gsd-pi 2.28.0 → 2.29.0-dev.2ccf3fb

package/src/resources/extensions/gsd/tests/validate-directory.test.ts

@@ -0,0 +1,222 @@
+/**
+ * Unit tests for GSD Directory Validation — safeguards against dangerous directories.
+ *
+ * Exercises validateDirectory() and assertSafeDirectory() with:
+ * - Blocked system paths (/, /usr, /etc, $HOME, C:\Windows)
+ * - Temp directory root
+ * - Normal project directories (should pass)
+ * - Directories with many entries (warning heuristic)
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir, homedir, platform } from "node:os";
+import { validateDirectory, assertSafeDirectory } from "../validate-directory.ts";
+
+const isWindows = platform() === "win32";
+
+function makeTempDir(prefix: string): string {
+  const dir = join(
+    tmpdir(),
+    `gsd-validate-test-${prefix}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
+  );
+  mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+// ─── Blocked system paths (Unix) ─────────────────────────────────────────────────
+
+test("validateDirectory: root filesystem is blocked", { skip: isWindows ? "Unix-only test" : undefined }, () => {
+  const result = validateDirectory("/");
+  assert.equal(result.safe, false);
+  assert.equal(result.severity, "blocked");
+  assert.ok(result.reason?.includes("system directory"));
+});
+
+test("validateDirectory: /usr is blocked", { skip: isWindows ? "Unix-only test" : undefined }, () => {
+  const result = validateDirectory("/usr");
+  assert.equal(result.safe, false);
+  assert.equal(result.severity, "blocked");
+});
+
+test("validateDirectory: /etc is blocked", { skip: isWindows ? "Unix-only test" : undefined }, () => {
+  const result = validateDirectory("/etc");
+  assert.equal(result.safe, false);
+  assert.equal(result.severity, "blocked");
+});
+
+test("validateDirectory: /var is blocked", { skip: isWindows ? "Unix-only test" : undefined }, () => {
+  const result = validateDirectory("/var");
+  assert.equal(result.safe, false);
+  assert.equal(result.severity, "blocked");
+});
+
+test("validateDirectory: /usr/local/bin is blocked", { skip: isWindows ? "Unix-only test" : undefined }, () => {
+  const result = validateDirectory("/usr/local/bin");
+  assert.equal(result.safe, false);
+  assert.equal(result.severity, "blocked");
+});
+
+// ─── Blocked system paths (Windows) ──────────────────────────────────────────────
+
+test("validateDirectory: C:\\ is blocked", { skip: !isWindows ? "Windows-only test" : undefined }, () => {
+  const result = validateDirectory("C:\\");
+  assert.equal(result.safe, false);
+  assert.equal(result.severity, "blocked");
+  assert.ok(result.reason?.includes("system directory"));
+});
+
+test("validateDirectory: C:\\Windows is blocked", { skip: !isWindows ? "Windows-only test" : undefined }, () => {
+  const result = validateDirectory("C:\\Windows");
+  assert.equal(result.safe, false);
+  assert.equal(result.severity, "blocked");
+});
+
+// ─── Home directory (cross-platform) ─────────────────────────────────────────────
+
+test("validateDirectory: home directory itself is blocked", () => {
+  const result = validateDirectory(homedir());
+  assert.equal(result.safe, false);
+  assert.equal(result.severity, "blocked");
+  assert.ok(result.reason?.includes("home directory"));
+});
+
+test("validateDirectory: home directory with trailing slash is blocked", () => {
+  const sep = isWindows ? "\\" : "/";
+  const result = validateDirectory(homedir() + sep);
+  assert.equal(result.safe, false);
+  assert.equal(result.severity, "blocked");
+});
+
+test("validateDirectory: subdirectory of home is NOT blocked", () => {
+  const dir = makeTempDir("home-subdir");
+  try {
+    const result = validateDirectory(dir);
+    assert.equal(result.severity, "ok");
+    assert.equal(result.safe, true);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+// ─── Temp directory root ─────────────────────────────────────────────────────────
