forge-workflow 0.0.4 → 0.0.6

package/lib/commands/sync.js

@@ -0,0 +1,55 @@
+'use strict';
+
+const { execFileSync } = require('node:child_process');
+
+/**
+ * Forge Sync Command
+ * Syncs Beads issue data by running dolt pull + push.
+ * Uses execFileSync (not execSync) to prevent command injection (OWASP A03).
+ *
+ * @module commands/sync
+ */
+module.exports = {
+  name: 'sync',
+  description: 'Sync Beads issue data (dolt pull + push)',
+  usage: 'forge sync',
+  flags: {},
+
+  /**
+   * Run beads dolt pull + push to sync issue data.
+   * @param {string[]} _args - Positional arguments (unused)
+   * @param {object} _flags - CLI flags (unused)
+   * @param {string} _projectRoot - Project root path (unused)
+   * @param {object} [opts] - Options for dependency injection
+   * @param {Function} [opts._exec] - Override for execFileSync (testing)
+   * @returns {Promise<{success: boolean, synced: boolean, message?: string, error?: string}>}
+   */
+  handler: async (_args, _flags, _projectRoot, opts = {}) => {
+    const exec = opts._exec || execFileSync;
+
+    // Step 1: Check if bd binary exists
+    try {
+      exec('bd', ['--version'], { stdio: 'pipe' });
+    } catch (_checkErr) { /* intentional: bd not installed, skip sync gracefully */ // NOSONAR S2486
+      return {
+        success: true,
+        synced: false,
+        message: 'Beads not installed — nothing to sync',
+      };
+    }
+
+    // Step 2: Run dolt pull + push
+    try {
+      exec('bd', ['dolt', 'pull'], { stdio: 'pipe' });
+      exec('bd', ['dolt', 'push'], { stdio: 'pipe' });
+    } catch (syncErr) {
+      return {
+        success: false,
+        synced: false,
+        error: syncErr.message,
+      };
+    }
+
+    return { success: true, synced: true };
+  },
+};

package/lib/commands/team.js

@@ -0,0 +1,37 @@
+const { existsSync } = require('node:fs');
+const { execFileSync } = require('node:child_process');
+const path = require('node:path');
+
+// Resolve bash binary from fixed, known locations only (no PATH search).
+// SonarCloud S4036: PATH must not be searched for OS commands.
+function _resolveBash() {
+  if (process.platform === 'win32') {
+    // Fixed locations for Git Bash on Windows (no PATH search)
+    const candidates = [
+      'C:\\Program Files\\Git\\bin\\bash.exe',
+      'C:\\Program Files (x86)\\Git\\bin\\bash.exe',
+      `${process.env.LOCALAPPDATA || ''}\\Programs\\Git\\bin\\bash.exe`,
+    ];
+    for (const p of candidates) {
+      if (p && existsSync(p)) return p;
+    }
+    // Fallback: assume Git Bash is in PATH (less secure but functional)
+    return 'bash';
+  }
+  return '/usr/bin/bash';
+}
+
+function handleTeam(args) {
+  const scriptPath = path.join(__dirname, '..', '..', 'scripts', 'forge-team', 'index.sh');
+  const bashPath = _resolveBash();
+
+  try {
+    execFileSync(bashPath, [scriptPath, ...args], {
+      stdio: 'inherit',
+    });
+  } catch (err) {
+    process.exit(err.status || 1);
+  }
+}
+
+module.exports = { handleTeam };

