forge-workflow 0.0.9 → 0.1.0-beta.2

package/lib/commands/upgrade.js

@@ -0,0 +1,47 @@
+'use strict';
+
+const {
+  applySelfHeal,
+  buildUpgradeDryRunReport,
+  renderUpgradeDryRunReport,
+} = require('../upgrade-safety');
+
+function hasArg(args, name) {
+  return Array.isArray(args) && args.includes(name);
+}
+
+const usage = 'Usage: forge upgrade [--dry-run] [--self-heal]';
+
+async function handler(args, flags, projectRoot) {
+  const dryRun = flags?.dryRun === true || flags?.['dry-run'] === true || hasArg(args, '--dry-run');
+  const selfHeal = flags?.selfHeal === true || flags?.['self-heal'] === true || hasArg(args, '--self-heal');
+
+  if (!dryRun && !selfHeal) {
+    return {
+      success: false,
+      error: usage,
+    };
+  }
+
+  const report = buildUpgradeDryRunReport(projectRoot);
+  const selfHealResult = selfHeal ? applySelfHeal(report.projectRoot, report) : null;
+  const output = renderUpgradeDryRunReport(report, selfHealResult);
+  const success = report.ok && !selfHealResult?.refused;
+
+  return {
+    success,
+    output,
+    error: success ? undefined : output,
+  };
+}
+
+module.exports = {
+  name: 'upgrade',
+  description: 'Preview and self-heal safe Forge upgrade readiness',
+  usage,
+  flags: {
+    '--dry-run': 'Preview upgrade readiness without writing files',
+    '--self-heal': 'Apply safe metadata repairs only; does not snapshot or restore',
+  },
+  handler,
+};

package/lib/commands/validate.js

@@ -11,6 +11,7 @@
 const { execFileSync } = require('node:child_process');
 const fs = require('node:fs');
 const path = require('node:path');
+const { secureExecFileSync } = require('../shell-utils');
 
 // Constants
 const CHECK_TYPES = {
@@ -31,21 +32,23 @@ const CONFLICT_MARKER_IGNORE_DIRS = new Set([
 ]);
 const CONFLICT_MARKER_ALLOWED_DOT_DIRS = new Set([
 	'.claude',
-	'.cline',
 	'.codex',
 	'.cursor',
 	'.forge',
 	'.github',
 	'.husky',
-	'.kilocode',
-	'.opencode',
-	'.roo',
 	'.sonarlint',
 ]);
 const CONFLICT_START_PATTERN = /^<<<<<<<(?: .*)?$/;
 const CONFLICT_DIVIDER_PATTERN = /^=======$/;
 const CONFLICT_END_PATTERN = /^>>>>>>>.*$/;
 const GIT_CONFLICT_SCAN_MAX_BUFFER = 16 * 1024 * 1024;
+const VALIDATION_COMMAND_TIMEOUT_MS = 600000;
+const VALIDATION_COMMAND_TIMEOUT_MINUTES = Math.round(VALIDATION_COMMAND_TIMEOUT_MS / 60000);
+
+function validationTimeoutMessage(label) {
+	return `${label} timed out after ${VALIDATION_COMMAND_TIMEOUT_MINUTES} minutes`;
+}
 
 function listConflictScanFiles(rootDir) {
 	try {
@@ -78,7 +81,7 @@ function shouldSkipConflictScanPath(relativePath) {
 }
 
 function getExecOptions() {
-	return { encoding: 'utf8', cwd: process.cwd(), timeout: 120000 };
+	return { encoding: 'utf8', cwd: process.cwd(), timeout: VALIDATION_COMMAND_TIMEOUT_MS };
 }
 
 const ERROR_PATTERNS = {
@@ -308,7 +311,7 @@ async function runTypeCheck() {
 			return {
 				success: false,
 				duration: Date.now() - startTime,
-				message: 'Type check timed out after 2 minutes',
+				message: validationTimeoutMessage('Type check'),
 			};
 		}
 
@@ -365,7 +368,7 @@ async function runLint() {
 			return {
 				success: false,
 				duration: Date.now() - startTime,
-				message: 'Lint check timed out after 2 minutes',
+				message: validationTimeoutMessage('Lint check'),
 			};
 		}
 
@@ -437,7 +440,7 @@ async function runSecurityScan() { // NOSONAR S3776
 			return {
 				success: false,
 				duration: Date.now() - startTime,
-				message: 'Security audit timed out after 2 minutes',
+				message: validationTimeoutMessage('Security audit'),
 			};
 		}
 		// bun audit exits non-zero when vulnerabilities are found; stdout still contains the data
@@ -460,13 +463,13 @@ async function runSecurityScan() { // NOSONAR S3776
 		try {
 			let npmRawOutput = null;
 			try {
-				npmRawOutput = execFileSync('npm', ['audit', '--json', '--production'], getExecOptions());  // NOSONAR S4036 - hardcoded CLI command, no user input, developer tool context
+				npmRawOutput = secureExecFileSync('npm', ['audit', '--json', '--production'], getExecOptions());  // NOSONAR S4036 - hardcoded CLI command, no user input, developer tool context
 			} catch (npmExitError) {
 				if (npmExitError.killed && npmExitError.signal === 'SIGTERM') {
 					return {
 						success: false,
 						duration: Date.now() - startTime,
-						message: 'Security audit timed out after 2 minutes',
+						message: validationTimeoutMessage('Security audit'),
 					};
 				}
 				// npm audit exits non-zero when it finds any vulnerability - stdout still has JSON
@@ -521,7 +524,7 @@ async function runSecurityScan() { // NOSONAR S3776
 				return {
 					success: false,
 					duration: Date.now() - startTime,
-					message: 'Security audit timed out after 2 minutes',
+					message: validationTimeoutMessage('Security audit'),
 				};
 			}
 
