easc-cli 1.1.28

package/test/config/fixtures/empty-frontmatter.md

@@ -0,0 +1,4 @@
+---
+---
+
+Content

package/test/config/fixtures/frontmatter.md

@@ -0,0 +1,28 @@
+---
+description: "This is a description wrapped in quotes"
+# field: this is a commented out field that should be ignored
+occupation: This man has the following occupation: Software Engineer
+title: 'Hello World'
+name: John "Doe"
+
+family: He has no 'family'
+summary: >
+  This is a summary
+url: https://example.com:8080/path?query=value
+time: The time is 12:30:00 PM
+nested: First: Second: Third: Fourth
+quoted_colon: "Already quoted: no change needed"
+single_quoted_colon: 'Single quoted: also fine'
+mixed: He said "hello: world" and then left
+empty:
+dollar: Use $' and $& for special patterns
+---
+
+Content that should not be parsed:
+
+fake_field: this is not yaml
+another: neither is this
+time: 10:30:00 AM
+url: https://should-not-be-parsed.com:3000
+
+The above lines look like YAML but are just content.

package/test/config/fixtures/no-frontmatter.md

@@ -0,0 +1 @@
+Content

package/test/config/markdown.test.ts

@@ -0,0 +1,192 @@
+import { expect, test, describe } from "bun:test"
+import { ConfigMarkdown } from "../../src/config/markdown"
+
+describe("ConfigMarkdown: normal template", () => {
+  const template = `This is a @valid/path/to/a/file and it should also match at
+  the beginning of a line:
+
+  @another-valid/path/to/a/file
+
+  but this is not:
+
+     - Adds a "Co-authored-by:" footer which clarifies which AI agent
+       helped create this commit, using an appropriate \`noreply@...\`
+       or \`noreply@anthropic.com\` email address.
+
+  We also need to deal with files followed by @commas, ones
+  with @file-extensions.md, even @multiple.extensions.bak,
+  hidden directories like @.config/ or files like @.bashrc
+  and ones at the end of a sentence like @foo.md.
+
+  Also shouldn't forget @/absolute/paths.txt with and @/without/extensions,
+  as well as @~/home-files and @~/paths/under/home.txt.
+
+  If the reference is \`@quoted/in/backticks\` then it shouldn't match at all.`
+
+  const matches = ConfigMarkdown.files(template)
+
+  test("should extract exactly 12 file references", () => {
+    expect(matches.length).toBe(12)
+  })
+
+  test("should extract valid/path/to/a/file", () => {
+    expect(matches[0][1]).toBe("valid/path/to/a/file")
+  })
+
+  test("should extract another-valid/path/to/a/file", () => {
+    expect(matches[1][1]).toBe("another-valid/path/to/a/file")
+  })
+
+  test("should extract paths ignoring comma after", () => {
+    expect(matches[2][1]).toBe("commas")
+  })
+
+  test("should extract a path with a file extension and comma after", () => {
+    expect(matches[3][1]).toBe("file-extensions.md")
+  })
+
+  test("should extract a path with multiple dots and comma after", () => {
+    expect(matches[4][1]).toBe("multiple.extensions.bak")
+  })
+
+  test("should extract hidden directory", () => {
+    expect(matches[5][1]).toBe(".config/")
+  })
+
+  test("should extract hidden file", () => {
+    expect(matches[6][1]).toBe(".bashrc")
+  })
+
+  test("should extract a file ignoring period at end of sentence", () => {
+    expect(matches[7][1]).toBe("foo.md")
+  })
+
+  test("should extract an absolute path with an extension", () => {
+    expect(matches[8][1]).toBe("/absolute/paths.txt")
+  })
+
+  test("should extract an absolute path without an extension", () => {
+    expect(matches[9][1]).toBe("/without/extensions")
+  })
+
+  test("should extract an absolute path in home directory", () => {
+    expect(matches[10][1]).toBe("~/home-files")
+  })
+
+  test("should extract an absolute path under home directory", () => {
+    expect(matches[11][1]).toBe("~/paths/under/home.txt")
+  })
+
+  test("should not match when preceded by backtick", () => {
+    const backtickTest = "This `@should/not/match` should be ignored"
+    const backtickMatches = ConfigMarkdown.files(backtickTest)
