security: fix path traversal risk in SPAWN_HOME validation#1402

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
louisgv merged 2 commits into from
Feb 17, 2026
Merged

security: fix path traversal risk in SPAWN_HOME validation #1402

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a41ea1f
security: fix path traversal risk in SPAWN_HOME validation
louisgv Feb 17, 2026
cafbc3f
fix: add missing join import and update tests for SPAWN_HOME security…
louisgv Feb 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions cli/src/__tests__/clear-history.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import {
clearHistory,
loadHistory,
Expand All@@ -27,7 +27,7 @@ describe("clearHistory", () => {
let originalEnv: NodeJS.ProcessEnv;

beforeEach(() => {
testDir = join(tmpdir(), `spawn-clear-test-${Date.now()}-${Math.random()}`);
testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
mkdirSync(testDir, { recursive: true });
originalEnv = { ...process.env };
process.env.SPAWN_HOME = testDir;
Expand DownExpand Up@@ -253,7 +253,7 @@ describe("cmdListClear", () => {
let originalEnv: NodeJS.ProcessEnv;

beforeEach(() => {
testDir = join(tmpdir(), `spawn-cmdclear-test-${Date.now()}-${Math.random()}`);
testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
mkdirSync(testDir, { recursive: true });
originalEnv = { ...process.env };
process.env.SPAWN_HOME = testDir;
Expand Down
14 changes: 8 additions & 6 deletions cli/src/__tests__/cli-core-edge-cases.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, spyOn, mock } from "bun:test";
import { existsSync, writeFileSync, mkdirSync, rmSync, readFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
* Tests for edge cases across core CLI modules (manifest.ts, security.ts,
Expand DownExpand Up@@ -697,7 +697,7 @@ describe("history.ts additional edge cases", () => {
let originalSpawnHome: string | undefined;

beforeEach(() => {
testDir = join(tmpdir(), `spawn-test-history-${Date.now()}-${Math.random().toString(36).slice(2)}`);
testDir = join(homedir(), `spawn-test-history-${Date.now()}-${Math.random().toString(36).slice(2)}`);
mkdirSync(testDir, { recursive: true });
originalSpawnHome = process.env.SPAWN_HOME;
process.env.SPAWN_HOME = testDir;
Expand All@@ -716,15 +716,17 @@ describe("history.ts additional edge cases", () => {

describe("getSpawnDir edge cases", () => {
it("should resolve absolute SPAWN_HOME with trailing slash", () => {
process.env.SPAWN_HOME = "/tmp/test-spawn/";
const { homedir } = require("os");
process.env.SPAWN_HOME = join(homedir(), "test-spawn") + "/";
const dir = getSpawnDir();
expect(dir).toBe("/tmp/test-spawn");
expect(dir).toBe(join(homedir(), "test-spawn"));
});

it("should resolve SPAWN_HOME with .. segments", () => {
process.env.SPAWN_HOME = "/tmp/a/../b";
const { homedir } = require("os");
process.env.SPAWN_HOME = join(homedir(), "a", "..", "b");
const dir = getSpawnDir();
expect(dir).toBe("/tmp/b");
expect(dir).toBe(join(homedir(), "b"));
});

it("should throw for relative path ./data", () => {
Expand Down
11 changes: 7 additions & 4 deletions cli/src/__tests__/cli-version-and-dispatch.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
import { describe, it, expect, beforeEach, afterEach, spyOn } from "bun:test";
import { resolve } from "path";
import { resolve, join } from "path";

/**
* Tests for CLI version output and dispatch routing via subprocess execution.
Expand DownExpand Up@@ -493,19 +493,22 @@ describe("subcommand alias routing", () => {

describe("list command aliases", () => {
it("'list' should not crash with empty history", () => {
const { exitCode } = runCLI(["list"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
const { homedir } = require("os");
const { exitCode } = runCLI(["list"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
// May exit 0 (shows "no spawns") or run interactive picker in non-TTY
// The important thing is it doesn't crash
expect(exitCode).toBeDefined();
});

it("'ls' should work as alias for 'list'", () => {
const { exitCode } = runCLI(["ls"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
const { homedir } = require("os");
const { exitCode } = runCLI(["ls"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
expect(exitCode).toBeDefined();
});

it("'history' should work as alias for 'list'", () => {
const { exitCode } = runCLI(["history"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
const { homedir } = require("os");
const { exitCode } = runCLI(["history"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
expect(exitCode).toBeDefined();
});

Expand Down
4 changes: 2 additions & 2 deletions cli/src/__tests__/cmdlast.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import type { SpawnRecord } from "../history";

Expand DownExpand Up@@ -79,7 +79,7 @@ describe("cmdLast", () => {
}

beforeEach(async () => {
testDir = join(tmpdir(), `spawn-cmdlast-test-${Date.now()}-${Math.random()}`);
testDir = join(homedir(), `spawn-cmdlast-test-${Date.now()}-${Math.random()}`);
mkdirSync(testDir, { recursive: true });

originalEnv = { ...process.env };
Expand Down
6 changes: 3 additions & 3 deletions cli/src/__tests__/cmdlist-filter-resolution.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";
import type { Manifest } from "../manifest";
Expand DownExpand Up@@ -100,7 +100,7 @@ describe("cmdList filter resolution via display names", () => {
}

beforeEach(async () => {
testDir = join(tmpdir(), `spawn-filter-res-${Date.now()}-${Math.random()}`);
testDir = join(homedir(), `spawn-filter-res-${Date.now()}-${Math.random()}`);
mkdirSync(testDir, { recursive: true });

originalEnv = { ...process.env };
Expand DownExpand Up@@ -578,7 +578,7 @@ describe("showListFooter prompt escaping", () => {
}

beforeEach(async () => {
testDir = join(tmpdir(), `spawn-footer-esc-${Date.now()}-${Math.random()}`);
testDir = join(homedir(), `spawn-footer-esc-${Date.now()}-${Math.random()}`);
mkdirSync(testDir, { recursive: true });
originalEnv = { ...process.env };
process.env.SPAWN_HOME = testDir;
Expand Down
4 changes: 2 additions & 2 deletions cli/src/__tests__/cmdlist-integration.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import type { SpawnRecord } from "../history";

Expand DownExpand Up@@ -93,7 +93,7 @@ describe("cmdList integration", () => {


beforeEach(async () => {
testDir = join(tmpdir(), `spawn-cmdlist-test-${Date.now()}-${Math.random()}`);
testDir = join(homedir(), `spawn-cmdlist-test-${Date.now()}-${Math.random()}`);
mkdirSync(testDir, { recursive: true });

originalEnv = { ...process.env };
Expand Down
6 changes: 3 additions & 3 deletions cli/src/__tests__/cmdrun-happy-path.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";

Expand DownExpand Up@@ -164,7 +164,7 @@ describe("cmdRun happy-path pipeline", () => {
originalFetch = global.fetch;

// Set up isolated history directory
historyDir = join(tmpdir(), `spawn-test-history-${Date.now()}-${Math.random()}`);
historyDir = join(homedir(), `spawn-test-history-${Date.now()}-${Math.random()}`);
mkdirSync(historyDir, { recursive: true });
originalSpawnHome = process.env.SPAWN_HOME;
process.env.SPAWN_HOME = historyDir;
Expand DownExpand Up@@ -352,7 +352,7 @@ describe("cmdRun happy-path pipeline", () => {

it("should still execute script when history save fails", async () => {
// Make history dir read-only to force saveSpawnRecord failure
const readOnlyDir = join(tmpdir(), `spawn-test-readonly-${Date.now()}`);
const readOnlyDir = join(homedir(), `spawn-test-readonly-${Date.now()}`);
mkdirSync(readOnlyDir, { recursive: true });
// Create a file where the directory should be, so mkdir fails
writeFileSync(join(readOnlyDir, "history.json"), "not-a-directory");
Expand Down
4 changes: 2 additions & 2 deletions cli/src/__tests__/history-trimming.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync, readFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import {
loadHistory,
saveSpawnRecord,
Expand All@@ -27,7 +27,7 @@ describe("History Trimming and Boundaries", () => {
let originalEnv: NodeJS.ProcessEnv;

beforeEach(() => {
testDir = join(tmpdir(), `spawn-history-trim-${Date.now()}-${Math.random()}`);
testDir = join(homedir(), `spawn-history-trim-${Date.now()}-${Math.random()}`);
mkdirSync(testDir, { recursive: true });
originalEnv = { ...process.env };
process.env.SPAWN_HOME = testDir;
Expand Down
63 changes: 52 additions & 11 deletions cli/src/__tests__/history.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -16,7 +16,9 @@ describe("history", () => {
let originalEnv: NodeJS.ProcessEnv;

beforeEach(() => {
testDir = join(tmpdir(), `spawn-history-test-${Date.now()}-${Math.random()}`);
// Use a directory within home directory for testing (required by security validation)
const { homedir } = require("os");
testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
mkdirSync(testDir, { recursive: true });
originalEnv = { ...process.env };
process.env.SPAWN_HOME = testDir;
Expand All@@ -32,9 +34,11 @@ describe("history", () => {
// ── getSpawnDir ─────────────────────────────────────────────────────────

