start-command 0.32.0 → 0.33.0

package/test/ci-workflow-invariants.js

@@ -76,6 +76,57 @@ function concurrencyKey(body, key) {
   return jobKey(body, key, 6);
 }
 
+/** Split a job body into individual `- ...` step blocks. */
+function parseSteps(body) {
+  const lines = body.split('\n');
+  const steps = [];
+  let current = null;
+  let indent = 0;
+  for (const line of lines) {
+    const start = line.match(/^(\s*)-\s/);
+    if (start && (current === null || start[1].length === indent)) {
+      if (current) {
+        steps.push(current.join('\n'));
+      }
+      current = [line];
+      indent = start[1].length;
+      continue;
+    }
+    if (current) {
+      current.push(line);
+    }
+  }
+  if (current) {
+    steps.push(current.join('\n'));
+  }
+  return steps;
+}
+
+/** True when line `index` of `workflow` sits inside a `run:` block. */
+function inRunBlock(workflow, index) {
+  const lines = workflow.split('\n');
+  const line = lines[index];
+  if (/^\s*(- )?run:/.test(line)) {
+    return true;
+  }
+  const indent = line.length - line.trimStart().length;
+  if (!line.trim()) {
+    return false;
+  }
+  for (let cursor = index - 1; cursor >= 0; cursor--) {
+    const previous = lines[cursor];
+    if (!previous.trim()) {
+      continue;
+    }
+    const previousIndent = previous.length - previous.trimStart().length;
+    if (previousIndent >= indent) {
+      continue;
+    }
+    return /^\s*(- )?run:\s*[|>]/.test(previous);
+  }
+  return false;
+}
+
 const workflows = listWorkflows();
 
 describe('CI workflow invariants', () => {
@@ -257,6 +308,146 @@ describe('CI workflow invariants', () => {
     }
   });
 
+  // --- issue #168: false negatives the pipeline could not see -------------
+
+  it('lints and audits the workflows themselves', () => {
+    assert.ok(
+      workflows.includes('workflows.yml'),
+      'no workflows.yml: nothing ran actionlint or zizmor over .github/workflows'
+    );
+    const meta = readWorkflow('workflows.yml');
+    assert.match(
+      meta,
+      /rhysd\/actionlint/,
+      'workflows.yml must run actionlint'
+    );
+    assert.match(meta, /zizmor/, 'workflows.yml must run zizmor');
+    for (const config of ['zizmor.yml', 'actionlint.yaml']) {
+      assert.doesNotThrow(
+        () => readFileSync(join(repoRoot, '.github', config)),
+        `missing .github/${config}`
+      );
+    }
+  });
+
+  it('never interpolates untrusted context into a run: block', () => {
+    // actionlint/zizmor call this template-injection: the value is attacker
+    // controlled on a fork PR and is pasted into the shell verbatim.
+    const untrusted =
+      /\$\{\{\s*github\.(head_ref|base_ref|event\.[A-Za-z0-9_.]*(title|body|name|label|ref))/;
+    for (const name of workflows) {
+      for (const [index, line] of readWorkflow(name).split('\n').entries()) {
+        if (line.trimStart().startsWith('#')) {
+          continue;
+        }
+        if (inRunBlock(readWorkflow(name), index) && untrusted.test(line)) {
+          assert.fail(
+            `${name}:${index + 1} interpolates untrusted context into run:; pass it through env: instead - ${line.trim()}`
+          );
+        }
+      }
+    }
+  });
+
+  it('does not persist credentials on read-only checkouts', () => {
+    for (const name of workflows) {
+      for (const job of parseJobs(readWorkflow(name))) {
+        if (WRITER_JOBS.has(job.name)) {
+          continue;
+        }
+        for (const step of parseSteps(job.body)) {
+          if (!/uses:\s*actions\/checkout/.test(step)) {
+            continue;
+          }
+          assert.match(
+            step,
+            /persist-credentials:\s*false/,
+            `${name}: read-only job "${job.name}" checks out with the token left in .git/config`
+          );
+        }
+      }
+    }
+  });
+
+  it('pins third-party actions to a commit hash', () => {
+    // Trusted first-party namespaces may use a moving tag; anything else is a
+    // mutable ref in a job that can hold write credentials.
+    const trusted =
+      /^(actions|github|docker|astral-sh|lycheeverse|zizmorcore|changesets)\//;
+    for (const name of workflows) {
+      const workflow = readWorkflow(name);
+      for (const match of workflow.matchAll(/uses:\s*(\S+)/g)) {
+        const reference = match[1];
+        if (reference.startsWith('docker://') || reference.startsWith('./')) {
+          continue;
+        }
+        if (trusted.test(reference)) {
+          continue;
+        }
+        assert.match(
+          reference,
+          /@[0-9a-f]{40}$/,
+          `${name}: third-party action ${reference} must be pinned to a commit hash`
+        );
+      }
+    }
+  });
+
+  it('audits both dependency graphs for advisories', () => {
+    const security = readWorkflow('security.yml');
+    const jobs = parseJobs(security).map((job) => job.name);
+    for (const job of ['cargo-audit', 'npm-audit']) {
+      assert.ok(jobs.includes(job), `security.yml has no ${job} job`);
+    }
+    assert.match(
+      security,
+      /cargo audit/,
+      'cargo-audit job must run cargo audit'
+    );
+    assert.match(security, /npm audit/, 'npm-audit job must run npm audit');
+  });
+
+  it('lints the repository-level scripts/ directory', () => {
+    // js/eslint.config.mjs has js/ as its base path, so `eslint .` run from js/
+    // silently skipped scripts/ - the release automation (issue #168).
+    assert.doesNotThrow(
+      () => readFileSync(join(repoRoot, 'eslint.config.mjs')),
+      'no repository-level eslint.config.mjs: scripts/ would go unlinted'
+    );
+    const js = readWorkflow('js.yml');
+    assert.match(js, /lint:scripts/, 'js.yml must lint scripts/');
+    assert.match(
+      js,
+      /format:check:scripts/,
+      'js.yml must format-check scripts/'
+    );
+  });
+
+  it('scopes CodeQL to this project\u2019s own code', () => {
+    // Without this, CodeQL extracts the third-party bundles archived under
+    // dev/log/ as evidence and fails pull requests on other projects'
+    // findings (issue #168: js/redos in the vendored use-m snapshot).
+    const security = readWorkflow('security.yml');
+    const codeqlJob = parseJobs(security).find((job) => job.name === 'codeql');
+    assert.ok(codeqlJob, 'security.yml has no codeql job');
+    const configPath = jobKey(codeqlJob.body, 'config-file', 10);
+    assert.ok(
+      configPath,
+      'the CodeQL init step must pass config-file, or archived evidence is analysed'
+    );
+    const config = readFileSync(join(repoRoot, configPath), 'utf8');
+    assert.match(
+      config,
+      /^paths-ignore:/m,
+      `${configPath} has no paths-ignore`
+    );
+    assert.match(
+      config,
+      /^\s*-\s*dev\/log\s*$/m,
+      `${configPath} must exclude dev/log`
+    );
+  });
+
   it('parses coverage through the tested helper, not an inline grep', () => {
     const js = readWorkflow('js.yml');
     assert.doesNotMatch(

package/test/docker-network-integration.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-/** Real-daemon integration coverage for Docker network isolation (issues #154, #156, #158). */
+/** Real-daemon integration coverage for Docker network isolation (issues #154, #156, #158, #160). */
 
 const { after, before, describe, it } = require('node:test');
 const assert = require('assert');
@@ -10,6 +10,8 @@ const { runInDocker } = require('../src/lib/isolation');
 // Bun's `node:test` shim ignores a `describe`-level timeout, so every `it`
 // declares its own budget explicitly (issue #158).
 const TEST_TIMEOUT = 120000;
+const MULTI_NETWORK_PROBE =
+  "ping -c 1 formal-ai && ping -c 1 formal-db && ip route | grep -q '^default '";
 
 const suffix = randomUUID().slice(0, 8);
 const network = `start-network-${suffix}`;
@@ -84,6 +86,13 @@ describe('Docker named network integration', () => {
     docker(['network', 'rm', network, secondNetwork]);
   });
 
+  it('keeps the multi-network probe hermetic', () => {
+    assert.doesNotMatch(MULTI_NETWORK_PROBE, /https?:\/\//);
+    assert.match(MULTI_NETWORK_PROBE, /formal-ai/);
+    assert.match(MULTI_NETWORK_PROBE, /formal-db/);
+    assert.match(MULTI_NETWORK_PROBE, /ip route/);
+  });
+
   it(
     'reaches a private sidecar on each of two networks',
     { timeout: TEST_TIMEOUT },
@@ -95,19 +104,18 @@ describe('Docker named network integration', () => {
       // Both endpoints are local, user-defined networks on purpose: probing a
       // public endpoint (previously `https://api.github.com`) made this test
       // fail whenever the shared runner IP hit the 60 requests/hour
-      // unauthenticated GitHub API rate limit (issue #158).
-      const joined = await runInDocker(
-        'ping -c 1 formal-ai && ping -c 1 formal-db',
-        {
-          image: 'alpine:3.23',
-          session: connected,
-          network,
-          networks: [network, secondNetwork],
-          detached: true,
-          shell: 'sh',
-          keepContainer: true,
-        }
-      );
+      // unauthenticated GitHub API rate limit. Checking the route table keeps
+      // the original assertion that the default bridge route survived without
+      // making the test depend on any internet service (issues #158, #160).
+      const joined = await runInDocker(MULTI_NETWORK_PROBE, {
+        image: 'alpine:3.23',
+        session: connected,
+        network: 'bridge',
+        networks: ['bridge', network, secondNetwork],
+        detached: true,
+        shell: 'sh',
+        keepContainer: true,
+      });
       assert.strictEqual(joined.success, true, joined.message);
       const joinedExit = docker(['wait', connected]);
       assert.strictEqual(joinedExit.status, 0, joinedExit.stderr);

package/test/echo-integration.js

@@ -19,22 +19,27 @@
 
 const { describe, it } = require('node:test');
 const assert = require('assert');
-const { execSync } = require('child_process');
+const { execSync, spawnSync } = require('child_process');
 const path = require('path');
 const {
   isCommandAvailable,
   canRunLinuxDockerImages,
   hasTTY,
 } = require('../src/lib/isolation');
+const { toShellWords } = require('../src/lib/shell-utils');
 
 // Path to the CLI
 const CLI_PATH = path.join(__dirname, '..', 'src', 'bin', 'cli.js');
 
-// Helper function to run the CLI and capture output
+// Helper function to run the CLI and capture output.
+// The arguments are split here instead of being handed to a host shell, so the
+// CLI receives the same argv on every platform (issue #164).
 function runCli(args, options = {}) {
   const timeout = options.timeout || 30000;
-  try {
-    const result = execSync(`bun run ${CLI_PATH} ${args}`, {
+  const result = spawnSync(
+    process.execPath,
+    ['run', CLI_PATH, ...toShellWords(args)],
+    {
       encoding: 'utf8',
       timeout,
       env: {
@@ -43,16 +48,18 @@ function runCli(args, options = {}) {
         START_DISABLE_TRACKING: '1',
       },
       maxBuffer: 1024 * 1024, // 1MB
-    });
-    return { success: true, output: result };
-  } catch (err) {
-    return {
-      success: false,
-      output: err.stdout || '',
-      stderr: err.stderr || '',
-      exitCode: err.status,
-    };
+    }
+  );
+  const output = result.stdout || '';
+  if (result.status === 0) {
+    return { success: true, output };
   }
+  return {
+    success: false,
+    output,
+    stderr: result.stderr || '',
+    exitCode: result.status,
+  };
 }
 
 // Verify output contains expected structure for attached modes (shows finish block)

package/test/execution-attach.js

@@ -0,0 +1,221 @@
+/**
+ * Tests for --attach (issue #162)
+ */
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert');
+const {
+  buildAttachPlan,
+  attachExecution,
+  formatAttachResultAsLinksNotation,
+} = require('../src/lib/execution-attach');
+const { SessionState } = require('../src/lib/session-probe');
+
+function makeRecord(options = {}, extra = {}) {
+  return {
+    uuid: '11111111-2222-3333-4444-555555555555',
+    status: 'executing',
+    logPath: '/tmp/session.log',
+    options: { isolationMode: 'detached', ...options },
+    ...extra,
+  };
+}
+
+const runningProbe = (backend, sessionName) => ({
+  backend,
+  sessionName,
+  state: SessionState.RUNNING,
+  alive: true,
+  containerStatus: backend === 'docker' ? 'running' : null,
+});
+
+describe('buildAttachPlan', () => {
+  test('attaches to a running docker container', () => {
+    const record = makeRecord({ isolated: 'docker', sessionName: 'box' });
+    const plan = buildAttachPlan(record, {
+      probe: runningProbe('docker', 'box'),
+    });
+    assert.strictEqual(plan.error, undefined);
+    assert.strictEqual(plan.command, 'docker');
+    assert.deepStrictEqual(plan.args, ['attach', 'box']);
+    assert.strictEqual(plan.interactive, true);
+    assert.strictEqual(plan.method, 'DOCKER_ATTACH');
+  });
+
+  test('follows docker logs in read-only mode', () => {
+    const record = makeRecord({ isolated: 'docker', sessionName: 'box' });
+    const plan = buildAttachPlan(record, {
+      readOnly: true,
+      probe: runningProbe('docker', 'box'),
+    });
+    assert.deepStrictEqual(plan.args, ['logs', '-f', 'box']);
+    assert.strictEqual(plan.interactive, false);
+    assert.strictEqual(plan.method, 'DOCKER_LOG_FOLLOW');
+  });
+
+  test('attaches to a running screen session', () => {
+    const record = makeRecord({ isolated: 'screen', sessionName: 'work' });
+    const plan = buildAttachPlan(record, {
+      probe: runningProbe('screen', 'work'),
+    });
+    assert.strictEqual(plan.command, 'screen');
+    assert.deepStrictEqual(plan.args, ['-r', 'work']);
+    assert.strictEqual(plan.interactive, true);
+  });
+
+  test('follows the stored log for a read-only screen attach', () => {
+    const record = makeRecord({ isolated: 'screen', sessionName: 'work' });
+    const plan = buildAttachPlan(record, {
+      readOnly: true,
+      probe: runningProbe('screen', 'work'),
+    });
+    assert.strictEqual(plan.command, 'tail');
+    assert.deepStrictEqual(plan.args, ['-f', '/tmp/session.log']);
+    assert.strictEqual(plan.method, 'LOG_FOLLOW');
+  });
+
+  test('uses tmux read-only attach for --read-only', () => {
+    const record = makeRecord({ isolated: 'tmux', sessionName: 'work' });
+    const plan = buildAttachPlan(record, {
+      probe: runningProbe('tmux', 'work'),
+    });
+    assert.deepStrictEqual(plan.args, ['attach-session', '-t', 'work']);
+    const readOnlyPlan = buildAttachPlan(record, {
+      readOnly: true,
+      probe: runningProbe('tmux', 'work'),
+    });
+    assert.deepStrictEqual(readOnlyPlan.args, [
+      'attach-session',
+      '-r',
+      '-t',
+      'work',
+    ]);
+    assert.strictEqual(readOnlyPlan.interactive, true);
+  });
+
+  test('follows the log for ssh sessions', () => {
+    const record = makeRecord({ isolated: 'ssh', sessionName: 'remote' });
+    const plan = buildAttachPlan(record, {
+      probe: {
+        backend: 'ssh',
+        sessionName: 'remote',
+        state: SessionState.UNKNOWN,
+        alive: false,
+      },
+    });
+    assert.strictEqual(plan.command, 'tail');
+    assert.strictEqual(plan.method, 'LOG_FOLLOW');
+  });
+
+  test('points at --resume when the session is not running', () => {
+    const record = makeRecord({ isolated: 'docker', sessionName: 'box' });
+    const plan = buildAttachPlan(record, {
+      probe: {
+        backend: 'docker',
+        sessionName: 'box',
+        state: SessionState.STOPPED,
+        alive: false,
+        containerStatus: 'exited',
+      },
+    });
+    assert.match(plan.error, /is not running/);
+    assert.match(plan.error, /--resume/);
+  });
+
+  test('reports a removed container distinctly', () => {
+    const record = makeRecord({ isolated: 'docker', sessionName: 'box' });
+    const plan = buildAttachPlan(record, {
+      probe: {
+        backend: 'docker',
+        sessionName: 'box',
+        state: SessionState.MISSING,
+        alive: false,
+      },
+    });
+    assert.match(plan.error, /no longer exists/);
+  });
+
+  test('rejects records without a session name', () => {
+    const plan = buildAttachPlan(makeRecord({ isolated: 'docker' }), {
+      probe: { state: SessionState.UNKNOWN, alive: false },
+    });
+    assert.match(plan.error, /does not contain an isolation session name/);
+  });
+
+  test('rejects attached (non-detached) executions', () => {
+    const record = makeRecord({
+      isolated: 'docker',
+      sessionName: 'box',
+      isolationMode: 'attached',
+    });
+    const plan = buildAttachPlan(record, {
+      probe: runningProbe('docker', 'box'),
+    });
+    assert.match(plan.error, /Only detached isolated executions/);
+  });
+});
+
+describe('attachExecution', () => {
+  function makeStore(record) {
+    return { get: () => record };
+  }
+
+  test('reports a missing execution', () => {
+    const result = attachExecution({ get: () => null }, 'nope', {});
+    assert.strictEqual(result.success, false);
+    assert.match(result.error, /No execution found/);
+  });
+
+  test('reports disabled tracking', () => {
+    const result = attachExecution(null, 'nope', {});
+    assert.strictEqual(result.success, false);
+    assert.match(result.error, /Execution tracking is disabled/);
+  });
+
+  test('runs the interactive attach command', () => {
+    const record = makeRecord({ isolated: 'docker', sessionName: 'box' });
+    const calls = [];
+    const result = attachExecution(makeStore(record), 'box', {
+      probe: () => runningProbe('docker', 'box'),
+      interactiveRunner: (command, args) => {
+        calls.push([command, ...args]);
+        return { success: true, status: 0 };
+      },
+    });
+    assert.strictEqual(result.success, true);
+    assert.deepStrictEqual(calls, [['docker', 'attach', 'box']]);
+    assert.match(result.output, /attach/);
+  });
+
+  test('surfaces plan errors', () => {
+    const record = makeRecord({ isolated: 'docker', sessionName: 'box' });
+    const result = attachExecution(makeStore(record), 'box', {
+      probe: () => ({
+        backend: 'docker',
+        sessionName: 'box',
+        state: SessionState.STOPPED,
+        alive: false,
+      }),
+    });
+    assert.strictEqual(result.success, false);
+    assert.match(result.error, /--resume/);
+  });
+});
+
+describe('formatAttachResultAsLinksNotation', () => {
+  test('emits a nested links-notation block', () => {
+    const output = formatAttachResultAsLinksNotation({
+      identifier: 'box',
+      uuid: 'u-1',
+      backend: 'docker',
+      sessionName: 'box',
+      method: 'DOCKER_ATTACH',
+      readOnly: false,
+      command: 'docker attach box',
+      message: 'Attaching to detached docker container: box',
+    });
+    assert.match(output, /^executionAttach\n/);
+    assert.match(output, /\n {2}method DOCKER_ATTACH\n/);
+    assert.match(output, /\n {2}readOnly false\n/);
+  });
+});