42 Commits

Author SHA1 Message Date
Affaan Mustafa
7483d646e4 fix: narrow unicode cleanup scope 2026-03-29 21:21:18 -04:00
Affaan Mustafa
866d9ebb53 fix: harden unicode safety checks 2026-03-29 21:21:18 -04:00
copilot-swe-agent[bot]
90e6a8c63b Fix copilot-setup-steps.yml and address PR review comments
Co-authored-by: pangerlkr <73515951+pangerlkr@users.noreply.github.com>
2026-02-18 07:22:05 +00:00
anthropic-code-agent[bot]
c5ca3c698c Fix ESLint errors in test files and package-manager.js
Co-authored-by: pangerlkr <73515951+pangerlkr@users.noreply.github.com>
2026-02-18 07:04:29 +00:00
Affaan Mustafa
182e9e78b9 test: add 3 edge-case tests for readFile binary, output() NaN/Infinity, loadAliases __proto__ safety
Round 125: Tests for readFile returning garbled strings (not null) on binary
files, output() handling undefined/NaN/Infinity as non-objects logged directly
(and JSON.stringify converting NaN/Infinity to null in objects), and loadAliases
with __proto__ key in JSON proving no prototype pollution occurs.
Total: 935 tests, all passing.
2026-02-13 18:44:07 -08:00
Affaan Mustafa
2753db3a48 test: add 3 edge-case tests for findFiles dot escaping, listAliases limit falsy values, getSessionById old format
Round 122: Tests for findFiles glob dot escaping (*.txt must not match filetxt),
listAliases limit=0/negative/NaN returning all due to JS falsy check, and
getSessionById matching old YYYY-MM-DD-session.tmp filenames via noIdMatch path.
Total: 926 tests, all passing.
2026-02-13 18:30:42 -08:00
Affaan Mustafa
e50b05384a test: add Round 121 tests for findFiles ? glob, setAlias path validation, and time metadata extraction
- findFiles: ? glob pattern matches single character only (converted to . regex)
- setAlias: rejects null, empty, whitespace-only, and non-string sessionPath values
- parseSessionMetadata: Started/Last Updated time extraction — present, missing, loose regex

Total tests: 923
2026-02-13 18:25:56 -08:00
Affaan Mustafa
26f3c88902 test: add Round 120 tests for replaceInFile empty search, setAlias length boundary, and notes extraction
- replaceInFile: empty string search — replace prepends at pos 0, replaceAll inserts between every char
- setAlias: 128-char alias accepted (boundary), 129-char rejected (> 128 check)
- parseSessionMetadata: "Notes for Next Session" extraction — last section, empty, ### boundary, markdown

Total tests: 920
2026-02-13 18:23:55 -08:00
Affaan Mustafa
df2d3a6d54 test: add Round 119 tests for appendFile type safety, renameAlias reserved names, and context extraction
- appendFile: null/undefined/number content throws TypeError (no try/catch like writeFile)
- renameAlias: reserved names rejected for newAlias (parallel check to setAlias, case-insensitive)
- parseSessionMetadata: "Context to Load" code block extraction — missing close, nested blocks, empty

Total tests: 917
2026-02-13 18:21:39 -08:00
Affaan Mustafa
25c5d58c44 test: add Round 118 edge-case tests for writeFile type safety, renameAlias self, and reserved alias names
- writeFile: null/undefined/number content throws TypeError (no try/catch unlike replaceInFile)
- renameAlias: same-name rename returns "already exists" (no self-rename short-circuit)
- setAlias: reserved names (list, help, remove, delete, create, set) rejected case-insensitively

Total tests: 914
2026-02-13 18:19:21 -08:00
Affaan Mustafa
6a0b231d34 test: add Round 116 edge-case tests for replaceInFile null coercion, loadAliases extra fields, and ensureDir null path
- replaceInFile: null/undefined replacement coerced to string "null"/"undefined" by JS String.replace ToString
- loadAliases: extra unknown JSON fields silently preserved through load/save round-trip (loose validation)
- ensureDir: null/undefined path throws wrapped Error (ERR_INVALID_ARG_TYPE → re-thrown)

