
+          expect(after!.getTime()).toBeGreaterThan(0)
+        },
+      })
+    })
+
+    test("tracks separate timestamps per session", async () => {
+      await using tmp = await tmpdir()
+      const filepath = path.join(tmp.path, "file.txt")
+      await fs.writeFile(filepath, "content", "utf-8")
+
+      await Instance.provide({
+        directory: tmp.path,
+        fn: async () => {
+          await FileTime.read(SessionID.make("ses_00000000000000000000000002"), filepath)
+          await FileTime.read(SessionID.make("ses_00000000000000000000000003"), filepath)
+
+          const time1 = await FileTime.get(SessionID.make("ses_00000000000000000000000002"), filepath)
+          const time2 = await FileTime.get(SessionID.make("ses_00000000000000000000000003"), filepath)
+
+          expect(time1).toBeDefined()
+          expect(time2).toBeDefined()
+        },
+      })
+    })
+
+    test("updates timestamp on subsequent reads", async () => {
+      await using tmp = await tmpdir()
+      const filepath = path.join(tmp.path, "file.txt")
+      await fs.writeFile(filepath, "content", "utf-8")
+
+      await Instance.provide({
+        directory: tmp.path,
+        fn: async () => {
+          await FileTime.read(sessionID, filepath)
+          const first = await FileTime.get(sessionID, filepath)
+
+          await FileTime.read(sessionID, filepath)
+          const second = await FileTime.get(sessionID, filepath)
+
+          expect(second!.getTime()).toBeGreaterThanOrEqual(first!.getTime())
+        },
+      })
+    })
+
+    test("isolates reads by directory", async () => {
+      await using one = await tmpdir()
+      await using two = await tmpdir()
+      await using shared = await tmpdir()
+      const filepath = path.join(shared.path, "file.txt")
+      await fs.writeFile(filepath, "content", "utf-8")
+
+      await Instance.provide({
+        directory: one.path,
+        fn: async () => {
+          await FileTime.read(sessionID, filepath)
+        },
+      })
+
+      await Instance.provide({
+        directory: two.path,
+        fn: async () => {
+          expect(await FileTime.get(sessionID, filepath)).toBeUndefined()
+        },
+      })
+    })
+  })
+
+  describe("assert()", () => {
+    test("passes when file has not been modified", async () => {
+      await using tmp = await tmpdir()
+      const filepath = path.join(tmp.path, "file.txt")
+      await fs.writeFile(filepath, "content", "utf-8")
+      await touch(filepath, 1_000)
+
+      await Instance.provide({
+        directory: tmp.path,
+        fn: async () => {
+          await FileTime.read(sessionID, filepath)
+          await FileTime.assert(sessionID, filepath)
+        },
+      })
+    })
+
+    test("throws when file was not read first", async () => {
+      await using tmp = await tmpdir()
+      const filepath = path.join(tmp.path, "file.txt")
+      await fs.writeFile(filepath, "content", "utf-8")
+
+      await Instance.provide({
+        directory: tmp.path,
+        fn: async () => {
+          await expect(FileTime.assert(sessionID, filepath)).rejects.toThrow("You must read file")
+        },
+      })
+    })
+
+    test("throws when file was modified after read", async () => {
+      await using tmp = await tmpdir()
+      const filepath = path.join(tmp.path, "file.txt")
+      await fs.writeFile(filepath, "content", "utf-8")
+      await touch(filepath, 1_000)
+
+      await Instance.provide({
+        directory: tmp.path,
+        fn: async () => {
+          await FileTime.read(sessionID, filepath)
+          await fs.writeFile(filepath, "modified content", "utf-8")
+          await touch(filepath, 2_000)
+          await expect(FileTime.assert(sessionID, filepath)).rejects.toThrow("modified since it was last read")
+        },
+      })
+    })
+
+    test("includes timestamps in error message", async () => {
+      await using tmp = await tmpdir()
+      const filepath = path.join(tmp.path, "file.txt")
+      await fs.writeFile(filepath, "content", "utf-8")
+      await touch(filepath, 1_000)
+
+      await Instance.provide({
+        directory: tmp.path,
+        fn: async () => {
+          await FileTime.read(sessionID, filepath)
+          await fs.writeFile(filepath, "modified", "utf-8")
+          await touch(filepath, 2_000)
+
+          let error: Error | undefined
+          try {
+            await FileTime.assert(sessionID, filepath)
+          } catch (e) {
+            error = e as Error
+          }
+          expect(error).toBeDefined()
+          expect(error!.message).toContain("Last modification:")
+          expect(error!.message).toContain("Last read:")
+        },
+      })
+    })
+  })
+
+  describe("withLock()", () => {
+    test("executes function within lock", async () => {
+      await using tmp = await tmpdir()
