feat(mcp): add workspace root validation to prevent path traversal (#100)
* feat(mcp): add workspace root validation to prevent path traversal
- Add workspaceRoot field to Service for restricting file operations
- Add WithWorkspaceRoot() option for configuring the workspace directory
- Add validatePath() helper to check paths are within workspace
- Apply validation to all file operation handlers
- Default to current working directory for security
- Add comprehensive tests for path validation
Closes #82
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: move CLI commands from pkg/ to internal/cmd/
- Move 18 CLI command packages to internal/cmd/ (not externally importable)
- Keep 16 library packages in pkg/ (externally importable)
- Update all import paths throughout codebase
- Cleaner separation between CLI logic and reusable libraries
CLI commands moved: ai, ci, dev, docs, doctor, gitcmd, go, monitor,
php, pkgcmd, qa, sdk, security, setup, test, updater, vm, workspace
Libraries remaining: agentic, build, cache, cli, container, devops,
errors, framework, git, i18n, io, log, mcp, process, release, repos
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor(mcp): use pkg/io Medium for sandboxed file operations
Replace manual path validation with pkg/io.Medium for all file operations.
This delegates security (path traversal, symlink bypass) to the sandboxed
local.Medium implementation.
Changes:
- Add io.NewSandboxed() for creating sandboxed Medium instances
- Refactor MCP Service to use io.Medium instead of direct os.* calls
- Remove validatePath and resolvePathWithSymlinks functions
- Update tests to verify Medium-based behaviour
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: correct import path and workflow references
- Fix pkg/io/io.go import from core-gui to core
- Update CI workflows to use internal/cmd/updater path
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(security): address CodeRabbit review issues for path validation
- pkg/io/local: add symlink resolution and boundary-aware containment
- Reject absolute paths in sandboxed Medium
- Use filepath.EvalSymlinks to prevent symlink bypass attacks
- Fix prefix check to prevent /tmp/root matching /tmp/root2
- pkg/mcp: fix resolvePath to validate and return errors
- Changed resolvePath from (string) to (string, error)
- Update deleteFile, renameFile, listDirectory, fileExists to handle errors
- Changed New() to return (*Service, error) instead of *Service
- Properly propagate option errors instead of silently discarding
- pkg/io: wrap errors with E() helper for consistent context
- Copy() and MockMedium.Read() now use coreerr.E()
- tests: rename to use _Good/_Bad/_Ugly suffixes per coding guidelines
- Fix hardcoded /tmp in TestPath to use t.TempDir()
- Add TestResolvePath_Bad_SymlinkTraversal test
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* style: fix gofmt formatting
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* style: fix gofmt formatting across all files
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-01 21:59:34 +00:00
|
|
|
package io
|
|
|
|
|
|
|
|
|
|
import (
|
|
|
|
|
"testing"
|
|
|
|
|
|
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
// --- MockMedium Tests ---
|
|
|
|
|
|
|
|
|
|
func TestNewMockMedium_Good(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
assert.NotNil(t, m)
|
|
|
|
|
assert.NotNil(t, m.Files)
|
|
|
|
|
assert.NotNil(t, m.Dirs)
|
|
|
|
|
assert.Empty(t, m.Files)
|
|
|
|
|
assert.Empty(t, m.Dirs)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestMockMedium_Read_Good(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
m.Files["test.txt"] = "hello world"
|
|
|
|
|
content, err := m.Read("test.txt")
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.Equal(t, "hello world", content)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestMockMedium_Read_Bad(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
_, err := m.Read("nonexistent.txt")
|
|
|
|
|
assert.Error(t, err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestMockMedium_Write_Good(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
err := m.Write("test.txt", "content")
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.Equal(t, "content", m.Files["test.txt"])
|
|
|
|
|
|
|
|
|
|
// Overwrite existing file
|
|
|
|
|
err = m.Write("test.txt", "new content")
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.Equal(t, "new content", m.Files["test.txt"])
