bigpowers 2.88.16 → 2.88.18

package/scripts/validate-omp-extension.sh

@@ -10,14 +10,7 @@ cd "$REPO_ROOT"
 
 ERRORS=0
 
-fail() {
-  echo "FAIL: $*"
-  ERRORS=$((ERRORS + 1))
-}
-
-pass() {
-  echo "ok  : $*"
-}
+source "$REPO_ROOT/scripts/lib/test-assertions.sh"
 
 # ── 1. Package has exactly one pi.extensions entry ─────────────────────────
 # pi reads extension paths from the `pi` manifest key (readPiManifest). The
@@ -25,21 +18,21 @@ pass() {
 echo "--- [OMP] manifest: single extension entry ---"
 EXT_COUNT=$(node -e "const p = require('./package.json'); const exts = p.pi?.extensions; if (!exts) { console.log(0); } else { console.log(exts.length); }")
 if [[ "$EXT_COUNT" -eq 1 ]]; then
-  pass "pi.extensions has exactly 1 entry"
+  ta_ok "pi.extensions has exactly 1 entry"
 else
-  fail "pi.extensions has $EXT_COUNT entries (expected 1)"
+  ta_err "pi.extensions has $EXT_COUNT entries (expected 1)"
 fi
 
 # ── 2. Extension file exists ───────────────────────────────────────────────
 echo "--- [OMP] extension file exists ---"
 EXT_PATH=$(node -e "const p = require('./package.json'); console.log(p.pi?.extensions?.[0] || '')")
 if [[ -z "$EXT_PATH" ]]; then
-  fail "No pi.extensions entry found"
+  ta_err "No pi.extensions entry found"
 else
   if [[ -f "$EXT_PATH" ]]; then
-    pass "extension file '$EXT_PATH' exists"
+    ta_ok "extension file '$EXT_PATH' exists"
   else
-    fail "extension file '$EXT_PATH' does not exist"
+    ta_err "extension file '$EXT_PATH' does not exist"
   fi
 fi
 
@@ -48,32 +41,32 @@ echo "--- [OMP] separated runtime responsibilities ---"
 if [[ -n "$EXT_PATH" && -f "$EXT_PATH" ]]; then
   for sym in "registerTool" "tool_call"; do
     if grep -q "$sym" "$EXT_PATH" 2>/dev/null; then
-      pass "symbol '$sym' found in extension source"
+      ta_ok "symbol '$sym' found in extension source"
     else
-      fail "symbol '$sym' NOT found in extension source"
+      ta_err "symbol '$sym' NOT found in extension source"
     fi
   done
   if grep -q 'pi\.registerCommand' "$EXT_PATH" 2>/dev/null; then
-    fail "extension registers commands already supplied by Pi prompt templates"
+    ta_err "extension registers commands already supplied by Pi prompt templates"
   else
-    pass "extension leaves slash-command registration to Pi prompt templates"
+    ta_ok "extension leaves slash-command registration to Pi prompt templates"
   fi
 else
-  fail "Cannot scan extension symbols — file not resolved"
+  ta_err "Cannot scan extension symbols — file not resolved"
 fi
 
 PROMPT_COUNT=$(node -e "const p = require('./package.json'); console.log(p.pi?.prompts?.length || 0)")
 if [[ "$PROMPT_COUNT" -eq 1 ]]; then
-  pass "pi.prompts has exactly 1 canonical prompt-template entry"
+  ta_ok "pi.prompts has exactly 1 canonical prompt-template entry"
 else
-  fail "pi.prompts has $PROMPT_COUNT entries (expected 1)"
+  ta_err "pi.prompts has $PROMPT_COUNT entries (expected 1)"
 fi
 
