BitSquare/Codeman
2
0
Fork 0
mirror of https://github.com/Ark0N/Codeman.git synced 2026-10-06 15:39:41 +02:00
Code Issues Packages Projects Releases Wiki Activity

chore: version packages

Browse Source 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
arkon
2026-02-28 01:35:37 +01:00
co-authored by Claude Opus 4.6
parent 1ab1dd100a
commit 9d9f4d323c
13 changed files with 240 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/hooks-config.test.ts
+17 -4
View File
@@ -667,8 +667,8 @@ describe('Hook Config Generation - Extended', () => {
for (const hook of notifHooks) {
const cmd = hook.hooks[0].command;
// The command contains escaped quotes for the JSON payload: \"event\":\"idle_prompt\"
expect(cmd).toContain(`\\"event\\":\\"${hook.matcher}\\"`);
// The printf format string contains the event name baked in
expect(cmd).toContain(`"event":"${hook.matcher}"`);
}
});
@@ -684,8 +684,9 @@ describe('Hook Config Generation - Extended', () => {
const notifHooks = config.hooks.Notification as Array<{ hooks: Array<{ command: string }> }>;
const cmd = notifHooks[0].hooks[0].command;
expect(cmd).toContain('HOOK_DATA=$(cat');
// The data field in the JSON uses escaped quotes: \"data\":$HOOK_DATA
expect(cmd).toContain('\\"data\\":$HOOK_DATA');
// Data is piped to curl via stdin (--data @-) to prevent shell injection
expect(cmd).toContain('$HOOK_DATA');
expect(cmd).toContain('--data @-');
});
it('should have consistent structure across all notification hooks', () => {
@@ -701,6 +702,18 @@ describe('Hook Config Generation - Extended', () => {
}
});
it('should pipe data to curl via stdin to prevent shell injection', () => {
const config = generateHooksConfig();
const notifHooks = config.hooks.Notification as Array<{ hooks: Array<{ command: string }> }>;
const cmd = notifHooks[0].hooks[0].command;
// HOOK_DATA must NOT be embedded unquoted in a -d "..." argument (shell injection vector)
expect(cmd).not.toMatch(/-d\s+"[^"]*\$HOOK_DATA/);
// Instead, data should be piped to curl via stdin
expect(cmd).toContain('printf');
expect(cmd).toContain('| curl');
expect(cmd).toContain('--data @-');
});
it('should have stop hook without matcher (catches all)', () => {
const config = generateHooksConfig();
const stopHooks = config.hooks.Stop as Array<{ matcher?: string; hooks: Array<{ command: string }> }>;