start-command 0.32.0 → 0.33.0

package/test/regression-164.js

@@ -0,0 +1,308 @@
+/**
+ * Regression tests for issue #164:
+ * "Command argv is flattened with join(' '), so quoted arguments are re-parsed
+ *  by the inner shell (`$ node -e \"console.log('hi')\"` fails)"
+ *
+ * Root cause:
+ *   parseArgs() returned `commandArgs.join(' ')`, so every argument boundary and
+ *   every quote the user typed was destroyed before the command reached
+ *   `sh -c`. `node -e "console.log('hi')"` became `node -e console.log('hi')`
+ *   (a syntax error), and `echo "a  b"` became `echo a  b` (re-split into two
+ *   words). `buildShellWithArgsCmdArgs()` repaired only the `<shell> -c …`
+ *   shape (issue #91) and only on the isolation code paths.
+ *
+ * Fix:
+ *   parseArgs() rebuilds the command with buildCommandString(): a single
+ *   argument is a shell script the user quoted as a whole and stays verbatim,
+ *   while multiple arguments are each shell-quoted so the inner shell sees the
+ *   argv the user typed.
+ *
+ * Reference: https://github.com/link-foundation/start/issues/164
+ */
+
+const { describe, it, expect } = require('bun:test');
+const { spawnSync } = require('child_process');
+const os = require('os');
+const path = require('path');
+
+const { parseArgs } = require('../src/lib/args-parser');
+const {
+  buildCommandString,
+  defaultShellQuotingStyle,
+  buildDisplayCommand,
+  buildShellWithArgsCmdArgs,
+  getCommandName,
+  isInteractiveShellCommand,
+  isShellInvocationWithArgs,
+  quoteShellArg,
+  splitShellWords,
+  toShellWords,
+} = require('../src/lib/shell-utils');
+
+const CLI_PATH = path.join(__dirname, '../src/bin/cli.js');
+// PowerShell (the host shell on Windows) escapes a quote by doubling it, so the
+// rebuilt command line differs from the POSIX one (issue #164).
+const IS_POWERSHELL = defaultShellQuotingStyle() === 'powershell';
+const TEST_APP_FOLDER = path.join(
+  os.tmpdir(),
+  `regression-164-${process.pid}-${Date.now()}`
+);
+
+/** Run the CLI the way a shell would: one process argument per argv element. */
+function runCli(argv) {
+  const result = spawnSync(process.execPath, [CLI_PATH, ...argv], {
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      START_APP_FOLDER: TEST_APP_FOLDER,
+      START_DISABLE_AUTO_ISSUE: '1',
+    },
+    timeout: 20000,
+  });
+  return {
+    stdout: result.stdout || '',
+    stderr: result.stderr || '',
+    exitCode: result.status,
+  };
+}
+
+/** The command output sits between the start block and the finish block. */
+function commandOutput(stdout) {
+  // PowerShell prefixes its output with a UTF-8 BOM and ends its lines with a
+  // carriage return on Windows, and the finish block is preceded by one more
+  // blank line there, so trailing blank lines are trimmed (issue #164).
+  const lines = stdout
+    .replace(/\uFEFF/g, '')
+    .replace(/\r/g, '')
+    .split('\n');
+  const start = lines.findIndex((line) => line.startsWith('$ '));
+  const finish = lines.findIndex((line) => line === '✓' || line === '✗');
+  return lines
+    .slice(start + 2, finish - 1)
+    .join('\n')
+    .replace(/\n+$/, '');
+}
+
+function displayedCommand(stdout) {
+  return (stdout.split('\n').find((line) => line.startsWith('$ ')) || '').slice(
+    2
+  );
+}
+
+describe('parseArgs keeps argv boundaries (issue #164)', () => {
+  it('quotes an argument that contains a shell metacharacter', () => {
+    const { command, rawCommand } = parseArgs([
+      'node',
+      '-e',
+      "console.log('hi')",
+    ]);
+    expect(command).toBe(
+      IS_POWERSHELL
+        ? "node -e 'console.log(''hi'')'"
+        : "node -e 'console.log('\\''hi'\\'')'"
+    );
+    expect(rawCommand).toEqual(['node', '-e', "console.log('hi')"]);
+  });
+
+  it('quotes an argument that contains repeated spaces', () => {
+    expect(parseArgs(['echo', 'a  b']).command).toBe("echo 'a  b'");
+  });
+
+  it('keeps a single argument verbatim so shell scripts still work', () => {
+    expect(parseArgs(['ls | wc -l']).command).toBe('ls | wc -l');
+  });
+
+  it('leaves ordinary arguments unquoted', () => {
+    // `%` is an alias for ForEach-Object in PowerShell, so it has to be quoted
+    // there while a POSIX shell leaves it alone.
