devrites 5.14.3 → 6.0.0

package/engine/internal/lib/windows.go

@@ -201,16 +201,20 @@ func windowsHits(opts diffScopeOpts) ([]windowHit, error) {
 		// Whole files whose diff produced no hunks: staged additions land in
 		// `git diff HEAD`, untracked files never do — scan those in full.
 		// Status paths are repo-root-relative, so reads anchor at toplevel.
-		repoRoot, rerr := runGitCommand(dir, nil, "rev-parse", "--show-toplevel")
-		status, serr := gitStatusPaths(dir)
-		if serr == nil && rerr == nil {
-			repo := strings.TrimSpace(string(repoRoot))
-			for _, p := range status {
-				if diffPaths[p] || strings.HasPrefix(p, ".devrites/") {
-					continue
-				}
-				hits = scanWholeFile(repo, p, hits)
+		repoRoot, err := runGitCommand(dir, nil, "rev-parse", "--show-toplevel")
+		if err != nil {
+			return nil, err
+		}
+		status, err := gitStatusPaths(dir)
+		if err != nil {
+			return nil, err
+		}
+		repo := strings.TrimSpace(string(repoRoot))
+		for _, p := range status {
+			if diffPaths[p] || strings.HasPrefix(p, ".devrites/") {
+				continue
 			}
+			hits = scanWholeFile(repo, p, hits)
 		}
 	}
 	var kept []windowHit

package/engine/internal/lib/windows_test.go

@@ -4,14 +4,32 @@ import (
 	"bytes"
 	"os"
 	"path/filepath"
+	"regexp"
 	"strings"
 	"testing"
 
 	"github.com/devrites/devrites/internal/testutil"
 )
 