describe("getSpawnDir", () => {
it("returns SPAWN_HOME when set", () => {
process.env.SPAWN_HOME = "/custom/spawn/dir";
expect(getSpawnDir()).toBe("/custom/spawn/dir");
it("returns SPAWN_HOME when set to valid path within home", () => {
const { homedir } = require("os");
const validPath = join(homedir(), "custom", "spawn", "dir");
process.env.SPAWN_HOME = validPath;
expect(getSpawnDir()).toBe(validPath);
});

it("falls back to ~/.spawn when SPAWN_HOME is not set", () => {
Expand All@@ -53,14 +57,47 @@ describe("history", () => {
expect(() => getSpawnDir()).toThrow("must be an absolute path");
});

it("resolves .. segments in absolute SPAWN_HOME", () => {
process.env.SPAWN_HOME = "/tmp/foo/../bar";
expect(getSpawnDir()).toBe("/tmp/bar");
it("resolves .. segments in absolute SPAWN_HOME within home", () => {
const { homedir } = require("os");
const pathWithDots = join(homedir(), "foo", "..", "bar");
process.env.SPAWN_HOME = pathWithDots;
expect(getSpawnDir()).toBe(join(homedir(), "bar"));
});

it("accepts normal absolute SPAWN_HOME within home", () => {
const { homedir } = require("os");
const validPath = join(homedir(), ".spawn");
process.env.SPAWN_HOME = validPath;
expect(getSpawnDir()).toBe(validPath);
});

it("accepts normal absolute SPAWN_HOME", () => {
process.env.SPAWN_HOME = "/home/user/.spawn";
expect(getSpawnDir()).toBe("/home/user/.spawn");
it("throws for SPAWN_HOME outside home directory", () => {
process.env.SPAWN_HOME = "/tmp/spawn";
expect(() => getSpawnDir()).toThrow("must be within your home directory");
});

it("throws for SPAWN_HOME pointing to /root when user home is different", () => {
const { homedir } = require("os");
// Only run this test if we're not actually running as root
if (homedir() !== "/root") {
process.env.SPAWN_HOME = "/root/.spawn";
expect(() => getSpawnDir()).toThrow("must be within your home directory");
}
});

it("throws for path traversal attempt to escape home directory", () => {
const { homedir } = require("os");
// Attempt to traverse outside home using .. segments
// e.g., /home/user/../../etc/.spawn
const traversalPath = join(homedir(), "..", "..", "etc", ".spawn");
process.env.SPAWN_HOME = traversalPath;
expect(() => getSpawnDir()).toThrow("must be within your home directory");
});

it("accepts home directory itself as SPAWN_HOME", () => {
const { homedir } = require("os");
process.env.SPAWN_HOME = homedir();
expect(getSpawnDir()).toBe(homedir());
});
});

Expand DownExpand Up@@ -142,7 +179,8 @@ describe("history", () => {

describe("saveSpawnRecord", () => {
it("creates directory and file when neither exist", () => {
const nestedDir = join(testDir, "nested", "spawn");
const { homedir } = require("os");
const nestedDir = join(homedir(), ".spawn-test", "nested", "spawn");
process.env.SPAWN_HOME = nestedDir;

saveSpawnRecord({ agent: "claude", cloud: "sprite", timestamp: "2026-01-01T00:00:00.000Z" });
Expand All@@ -151,6 +189,9 @@ describe("history", () => {
const data = JSON.parse(readFileSync(join(nestedDir, "history.json"), "utf-8"));
expect(data).toHaveLength(1);
expect(data[0].agent).toBe("claude");

// Clean up
rmSync(join(homedir(), ".spawn-test"), { recursive: true, force: true });
});

it("appends to existing history", () => {
Expand Down
4 changes: 2 additions & 2 deletions cli/src/__tests__/list-display.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
* Tests for the `spawn list` display logic in commands.ts and index.ts.
Expand DownExpand Up@@ -304,7 +304,7 @@ describe("cmdList output", () => {
let originalEnv: NodeJS.ProcessEnv;

beforeEach(() => {
testDir = join(tmpdir(), `spawn-list-test-${Date.now()}-${Math.random()}`);
testDir = join(homedir(), `spawn-list-test-${Date.now()}-${Math.random()}`);
mkdirSync(testDir, { recursive: true });
originalEnv = { ...process.env };
process.env.SPAWN_HOME = testDir;
Expand Down
4 changes: 2 additions & 2 deletions cli/src/__tests__/list-filter-suggestions.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest, type Manifest } from "../manifest";

Expand DownExpand Up@@ -212,7 +212,7 @@ describe("cmdList - filter suggestions", () => {
}

beforeEach(async () => {
testDir = join(tmpdir(), `spawn-filter-test-${Date.now()}-${Math.random()}`);
testDir = join(homedir(), `spawn-filter-test-${Date.now()}-${Math.random()}`);
mkdirSync(testDir, { recursive: true });
consoleMocks = createConsoleMocks();
mockLogError.mockClear();
Expand Down
4 changes: 2 additions & 2 deletions cli/src/__tests__/list-prompt-display.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync, existsSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
* Tests for prompt-related display logic in cmdList and the
Expand DownExpand Up@@ -282,7 +282,7 @@ describe("cmdList prompt display", () => {
let originalEnv: NodeJS.ProcessEnv;

beforeEach(() => {
testDir = join(tmpdir(), `spawn-prompt-display-${Date.now()}-${Math.random()}`);
testDir = join(homedir(), `spawn-prompt-display-${Date.now()}-${Math.random()}`);
mkdirSync(testDir, { recursive: true });
originalEnv = { ...process.env };
process.env.SPAWN_HOME = testDir;
Expand Down
4 changes: 2 additions & 2 deletions cli/src/__tests__/list-table-rendering.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync, existsSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";
import type { Manifest } from "../manifest";
Expand DownExpand Up@@ -113,7 +113,7 @@ describe("cmdList table rendering", () => {
originalEnv = { ...process.env };

// Set up temp history dir
testDir = join(tmpdir(), `spawn-list-table-test-${Date.now()}-${Math.random()}`);
testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
mkdirSync(testDir, { recursive: true });
process.env.SPAWN_HOME = testDir;
});
Expand Down
4 changes: 2 additions & 2 deletions cli/src/__tests__/resolve-list-filters.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest, _resetCacheForTesting } from "../manifest";
import type { SpawnRecord } from "../history";
Expand DownExpand Up@@ -459,7 +459,7 @@ describe("cmdList integration with filter resolution", () => {
let processExitSpy: ReturnType<typeof spyOn>;

beforeEach(async () => {
testDir = join(tmpdir(), `spawn-resolve-list-${Date.now()}-${Math.random()}`);
testDir = join(homedir(), `spawn-resolve-list-${Date.now()}-${Math.random()}`);
mkdirSync(testDir, { recursive: true });
cacheDir = join(testDir, "cache");
mkdirSync(cacheDir, { recursive: true });
Expand Down
Loading
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
security: fix path traversal risk in SPAWN_HOME validation#1402

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

louisgv
merged 2 commits into

from

Feb 17, 2026
 Merged


security: fix path traversal risk in SPAWN_HOME validation
#1402
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
a41ea1f

security: fix path traversal risk in SPAWN_HOME validation


louisgv Feb 17, 2026
cafbc3f

fix: add missing join import and update tests for SPAWN_HOME security…


louisgv Feb 17, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 3 additions & 3 deletions
cli/src/__tests__/clear-history.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import {
 clearHistory,
 loadHistory,
Expand All@@ -27,7 +27,7 @@ describe("clearHistory", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-clear-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand DownExpand Up@@ -253,7 +253,7 @@ describe("cmdListClear", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-cmdclear-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

14 changes: 8 additions & 6 deletions
cli/src/__tests__/cli-core-edge-cases.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, spyOn, mock } from "bun:test";
import { existsSync, writeFileSync, mkdirSync, rmSync, readFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
 * Tests for edge cases across core CLI modules (manifest.ts, security.ts,
Expand DownExpand Up@@ -697,7 +697,7 @@ describe("history.ts additional edge cases", () => {
 let originalSpawnHome: string | undefined;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-test-history-${Date.now()}-${Math.random().toString(36).slice(2)}`);
 testDir = join(homedir(), `spawn-test-history-${Date.now()}-${Math.random().toString(36).slice(2)}`);
 mkdirSync(testDir, { recursive: true });
 originalSpawnHome = process.env.SPAWN_HOME;
 process.env.SPAWN_HOME = testDir;
Expand All@@ -716,15 +716,17 @@ describe("history.ts additional edge cases", () => {

 describe("getSpawnDir edge cases", () => {
 it("should resolve absolute SPAWN_HOME with trailing slash", () => {
 process.env.SPAWN_HOME = "/tmp/test-spawn/";
 const { homedir } = require("os");
 process.env.SPAWN_HOME = join(homedir(), "test-spawn") + "/";
 const dir = getSpawnDir();
 expect(dir).toBe("/tmp/test-spawn");
 expect(dir).toBe(join(homedir(), "test-spawn"));
 });

 it("should resolve SPAWN_HOME with .. segments", () => {
 process.env.SPAWN_HOME = "/tmp/a/../b";
 const { homedir } = require("os");
 process.env.SPAWN_HOME = join(homedir(), "a", "..", "b");
 const dir = getSpawnDir();
 expect(dir).toBe("/tmp/b");
 expect(dir).toBe(join(homedir(), "b"));
 });

 it("should throw for relative path ./data", () => {
Expand Down

11 changes: 7 additions & 4 deletions
cli/src/__tests__/cli-version-and-dispatch.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
import { describe, it, expect, beforeEach, afterEach, spyOn } from "bun:test";
import { resolve } from "path";
import { resolve, join } from "path";