+    expect(parseArgs(['git', 'log', '-1', '--pretty=%s']).command).toBe(
+      IS_POWERSHELL ? "git log -1 '--pretty=%s'" : 'git log -1 --pretty=%s'
+    );
+  });
+
+  it('keeps boundaries after the -- separator', () => {
+    const { command } = parseArgs([
+      '--isolated',
+      'docker',
+      '--',
+      'git',
+      'commit',
+      '-m',
+      'msg with spaces',
+    ]);
+    expect(command).toBe("git commit -m 'msg with spaces'");
+  });
+
+  it('returns an empty command when no command was given', () => {
+    expect(parseArgs(['--list']).command).toBe('');
+  });
+});
+
+describe('buildCommandString and quoteShellArg (issue #164)', () => {
+  it('returns an empty string for empty argv', () => {
+    expect(buildCommandString([])).toBe('');
+  });
+
+  it('escapes embedded single quotes for a POSIX shell', () => {
+    expect(quoteShellArg("it's", 'posix')).toBe("'it'\\''s'");
+  });
+
+  it('escapes embedded single quotes for PowerShell by doubling them', () => {
+    expect(quoteShellArg("it's", 'powershell')).toBe("'it''s'");
+  });
+
+  it('quotes characters PowerShell treats specially but a POSIX shell does not', () => {
+    expect(quoteShellArg('a,b', 'posix')).toBe('a,b');
+    expect(quoteShellArg('a,b', 'powershell')).toBe("'a,b'");
+  });
+
+  it('uses the host shell dialect by default', () => {
+    expect(quoteShellArg("it's")).toBe(
+      quoteShellArg("it's", defaultShellQuotingStyle())
+    );
+  });
+
+  it('quotes an empty argument so it survives as an argument', () => {
+    expect(buildCommandString(['echo', ''])).toBe("echo ''");
+  });
+
+  it('round-trips through splitShellWords in both dialects', () => {
+    const argv = ['node', '-e', "console.log('a  b')", 'x$y', ''];
+    for (const style of ['posix', 'powershell']) {
+      expect(splitShellWords(buildCommandString(argv, style), style)).toEqual(
+        argv
+      );
+    }
+  });
+});
+
+describe('splitShellWords (issue #164)', () => {
+  it('splits on unquoted whitespace', () => {
+    expect(splitShellWords('echo a b')).toEqual(['echo', 'a', 'b']);
+  });
+
+  it('keeps double-quoted words together', () => {
+    expect(splitShellWords('echo "a  b"')).toEqual(['echo', 'a  b']);
+  });
+
+  it('keeps single-quoted words together', () => {
+    expect(splitShellWords("echo 'a  b'")).toEqual(['echo', 'a  b']);
+  });
+
+  it('honours backslash escapes in a POSIX shell', () => {
+    expect(splitShellWords('echo a\\ b', 'posix')).toEqual(['echo', 'a b']);
+  });
+
+  it('keeps backslashes literal for PowerShell, where they are separators', () => {
+    expect(splitShellWords('echo C:\\tmp', 'powershell')).toEqual([
+      'echo',
+      'C:\\tmp',
+    ]);
+  });
+
+  it('reads a doubled quote inside a PowerShell string as one quote', () => {
+    expect(splitShellWords("echo 'it''s'", 'powershell')).toEqual([
+      'echo',
+      "it's",
+    ]);
+  });
+
+  it('returns null when quoting is unbalanced', () => {
+    expect(splitShellWords('echo "a')).toBe(null);
+  });
+});
+
+describe('toShellWords (issue #164)', () => {
+  it('keeps a quoted bare-shell argument in one argv element', () => {
+    expect(toShellWords("bash --rcfile 'my file'")).toEqual([
+      'bash',
+      '--rcfile',
+      'my file',
+    ]);
+  });
+
+  it('falls back to whitespace splitting when quoting is unbalanced', () => {
+    expect(toShellWords('echo "a b')).toEqual(['echo', '"a', 'b']);
+  });
+});
+