+    expect(backtickMatches.length).toBe(0)
+  })
+
+  test("should not match email addresses", () => {
+    const emailTest = "Contact user@example.com for help"
+    const emailMatches = ConfigMarkdown.files(emailTest)
+    expect(emailMatches.length).toBe(0)
+  })
+})
+
+describe("ConfigMarkdown: frontmatter parsing", async () => {
+  const parsed = await ConfigMarkdown.parse(import.meta.dir + "/fixtures/frontmatter.md")
+
+  test("should parse without throwing", () => {
+    expect(parsed).toBeDefined()
+    expect(parsed.data).toBeDefined()
+    expect(parsed.content).toBeDefined()
+  })
+
+  test("should extract description field", () => {
+    expect(parsed.data.description).toBe("This is a description wrapped in quotes")
+  })
+
+  test("should extract occupation field with colon in value", () => {
+    expect(parsed.data.occupation).toBe("This man has the following occupation: Software Engineer\n")
+  })
+
+  test("should extract title field with single quotes", () => {
+    expect(parsed.data.title).toBe("Hello World")
+  })
+
+  test("should extract name field with embedded quotes", () => {
+    expect(parsed.data.name).toBe('John "Doe"')
+  })
+
+  test("should extract family field with embedded single quotes", () => {
+    expect(parsed.data.family).toBe("He has no 'family'")
+  })
+
+  test("should extract multiline summary field", () => {
+    expect(parsed.data.summary).toBe("This is a summary\n")
+  })
+
+  test("should not include commented fields in data", () => {
+    expect(parsed.data.field).toBeUndefined()
+  })
+
+  test("should extract URL with port", () => {
+    expect(parsed.data.url).toBe("https://example.com:8080/path?query=value\n")
+  })
+
+  test("should extract time with colons", () => {
+    expect(parsed.data.time).toBe("The time is 12:30:00 PM\n")
+  })
+
+  test("should extract value with multiple colons", () => {
+    expect(parsed.data.nested).toBe("First: Second: Third: Fourth\n")
+  })
+
+  test("should preserve already double-quoted values with colons", () => {
+    expect(parsed.data.quoted_colon).toBe("Already quoted: no change needed")
+  })
+
+  test("should preserve already single-quoted values with colons", () => {
+    expect(parsed.data.single_quoted_colon).toBe("Single quoted: also fine")
+  })
+
+  test("should extract value with quotes and colons mixed", () => {
+    expect(parsed.data.mixed).toBe('He said "hello: world" and then left\n')
+  })
+
+  test("should handle empty values", () => {
+    expect(parsed.data.empty).toBeNull()
+  })
+
+  test("should handle dollar sign replacement patterns literally", () => {
+    expect(parsed.data.dollar).toBe("Use $' and $& for special patterns")
+  })
+
+  test("should not parse fake yaml from content", () => {
+    expect(parsed.data.fake_field).toBeUndefined()
+    expect(parsed.data.another).toBeUndefined()
+  })
+
+  test("should extract content after frontmatter without modification", () => {
+    expect(parsed.content).toContain("Content that should not be parsed:")
+    expect(parsed.content).toContain("fake_field: this is not yaml")
+    expect(parsed.content).toContain("url: https://should-not-be-parsed.com:3000")
+  })
+})
+
+describe("ConfigMarkdown: frontmatter parsing w/ empty frontmatter", async () => {
+  const result = await ConfigMarkdown.parse(import.meta.dir + "/fixtures/empty-frontmatter.md")
+
+  test("should parse without throwing", () => {
+    expect(result).toBeDefined()
+    expect(result.data).toEqual({})
+    expect(result.content.trim()).toBe("Content")
+  })
+})
+
+describe("ConfigMarkdown: frontmatter parsing w/ no frontmatter", async () => {
+  const result = await ConfigMarkdown.parse(import.meta.dir + "/fixtures/no-frontmatter.md")
+
+  test("should parse without throwing", () => {
+    expect(result).toBeDefined()
+    expect(result.data).toEqual({})
+    expect(result.content.trim()).toBe("Content")
+  })
+})