/**
 * Tests for CLI version output and dispatch routing via subprocess execution.
Expand DownExpand Up@@ -493,19 +493,22 @@ describe("subcommand alias routing", () => {

describe("list command aliases", () => {
 it("'list' should not crash with empty history", () => {
 const { exitCode } = runCLI(["list"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
 const { homedir } = require("os");
 const { exitCode } = runCLI(["list"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
 // May exit 0 (shows "no spawns") or run interactive picker in non-TTY
 // The important thing is it doesn't crash
 expect(exitCode).toBeDefined();
 });

 it("'ls' should work as alias for 'list'", () => {
 const { exitCode } = runCLI(["ls"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
 const { homedir } = require("os");
 const { exitCode } = runCLI(["ls"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
 expect(exitCode).toBeDefined();
 });

 it("'history' should work as alias for 'list'", () => {
 const { exitCode } = runCLI(["history"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
 const { homedir } = require("os");
 const { exitCode } = runCLI(["history"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
 expect(exitCode).toBeDefined();
 });

Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/cmdlast.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import type { SpawnRecord } from "../history";

Expand DownExpand Up@@ -79,7 +79,7 @@ describe("cmdLast", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-cmdlast-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-cmdlast-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });

 originalEnv = { ...process.env };
Expand Down

6 changes: 3 additions & 3 deletions
cli/src/__tests__/cmdlist-filter-resolution.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";
import type { Manifest } from "../manifest";
Expand DownExpand Up@@ -100,7 +100,7 @@ describe("cmdList filter resolution via display names", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-filter-res-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-filter-res-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });

 originalEnv = { ...process.env };
Expand DownExpand Up@@ -578,7 +578,7 @@ describe("showListFooter prompt escaping", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-footer-esc-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-footer-esc-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/cmdlist-integration.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import type { SpawnRecord } from "../history";

Expand DownExpand Up@@ -93,7 +93,7 @@ describe("cmdList integration", () => {


 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-cmdlist-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-cmdlist-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });

 originalEnv = { ...process.env };
Expand Down

6 changes: 3 additions & 3 deletions
cli/src/__tests__/cmdrun-happy-path.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";

Expand DownExpand Up@@ -164,7 +164,7 @@ describe("cmdRun happy-path pipeline", () => {
 originalFetch = global.fetch;

 // Set up isolated history directory
 historyDir = join(tmpdir(), `spawn-test-history-${Date.now()}-${Math.random()}`);
 historyDir = join(homedir(), `spawn-test-history-${Date.now()}-${Math.random()}`);
 mkdirSync(historyDir, { recursive: true });
 originalSpawnHome = process.env.SPAWN_HOME;
 process.env.SPAWN_HOME = historyDir;
Expand DownExpand Up@@ -352,7 +352,7 @@ describe("cmdRun happy-path pipeline", () => {

 it("should still execute script when history save fails", async () => {
 // Make history dir read-only to force saveSpawnRecord failure
 const readOnlyDir = join(tmpdir(), `spawn-test-readonly-${Date.now()}`);
 const readOnlyDir = join(homedir(), `spawn-test-readonly-${Date.now()}`);
 mkdirSync(readOnlyDir, { recursive: true });
 // Create a file where the directory should be, so mkdir fails
 writeFileSync(join(readOnlyDir, "history.json"), "not-a-directory");
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/history-trimming.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync, readFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import {
 loadHistory,
 saveSpawnRecord,
Expand All@@ -27,7 +27,7 @@ describe("History Trimming and Boundaries", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-history-trim-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-history-trim-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

63 changes: 52 additions & 11 deletions
cli/src/__tests__/history.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -16,7 +16,9 @@ describe("history", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-history-test-${Date.now()}-${Math.random()}`);
 // Use a directory within home directory for testing (required by security validation)
 const { homedir } = require("os");
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand All@@ -32,9 +34,11 @@ describe("history", () => {
 // ── getSpawnDir ─────────────────────────────────────────────────────────

 describe("getSpawnDir", () => {
 it("returns SPAWN_HOME when set", () => {
 process.env.SPAWN_HOME = "/custom/spawn/dir";
 expect(getSpawnDir()).toBe("/custom/spawn/dir");
 it("returns SPAWN_HOME when set to valid path within home", () => {
 const { homedir } = require("os");
 const validPath = join(homedir(), "custom", "spawn", "dir");
 process.env.SPAWN_HOME = validPath;
 expect(getSpawnDir()).toBe(validPath);
 });

 it("falls back to ~/.spawn when SPAWN_HOME is not set", () => {
Expand All@@ -53,14 +57,47 @@ describe("history", () => {
 expect(() => getSpawnDir()).toThrow("must be an absolute path");
 });

 it("resolves .. segments in absolute SPAWN_HOME", () => {
 process.env.SPAWN_HOME = "/tmp/foo/../bar";
 expect(getSpawnDir()).toBe("/tmp/bar");
 it("resolves .. segments in absolute SPAWN_HOME within home", () => {
 const { homedir } = require("os");
 const pathWithDots = join(homedir(), "foo", "..", "bar");
 process.env.SPAWN_HOME = pathWithDots;
 expect(getSpawnDir()).toBe(join(homedir(), "bar"));
 });

 it("accepts normal absolute SPAWN_HOME within home", () => {
 const { homedir } = require("os");
 const validPath = join(homedir(), ".spawn");
 process.env.SPAWN_HOME = validPath;
 expect(getSpawnDir()).toBe(validPath);
 });

 it("accepts normal absolute SPAWN_HOME", () => {
 process.env.SPAWN_HOME = "/home/user/.spawn";
 expect(getSpawnDir()).toBe("/home/user/.spawn");
 it("throws for SPAWN_HOME outside home directory", () => {
 process.env.SPAWN_HOME = "/tmp/spawn";
 expect(() => getSpawnDir()).toThrow("must be within your home directory");
 });

 it("throws for SPAWN_HOME pointing to /root when user home is different", () => {
 const { homedir } = require("os");
 // Only run this test if we're not actually running as root
 if (homedir() !== "/root") {
 process.env.SPAWN_HOME = "/root/.spawn";
 expect(() => getSpawnDir()).toThrow("must be within your home directory");
 }
 });

 it("throws for path traversal attempt to escape home directory", () => {
 const { homedir } = require("os");
 // Attempt to traverse outside home using .. segments
 // e.g., /home/user/../../etc/.spawn
 const traversalPath = join(homedir(), "..", "..", "etc", ".spawn");
 process.env.SPAWN_HOME = traversalPath;
 expect(() => getSpawnDir()).toThrow("must be within your home directory");
 });

 it("accepts home directory itself as SPAWN_HOME", () => {
 const { homedir } = require("os");
 process.env.SPAWN_HOME = homedir();
 expect(getSpawnDir()).toBe(homedir());
 });
 });

Expand DownExpand Up@@ -142,7 +179,8 @@ describe("history", () => {

 describe("saveSpawnRecord", () => {
 it("creates directory and file when neither exist", () => {
 const nestedDir = join(testDir, "nested", "spawn");
 const { homedir } = require("os");
 const nestedDir = join(homedir(), ".spawn-test", "nested", "spawn");
 process.env.SPAWN_HOME = nestedDir;

 saveSpawnRecord({ agent: "claude", cloud: "sprite", timestamp: "2026-01-01T00:00:00.000Z" });
Expand All@@ -151,6 +189,9 @@ describe("history", () => {
 const data = JSON.parse(readFileSync(join(nestedDir, "history.json"), "utf-8"));
 expect(data).toHaveLength(1);
 expect(data[0].agent).toBe("claude");

 // Clean up
 rmSync(join(homedir(), ".spawn-test"), { recursive: true, force: true });
 });

 it("appends to existing history", () => {
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-display.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
 * Tests for the `spawn list` display logic in commands.ts and index.ts.
Expand DownExpand Up@@ -304,7 +304,7 @@ describe("cmdList output", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-list-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-list-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-filter-suggestions.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest, type Manifest } from "../manifest";

Expand DownExpand Up@@ -212,7 +212,7 @@ describe("cmdList - filter suggestions", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-filter-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-filter-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 consoleMocks = createConsoleMocks();
 mockLogError.mockClear();
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-prompt-display.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync, existsSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
 * Tests for prompt-related display logic in cmdList and the
Expand DownExpand Up@@ -282,7 +282,7 @@ describe("cmdList prompt display", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-prompt-display-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-prompt-display-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-table-rendering.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync, existsSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";
import type { Manifest } from "../manifest";
Expand DownExpand Up@@ -113,7 +113,7 @@ describe("cmdList table rendering", () => {
 originalEnv = { ...process.env };

 // Set up temp history dir
 testDir = join(tmpdir(), `spawn-list-table-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 process.env.SPAWN_HOME = testDir;
 });
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/resolve-list-filters.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest, _resetCacheForTesting } from "../manifest";
import type { SpawnRecord } from "../history";
Expand DownExpand Up@@ -459,7 +459,7 @@ describe("cmdList integration with filter resolution", () => {
 let processExitSpy: ReturnType<typeof spyOn>;

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-resolve-list-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-resolve-list-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 cacheDir = join(testDir, "cache");
 mkdirSync(cacheDir, { recursive: true });
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
security: fix path traversal risk in SPAWN_HOME validation#1402