Total tests: 908
2026-02-13 18:11:58 -08:00
Affaan Mustafa
a563df2a52 test: add edge-case tests for countInFile empty pattern, parseSessionMetadata CRLF, and updateAliasTitle empty string coercion (round 115) 2026-02-13 18:05:28 -08:00
Affaan Mustafa
53e06a8850 test: add edge-case tests for listAliases type coercion, replaceInFile options.all with RegExp, and output BigInt serialization (round 114) 2026-02-13 18:01:25 -08:00
Affaan Mustafa
791da32c6b test: add 3 tests for Unicode alias rejection, newline-in-path heuristic, and read-only append (Round 112)
- resolveAlias rejects Unicode characters (accented, CJK, emoji, Cyrillic homoglyphs)
- getSessionStats treats absolute .tmp paths with embedded newlines as content, not file paths
- appendSessionContent returns false on EACCES for read-only files

Total: 896 tests
2026-02-13 17:47:50 -08:00
Affaan Mustafa
635eb108ab test: add 3 tests for nested backtick context truncation, newline args injection, alias 128-char boundary
Round 111: Tests for parseSessionMetadata context regex truncation at
nested triple backticks (lazy [\s\S]*? stops early), getExecCommand
accepting newline/tab/CR in args via \s in SAFE_ARGS_REGEX, and setAlias
accepting exactly 128-character alias (off-by-one boundary). 893 tests total.
2026-02-13 17:41:58 -08:00
Affaan Mustafa
882157ac09 test: add 3 tests for Round 107 (881 total)
- grepFile with ^$ pattern verifies empty line matching including trailing newline phantom
- replaceInFile with self-reintroducing replacement confirms single-pass behavior
- setAlias with whitespace-only title exposes missing trim validation vs sessionPath
2026-02-13 17:11:32 -08:00
Affaan Mustafa
332d0f444b test: add Round 104 edge-case tests (detectFromLockFile null, resolveSessionAlias traversal, whitespace notes)
- detectFromLockFile(null): throws TypeError — no input validation before
  path.join (package-manager.js:95)
- resolveSessionAlias('../etc/passwd'): returns path-traversal input unchanged
  when alias lookup fails, documenting the passthrough behavior
- parseSessionMetadata with whitespace-only notes: trim() → "" → hasNotes=false,
  whitespace-only notes treated as absent

Total tests: 872 (all passing)
2026-02-13 16:45:47 -08:00
Affaan Mustafa
45a0b62fcb test: add Round 103 edge-case tests (countInFile bool, grepFile numeric, loadAliases array)
- countInFile(file, false): boolean falls to else-return-0 type guard (utils.js:443)
- grepFile(file, 0): numeric pattern implicitly coerced via RegExp constructor,
  contrasting with countInFile which explicitly rejects non-string non-RegExp
- loadAliases with array aliases: typeof [] === 'object' bypasses validation
  at session-aliases.js:58, returning array instead of plain object

Total tests: 869 (all passing)
2026-02-13 16:08:47 -08:00
Affaan Mustafa
a64a294b29 test: add 3 edge-case tests for looksLikePath heuristic, falsy title coercion, and checkbox regex (Round 102)
- getSessionStats with Unix nonexistent .tmp path triggers looksLikePath
  heuristic → readFile returns null → zeroed stats via null content path
- setAlias with title=0 silently converts to null (0 || null === null)
- parseSessionMetadata skips [x] checked items in In Progress section
  (regex only matches unchecked [ ] checkboxes)

Total tests: 866
2026-02-13 16:02:18 -08:00
Affaan Mustafa
d2c1281e97 test: round 100 — findFiles maxAge+recursive interaction, parseSessionMetadata ### truncation, cleanupAliases falsy coercion
- findFiles with both maxAge AND recursive combined (option interaction test)
- parseSessionMetadata truncates item text at embedded ### due to lazy regex
- cleanupAliases callback returning 0 (falsy non-boolean) removes alias via !0 coercion

Total tests: 860
2026-02-13 15:49:06 -08:00
Affaan Mustafa
233b341557 test: add 3 tests for alternation regex, double-negative clamping, and self-rename (Round 95) 2026-02-13 14:50:49 -08:00
Affaan Mustafa
3e98be3e39 test: add Round 90 tests for readStdinJson timeout and saveAliases double failure
- Test readStdinJson timeout path when stdin never closes (resolves with {})
- Test readStdinJson timeout path with partial invalid JSON (catch resolves with {})
- Test saveAliases backup restore double failure (inner restoreErr catch at line 135)

