patchwarden 1.5.0 → 1.6.1

package/src/test/unit/audit-checks.test.ts

@@ -1,567 +0,0 @@
-import { describe, it, beforeEach, afterEach } from "node:test";
-import { strict as assert } from "node:assert";
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import type { ChangedFile } from "../../runner/changeCapture.js";
-import {
-  checkForbiddenScope,
-  checkDoneEvidenceMissing,
-  checkReadmeChangelogSync,
-  checkPackageManifestConsistency,
-  checkSensitivePathAccess,
-  checkUnrecordedCommandExecution,
-} from "../../tools/auditTask.js";
-
-// ── Helpers ───────────────────────────────────────────────────────
-
-function makeChangedFile(path: string, change: ChangedFile["change"] = "modified", oldPath?: string): ChangedFile {
-  return {
-    path,
-    change,
-    old_path: oldPath,
-    before_sha256: null,
-    after_sha256: null,
-    tracked: true,
-    ignored: false,
-    kind: "source",
-  };
-}
-
-describe("auditTask new checks", () => {
-  let tempDir: string;
-
-  beforeEach(() => {
-    tempDir = mkdtempSync(join(tmpdir(), "pw-audit-checks-"));
-  });
-
-  afterEach(() => {
-    rmSync(tempDir, { recursive: true, force: true });
-  });
-
-  // ── 1. checkForbiddenScope ──────────────────────────────────────
-
-  describe("checkForbiddenScope", () => {
-    it("returns null when forbidden is null (skip)", () => {
-      const result = checkForbiddenScope([makeChangedFile("src/index.ts")], null);
-      assert.equal(result, null);
-    });
-
-    it("returns null when forbidden is empty array (skip)", () => {
-      const result = checkForbiddenScope([makeChangedFile("src/index.ts")], []);
-      assert.equal(result, null);
-    });
-
-    it("returns pass when changedFiles is empty", () => {
-      const result = checkForbiddenScope([], ["src/security/**"]);
-      assert.notEqual(result, null);
-      assert.equal(result!.result, "pass");
-      assert.equal(result!.name, "forbidden_scope_violation");
-    });
-
-    it("returns pass when no changed file matches forbidden patterns", () => {
-      const result = checkForbiddenScope(
-        [makeChangedFile("src/tools/auditTask.ts")],
-        ["src/security/**"],
-      );
-      assert.equal(result!.result, "pass");
-    });
-
-    it("returns fail when a changed file matches a ** glob (src/security/** matches src/security/pathGuard.ts)", () => {
-      const result = checkForbiddenScope(
-        [makeChangedFile("src/security/pathGuard.ts")],
-        ["src/security/**"],
-      );
-      assert.equal(result!.result, "fail");
-      assert.ok(result!.detail.includes("src/security/pathGuard.ts"));
-      assert.ok(result!.detail.includes("forbidden paths"));
-    });
-
-    it("returns fail for src/tools/* matching src/tools/auditTask.ts (single segment)", () => {
-      const result = checkForbiddenScope(
-        [makeChangedFile("src/tools/auditTask.ts")],
-        ["src/tools/*"],
-      );
-      assert.equal(result!.result, "fail");
-    });
-
-    it("returns fail for src/tools/** matching src/tools/auditTask.ts", () => {
-      const result = checkForbiddenScope(
-        [makeChangedFile("src/tools/auditTask.ts")],
-        ["src/tools/**"],
-      );
-      assert.equal(result!.result, "fail");
-    });
-
-    it("single * does NOT match nested path (src/tools/* does not match src/tools/sub/file.ts)", () => {
-      const result = checkForbiddenScope(
-        [makeChangedFile("src/tools/sub/file.ts")],
-        ["src/tools/*"],
-      );
-      assert.equal(result!.result, "pass");
-    });
-
-    it("checks old_path for renamed files", () => {
-      const result = checkForbiddenScope(
-        [makeChangedFile("src/new-path.ts", "renamed", "src/secret/old.ts")],
-        ["src/secret/**"],
-      );
-      assert.equal(result!.result, "fail");
-      assert.ok(result!.detail.includes("src/secret/old.ts"));
-    });