+describe('shell detection stays correct for quoted commands (issue #164)', () => {
+  it('still detects a bare shell invocation', () => {
+    expect(isInteractiveShellCommand('bash')).toBe(true);
+    expect(isInteractiveShellCommand("bash -c 'echo hi'")).toBe(false);
+  });
+
+  it('detects a shell invocation whose script argument is quoted', () => {
+    expect(isShellInvocationWithArgs("bash -c 'echo hi'")).toBe(true);
+  });
+
+  it('passes the quoted script through as a single argv element', () => {
+    expect(buildShellWithArgsCmdArgs("bash -i -c 'nvm --version'")).toEqual([
+      'bash',
+      '-i',
+      '-c',
+      'nvm --version',
+    ]);
+  });
+
+  it('reads the command name from the first shell word', () => {
+    expect(getCommandName("'my command' --flag")).toBe('my command');
+  });
+});
+
+describe('buildDisplayCommand shows the argv the user typed (issue #164)', () => {
+  it('re-quotes an argument that was quoted by the parser', () => {
+    expect(buildDisplayCommand(parseArgs(['echo', 'a  b']).command)).toBe(
+      'echo "a  b"'
+    );
+  });
+
+  it('re-quotes an argument containing shell metacharacters', () => {
+    expect(
+      buildDisplayCommand(
+        parseArgs(['node', '-e', "console.log('hi')"]).command
+      )
+    ).toBe('node -e "console.log(\'hi\')"');
+  });
+
+  it('shows a single-argument shell script verbatim', () => {
+    expect(buildDisplayCommand('ls | wc -l')).toBe('ls | wc -l');
+  });
+});
+
+describe('CLI end to end (issue #164)', () => {
+  it('runs node -e with a quoted script', () => {
+    const result = runCli(['node', '-e', "console.log('hi')"]);
+    expect(result.exitCode).toBe(0);
+    expect(commandOutput(result.stdout)).toBe('hi');
+  });
+
+  it('preserves repeated spaces inside a quoted argument', () => {
+    const result = runCli(['echo', 'a  b']);
+    expect(result.exitCode).toBe(0);
+    expect(commandOutput(result.stdout)).toBe('a  b');
+  });
+
+  it('keeps `bash -c` scripts intact on the direct path (issue #91 shape)', () => {
+    const result = runCli(['bash', '-c', 'echo hello world']);
+    expect(result.exitCode).toBe(0);
+    expect(commandOutput(result.stdout)).toBe('hello world');
+  });
+
+  it('keeps arithmetic expansion inside `bash -c` intact', () => {
+    const result = runCli(['bash', '-c', 'echo $((1+1))']);
+    expect(result.exitCode).toBe(0);
+    expect(commandOutput(result.stdout)).toBe('2');
+  });
+
+  it('still runs a single quoted argument as a shell script', () => {
+    const result = runCli(['echo one | tr a-z A-Z']);
+    expect(result.exitCode).toBe(0);
+    expect(commandOutput(result.stdout)).toBe('ONE');
+  });
+
+  it('displays the command with the quoting the user typed', () => {
+    const result = runCli(['echo', 'a  b']);
+    expect(displayedCommand(result.stdout)).toBe('echo "a  b"');
+  });
+});

package/test/regression-165.js

@@ -0,0 +1,310 @@
+/**
+ * Regression tests for issue #165.
+ *
+ * A runtime that aborts on its own heap limit (`FATAL ERROR: Reached heap limit
+ * ...`) dies below the container limit, so every container signal `start`
+ * consults is correct and useless: `State.OOMKilled` is `false` and the cgroup
+ * `oom_kill` counter is `0`. The only evidence is what the runtime printed into
+ * the log, which is why `--status` now carries `memoryExhausted` /
+ * `memoryExhaustedReason` alongside `oomKilled`, and why the kept-container
+ * footer no longer asserts a bare `oomKilled=false` next to a fatal marker.