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

louisgv
merged 2 commits into

from

Feb 17, 2026
 Merged


security: fix path traversal risk in SPAWN_HOME validation
#1402
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
a41ea1f

security: fix path traversal risk in SPAWN_HOME validation


louisgv Feb 17, 2026
cafbc3f

fix: add missing join import and update tests for SPAWN_HOME security…


louisgv Feb 17, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 3 additions & 3 deletions
cli/src/__tests__/clear-history.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import {
 clearHistory,
 loadHistory,
Expand All@@ -27,7 +27,7 @@ describe("clearHistory", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-clear-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand DownExpand Up@@ -253,7 +253,7 @@ describe("cmdListClear", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-cmdclear-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

14 changes: 8 additions & 6 deletions
cli/src/__tests__/cli-core-edge-cases.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, spyOn, mock } from "bun:test";
import { existsSync, writeFileSync, mkdirSync, rmSync, readFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
 * Tests for edge cases across core CLI modules (manifest.ts, security.ts,
Expand DownExpand Up@@ -697,7 +697,7 @@ describe("history.ts additional edge cases", () => {
 let originalSpawnHome: string | undefined;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-test-history-${Date.now()}-${Math.random().toString(36).slice(2)}`);
 testDir = join(homedir(), `spawn-test-history-${Date.now()}-${Math.random().toString(36).slice(2)}`);
 mkdirSync(testDir, { recursive: true });
 originalSpawnHome = process.env.SPAWN_HOME;
 process.env.SPAWN_HOME = testDir;
Expand All@@ -716,15 +716,17 @@ describe("history.ts additional edge cases", () => {

 describe("getSpawnDir edge cases", () => {
 it("should resolve absolute SPAWN_HOME with trailing slash", () => {
 process.env.SPAWN_HOME = "/tmp/test-spawn/";
 const { homedir } = require("os");
 process.env.SPAWN_HOME = join(homedir(), "test-spawn") + "/";
 const dir = getSpawnDir();
 expect(dir).toBe("/tmp/test-spawn");
 expect(dir).toBe(join(homedir(), "test-spawn"));
 });

 it("should resolve SPAWN_HOME with .. segments", () => {
 process.env.SPAWN_HOME = "/tmp/a/../b";
 const { homedir } = require("os");
 process.env.SPAWN_HOME = join(homedir(), "a", "..", "b");
 const dir = getSpawnDir();
 expect(dir).toBe("/tmp/b");
 expect(dir).toBe(join(homedir(), "b"));
 });

 it("should throw for relative path ./data", () => {
Expand Down

11 changes: 7 additions & 4 deletions
cli/src/__tests__/cli-version-and-dispatch.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
import { describe, it, expect, beforeEach, afterEach, spyOn } from "bun:test";
import { resolve } from "path";
import { resolve, join } from "path";

/**
 * Tests for CLI version output and dispatch routing via subprocess execution.
Expand DownExpand Up@@ -493,19 +493,22 @@ describe("subcommand alias routing", () => {

describe("list command aliases", () => {
 it("'list' should not crash with empty history", () => {
 const { exitCode } = runCLI(["list"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
 const { homedir } = require("os");
 const { exitCode } = runCLI(["list"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
 // May exit 0 (shows "no spawns") or run interactive picker in non-TTY
 // The important thing is it doesn't crash
 expect(exitCode).toBeDefined();
 });

 it("'ls' should work as alias for 'list'", () => {
 const { exitCode } = runCLI(["ls"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
 const { homedir } = require("os");
 const { exitCode } = runCLI(["ls"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
 expect(exitCode).toBeDefined();
 });

 it("'history' should work as alias for 'list'", () => {
 const { exitCode } = runCLI(["history"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
 const { homedir } = require("os");
 const { exitCode } = runCLI(["history"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
 expect(exitCode).toBeDefined();
 });

Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/cmdlast.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import type { SpawnRecord } from "../history";

Expand DownExpand Up@@ -79,7 +79,7 @@ describe("cmdLast", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-cmdlast-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-cmdlast-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });

 originalEnv = { ...process.env };
Expand Down

6 changes: 3 additions & 3 deletions
cli/src/__tests__/cmdlist-filter-resolution.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";
import type { Manifest } from "../manifest";
Expand DownExpand Up@@ -100,7 +100,7 @@ describe("cmdList filter resolution via display names", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-filter-res-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-filter-res-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });

 originalEnv = { ...process.env };
Expand DownExpand Up@@ -578,7 +578,7 @@ describe("showListFooter prompt escaping", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-footer-esc-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-footer-esc-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/cmdlist-integration.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import type { SpawnRecord } from "../history";

Expand DownExpand Up@@ -93,7 +93,7 @@ describe("cmdList integration", () => {


 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-cmdlist-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-cmdlist-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });

 originalEnv = { ...process.env };
Expand Down

6 changes: 3 additions & 3 deletions
cli/src/__tests__/cmdrun-happy-path.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";

Expand DownExpand Up@@ -164,7 +164,7 @@ describe("cmdRun happy-path pipeline", () => {
 originalFetch = global.fetch;

 // Set up isolated history directory
 historyDir = join(tmpdir(), `spawn-test-history-${Date.now()}-${Math.random()}`);
 historyDir = join(homedir(), `spawn-test-history-${Date.now()}-${Math.random()}`);
 mkdirSync(historyDir, { recursive: true });
 originalSpawnHome = process.env.SPAWN_HOME;
 process.env.SPAWN_HOME = historyDir;
Expand DownExpand Up@@ -352,7 +352,7 @@ describe("cmdRun happy-path pipeline", () => {

 it("should still execute script when history save fails", async () => {
 // Make history dir read-only to force saveSpawnRecord failure
 const readOnlyDir = join(tmpdir(), `spawn-test-readonly-${Date.now()}`);
 const readOnlyDir = join(homedir(), `spawn-test-readonly-${Date.now()}`);
 mkdirSync(readOnlyDir, { recursive: true });
 // Create a file where the directory should be, so mkdir fails
 writeFileSync(join(readOnlyDir, "history.json"), "not-a-directory");
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/history-trimming.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync, readFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import {
 loadHistory,
 saveSpawnRecord,
Expand All@@ -27,7 +27,7 @@ describe("History Trimming and Boundaries", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-history-trim-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-history-trim-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

63 changes: 52 additions & 11 deletions
cli/src/__tests__/history.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -16,7 +16,9 @@ describe("history", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-history-test-${Date.now()}-${Math.random()}`);
 // Use a directory within home directory for testing (required by security validation)
 const { homedir } = require("os");
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand All@@ -32,9 +34,11 @@ describe("history", () => {
 // ── getSpawnDir ─────────────────────────────────────────────────────────

 describe("getSpawnDir", () => {
 it("returns SPAWN_HOME when set", () => {
 process.env.SPAWN_HOME = "/custom/spawn/dir";
 expect(getSpawnDir()).toBe("/custom/spawn/dir");
 it("returns SPAWN_HOME when set to valid path within home", () => {
 const { homedir } = require("os");
 const validPath = join(homedir(), "custom", "spawn", "dir");
 process.env.SPAWN_HOME = validPath;
 expect(getSpawnDir()).toBe(validPath);
 });

 it("falls back to ~/.spawn when SPAWN_HOME is not set", () => {
Expand All@@ -53,14 +57,47 @@ describe("history", () => {
 expect(() => getSpawnDir()).toThrow("must be an absolute path");
 });

 it("resolves .. segments in absolute SPAWN_HOME", () => {
 process.env.SPAWN_HOME = "/tmp/foo/../bar";
 expect(getSpawnDir()).toBe("/tmp/bar");
 it("resolves .. segments in absolute SPAWN_HOME within home", () => {
 const { homedir } = require("os");
 const pathWithDots = join(homedir(), "foo", "..", "bar");
 process.env.SPAWN_HOME = pathWithDots;
 expect(getSpawnDir()).toBe(join(homedir(), "bar"));
 });

 it("accepts normal absolute SPAWN_HOME within home", () => {
 const { homedir } = require("os");
 const validPath = join(homedir(), ".spawn");
 process.env.SPAWN_HOME = validPath;
 expect(getSpawnDir()).toBe(validPath);
 });

 it("accepts normal absolute SPAWN_HOME", () => {
 process.env.SPAWN_HOME = "/home/user/.spawn";
 expect(getSpawnDir()).toBe("/home/user/.spawn");
 it("throws for SPAWN_HOME outside home directory", () => {
 process.env.SPAWN_HOME = "/tmp/spawn";
 expect(() => getSpawnDir()).toThrow("must be within your home directory");
 });

 it("throws for SPAWN_HOME pointing to /root when user home is different", () => {
 const { homedir } = require("os");
 // Only run this test if we're not actually running as root
 if (homedir() !== "/root") {
 process.env.SPAWN_HOME = "/root/.spawn";
 expect(() => getSpawnDir()).toThrow("must be within your home directory");
 }
 });

 it("throws for path traversal attempt to escape home directory", () => {
 const { homedir } = require("os");
 // Attempt to traverse outside home using .. segments
 // e.g., /home/user/../../etc/.spawn
 const traversalPath = join(homedir(), "..", "..", "etc", ".spawn");
 process.env.SPAWN_HOME = traversalPath;
 expect(() => getSpawnDir()).toThrow("must be within your home directory");
 });

 it("accepts home directory itself as SPAWN_HOME", () => {
 const { homedir } = require("os");
 process.env.SPAWN_HOME = homedir();
 expect(getSpawnDir()).toBe(homedir());
 });
 });

