gsd-pi 2.78.1-dev.e9d88a536 → 2.78.1-dev.eccf86e27

package/src/resources/extensions/gsd/tests/db-writer-path-containment.test.ts

@@ -0,0 +1,152 @@
+// GSD-2 + db-writer path containment: regression tests for path.relative-based traversal guard
+
+import { describe, test, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { openDatabase, closeDatabase } from "../gsd-db.ts";
+import { createWorkspace, scopeMilestone } from "../workspace.ts";
+import {
+  saveArtifactToDbForWorkspace,
+  saveArtifactToDbByScope,
+} from "../db-writer.ts";
+
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+
+function makeProjectDir(base: string): string {
+  mkdirSync(join(base, ".gsd", "milestones"), { recursive: true });
+  return base;
+}
+
+// ─── Tests ───────────────────────────────────────────────────────────────────
+
+describe("saveArtifactToDbForWorkspace: path.relative containment guard", () => {
+  let tmp: string;
+  let projectDir: string;
+
+  beforeEach(() => {
+    tmp = mkdtempSync(join(tmpdir(), "gsd-path-contain-fw-"));
+    projectDir = makeProjectDir(tmp);
+    openDatabase(join(projectDir, ".gsd", "gsd.db"));
+  });
+
+  afterEach(() => {
+    closeDatabase();
+    rmSync(tmp, { recursive: true, force: true });
+  });
+
+  // Attack: /foo/.gsd-other/file resolves to a path that startsWith("/foo/.gsd")
+  // but is NOT inside /foo/.gsd/. The path.relative fix correctly detects this.
+  test("rejects sibling directory that startsWith would have accepted", async () => {
+    // Create a sibling directory next to .gsd that shares the prefix
+    const sibling = join(projectDir, ".gsd-other");
+    mkdirSync(sibling, { recursive: true });
+
+    const ws = createWorkspace(projectDir);
+    // Craft an opts.path that traverses out of .gsd into .gsd-other
+    // resolve(gsdDir, "../.gsd-other/evil.md") === projectDir + "/.gsd-other/evil.md"
+    // which startsWith(projectDir + "/.gsd") because ".gsd-other" starts with ".gsd"
+    const traversalPath = "../.gsd-other/evil.md";
+
+    await assert.rejects(
+      () =>
+        saveArtifactToDbForWorkspace(ws, {
+          path: traversalPath,
+          artifact_type: "CONTEXT",
+          content: "attack",
+        }),
+      /path escapes \.gsd\/ directory/,
+    );
+  });
+
+  test("rejects absolute path input", async () => {
+    const ws = createWorkspace(projectDir);
+    await assert.rejects(
+      () =>
+        saveArtifactToDbForWorkspace(ws, {
+          path: "/etc/passwd",
+          artifact_type: "CONTEXT",
+          content: "attack",
+        }),
+      /path escapes \.gsd\/ directory/,
+    );
+  });
+
+  test("accepts a legitimate path inside .gsd/", async () => {
+    const ws = createWorkspace(projectDir);
+    // Should not throw — CONTEXT.md inside .gsd is valid
+    await assert.doesNotReject(() =>
+      saveArtifactToDbForWorkspace(ws, {
+        path: "CONTEXT.md",
+        artifact_type: "CONTEXT",
+        content: "# Context\n",
+      }),
+    );
+  });
+});
+
+describe("saveArtifactToDbByScope: path.relative containment guard", () => {
+  let tmp: string;
+  let projectDir: string;
+
+  beforeEach(() => {
+    tmp = mkdtempSync(join(tmpdir(), "gsd-path-contain-bs-"));
+    projectDir = makeProjectDir(tmp);
+    openDatabase(join(projectDir, ".gsd", "gsd.db"));
+  });
+
+  afterEach(() => {
+    closeDatabase();
+    rmSync(tmp, { recursive: true, force: true });
+  });
+