+ */
+
+const { describe, it, expect, beforeEach, afterEach } = require('bun:test');
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const {
+  ExecutionRecord,
+  ExecutionStore,
+} = require('../src/lib/execution-store');
+const {
+  buildAttachedDockerKeptMessage,
+  buildDetachedDockerCompletionScript,
+  buildDockerKeptReasonSnippet,
+} = require('../src/lib/docker-cleanup');
+
+const TEST_APP_FOLDER = path.join(
+  os.tmpdir(),
+  `regression-165-${process.pid}-${Date.now()}`
+);
+const CLI_PATH = path.join(__dirname, '../src/bin/cli.js');
+
+const HEAP_LIMIT_MARKER =
+  'FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory';
+
+function cleanupTestDir() {
+  fs.rmSync(TEST_APP_FOLDER, { recursive: true, force: true });
+}
+
+function runCli(args) {
+  const result = spawnSync(process.execPath, [CLI_PATH, ...args], {
+    encoding: 'utf8',
+    env: { ...process.env, START_APP_FOLDER: TEST_APP_FOLDER },
+    timeout: 20000,
+  });
+  return {
+    stdout: result.stdout || '',
+    stderr: result.stderr || '',
+    exitCode: result.status,
+  };
+}
+
+/**
+ * Write a log that ends the way the incident log does: command output, the
+ * dying runtime's fatal marker, an optional native stack trace, and the
+ * terminal footer `start` appends itself.
+ */
+function writeOomLog(
+  name,
+  { stackTraceBytes = 0, marker = HEAP_LIMIT_MARKER }
+) {
+  const logPath = path.join(TEST_APP_FOLDER, name);
+  const stackFrame =
+    ' 1: 0x757658 node::OOMErrorHandler(char const*, v8::OOMDetails const&) [node]\n';
+  const frames = stackTraceBytes
+    ? stackFrame.repeat(Math.ceil(stackTraceBytes / stackFrame.length))
+    : '';
+  fs.writeFileSync(
+    logPath,
+    [
+      'building...',
+      '',
+      '<--- Last few GCs --->',
+      '[1:0xa485000]  790 ms: Mark-Compact 66.6 (99.8) -> 64.4 (194.2) MB',
+      '',
+      marker,
+      '----- Native stack trace -----',
+      frames,
+      'Docker container "docker-165" exited with code 139',
+      'Container kept because the command failed.',
+      '',
+      '==================================================',
+      'Finished: 2026-09-03 08:14:20.707',
+      'Exit Code: 139',
+      '',
+    ].join('\n'),
+    'utf8'
+  );
+  return logPath;
+}
+
+function saveRecord(store, overrides = {}) {
+  const record = new ExecutionRecord({
+    command: overrides.command || 'node build.mjs',
+    pid: 4242,
+    logPath: overrides.logPath || null,
+    workingDirectory: '/tmp',
+    shell: '/bin/bash',
+    options: overrides.options || {},
+  });
+  if (overrides.exitCode !== undefined) {
+    record.complete(overrides.exitCode);
+  }
+  store.save(record);
+  return record;
+}
+
+function statusJson(uuid) {
+  const result = runCli(['--status', uuid, '--output-format', 'json']);
+  expect(result.stderr).toBe('');
+  expect(result.exitCode).toBe(0);
+  return JSON.parse(result.stdout);
+}
+
+describe('Issue #165: memory exhaustion observed from the log', () => {
+  let store;
+
+  beforeEach(() => {
+    cleanupTestDir();
+    fs.mkdirSync(TEST_APP_FOLDER, { recursive: true });
+    store = new ExecutionStore({
+      appFolder: TEST_APP_FOLDER,
+      useLinks: false,
+    });
+  });
+
+  afterEach(() => {
+    cleanupTestDir();
+  });
+
+  it('reports memoryExhausted for an attached docker session that self-aborted', () => {
+    const record = saveRecord(store, {
+      logPath: writeOomLog('attached.log', {}),
+      exitCode: 139,
+      options: { isolated: 'docker', isolationMode: 'attached' },
+    });
+
+    const parsed = statusJson(record.uuid);
+
+    expect(parsed.exitCode).toBe(139);
+    // The container flag is still absent/false — the observation does not
+    // contradict it, it complements it.
