claude-flow 2.0.0-alpha.78 → 2.0.0-alpha.79

package/src/utils/__tests__/github-cli-safety-wrapper.test.js

@@ -0,0 +1,408 @@
+/**
+ * Test suite for GitHub CLI Safety Wrapper
+ * 
+ * Tests all security features, error handling, and functionality
+ */
+
+import { jest } from '@jest/globals';
+import { 
+  GitHubCliSafe, 
+  createGitHubCliSafe, 
+  githubCli,
+  GitHubCliError,
+  GitHubCliTimeoutError,
+  GitHubCliValidationError,
+  GitHubCliRateLimitError
+} from '../github-cli-safety-wrapper.js';
+import { spawn } from 'child_process';
+import { promises as fs } from 'fs';
+
+// Mock child_process and fs
+jest.mock('child_process');
+jest.mock('fs', () => ({
+  promises: {
+    writeFile: jest.fn(),
+    unlink: jest.fn(),
+  }
+}));
+
+describe('GitHubCliSafe', () => {
+  let ghSafe;
+  let mockSpawn;
+  let mockChild;
+
+  beforeEach(() => {
+    ghSafe = new GitHubCliSafe({
+      timeout: 5000,
+      enableRateLimit: false,
+      enableLogging: false
+    });
+
+    mockChild = {
+      kill: jest.fn(),
+      on: jest.fn(),
+      stdout: { on: jest.fn() },
+      stderr: { on: jest.fn() }
+    };
+
+    mockSpawn = spawn.mockReturnValue(mockChild);
+    fs.writeFile.mockResolvedValue();
+    fs.unlink.mockResolvedValue();
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('Input Validation', () => {
+    test('should validate allowed commands', () => {
+      expect(() => ghSafe.validateCommand('issue create')).not.toThrow();
+      expect(() => ghSafe.validateCommand('pr comment')).not.toThrow();
+      
+      expect(() => ghSafe.validateCommand('rm -rf /')).toThrow(GitHubCliValidationError);
+      expect(() => ghSafe.validateCommand('maliciouscommand')).toThrow(GitHubCliValidationError);
+    });
+
+    test('should reject empty or invalid commands', () => {
+      expect(() => ghSafe.validateCommand('')).toThrow(GitHubCliValidationError);
+      expect(() => ghSafe.validateCommand(null)).toThrow(GitHubCliValidationError);
+      expect(() => ghSafe.validateCommand(undefined)).toThrow(GitHubCliValidationError);
+    });
+
+    test('should sanitize dangerous input patterns', () => {
+      const dangerousInputs = [
+        '$(rm -rf /)',
+        '`rm -rf /`',
+        'test && rm -rf /',
+        'test || rm -rf /',
+        'test; rm -rf /',
+        'test <(echo malicious)',
+        'test > /dev/null',
+        'test | sh',
+        'eval("malicious")',
+        'exec("malicious")'
+      ];
+
+      dangerousInputs.forEach(input => {
+        expect(() => ghSafe.sanitizeInput(input)).toThrow(GitHubCliValidationError);
+      });
+    });
+
+    test('should allow safe input', () => {
+      const safeInputs = [
+        'This is a normal comment',
+        'Code example: console.log("hello")',
+        'File path: /src/components/Button.jsx',
+        'Numbers: 123, versions: v1.2.3',
+        'Special chars: @#$%^&*()_+-=[]{}|;:,.<>?'
+      ];
+
+      safeInputs.forEach(input => {
+        expect(() => ghSafe.sanitizeInput(input)).not.toThrow();
+      });
+    });
+
+    test('should validate body size limits', () => {
+      const largeBody = 'x'.repeat(1024 * 1024 + 1); // > 1MB
+      expect(() => ghSafe.validateBodySize(largeBody)).toThrow(GitHubCliValidationError);
+      
+      const normalBody = 'x'.repeat(1000);
+      expect(() => ghSafe.validateBodySize(normalBody)).not.toThrow();
+    });
+  });
+
+  describe('Process Management', () => {
+    test('should spawn process with correct arguments', async () => {
+      const mockProcess = setupMockProcess(0, 'success', '');
+      
+      await ghSafe.execute('issue create', {
+        title: 'Test Issue',
+        body: 'Test body'
+      });
+
+      expect(spawn).toHaveBeenCalledWith('gh', 
+        expect.arrayContaining(['issue', 'create', '--title', 'Test Issue']),
+        expect.objectContaining({
+          stdio: ['ignore', 'pipe', 'pipe'],
+          shell: false
+        })
+      );
+    });
+
+    test('should handle process timeout', async () => {
+      setupMockProcess(null, '', '', true); // Never completes
+
+      await expect(
+        ghSafe.execute('issue create', { title: 'Test' })
+      ).rejects.toThrow(GitHubCliTimeoutError);
+    });
+
+    test('should handle process failure', async () => {