-
-    it("handles backslash path separators", () => {
-      const result = checkForbiddenScope(
-        [makeChangedFile("src\\security\\pathGuard.ts")],
-        ["src/security/**"],
-      );
-      assert.equal(result!.result, "fail");
-    });
-
-    it("deduplicates hit paths in detail", () => {
-      const result = checkForbiddenScope(
-        [makeChangedFile("src/secret/a.ts"), makeChangedFile("src/secret/a.ts")],
-        ["src/secret/**"],
-      );
-      const occurrences = result!.detail.split("src/secret/a.ts").length - 1;
-      assert.equal(occurrences, 1, "path should appear only once");
-    });
-  });
-
-  // ── 2. checkDoneEvidenceMissing ─────────────────────────────────
-
-  describe("checkDoneEvidenceMissing", () => {
-    it("returns null when doneEvidence is null (skip)", () => {
-      const result = checkDoneEvidenceMissing(tempDir, null);
-      assert.equal(result, null);
-    });
-
-    it("returns null when doneEvidence is empty (skip)", () => {
-      const result = checkDoneEvidenceMissing(tempDir, []);
-      assert.equal(result, null);
-    });
-
-    it("returns pass when all evidence files exist", () => {
-      writeFileSync(join(tempDir, "result.md"), "# Result", "utf-8");
-      writeFileSync(join(tempDir, "test.log"), "ok", "utf-8");
-      const result = checkDoneEvidenceMissing(tempDir, ["result.md", "test.log"]);
-      assert.equal(result!.result, "pass");
-      assert.equal(result!.name, "done_evidence_missing");
-      assert.ok(result!.detail.includes("present"));
-    });
-
-    it("returns warn when some evidence files are missing", () => {
-      writeFileSync(join(tempDir, "result.md"), "# Result", "utf-8");
-      const result = checkDoneEvidenceMissing(tempDir, ["result.md", "test.log", "git.diff"]);
-      assert.equal(result!.result, "warn");
-      assert.ok(result!.detail.includes("test.log"));
-      assert.ok(result!.detail.includes("git.diff"));
-      assert.ok(!result!.detail.includes("result.md"));
-    });
-
-    it("returns warn when all evidence files are missing", () => {
-      const result = checkDoneEvidenceMissing(tempDir, ["result.md", "test.log"]);
-      assert.equal(result!.result, "warn");
-      assert.ok(result!.detail.includes("result.md"));
-      assert.ok(result!.detail.includes("test.log"));
-    });
-  });
-
-  // ── 3. checkReadmeChangelogSync ─────────────────────────────────
-
-  describe("checkReadmeChangelogSync", () => {
-    it("returns null when no code files changed (skip)", () => {
-      const result = checkReadmeChangelogSync([
-        makeChangedFile("README.md"),
-        makeChangedFile("docs/guide.md"),
-      ]);
-      assert.equal(result, null);
-    });
-
-    it("returns null when changedFiles is empty (skip)", () => {
-      const result = checkReadmeChangelogSync([]);
-      assert.equal(result, null);
-    });
-
-    it("returns warn when code changed but no README/CHANGELOG updated", () => {
-      const result = checkReadmeChangelogSync([
-        makeChangedFile("src/index.ts"),
-        makeChangedFile("src/tools/auditTask.ts"),
-      ]);
-      assert.equal(result!.result, "warn");
-      assert.equal(result!.name, "readme_changelog_sync");
-      assert.ok(result!.detail.includes("not updated"));
-    });
-
-    it("returns pass when README.md is also changed", () => {
-      const result = checkReadmeChangelogSync([
-        makeChangedFile("src/index.ts"),
-        makeChangedFile("README.md"),
-      ]);
-      assert.equal(result!.result, "pass");
-    });
-
-    it("returns pass when CHANGELOG.md is also changed", () => {
-      const result = checkReadmeChangelogSync([
-        makeChangedFile("src/index.ts"),
-        makeChangedFile("CHANGELOG.md"),
-      ]);
-      assert.equal(result!.result, "pass");
-    });
-
-    it("is case-insensitive for README.md basename", () => {