Total tests: 830
2026-02-13 13:59:03 -08:00
Affaan Mustafa
b3e362105d test: add 3 tests for typeof guard, empty package.json, and learned_skills_path override (round 86)
- loadAliases resets to defaults when aliases field is a truthy non-object (string)
- detectFromPackageJson returns null for empty (0-byte) package.json
- evaluate-session uses learned_skills_path config override with ~ expansion
2026-02-13 12:23:34 -08:00
Affaan Mustafa
cedcf9a701 test: add 3 tests for TOCTOU catch paths and NaN date sort fallback (round 84)
- getSessionById returns null for broken symlink (session-manager.js:307-310)
- findFiles skips broken symlinks matching the pattern (utils.js:170-173)
- listAliases sorts entries with invalid/missing dates via getTime() || 0 fallback
2026-02-13 11:35:22 -08:00
Affaan Mustafa
0c67e0571e test: cover cleanupAliases save failure, setAlias save failure, and validate-commands statSync catch
Round 73: Add 3 tests for genuine untested code paths:
- session-aliases cleanupAliases returns failure when save blocked after removing aliases
- session-aliases setAlias returns failure when save blocked on new alias creation
- validate-commands silently skips broken symlinks in skill directory scanning
2026-02-13 09:42:25 -08:00
Affaan Mustafa
02d5986049 test: cover setProjectPM save failure, deleteAlias save failure, hooks async/timeout validation
Round 72: Add 4 tests for untested code paths (818 → 822):
- package-manager.js: setProjectPackageManager wraps writeFile errors (lines 275-279)
- session-aliases.js: deleteAlias returns failure when saveAliases fails (line 299)
- validate-hooks.js: rejects non-boolean async field (line 28-31)
- validate-hooks.js: rejects negative timeout value (lines 32-35)
2026-02-13 08:12:27 -08:00
Affaan Mustafa
44b5a4f9f0 test: add 3 tests for untested fallback/skip/failure paths (Round 70)
- session-end.js: entry.name/entry.input fallback in direct tool_use entries
- validate-commands.js: "would create:" regex alternation skip line
- session-aliases.js: updateAliasTitle save failure with read-only dir
2026-02-13 07:48:39 -08:00
Affaan Mustafa
702c3f54b4 test: add 3 tests for session-aliases empty file, null resolve, metadata backfill (Round 67) 2026-02-13 07:18:28 -08:00
Affaan Mustafa
cba6b44c61 test: add 3 tests for suggest-compact, session-aliases, typecheck (Round 64)
- suggest-compact: 'default' session ID fallback when CLAUDE_SESSION_ID empty
- session-aliases: loadAliases backfills missing version and metadata fields
- post-edit-typecheck: valid JSON without tool_input passes through unchanged

Total: 797 tests, all passing
2026-02-13 06:59:08 -08:00
Affaan Mustafa
990c08159c test: add tsconfig walk-up, compact fallback, and Windows atomic write tests (Round 56) 2026-02-13 05:59:07 -08:00
Affaan Mustafa
71e86cc93f test: add packageManager version format and sequential save integrity tests 2026-02-13 05:04:58 -08:00
Affaan Mustafa
dc11fc2fd8 fix: make saveAliases atomic on Unix by skipping unnecessary unlink before rename
On Unix/macOS, rename(2) atomically replaces the destination file.
The previous code ran unlinkSync before renameSync on all platforms,
creating an unnecessary non-atomic window where a crash could lose
data. Now the delete-before-rename is gated behind process.platform
=== 'win32', where rename cannot overwrite an existing file.
2026-02-13 04:23:22 -08:00
Affaan Mustafa
bb9df39d96 test: add 10 tests for birthtime fallback, stdin error, alias rollback (Round 33)
Cover createdTime/birthtime fallback in session-manager, readStdinJson
error event settled-flag guard in utils, renameAlias rollback on naming
conflict in session-aliases, and saveAliases backup preservation on
serialization failure. Total: 713 tests.
2026-02-13 03:50:44 -08:00
Affaan Mustafa
167b105cac fix: reject flags passed as package manager names in setup-package-manager CLI
When --global or --project was followed by another flag (e.g., --global --project),
the flag was treated as a package manager name. Added pmName.startsWith('-') check
to both handlers. Added 20 tests across 4 test files covering argument validation,
ensureDir error propagation, runCommand stderr handling, and saveAliases failure paths.
2026-02-13 03:37:46 -08:00
Affaan Mustafa
d903053830 test: add 15 tests for session-manager and session-aliases edge cases
Cover 30-day month validation (Sep/Nov 31 rejection), getSessionStats
path heuristic with multiline content, combined date+search+pagination
in getAllSessions, ambiguous prefix matching in getSessionById, unclosed
code fence in parseSessionMetadata, empty checklist item behavior,
reserved name case sensitivity (LIST/Help/Set), negative limit in
listAliases, and undefined title in setAlias.
2026-02-13 02:54:23 -08:00
Affaan Mustafa
f33ed4c49e fix: clamp getAllSessions pagination params, add cleanupAliases success field, add 10 tests
- session-manager: clamp offset/limit to safe non-negative integers to
  prevent negative offset counting from end and NaN returning empty results
- session-aliases: add success field to cleanupAliases return value for
  API contract consistency with setAlias/deleteAlias/renameAlias
2026-02-13 02:16:22 -08:00
Affaan Mustafa
c1919bb879 fix: greedy regex in validate-commands captures all refs per line, add 18 tests
The command cross-reference regex /^.*`\/(...)`.*$/gm only captured the
LAST command ref per line due to greedy .* consuming earlier refs.
Replaced with line-by-line processing using non-anchored regex to
capture ALL command references.

New tests:
- 4 validate-commands multi-ref-per-line tests (regression)
- 8 evaluate-session threshold boundary tests (new file)
- 6 session-aliases edge case tests (cleanup, rename, path matching)
2026-02-13 01:52:30 -08:00
Affaan Mustafa
a4848da38b test: add tsconfig depth limit and cleanupAliases exception tests
- post-edit-typecheck: verify 25-level-deep directory completes without
  hanging (tests the max depth=20 walk-up guard)
- cleanupAliases: document behavior when sessionExists callback throws
  (propagates to caller, which is acceptable)
2026-02-13 01:10:30 -08:00
Affaan Mustafa
654731f232 fix: add missing validation in renameAlias, add 6 tests
renameAlias was missing length (>128), reserved name, and empty string
validation that setAlias enforced. This inconsistency allowed renaming
aliases to reserved names like 'list' or 'delete'.

Also adds tests for:
- renameAlias empty string, reserved name, and length limit
- validate-skills whitespace-only SKILL.md rejection
- validate-rules whitespace-only file and recursive subdirectory scan
2026-02-13 01:05:59 -08:00
Affaan Mustafa
dc9aefbee1 fix: set USERPROFILE in tests for Windows os.homedir() compatibility
On Windows, os.homedir() uses USERPROFILE env var instead of HOME.
Tests that override HOME to a temp dir must also set USERPROFILE for
the session-manager, session-aliases, and session-start hook tests
to find files in the correct directory.
2026-02-12 16:41:58 -08:00
Affaan Mustafa
e9f0f1334f test: add 33 edge case tests for session-manager, session-aliases, and hooks
- session-manager: CRLF handling, empty sections, multi-heading title, context
  extraction, notes/context detection, MB file size, uppercase ID rejection
- session-aliases: missing timestamps sort, title search, createdAt preservation,
  whitespace-only path rejection, empty string title behavior
- hooks: session-start isolated HOME, template vs real session injection,
  learned skills count, check-console-log passthrough

Total test count: 261 → 294
2026-02-12 16:26:57 -08:00
Affaan Mustafa
76b271ab6b fix: 6 bugs fixed, 67 tests added for session-manager and session-aliases
Bug fixes:
- utils.js: prevent duplicate 'g' flag in countInFile regex construction
- validate-agents.js: handle CRLF line endings in frontmatter parsing
- validate-hooks.js: handle \t and \\ escape sequences in inline JS validation
- session-aliases.js: prevent NaN in date sort when timestamps are missing
- session-aliases.js: persist rollback on rename failure instead of silent loss
- session-manager.js: require absolute paths in getSessionStats to prevent
  content strings ending with .tmp from being treated as file paths

New tests (164 total, up from 97):
- session-manager.test.js: 27 tests covering parseSessionFilename,
  parseSessionMetadata, getSessionStats, CRUD operations, getSessionSize,
  getSessionTitle, edge cases (null input, non-existent files, directories)
- session-aliases.test.js: 40 tests covering loadAliases (corrupted JSON,
  invalid structure), setAlias (validation, reserved names), resolveAlias,
  listAliases (sort, search, limit), deleteAlias, renameAlias, updateAliasTitle,
  resolveSessionAlias, getAliasesForSession, cleanupAliases, atomic write

Also includes hook-generated improvements:
- utils.d.ts: document that readStdinJson never rejects
- session-aliases.d.ts: fix updateAliasTitle type to accept null
- package-manager.js: add try-catch to setProjectPackageManager writeFile
2026-02-12 15:50:04 -08:00