+
+test("validateDirectory: temp directory root is blocked", () => {
+  const result = validateDirectory(tmpdir());
+  assert.equal(result.safe, false);
+  assert.equal(result.severity, "blocked");
+  assert.ok(result.reason?.includes("temp directory"));
+});
+
+// ─── Normal project directories ──────────────────────────────────────────────────
+
+test("validateDirectory: normal project directory is safe", () => {
+  const dir = makeTempDir("normal-project");
+  try {
+    writeFileSync(join(dir, "package.json"), "{}");
+    mkdirSync(join(dir, "src"));
+    const result = validateDirectory(dir);
+    assert.equal(result.safe, true);
+    assert.equal(result.severity, "ok");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("validateDirectory: empty directory is safe", () => {
+  const dir = makeTempDir("empty");
+  try {
+    const result = validateDirectory(dir);
+    assert.equal(result.safe, true);
+    assert.equal(result.severity, "ok");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+// ─── High entry count heuristic ──────────────────────────────────────────────────
+
+test("validateDirectory: directory with >200 entries triggers warning", () => {
+  const dir = makeTempDir("many-entries");
+  try {
+    for (let i = 0; i < 210; i++) {
+      writeFileSync(join(dir, `file-${i.toString().padStart(4, "0")}.txt`), "");
+    }
+    const result = validateDirectory(dir);
+    assert.equal(result.safe, false);
+    assert.equal(result.severity, "warning");
+    assert.ok(result.reason?.includes("210 entries"));
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("validateDirectory: directory with exactly 200 entries is safe", () => {
+  const dir = makeTempDir("boundary-entries");
+  try {
+    for (let i = 0; i < 200; i++) {
+      writeFileSync(join(dir, `file-${i.toString().padStart(4, "0")}.txt`), "");
+    }
+    const result = validateDirectory(dir);
+    assert.equal(result.safe, true);
+    assert.equal(result.severity, "ok");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+// ─── assertSafeDirectory ─────────────────────────────────────────────────────────
+
+test("assertSafeDirectory: throws for blocked directories", { skip: isWindows ? "Unix-only test" : undefined }, () => {
+  assert.throws(
+    () => assertSafeDirectory("/"),
+    (err: Error) => err.message.includes("system directory"),
+  );
+});
+
+test("assertSafeDirectory: throws for home directory", () => {
+  assert.throws(
+    () => assertSafeDirectory(homedir()),
+    (err: Error) => err.message.includes("home directory"),
+  );
+});
+
+test("assertSafeDirectory: returns result for warnings (does not throw)", () => {
+  const dir = makeTempDir("assert-warning");
+  try {
+    for (let i = 0; i < 210; i++) {
+      writeFileSync(join(dir, `file-${i.toString().padStart(4, "0")}.txt`), "");
+    }
+    const result = assertSafeDirectory(dir);
+    assert.equal(result.severity, "warning");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("assertSafeDirectory: returns ok for safe directories", () => {
+  const dir = makeTempDir("assert-safe");
+  try {
+    const result = assertSafeDirectory(dir);
+    assert.equal(result.severity, "ok");
+    assert.equal(result.safe, true);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+// ─── Trailing slash normalization ────────────────────────────────────────────────
+
+test("validateDirectory: handles paths with trailing slashes", { skip: isWindows ? "Unix-only test" : undefined }, () => {
+  const result = validateDirectory("/usr/");
+  assert.equal(result.safe, false);
+  assert.equal(result.severity, "blocked");
+});
+
+test("validateDirectory: handles paths with multiple trailing slashes", { skip: isWindows ? "Unix-only test" : undefined }, () => {
+  const result = validateDirectory("/etc///");
+  assert.equal(result.safe, false);
+  assert.equal(result.severity, "blocked");
+});