-      const result = checkReadmeChangelogSync([
-        makeChangedFile("src/index.ts"),
-        makeChangedFile("docs/Readme.md"),
-      ]);
-      assert.equal(result!.result, "pass");
-    });
-
-    it("detects code files by various extensions", () => {
-      const extensions = [".ts", ".js", ".py", ".go", ".rs", ".java"];
-      for (const ext of extensions) {
-        const result = checkReadmeChangelogSync([makeChangedFile(`src/file${ext}`)]);
-        assert.equal(result!.result, "warn", `extension ${ext} should be detected as code`);
-      }
-    });
-
-    it("does not treat .md as code", () => {
-      const result = checkReadmeChangelogSync([makeChangedFile("docs/guide.md")]);
-      assert.equal(result, null);
-    });
-  });
-
-  // ── 4. checkPackageManifestConsistency ──────────────────────────
-
-  describe("checkPackageManifestConsistency", () => {
-    it("returns null when package.json is not in changed files (skip)", () => {
-      const result = checkPackageManifestConsistency(
-        [makeChangedFile("src/index.ts")],
-        tempDir,
-      );
-      assert.equal(result, null);
-    });
-
-    it("returns pass when package.json has valid name and version", () => {
-      writeFileSync(
-        join(tempDir, "package.json"),
-        JSON.stringify({ name: "patchwarden", version: "0.7.2" }),
-        "utf-8",
-      );
-      const result = checkPackageManifestConsistency(
-        [makeChangedFile("package.json")],
-        tempDir,
-      );
-      assert.equal(result!.result, "pass");
-      assert.equal(result!.name, "package_manifest_consistency");
-    });
-
-    it("returns warn when package.json is missing version field", () => {
-      writeFileSync(
-        join(tempDir, "package.json"),
-        JSON.stringify({ name: "patchwarden" }),
-        "utf-8",
-      );
-      const result = checkPackageManifestConsistency(
-        [makeChangedFile("package.json")],
-        tempDir,
-      );
-      assert.equal(result!.result, "warn");
-    });
-
-    it("returns warn when package.json is missing name field", () => {
-      writeFileSync(
-        join(tempDir, "package.json"),
-        JSON.stringify({ version: "0.7.2" }),
-        "utf-8",
-      );
-      const result = checkPackageManifestConsistency(
-        [makeChangedFile("package.json")],
-        tempDir,
-      );
-      assert.equal(result!.result, "warn");
-    });
-
-    it("returns warn when package.json is invalid JSON", () => {
-      writeFileSync(join(tempDir, "package.json"), "{ not valid json", "utf-8");
-      const result = checkPackageManifestConsistency(
-        [makeChangedFile("package.json")],
-        tempDir,
-      );
-      assert.equal(result!.result, "warn");
-    });
-
-    it("returns warn when package.json does not exist on disk", () => {
-      const result = checkPackageManifestConsistency(
-        [makeChangedFile("package.json")],
-        tempDir,
-      );
-      assert.equal(result!.result, "warn");
-    });
-
-    it("detects package.json case-insensitively by basename", () => {
-      writeFileSync(
-        join(tempDir, "package.json"),
-        JSON.stringify({ name: "x", version: "1.0.0" }),
-        "utf-8",
-      );
-      const result = checkPackageManifestConsistency(
-        [makeChangedFile("subdir/Package.json")],
-        tempDir,
-      );
-      assert.equal(result!.result, "pass");
-    });
-
-    it("returns warn when name/version are empty strings", () => {
-      writeFileSync(
-        join(tempDir, "package.json"),
-        JSON.stringify({ name: "", version: "" }),
-        "utf-8",
-      );
-      const result = checkPackageManifestConsistency(
-        [makeChangedFile("package.json")],
-        tempDir,
-      );
-      assert.equal(result!.result, "warn");
-    });
-  });
-
-  // ── 5. checkSensitivePathAccess ─────────────────────────────────