+    expect(parsed.oomKilled).toBeUndefined();
+    expect(parsed.memoryExhausted).toBe(true);
+    expect(parsed.memoryExhaustedReason).toBe(HEAP_LIMIT_MARKER);
+    expect(parsed.exitReason).toBe('memory-exhaustion (v8-heap-limit)');
+  });
+
+  it('finds a marker pushed far from EOF by the native stack trace', () => {
+    const logPath = writeOomLog('long-trace.log', {
+      stackTraceBytes: 40 * 1024,
+    });
+    expect(fs.statSync(logPath).size).toBeGreaterThan(32 * 1024);
+    const record = saveRecord(store, { logPath, exitCode: 134 });
+
+    const parsed = statusJson(record.uuid);
+
+    expect(parsed.memoryExhausted).toBe(true);
+    expect(parsed.memoryExhaustedReason).toBe(HEAP_LIMIT_MARKER);
+  });
+
+  it('detects a Rust allocation failure', () => {
+    const record = saveRecord(store, {
+      logPath: writeOomLog('rust.log', {
+        marker: 'memory allocation of 1073741824 bytes failed',
+      }),
+      exitCode: 134,
+    });
+
+    const parsed = statusJson(record.uuid);
+
+    expect(parsed.memoryExhausted).toBe(true);
+    expect(parsed.memoryExhaustedReason).toBe(
+      'memory allocation of 1073741824 bytes failed'
+    );
+  });
+
+  it('never turns a clean run into a reported memory failure', () => {
+    // The marker is present in the output — the command merely printed it —
+    // but the run succeeded, so there is nothing to explain (issue #151's rule:
+    // an observation, never a verdict).
+    const logPath = path.join(TEST_APP_FOLDER, 'quoted.log');
+    fs.writeFileSync(
+      logPath,
+      [
+        `grep found: ${HEAP_LIMIT_MARKER}`,
+        '==================================================',
+        'Finished: 2026-09-03 08:14:20.707',
+        'Exit Code: 0',
+        '',
+      ].join('\n'),
+      'utf8'
+    );
+    const record = saveRecord(store, { logPath, exitCode: 0 });
+
+    const parsed = statusJson(record.uuid);
+
+    expect(parsed.exitCode).toBe(0);
+    expect(parsed.memoryExhausted).toBeUndefined();
+    expect(parsed.memoryExhaustedReason).toBeUndefined();
+  });
+
+  it('leaves an ordinary failure without a memory observation', () => {
+    const logPath = path.join(TEST_APP_FOLDER, 'plain-failure.log');
+    fs.writeFileSync(logPath, 'error: missing file\n', 'utf8');
+    const record = saveRecord(store, { logPath, exitCode: 1 });
+
+    const parsed = statusJson(record.uuid);
+
+    expect(parsed.memoryExhausted).toBeUndefined();
+  });
+
+  it('shows the observation in the human-readable and links-notation output', () => {
+    const record = saveRecord(store, {
+      logPath: writeOomLog('formats.log', {}),
+      exitCode: 139,
+    });
+
+    const text = runCli(['--status', record.uuid, '--output-format', 'text']);
+    expect(text.exitCode).toBe(0);
+    expect(text.stdout).toContain('Memory Exhausted:  true');
+    expect(text.stdout).toContain(`Memory Evidence:   ${HEAP_LIMIT_MARKER}`);
+
+    const lino = runCli(['--status', record.uuid]);
+    expect(lino.exitCode).toBe(0);
+    expect(lino.stdout).toContain('memoryExhausted true');
+    expect(lino.stdout).toContain('memoryExhaustedReason');
+  });
+});
+
+describe('Issue #165: kept-container footer', () => {
+  const evaluateReason = (exitCode, oomKilled) => {
+    const snippet = buildDockerKeptReasonSnippet();
+    const result = spawnSync(
+      'sh',
+      [
+        '-c',
+        `__start_command_exit=${exitCode}; __start_command_oom=${oomKilled}; ${snippet}; printf '%s' "$__start_command_reason"`,
+      ],
+      { encoding: 'utf8' }
+    );
+    expect(result.status).toBe(0);
+    return result.stdout;
+  };
+
+  it('does not assert a bare oomKilled=false for a self-abort exit code', () => {
+    for (const exitCode of [134, 139]) {
+      const reason = evaluateReason(exitCode, 'false');
+      expect(reason).toContain(`exitCode=${exitCode} oomKilled=false`);
+      expect(reason).toContain('invisible to this flag');
+    }
+  });
+
+  it('keeps the plain reason for other exit codes and for a real OOM kill', () => {
+    expect(evaluateReason(1, 'false')).toBe('exitCode=1 oomKilled=false');
+    expect(evaluateReason(137, 'true')).toBe('exitCode=137 oomKilled=true');
+  });
+
+  it('embeds the reason computation in the detached completion script', () => {
+    const script = buildDetachedDockerCompletionScript(
+      'container-165',