+  test("rejects sibling directory that startsWith would have accepted", async () => {
+    const sibling = join(projectDir, ".gsd-other");
+    mkdirSync(sibling, { recursive: true });
+
+    const ws = createWorkspace(projectDir);
+    const scope = scopeMilestone(ws, "M001");
+    const traversalPath = "../.gsd-other/evil.md";
+
+    await assert.rejects(
+      () =>
+        saveArtifactToDbByScope(scope, {
+          path: traversalPath,
+          artifact_type: "CONTEXT",
+          content: "attack",
+        }),
+      /path escapes \.gsd\/ directory/,
+    );
+  });
+
+  test("rejects absolute path input", async () => {
+    const ws = createWorkspace(projectDir);
+    const scope = scopeMilestone(ws, "M001");
+    await assert.rejects(
+      () =>
+        saveArtifactToDbByScope(scope, {
+          path: "/etc/passwd",
+          artifact_type: "CONTEXT",
+          content: "attack",
+        }),
+      /path escapes \.gsd\/ directory/,
+    );
+  });
+
+  test("accepts a legitimate milestone-relative path inside .gsd/", async () => {
+    mkdirSync(join(projectDir, ".gsd", "milestones", "M001"), {
+      recursive: true,
+    });
+    const ws = createWorkspace(projectDir);
+    const scope = scopeMilestone(ws, "M001");
+    await assert.doesNotReject(() =>
+      saveArtifactToDbByScope(scope, {
+        path: "milestones/M001/M001-CONTEXT.md",
+        artifact_type: "CONTEXT",
+        content: "# Context\n",
+      }),
+    );
+  });
+});

package/src/resources/extensions/gsd/tests/db-writer-root-artifact.test.ts

@@ -0,0 +1,221 @@
+// GSD-2 + db-writer root-artifact path guard: regression tests for M1 fix
+
+import { describe, test, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import {
+  mkdtempSync,
+  mkdirSync,
+  existsSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+} from "node:fs";
+import { join, resolve } from "node:path";
+import { tmpdir } from "node:os";
+
+import { createWorkspace, scopeMilestone } from "../workspace.ts";
+import {
+  saveArtifactToDb,
+  saveArtifactToDbByScope,
+  saveArtifactToDbForWorkspace,
+} from "../db-writer.ts";
+import { openDatabase, closeDatabase } from "../gsd-db.ts";
+
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+
+function makeProjectDir(): string {
+  const dir = realpathSync(mkdtempSync(join(tmpdir(), "gsd-dbwriter-root-")));
+  mkdirSync(join(dir, ".gsd"), { recursive: true });
+  return dir;
+}
+
+// ─── Suite 1: saveArtifactToDb with undefined milestone_id writes to .gsd/ root, not milestones/ ──
+
+describe("saveArtifactToDb: root artifact (no milestone_id) routes to workspace .gsd root", () => {
+  let tmp: string;
+
+  beforeEach(() => {
+    tmp = makeProjectDir();
+    openDatabase(join(tmp, ".gsd", "gsd.db"));
+  });
+
+  afterEach(() => {
+    closeDatabase();
+    rmSync(tmp, { recursive: true, force: true });
+  });
+
+  test("opts.milestone_id = undefined writes artifact at .gsd/REQUIREMENTS.md, not inside milestones/", async () => {
+    const content = "# Requirements\n\nTest root artifact.\n";
+    const opts = {
+      path: "REQUIREMENTS.md",
+      artifact_type: "REQUIREMENTS_DRAFT",
+      content,
+      milestone_id: undefined,
+    };
+
+    await saveArtifactToDb(opts, tmp);
+
+    const ws = createWorkspace(tmp);
+    const expectedPath = resolve(ws.contract.projectGsd, "REQUIREMENTS.md");
+
+    assert.ok(existsSync(expectedPath), "root artifact written at .gsd/REQUIREMENTS.md");