Expand DownExpand Up@@ -142,7 +179,8 @@ describe("history", () => {

 describe("saveSpawnRecord", () => {
 it("creates directory and file when neither exist", () => {
 const nestedDir = join(testDir, "nested", "spawn");
 const { homedir } = require("os");
 const nestedDir = join(homedir(), ".spawn-test", "nested", "spawn");
 process.env.SPAWN_HOME = nestedDir;

 saveSpawnRecord({ agent: "claude", cloud: "sprite", timestamp: "2026-01-01T00:00:00.000Z" });
Expand All@@ -151,6 +189,9 @@ describe("history", () => {
 const data = JSON.parse(readFileSync(join(nestedDir, "history.json"), "utf-8"));
 expect(data).toHaveLength(1);
 expect(data[0].agent).toBe("claude");

 // Clean up
 rmSync(join(homedir(), ".spawn-test"), { recursive: true, force: true });
 });

 it("appends to existing history", () => {
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-display.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
 * Tests for the `spawn list` display logic in commands.ts and index.ts.
Expand DownExpand Up@@ -304,7 +304,7 @@ describe("cmdList output", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-list-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-list-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-filter-suggestions.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest, type Manifest } from "../manifest";

Expand DownExpand Up@@ -212,7 +212,7 @@ describe("cmdList - filter suggestions", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-filter-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-filter-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 consoleMocks = createConsoleMocks();
 mockLogError.mockClear();
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-prompt-display.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync, existsSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
 * Tests for prompt-related display logic in cmdList and the
Expand DownExpand Up@@ -282,7 +282,7 @@ describe("cmdList prompt display", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-prompt-display-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-prompt-display-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-table-rendering.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync, existsSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";
import type { Manifest } from "../manifest";
Expand DownExpand Up@@ -113,7 +113,7 @@ describe("cmdList table rendering", () => {
 originalEnv = { ...process.env };

 // Set up temp history dir
 testDir = join(tmpdir(), `spawn-list-table-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 process.env.SPAWN_HOME = testDir;
 });
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/resolve-list-filters.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest, _resetCacheForTesting } from "../manifest";
import type { SpawnRecord } from "../history";
Expand DownExpand Up@@ -459,7 +459,7 @@ describe("cmdList integration with filter resolution", () => {
 let processExitSpy: ReturnType<typeof spyOn>;

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-resolve-list-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-resolve-list-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 cacheDir = join(testDir, "cache");
 mkdirSync(cacheDir, { recursive: true });
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
security: fix path traversal risk in SPAWN_HOME validation#1402

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

louisgv
merged 2 commits into

from

Feb 17, 2026
 Merged


security: fix path traversal risk in SPAWN_HOME validation
#1402
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
a41ea1f

security: fix path traversal risk in SPAWN_HOME validation


louisgv Feb 17, 2026
cafbc3f

fix: add missing join import and update tests for SPAWN_HOME security…


louisgv Feb 17, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 3 additions & 3 deletions
cli/src/__tests__/clear-history.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import {
 clearHistory,
 loadHistory,
Expand All@@ -27,7 +27,7 @@ describe("clearHistory", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-clear-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand DownExpand Up@@ -253,7 +253,7 @@ describe("cmdListClear", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-cmdclear-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

14 changes: 8 additions & 6 deletions
cli/src/__tests__/cli-core-edge-cases.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, spyOn, mock } from "bun:test";
import { existsSync, writeFileSync, mkdirSync, rmSync, readFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
 * Tests for edge cases across core CLI modules (manifest.ts, security.ts,
Expand DownExpand Up@@ -697,7 +697,7 @@ describe("history.ts additional edge cases", () => {
 let originalSpawnHome: string | undefined;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-test-history-${Date.now()}-${Math.random().toString(36).slice(2)}`);
 testDir = join(homedir(), `spawn-test-history-${Date.now()}-${Math.random().toString(36).slice(2)}`);
 mkdirSync(testDir, { recursive: true });
 originalSpawnHome = process.env.SPAWN_HOME;
 process.env.SPAWN_HOME = testDir;
Expand All@@ -716,15 +716,17 @@ describe("history.ts additional edge cases", () => {

 describe("getSpawnDir edge cases", () => {
 it("should resolve absolute SPAWN_HOME with trailing slash", () => {
 process.env.SPAWN_HOME = "/tmp/test-spawn/";
 const { homedir } = require("os");
 process.env.SPAWN_HOME = join(homedir(), "test-spawn") + "/";
 const dir = getSpawnDir();
 expect(dir).toBe("/tmp/test-spawn");
 expect(dir).toBe(join(homedir(), "test-spawn"));
 });

 it("should resolve SPAWN_HOME with .. segments", () => {
 process.env.SPAWN_HOME = "/tmp/a/../b";
 const { homedir } = require("os");
 process.env.SPAWN_HOME = join(homedir(), "a", "..", "b");
 const dir = getSpawnDir();
 expect(dir).toBe("/tmp/b");
 expect(dir).toBe(join(homedir(), "b"));
 });

 it("should throw for relative path ./data", () => {
Expand Down

11 changes: 7 additions & 4 deletions
cli/src/__tests__/cli-version-and-dispatch.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
import { describe, it, expect, beforeEach, afterEach, spyOn } from "bun:test";
import { resolve } from "path";
import { resolve, join } from "path";

/**
 * Tests for CLI version output and dispatch routing via subprocess execution.
Expand DownExpand Up@@ -493,19 +493,22 @@ describe("subcommand alias routing", () => {

describe("list command aliases", () => {
 it("'list' should not crash with empty history", () => {
 const { exitCode } = runCLI(["list"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
 const { homedir } = require("os");
 const { exitCode } = runCLI(["list"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
 // May exit 0 (shows "no spawns") or run interactive picker in non-TTY
 // The important thing is it doesn't crash
 expect(exitCode).toBeDefined();
 });

 it("'ls' should work as alias for 'list'", () => {
 const { exitCode } = runCLI(["ls"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
 const { homedir } = require("os");
 const { exitCode } = runCLI(["ls"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
 expect(exitCode).toBeDefined();
 });

 it("'history' should work as alias for 'list'", () => {
 const { exitCode } = runCLI(["history"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
 const { homedir } = require("os");
 const { exitCode } = runCLI(["history"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
 expect(exitCode).toBeDefined();
 });

Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/cmdlast.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import type { SpawnRecord } from "../history";

Expand DownExpand Up@@ -79,7 +79,7 @@ describe("cmdLast", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-cmdlast-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-cmdlast-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });

 originalEnv = { ...process.env };
Expand Down

6 changes: 3 additions & 3 deletions
cli/src/__tests__/cmdlist-filter-resolution.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";
import type { Manifest } from "../manifest";
Expand DownExpand Up@@ -100,7 +100,7 @@ describe("cmdList filter resolution via display names", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-filter-res-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-filter-res-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });

 originalEnv = { ...process.env };
Expand DownExpand Up@@ -578,7 +578,7 @@ describe("showListFooter prompt escaping", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-footer-esc-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-footer-esc-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/cmdlist-integration.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import type { SpawnRecord } from "../history";

Expand DownExpand Up@@ -93,7 +93,7 @@ describe("cmdList integration", () => {


 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-cmdlist-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-cmdlist-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });

 originalEnv = { ...process.env };
Expand Down

6 changes: 3 additions & 3 deletions
cli/src/__tests__/cmdrun-happy-path.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";

Expand DownExpand Up@@ -164,7 +164,7 @@ describe("cmdRun happy-path pipeline", () => {
 originalFetch = global.fetch;

 // Set up isolated history directory
 historyDir = join(tmpdir(), `spawn-test-history-${Date.now()}-${Math.random()}`);
 historyDir = join(homedir(), `spawn-test-history-${Date.now()}-${Math.random()}`);
 mkdirSync(historyDir, { recursive: true });
 originalSpawnHome = process.env.SPAWN_HOME;
 process.env.SPAWN_HOME = historyDir;
Expand DownExpand Up@@ -352,7 +352,7 @@ describe("cmdRun happy-path pipeline", () => {

 it("should still execute script when history save fails", async () => {
 // Make history dir read-only to force saveSpawnRecord failure
 const readOnlyDir = join(tmpdir(), `spawn-test-readonly-${Date.now()}`);
 const readOnlyDir = join(homedir(), `spawn-test-readonly-${Date.now()}`);
 mkdirSync(readOnlyDir, { recursive: true });
 // Create a file where the directory should be, so mkdir fails
 writeFileSync(join(readOnlyDir, "history.json"), "not-a-directory");
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/history-trimming.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync, readFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import {
 loadHistory,
 saveSpawnRecord,
Expand All@@ -27,7 +27,7 @@ describe("History Trimming and Boundaries", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-history-trim-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-history-trim-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