package/src/resources/extensions/gsd/tests/validate-milestone.test.ts

@@ -290,6 +290,61 @@ test("verifyExpectedArtifact fails when VALIDATION.md is missing", () => {
   }
 });
 
+test("verifyExpectedArtifact rejects VALIDATION with missing frontmatter", () => {
+  const base = makeTmpBase();
+  try {
+    // A VALIDATION file without frontmatter should be treated as incomplete —
+    // matching what deriveState expects. Without this, the artifact check passes
+    // but deriveState still returns validating-milestone, causing the hard skip loop.
+    writeValidation(base, "M001", "# Validation\nNo frontmatter here.");
+    clearPathCache();
+    clearParseCache();
+    const result = verifyExpectedArtifact("validate-milestone", "M001", base);
+    assert.equal(result, false, "VALIDATION without frontmatter should fail verification");
+  } finally {
+    cleanup(base);
+  }
+});
+
+test("verifyExpectedArtifact rejects VALIDATION with missing verdict field", () => {
+  const base = makeTmpBase();
+  try {
+    writeValidation(base, "M001", "---\nremediation_round: 0\n---\n\n# Validation");
+    clearPathCache();
+    clearParseCache();
+    const result = verifyExpectedArtifact("validate-milestone", "M001", base);
+    assert.equal(result, false, "VALIDATION without verdict field should fail verification");
+  } finally {
+    cleanup(base);
+  }
+});
+
+test("verifyExpectedArtifact rejects VALIDATION with unrecognized verdict", () => {
+  const base = makeTmpBase();
+  try {
+    writeValidation(base, "M001", "---\nverdict: unknown-value\nremediation_round: 0\n---\n\n# Validation");
+    clearPathCache();
+    clearParseCache();
+    const result = verifyExpectedArtifact("validate-milestone", "M001", base);
+    assert.equal(result, false, "VALIDATION with unrecognized verdict should fail verification");
+  } finally {
+    cleanup(base);
+  }
+});
+
+test("verifyExpectedArtifact passes VALIDATION with needs-attention verdict", () => {
+  const base = makeTmpBase();
+  try {
+    writeValidation(base, "M001", "---\nverdict: needs-attention\nremediation_round: 0\n---\n\n# Validation\nNeeds attention.");
+    clearPathCache();
+    clearParseCache();
+    const result = verifyExpectedArtifact("validate-milestone", "M001", base);
+    assert.equal(result, true, "VALIDATION with needs-attention verdict should pass verification");
+  } finally {
+    cleanup(base);
+  }
+});
+
 // ─── diagnoseExpectedArtifact ─────────────────────────────────────────────
 
 test("diagnoseExpectedArtifact returns validation path for validate-milestone", () => {

package/src/resources/extensions/gsd/tests/verification-evidence.test.ts

@@ -58,6 +58,7 @@ test("verification-evidence: writeVerificationJSON writes correct JSON shape", (
           stdout: "all good",
           stderr: "",
           durationMs: 2340,
+          blocking: true,
         },
       ],
     });
@@ -105,9 +106,9 @@ test("verification-evidence: writeVerificationJSON maps exitCode to verdict corr
     const result = makeResult({
       passed: false,
       checks: [
-        { command: "lint", exitCode: 0, stdout: "", stderr: "", durationMs: 100 },
-        { command: "test", exitCode: 1, stdout: "", stderr: "fail", durationMs: 200 },
-        { command: "audit", exitCode: 2, stdout: "", stderr: "err", durationMs: 300 },
+        { command: "lint", exitCode: 0, stdout: "", stderr: "", durationMs: 100, blocking: true },
+        { command: "test", exitCode: 1, stdout: "", stderr: "fail", durationMs: 200, blocking: true },
+        { command: "audit", exitCode: 2, stdout: "", stderr: "err", durationMs: 300, blocking: true },
       ],
     });
 
@@ -133,6 +134,7 @@ test("verification-evidence: writeVerificationJSON excludes stdout/stderr from o
           stdout: "hello\n",
           stderr: "some warning",
           durationMs: 50,
+          blocking: true,
         },
       ],
     });
@@ -181,8 +183,8 @@ test("verification-evidence: writeVerificationJSON uses optional unitId when pro
 test("verification-evidence: formatEvidenceTable returns markdown table with correct columns", () => {
   const result = makeResult({
     checks: [
-      { command: "npm run typecheck", exitCode: 0, stdout: "", stderr: "", durationMs: 2340 },
-      { command: "npm run lint", exitCode: 1, stdout: "", stderr: "err", durationMs: 1100 },
+      { command: "npm run typecheck", exitCode: 0, stdout: "", stderr: "", durationMs: 2340, blocking: true },
+      { command: "npm run lint", exitCode: 1, stdout: "", stderr: "err", durationMs: 1100, blocking: true },
     ],
   });
 