package/test/file/ignore.test.ts

@@ -0,0 +1,10 @@
+import { test, expect } from "bun:test"
+import { FileIgnore } from "../../src/file/ignore"
+
+test("match nested and non-nested", () => {
+  expect(FileIgnore.match("node_modules/index.js")).toBe(true)
+  expect(FileIgnore.match("node_modules")).toBe(true)
+  expect(FileIgnore.match("node_modules/")).toBe(true)
+  expect(FileIgnore.match("node_modules/bar")).toBe(true)
+  expect(FileIgnore.match("node_modules/bar/")).toBe(true)
+})

package/test/file/path-traversal.test.ts

@@ -0,0 +1,198 @@
+import { test, expect, describe } from "bun:test"
+import path from "path"
+import fs from "fs/promises"
+import { Filesystem } from "../../src/util/filesystem"
+import { File } from "../../src/file"
+import { Instance } from "../../src/project/instance"
+import { tmpdir } from "../fixture/fixture"
+
+describe("Filesystem.contains", () => {
+  test("allows paths within project", () => {
+    expect(Filesystem.contains("/project", "/project/src")).toBe(true)
+    expect(Filesystem.contains("/project", "/project/src/file.ts")).toBe(true)
+    expect(Filesystem.contains("/project", "/project")).toBe(true)
+  })
+
+  test("blocks ../ traversal", () => {
+    expect(Filesystem.contains("/project", "/project/../etc")).toBe(false)
+    expect(Filesystem.contains("/project", "/project/src/../../etc")).toBe(false)
+    expect(Filesystem.contains("/project", "/etc/passwd")).toBe(false)
+  })
+
+  test("blocks absolute paths outside project", () => {
+    expect(Filesystem.contains("/project", "/etc/passwd")).toBe(false)
+    expect(Filesystem.contains("/project", "/tmp/file")).toBe(false)
+    expect(Filesystem.contains("/home/user/project", "/home/user/other")).toBe(false)
+  })
+
+  test("handles prefix collision edge cases", () => {
+    expect(Filesystem.contains("/project", "/project-other/file")).toBe(false)
+    expect(Filesystem.contains("/project", "/projectfile")).toBe(false)
+  })
+})
+
+/*
+ * Integration tests for File.read() and File.list() path traversal protection.
+ *
+ * These tests verify the HTTP API code path is protected. The HTTP endpoints
+ * in server.ts (GET /file/content, GET /file) call File.read()/File.list()
+ * directly - they do NOT go through ReadTool or the agent permission layer.
+ *
+ * This is a SEPARATE code path from ReadTool, which has its own checks.
+ */
+describe("File.read path traversal protection", () => {
+  test("rejects ../ traversal attempting to read /etc/passwd", async () => {
+    await using tmp = await tmpdir({
+      init: async (dir) => {
+        await Bun.write(path.join(dir, "allowed.txt"), "allowed content")
+      },
+    })
+
+    await Instance.provide({
+      directory: tmp.path,
+      fn: async () => {
+        await expect(File.read("../../../etc/passwd")).rejects.toThrow("Access denied: path escapes project directory")
+      },
+    })
+  })
+
+  test("rejects deeply nested traversal", async () => {
+    await using tmp = await tmpdir()
+
+    await Instance.provide({
+      directory: tmp.path,
+      fn: async () => {
+        await expect(File.read("src/nested/../../../../../../../etc/passwd")).rejects.toThrow(
+          "Access denied: path escapes project directory",
+        )
+      },
+    })
+  })
+
+  test("allows valid paths within project", async () => {
+    await using tmp = await tmpdir({
+      init: async (dir) => {
+        await Bun.write(path.join(dir, "valid.txt"), "valid content")
+      },
+    })
+
+    await Instance.provide({
+      directory: tmp.path,
+      fn: async () => {
+        const result = await File.read("valid.txt")
+        expect(result.content).toBe("valid content")
+      },
+    })
+  })
+})
+