+    assert.equal(readFileSync(expectedPath, "utf-8"), content, "content matches");
+
+    // Must NOT be inside milestones/ — the latent trap being fixed
+    const wrongPath = resolve(ws.contract.projectGsd, "milestones", "", "REQUIREMENTS.md");
+    assert.ok(!existsSync(wrongPath), "artifact NOT written inside milestones/");
+  });
+
+  test("opts.milestone_id = null writes artifact at .gsd/ root", async () => {
+    const content = "# Project\n\nRoot project doc.\n";
+    const opts = {
+      path: "PROJECT.md",
+      artifact_type: "PROJECT",
+      content,
+      milestone_id: undefined,
+    };
+
+    await saveArtifactToDb(opts, tmp);
+
+    const ws = createWorkspace(tmp);
+    const expectedPath = resolve(ws.contract.projectGsd, "PROJECT.md");
+
+    assert.ok(existsSync(expectedPath), "PROJECT.md written at .gsd/PROJECT.md");
+    assert.equal(readFileSync(expectedPath, "utf-8"), content, "content matches");
+  });
+
+  test("path resolves via workspace.contract.projectGsd, not a hand-rolled join", async () => {
+    const content = "# Knowledge\n";
+    const opts = {
+      path: "KNOWLEDGE.md",
+      artifact_type: "KNOWLEDGE",
+      content,
+      milestone_id: undefined,
+    };
+
+    await saveArtifactToDb(opts, tmp);
+
+    const ws = createWorkspace(tmp);
+    // The canonical path must equal contract.projectGsd + '/KNOWLEDGE.md'
+    const canonicalPath = join(ws.contract.projectGsd, "KNOWLEDGE.md");
+    assert.ok(existsSync(canonicalPath), "file at contract.projectGsd/KNOWLEDGE.md");
+    assert.equal(
+      canonicalPath,
+      join(ws.projectRoot, ".gsd", "KNOWLEDGE.md"),
+      "contract.projectGsd-based path equals projectRoot/.gsd/KNOWLEDGE.md",
+    );
+  });
+});
+
+// ─── Suite 2: saveArtifactToDb with a real milestone_id still works (no regression) ──
+
+describe("saveArtifactToDb: milestone_id present routes to milestones/ (no regression)", () => {
+  let tmp: string;
+
+  beforeEach(() => {
+    tmp = makeProjectDir();
+    openDatabase(join(tmp, ".gsd", "gsd.db"));
+  });
+
+  afterEach(() => {
+    closeDatabase();
+    rmSync(tmp, { recursive: true, force: true });
+  });
+
+  test("milestone_id = 'M001' writes to .gsd/milestones/M001/...", async () => {
+    const relPath = "milestones/M001/M001-CONTEXT.md";
+    const content = "# M001 Context\n";
+    const opts = {
+      path: relPath,
+      artifact_type: "CONTEXT",
+      content,
+      milestone_id: "M001",
+    };
+
+    await saveArtifactToDb(opts, tmp);
+
+    const ws = createWorkspace(tmp);
+    const expectedPath = resolve(ws.contract.projectGsd, relPath);
+
+    assert.ok(existsSync(expectedPath), "milestone artifact written at correct path");
+    assert.equal(readFileSync(expectedPath, "utf-8"), content, "content matches");
+  });
+});
+
+// ─── Suite 3: saveArtifactToDbByScope with empty milestoneId throws a clear error ──
+
+describe("saveArtifactToDbByScope: empty milestoneId throws defensive error", () => {
+  let tmp: string;
+
+  beforeEach(() => {
+    tmp = makeProjectDir();
+    openDatabase(join(tmp, ".gsd", "gsd.db"));
+  });
+
+  afterEach(() => {
+    closeDatabase();
+    rmSync(tmp, { recursive: true, force: true });
+  });
+
+  test("scope with empty milestoneId throws GSDError mentioning saveArtifactToDbForWorkspace", async () => {
+    const ws = createWorkspace(tmp);
+    const emptyScope = scopeMilestone(ws, "");
+    const opts = {
+      path: "REQUIREMENTS.md",
+      artifact_type: "REQUIREMENTS_DRAFT",
+      content: "# req\n",
+    };
+
+    await assert.rejects(
+      () => saveArtifactToDbByScope(emptyScope, opts),
+      (err: unknown) => {
+        assert.ok(err instanceof Error, "thrown value is an Error");
+        assert.ok(
+          err.message.includes("milestoneId is empty"),
+          `error message should mention 'milestoneId is empty', got: ${err.message}`,
+        );
+        assert.ok(
+          err.message.includes("saveArtifactToDbForWorkspace"),
+          `error message should mention 'saveArtifactToDbForWorkspace', got: ${err.message}`,
+        );
+        return true;
+      },
+    );
+  });
+});
+
+// ─── Suite 4: saveArtifactToDbForWorkspace writes at contract.projectGsd, not milestones/ ──
+
+describe("saveArtifactToDbForWorkspace: writes directly to .gsd root via workspace contract", () => {
+  let tmp: string;
+
+  beforeEach(() => {
+    tmp = makeProjectDir();
+    openDatabase(join(tmp, ".gsd", "gsd.db"));
+  });
+
+  afterEach(() => {
+    closeDatabase();
+    rmSync(tmp, { recursive: true, force: true });
+  });
+
+  test("root artifact lands at contract.projectGsd/path, not milestones/", async () => {
+    const ws = createWorkspace(tmp);
+    const content = "# Requirements\n";
+    const opts = {
+      path: "REQUIREMENTS.md",
+      artifact_type: "REQUIREMENTS_DRAFT",
+      content,
+    };
+
+    await saveArtifactToDbForWorkspace(ws, opts);
+
+    const expectedPath = resolve(ws.contract.projectGsd, "REQUIREMENTS.md");
+    assert.ok(existsSync(expectedPath), "artifact written at contract.projectGsd/REQUIREMENTS.md");
+    assert.equal(readFileSync(expectedPath, "utf-8"), content, "content matches");
+
+    // Must not have landed inside milestones/
+    const milestonePath = join(ws.contract.projectGsd, "milestones", "", "REQUIREMENTS.md");
+    assert.ok(!existsSync(milestonePath), "artifact NOT inside milestones/empty-string/");
+  });
+});

package/src/resources/extensions/gsd/tests/db-writer-scope.test.ts

@@ -0,0 +1,230 @@
+// GSD-2 + db-writer saveArtifactToDbByScope: workspace-contract path routing tests
+
+import { describe, test, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import {
+  mkdtempSync,
+  mkdirSync,
+  existsSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+} from "node:fs";
+import { join, resolve } from "node:path";
+import { tmpdir } from "node:os";
+
+import { createWorkspace, scopeMilestone } from "../workspace.ts";
+import { saveArtifactToDb, saveArtifactToDbByScope } from "../db-writer.ts";
+import { openDatabase, closeDatabase } from "../gsd-db.ts";
+
+// ─── Helpers ────────────────────────────────────────────────────────────────
+
+function makeProjectDir(): string {
+  const dir = realpathSync(mkdtempSync(join(tmpdir(), "gsd-dbwriter-scope-")));
+  mkdirSync(join(dir, ".gsd"), { recursive: true });
+  return dir;
+}
+
+// ─── Suite 1: scope variant writes to the same canonical path as legacy ──────
+
+describe("saveArtifactToDbByScope: path parity with legacy saveArtifactToDb", () => {
+  let tmp1: string;
+  let tmp2: string;
+
+  beforeEach(() => {
+    tmp1 = makeProjectDir();
+    tmp2 = makeProjectDir();
+  });
+
+  afterEach(() => {
+    closeDatabase();
+    rmSync(tmp1, { recursive: true, force: true });
+    rmSync(tmp2, { recursive: true, force: true });
+  });
+
+  test("scope variant writes artifact to same canonical path as legacy variant", async () => {
+    const relPath = "milestones/M001/slices/S01/tasks/T01-SUMMARY.md";
+    const content = "# T01 Summary\n\nTest content.\n";
+    const opts = {
+      path: relPath,
+      artifact_type: "SUMMARY",
+      content,
+      milestone_id: "M001",
+      slice_id: "S01",
+      task_id: "T01",
+    };
+
+    // Legacy path: basePath + '.gsd' join
+    const legacyExpectedPath = resolve(tmp1, ".gsd", relPath);
+
+    // Scope path: contract.projectGsd
+    const ws = createWorkspace(tmp2);
+    const scope = scopeMilestone(ws, "M001");
+    const scopeExpectedPath = resolve(ws.contract.projectGsd, relPath);
+
+    // Both should resolve to the same relative structure
+    // (though under different temp dirs — so we compare structure, not absolute path)
+    assert.equal(
+      scopeExpectedPath,
+      resolve(ws.contract.projectGsd, relPath),
+      "scope path must be contract.projectGsd + relPath",
+    );
+    assert.equal(
+      legacyExpectedPath,
+      resolve(tmp1, ".gsd", relPath),
+      "legacy path must be basePath/.gsd + relPath",
+    );
+
+    // Open DB for tmp1 and write via legacy
+    const dbPath1 = join(tmp1, ".gsd", "gsd.db");
+    openDatabase(dbPath1);
+    await saveArtifactToDb(opts, tmp1);
+    closeDatabase();
+
+    // Open DB for tmp2 and write via scope variant
+    const dbPath2 = join(tmp2, ".gsd", "gsd.db");
+    openDatabase(dbPath2);
+    await saveArtifactToDbByScope(scope, opts);
+    closeDatabase();
+
+    // Both should have written to the correct location under their respective .gsd dirs
+    assert.ok(existsSync(legacyExpectedPath), "legacy: artifact written at basePath/.gsd/relPath");
+    assert.ok(existsSync(scopeExpectedPath), "scope: artifact written at contract.projectGsd/relPath");
+
+    // Content must match
+    assert.equal(readFileSync(legacyExpectedPath, "utf-8"), content, "legacy: content matches");
+    assert.equal(readFileSync(scopeExpectedPath, "utf-8"), content, "scope: content matches");
+  });
+});
+
+// ─── Suite 2: scope variant uses contract.projectGsd, not a basePath join ────
+
+describe("saveArtifactToDbByScope: uses contract.projectGsd, not hand-rolled basePath join", () => {
+  let tmp: string;
+
+  beforeEach(() => {
+    tmp = makeProjectDir();
+  });
+
+  afterEach(() => {
+    closeDatabase();
+    rmSync(tmp, { recursive: true, force: true });
+  });
+
+  test("scope.workspace.contract.projectGsd is used as the .gsd root, not basePath/.gsd", async () => {
+    const ws = createWorkspace(tmp);
+    const scope = scopeMilestone(ws, "M001");
+
+    // The contract.projectGsd must equal the canonical join(projectRoot, '.gsd')
+    assert.equal(
+      ws.contract.projectGsd,
+      join(ws.projectRoot, ".gsd"),
+      "contract.projectGsd must equal join(projectRoot, '.gsd')",
+    );
+
+    // It must NOT be a hand-rolled resolution from an arbitrary basePath string
+    // (i.e., contract.projectGsd routes through the workspace contract)
+    assert.ok(
+      ws.contract.projectGsd.startsWith(ws.projectRoot),
+      "contract.projectGsd must be rooted at projectRoot",
+    );
+
+    const relPath = "milestones/M001/M001-CONTEXT.md";
+    const content = "# M001 Context\n";
+    const opts = {
+      path: relPath,
+      artifact_type: "CONTEXT",
+      content,
+      milestone_id: "M001",