+// windowsStandardPath is the canonical pack standard for this check, relative
+// to engine/internal/lib.
+const windowsStandardPath = "../../../pack/.claude/skills/devrites-lib/reference/standards/windows.md"
+
+var (
+	// The untracked-file guarantee must name the mode that implements it: no git
+	// diff shows an untracked path, so only the whole-file scan in windowsHits
+	// covers one.
+	windowsWorktreeScopeRe = regexp.MustCompile(`(?i)untracked files (?:as|a) wholly new (?:in|under|by) (?:` + "`" + `--)?worktree(?: mode)?`)
+	// The other two modes must state the narrower scope they actually have.
+	windowsOtherModeLimitRe = regexp.MustCompile(`(?i)--staged[^\n]{0,60}--base[^\n]{0,40}(?:diff only|tracked diff)`)
+	// The defective wording: the guarantee stated with no mode qualifier, in the
+	// same sentence that offers worktree, staged and base as one set.
+	windowsUnscopedClaim = "treats untracked files as wholly new,"
+)
+
 func windowsWorkspace(t *testing.T, project, slug string) string {
 	t.Helper()
+	t.Setenv("DEVRITES_WORKSPACE", "")
 	root := filepath.Join(project, ".devrites")
 	ws := filepath.Join(root, "work", slug)
 	if err := os.MkdirAll(ws, 0o755); err != nil {
@@ -235,3 +253,83 @@ func TestCheckWindowsUsageErrors(t *testing.T) {
 		t.Fatalf("missing base ref: code=%d", code)
 	}
 }
+
+// TestCheckWindowsUntrackedScopePerMode pins which modes scan an untracked file.
+// The whole-file scan is inside the worktree branch because neither `git diff
+// HEAD` nor `git diff --cached` nor `git diff <ref>` reports an untracked path;
+// staged and base modes read the index and the tracked diff only. This is the
+// behaviour half of the drift guard in
+// TestWindowsStandardScopesUntrackedFiles.
+func TestCheckWindowsUntrackedScopePerMode(t *testing.T) {
+	project := t.TempDir()
+	initWindowsRepo(t, project)
+	root := windowsWorkspace(t, project, "feat")
+	testutil.WriteFile(t, filepath.Join(project, "base.go"), "package base\n")
+	runSecretScanGit(t, project, "add", "--", "base.go")
+	runSecretScanGit(t, project, "commit", "-qm", "baseline")
+	// Never staged: only the whole-file scan can see this marker.
+	testutil.WriteFile(t, filepath.Join(project, "new.go"), "package n\n\n// TODO: untracked\n")
+
+	var out, errBuf bytes.Buffer
+	if code := RunCheckWindows(root, []string{"feat"}, &out, &errBuf); code != 3 {
+		t.Fatalf("--worktree must scan untracked files: code=%d out=%q err=%q", code, out.String(), errBuf.String())
+	}
+	if !strings.Contains(out.String(), "unwaived: new.go:3 TODO") {
+		t.Fatalf("--worktree must report the untracked marker: out=%q", out.String())
+	}
+	for _, args := range [][]string{{"feat", "--staged"}, {"feat", "--base", "HEAD"}} {
+		out.Reset()
+		errBuf.Reset()
+		if code := RunCheckWindows(root, args, &out, &errBuf); code != 0 {
+			t.Fatalf("%v covers the tracked diff only, so an untracked file is out of scope: code=%d out=%q", args, code, out.String())
+		}
+	}
+}
+
+// TestWindowsStandardScopesUntrackedFiles keeps windows.md honest about the
+// scope each diff mode has. The standard states the untracked-file guarantee
+// next to the list of modes, so an unqualified claim reads as covering all
+// three; --staged and --base then pass on a workspace holding a not-yet-staged
+// marker. The assertions pair with TestCheckWindowsUntrackedScopePerMode:
+// changing either the engine's per-mode scope or the wording requires changing
+// both.
+func TestWindowsStandardScopesUntrackedFiles(t *testing.T) {
+	raw, err := os.ReadFile(windowsStandardPath)
+	if err != nil {
+		t.Fatalf("read canonical standard: %v", err)
+	}
+	prose := strings.Join(strings.Fields(string(raw)), " ")
+	if !windowsWorktreeScopeRe.MatchString(prose) {
+		t.Errorf("%s must scope the untracked-file guarantee to --worktree mode: no unqualified or wrong-mode claim found", windowsStandardPath)
+	}
+	if !windowsOtherModeLimitRe.MatchString(prose) {
+		t.Errorf("%s must state that --staged and --base cover the tracked diff only", windowsStandardPath)
+	}
+	if strings.Contains(prose, windowsUnscopedClaim) {
+		t.Errorf("%s still states the untracked-file guarantee with no mode qualifier (%q); --staged and --base do not scan untracked files", windowsStandardPath, windowsUnscopedClaim)
+	}
+}
+
+// TestCheckWindowsFailsWhenStatusScanFails pins that a failed untracked-file
+// listing is an error, never a clean result: the whole-file scan is the only
+// reader of untracked files, so skipping it silently leaves them unexamined.
+func TestCheckWindowsFailsWhenStatusScanFails(t *testing.T) {
+	project := t.TempDir()
+	initWindowsRepo(t, project)
+	root := windowsWorkspace(t, project, "feat")
+	testutil.WriteFile(t, filepath.Join(project, "a.go"), "package a\n")
+	runSecretScanGit(t, project, "add", "--", "a.go")
+	runSecretScanGit(t, project, "commit", "-qm", "baseline")
+	testutil.WriteFile(t, filepath.Join(project, "new.go"), "package n\n\n// TODO: untracked\n")
+	// git status rejects this value; git diff never reads it.
+	runSecretScanGit(t, project, "config", "status.renames", "bogus")
+
+	var out, errBuf bytes.Buffer
+	code := RunCheckWindows(root, []string{"feat"}, &out, &errBuf)
+	if code == 0 || strings.Contains(out.String(), "windows: ok") {
+		t.Fatalf("status failure must not report clean: code=%d out=%q err=%q", code, out.String(), errBuf.String())
+	}
+	if !strings.Contains(errBuf.String(), "windows:") {
+		t.Fatalf("status failure must be reported on stderr: err=%q", errBuf.String())
+	}
+}

package/engine/internal/lib/workspace_read.go

@@ -2,7 +2,6 @@ package lib
 
 import (
 	"fmt"
-	"os"
 	"path/filepath"
 