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestMockMedium_EnsureDir_Good(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
err := m.EnsureDir("/path/to/dir")
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.True(t, m.Dirs["/path/to/dir"])
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestMockMedium_IsFile_Good(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
m.Files["exists.txt"] = "content"
|
|
|
|
|
|
|
|
|
|
assert.True(t, m.IsFile("exists.txt"))
|
|
|
|
|
assert.False(t, m.IsFile("nonexistent.txt"))
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestMockMedium_FileGet_Good(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
m.Files["test.txt"] = "content"
|
|
|
|
|
content, err := m.FileGet("test.txt")
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.Equal(t, "content", content)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestMockMedium_FileSet_Good(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
err := m.FileSet("test.txt", "content")
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.Equal(t, "content", m.Files["test.txt"])
|
|
|
|
|
}
|
|
|
|
|
|
feat(errors): Unify errors and logging (#180)
* feat(help): Add CLI help command
Fixes #136
* chore: remove binary
* feat(mcp): Add TCP transport
Fixes #126
* feat(io): Migrate pkg/mcp to use Medium abstraction
Fixes #103
* feat(io): batch implementation placeholder
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(errors): batch implementation placeholder
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(log): batch implementation placeholder
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore(io): Migrate internal/cmd/docs/* to Medium abstraction
Fixes #113
* chore(io): Migrate internal/cmd/dev/* to Medium abstraction
Fixes #114
* chore(io): Migrate internal/cmd/setup/* to Medium abstraction
* chore(io): Complete migration of internal/cmd/dev/* to Medium abstraction
* feat(io): extend Medium interface with Delete, Rename, List, Stat operations
Adds the following methods to the Medium interface:
- Delete(path) - remove a file or empty directory
- DeleteAll(path) - recursively remove a file or directory
- Rename(old, new) - move/rename a file or directory
- List(path) - list directory entries (returns []fs.DirEntry)
- Stat(path) - get file information (returns fs.FileInfo)
- Exists(path) - check if path exists
- IsDir(path) - check if path is a directory
Implements these methods in both local.Medium (using os package)
and MockMedium (in-memory for testing). Includes FileInfo and
DirEntry types for mock implementations.
This enables migration of direct os.* calls to the Medium
abstraction for consistent path validation and testability.
Refs #101
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore(io): Migrate internal/cmd/sdk, pkgcmd, and workspace to Medium abstraction
* chore(io): migrate internal/cmd/docs and internal/cmd/dev to Medium
- internal/cmd/docs: Replace os.Stat, os.ReadFile, os.WriteFile,
os.MkdirAll, os.RemoveAll with io.Local equivalents
- internal/cmd/dev: Replace os.Stat, os.ReadFile, os.WriteFile,
os.MkdirAll, os.ReadDir with io.Local equivalents
- Fix local.Medium to allow absolute paths when root is "/" for
full filesystem access (io.Local use case)
Refs #113, #114
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore(io): migrate internal/cmd/setup to Medium abstraction
Migrated all direct os.* filesystem calls to use io.Local:
- cmd_repo.go: os.MkdirAll -> io.Local.EnsureDir, os.WriteFile -> io.Local.Write, os.Stat -> io.Local.IsFile
- cmd_bootstrap.go: os.MkdirAll -> io.Local.EnsureDir, os.Stat -> io.Local.IsDir/Exists, os.ReadDir -> io.Local.List
- cmd_registry.go: os.MkdirAll -> io.Local.EnsureDir, os.Stat -> io.Local.Exists
- cmd_ci.go: os.ReadFile -> io.Local.Read
- github_config.go: os.ReadFile -> io.Local.Read, os.Stat -> io.Local.Exists
Refs #116
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(log): add error creation and log-and-return helpers
Implements issues #129 and #132:
- Add Err struct with Op, Msg, Err, Code fields for structured errors
- Add E(), Wrap(), WrapCode(), NewCode() for error creation
- Add Is(), As(), NewError(), Join() as stdlib wrappers
- Add Op(), ErrCode(), Message(), Root() for introspection
- Add LogError(), LogWarn(), Must() for combined log-and-return
Closes #129
Closes #132
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore(errors): create deprecation alias pointing to pkg/log
Makes pkg/errors a thin compatibility layer that re-exports from pkg/log.