63 changes: 52 additions & 11 deletions
cli/src/__tests__/history.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -16,7 +16,9 @@ describe("history", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-history-test-${Date.now()}-${Math.random()}`);
 // Use a directory within home directory for testing (required by security validation)
 const { homedir } = require("os");
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand All@@ -32,9 +34,11 @@ describe("history", () => {
 // ── getSpawnDir ─────────────────────────────────────────────────────────

 describe("getSpawnDir", () => {
 it("returns SPAWN_HOME when set", () => {
 process.env.SPAWN_HOME = "/custom/spawn/dir";
 expect(getSpawnDir()).toBe("/custom/spawn/dir");
 it("returns SPAWN_HOME when set to valid path within home", () => {
 const { homedir } = require("os");
 const validPath = join(homedir(), "custom", "spawn", "dir");
 process.env.SPAWN_HOME = validPath;
 expect(getSpawnDir()).toBe(validPath);
 });

 it("falls back to ~/.spawn when SPAWN_HOME is not set", () => {
Expand All@@ -53,14 +57,47 @@ describe("history", () => {
 expect(() => getSpawnDir()).toThrow("must be an absolute path");
 });

 it("resolves .. segments in absolute SPAWN_HOME", () => {
 process.env.SPAWN_HOME = "/tmp/foo/../bar";
 expect(getSpawnDir()).toBe("/tmp/bar");
 it("resolves .. segments in absolute SPAWN_HOME within home", () => {
 const { homedir } = require("os");
 const pathWithDots = join(homedir(), "foo", "..", "bar");
 process.env.SPAWN_HOME = pathWithDots;
 expect(getSpawnDir()).toBe(join(homedir(), "bar"));
 });

 it("accepts normal absolute SPAWN_HOME within home", () => {
 const { homedir } = require("os");
 const validPath = join(homedir(), ".spawn");
 process.env.SPAWN_HOME = validPath;
 expect(getSpawnDir()).toBe(validPath);
 });

 it("accepts normal absolute SPAWN_HOME", () => {
 process.env.SPAWN_HOME = "/home/user/.spawn";
 expect(getSpawnDir()).toBe("/home/user/.spawn");
 it("throws for SPAWN_HOME outside home directory", () => {
 process.env.SPAWN_HOME = "/tmp/spawn";
 expect(() => getSpawnDir()).toThrow("must be within your home directory");
 });

 it("throws for SPAWN_HOME pointing to /root when user home is different", () => {
 const { homedir } = require("os");
 // Only run this test if we're not actually running as root
 if (homedir() !== "/root") {
 process.env.SPAWN_HOME = "/root/.spawn";
 expect(() => getSpawnDir()).toThrow("must be within your home directory");
 }
 });

 it("throws for path traversal attempt to escape home directory", () => {
 const { homedir } = require("os");
 // Attempt to traverse outside home using .. segments
 // e.g., /home/user/../../etc/.spawn
 const traversalPath = join(homedir(), "..", "..", "etc", ".spawn");
 process.env.SPAWN_HOME = traversalPath;
 expect(() => getSpawnDir()).toThrow("must be within your home directory");
 });

 it("accepts home directory itself as SPAWN_HOME", () => {
 const { homedir } = require("os");
 process.env.SPAWN_HOME = homedir();
 expect(getSpawnDir()).toBe(homedir());
 });
 });

Expand DownExpand Up@@ -142,7 +179,8 @@ describe("history", () => {

 describe("saveSpawnRecord", () => {
 it("creates directory and file when neither exist", () => {
 const nestedDir = join(testDir, "nested", "spawn");
 const { homedir } = require("os");
 const nestedDir = join(homedir(), ".spawn-test", "nested", "spawn");
 process.env.SPAWN_HOME = nestedDir;

 saveSpawnRecord({ agent: "claude", cloud: "sprite", timestamp: "2026-01-01T00:00:00.000Z" });
Expand All@@ -151,6 +189,9 @@ describe("history", () => {
 const data = JSON.parse(readFileSync(join(nestedDir, "history.json"), "utf-8"));
 expect(data).toHaveLength(1);
 expect(data[0].agent).toBe("claude");

 // Clean up
 rmSync(join(homedir(), ".spawn-test"), { recursive: true, force: true });
 });

 it("appends to existing history", () => {
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-display.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
 * Tests for the `spawn list` display logic in commands.ts and index.ts.
Expand DownExpand Up@@ -304,7 +304,7 @@ describe("cmdList output", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-list-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-list-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-filter-suggestions.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest, type Manifest } from "../manifest";

Expand DownExpand Up@@ -212,7 +212,7 @@ describe("cmdList - filter suggestions", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-filter-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-filter-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 consoleMocks = createConsoleMocks();
 mockLogError.mockClear();
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-prompt-display.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync, existsSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
 * Tests for prompt-related display logic in cmdList and the
Expand DownExpand Up@@ -282,7 +282,7 @@ describe("cmdList prompt display", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-prompt-display-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-prompt-display-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-table-rendering.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync, existsSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";
import type { Manifest } from "../manifest";
Expand DownExpand Up@@ -113,7 +113,7 @@ describe("cmdList table rendering", () => {
 originalEnv = { ...process.env };

 // Set up temp history dir
 testDir = join(tmpdir(), `spawn-list-table-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 process.env.SPAWN_HOME = testDir;
 });
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/resolve-list-filters.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest, _resetCacheForTesting } from "../manifest";
import type { SpawnRecord } from "../history";
Expand DownExpand Up@@ -459,7 +459,7 @@ describe("cmdList integration with filter resolution", () => {
 let processExitSpy: ReturnType<typeof spyOn>;

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-resolve-list-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-resolve-list-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 cacheDir = join(testDir, "cache");
 mkdirSync(cacheDir, { recursive: true });
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
security: fix path traversal risk in SPAWN_HOME validation#1402

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

louisgv
merged 2 commits into

from

Feb 17, 2026
 Merged


security: fix path traversal risk in SPAWN_HOME validation
#1402
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
a41ea1f

security: fix path traversal risk in SPAWN_HOME validation


louisgv Feb 17, 2026
cafbc3f

fix: add missing join import and update tests for SPAWN_HOME security…


louisgv Feb 17, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 3 additions & 3 deletions
cli/src/__tests__/clear-history.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import {
 clearHistory,
 loadHistory,
Expand All@@ -27,7 +27,7 @@ describe("clearHistory", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-clear-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand DownExpand Up@@ -253,7 +253,7 @@ describe("cmdListClear", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-cmdclear-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

14 changes: 8 additions & 6 deletions
cli/src/__tests__/cli-core-edge-cases.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, spyOn, mock } from "bun:test";
import { existsSync, writeFileSync, mkdirSync, rmSync, readFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
 * Tests for edge cases across core CLI modules (manifest.ts, security.ts,
Expand DownExpand Up@@ -697,7 +697,7 @@ describe("history.ts additional edge cases", () => {
 let originalSpawnHome: string | undefined;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-test-history-${Date.now()}-${Math.random().toString(36).slice(2)}`);
 testDir = join(homedir(), `spawn-test-history-${Date.now()}-${Math.random().toString(36).slice(2)}`);
 mkdirSync(testDir, { recursive: true });
 originalSpawnHome = process.env.SPAWN_HOME;
 process.env.SPAWN_HOME = testDir;
Expand All@@ -716,15 +716,17 @@ describe("history.ts additional edge cases", () => {

 describe("getSpawnDir edge cases", () => {
 it("should resolve absolute SPAWN_HOME with trailing slash", () => {
 process.env.SPAWN_HOME = "/tmp/test-spawn/";
 const { homedir } = require("os");
 process.env.SPAWN_HOME = join(homedir(), "test-spawn") + "/";
 const dir = getSpawnDir();
 expect(dir).toBe("/tmp/test-spawn");
 expect(dir).toBe(join(homedir(), "test-spawn"));
 });

 it("should resolve SPAWN_HOME with .. segments", () => {
 process.env.SPAWN_HOME = "/tmp/a/../b";
 const { homedir } = require("os");
 process.env.SPAWN_HOME = join(homedir(), "a", "..", "b");
 const dir = getSpawnDir();
 expect(dir).toBe("/tmp/b");
 expect(dir).toBe(join(homedir(), "b"));
 });

 it("should throw for relative path ./data", () => {
Expand Down

11 changes: 7 additions & 4 deletions
cli/src/__tests__/cli-version-and-dispatch.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
import { describe, it, expect, beforeEach, afterEach, spyOn } from "bun:test";
import { resolve } from "path";
import { resolve, join } from "path";

/**
 * Tests for CLI version output and dispatch routing via subprocess execution.
Expand DownExpand Up@@ -493,19 +493,22 @@ describe("subcommand alias routing", () => {

describe("list command aliases", () => {
 it("'list' should not crash with empty history", () => {
 const { exitCode } = runCLI(["list"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
 const { homedir } = require("os");
 const { exitCode } = runCLI(["list"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
 // May exit 0 (shows "no spawns") or run interactive picker in non-TTY
 // The important thing is it doesn't crash
 expect(exitCode).toBeDefined();
 });

 it("'ls' should work as alias for 'list'", () => {
 const { exitCode } = runCLI(["ls"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
 const { homedir } = require("os");
 const { exitCode } = runCLI(["ls"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
 expect(exitCode).toBeDefined();
 });

 it("'history' should work as alias for 'list'", () => {
 const { exitCode } = runCLI(["history"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
 const { homedir } = require("os");
 const { exitCode } = runCLI(["history"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
 expect(exitCode).toBeDefined();
 });

Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/cmdlast.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import type { SpawnRecord } from "../history";