 # ── 4. Skill discovery root is skills/ ────────────────────────────────────
 echo "--- [OMP] source skill discoverability (skills/<name>/SKILL.md) ---"
 SKILLS_ROOT="$REPO_ROOT/skills"
 if [[ ! -d "$SKILLS_ROOT" ]]; then
-  fail "skills/ directory not found at $SKILLS_ROOT"
+  ta_err "skills/ directory not found at $SKILLS_ROOT"
 else
   TOTAL=0
   MISSING=0
@@ -81,7 +74,7 @@ else
     rel="${skill_md#"$SKILLS_ROOT"/}"
     # Each should be exactly <name>/SKILL.md (one level of nesting).
     if [[ "$rel" != */SKILL.md || "${rel%%/*}" == "" ]]; then
-      fail "unexpected SKILL.md path: $rel"
+      ta_err "unexpected SKILL.md path: $rel"
       MISSING=$((MISSING + 1))
       continue
     fi
@@ -89,11 +82,11 @@ else
   done < <(find "$SKILLS_ROOT" -maxdepth 2 -name SKILL.md 2>/dev/null | sort)
 
   if [[ "$TOTAL" -eq 0 ]]; then
-    fail "no skills found under skills/"
+    ta_err "no skills found under skills/"
   elif [[ "$MISSING" -eq 0 ]]; then
-    pass "$TOTAL source skills all at skills/<name>/SKILL.md"
+    ta_ok "$TOTAL source skills all at skills/<name>/SKILL.md"
   else
-    fail "$MISSING/$TOTAL skills at unexpected paths"
+    ta_err "$MISSING/$TOTAL skills at unexpected paths"
   fi
 fi
 
@@ -101,9 +94,9 @@ fi
 echo "--- [OMP] extension targets skills/ root ---"
 if [[ -n "$EXT_PATH" && -f "$EXT_PATH" ]]; then
   if grep -q 'join(pluginRoot(), "skills")' "$EXT_PATH" 2>/dev/null; then
-    pass "extension calls discoverSkills with skills/ subdirectory"
+    ta_ok "extension calls discoverSkills with skills/ subdirectory"
   else
-    fail "extension does not target skills/ — check discoverSkills call in $EXT_PATH"
+    ta_err "extension does not target skills/ — check discoverSkills call in $EXT_PATH"
   fi
 fi
 
@@ -115,15 +108,15 @@ fi
 echo "--- [OMP] runtime load smoke (scripts/omp-smoke.ts) ---"
 SMOKE="$REPO_ROOT/scripts/omp-smoke.ts"
 if [[ ! -f "$SMOKE" ]]; then
-  fail "omp-smoke.ts not found at $SMOKE"
+  ta_err "omp-smoke.ts not found at $SMOKE"
 elif ! command -v node >/dev/null 2>&1; then
   echo "warn: node unavailable — skipping runtime load smoke"
 else
   SMOKE_ERR=$(mktemp)
   if node "$SMOKE" >/dev/null 2>"$SMOKE_ERR"; then
-    pass "extension loads without calling action methods during load"
+    ta_ok "extension loads without calling action methods during load"
   else
-    fail "runtime load smoke failed — $(head -3 "$SMOKE_ERR" 2>/dev/null | tr '\n' ' ')"
+    ta_err "runtime load smoke failed — $(head -3 "$SMOKE_ERR" 2>/dev/null | tr '\n' ' ')"
   fi
   rm -f "$SMOKE_ERR"
 fi

package/tests/security/agents-import.cjs

@@ -0,0 +1,36 @@
+// story: e21s03
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'bp-agents-'));
+const script = path.resolve(__dirname, '../../scripts/bp-read-agents.sh');
+const commands = [
+  "echo'; printf IMPORT_RAN > import-marker; #",
+  "node -e 'console.log(\"quoted value\")'",
+  'echo $(touch substitution-marker) `touch backtick-marker` "$HOME"; echo done',
+  "printf '%s\\n' 'spaces & symbols | < >'",
+  'echo "deploy" && echo finished'
+];
+const names = ['PREFLIGHT', 'TEST', 'BUILD', 'LINT', 'DEPLOY'];
+const sections = ['Preflight', 'Test', 'Build', 'Lint', 'Deploy'];
+try {
+  for (const source of ['AGENTS.md', 'CLAUDE.md', 'CURSOR.md']) {
+    fs.writeFileSync(path.join(root, source), commands.map((c, i) =>
+      `## ${sections[i]}\n\n\`\`\`bash\n${c}\n\`\`\`\n`).join('\n'));
+    const output = execFileSync('bash', ['-c',
+      'eval "$(bash "$1")"; printf "%s\\0" "$BP_PREFLIGHT" "$BP_TEST" "$BP_BUILD" "$BP_LINT" "$BP_DEPLOY"',
+      'import-test', script], { cwd: root, encoding: 'utf8' });
+    for (const marker of ['import-marker', 'substitution-marker', 'backtick-marker']) {
+      assert(!fs.existsSync(path.join(root, marker)), `${source}: importing executed ${marker}`);
+    }
+    assert.deepStrictEqual(output.split('\0').slice(0, -1), commands, `${source}: exact values`);
+    const printed = execFileSync('bash', [script, '--print'], { cwd: root, encoding: 'utf8' });
+    for (const command of commands) assert(printed.includes(command));
+    fs.unlinkSync(path.join(root, source));
+  }
+  assert.strictEqual(execFileSync('bash', [script], { cwd: root, encoding: 'utf8' }), '');
+  console.log(`PASS: ${names.length} command exports round-trip without execution in all 3 source formats`);
+} finally { fs.rmSync(root, { recursive: true, force: true }); }