+    };
+
+    openDatabase(join(tmp, ".gsd", "gsd.db"));
+    await saveArtifactToDbByScope(scope, opts);
+
+    // File must be at contract.projectGsd/relPath
+    const expectedPath = resolve(ws.contract.projectGsd, relPath);
+    assert.ok(existsSync(expectedPath), "artifact written at contract.projectGsd/relPath");
+    assert.equal(readFileSync(expectedPath, "utf-8"), content, "content matches");
+
+    // And must NOT be at some other location
+    const handRolledPath = resolve(tmp, ".gsd", relPath);
+    // Both should be the same path in project mode (they should agree)
+    assert.equal(
+      expectedPath,
+      handRolledPath,
+      "in project mode, contract.projectGsd resolves same as basePath/.gsd",
+    );
+  });
+});
+
+// ─── Suite 3: worktree-mode scope routes to project root's .gsd/ ─────────────
+
+describe("saveArtifactToDbByScope: worktree scope writes to project root .gsd/", () => {
+  let tmp: string;
+
+  beforeEach(() => {
+    tmp = realpathSync(mkdtempSync(join(tmpdir(), "gsd-dbwriter-wt-scope-")));
+    // Create project .gsd directory
+    mkdirSync(join(tmp, ".gsd"), { recursive: true });
+  });
+
+  afterEach(() => {
+    closeDatabase();
+    rmSync(tmp, { recursive: true, force: true });
+  });
+
+  test("worktree-mode scope: contract.projectGsd resolves to project root's .gsd/, not worktree .gsd/", async () => {
+    // Construct a worktree path inside the project's .gsd/worktrees/<MID>
+    const worktreePath = join(tmp, ".gsd", "worktrees", "M001");
+    mkdirSync(join(worktreePath, ".gsd"), { recursive: true });
+
+    const projectWs = createWorkspace(tmp);
+    const worktreeWs = createWorkspace(worktreePath);
+
+    // Both should share the same projectRoot (worktree-root resolution)
+    assert.equal(
+      worktreeWs.projectRoot,
+      projectWs.projectRoot,
+      "worktree workspace must have same projectRoot as project workspace",
+    );
+
+    // contract.projectGsd for the worktree workspace must point to the PROJECT root's .gsd/
+    assert.equal(
+      worktreeWs.contract.projectGsd,
+      join(projectWs.projectRoot, ".gsd"),
+      "worktree contract.projectGsd must equal project root's .gsd/",
+    );
+
+    // Must NOT be the worktree-local .gsd/
+    assert.notEqual(
+      worktreeWs.contract.projectGsd,
+      join(worktreePath, ".gsd"),
+      "worktree contract.projectGsd must NOT be the worktree-local .gsd/",
+    );
+
+    // Write via the worktree-mode scope
+    const scope = scopeMilestone(worktreeWs, "M001");
+    const relPath = "milestones/M001/M001-CONTEXT.md";
+    const content = "# M001 Context from worktree scope\n";
+    const opts = {
+      path: relPath,
+      artifact_type: "CONTEXT",
+      content,
+      milestone_id: "M001",
+    };
+
+    openDatabase(join(tmp, ".gsd", "gsd.db"));
+    await saveArtifactToDbByScope(scope, opts);
+
+    // File must land in the PROJECT root's .gsd/, not in the worktree's .gsd/
+    const projectPath = resolve(projectWs.contract.projectGsd, relPath);
+    const worktreeLocalPath = resolve(worktreePath, ".gsd", relPath);
+
+    assert.ok(existsSync(projectPath), "artifact written to project root's .gsd/");
+    assert.ok(
+      !existsSync(worktreeLocalPath),
+      "artifact must NOT be written to worktree-local .gsd/",
+    );
+    assert.equal(readFileSync(projectPath, "utf-8"), content, "content at project root matches");
+  });
+});