All error handling functions now have canonical implementations in pkg/log.
Migration guide in package documentation:
- errors.Error -> log.Err
- errors.E -> log.E
- errors.Code -> log.NewCode
- errors.New -> log.NewError
Fixes behavior consistency:
- E(op, msg, nil) now creates an error (for errors without cause)
- Wrap(nil, op, msg) returns nil (for conditional wrapping)
- WrapCode returns nil only when both err is nil AND code is empty
Closes #128
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore(log): migrate pkg/errors imports to pkg/log
Migrates all internal packages from pkg/errors to pkg/log:
- internal/cmd/monitor
- internal/cmd/qa
- internal/cmd/dev
- pkg/agentic
Closes #130
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(io): address Copilot review feedback
- Fix MockMedium.Rename: collect keys before mutating maps during iteration
- Fix .git checks to use Exists instead of List (handles worktrees/submodules)
- Fix cmd_sync.go: use DeleteAll for recursive directory removal
Files updated:
- pkg/io/io.go: safe map iteration in Rename
- internal/cmd/setup/cmd_bootstrap.go: Exists for .git checks
- internal/cmd/setup/cmd_registry.go: Exists for .git checks
- internal/cmd/pkgcmd/cmd_install.go: Exists for .git checks
- internal/cmd/pkgcmd/cmd_manage.go: Exists for .git checks
- internal/cmd/docs/cmd_sync.go: DeleteAll for recursive delete
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(updater): resolve PkgVersion duplicate declaration
Remove var PkgVersion from updater.go since go generate creates
const PkgVersion in version.go. Track version.go in git to ensure
builds work without running go generate first.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* style: fix formatting in internal/variants
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* style: fix formatting across migrated files
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor(io): simplify local Medium implementation
Rewrote to match the simpler TypeScript pattern:
- path() sanitizes and returns string directly
- Each method calls path() once
- No complex symlink validation
- Less code, less attack surface
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(io): remove duplicate method declarations
Clean up the client.go file that had duplicate method declarations
from a bad cherry-pick merge. Now has 127 lines of simple, clean code.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* test(io): fix traversal test to match sanitization behavior
The simplified path() sanitizes .. to . without returning errors.
Update test to verify sanitization works correctly.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* test(mcp): update sandboxing tests for simplified Medium
The simplified io/local.Medium implementation:
- Sanitizes .. to . (no error, path is cleaned)
- Allows absolute paths through (caller validates if needed)
- Follows symlinks (no traversal blocking)
Update tests to match this simplified behavior.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-02 06:48:40 +00:00
|
|
|
func TestMockMedium_Delete_Good(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
m.Files["test.txt"] = "content"
|
|
|
|
|
|
|
|
|
|
err := m.Delete("test.txt")
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.False(t, m.IsFile("test.txt"))
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestMockMedium_Delete_Bad_NotFound(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
err := m.Delete("nonexistent.txt")
|
|
|
|
|
assert.Error(t, err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestMockMedium_Delete_Bad_DirNotEmpty(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
m.Dirs["mydir"] = true
|
|
|
|
|
m.Files["mydir/file.txt"] = "content"
|
|
|
|
|
|
|
|
|
|
err := m.Delete("mydir")
|
|
|
|
|
assert.Error(t, err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestMockMedium_DeleteAll_Good(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
m.Dirs["mydir"] = true
|
|
|
|
|
m.Dirs["mydir/subdir"] = true
|
|
|
|
|
m.Files["mydir/file.txt"] = "content"
|
|
|
|
|
m.Files["mydir/subdir/nested.txt"] = "nested"
|
|
|
|
|
|
|
|
|
|
err := m.DeleteAll("mydir")
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.Empty(t, m.Dirs)
|
|
|
|
|
assert.Empty(t, m.Files)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestMockMedium_Rename_Good(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