+describe("File.list path traversal protection", () => {
+  test("rejects ../ traversal attempting to list /etc", async () => {
+    await using tmp = await tmpdir()
+
+    await Instance.provide({
+      directory: tmp.path,
+      fn: async () => {
+        await expect(File.list("../../../etc")).rejects.toThrow("Access denied: path escapes project directory")
+      },
+    })
+  })
+
+  test("allows valid subdirectory listing", async () => {
+    await using tmp = await tmpdir({
+      init: async (dir) => {
+        await Bun.write(path.join(dir, "subdir", "file.txt"), "content")
+      },
+    })
+
+    await Instance.provide({
+      directory: tmp.path,
+      fn: async () => {
+        const result = await File.list("subdir")
+        expect(Array.isArray(result)).toBe(true)
+      },
+    })
+  })
+})
+
+describe("Instance.containsPath", () => {
+  test("returns true for path inside directory", async () => {
+    await using tmp = await tmpdir({ git: true })
+
+    await Instance.provide({
+      directory: tmp.path,
+      fn: () => {
+        expect(Instance.containsPath(path.join(tmp.path, "foo.txt"))).toBe(true)
+        expect(Instance.containsPath(path.join(tmp.path, "src", "file.ts"))).toBe(true)
+      },
+    })
+  })
+
+  test("returns true for path inside worktree but outside directory (monorepo subdirectory scenario)", async () => {
+    await using tmp = await tmpdir({ git: true })
+    const subdir = path.join(tmp.path, "packages", "lib")
+    await fs.mkdir(subdir, { recursive: true })
+
+    await Instance.provide({
+      directory: subdir,
+      fn: () => {
+        // .opencode at worktree root, but we're running from packages/lib
+        expect(Instance.containsPath(path.join(tmp.path, ".opencode", "state"))).toBe(true)
+        // sibling package should also be accessible
+        expect(Instance.containsPath(path.join(tmp.path, "packages", "other", "file.ts"))).toBe(true)
+        // worktree root itself
+        expect(Instance.containsPath(tmp.path)).toBe(true)
+      },
+    })
+  })
+
+  test("returns false for path outside both directory and worktree", async () => {
+    await using tmp = await tmpdir({ git: true })
+
+    await Instance.provide({
+      directory: tmp.path,
+      fn: () => {
+        expect(Instance.containsPath("/etc/passwd")).toBe(false)
+        expect(Instance.containsPath("/tmp/other-project")).toBe(false)
+      },
+    })
+  })
+
+  test("returns false for path with .. escaping worktree", async () => {
+    await using tmp = await tmpdir({ git: true })
+
+    await Instance.provide({
+      directory: tmp.path,
+      fn: () => {
+        expect(Instance.containsPath(path.join(tmp.path, "..", "escape.txt"))).toBe(false)
+      },
+    })
+  })
+
+  test("handles directory === worktree (running from repo root)", async () => {
+    await using tmp = await tmpdir({ git: true })
+
+    await Instance.provide({
+      directory: tmp.path,
+      fn: () => {
+        expect(Instance.directory).toBe(Instance.worktree)
+        expect(Instance.containsPath(path.join(tmp.path, "file.txt"))).toBe(true)
+        expect(Instance.containsPath("/etc/passwd")).toBe(false)
+      },
+    })
+  })
+
+  test("non-git project does not allow arbitrary paths via worktree='/'", async () => {
+    await using tmp = await tmpdir() // no git: true
+
+    await Instance.provide({
+      directory: tmp.path,
+      fn: () => {
+        // worktree is "/" for non-git projects, but containsPath should NOT allow all paths
+        expect(Instance.containsPath(path.join(tmp.path, "file.txt"))).toBe(true)
+        expect(Instance.containsPath("/etc/passwd")).toBe(false)
+        expect(Instance.containsPath("/tmp/other")).toBe(false)
+      },
+    })
+  })
+})