 	"github.com/devrites/devrites/internal/devritespaths"
@@ -19,17 +18,9 @@ func readWorkspaceArtifact(root, slug, name string) ([]byte, error) {
 		return nil, fmt.Errorf("workspace artifact: workspace unavailable: %w", err)
 	}
 	path := filepath.Join(workspace, name)
-	info, err := os.Stat(path)
+	raw, err := readBoundedRegularFile(path, workspaceArtifactLimit)
 	if err != nil {
-		return nil, fmt.Errorf("workspace artifact: %s unavailable: %w", name, err)
-	}
-	if info.Size() > workspaceArtifactLimit {
-		return nil, fmt.Errorf("workspace artifact: %s exceeds %d MiB limit", name, workspaceArtifactLimit>>20)
-	}
-	// #nosec G304 -- workspace artifact; size cap checked above
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		return nil, fmt.Errorf("workspace artifact: cannot read %s: %w", name, err)
+		return nil, fmt.Errorf("workspace artifact: %s: %w", name, err)
 	}
 	return raw, nil
 }

package/engine/internal/lib/workspace_read_test.go

@@ -0,0 +1,102 @@
+package lib
+
+import (
+	"errors"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+)
+
+func workspaceReadFixture(t *testing.T) (root, workspace string) {
+	t.Helper()
+	root = t.TempDir()
+	workspace = filepath.Join(root, "work", "feat")
+	if err := os.MkdirAll(workspace, 0o750); err != nil {
+		t.Fatal(err)
+	}
+	return root, workspace
+}
+
+func TestReadWorkspaceArtifactReadsRegularFile(t *testing.T) {
+	root, workspace := workspaceReadFixture(t)
+	if err := os.WriteFile(filepath.Join(workspace, "tasks.md"), []byte("ok"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	raw, err := readWorkspaceArtifact(root, "feat", "tasks.md")
+	if err != nil || string(raw) != "ok" {
+		t.Fatalf("raw=%q err=%v", raw, err)
+	}
+}
+
+func TestReadWorkspaceArtifactMissingKeepsNotExist(t *testing.T) {
+	root, _ := workspaceReadFixture(t)
+	if _, err := readWorkspaceArtifact(root, "feat", "tasks.md"); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("err=%v, want os.ErrNotExist", err)
+	}
+}
+
+func TestReadWorkspaceArtifactRejectsSymlinkLeaf(t *testing.T) {
+	root, workspace := workspaceReadFixture(t)
+	outside := filepath.Join(t.TempDir(), "outside.md")
+	if err := os.WriteFile(outside, []byte("outside secret"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outside, filepath.Join(workspace, "tasks.md")); err != nil {
+		t.Skipf("symlinks unavailable: %v", err)
+	}
+	raw, err := readWorkspaceArtifact(root, "feat", "tasks.md")
+	if err == nil {
+		t.Fatalf("symlinked artifact was read: %q", raw)
+	}
+}
+
+func TestReadWorkspaceArtifactRejectsFIFO(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("mkfifo under Git Bash does not create a real FIFO")
+	}
+	root, workspace := workspaceReadFixture(t)
+	if out, err := exec.Command("mkfifo", filepath.Join(workspace, "tasks.md")).CombinedOutput(); err != nil {
+		t.Skipf("fifo unavailable: %v: %s", err, out)
+	}
+	done := make(chan error, 1)
+	go func() {
+		_, err := readWorkspaceArtifact(root, "feat", "tasks.md")
+		done <- err
+	}()
+	select {
+	case err := <-done:
+		if err == nil {
+			t.Fatal("FIFO artifact read without error")
+		}
+	case <-time.After(time.Second):
+		t.Fatal("readWorkspaceArtifact blocked on a FIFO")
+	}
+}
+
+func TestReadWorkspaceArtifactMissingWorkspaceKeepsNotExist(t *testing.T) {
+	if _, err := readWorkspaceArtifact(t.TempDir(), "absent", "tasks.md"); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("err=%v, want os.ErrNotExist", err)
+	}
+}
+
+func TestReadWorkspaceArtifactRejectsOversize(t *testing.T) {
+	root, workspace := workspaceReadFixture(t)
+	path := filepath.Join(workspace, "tasks.md")
+	if err := os.WriteFile(path, nil, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Truncate(path, workspaceArtifactLimit+1); err != nil {
+		t.Fatal(err)
+	}
+	raw, err := readWorkspaceArtifact(root, "feat", "tasks.md")
+	if err == nil {
+		t.Fatalf("oversize artifact was read: %d bytes", len(raw))
+	}
+	if !strings.Contains(err.Error(), "tasks.md") || !strings.Contains(err.Error(), "exceeds") {
+		t.Fatalf("err=%v, want artifact name and limit message", err)
+	}
+}

