fix(arg-parser): take the arguments as stdin text, and block a heredoc that closes early
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
parent
738efa3e24
commit
f1704f0800
SSH key fingerprint:
SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
4 changed files with 287 additions and 16 deletions
|
|
@ -9,6 +9,7 @@
|
|||
|
||||
import { test } from 'node:test';
|
||||
import { strict as assert } from 'node:assert';
|
||||
import { readFileSync } from 'node:fs';
|
||||
import { dirname, join } from 'node:path';
|
||||
import { fileURLToPath } from 'node:url';
|
||||
import { runHook } from '../helpers/hook-helper.mjs';
|
||||
|
|
@ -314,3 +315,70 @@ test('pre-bash-executor fails open on malformed JSON', async () => {
|
|||
const { code } = await runHook(PRE_BASH, 'not-json');
|
||||
assert.strictEqual(code, 0);
|
||||
});
|
||||
|
||||
// -----------------------------------------------------------------------
|
||||
// ARG / R6 (fix round 4.5b) -- the parser heredoc must not close early.
|
||||
// The commands hand $ARGUMENTS to the arg parser through a quoted heredoc
|
||||
// closed by VOYAGE_ARGS_EOF_7F3C9E. A typed line equal to that delimiter
|
||||
// would end the heredoc there, and the shell would run every line after it
|
||||
// as a command. Each blocking case asserts the rule's name on stderr, so it
|
||||
// is red on its own assertion where the rule does not exist.
|
||||
// -----------------------------------------------------------------------
|
||||
const ARGS_DELIM = 'VOYAGE_ARGS_EOF_7F3C9E';
|
||||
const ARGS_RULE = /args-heredoc-closed-early/;
|
||||
const PARSER_LINE = 'node /plugin/lib/parsers/arg-parser.mjs --command trekendsession --stdin';
|
||||
|
||||
async function expectArgsBlocked(command) {
|
||||
const { code, stderr } = await runHook(PRE_BASH, bashInput(command));
|
||||
assert.match(stderr, ARGS_RULE, `the guard did not name args-heredoc-closed-early for: ${JSON.stringify(command)}`);
|
||||
assert.strictEqual(code, 2, `the guard did not block: ${JSON.stringify(command)}`);
|
||||
}
|
||||
|
||||
async function expectArgsAllowed(command) {
|
||||
const { code, stderr } = await runHook(PRE_BASH, bashInput(command));
|
||||
assert.doesNotMatch(stderr, ARGS_RULE, `the guard refused a well-formed heredoc: ${JSON.stringify(command)}`);
|
||||
assert.strictEqual(code, 0, `the guard refused a well-formed heredoc: ${stderr}`);
|
||||
}
|
||||
|
||||
test('[ARG] the guard blocks a parser heredoc whose closing line is followed by a command', async () => {
|
||||
await expectArgsBlocked(`${PARSER_LINE} <<'${ARGS_DELIM}'\nbrief.md\n${ARGS_DELIM}\ntouch PWNED`);
|
||||
await expectArgsBlocked(`${PARSER_LINE} <<'${ARGS_DELIM}'\nbrief.md\n${ARGS_DELIM}\ntouch PWNED\n`);
|
||||
});
|
||||
|
||||
test('[ARG] the guard blocks a parser heredoc with the closing line twice', async () => {
|
||||
await expectArgsBlocked(`${PARSER_LINE} <<'${ARGS_DELIM}'\nbrief.md\n${ARGS_DELIM}\ntouch PWNED\n${ARGS_DELIM}`);
|
||||
// A typed line with spaces around the delimiter still counts as a closing line.
|
||||
await expectArgsBlocked(`${PARSER_LINE} <<'${ARGS_DELIM}'\nbrief.md\n ${ARGS_DELIM} \ntouch PWNED\n${ARGS_DELIM}\n`);
|
||||
});
|
||||
|
||||
test('[ARG] the guard allows the parser heredoc as the commands write it', async () => {
|
||||
await expectArgsAllowed(`${PARSER_LINE} <<'${ARGS_DELIM}'\nbrief.md Session 2 of 3\n${ARGS_DELIM}`);
|
||||
await expectArgsAllowed(`${PARSER_LINE} <<'${ARGS_DELIM}'\nbrief.md Session 2 of 3\n${ARGS_DELIM}\n`);
|
||||
await expectArgsAllowed(`${PARSER_LINE} <<'${ARGS_DELIM}'\n\n${ARGS_DELIM}\n\n`);
|
||||
await expectArgsAllowed(`${PARSER_LINE} <<'${ARGS_DELIM}'\nbrief.md ; touch PWNED $(touch PWNED2) *\n${ARGS_DELIM}`);
|
||||
});
|
||||
|
||||
test('[ARG] the guard blocks an unquoted or spaced opener whose body closes early', async () => {
|
||||
await expectArgsBlocked(`${PARSER_LINE} << '${ARGS_DELIM}'\nbrief.md\n${ARGS_DELIM}\ntouch PWNED\n${ARGS_DELIM}`);
|
||||
await expectArgsBlocked(`${PARSER_LINE} <<"${ARGS_DELIM}"\nbrief.md\n${ARGS_DELIM}\ntouch PWNED\n${ARGS_DELIM}`);
|
||||
await expectArgsBlocked(`${PARSER_LINE} <<-'${ARGS_DELIM}'\nbrief.md\n${ARGS_DELIM}\ntouch PWNED\n${ARGS_DELIM}`);
|
||||
await expectArgsBlocked(`${PARSER_LINE} <<${ARGS_DELIM}\nbrief.md\n${ARGS_DELIM}\ntouch PWNED\n${ARGS_DELIM}`);
|
||||
// Unquoted, the body would expand $( ) even when it closes where it should.