m.Files["old.txt"] = "content"
|
|
|
|
|
|
|
|
|
|
err := m.Rename("old.txt", "new.txt")
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.False(t, m.IsFile("old.txt"))
|
|
|
|
|
assert.True(t, m.IsFile("new.txt"))
|
|
|
|
|
assert.Equal(t, "content", m.Files["new.txt"])
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestMockMedium_Rename_Good_Dir(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
m.Dirs["olddir"] = true
|
|
|
|
|
m.Files["olddir/file.txt"] = "content"
|
|
|
|
|
|
|
|
|
|
err := m.Rename("olddir", "newdir")
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.False(t, m.Dirs["olddir"])
|
|
|
|
|
assert.True(t, m.Dirs["newdir"])
|
|
|
|
|
assert.Equal(t, "content", m.Files["newdir/file.txt"])
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestMockMedium_List_Good(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
m.Dirs["mydir"] = true
|
|
|
|
|
m.Files["mydir/file1.txt"] = "content1"
|
|
|
|
|
m.Files["mydir/file2.txt"] = "content2"
|
|
|
|
|
m.Dirs["mydir/subdir"] = true
|
|
|
|
|
|
|
|
|
|
entries, err := m.List("mydir")
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.Len(t, entries, 3)
|
|
|
|
|
|
|
|
|
|
names := make(map[string]bool)
|
|
|
|
|
for _, e := range entries {
|
|
|
|
|
names[e.Name()] = true
|
|
|
|
|
}
|
|
|
|
|
assert.True(t, names["file1.txt"])
|
|
|
|
|
assert.True(t, names["file2.txt"])
|
|
|
|
|
assert.True(t, names["subdir"])
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestMockMedium_Stat_Good(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
m.Files["test.txt"] = "hello world"
|
|
|
|
|
|
|
|
|
|
info, err := m.Stat("test.txt")
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.Equal(t, "test.txt", info.Name())
|
|
|
|
|
assert.Equal(t, int64(11), info.Size())
|
|
|
|
|
assert.False(t, info.IsDir())
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestMockMedium_Stat_Good_Dir(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
m.Dirs["mydir"] = true
|
|
|
|
|
|
|
|
|
|
info, err := m.Stat("mydir")
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.Equal(t, "mydir", info.Name())
|
|
|
|
|
assert.True(t, info.IsDir())
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestMockMedium_Exists_Good(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
m.Files["file.txt"] = "content"
|
|
|
|
|
m.Dirs["mydir"] = true
|
|
|
|
|
|
|
|
|
|
assert.True(t, m.Exists("file.txt"))
|
|
|
|
|
assert.True(t, m.Exists("mydir"))
|
|
|
|
|
assert.False(t, m.Exists("nonexistent"))
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestMockMedium_IsDir_Good(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
m.Files["file.txt"] = "content"
|
|
|
|
|
m.Dirs["mydir"] = true
|
|
|
|
|
|
|
|
|
|
assert.False(t, m.IsDir("file.txt"))
|
|
|
|
|
assert.True(t, m.IsDir("mydir"))
|
|
|
|
|
assert.False(t, m.IsDir("nonexistent"))
|
|
|
|
|
}
|
|
|
|
|
|
feat(mcp): add workspace root validation to prevent path traversal (#100)
* feat(mcp): add workspace root validation to prevent path traversal
- Add workspaceRoot field to Service for restricting file operations
- Add WithWorkspaceRoot() option for configuring the workspace directory
- Add validatePath() helper to check paths are within workspace
- Apply validation to all file operation handlers
- Default to current working directory for security
- Add comprehensive tests for path validation
Closes #82
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: move CLI commands from pkg/ to internal/cmd/
- Move 18 CLI command packages to internal/cmd/ (not externally importable)
- Keep 16 library packages in pkg/ (externally importable)
- Update all import paths throughout codebase
- Cleaner separation between CLI logic and reusable libraries
CLI commands moved: ai, ci, dev, docs, doctor, gitcmd, go, monitor,
php, pkgcmd, qa, sdk, security, setup, test, updater, vm, workspace
Libraries remaining: agentic, build, cache, cli, container, devops,
errors, framework, git, i18n, io, log, mcp, process, release, repos
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor(mcp): use pkg/io Medium for sandboxed file operations
Replace manual path validation with pkg/io.Medium for all file operations.
This delegates security (path traversal, symlink bypass) to the sandboxed
local.Medium implementation.