package/tests/security/dashboard-bind.cjs

@@ -0,0 +1,31 @@
+const assert = require('assert');
+const fs = require('fs');
+const http = require('http');
+const path = require('path');
+const vm = require('vm');
+
+// Replace filesystem watching and Express routing at the I/O boundary, but
+// exercise a real TCP listener with the arguments supplied by createServer.
+const filename = path.resolve(__dirname, '../../dashboard/src/web/server.js');
+const moduleStub = { exports: {} };
+const sandbox = {
+  module: moduleStub, __dirname: path.dirname(filename), console, setTimeout, clearTimeout,
+  require(name) {
+    if (name === 'path') return path;
+    if (name === '../loaders/watcher') return { watch: () => ({ on() {} }) };
+    if (name.startsWith('../loaders/')) return {};
+    assert.strictEqual(name, 'express');
+    return () => ({ get() {}, listen: (...args) => http.createServer().listen(...args) });
+  }
+};
+vm.runInNewContext(fs.readFileSync(filename, 'utf8'), sandbox, { filename });
+const app = moduleStub.exports.createServer('/unused', 0);
+const server = app.listen(0, () => {
+  try {
+    assert.strictEqual(server.address().address, '127.0.0.1');
+    assert(server.address().port > 0, 'ephemeral port and callback remain supported');
+    console.log('PASS: dashboard binds only to IPv4 loopback');
+  } catch (error) { console.error(error); process.exitCode = 1; }
+  finally { server.close(); }
+});
+server.on('error', error => { console.error(error); process.exitCode = 1; });

package/tests/security/dashboard-render.cjs

@@ -0,0 +1,60 @@
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const vm = require('vm');
+
+// Execute the shipped client and feed its public fetch/SSE inputs. Capture
+// generated HTML at the DOM boundary; this is not a browser execution test.
+const nodes = new Map(['pipeline', 'metrics', 'state', 'epics', 'ledger', 'status']
+  .map(id => [id, { innerHTML: '', classList: { add() {}, remove() {} } }]));
+const events = new Map();
+let stream;
+const payload = '<img src=x onerror="window.__bpXss=1"> & \'quoted\'';
+const escaped = '&lt;img src=x onerror=&quot;window.__bpXss=1&quot;&gt; &amp; &#39;quoted&#39;';
+const snapshot = {
+  state: { activeFlow: payload, activeEpic: payload, activeStory: payload,
+    gitBranch: payload, release: { version: payload } },
+  projectMetrics: { totalBcps: payload, avgBcpPerHour: 1.5 },
+  currentVelocity: { avgBcpPerHour: 2 },
+  epics: [{ id: payload, title: payload, stories: [] }],
+  cycleTimes: [{ id: payload, bcps: payload, cycleMin: payload, bcpPerHour: 3 }]
+};
+const sandbox = {
+  console,
+  document: {
+    getElementById: id => nodes.get(id), querySelectorAll: () => [],
+    addEventListener() {}, createElement: () => ({ getContext: () => ({}) })
+  },
+  window: { addEventListener: (name, fn) => events.set(name, fn) },
+  fetch: async () => ({ json: async () => JSON.parse(JSON.stringify(snapshot)) }),
+  EventSource: class { constructor() { stream = this; } },
+  setInterval() { throw new Error('unexpected polling fallback'); }
+};
+const filename = path.resolve(__dirname, '../../dashboard/src/web/client.html');
+const html = fs.readFileSync(filename, 'utf8');
+for (const match of html.matchAll(/<script>([\s\S]*?)<\/script>/g)) {
+  vm.runInNewContext(match[1], sandbox, { filename });
+}
+function assertEscaped() {
+  for (const [panel, count] of [['state', 4], ['metrics', 2], ['epics', 2], ['ledger', 3]]) {
+    const output = nodes.get(panel).innerHTML;
+    assert(!output.includes('<img'), `${panel}: project metadata became HTML`);
+    assert.strictEqual(output.split(escaped).length - 1, count, `${panel}: literal text preserved`);
+  }
+}
+async function main() {
+  events.get('load')();
+  await new Promise(resolve => setImmediate(resolve));
+  assertEscaped();
+  assert(stream, 'initial fetch should connect SSE');
+  stream.onmessage({ data: JSON.stringify(snapshot) });
+  assertEscaped();
+  stream.onmessage({ data: JSON.stringify({ state: { gitBranch: 'feature/example' },
+    projectMetrics: { totalBcps: 0, avgBcpPerHour: 0 } }) });
+  assert(nodes.get('state').innerHTML.includes('feature/example'));
+  assert(nodes.get('metrics').innerHTML.includes('>0</span>'));
+  assert(nodes.get('epics').innerHTML.includes('No epics available'));
+  assert(nodes.get('ledger').innerHTML.includes('No cycle-time data available'));
+  console.log('PASS: fetch and SSE render all project metadata as escaped text');
+}
+main().catch(error => { console.error(error); process.exitCode = 1; });

package/tests/security/git-context.cjs

@@ -0,0 +1,44 @@
+// story: e32s04
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'bp-diff-'));
+const git = (...args) => execFileSync('git', args, { cwd: root, stdio: 'pipe' });
+const put = (name, value) => {
+  fs.mkdirSync(path.dirname(path.join(root, name)), { recursive: true });
+  fs.writeFileSync(path.join(root, name), value);
+};
+
+async function main() {
+  const { getGitContext } = await import('../../bigpowers-mcp/build/lib/git-context.js');
+  git('init', '-q');
+  const secret = 'specs/m-secret.pem';
+  const before = 'specs/a-public.md';
+  const after = 'specs/z-public.md';
+  const outside = 'private/readme.md';
+  for (const file of [secret, before, after, outside]) put(file, 'baseline\n');
+  git('add', '.');
+  git('-c', 'user.name=Test', '-c', 'user.email=test@example.invalid',
+    'commit', '-qm', 'fixture');
+  for (const allowed of [[after], [before, after], [before], []]) {
+    git('reset', '--hard', 'HEAD');
+    put(secret, 'DUMMY_SECRET_VALUE\n');
+    put(outside, 'OUT_OF_SCOPE_VALUE\n');
+    for (const file of allowed) put(file, 'PUBLIC_CHANGE\n');
+    const result = getGitContext(root, 'diff');
+    assert.deepStrictEqual(Object.keys(result.diffs).sort(), [...allowed].sort());
+    assert.deepStrictEqual(Object.values(result.changed_files).flat().sort(), [...allowed].sort());
+    assert(!JSON.stringify(result).includes('DUMMY_SECRET_VALUE'));
+    assert(!JSON.stringify(result).includes('OUT_OF_SCOPE_VALUE'));
+    for (const file of allowed) assert(result.diffs[file].includes('+PUBLIC_CHANGE'));
+  }
+  git('reset', '--hard', 'HEAD');
+  assert.deepStrictEqual(getGitContext(root, 'diff').diffs, {});
+  console.log('PASS: secret diffs excluded in first, middle, last and only positions');
+}
+
+main().catch(error => { console.error(error); process.exitCode = 1; })
+  .finally(() => fs.rmSync(root, { recursive: true, force: true }));