-
-  describe("checkSensitivePathAccess", () => {
-    it("returns null when changedFiles is empty (skip)", () => {
-      const result = checkSensitivePathAccess([]);
-      assert.equal(result, null);
-    });
-
-    it("returns pass when no sensitive paths are accessed", () => {
-      const result = checkSensitivePathAccess([
-        makeChangedFile("src/index.ts"),
-        makeChangedFile("README.md"),
-      ]);
-      assert.equal(result!.result, "pass");
-      assert.equal(result!.name, "sensitive_path_access");
-      assert.ok(result!.detail.includes("No sensitive"));
-    });
-
-    it("returns fail when .env is accessed", () => {
-      const result = checkSensitivePathAccess([makeChangedFile(".env")]);
-      assert.equal(result!.result, "fail");
-      assert.ok(result!.detail.includes(".env"));
-    });
-
-    it("returns fail when id_rsa is accessed", () => {
-      const result = checkSensitivePathAccess([makeChangedFile("id_rsa")]);
-      assert.equal(result!.result, "fail");
-    });
-
-    it("returns fail when credentials.json is accessed", () => {
-      const result = checkSensitivePathAccess([makeChangedFile("credentials.json")]);
-      assert.equal(result!.result, "fail");
-    });
-
-    it("returns fail when a sensitive path is in a subdirectory", () => {
-      const result = checkSensitivePathAccess([
-        makeChangedFile("src/index.ts"),
-        makeChangedFile("config/secrets.pem"),
-      ]);
-      assert.equal(result!.result, "fail");
-      assert.ok(result!.detail.includes("config/secrets.pem"));
-    });
-
-    it("returns fail when old_path of a renamed file is sensitive", () => {
-      const result = checkSensitivePathAccess([
-        makeChangedFile("src/new-location.ts", "renamed", ".env"),
-      ]);
-      assert.equal(result!.result, "fail");
-      assert.ok(result!.detail.includes(".env"));
-    });
-
-    it("returns pass for src/index.ts (non-sensitive)", () => {
-      const result = checkSensitivePathAccess([makeChangedFile("src/index.ts")]);
-      assert.equal(result!.result, "pass");
-    });
-
-    it("deduplicates hit paths in detail", () => {
-      const result = checkSensitivePathAccess([
-        makeChangedFile(".env"),
-        makeChangedFile(".env"),
-      ]);
-      const occurrences = result!.detail.split(".env").length - 1;
-      assert.equal(occurrences, 1, "path should appear only once");
-    });
-  });
-
-  // ── 6. checkUnrecordedCommandExecution ──────────────────────────
-
-  describe("checkUnrecordedCommandExecution", () => {
-    it("returns null when both contents are null (skip)", () => {
-      const result = checkUnrecordedCommandExecution(null, null, [], null);
-      assert.equal(result, null);
-    });
-
-    it("returns null when both contents are empty strings (skip)", () => {
-      const result = checkUnrecordedCommandExecution("", "", [], null);
-      assert.equal(result, null);
-    });
-
-    it("returns pass when test log command is in whitelist (npm test)", () => {
-      const result = checkUnrecordedCommandExecution(
-        "Running npm test\nExit code: 0",
-        null,
-        [],
-        "npm test",
-      );
-      assert.equal(result!.result, "pass");
-      assert.equal(result!.name, "unrecorded_command_execution");
-      assert.ok(result!.detail.includes("whitelist"));
-    });
-
-    it("returns warn when npm run build is not in whitelist", () => {
-      const result = checkUnrecordedCommandExecution(
-        "Running npm run build\nDone",
-        null,
-        [],
-        null,
-      );
-      assert.equal(result!.result, "warn");
-      assert.ok(result!.detail.includes("build"));
-    });
-
-    it("returns pass when npm run build IS in whitelist (via verify_commands)", () => {
-      const result = checkUnrecordedCommandExecution(