Changes:
- Add io.NewSandboxed() for creating sandboxed Medium instances
- Refactor MCP Service to use io.Medium instead of direct os.* calls
- Remove validatePath and resolvePathWithSymlinks functions
- Update tests to verify Medium-based behaviour
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: correct import path and workflow references
- Fix pkg/io/io.go import from core-gui to core
- Update CI workflows to use internal/cmd/updater path
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(security): address CodeRabbit review issues for path validation
- pkg/io/local: add symlink resolution and boundary-aware containment
- Reject absolute paths in sandboxed Medium
- Use filepath.EvalSymlinks to prevent symlink bypass attacks
- Fix prefix check to prevent /tmp/root matching /tmp/root2
- pkg/mcp: fix resolvePath to validate and return errors
- Changed resolvePath from (string) to (string, error)
- Update deleteFile, renameFile, listDirectory, fileExists to handle errors
- Changed New() to return (*Service, error) instead of *Service
- Properly propagate option errors instead of silently discarding
- pkg/io: wrap errors with E() helper for consistent context
- Copy() and MockMedium.Read() now use coreerr.E()
- tests: rename to use _Good/_Bad/_Ugly suffixes per coding guidelines
- Fix hardcoded /tmp in TestPath to use t.TempDir()
- Add TestResolvePath_Bad_SymlinkTraversal test
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* style: fix gofmt formatting
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* style: fix gofmt formatting across all files
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-01 21:59:34 +00:00
|
|
|
// --- Wrapper Function Tests ---
|
|
|
|
|
|
|
|
|
|
func TestRead_Good(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
m.Files["test.txt"] = "hello"
|
|
|
|
|
content, err := Read(m, "test.txt")
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.Equal(t, "hello", content)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestWrite_Good(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
err := Write(m, "test.txt", "hello")
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.Equal(t, "hello", m.Files["test.txt"])
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestEnsureDir_Good(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
err := EnsureDir(m, "/my/dir")
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.True(t, m.Dirs["/my/dir"])
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestIsFile_Good(t *testing.T) {
|
|
|
|
|
m := NewMockMedium()
|
|
|
|
|
m.Files["exists.txt"] = "content"
|
|
|
|
|
|
|
|
|
|
assert.True(t, IsFile(m, "exists.txt"))
|
|
|
|
|
assert.False(t, IsFile(m, "nonexistent.txt"))
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestCopy_Good(t *testing.T) {
|
|
|
|
|
source := NewMockMedium()
|
|
|
|
|
dest := NewMockMedium()
|
|
|
|
|
source.Files["test.txt"] = "hello"
|
|
|
|
|
err := Copy(source, "test.txt", dest, "test.txt")
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.Equal(t, "hello", dest.Files["test.txt"])
|
|
|
|
|
|
|
|
|
|
// Copy to different path
|
|
|
|
|
source.Files["original.txt"] = "content"
|
|
|
|
|
err = Copy(source, "original.txt", dest, "copied.txt")
|
|
|
|
|
assert.NoError(t, err)
|
|
|
|
|
assert.Equal(t, "content", dest.Files["copied.txt"])
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func TestCopy_Bad(t *testing.T) {
|
|
|
|
|
source := NewMockMedium()
|
|
|
|
|
dest := NewMockMedium()
|
|
|
|
|
err := Copy(source, "nonexistent.txt", dest, "dest.txt")
|
|
|
|
|
assert.Error(t, err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// --- Local Global Tests ---
|
|
|
|
|
|
|
|
|
|
func TestLocalGlobal_Good(t *testing.T) {
|
|
|
|
|
// io.Local should be initialized by init()
|
|
|
|
|
assert.NotNil(t, Local, "io.Local should be initialized")
|
|
|
|
|
|
|
|
|
|
// Should be able to use it as a Medium
|
feat: infrastructure packages and lint cleanup (#281)
* ci: consolidate duplicate workflows and merge CodeQL configs
Remove 17 duplicate workflow files that were split copies of the
combined originals. Each family (CI, CodeQL, Coverage, PR Build,
Alpha Release) had the same job duplicated across separate
push/pull_request/schedule/manual trigger files.