+      setupMockProcess(1, '', 'Command failed');
+
+      await expect(
+        ghSafe.execute('issue create', { title: 'Test' })
+      ).rejects.toThrow(GitHubCliError);
+    });
+
+    test('should cleanup processes on timeout', async () => {
+      setupMockProcess(null, '', '', true); // Never completes
+
+      try {
+        await ghSafe.execute('issue create', { title: 'Test' });
+      } catch (error) {
+        expect(mockChild.kill).toHaveBeenCalledWith('SIGTERM');
+      }
+    });
+  });
+
+  describe('Retry Logic', () => {
+    test('should retry on transient failures', async () => {
+      let attemptCount = 0;
+      const operation = jest.fn(() => {
+        attemptCount++;
+        if (attemptCount < 3) {
+          throw new GitHubCliError('Transient error');
+        }
+        return { success: true };
+      });
+
+      const result = await ghSafe.withRetry(operation, 3);
+      expect(result.success).toBe(true);
+      expect(operation).toHaveBeenCalledTimes(3);
+    });
+
+    test('should not retry validation errors', async () => {
+      const operation = jest.fn(() => {
+        throw new GitHubCliValidationError('Invalid input');
+      });
+
+      await expect(ghSafe.withRetry(operation, 3)).rejects.toThrow(GitHubCliValidationError);
+      expect(operation).toHaveBeenCalledTimes(1);
+    });
+
+    test('should not retry rate limit errors', async () => {
+      const operation = jest.fn(() => {
+        throw new GitHubCliRateLimitError('Rate limited');
+      });
+
+      await expect(ghSafe.withRetry(operation, 3)).rejects.toThrow(GitHubCliRateLimitError);
+      expect(operation).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe('Rate Limiting', () => {
+    test('should enforce rate limits', async () => {
+      const rateLimitedGh = new GitHubCliSafe({
+        enableRateLimit: true,
+        maxRequestsPerWindow: 2,
+        rateLimitWindow: 1000
+      });
+
+      // Mock successful executions
+      setupMockProcess(0, 'success', '');
+
+      // First two requests should succeed
+      await rateLimitedGh.execute('auth status');
+      await rateLimitedGh.execute('auth status');
+
+      // Third request should be rate limited
+      await expect(
+        rateLimitedGh.execute('auth status')
+      ).rejects.toThrow(GitHubCliRateLimitError);
+    });
+  });
+
+  describe('Temp File Handling', () => {
+    test('should create secure temp files for body content', async () => {
+      setupMockProcess(0, 'success', '');
+
+      await ghSafe.execute('issue create', {
+        title: 'Test',
+        body: 'Test body'
+      });
+
+      expect(fs.writeFile).toHaveBeenCalledWith(
+        expect.stringMatching(/gh-safe-.*\.tmp$/),
+        'Test body',
+        { mode: 0o600 }
+      );
+    });
+
+    test('should cleanup temp files even on error', async () => {
+      setupMockProcess(1, '', 'Error');
+
+      try {
+        await ghSafe.execute('issue create', {
+          title: 'Test',
+          body: 'Test body'
+        });
+      } catch (error) {
+        // Expected to fail
+      }
+
+      expect(fs.unlink).toHaveBeenCalled();
+    });
+  });
+
+  describe('High-level Operations', () => {
+    beforeEach(() => {
+      setupMockProcess(0, 'Issue created successfully', '');
+    });
+
+    test('should create issue with proper arguments', async () => {
+      await ghSafe.createIssue({
+        title: 'Bug Report',
+        body: 'Found a bug',
+        labels: ['bug', 'high-priority'],
+        assignees: ['user1', 'user2']
+      });
+
+      expect(spawn).toHaveBeenCalledWith('gh', 
+        expect.arrayContaining([
+          'issue', 'create',
+          '--title', 'Bug Report',
+          '--body-file', expect.stringMatching(/gh-safe-.*\.tmp$/),
+          '--label', 'bug,high-priority',
+          '--assignee', 'user1,user2'
+        ]),
+        expect.any(Object)
+      );
+    });
+
+    test('should create PR with proper arguments', async () => {
+      await ghSafe.createPR({
+        title: 'Feature: Add new component',
+        body: 'Adds new component',
+        base: 'develop',
+        head: 'feature/new-component',
+        draft: true
+      });
+
+      expect(spawn).toHaveBeenCalledWith('gh',
+        expect.arrayContaining([
+          'pr', 'create',
+          '--title', 'Feature: Add new component',
+          '--body-file', expect.stringMatching(/gh-safe-.*\.tmp$/),
+          '--base', 'develop',
+          '--head', 'feature/new-component',
+          '--draft'
+        ]),
+        expect.any(Object)
+      );
+    });
+
+    test('should add issue comment', async () => {
+      await ghSafe.addIssueComment(123, 'This is a comment');
+
+      expect(spawn).toHaveBeenCalledWith('gh',
+        expect.arrayContaining([
+          'issue', 'comment', '123',
+          '--body-file', expect.stringMatching(/gh-safe-.*\.tmp$/)
+        ]),
+        expect.any(Object)
+      );
+    });
+  });
+
+  describe('Utility Methods', () => {
+    test('should check GitHub CLI availability', async () => {
+      // Mock execSync for version check
+      const { execSync } = require('child_process');
+      jest.spyOn(require('child_process'), 'execSync').mockImplementation(() => 'gh version 2.0.0');
+
+      const isAvailable = await ghSafe.checkGitHubCli();
+      expect(isAvailable).toBe(true);
+    });
+
+    test('should get stats', () => {
+      const stats = ghSafe.getStats();
+      expect(stats).toHaveProperty('totalRequests');
+      expect(stats).toHaveProperty('successfulRequests');
+      expect(stats).toHaveProperty('failedRequests');
+    });
+
+    test('should cleanup active processes', async () => {
+      ghSafe.activeProcesses.set('test-process', mockChild);
+      
+      await ghSafe.cleanup();
+      
+      expect(mockChild.kill).toHaveBeenCalledWith('SIGTERM');
+      expect(ghSafe.activeProcesses.size).toBe(0);
+    });
+  });
+
+  describe('Factory Function', () => {
+    test('should create configured instance', () => {
+      const instance = createGitHubCliSafe({
+        timeout: 10000,
+        maxRetries: 5
+      });
+
+      expect(instance).toBeInstanceOf(GitHubCliSafe);
+      expect(instance.options.timeout).toBe(10000);
+      expect(instance.options.maxRetries).toBe(5);
+    });
+  });
+
+  describe('Singleton Instance', () => {
+    test('should provide default singleton', () => {
+      expect(githubCli).toBeInstanceOf(GitHubCliSafe);
+    });
+  });
+
+  // Helper function to setup mock process behavior
+  function setupMockProcess(exitCode, stdout = '', stderr = '', neverComplete = false) {
+    let closeCallback, errorCallback;
+    let stdoutCallback, stderrCallback;
+
+    mockChild.on.mockImplementation((event, callback) => {
+      if (event === 'close') closeCallback = callback;
+      if (event === 'error') errorCallback = callback;
+    });
+
+    mockChild.stdout.on.mockImplementation((event, callback) => {
+      if (event === 'data') stdoutCallback = callback;
+    });
+
+    mockChild.stderr.on.mockImplementation((event, callback) => {
+      if (event === 'data') stderrCallback = callback;
+    });
+
+    // Simulate process execution
+    if (!neverComplete) {
+      setTimeout(() => {
+        if (stdoutCallback && stdout) stdoutCallback(Buffer.from(stdout));
+        if (stderrCallback && stderr) stderrCallback(Buffer.from(stderr));
+        if (closeCallback) closeCallback(exitCode);
+      }, 10);
+    }
+  }
+});
+
+describe('Error Classes', () => {
+  test('GitHubCliError should contain proper details', () => {
+    const error = new GitHubCliError('Test error', 'TEST_CODE', { test: true });
+    
+    expect(error.name).toBe('GitHubCliError');
+    expect(error.code).toBe('TEST_CODE');
+    expect(error.details).toEqual({ test: true });
+    expect(error.timestamp).toBeDefined();
+  });
+
+  test('GitHubCliTimeoutError should extend GitHubCliError', () => {
+    const error = new GitHubCliTimeoutError(5000, 'gh issue create');
+    
+    expect(error).toBeInstanceOf(GitHubCliError);
+    expect(error.name).toBe('GitHubCliTimeoutError');
+    expect(error.code).toBe('TIMEOUT');
+  });
+
+  test('GitHubCliValidationError should contain field info', () => {
+    const error = new GitHubCliValidationError('Invalid field', 'testField', 'testValue');
+    
+    expect(error.name).toBe('GitHubCliValidationError');
+    expect(error.details.field).toBe('testField');
+    expect(error.details.value).toBe('testValue');
+  });
+});

package/src/utils/github-cli-safe.js

@@ -1,15 +1,19 @@
 /**
+ * DEPRECATED: Use github-cli-safety-wrapper.js instead
+ * This file is maintained for backward compatibility only
+ * 
  * Safe GitHub CLI command execution utilities
  * Prevents shell injection and timeout issues with special characters
  */
 
-import { promises as fs } from 'fs';
-import { tmpdir } from 'os';
-import { join } from 'path';
-import { randomBytes } from 'crypto';
-import { spawn } from 'child_process';
+import { 
+  GitHubCliSafe, 
+  githubCli, 
+  safeGhCommand as newSafeGhCommand 
+} from './github-cli-safety-wrapper.js';
 
 /**
+ * @deprecated Use GitHubCliSafe class from github-cli-safety-wrapper.js
  * Execute GitHub CLI command with safe body content handling
  * @param {string} command - The gh command (e.g., 'issue comment')
  * @param {string} target - Target (issue/PR number or repo)
@@ -18,36 +22,18 @@ import { spawn } from 'child_process';
  * @returns {Promise<string>} - Command output
  */
 export async function safeGhCommand(command, target, body, options = {}) {
-  const tmpFile = join(tmpdir(), `gh-body-${randomBytes(8).toString('hex')}.tmp`);
+  console.warn('safeGhCommand is deprecated. Use GitHubCliSafe from github-cli-safety-wrapper.js');
   
   try {
-    // Write body content to temporary file
-    await fs.writeFile(tmpFile, body, 'utf8');
-    
-    // Build command arguments
-    const args = command.split(' ');
-    args.push(target);
-    args.push('--body-file', tmpFile);
-    
-    // Add any additional options
-    Object.entries(options).forEach(([key, value]) => {
-      args.push(`--${key}`, value);
-    });
-    
-    // Execute command with timeout
-    const result = await executeWithTimeout('gh', args, options.timeout || 30000);
-    return result;
-  } finally {
-    // Clean up temp file
-    try {
-      await fs.unlink(tmpFile);
-    } catch (err) {
-      // Ignore cleanup errors
-    }
+    const result = await newSafeGhCommand(command, target, body, options);
+    return result.stdout;
+  } catch (error) {
+    throw error;
   }
 }
 
 /**
+ * @deprecated This function is deprecated and will be removed
  * Execute command with timeout and proper cleanup
  * @param {string} command - Command to execute
  * @param {string[]} args - Command arguments
@@ -55,132 +41,64 @@ export async function safeGhCommand(command, target, body, options = {}) {
  * @returns {Promise<string>} - Command output
  */
 function executeWithTimeout(command, args, timeout) {
-  return new Promise((resolve, reject) => {
-    const child = spawn(command, args, {
-      stdio: ['ignore', 'pipe', 'pipe'],
-      shell: false, // Important: don't use shell
-    });
-    
-    let stdout = '';
-    let stderr = '';
-    let timedOut = false;
-    
-    // Set timeout
-    const timer = setTimeout(() => {
-      timedOut = true;
-      child.kill('SIGTERM');
-      setTimeout(() => child.kill('SIGKILL'), 5000); // Force kill after 5s
-    }, timeout);
-    
-    child.stdout.on('data', (data) => {
-      stdout += data.toString();
-    });
-    
-    child.stderr.on('data', (data) => {
-      stderr += data.toString();
-    });
-    
-    child.on('close', (code) => {
-      clearTimeout(timer);
-      
-      if (timedOut) {
-        reject(new Error(`Command timed out after ${timeout}ms`));
-      } else if (code !== 0) {
-        reject(new Error(`Command failed with exit code ${code}: ${stderr}`));
-      } else {
-        resolve(stdout.trim());
-      }
-    });
-    
-    child.on('error', (err) => {
-      clearTimeout(timer);
-      reject(err);
-    });
-  });
+  console.warn('executeWithTimeout is deprecated. Use GitHubCliSafe.executeWithTimeout instead');
+  
+  // Forward to new implementation via GitHubCliSafe
+  const ghSafe = new GitHubCliSafe({ timeout });
+  return ghSafe.executeWithTimeout(command.replace('gh ', ''), args.slice(1), { timeout });
 }
 