|
||||
await expectArgsBlocked(`${PARSER_LINE} <<${ARGS_DELIM}\nbrief.md $(touch PWNED)\n${ARGS_DELIM}`);
|
||||
});
|
||||
|
||||
test('[ARG] the guard checks a backslash-quoted <<\\VOYAGE_ARGS_EOF_7F3C9E opener', async () => {
|
||||
await expectArgsBlocked(`${PARSER_LINE} <<\\${ARGS_DELIM}\nbrief.md\n${ARGS_DELIM}\ntouch PWNED\n${ARGS_DELIM}`);
|
||||
await expectArgsBlocked(`${PARSER_LINE} << \\${ARGS_DELIM}\nbrief.md\n${ARGS_DELIM}\ntouch PWNED`);
|
||||
await expectArgsAllowed(`${PARSER_LINE} <<\\${ARGS_DELIM}\nbrief.md Session 2 of 3\n${ARGS_DELIM}`);
|
||||
});
|
||||
|
||||
test("[ARG] the guard's added lines are ASCII", () => {
|
||||
const src = readFileSync(PRE_BASH, 'utf8');
|
||||
const from = src.indexOf('// BEGIN args-heredoc-closed-early');
|
||||
const to = src.indexOf('// END args-heredoc-closed-early');
|
||||
assert.ok(from >= 0 && to > from, 'the guard marks its args-heredoc-closed-early block with BEGIN/END comments');
|
||||
const block = src.slice(from, to);
|
||||
assert.match(block, /VOYAGE_ARGS_EOF_7F3C9E/);
|
||||
assert.doesNotMatch(block, /[^\x00-\x7f]/, 'a hook script is ASCII (~/.claude/CLAUDE.md, Miljo)');
|
||||
});
|
||||
|
|
|
|||
|
|
@ -1,11 +1,15 @@
|
|||
import { test } from 'node:test';
|
||||
import { strict as assert } from 'node:assert';
|
||||
import { spawnSync } from 'node:child_process';
|
||||
import { existsSync, mkdtempSync, rmSync } from 'node:fs';
|
||||
import { tmpdir } from 'node:os';
|
||||
import { dirname, join } from 'node:path';
|
||||
import { fileURLToPath } from 'node:url';
|
||||
import { fileURLToPath, pathToFileURL } from 'node:url';
|
||||
import { parseArgs } from '../../lib/parsers/arg-parser.mjs';
|
||||
import { childEnv } from '../helpers/child-env.mjs';
|
||||
|
||||
const PARSER = join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'lib', 'parsers', 'arg-parser.mjs');
|
||||
const PARSER_URL = pathToFileURL(PARSER).href;
|
||||
|
||||
test('trekbrief — empty args', () => {
|
||||
const r = parseArgs('', 'trekbrief');
|
||||
|
|
@ -200,3 +204,88 @@ test('trekendsession — -h stays a positional (no alias resolution)', () => {
|
|||
assert.deepEqual(r.errors, []);
|
||||
assert.equal(r.flags['--help'], undefined);
|
||||
});
|
||||
|
||||
// --- ARG / M10 (fix round 4.5b) — the arguments reach the parser as stdin
|
||||
// text, never as shell words, and the label is read whole from `tail` ---
|
||||
|
||||
function runStdin(command, input, cwd) {
|
||||
return spawnSync(process.execPath, [PARSER, '--command', command, '--stdin'], {
|
||||
input, cwd, encoding: 'utf8', env: childEnv(),
|
||||
});
|
||||
}
|
||||
|
||||
test('[ARG] --stdin keeps ; $( ) and * as literal characters and creates no file', async () => {
|
||||
const mod = await import(PARSER_URL);
|
||||
assert.equal(typeof mod.parseArgs, 'function', 'arg-parser.mjs exports parseArgs');
|
||||
const cwd = mkdtempSync(join(tmpdir(), 'arg-parser-stdin-'));
|
||||
try {
|
||||
const r = runStdin('trekendsession', 'brief.md ; touch PWNED $(touch PWNED2) * ~/x $HOME\n', cwd);
|
||||
assert.equal(r.status, 0, `the parser CLI refused --stdin: ${r.stdout}${r.stderr}`);
|
||||
const out = JSON.parse(r.stdout);
|
||||
assert.deepEqual(out.positional,
|
||||
['brief.md', ';', 'touch', 'PWNED', '$(touch', 'PWNED2)', '*', '~/x', '$HOME']);
|
||||