@@ -214,9 +216,9 @@ test("verification-evidence: formatEvidenceTable returns no-checks message for e
 test("verification-evidence: formatEvidenceTable formats duration as seconds with 1 decimal", () => {
   const result = makeResult({
     checks: [
-      { command: "fast", exitCode: 0, stdout: "", stderr: "", durationMs: 150 },
-      { command: "slow", exitCode: 0, stdout: "", stderr: "", durationMs: 2340 },
-      { command: "zero", exitCode: 0, stdout: "", stderr: "", durationMs: 0 },
+      { command: "fast", exitCode: 0, stdout: "", stderr: "", durationMs: 150, blocking: true },
+      { command: "slow", exitCode: 0, stdout: "", stderr: "", durationMs: 2340, blocking: true },
+      { command: "zero", exitCode: 0, stdout: "", stderr: "", durationMs: 0, blocking: true },
     ],
   });
 
@@ -230,8 +232,8 @@ test("verification-evidence: formatEvidenceTable uses ✅/❌ emoji for pass/fai
   const result = makeResult({
     passed: false,
     checks: [
-      { command: "pass-cmd", exitCode: 0, stdout: "", stderr: "", durationMs: 100 },
-      { command: "fail-cmd", exitCode: 1, stdout: "", stderr: "", durationMs: 200 },
+      { command: "pass-cmd", exitCode: 0, stdout: "", stderr: "", durationMs: 100, blocking: true },
+      { command: "fail-cmd", exitCode: 1, stdout: "", stderr: "", durationMs: 200, blocking: true },
     ],
   });
 
@@ -335,8 +337,8 @@ test("verification-evidence: integration — VerificationResult → JSON → tab
     const result = makeResult({
       passed: false,
       checks: [
-        { command: "npm run typecheck", exitCode: 0, stdout: "ok", stderr: "", durationMs: 1500 },
-        { command: "npm run test:unit", exitCode: 1, stdout: "", stderr: "1 failed", durationMs: 3200 },
+        { command: "npm run typecheck", exitCode: 0, stdout: "ok", stderr: "", durationMs: 1500, blocking: true },
+        { command: "npm run test:unit", exitCode: 1, stdout: "", stderr: "1 failed", durationMs: 3200, blocking: true },
       ],
       discoverySource: "package-json",
     });
@@ -390,7 +392,7 @@ test("verification-evidence: writeVerificationJSON with retryAttempt and maxRetr
     const result = makeResult({
       passed: false,
       checks: [
-        { command: "npm run lint", exitCode: 1, stdout: "", stderr: "error", durationMs: 300 },
+        { command: "npm run lint", exitCode: 1, stdout: "", stderr: "error", durationMs: 300, blocking: true },
       ],
     });
 
@@ -415,7 +417,7 @@ test("verification-evidence: writeVerificationJSON without retry params omits re
     const result = makeResult({
       passed: true,
       checks: [
-        { command: "npm run test", exitCode: 0, stdout: "ok", stderr: "", durationMs: 100 },
+        { command: "npm run test", exitCode: 0, stdout: "ok", stderr: "", durationMs: 100, blocking: true },
       ],
     });
 
@@ -441,7 +443,7 @@ test("verification-evidence: writeVerificationJSON includes runtimeErrors when p
     const result = makeResult({
       passed: false,
       checks: [
-        { command: "npm run test", exitCode: 0, stdout: "ok", stderr: "", durationMs: 100 },
+        { command: "npm run test", exitCode: 0, stdout: "ok", stderr: "", durationMs: 100, blocking: true },
       ],
       runtimeErrors: [
         { source: "bg-shell", severity: "crash", message: "Server crashed", blocking: true },
@@ -473,7 +475,7 @@ test("verification-evidence: writeVerificationJSON omits runtimeErrors when abse
     const result = makeResult({
       passed: true,
       checks: [
-        { command: "npm run lint", exitCode: 0, stdout: "", stderr: "", durationMs: 50 },
+        { command: "npm run lint", exitCode: 0, stdout: "", stderr: "", durationMs: 50, blocking: true },
       ],
     });
 