 /**
+ * @deprecated Use gh object from github-cli-safety-wrapper.js
  * Safe methods for common GitHub CLI operations
  */
 export const gh = {
   /**
+   * @deprecated Use githubCli.addIssueComment instead
    * Create issue comment safely
    * @param {number|string} issue - Issue number
    * @param {string} body - Comment body
    * @param {Object} options - Additional options
    */
   async issueComment(issue, body, options = {}) {
-    return safeGhCommand('issue comment', issue.toString(), body, options);
+    console.warn('gh.issueComment is deprecated. Use githubCli.addIssueComment instead');
+    const result = await githubCli.addIssueComment(issue, body, options);
+    return result.stdout;
   },
   
   /**
+   * @deprecated Use githubCli.addPRComment instead
    * Create PR comment safely
    * @param {number|string} pr - PR number
    * @param {string} body - Comment body
    * @param {Object} options - Additional options
    */
   async prComment(pr, body, options = {}) {
-    return safeGhCommand('pr comment', pr.toString(), body, options);
+    console.warn('gh.prComment is deprecated. Use githubCli.addPRComment instead');
+    const result = await githubCli.addPRComment(pr, body, options);
+    return result.stdout;
   },
   
   /**
+   * @deprecated Use githubCli.createIssue instead
    * Create issue safely
    * @param {Object} params - Issue parameters
    */
   async createIssue({ title, body, labels = [], assignees = [] }) {
-    const tmpFile = join(tmpdir(), `gh-issue-${randomBytes(8).toString('hex')}.tmp`);
-    
-    try {
-      await fs.writeFile(tmpFile, body, 'utf8');
-      
-      const args = ['issue', 'create', '--title', title, '--body-file', tmpFile];
-      
-      if (labels.length > 0) {
-        args.push('--label', labels.join(','));
-      }
-      
-      if (assignees.length > 0) {
-        args.push('--assignee', assignees.join(','));
-      }
-      
-      return await executeWithTimeout('gh', args, 30000);
-    } finally {
-      try {
-        await fs.unlink(tmpFile);
-      } catch (err) {
-        // Ignore cleanup errors
-      }
-    }
+    console.warn('gh.createIssue is deprecated. Use githubCli.createIssue instead');
+    const result = await githubCli.createIssue({ title, body, labels, assignees });
+    return result.stdout;
   },
   
   /**
+   * @deprecated Use githubCli.createPR instead
    * Create PR safely
    * @param {Object} params - PR parameters
    */
   async createPR({ title, body, base = 'main', head, draft = false }) {
-    const tmpFile = join(tmpdir(), `gh-pr-${randomBytes(8).toString('hex')}.tmp`);
-    
-    try {
-      await fs.writeFile(tmpFile, body, 'utf8');
-      
-      const args = ['pr', 'create', '--title', title, '--body-file', tmpFile, '--base', base];
-      
-      if (head) {
-        args.push('--head', head);
-      }
-      
-      if (draft) {
-        args.push('--draft');
-      }
-      
-      return await executeWithTimeout('gh', args, 30000);
-    } finally {
-      try {
-        await fs.unlink(tmpFile);
-      } catch (err) {
-        // Ignore cleanup errors
-      }
-    }
+    console.warn('gh.createPR is deprecated. Use githubCli.createPR instead');
+    const result = await githubCli.createPR({ title, body, base, head, draft });
+    return result.stdout;
   }
 };