package/test/fixture/fixture.ts

@@ -0,0 +1,45 @@
+import { $ } from "bun"
+import * as fs from "fs/promises"
+import os from "os"
+import path from "path"
+import type { Config } from "../../src/config/config"
+
+// Strip null bytes from paths (defensive fix for CI environment issues)
+function sanitizePath(p: string): string {
+  return p.replace(/\0/g, "")
+}
+
+type TmpDirOptions<T> = {
+  git?: boolean
+  config?: Partial<Config.Info>
+  init?: (dir: string) => Promise<T>
+  dispose?: (dir: string) => Promise<T>
+}
+export async function tmpdir<T>(options?: TmpDirOptions<T>) {
+  const dirpath = sanitizePath(path.join(os.tmpdir(), "opencode-test-" + Math.random().toString(36).slice(2)))
+  await fs.mkdir(dirpath, { recursive: true })
+  if (options?.git) {
+    await $`git init`.cwd(dirpath).quiet()
+    await $`git commit --allow-empty -m "root commit ${dirpath}"`.cwd(dirpath).quiet()
+  }
+  if (options?.config) {
+    await Bun.write(
+      path.join(dirpath, "opencode.json"),
+      JSON.stringify({
+        $schema: "https://opencode.ai/config.json",
+        ...options.config,
+      }),
+    )
+  }
+  const extra = await options?.init?.(dirpath)
+  const realpath = sanitizePath(await fs.realpath(dirpath))
+  const result = {
+    [Symbol.asyncDispose]: async () => {
+      await options?.dispose?.(dirpath)
+      // await fs.rm(dirpath, { recursive: true, force: true })
+    },
+    path: realpath,
+    extra: extra as T,
+  }
+  return result
+}

package/test/fixture/lsp/fake-lsp-server.js

@@ -0,0 +1,77 @@
+// Simple JSON-RPC 2.0 LSP-like fake server over stdio
+// Implements a minimal LSP handshake and triggers a request upon notification
+
+const net = require("net")
+
+let nextId = 1
+
+function encode(message) {
+  const json = JSON.stringify(message)
+  const header = `Content-Length: ${Buffer.byteLength(json, "utf8")}\r\n\r\n`
+  return Buffer.concat([Buffer.from(header, "utf8"), Buffer.from(json, "utf8")])
+}
+
+function decodeFrames(buffer) {
+  const results = []
+  let idx
+  while ((idx = buffer.indexOf("\r\n\r\n")) !== -1) {
+    const header = buffer.slice(0, idx).toString("utf8")
+    const m = /Content-Length:\s*(\d+)/i.exec(header)
+    const len = m ? parseInt(m[1], 10) : 0
+    const bodyStart = idx + 4
+    const bodyEnd = bodyStart + len
+    if (buffer.length < bodyEnd) break
+    const body = buffer.slice(bodyStart, bodyEnd).toString("utf8")
+    results.push(body)
+    buffer = buffer.slice(bodyEnd)
+  }
+  return { messages: results, rest: buffer }
+}
+
+let readBuffer = Buffer.alloc(0)
+
+process.stdin.on("data", (chunk) => {
+  readBuffer = Buffer.concat([readBuffer, chunk])
+  const { messages, rest } = decodeFrames(readBuffer)
+  readBuffer = rest
+  for (const m of messages) handle(m)
+})
+
+function send(msg) {
+  process.stdout.write(encode(msg))
+}
+
+function sendRequest(method, params) {
+  const id = nextId++
+  send({ jsonrpc: "2.0", id, method, params })
+  return id
+}
+
+function handle(raw) {
+  let data
+  try {
+    data = JSON.parse(raw)
+  } catch {
+    return
+  }
+  if (data.method === "initialize") {
+    send({ jsonrpc: "2.0", id: data.id, result: { capabilities: {} } })
+    return
+  }
+  if (data.method === "initialized") {
+    return
+  }
+  if (data.method === "workspace/didChangeConfiguration") {
+    return
+  }
+  if (data.method === "test/trigger") {
+    const method = data.params && data.params.method
+    if (method) sendRequest(method, {})
+    return
+  }
+  if (typeof data.id !== "undefined") {
+    // Respond OK to any request from client to keep transport flowing
+    send({ jsonrpc: "2.0", id: data.id, result: null })
+    return
+  }
+}