@@ -512,7 +514,7 @@ test("verification-evidence: formatEvidenceTable appends runtime errors section"
   const result = makeResult({
     passed: false,
     checks: [
-      { command: "npm run test", exitCode: 0, stdout: "", stderr: "", durationMs: 100 },
+      { command: "npm run test", exitCode: 0, stdout: "", stderr: "", durationMs: 100, blocking: true },
     ],
     runtimeErrors: [
       { source: "bg-shell", severity: "crash", message: "Server crashed with SIGKILL", blocking: true },
@@ -537,7 +539,7 @@ test("verification-evidence: formatEvidenceTable omits runtime errors section wh
   const result = makeResult({
     passed: true,
     checks: [
-      { command: "npm run lint", exitCode: 0, stdout: "", stderr: "", durationMs: 200 },
+      { command: "npm run lint", exitCode: 0, stdout: "", stderr: "", durationMs: 200, blocking: true },
     ],
   });
 
@@ -552,7 +554,7 @@ test("verification-evidence: formatEvidenceTable truncates runtime error message
   const result = makeResult({
     passed: false,
     checks: [
-      { command: "npm run test", exitCode: 0, stdout: "", stderr: "", durationMs: 100 },
+      { command: "npm run test", exitCode: 0, stdout: "", stderr: "", durationMs: 100, blocking: true },
     ],
     runtimeErrors: [
       { source: "bg-shell", severity: "error", message: longMessage, blocking: false },
@@ -598,7 +600,7 @@ test("verification-evidence: writeVerificationJSON includes auditWarnings when p
     const result = makeResult({
       passed: true,
       checks: [
-        { command: "npm run test", exitCode: 0, stdout: "ok", stderr: "", durationMs: 100 },
+        { command: "npm run test", exitCode: 0, stdout: "ok", stderr: "", durationMs: 100, blocking: true },
       ],
       auditWarnings: SAMPLE_AUDIT_WARNINGS,
     });
@@ -627,7 +629,7 @@ test("verification-evidence: writeVerificationJSON omits auditWarnings when abse
     const result = makeResult({
       passed: true,
       checks: [
-        { command: "npm run lint", exitCode: 0, stdout: "", stderr: "", durationMs: 50 },
+        { command: "npm run lint", exitCode: 0, stdout: "", stderr: "", durationMs: 50, blocking: true },
       ],
     });
 
@@ -666,7 +668,7 @@ test("verification-evidence: formatEvidenceTable appends audit warnings section"
   const result = makeResult({
     passed: true,
     checks: [
-      { command: "npm run test", exitCode: 0, stdout: "", stderr: "", durationMs: 100 },
+      { command: "npm run test", exitCode: 0, stdout: "", stderr: "", durationMs: 100, blocking: true },
     ],
     auditWarnings: SAMPLE_AUDIT_WARNINGS,
   });
@@ -689,7 +691,7 @@ test("verification-evidence: formatEvidenceTable omits audit warnings section wh
   const result = makeResult({
     passed: true,
     checks: [
-      { command: "npm run lint", exitCode: 0, stdout: "", stderr: "", durationMs: 200 },
+      { command: "npm run lint", exitCode: 0, stdout: "", stderr: "", durationMs: 200, blocking: true },
     ],
   });
 
@@ -705,7 +707,7 @@ test("verification-evidence: integration — VerificationResult with auditWarnin
     const result = makeResult({
       passed: true,
       checks: [
-        { command: "npm run typecheck", exitCode: 0, stdout: "ok", stderr: "", durationMs: 1500 },
+        { command: "npm run typecheck", exitCode: 0, stdout: "ok", stderr: "", durationMs: 1500, blocking: true },
       ],
       auditWarnings: [
         {