@@ -560,23 +563,46 @@ async function runSecurityScan() { // NOSONAR S3776
  * const result = await runAllTests();
  * console.log(`${result.passed}/${result.total} tests passed`);
  */
-async function runAllTests() {
+function parseTestCounts(output) {
+	const text = String(output || '');
+	const passed = parseNumber(/(\d+) pass/.exec(text));  // NOSONAR S5852 - bounded \d+ pattern
+	const failed = parseNumber(/(\d+) fail/.exec(text));  // NOSONAR S5852 - bounded \d+ pattern
+	const skipped = parseNumber(/(\d+) skip/.exec(text));  // NOSONAR S5852 - bounded \d+ pattern
+	const ranMatch = /Ran (\d+) tests/.exec(text);  // NOSONAR S5852 - bounded \d+ pattern
+	const total = ranMatch ? parseNumber(ranMatch, 1) : passed + failed + skipped;
+	return { passed, failed, skipped, total, testsFound: total > 0 };
+}
+
+async function runAllTests(exec = execFileSync) {
 	const startTime = Date.now();
 
 	try {
-		const result = execFileSync('bun', ['test'], getExecOptions());  // NOSONAR S4036 - hardcoded CLI command, no user input, developer tool context
+		const result = exec('bun', ['test', '--timeout', '30000'], getExecOptions());  // NOSONAR S4036 - hardcoded CLI command, no user input, developer tool context
+
+		const { passed, failed, skipped, total, testsFound } = parseTestCounts(result);
 
-		// Parse bun test output
-		const passed = parseNumber(/(\d+) pass/.exec(result));  // NOSONAR S5852 - bounded \d+ pattern
-		const failed = parseNumber(/(\d+) fail/.exec(result));  // NOSONAR S5852 - bounded \d+ pattern
-		const skipped = parseNumber(/(\d+) skip/.exec(result));  // NOSONAR S5852 - bounded \d+ pattern
-		const total = parseNumber(/Ran (\d+) tests/.exec(result), 1, passed + failed + skipped);
+		// B2 (N1): a bun run that executes 0 tests must NEVER report PASS — that
+		// manufactures false confidence. Surface it as an explicit SKIP instead.
+		if (!testsFound) {
+			return {
+				success: true,
+				skipped: true,
+				testsFound: false,
+				duration: Date.now() - startTime,
+				passed,
+				failed,
+				total,
+				message: 'No tests found — 0 tests executed (SKIP, not a pass). Add tests or check the runner config.',
+			};
+		}
 
 		return {
 			success: failed === 0,
+			testsFound: true,
 			duration: Date.now() - startTime,
 			passed,
 			failed,
+			skipped,
 			total,
 			message: failed === 0
 				? `All ${total} tests passed`
@@ -591,32 +617,36 @@ async function runAllTests() {
 				passed: 0,
 				failed: 0,
 				total: 0,
-				message: 'Test execution timed out after 2 minutes',
+				message: validationTimeoutMessage('Test execution'),
 			};
 		}
 
-		// Test execution failed
+		// Test runner absent — say so explicitly (do NOT silently pass).
 		if (isCommandNotFound(error)) {
 			return {
 				success: true,
 				skipped: true,
+				testsFound: false,
 				duration: Date.now() - startTime,
 				passed: 0,
 				failed: 0,
 				total: 0,
-				message: 'Tests skipped: bun not found.',
+				message: 'Tests skipped: bun test runner not found. Install bun to run tests.',
 			};
 		}
 
 		// Parse test failures from output
 		const output = error.stdout || error.message;
-		const passed = parseNumber(/(\d+) pass/.exec(output));  // NOSONAR S5852 - bounded \d+ pattern
-		const failed = parseNumber(/(\d+) fail/.exec(output), 1, 1);  // NOSONAR S5852 - bounded \d+ pattern
-		const skipped = parseNumber(/(\d+) skip/.exec(output));  // NOSONAR S5852 - bounded \d+ pattern
-		const total = passed + failed + skipped;
+		const counts = parseTestCounts(output);
+		const passed = counts.passed;
+		// bun exited non-zero: if the output shows no explicit failure count, treat
+		// it as at least one failure rather than swallowing the non-zero exit.
+		const failed = counts.failed > 0 ? counts.failed : Math.max(1, counts.failed);
+		const total = counts.total > 0 ? counts.total : passed + failed + counts.skipped;
 
 		return {
 			success: false,
+			testsFound: counts.testsFound,
 			duration: Date.now() - startTime,
 			passed,
 			failed,
@@ -826,6 +856,7 @@ module.exports = {
 	runLint,
 	runSecurityScan,
 	runAllTests,
+	parseTestCounts,
 	scanForConflictMarkers,
 	executeValidate,
 	executeDebugMode,