Expand DownExpand Up@@ -79,7 +79,7 @@ describe("cmdLast", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-cmdlast-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-cmdlast-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });

 originalEnv = { ...process.env };
Expand Down

6 changes: 3 additions & 3 deletions
cli/src/__tests__/cmdlist-filter-resolution.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";
import type { Manifest } from "../manifest";
Expand DownExpand Up@@ -100,7 +100,7 @@ describe("cmdList filter resolution via display names", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-filter-res-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-filter-res-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });

 originalEnv = { ...process.env };
Expand DownExpand Up@@ -578,7 +578,7 @@ describe("showListFooter prompt escaping", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-footer-esc-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-footer-esc-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/cmdlist-integration.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import type { SpawnRecord } from "../history";

Expand DownExpand Up@@ -93,7 +93,7 @@ describe("cmdList integration", () => {


 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-cmdlist-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-cmdlist-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });

 originalEnv = { ...process.env };
Expand Down

6 changes: 3 additions & 3 deletions
cli/src/__tests__/cmdrun-happy-path.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";

Expand DownExpand Up@@ -164,7 +164,7 @@ describe("cmdRun happy-path pipeline", () => {
 originalFetch = global.fetch;

 // Set up isolated history directory
 historyDir = join(tmpdir(), `spawn-test-history-${Date.now()}-${Math.random()}`);
 historyDir = join(homedir(), `spawn-test-history-${Date.now()}-${Math.random()}`);
 mkdirSync(historyDir, { recursive: true });
 originalSpawnHome = process.env.SPAWN_HOME;
 process.env.SPAWN_HOME = historyDir;
Expand DownExpand Up@@ -352,7 +352,7 @@ describe("cmdRun happy-path pipeline", () => {

 it("should still execute script when history save fails", async () => {
 // Make history dir read-only to force saveSpawnRecord failure
 const readOnlyDir = join(tmpdir(), `spawn-test-readonly-${Date.now()}`);
 const readOnlyDir = join(homedir(), `spawn-test-readonly-${Date.now()}`);
 mkdirSync(readOnlyDir, { recursive: true });
 // Create a file where the directory should be, so mkdir fails
 writeFileSync(join(readOnlyDir, "history.json"), "not-a-directory");
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/history-trimming.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync, readFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import {
 loadHistory,
 saveSpawnRecord,
Expand All@@ -27,7 +27,7 @@ describe("History Trimming and Boundaries", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-history-trim-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-history-trim-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

63 changes: 52 additions & 11 deletions
cli/src/__tests__/history.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -16,7 +16,9 @@ describe("history", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-history-test-${Date.now()}-${Math.random()}`);
 // Use a directory within home directory for testing (required by security validation)
 const { homedir } = require("os");
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand All@@ -32,9 +34,11 @@ describe("history", () => {
 // ── getSpawnDir ─────────────────────────────────────────────────────────

 describe("getSpawnDir", () => {
 it("returns SPAWN_HOME when set", () => {
 process.env.SPAWN_HOME = "/custom/spawn/dir";
 expect(getSpawnDir()).toBe("/custom/spawn/dir");
 it("returns SPAWN_HOME when set to valid path within home", () => {
 const { homedir } = require("os");
 const validPath = join(homedir(), "custom", "spawn", "dir");
 process.env.SPAWN_HOME = validPath;
 expect(getSpawnDir()).toBe(validPath);
 });

 it("falls back to ~/.spawn when SPAWN_HOME is not set", () => {
Expand All@@ -53,14 +57,47 @@ describe("history", () => {
 expect(() => getSpawnDir()).toThrow("must be an absolute path");
 });

 it("resolves .. segments in absolute SPAWN_HOME", () => {
 process.env.SPAWN_HOME = "/tmp/foo/../bar";
 expect(getSpawnDir()).toBe("/tmp/bar");
 it("resolves .. segments in absolute SPAWN_HOME within home", () => {
 const { homedir } = require("os");
 const pathWithDots = join(homedir(), "foo", "..", "bar");
 process.env.SPAWN_HOME = pathWithDots;
 expect(getSpawnDir()).toBe(join(homedir(), "bar"));
 });

 it("accepts normal absolute SPAWN_HOME within home", () => {
 const { homedir } = require("os");
 const validPath = join(homedir(), ".spawn");
 process.env.SPAWN_HOME = validPath;
 expect(getSpawnDir()).toBe(validPath);
 });

 it("accepts normal absolute SPAWN_HOME", () => {
 process.env.SPAWN_HOME = "/home/user/.spawn";
 expect(getSpawnDir()).toBe("/home/user/.spawn");
 it("throws for SPAWN_HOME outside home directory", () => {
 process.env.SPAWN_HOME = "/tmp/spawn";
 expect(() => getSpawnDir()).toThrow("must be within your home directory");
 });

 it("throws for SPAWN_HOME pointing to /root when user home is different", () => {
 const { homedir } = require("os");
 // Only run this test if we're not actually running as root
 if (homedir() !== "/root") {
 process.env.SPAWN_HOME = "/root/.spawn";
 expect(() => getSpawnDir()).toThrow("must be within your home directory");
 }
 });

 it("throws for path traversal attempt to escape home directory", () => {
 const { homedir } = require("os");
 // Attempt to traverse outside home using .. segments
 // e.g., /home/user/../../etc/.spawn
 const traversalPath = join(homedir(), "..", "..", "etc", ".spawn");
 process.env.SPAWN_HOME = traversalPath;
 expect(() => getSpawnDir()).toThrow("must be within your home directory");
 });

 it("accepts home directory itself as SPAWN_HOME", () => {
 const { homedir } = require("os");
 process.env.SPAWN_HOME = homedir();
 expect(getSpawnDir()).toBe(homedir());
 });
 });

Expand DownExpand Up@@ -142,7 +179,8 @@ describe("history", () => {

 describe("saveSpawnRecord", () => {
 it("creates directory and file when neither exist", () => {
 const nestedDir = join(testDir, "nested", "spawn");
 const { homedir } = require("os");
 const nestedDir = join(homedir(), ".spawn-test", "nested", "spawn");
 process.env.SPAWN_HOME = nestedDir;

 saveSpawnRecord({ agent: "claude", cloud: "sprite", timestamp: "2026-01-01T00:00:00.000Z" });
Expand All@@ -151,6 +189,9 @@ describe("history", () => {
 const data = JSON.parse(readFileSync(join(nestedDir, "history.json"), "utf-8"));
 expect(data).toHaveLength(1);
 expect(data[0].agent).toBe("claude");

 // Clean up
 rmSync(join(homedir(), ".spawn-test"), { recursive: true, force: true });
 });

 it("appends to existing history", () => {
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-display.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
 * Tests for the `spawn list` display logic in commands.ts and index.ts.
Expand DownExpand Up@@ -304,7 +304,7 @@ describe("cmdList output", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-list-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-list-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-filter-suggestions.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest, type Manifest } from "../manifest";

Expand DownExpand Up@@ -212,7 +212,7 @@ describe("cmdList - filter suggestions", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-filter-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-filter-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 consoleMocks = createConsoleMocks();
 mockLogError.mockClear();
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-prompt-display.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync, existsSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
 * Tests for prompt-related display logic in cmdList and the
Expand DownExpand Up@@ -282,7 +282,7 @@ describe("cmdList prompt display", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-prompt-display-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-prompt-display-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-table-rendering.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync, existsSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";
import type { Manifest } from "../manifest";
Expand DownExpand Up@@ -113,7 +113,7 @@ describe("cmdList table rendering", () => {
 originalEnv = { ...process.env };

 // Set up temp history dir
 testDir = join(tmpdir(), `spawn-list-table-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 process.env.SPAWN_HOME = testDir;
 });
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/resolve-list-filters.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest, _resetCacheForTesting } from "../manifest";
import type { SpawnRecord } from "../history";
Expand DownExpand Up@@ -459,7 +459,7 @@ describe("cmdList integration with filter resolution", () => {
 let processExitSpy: ReturnType<typeof spyOn>;

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-resolve-list-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-resolve-list-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 cacheDir = join(testDir, "cache");
 mkdirSync(cacheDir, { recursive: true });
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
security: fix path traversal risk in SPAWN_HOME validation#1402

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

louisgv
merged 2 commits into

from

Feb 17, 2026
 Merged


security: fix path traversal risk in SPAWN_HOME validation
#1402
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
a41ea1f

security: fix path traversal risk in SPAWN_HOME validation


louisgv Feb 17, 2026
cafbc3f

fix: add missing join import and update tests for SPAWN_HOME security…


louisgv Feb 17, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 3 additions & 3 deletions
cli/src/__tests__/clear-history.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import {
 clearHistory,
 loadHistory,
Expand All@@ -27,7 +27,7 @@ describe("clearHistory", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-clear-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand DownExpand Up@@ -253,7 +253,7 @@ describe("cmdListClear", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-cmdclear-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