+      const filepath = path.join(tmp.path, "file.txt")
+
+      await Instance.provide({
+        directory: tmp.path,
+        fn: async () => {
+          let executed = false
+          await FileTime.withLock(filepath, async () => {
+            executed = true
+            return "result"
+          })
+          expect(executed).toBe(true)
+        },
+      })
+    })
+
+    test("returns function result", async () => {
+      await using tmp = await tmpdir()
+      const filepath = path.join(tmp.path, "file.txt")
+
+      await Instance.provide({
+        directory: tmp.path,
+        fn: async () => {
+          const result = await FileTime.withLock(filepath, async () => {
+            return "success"
+          })
+          expect(result).toBe("success")
+        },
+      })
+    })
+
+    test("serializes concurrent operations on same file", async () => {
+      await using tmp = await tmpdir()
+      const filepath = path.join(tmp.path, "file.txt")
+
+      await Instance.provide({
+        directory: tmp.path,
+        fn: async () => {
+          const order: number[] = []
+          const hold = gate()
+          const ready = gate()
+
+          const op1 = FileTime.withLock(filepath, async () => {
+            order.push(1)
+            ready.open()
+            await hold.wait
+            order.push(2)
+          })
+
+          await ready.wait
+
+          const op2 = FileTime.withLock(filepath, async () => {
+            order.push(3)
+            order.push(4)
+          })
+
+          hold.open()
+
+          await Promise.all([op1, op2])
+          expect(order).toEqual([1, 2, 3, 4])
+        },
+      })
+    })
+
+    test("allows concurrent operations on different files", async () => {
+      await using tmp = await tmpdir()
+      const filepath1 = path.join(tmp.path, "file1.txt")
+      const filepath2 = path.join(tmp.path, "file2.txt")
+
+      await Instance.provide({
+        directory: tmp.path,
+        fn: async () => {
+          let started1 = false
+          let started2 = false
+          const hold = gate()
+          const ready = gate()
+
+          const op1 = FileTime.withLock(filepath1, async () => {
+            started1 = true
+            ready.open()
+            await hold.wait
+            expect(started2).toBe(true)
+          })
+
+          await ready.wait
+
+          const op2 = FileTime.withLock(filepath2, async () => {
+            started2 = true
+            hold.open()
+          })
+
+          await Promise.all([op1, op2])
+          expect(started1).toBe(true)
+          expect(started2).toBe(true)
+        },
+      })
+    })
+
+    test("releases lock even if function throws", async () => {
+      await using tmp = await tmpdir()
+      const filepath = path.join(tmp.path, "file.txt")
+
+      await Instance.provide({
+        directory: tmp.path,
+        fn: async () => {
+          await expect(
+            FileTime.withLock(filepath, async () => {
+              throw new Error("Test error")
+            }),
+          ).rejects.toThrow("Test error")
+
+          let executed = false
+          await FileTime.withLock(filepath, async () => {
+            executed = true
+          })
+          expect(executed).toBe(true)
+        },
+      })
+    })
+  })
+
+  describe("stat() Filesystem.stat pattern", () => {
+    test("reads file modification time via Filesystem.stat()", async () => {
+      await using tmp = await tmpdir()
+      const filepath = path.join(tmp.path, "file.txt")
+      await fs.writeFile(filepath, "content", "utf-8")
+      await touch(filepath, 1_000)
+
+      await Instance.provide({
+        directory: tmp.path,
+        fn: async () => {
+          await FileTime.read(sessionID, filepath)
+
+          const stats = Filesystem.stat(filepath)
+          expect(stats?.mtime).toBeInstanceOf(Date)
+          expect(stats!.mtime.getTime()).toBeGreaterThan(0)
+
+          await FileTime.assert(sessionID, filepath)
+        },
+      })
+    })
+
+    test("detects modification via stat mtime", async () => {
+      await using tmp = await tmpdir()
+      const filepath = path.join(tmp.path, "file.txt")
+      await fs.writeFile(filepath, "original", "utf-8")
+      await touch(filepath, 1_000)
+
+      await Instance.provide({
+        directory: tmp.path,
+        fn: async () => {
+          await FileTime.read(sessionID, filepath)
+
+          const originalStat = Filesystem.stat(filepath)
+
+          await fs.writeFile(filepath, "modified", "utf-8")
+          await touch(filepath, 2_000)
+
+          const newStat = Filesystem.stat(filepath)
+          expect(newStat!.mtime.getTime()).toBeGreaterThan(originalStat!.mtime.getTime())
+
+          await expect(FileTime.assert(sessionID, filepath)).rejects.toThrow()
+        },
+      })
+    })
+  })
+})