assert.equal(out.tail, '; touch PWNED $(touch PWNED2) * ~/x $HOME');
|
||||
assert.equal(existsSync(join(cwd, 'PWNED')), false, 'no PWNED file was created');
|
||||
assert.equal(existsSync(join(cwd, 'PWNED2')), false, 'no PWNED2 file was created');
|
||||
} finally {
|
||||
rmSync(cwd, { recursive: true, force: true });
|
||||
}
|
||||
});
|
||||
|
||||
test('[ARG] a balanced quote groups words', async () => {
|
||||
const mod = await import(PARSER_URL);
|
||||
assert.equal(typeof mod.tokenize, 'function', 'arg-parser.mjs exports tokenize');
|
||||
assert.deepEqual(mod.tokenize(`a "b c" 'd e' f`), [
|
||||
{ value: 'a', start: 0, end: 1 },
|
||||
{ value: 'b c', start: 2, end: 7 },
|
||||
{ value: 'd e', start: 8, end: 13 },
|
||||
{ value: 'f', start: 14, end: 15 },
|
||||
]);
|
||||
assert.deepEqual(mod.tokenize(`brief.md "Fix the user's login"`).map((t) => t.value),
|
||||
['brief.md', "Fix the user's login"]);
|
||||
});
|
||||
|
||||
test('[ARG] an unbalanced quote stays a literal character', async () => {
|
||||
const mod = await import(PARSER_URL);
|
||||
assert.equal(typeof mod.tokenize, 'function', 'arg-parser.mjs exports tokenize');
|
||||
assert.deepEqual(mod.tokenize(`Fix the user's login`).map((t) => t.value),
|
||||
['Fix', 'the', "user's", 'login']);
|
||||
assert.deepEqual(mod.tokenize('say "hi there').map((t) => t.value),
|
||||
['say', '"hi', 'there']);
|
||||
assert.deepEqual(mod.parseArgs(`brief.md it's`, 'trekendsession').positional,
|
||||
['brief.md', "it's"]);
|
||||
});
|
||||
|
||||
test('[ARG] empty stdin gives no positional, an empty tail and exit 0', async () => {
|
||||
const mod = await import(PARSER_URL);
|
||||
assert.equal(typeof mod.parseArgs, 'function', 'arg-parser.mjs exports parseArgs');
|
||||
for (const input of ['', '\n']) {
|
||||
const r = runStdin('trekendsession', input);
|
||||
assert.equal(r.status, 0, `the parser CLI refused empty stdin: ${r.stdout}${r.stderr}`);
|
||||
const out = JSON.parse(r.stdout);
|
||||
assert.deepEqual(out.positional, []);
|
||||
assert.deepEqual(out.errors, []);
|
||||
assert.equal(out.tail, '', `tail for ${JSON.stringify(input)}`);
|
||||
}
|
||||
});
|
||||
|
||||
test('[M10] tail keeps a multi-word label whole', async () => {
|
||||
const mod = await import(PARSER_URL);
|
||||
assert.equal(typeof mod.parseArgs, 'function', 'arg-parser.mjs exports parseArgs');
|
||||
const r = mod.parseArgs('brief.md Session 2 of 3', 'trekendsession');
|
||||
assert.equal(r.tail, 'Session 2 of 3');
|
||||
assert.equal(r.positional[0], 'brief.md');
|
||||
});
|
||||
|
||||
test('[M10] one outer quote pair around the label is removed', async () => {
|
||||
const mod = await import(PARSER_URL);
|
||||
assert.equal(typeof mod.parseArgs, 'function', 'arg-parser.mjs exports parseArgs');
|
||||
assert.equal(mod.parseArgs(`brief.md 'Session 2 of 3'`, 'trekendsession').tail, 'Session 2 of 3');
|
||||
assert.equal(mod.parseArgs(`brief.md "Session 2 of 3"`, 'trekendsession').tail, 'Session 2 of 3');
|
||||
});
|
||||
|
||||
test('[M10] an inner apostrophe stays', async () => {
|
||||
const mod = await import(PARSER_URL);
|
||||
assert.equal(typeof mod.parseArgs, 'function', 'arg-parser.mjs exports parseArgs');
|
||||
assert.equal(mod.parseArgs(`brief.md Fix the user's login`, 'trekendsession').tail, "Fix the user's login");
|
||||
});
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue