everything-claude-code

fix: sanitize getExecCommand args, escape regex in getCommandPattern, clean up readStdinJson timeout, add 10 tests

Validate args parameter in getExecCommand() against SAFE_ARGS_REGEX to
prevent command injection when returned string is passed to a shell.
Escape regex metacharacters in getCommandPattern() generic action branch
to prevent malformed patterns and unintended matching. Clean up stdin
listeners in readStdinJson() timeout path to prevent process hanging.

Affaan Mustafa · 2026-02-13 02:27:04 -08:00

a62a3a2416

fix: calendar-accurate date validation in parseSessionFilename, add 22 tests

- Fix parseSessionFilename to reject impossible dates (Feb 31, Apr 31,
  Feb 29 non-leap) using Date constructor month/day roundtrip check
- Add 6 session-manager tests for calendar date validation edge cases
- Add 3 session-manager tests for code blocks/special chars in getSessionStats
- Add 10 package-manager tests for PM-specific command formats (getRunCommand
  and getExecCommand for pnpm, yarn, bun, npm)
- Add 3 integration tests for session-end transcript parsing (mixed JSONL
  formats, malformed lines, nested user messages)

Affaan Mustafa · 2026-02-13 01:42:56 -08:00

e96b522af0

test: add 7 package-manager priority and source detection tests

- Test valid project-config detection (.claude/package-manager.json)
- Test priority order: project-config > package.json > lock-file
- Test package.json > lock-file priority
- Test default fallback to npm
- Test setPreferredPackageManager success case
- Test getCommandPattern for test and build actions

Affaan Mustafa · 2026-02-13 01:38:29 -08:00

34edb59e19

fix: add input validation, date range checks, and security hardening

- validate-agents.js: reject invalid model names in agent frontmatter
- package-manager.js: validate script/binary names against shell injection
- session-manager.js: reject impossible month/day values in filenames
- utils.js: support options.all for replaceInFile string patterns
- strategic-compact/SKILL.md: fix hook matcher syntax and script reference
- install.sh: warn when overwriting existing rule customizations
- Add 24 new tests covering all validation and edge cases

Affaan Mustafa · 2026-02-12 17:32:04 -08:00

926eba97c5

test: add 13 tests for package-manager.js untested functions

- setProjectPackageManager: creates config, rejects unknown PM
- setPreferredPackageManager: rejects unknown PM
- detectFromPackageJson: invalid JSON, unknown PM name
- getExecCommand: without args
- getRunCommand: build, dev, and custom scripts
- DETECTION_PRIORITY: order verification
- getCommandPattern: install and custom action patterns

Total tests: 164 → 177

Affaan Mustafa · 2026-02-12 15:59:56 -08:00

7d57de1299

test: update getSelectionPrompt test for new no-spawn behavior

The prompt no longer lists "Available package managers" (which required
spawning processes) — it now shows "Supported package managers" and
mentions lock file detection as a configuration option.

All 69 tests pass.

Affaan Mustafa · 2026-02-12 12:20:27 -08:00

501bf23ca0

fix: resolve ESLint errors and update tests for project-name fallback

- Fix 16 ESLint no-unused-vars errors across hook scripts and tests
- Add eslint-disable comment for intentional control-regex in ANSI stripper
- Update session file test to use getSessionIdShort() instead of hardcoded 'default'
  (reflects PR #110's project-name fallback behavior)
- Add marketing/ to .gitignore (local drafts)
- Add skill-create-output.js (terminal output formatter)

All 69 tests now pass. CI should be green.

Affaan Mustafa · 2026-01-29 02:58:51 -08:00

a44a0553bb

feat: cross-platform support with Node.js scripts

- Rewrite all bash hooks to Node.js for Windows/macOS/Linux compatibility
- Add package manager auto-detection (npm, pnpm, yarn, bun)
- Add scripts/lib/ with cross-platform utilities
- Add /setup-pm command for package manager configuration
- Add comprehensive test suite (62 tests)

Co-authored-by: zerx-lab

zerx-lab · 2026-01-22 23:08:07 -08:00

970f8bf884

8 Commits