package/tests/security/migration.cjs

@@ -0,0 +1,76 @@
+// story: e44s03 e44s06
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync, spawnSync } = require('child_process');
+
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'bp-migration-'));
+const repo = path.resolve(__dirname, '../..');
+const project = path.join(root, 'project');
+const specs = path.join(project, 'specs');
+const marker = path.join(root, 'executed-marker');
+const git = (...args) => execFileSync('git', args, { cwd: project, stdio: 'pipe' });
+function stamp(version) {
+  fs.writeFileSync(path.join(specs, 'state.yaml'),
+    `bigpowers_version: ${JSON.stringify(version)}\nactive_flow: null\n`);
+  git('add', '.');
+  git('-c', 'user.name=Test', '-c', 'user.email=test@example.invalid',
+    'commit', '--allow-empty', '-qm', 'fixture');
+}
+function preview(script) {
+  const before = fs.readFileSync(path.join(specs, 'state.yaml'), 'utf8');
+  const result = spawnSync('bash', [script, '--project', project, '--dry-run'],
+    { cwd: project, encoding: 'utf8' });
+  assert(!result.error, String(result.error));
+  assert(!fs.existsSync(marker), 'dry run executed version metadata');
+  assert.strictEqual(fs.readFileSync(path.join(specs, 'state.yaml'), 'utf8'), before);
+  assert.deepStrictEqual(fs.readdirSync(specs), ['state.yaml'], 'dry run wrote files');
+  return result;
+}
+function copyFile(relative, destination) {
+  const target = path.join(destination, relative);
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.copyFileSync(path.join(repo, relative), target);
+}
+function installFixture(destination) {
+  for (const relative of ['package.json', 'scripts/migrate-version.sh',
+    'scripts/lib/python-env.sh', ...['common', 'plan', 'run', 'post', 'execute', 'transforms']
+      .map(name => `scripts/lib/migrate-version-${name}.sh`)]) copyFile(relative, destination);
+  const migrations = path.join(destination, 'specs/migrations');
+  fs.mkdirSync(migrations, { recursive: true });
+  fs.writeFileSync(path.join(migrations, 'registry.okf.md'),
+    '---\nmigrations:\n  - id: test\n    since_version: "2.80.0"\n    order: 1\n---\n');
+  fs.writeFileSync(path.join(migrations, 'test.okf.md'),
+    '---\ntransforms: []\nactions_needed: []\n---\n');
+  return path.join(destination, 'scripts/migrate-version.sh');
+}
+try {
+  fs.mkdirSync(specs, { recursive: true });
+  git('init', '-q', '-b', 'main');
+  const script = installFixture(path.join(root, 'installation'));
+  stamp(`0.0.0'; open('${marker}', 'w').write('DUMMY'); #`);
+  const hostile = preview(script);
+  assert.notStrictEqual(hostile.status, 0, 'invalid version must fail closed');
+  assert(/invalid.*version/i.test(hostile.stderr), hostile.stderr);
+  for (const version of ['1.0.0', '2.0.0', '2.20.0', '2.20.0-rc.1+build.2']) {
+    stamp(version);
+    const result = preview(script);
+    assert.strictEqual(result.status, 0, result.stderr);
+    assert(result.stdout.includes(`Detected version: ${version}`), result.stdout);
+  }
+  // The same data boundary applies to legitimate installation/project paths.
+  const installation = path.join(root, "install's directory");
+  const quotedScript = installFixture(installation);
+  stamp('1.0.0');
+  const quotedProject = path.join(root, "project's directory");
+  fs.symlinkSync(project, quotedProject, 'dir');
+  const result = spawnSync('bash', [quotedScript,
+    '--project', quotedProject, '--dry-run'], { encoding: 'utf8' });
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert(result.stdout.includes('Detected version: 1.0.0'), result.stdout);
+  assert(result.stdout.includes('Transforms preview:'), result.stdout);
+  assert(result.stdout.includes('-- test: test --'), result.stdout);
+  assert(!result.stdout.includes('installed=unknown'), result.stdout);
+  console.log('PASS: migration preview rejects executable stamps and supports quoted paths');
+} finally { fs.rmSync(root, { recursive: true, force: true }); }