package/lib/commands/test.js

@@ -0,0 +1,207 @@
+'use strict';
+
+/**
+ * Test Command — Smart Test Runner
+ *
+ * Wraps test execution with smart defaults:
+ * - Auto-detects package manager from lockfiles
+ * - Checks Beads (Dolt) connectivity, sets BEADS_SKIP_TESTS if unavailable
+ * - Supports --affected flag to run only tests for changed files
+ *
+ * Security: Uses execFileSync for subprocess calls (OWASP A03)
+ *
+ * @module commands/test
+ */
+
+const { execFileSync: defaultExecFileSync, spawnSync: defaultSpawnSync } = require('node:child_process');
+const defaultFs = require('node:fs');
+const path = require('node:path');
+
+/** @type {Array<[string, string]>} Lockfile → package manager mapping (order matters) */
+const LOCKFILE_MAP = [
+	['bun.lockb', 'bun'],
+	['pnpm-lock.yaml', 'pnpm'],
+	['yarn.lock', 'yarn'],
+	['package-lock.json', 'npm'],
+];
+
+const DEFAULT_TIMEOUT = 120000;
+const BEADS_CHECK_TIMEOUT = 3000;
+
+/**
+ * Detect the package manager by checking which lockfile exists.
+ *
+ * @param {string} projectRoot - Absolute path to project root
+ * @param {Object} fs - Injected fs module
+ * @returns {string} Package manager command ('bun' | 'pnpm' | 'yarn' | 'npm')
+ */
+function detectPackageManager(projectRoot, fs) {
+	for (const [lockfile, manager] of LOCKFILE_MAP) {
+		if (fs.existsSync(path.join(projectRoot, lockfile))) {
+			return manager;
+		}
+	}
+	return 'npm';
+}
+
+/**
+ * Check if Beads (bd CLI) is reachable.
+ *
+ * @param {Function} execFileSync - Injected execFileSync
+ * @returns {boolean} true if bd is available
+ */
+function checkBeadsConnectivity(execFileSync) {
+	try {
+		execFileSync('bd', ['list', '--limit=1'], { timeout: BEADS_CHECK_TIMEOUT });
+		return true;
+	} catch (_e) { // NOSONAR S2486
+		/* intentional: bd not installed or unreachable */
+		return false;
+	}
+}
+
+/**
+ * Get changed files relative to main branch, mapped to test file paths.
+ *
+ * Falls back to `git diff --name-only HEAD` if merge-base fails.
+ *
+ * @param {string} _projectRoot - Project root (unused, git uses cwd)
+ * @param {Function} execFileSync - Injected execFileSync
+ * @returns {string[]} Array of test file paths (e.g. ['test/foo.test.js'])
+ */
+function getAffectedTestFiles(_projectRoot, execFileSync) {
+	let diffRef;
+
+	// Detect default branch, then try merge-base
+	let baseBranch = 'main';
+	try {
+		baseBranch = execFileSync('git', ['rev-parse', '--abbrev-ref', 'origin/HEAD'], {
+			encoding: 'utf8', timeout: 3000,
+		}).trim().replace('origin/', '');
+	} catch (_e) { // NOSONAR S2486
+		/* intentional: origin/HEAD not set, detect base branch manually */
+		for (const name of ['main', 'master']) {
+			try {
+				execFileSync('git', ['rev-parse', '--verify', name], { stdio: 'pipe', timeout: 3000 });
+				baseBranch = name;
+				break;
+			} catch (_e2) { /* intentional: branch doesn't exist, try next name */ } // NOSONAR S2486
+		}
+	}
+
+	try {
+		const mergeBase = execFileSync('git', ['merge-base', 'HEAD', baseBranch], {
+			encoding: 'utf8',
+			timeout: 5000,
+		}).trim();
+		diffRef = `${mergeBase}...HEAD`;
+	} catch (_e) { /* intentional: merge-base failed, fallback to diff against HEAD */ // NOSONAR S2486
+		diffRef = 'HEAD';
+	}
+
+	let output;
+	try {
+		output = execFileSync('git', ['diff', '--name-only', diffRef], {
+			encoding: 'utf8',
+			timeout: 5000,
+		}).trim();
+	} catch (_e) { // NOSONAR S2486
+		/* intentional: git diff failed, no affected files to report */
+		return [];
+	}
+
+	if (!output) return [];
+
+	const changedFiles = output.split('\n').filter(Boolean);
+
+	// Map lib/*.js files to test/*.test.js
+	const testFiles = [];
+	for (const file of changedFiles) {
+		if (file.startsWith('lib/') && file.endsWith('.js')) {
+			const relative = file.slice('lib/'.length);
+			const testFile = `test/${relative.replace(/\.js$/, '.test.js')}`;
+			testFiles.push(testFile);
+		}
+	}
+
+	return testFiles;
+}
+
+module.exports = {
+	name: 'test',
+	description: 'Run tests with smart defaults (timeout, Beads skip, affected-only)',
+	usage: 'forge test [--affected]',
+	flags: {
+		'--affected': 'Run only tests for changed files',
+	},
+
+	/**
+	 * Run tests with smart defaults.
+	 *
+	 * @param {string[]} _args - Positional arguments (unused)
+	 * @param {Object} flags - Parsed flags ({ affected?: boolean })
+	 * @param {string} projectRoot - Absolute path to project root
+	 * @param {Object} [deps] - Dependency injection for testability
+	 * @param {Object} [deps.fs] - fs module
+	 * @param {Function} [deps.execFileSync] - child_process.execFileSync
+	 * @param {Function} [deps.spawnSync] - child_process.spawnSync
+	 * @returns {Promise<{ success: boolean, exitCode: number, beadsSkipped: boolean }>}
+	 */
+	async handler(_args, flags, projectRoot, deps = {}) {
+		const fs = deps.fs || defaultFs;
+		const execFileSync = deps.execFileSync || defaultExecFileSync;
+		const spawnSync = deps.spawnSync || defaultSpawnSync;
+
+		// 1. Detect package manager
+		const pkgManager = detectPackageManager(projectRoot, fs);
+
+		// 2. Read timeout from package.json or use default
+		let timeout = DEFAULT_TIMEOUT;
+		try {
+			const pkgPath = path.join(projectRoot, 'package.json');
+			const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+			const testScript = pkg.scripts?.test || '';
+			const timeoutMatch = testScript.match(/--timeout\s+(\d+)/);
+			if (timeoutMatch) {
+				timeout = Number.parseInt(timeoutMatch[1], 10);
+			}
+		} catch (_e) { /* intentional: package.json missing or unreadable, use default timeout */ } // NOSONAR S2486
+
+		// 3. Check Beads connectivity
+		const beadsAvailable = checkBeadsConnectivity(execFileSync);
+		const beadsSkipped = !beadsAvailable;
+
+		const extraEnv = {};
+		if (beadsSkipped) {
+			extraEnv.BEADS_SKIP_TESTS = '1';
+		}
+
+		// 4. Build test command args
+		let testArgs = ['run', 'test'];
+
+		// 5. --affected flag: find changed test files
+		if (flags['--affected'] || flags.affected) {
+			const affectedTests = getAffectedTestFiles(projectRoot, execFileSync);
+			if (affectedTests.length > 0) {
+				testArgs = ['run', 'test', ...affectedTests];
+			}
+			// If no affected tests found, fall back to running all tests
+		}
+
+		// 6. Run tests
+		const result = spawnSync(pkgManager, testArgs, {
+			env: { ...process.env, ...extraEnv },
+			timeout,
+			stdio: 'inherit',
+			shell: process.platform === 'win32',
+		});
+
+		const exitCode = result.status ?? 1;
+
+		return {
+			success: exitCode === 0,
+			exitCode,
+			beadsSkipped,
+		};
+	},
+};