package/test/ide/ide.test.ts

@@ -0,0 +1,82 @@
+import { describe, expect, test, afterEach } from "bun:test"
+import { Ide } from "../../src/ide"
+
+describe("ide", () => {
+  const original = structuredClone(process.env)
+
+  afterEach(() => {
+    Object.keys(process.env).forEach((key) => {
+      delete process.env[key]
+    })
+    Object.assign(process.env, original)
+  })
+
+  test("should detect Visual Studio Code", () => {
+    process.env["TERM_PROGRAM"] = "vscode"
+    process.env["GIT_ASKPASS"] = "/path/to/Visual Studio Code.app/Contents/Resources/app/extensions/git/dist/askpass.sh"
+
+    expect(Ide.ide()).toBe("Visual Studio Code")
+  })
+
+  test("should detect Visual Studio Code Insiders", () => {
+    process.env["TERM_PROGRAM"] = "vscode"
+    process.env["GIT_ASKPASS"] =
+      "/Applications/Visual Studio Code - Insiders.app/Contents/Resources/app/extensions/git/dist/askpass.sh"
+
+    expect(Ide.ide()).toBe("Visual Studio Code - Insiders")
+  })
+
+  test("should detect Cursor", () => {
+    process.env["TERM_PROGRAM"] = "vscode"
+    process.env["GIT_ASKPASS"] = "/path/to/Cursor.app/Contents/Resources/app/extensions/git/dist/askpass.sh"
+
+    expect(Ide.ide()).toBe("Cursor")
+  })
+
+  test("should detect VSCodium", () => {
+    process.env["TERM_PROGRAM"] = "vscode"
+    process.env["GIT_ASKPASS"] = "/path/to/VSCodium.app/Contents/Resources/app/extensions/git/dist/askpass.sh"
+
+    expect(Ide.ide()).toBe("VSCodium")
+  })
+
+  test("should detect Windsurf", () => {
+    process.env["TERM_PROGRAM"] = "vscode"
+    process.env["GIT_ASKPASS"] = "/path/to/Windsurf.app/Contents/Resources/app/extensions/git/dist/askpass.sh"
+
+    expect(Ide.ide()).toBe("Windsurf")
+  })
+
+  test("should return unknown when TERM_PROGRAM is not vscode", () => {
+    process.env["TERM_PROGRAM"] = "iTerm2"
+    process.env["GIT_ASKPASS"] =
+      "/Applications/Visual Studio Code - Insiders.app/Contents/Resources/app/extensions/git/dist/askpass.sh"
+
+    expect(Ide.ide()).toBe("unknown")
+  })
+
+  test("should return unknown when GIT_ASKPASS does not contain IDE name", () => {
+    process.env["TERM_PROGRAM"] = "vscode"
+    process.env["GIT_ASKPASS"] = "/path/to/unknown/askpass.sh"
+
+    expect(Ide.ide()).toBe("unknown")
+  })
+
+  test("should recognize vscode-insiders OPENCODE_CALLER", () => {
+    process.env["OPENCODE_CALLER"] = "vscode-insiders"
+
+    expect(Ide.alreadyInstalled()).toBe(true)
+  })
+
+  test("should recognize vscode OPENCODE_CALLER", () => {
+    process.env["OPENCODE_CALLER"] = "vscode"
+
+    expect(Ide.alreadyInstalled()).toBe(true)
+  })
+
+  test("should return false for unknown OPENCODE_CALLER", () => {
+    process.env["OPENCODE_CALLER"] = "unknown"
+
+    expect(Ide.alreadyInstalled()).toBe(false)
+  })
+})