@winspan/claude-forge 8.41.0 → 8.50.6

package/tests/unit/router.test.ts

@@ -0,0 +1,138 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { createMockAI, createFailingMockAI } from '../helpers/mock-ai.js';
+
+describe('Router - Agent Routing', () => {
+  describe('MockAIProvider', () => {
+    it('should return mock response', async () => {
+      const ai = createMockAI('test response');
+      const result = await ai.complete('test prompt');
+      expect(result).toBe('test response');
+    });
+
+    it('should track call history', async () => {
+      const ai = createMockAI('response');
+      await ai.complete('prompt 1');
+      await ai.complete('prompt 2');
+
+      expect(ai.getCallCount()).toBe(2);
+      expect(ai.getLastPrompt()).toBe('prompt 2');
+    });
+
+    it('should return multiple responses in sequence', async () => {
+      const ai = createMockAI();
+      ai.addResponse('response 1');
+      ai.addResponse('response 2');
+
+      const result1 = await ai.complete('prompt 1');
+      const result2 = await ai.complete('prompt 2');
+
+      expect(result1).toBe('mock response');
+      expect(result2).toBe('response 1');
+    });
+
+    it('should reset state', async () => {
+      const ai = createMockAI('response');
+      await ai.complete('prompt');
+      expect(ai.getCallCount()).toBe(1);
+
+      ai.reset();
+      expect(ai.getCallCount()).toBe(0);
+    });
+  });
+
+  describe('Error handling', () => {
+    it('should handle AI provider errors', async () => {
+      const ai = createFailingMockAI('Test error');
+      await expect(ai.complete('prompt')).rejects.toThrow('Test error');
+    });
+  });
+
+  describe('Intent classification', () => {
+    it('should classify simple prompts', () => {
+      const prompts = [
+        { text: 'fix the bug', expectedIntent: 'bug_fix' },
+        { text: 'add new feature', expectedIntent: 'feature' },
+        { text: 'refactor the code', expectedIntent: 'refactor' },
+        { text: 'optimize performance', expectedIntent: 'performance' },
+      ];
+
+      prompts.forEach(({ text, expectedIntent }) => {
+        // Simple keyword-based classification for testing
+        let intent = 'unknown';
+        if (text.includes('fix') || text.includes('bug')) intent = 'bug_fix';
+        else if (text.includes('add') || text.includes('feature')) intent = 'feature';
+        else if (text.includes('refactor')) intent = 'refactor';
+        else if (text.includes('optimize') || text.includes('performance')) intent = 'performance';
+
+        expect(intent).toBe(expectedIntent);
+      });
+    });
+  });
+
+  describe('Agent selection', () => {
+    it('should select appropriate agent for bug fix', () => {
+      const intent = 'bug_fix';
+      const agent = selectAgent(intent);
+      expect(agent).toBe('coder');
+    });
+
+    it('should select appropriate agent for feature', () => {
+      const intent = 'feature';
+      const agent = selectAgent(intent);
+      expect(agent).toBe('feature-developer');
+    });
+
+    it('should select appropriate agent for refactor', () => {
+      const intent = 'refactor';
+      const agent = selectAgent(intent);
+      expect(agent).toBe('refactor-specialist');
+    });
+
+    it('should default to coder for unknown intent', () => {
+      const intent = 'unknown';
+      const agent = selectAgent(intent);
+      expect(agent).toBe('coder');
+    });
+  });
+
+  describe('Routing decision', () => {
+    it('should create routing decision with metadata', () => {
+      const decision = {
+        intent: 'bug_fix',
+        agent: 'coder',
+        confidence: 0.9,
+        timestamp: Date.now(),
+      };
+
+      expect(decision.intent).toBe('bug_fix');
+      expect(decision.agent).toBe('coder');
+      expect(decision.confidence).toBeGreaterThan(0.8);
+      expect(decision.timestamp).toBeGreaterThan(0);
+    });
+
+    it('should handle low confidence routing', () => {
+      const decision = {
+        intent: 'unknown',
+        agent: 'coder',
+        confidence: 0.3,
+        fallback: true,
+      };
+
+      expect(decision.fallback).toBe(true);
+      expect(decision.confidence).toBeLessThan(0.5);
+    });
+  });
+});
+
+// Helper function for agent selection
+function selectAgent(intent: string): string {
+  const mapping: Record<string, string> = {
+    bug_fix: 'coder',
+    feature: 'feature-developer',
+    refactor: 'refactor-specialist',
+    performance: 'coder',
+    investigation: 'researcher',
+  };
+
+  return mapping[intent] || 'coder';
+}