+      'default',
+      '/tmp/regression-165.log'
+    );
+    expect(script).toContain('__start_command_reason=');
+    expect(script).toContain('Reason: %s');
+  });
+});
+
+describe('Issue #165: attached kept-container message', () => {
+  beforeEach(() => {
+    cleanupTestDir();
+    fs.mkdirSync(TEST_APP_FOLDER, { recursive: true });
+  });
+
+  afterEach(() => {
+    cleanupTestDir();
+  });
+
+  it('names the evidence the runtime printed into the log', () => {
+    const message = buildAttachedDockerKeptMessage({
+      containerName: 'container-165',
+      exitCode: 139,
+      oomKilled: false,
+      logPath: writeOomLog('attached-message.log', {}),
+    });
+
+    expect(message).toContain('Container kept because the command failed.');
+    expect(message).toContain(
+      `Memory exhaustion detected in the log: ${HEAP_LIMIT_MARKER}`
+    );
+    expect(message).toContain('Remove when done: docker rm -f container-165');
+  });
+
+  it('stays silent for an ordinary failure', () => {
+    const logPath = path.join(TEST_APP_FOLDER, 'attached-plain.log');
+    fs.writeFileSync(logPath, 'error: missing file\n', 'utf8');
+
+    const message = buildAttachedDockerKeptMessage({
+      containerName: 'container-165',
+      exitCode: 1,
+      oomKilled: false,
+      logPath,
+    });
+
+    expect(message).not.toContain('Memory exhaustion');
+  });
+});

package/test/regression-84.js

@@ -250,9 +250,14 @@ describe('Docker not installed check (issue #84)', () => {
       message.toLowerCase().includes('not installed'),
       'Message must indicate Docker is not installed'
     );
-    assert.ok(
-      message.includes('https://docs.docker.com/get-docker/'),
-      'Message must include an installation URL'
+    // Compare the whole URL, not a substring of the message: a substring test
+    // also passes for a look-alike such as https://evil.invalid/docs.docker.com
+    // (CodeQL js/incomplete-url-substring-sanitization, issue #168).
+    const [installUrl] = message.match(/https?:\/\/\S+/) ?? [];
+    assert.equal(
+      installUrl,
+      'https://docs.docker.com/get-docker/',
+      'Message must include the Docker installation URL'
     );
   });
 

package/test/release-name.mjs

@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'bun:test';
 import {
+  containsPackageVersionBadge,
   encodeShieldsStaticBadgeSegment,
   extractChangelogEntry,
   normalizeReleaseVersionForBadge,
@@ -115,3 +116,59 @@ describe('extractChangelogEntry', () => {
     );
   });
 });
+
+describe('containsPackageVersionBadge', () => {
+  it('detects the badge this repository generates', () => {
+    const badge = packageVersionBadge({
+      packageType: 'npm',
+      packageName: 'start-command',
+      releaseVersion: 'js-v1.2.3',
+    });
+
+    expect(containsPackageVersionBadge(`Notes\n\n---\n\n${badge}`)).toBe(true);
+  });
+
+  it('reports unformatted release notes', () => {
+    expect(containsPackageVersionBadge('### Patch Changes\n\n- Fix.')).toBe(
+      false
+    );
+    expect(containsPackageVersionBadge('')).toBe(false);
+    expect(containsPackageVersionBadge(undefined)).toBe(false);
+  });
+
+  it('does not treat a foreign host that merely mentions the badge host as a badge', () => {
+    // CodeQL js/incomplete-url-substring-sanitization (issue #168): the former
+    // `body.includes('img.shields.io')` matched all of these.
+    expect(
+      containsPackageVersionBadge(
+        '![x](https://example.invalid/img.shields.io)'
+      )
+    ).toBe(false);
+    expect(
+      containsPackageVersionBadge(
+        '![x](https://example.invalid/?u=img.shields.io)'
+      )
+    ).toBe(false);
+    expect(
+      containsPackageVersionBadge(
+        '![x](https://img.shields.io.example.invalid/b.svg)'
+      )
+    ).toBe(false);
+    expect(containsPackageVersionBadge('see https://img.shields.io')).toBe(
+      false
+    );
+  });
+
+  it('ignores relative and malformed image targets', () => {
+    expect(containsPackageVersionBadge('![x](./local/badge.svg)')).toBe(false);
+    expect(containsPackageVersionBadge('![x]()')).toBe(false);
+  });
+
+  it('accepts a badge carrying a markdown title', () => {
+    expect(
+      containsPackageVersionBadge(
+        '![npm version](https://img.shields.io/badge/npm-1.2.3-blue.svg "npm")'
+      )
+    ).toBe(true);
+  });
+});