package/engine/internal/markdowntext/markdowntext.go

@@ -19,6 +19,8 @@ func Structural(input []byte) ([]byte, error) {
 	out := append([]byte(nil), input...)
 	var marker byte
 	fenceWidth := 0
+	anchor, anchorStart := -1, 0
+	afterBlank := true
 	for start := 0; start < len(input); {
 		lineEnd := bytes.IndexByte(input[start:], '\n')
 		if lineEnd < 0 {
@@ -33,13 +35,37 @@ func Structural(input []byte) ([]byte, error) {
 		line := input[start:contentEnd]
 
 		if marker == 0 {
-			if nextMarker, width, ok := openingFence(line); ok {
+			if blank(line) {
+				afterBlank = true
+			} else if nextMarker, width, ok := openingFence(line, 3); ok {
 				marker, fenceWidth = nextMarker, width
 				mask(out[start:lineEnd])
+				anchor, afterBlank = -1, false
+			} else if nextMarker, width, ok := openingFence(line, anchor+3); ok && anchor >= 0 && indentColumns(line) >= anchor {
+				anchored := anchor
+				anchor, afterBlank = -1, false
+				if closeEnd := listFenceEnd(input, lineEnd, nextMarker, width, indentColumns(line), anchored); closeEnd >= 0 {
+					if !loneCR(input[anchorStart:closeEnd]) {
+						mask(out[start:closeEnd])
+					}
+					if closeEnd == len(input) {
+						break
+					}
+					start = closeEnd + 1
+					continue
+				}
+			} else {
+				column, ok := topLevelItem(line)
+				if ok && (afterBlank || anchor >= 0) {
+					anchor, anchorStart = column, start
+				} else {
+					anchor = -1
+				}
+				afterBlank = false
 			}
 		} else {
 			mask(out[start:lineEnd])
-			if closingFence(line, marker, fenceWidth) {
+			if closingFence(line, marker, fenceWidth, 3) {
 				marker, fenceWidth = 0, 0
 			}
 		}
@@ -52,8 +78,19 @@ func Structural(input []byte) ([]byte, error) {
 	return out, nil
 }
 
-func openingFence(line []byte) (byte, int, bool) {
-	start, ok := fenceStart(line)
+// loneCR reports a carriage return that is not the final byte of its line.
+func loneCR(b []byte) bool {
+	for i, c := range b {
+		if c == '\r' && i+1 < len(b) && b[i+1] != '\n' {
+			return true
+		}
+	}
+	return false
+}
+
+// openingFence reports a fence opener indented at most limit columns.
+func openingFence(line []byte, limit int) (byte, int, bool) {
+	start, ok := fenceStart(line, limit)
 	if !ok {
 		return 0, 0, false
 	}
@@ -71,8 +108,42 @@ func openingFence(line []byte) (byte, int, bool) {
 	return marker, end - start, true
 }
 
-func closingFence(line []byte, marker byte, width int) bool {
-	start, ok := fenceStart(line)
+// listFenceEnd returns the end offset of the line that closes a list-indented
+// fence, or -1 unless a closer with the opener's exact indentation follows and
+// every line before it is blank or indented at least as far. A closer-like line
+// at another indentation inside the item makes the pairing ambiguous.
+func listFenceEnd(input []byte, openEnd int, marker byte, width, indent, container int) int {
+	for start := openEnd + 1; start < len(input); {
+		lineEnd := bytes.IndexByte(input[start:], '\n')
+		if lineEnd < 0 {
+			lineEnd = len(input)
+		} else {
+			lineEnd += start
+		}
+		contentEnd := lineEnd
+		if contentEnd > start && input[contentEnd-1] == '\r' {
+			contentEnd--
+		}
+		line := input[start:contentEnd]
+		if !blank(line) {
+			columns := indentColumns(line)
+			if columns < indent {
+				return -1
+			}
+			if closingFence(line, marker, width, container+3) {
+				if columns != indent {
+					return -1
+				}
+				return lineEnd
+			}
+		}
+		start = lineEnd + 1
+	}
+	return -1
+}
+
+func closingFence(line []byte, marker byte, width, limit int) bool {
+	start, ok := fenceStart(line, limit)
 	if !ok || line[start] != marker {
 		return false
 	}
@@ -91,12 +162,124 @@ func closingFence(line []byte, marker byte, width int) bool {
 	return true
 }
 
-func fenceStart(line []byte) (int, bool) {
-	start := 0
-	for start < len(line) && line[start] == ' ' {
-		start++
+func fenceStart(line []byte, limit int) (int, bool) {
+	columns, start := leadingWidth(line)
+	return start, columns <= limit && start < len(line) && (line[start] == '`' || line[start] == '~')
+}
+
+// topLevelItem returns the content column of a list item whose marker sits at
+// column 0 and whose content is neither another list marker, a heading marker,
+// a fence nor part of a thematic break.
+func topLevelItem(line []byte) (int, bool) {
+	if len(line) < 2 || isThematicBreak(line) {
+		return 0, false
+	}
+	markerEnd := 1
+	switch c := line[0]; {
+	case c == '-' || c == '*' || c == '+':
+	case c >= '1' && c <= '9' && line[1] == '.':
+		markerEnd = 2
+	default:
+		return 0, false
+	}
+	if markerEnd >= len(line) || (line[markerEnd] != ' ' && line[markerEnd] != '\t') {
+		return 0, false
+	}
+	column, next := markerEnd, markerEnd
+	for next < len(line) && (line[next] == ' ' || line[next] == '\t') {
+		if line[next] == '\t' {
+			column += 4 - column%4
+		} else {
+			column++
+		}
+		next++
+	}
+	if next == len(line) || column-markerEnd > 4 || startsBlock(line[next:]) {
+		return 0, false
+	}
+	return column, true
+}
+
+// startsBlock reports content that opens a list marker, heading or fence.
+func startsBlock(content []byte) bool {
+	i := 0
+	switch c := content[0]; {
+	case c == '-' || c == '*' || c == '+':
+		i = 1
+	case c >= '0' && c <= '9':
+		for i < len(content) && i < 9 && content[i] >= '0' && content[i] <= '9' {
+			i++
+		}
+		if i == len(content) || (content[i] != '.' && content[i] != ')') {
+			return false
+		}
+		i++
+	case c == '#':
+		for i < len(content) && content[i] == '#' {
+			i++
+		}
+		if i > 6 {
+			return false
+		}
+	case c == '`' || c == '~':
+		return len(content) >= 3 && content[1] == c && content[2] == c
+	default:
+		return false
+	}
+	return i == len(content) || content[i] == ' ' || content[i] == '\t'
+}
+
+// leadingWidth returns the column width and byte length of the leading spaces
+// and tabs, with tabs advancing to the next multiple of four.
+func leadingWidth(line []byte) (columns, size int) {
+	for size < len(line) && (line[size] == ' ' || line[size] == '\t') {
+		if line[size] == '\t' {
+			columns += 4 - columns%4
+		} else {
+			columns++
+		}
+		size++
+	}
+	return columns, size
+}
+
+func blank(line []byte) bool {
+	return len(bytes.Trim(line, " \t")) == 0
+}
+
+// indentColumns is the width of the leading whitespace with tabs advancing to
+// the next multiple of four.
+func indentColumns(line []byte) int {
+	column := 0
+	for _, b := range line {
+		switch b {
+		case ' ':
+			column++
+		case '\t':
+			column += 4 - column%4
+		default:
+			return column
+		}
+	}
+	return column
+}
+
+func isThematicBreak(line []byte) bool {
+	trimmed := bytes.Trim(line, " \t")
+	if len(trimmed) < 3 || (trimmed[0] != '-' && trimmed[0] != '*' && trimmed[0] != '_') {
+		return false
+	}
+	count := 0
+	for _, b := range trimmed {
+		switch b {
+		case trimmed[0]:
+			count++
+		case ' ', '\t':
+		default:
+			return false
+		}
 	}
-	return start, start <= 3 && start < len(line) && (line[start] == '`' || line[start] == '~')
+	return count >= 3
 }
 
 func mask(data []byte) {