Merge codeql.yml and codescan.yml into a single codeql.yml with
a language matrix covering go, javascript-typescript, python,
and actions — matching the previous default setup coverage.
Remaining workflows (one per family):
- ci.yml (push + PR + manual)
- codeql.yml (push + PR + schedule, all languages)
- coverage.yml (push + PR + manual)
- alpha-release.yml (push + manual)
- pr-build.yml (PR + manual)
- release.yml (tag push)
- agent-verify.yml, auto-label.yml, auto-project.yml
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add collect, config, crypt, plugin packages and fix all lint issues
Add four new infrastructure packages with CLI commands:
- pkg/config: layered configuration (defaults → file → env → flags)
- pkg/crypt: crypto primitives (Argon2id, AES-GCM, ChaCha20, HMAC, checksums)
- pkg/plugin: plugin system with GitHub-based install/update/remove
- pkg/collect: collection subsystem (GitHub, BitcoinTalk, market, papers, excavate)
Fix all golangci-lint issues across the entire codebase (~100 errcheck,
staticcheck SA1012/SA1019/ST1005, unused, ineffassign fixes) so that
`core go qa` passes with 0 issues.
Closes #167, #168, #170, #250, #251, #252, #253, #254, #255, #256
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-04 11:34:43 +00:00
|
|
|
var m = Local
|
feat(mcp): add workspace root validation to prevent path traversal (#100)
* feat(mcp): add workspace root validation to prevent path traversal
- Add workspaceRoot field to Service for restricting file operations
- Add WithWorkspaceRoot() option for configuring the workspace directory
- Add validatePath() helper to check paths are within workspace
- Apply validation to all file operation handlers
- Default to current working directory for security
- Add comprehensive tests for path validation
Closes #82
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: move CLI commands from pkg/ to internal/cmd/
- Move 18 CLI command packages to internal/cmd/ (not externally importable)
- Keep 16 library packages in pkg/ (externally importable)
- Update all import paths throughout codebase
- Cleaner separation between CLI logic and reusable libraries
CLI commands moved: ai, ci, dev, docs, doctor, gitcmd, go, monitor,
php, pkgcmd, qa, sdk, security, setup, test, updater, vm, workspace
Libraries remaining: agentic, build, cache, cli, container, devops,
errors, framework, git, i18n, io, log, mcp, process, release, repos
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor(mcp): use pkg/io Medium for sandboxed file operations
Replace manual path validation with pkg/io.Medium for all file operations.
This delegates security (path traversal, symlink bypass) to the sandboxed
local.Medium implementation.
Changes:
- Add io.NewSandboxed() for creating sandboxed Medium instances
- Refactor MCP Service to use io.Medium instead of direct os.* calls
- Remove validatePath and resolvePathWithSymlinks functions
- Update tests to verify Medium-based behaviour
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: correct import path and workflow references
- Fix pkg/io/io.go import from core-gui to core
- Update CI workflows to use internal/cmd/updater path
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(security): address CodeRabbit review issues for path validation
- pkg/io/local: add symlink resolution and boundary-aware containment
- Reject absolute paths in sandboxed Medium
- Use filepath.EvalSymlinks to prevent symlink bypass attacks
- Fix prefix check to prevent /tmp/root matching /tmp/root2
- pkg/mcp: fix resolvePath to validate and return errors
- Changed resolvePath from (string) to (string, error)
- Update deleteFile, renameFile, listDirectory, fileExists to handle errors
- Changed New() to return (*Service, error) instead of *Service
- Properly propagate option errors instead of silently discarding
- pkg/io: wrap errors with E() helper for consistent context
- Copy() and MockMedium.Read() now use coreerr.E()
- tests: rename to use _Good/_Bad/_Ugly suffixes per coding guidelines
- Fix hardcoded /tmp in TestPath to use t.TempDir()
- Add TestResolvePath_Bad_SymlinkTraversal test
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* style: fix gofmt formatting
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* style: fix gofmt formatting across all files
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-01 21:59:34 +00:00
|
|
|
assert.NotNil(t, m)
|
|
|
|
|
}
|