-        "Running npm run build\nDone",
-        null,
-        ["npm run build"],
-        null,
-      );
-      assert.equal(result!.result, "pass");
-    });
-
-    it("returns pass when npm run build IS in whitelist (via test_command)", () => {
-      const result = checkUnrecordedCommandExecution(
-        "Running npm run build\nDone",
-        null,
-        [],
-        "npm run build",
-      );
-      assert.equal(result!.result, "pass");
-    });
-
-    it("scans result.md content as well as test.log", () => {
-      const result = checkUnrecordedCommandExecution(
-        null,
-        "I ran npm run deploy to publish",
-        ["npm test"],
-        "npm test",
-      );
-      assert.equal(result!.result, "warn");
-      assert.ok(result!.detail.includes("deploy"));
-    });
-
-    it("handles npm.cmd variant", () => {
-      const result = checkUnrecordedCommandExecution(
-        "npm.cmd run build\nDone",
-        null,
-        [],
-        null,
-      );
-      assert.equal(result!.result, "warn");
-      assert.ok(result!.detail.includes("build"));
-    });
-
-    it("handles npx commands", () => {
-      const result = checkUnrecordedCommandExecution(
-        "npx eslint src/\nDone",
-        null,
-        [],
-        null,
-      );
-      assert.equal(result!.result, "warn");
-      assert.ok(result!.detail.includes("eslint"));
-    });
-
-    it("handles node commands", () => {
-      const result = checkUnrecordedCommandExecution(
-        "node ./scripts/check.js\nDone",
-        null,
-        [],
-        null,
-      );
-      assert.equal(result!.result, "warn");
-      assert.ok(result!.detail.includes("scripts/check.js"));
-    });
-
-    it("returns pass when whitelist contains all discovered commands", () => {
-      const log = "npm run build && npm test && npx tsc";
-      const result = checkUnrecordedCommandExecution(
-        log,
-        null,
-        ["npm run build", "npx tsc"],
-        "npm test",
-      );
-      assert.equal(result!.result, "pass");
-    });
-    it("recognizes commands reached transitively through npm scripts and local verifier files", () => {
-      mkdirSync(join(tempDir, "scripts"), { recursive: true });
-      writeFileSync(
-        join(tempDir, "package.json"),
-        JSON.stringify({
-          scripts: {
-            test: "node scripts/verify-all.js",
-            build: "node scripts/build.js",
-            check: "node scripts/check.js",
-          },
-        }),
-        "utf-8",
-      );
-      writeFileSync(
-        join(tempDir, "scripts", "verify-all.js"),
-        "npm run build\nnpm run check\n",
-        "utf-8",
-      );
-      const result = checkUnrecordedCommandExecution(
-        "npm test\nnode scripts/verify-all.js\nnpm run build\nnpm run check\n",
-        null,
-        [],
-        "npm test",
-        tempDir,
-      );
-      assert.equal(result!.result, "pass");
-      assert.ok(result!.detail.includes("transitive_verified_command"));
-    });
-
-    it("fails high-risk publication commands even when they look intentional", () => {
-      const result = checkUnrecordedCommandExecution(
-        "npm publish --access public\n",
-        null,
-        ["npm publish --access public"],
-        null,
-        tempDir,
-      );
-      assert.equal(result!.result, "fail");
-      assert.ok(result!.detail.includes("High-risk"));
-    });
-
-    it("returns pass when there are no commands in the log", () => {
-      const result = checkUnrecordedCommandExecution(
-        "No commands here, just text.\nExit code: 0",
-        null,
-        [],
-        null,
-      );
-      assert.equal(result!.result, "pass");
-    });
-
-    it("deduplicates unrecorded commands in detail", () => {
-      const result = checkUnrecordedCommandExecution(
-        "npm run build && npm run build && npm run build",
-        null,
