tests/test_compress_hub_scan.py

Rama main · réplica de lectura del repositorio original.

"""Keep skills/caveman-compress installable from skill hubs that scan statically (#1464).

Hermes' hub scanner (skills-guard) hard-blocks a community skill on any
critical finding and asks for --force on any high one. Every finding it raised
here matched what the skill legitimately does, so the fixes respelled text
without changing behaviour. These checks pin the shapes that triggered those
findings, so a later edit cannot quietly make the skill uninstallable again.
They are narrower than the scanner on purpose: each one names a shape that has
fired on this skill before.
"""

import re
import unittest
from pathlib import Path

SKILL_DIR = Path(__file__).resolve().parent.parent / "skills" / "caveman-compress"
PLUGIN_MIRROR = Path(__file__).resolve().parent.parent / "plugins" / "caveman" / "skills" / "caveman-compress"
TEXT_SUFFIXES = {".md", ".py", ".txt", ".sh", ".json", ".yaml", ".yml", ".toml"}

AGENT_CONFIG = r"(?:AGENTS\.md|CLAUDE\.md|\.cursorrules|\.clinerules)"
MODIFY_VERB = (
    r"(?:writ(?:e|es|ing)|written|edit(?:s|ed|ing)?|modif(?:y|ies|ied|ying)|updat(?:e|es|ed|ing)"
    r"|append(?:s|ed|ing)?|prepend(?:s|ed|ing)?|inject(?:s|ed|ing)?|overwrit(?:e|es|ing)|overwritten"
    r"|replac(?:e|es|ed|ing)|alter(?:s|ed|ing)?|add(?:s|ed|ing))"
)

# (name, pattern, applies to suffixes or None for all)
SHAPES = (
    ("ssh authorized-keys token", re.compile("authorized" + "_keys"), None),
    ("inline shell exec marker", re.compile("!" + "`" + r"[^`\s]"), None),
    ("os.environ outside .get()", re.compile(r"^[^#\n]*os\.environ\b(?!\s*\.get\s*\()"), {".py"}),
    (
        "shell write into an agent config file",
        re.compile(
            rf"(?:>>|[\w\"'`)\]]\s*>)\s*[~\w./-]*{AGENT_CONFIG}(?!\.?\w)"
            rf"|\btee\s+(?:-a\s+)?[~\w./\"'-]*{AGENT_CONFIG}(?!\.?\w)"
            rf"|\b(?:cp|mv)\s+[^\s|;&]+\s+[^\n|;&]{{0,40}}?{AGENT_CONFIG}(?!\.?\w)"
        ),
        None,
    ),
    (
        "imperative edit of an agent config file",
        re.compile(rf"^\s*(?:[-*+]\s+|\d+[.)]\s+)?\b{MODIFY_VERB}\b[^\n,]{{0,80}}?{AGENT_CONFIG}\b", re.IGNORECASE),
        None,
    ),
)


def scanned_files(root):
    return sorted(
        p for p in root.rglob("*")
        if p.is_file() and (p.suffix.lower() in TEXT_SUFFIXES or p.name == "SKILL.md")
        and "__pycache__" not in p.parts
    )


class CompressHubScanTests(unittest.TestCase):
    def assert_clean(self, root):
        files = scanned_files(root)
        self.assertTrue(files, f"no files found under {root}")
        hits = []
        for path in files:
            for lineno, line in enumerate(path.read_text(encoding="utf-8").split("\n"), start=1):
                for name, pattern, suffixes in SHAPES:
                    if suffixes is not None and path.suffix.lower() not in suffixes:
                        continue
                    if pattern.search(line):
                        hits.append(f"{path.relative_to(root)}:{lineno}: {name}: {line.strip()[:100]}")
        self.assertEqual(hits, [], "hub scanner would flag:\n" + "\n".join(hits))

    def test_skill_source_has_no_hub_blocking_shapes(self):
        self.assert_clean(SKILL_DIR)

    def test_plugin_mirror_has_no_hub_blocking_shapes(self):
        if not PLUGIN_MIRROR.exists():
            self.skipTest("plugin mirror not present")
        self.assert_clean(PLUGIN_MIRROR)


if __name__ == "__main__":
    unittest.main()