package/tests/unit/security.test.ts

@@ -0,0 +1,128 @@
+import { describe, it, expect } from 'vitest';
+import { resolvePatchTarget } from '../../src/web/routes/types.js';
+import fs from 'node:fs';
+import path from 'node:path';
+import { tmpdir } from 'node:os';
+
+describe('Security - Path Traversal Prevention', () => {
+  describe('resolvePatchTarget', () => {
+    it('should reject path traversal with ../', () => {
+      expect(() => resolvePatchTarget('skill', '../../../etc/passwd')).toThrow('Invalid target name');
+    });
+
+    it('should reject path traversal with ..\\', () => {
+      expect(() => resolvePatchTarget('skill', '..\\..\\..\\windows\\system32')).toThrow('Invalid target name');
+    });
+
+    it('should reject absolute paths with /', () => {
+      expect(() => resolvePatchTarget('skill', '/etc/passwd')).toThrow('Invalid target name');
+    });
+
+    it('should reject absolute paths with \\', () => {
+      expect(() => resolvePatchTarget('skill', '\\windows\\system32')).toThrow('Invalid target name');
+    });
+
+    it('should reject paths with .. in the middle', () => {
+      expect(() => resolvePatchTarget('skill', 'foo/../bar')).toThrow('Invalid target name');
+    });
+
+    it('should accept valid skill names', () => {
+      const result = resolvePatchTarget('skill', 'my-skill');
+      expect(result.filePath).toContain('my-skill.md');
+      expect(result.filePath).not.toContain('..');
+    });
+
+    it('should accept skill names with underscores and hyphens', () => {
+      const result = resolvePatchTarget('skill', 'my_skill-v2');
+      expect(result.filePath).toContain('my_skill-v2.md');
+    });
+
+    it('should reject empty target names', () => {
+      expect(() => resolvePatchTarget('skill', '')).toThrow('Invalid target name');
+    });
+  });
+});
+
+describe('Security - Input Validation', () => {
+  describe('Skill name validation patterns', () => {
+    const invalidNames = [
+      '../../../etc/passwd',
+      '..\\..\\..\\windows\\system32',
+      '/etc/passwd',
+      '\\windows\\system32',
+      'foo/../bar',
+      'foo\\..\\bar',
+      '..',
+      './foo',
+      '.\\foo',
+    ];
+
+    invalidNames.forEach(name => {
+      it(`should reject invalid name: ${name}`, () => {
+        expect(() => resolvePatchTarget('skill', name)).toThrow();
+      });
+    });
+
+    const validNames = [
+      'my-skill',
+      'my_skill',
+      'skill123',
+      'SKILL',
+      'my-skill-v2',
+      'my_skill_v2',
+    ];
+
+    validNames.forEach(name => {
+      it(`should accept valid name: ${name}`, () => {
+        expect(() => resolvePatchTarget('skill', name)).not.toThrow();
+      });
+    });
+  });
+});
+
+describe('Security - Git Command Injection Prevention', () => {
+  describe('projectPath validation', () => {
+    it('should reject relative paths', () => {
+      const relativePath = '../some/project';
+      expect(path.isAbsolute(relativePath)).toBe(false);
+    });
+
+    it('should accept absolute paths', () => {
+      const absolutePath = '/home/user/project';
+      expect(path.isAbsolute(absolutePath)).toBe(true);
+    });
+
+    it('should validate directory existence', () => {
+      const nonExistentPath = '/this/path/does/not/exist/12345';
+      expect(fs.existsSync(nonExistentPath)).toBe(false);
+    });
+
+    it('should validate .git directory existence', () => {
+      const tempDir = tmpdir();
+      const gitDir = path.join(tempDir, '.git');
+
+      // tmpdir exists but likely doesn't have .git
+      expect(fs.existsSync(tempDir)).toBe(true);
+      // Most temp dirs won't have .git
+      if (!fs.existsSync(gitDir)) {
+        expect(fs.existsSync(gitDir)).toBe(false);
+      }
+    });
+
+    it('should handle path with special characters safely', () => {
+      // These should be rejected as non-existent or invalid
+      const dangerousPaths = [
+        '/tmp; rm -rf /',
+        '/tmp && echo pwned',
+        '/tmp | cat /etc/passwd',
+        '/tmp`whoami`',
+        '/tmp$(whoami)',
+      ];
+
+      dangerousPaths.forEach(p => {
+        // These paths should fail existence check
+        expect(fs.existsSync(p)).toBe(false);
+      });
+    });
+  });
+});