-        [],
-        null,
-      );
-      const occurrences = result!.detail.split("build").length - 1;
-      assert.equal(occurrences, 1, "command should appear only once");
-    });
-  });
-});

package/src/test/unit/chinese-path.test.ts

@@ -1,106 +0,0 @@
-import { describe, it, beforeEach, afterEach } from "node:test";
-import { strict as assert } from "node:assert";
-import { mkdtempSync, rmSync, mkdirSync, writeFileSync, readFileSync, existsSync } from "node:fs";
-import { join, resolve } from "node:path";
-import { tmpdir } from "node:os";
-
-describe("Chinese path handling", () => {
-  let tempDir: string;
-
-  beforeEach(() => {
-    tempDir = mkdtempSync(join(tmpdir(), "pw-chinese-"));
-  });
-
-  afterEach(() => {
-    rmSync(tempDir, { recursive: true, force: true });
-  });
-
-  it("writes and reads status.json with Chinese repo_path", () => {
-    const chinesePath = "念念小伴_release";
-    const status = {
-      task_id: "test-001",
-      status: "pending",
-      repo_path: chinesePath,
-      resolved_repo_path: resolve(tempDir, chinesePath),
-    };
-    const statusFile = join(tempDir, "status.json");
-    writeFileSync(statusFile, JSON.stringify(status, null, 2), "utf-8");
-
-    const raw = readFileSync(statusFile, "utf-8");
-    const parsed = JSON.parse(raw);
-    assert.equal(parsed.repo_path, chinesePath);
-    assert.equal(parsed.resolved_repo_path, resolve(tempDir, chinesePath));
-  });
-
-  it("preserves Chinese characters through JSON stringify/parse", () => {
-    const testPaths = [
-      "念念小伴_release",
-      "测试项目",
-      "项目目录/子目录",
-      "日本語プロジェクト",
-      "한국어_프로젝트",
-    ];
-    for (const path of testPaths) {
-      const json = JSON.stringify({ repo_path: path });
-      const parsed = JSON.parse(json);
-      assert.equal(parsed.repo_path, path, `Path "${path}" was corrupted`);
-    }
-  });
-
-  it("creates and reads directories with Chinese names", () => {
-    const chineseDir = join(tempDir, "念念小伴_release");
-    mkdirSync(chineseDir, { recursive: true });
-    assert.ok(existsSync(chineseDir));
-
-    const filePath = join(chineseDir, "status.json");
-    const data = { repo_path: "念念小伴_release", status: "running" };
-    writeFileSync(filePath, JSON.stringify(data, null, 2), "utf-8");
-
-    const raw = readFileSync(filePath, "utf-8");
-    const parsed = JSON.parse(raw);
-    assert.equal(parsed.repo_path, "念念小伴_release");
-  });
-
-  it("handles Chinese characters in result.md", () => {
-    const resultMd = [
-      "# PatchWarden Task Result",
-      "",
-      "## Status",
-      "done",
-      "",
-      "## Files changed",
-      "- modified: 念念小伴_release/src/main.ts",
-      "- added: 测试项目/config.json",
-      "",
-    ].join("\n");
-    const resultFile = join(tempDir, "result.md");
-    writeFileSync(resultFile, resultMd, "utf-8");
-
-    const content = readFileSync(resultFile, "utf-8");
-    assert.ok(content.includes("念念小伴_release"));
-    assert.ok(content.includes("测试项目"));
-  });
-
-  it("handles mixed Chinese and ASCII paths", () => {
-    const mixedPath = "src/组件/Button.tsx";
-    const data = { path: mixedPath };
-    const json = JSON.stringify(data);
-    const parsed = JSON.parse(json);
-    assert.equal(parsed.path, mixedPath);
-  });
-
-  it("handles Chinese characters in error messages", () => {
-    const errorMsg = 'repo_path "念念小伴_release" is outside workspace';
-    const errorFile = join(tempDir, "error.log");
-    writeFileSync(errorFile, errorMsg, "utf-8");
-
-    const content = readFileSync(errorFile, "utf-8");
-    assert.ok(content.includes("念念小伴_release"));
-  });
-
-  it("handles Windows backslash paths with Chinese characters", () => {
-    const winPath = "念念小伴_release\\src\\main.ts";
-    const normalized = winPath.replace(/\\/g, "/");
-    assert.equal(normalized, "念念小伴_release/src/main.ts");
-  });
-});