14 changes: 8 additions & 6 deletions
cli/src/__tests__/cli-core-edge-cases.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, spyOn, mock } from "bun:test";
import { existsSync, writeFileSync, mkdirSync, rmSync, readFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
 * Tests for edge cases across core CLI modules (manifest.ts, security.ts,
Expand DownExpand Up@@ -697,7 +697,7 @@ describe("history.ts additional edge cases", () => {
 let originalSpawnHome: string | undefined;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-test-history-${Date.now()}-${Math.random().toString(36).slice(2)}`);
 testDir = join(homedir(), `spawn-test-history-${Date.now()}-${Math.random().toString(36).slice(2)}`);
 mkdirSync(testDir, { recursive: true });
 originalSpawnHome = process.env.SPAWN_HOME;
 process.env.SPAWN_HOME = testDir;
Expand All@@ -716,15 +716,17 @@ describe("history.ts additional edge cases", () => {

 describe("getSpawnDir edge cases", () => {
 it("should resolve absolute SPAWN_HOME with trailing slash", () => {
 process.env.SPAWN_HOME = "/tmp/test-spawn/";
 const { homedir } = require("os");
 process.env.SPAWN_HOME = join(homedir(), "test-spawn") + "/";
 const dir = getSpawnDir();
 expect(dir).toBe("/tmp/test-spawn");
 expect(dir).toBe(join(homedir(), "test-spawn"));
 });

 it("should resolve SPAWN_HOME with .. segments", () => {
 process.env.SPAWN_HOME = "/tmp/a/../b";
 const { homedir } = require("os");
 process.env.SPAWN_HOME = join(homedir(), "a", "..", "b");
 const dir = getSpawnDir();
 expect(dir).toBe("/tmp/b");
 expect(dir).toBe(join(homedir(), "b"));
 });

 it("should throw for relative path ./data", () => {
Expand Down

11 changes: 7 additions & 4 deletions
cli/src/__tests__/cli-version-and-dispatch.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
import { describe, it, expect, beforeEach, afterEach, spyOn } from "bun:test";
import { resolve } from "path";
import { resolve, join } from "path";

/**
 * Tests for CLI version output and dispatch routing via subprocess execution.
Expand DownExpand Up@@ -493,19 +493,22 @@ describe("subcommand alias routing", () => {

describe("list command aliases", () => {
 it("'list' should not crash with empty history", () => {
 const { exitCode } = runCLI(["list"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
 const { homedir } = require("os");
 const { exitCode } = runCLI(["list"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
 // May exit 0 (shows "no spawns") or run interactive picker in non-TTY
 // The important thing is it doesn't crash
 expect(exitCode).toBeDefined();
 });

 it("'ls' should work as alias for 'list'", () => {
 const { exitCode } = runCLI(["ls"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
 const { homedir } = require("os");
 const { exitCode } = runCLI(["ls"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
 expect(exitCode).toBeDefined();
 });

 it("'history' should work as alias for 'list'", () => {
 const { exitCode } = runCLI(["history"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
 const { homedir } = require("os");
 const { exitCode } = runCLI(["history"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
 expect(exitCode).toBeDefined();
 });

Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/cmdlast.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import type { SpawnRecord } from "../history";

Expand DownExpand Up@@ -79,7 +79,7 @@ describe("cmdLast", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-cmdlast-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-cmdlast-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });

 originalEnv = { ...process.env };
Expand Down

6 changes: 3 additions & 3 deletions
cli/src/__tests__/cmdlist-filter-resolution.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";
import type { Manifest } from "../manifest";
Expand DownExpand Up@@ -100,7 +100,7 @@ describe("cmdList filter resolution via display names", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-filter-res-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-filter-res-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });

 originalEnv = { ...process.env };
Expand DownExpand Up@@ -578,7 +578,7 @@ describe("showListFooter prompt escaping", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-footer-esc-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-footer-esc-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/cmdlist-integration.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import type { SpawnRecord } from "../history";

Expand DownExpand Up@@ -93,7 +93,7 @@ describe("cmdList integration", () => {


 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-cmdlist-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-cmdlist-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });

 originalEnv = { ...process.env };
Expand Down

6 changes: 3 additions & 3 deletions
cli/src/__tests__/cmdrun-happy-path.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";

Expand DownExpand Up@@ -164,7 +164,7 @@ describe("cmdRun happy-path pipeline", () => {
 originalFetch = global.fetch;

 // Set up isolated history directory
 historyDir = join(tmpdir(), `spawn-test-history-${Date.now()}-${Math.random()}`);
 historyDir = join(homedir(), `spawn-test-history-${Date.now()}-${Math.random()}`);
 mkdirSync(historyDir, { recursive: true });
 originalSpawnHome = process.env.SPAWN_HOME;
 process.env.SPAWN_HOME = historyDir;
Expand DownExpand Up@@ -352,7 +352,7 @@ describe("cmdRun happy-path pipeline", () => {

 it("should still execute script when history save fails", async () => {
 // Make history dir read-only to force saveSpawnRecord failure
 const readOnlyDir = join(tmpdir(), `spawn-test-readonly-${Date.now()}`);
 const readOnlyDir = join(homedir(), `spawn-test-readonly-${Date.now()}`);
 mkdirSync(readOnlyDir, { recursive: true });
 // Create a file where the directory should be, so mkdir fails
 writeFileSync(join(readOnlyDir, "history.json"), "not-a-directory");
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/history-trimming.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync, readFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import {
 loadHistory,
 saveSpawnRecord,
Expand All@@ -27,7 +27,7 @@ describe("History Trimming and Boundaries", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-history-trim-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-history-trim-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

63 changes: 52 additions & 11 deletions
cli/src/__tests__/history.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -16,7 +16,9 @@ describe("history", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-history-test-${Date.now()}-${Math.random()}`);
 // Use a directory within home directory for testing (required by security validation)
 const { homedir } = require("os");
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand All@@ -32,9 +34,11 @@ describe("history", () => {
 // ── getSpawnDir ─────────────────────────────────────────────────────────

 describe("getSpawnDir", () => {
 it("returns SPAWN_HOME when set", () => {
 process.env.SPAWN_HOME = "/custom/spawn/dir";
 expect(getSpawnDir()).toBe("/custom/spawn/dir");
 it("returns SPAWN_HOME when set to valid path within home", () => {
 const { homedir } = require("os");
 const validPath = join(homedir(), "custom", "spawn", "dir");
 process.env.SPAWN_HOME = validPath;
 expect(getSpawnDir()).toBe(validPath);
 });

 it("falls back to ~/.spawn when SPAWN_HOME is not set", () => {
Expand All@@ -53,14 +57,47 @@ describe("history", () => {
 expect(() => getSpawnDir()).toThrow("must be an absolute path");
 });

 it("resolves .. segments in absolute SPAWN_HOME", () => {
 process.env.SPAWN_HOME = "/tmp/foo/../bar";
 expect(getSpawnDir()).toBe("/tmp/bar");
 it("resolves .. segments in absolute SPAWN_HOME within home", () => {
 const { homedir } = require("os");
 const pathWithDots = join(homedir(), "foo", "..", "bar");
 process.env.SPAWN_HOME = pathWithDots;
 expect(getSpawnDir()).toBe(join(homedir(), "bar"));
 });

 it("accepts normal absolute SPAWN_HOME within home", () => {
 const { homedir } = require("os");
 const validPath = join(homedir(), ".spawn");
 process.env.SPAWN_HOME = validPath;
 expect(getSpawnDir()).toBe(validPath);
 });

 it("accepts normal absolute SPAWN_HOME", () => {
 process.env.SPAWN_HOME = "/home/user/.spawn";
 expect(getSpawnDir()).toBe("/home/user/.spawn");
 it("throws for SPAWN_HOME outside home directory", () => {
 process.env.SPAWN_HOME = "/tmp/spawn";
 expect(() => getSpawnDir()).toThrow("must be within your home directory");
 });

 it("throws for SPAWN_HOME pointing to /root when user home is different", () => {
 const { homedir } = require("os");
 // Only run this test if we're not actually running as root
 if (homedir() !== "/root") {
 process.env.SPAWN_HOME = "/root/.spawn";
 expect(() => getSpawnDir()).toThrow("must be within your home directory");
 }
 });

 it("throws for path traversal attempt to escape home directory", () => {
 const { homedir } = require("os");
 // Attempt to traverse outside home using .. segments
 // e.g., /home/user/../../etc/.spawn
 const traversalPath = join(homedir(), "..", "..", "etc", ".spawn");
 process.env.SPAWN_HOME = traversalPath;
 expect(() => getSpawnDir()).toThrow("must be within your home directory");
 });

 it("accepts home directory itself as SPAWN_HOME", () => {
 const { homedir } = require("os");
 process.env.SPAWN_HOME = homedir();
 expect(getSpawnDir()).toBe(homedir());
 });
 });

Expand DownExpand Up@@ -142,7 +179,8 @@ describe("history", () => {

 describe("saveSpawnRecord", () => {
 it("creates directory and file when neither exist", () => {
 const nestedDir = join(testDir, "nested", "spawn");
 const { homedir } = require("os");
 const nestedDir = join(homedir(), ".spawn-test", "nested", "spawn");
 process.env.SPAWN_HOME = nestedDir;

 saveSpawnRecord({ agent: "claude", cloud: "sprite", timestamp: "2026-01-01T00:00:00.000Z" });
Expand All@@ -151,6 +189,9 @@ describe("history", () => {
 const data = JSON.parse(readFileSync(join(nestedDir, "history.json"), "utf-8"));
 expect(data).toHaveLength(1);
 expect(data[0].agent).toBe("claude");

 // Clean up
 rmSync(join(homedir(), ".spawn-test"), { recursive: true, force: true });
 });

 it("appends to existing history", () => {
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-display.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
 * Tests for the `spawn list` display logic in commands.ts and index.ts.
Expand DownExpand Up@@ -304,7 +304,7 @@ describe("cmdList output", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-list-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-list-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-filter-suggestions.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest, type Manifest } from "../manifest";

Expand DownExpand Up@@ -212,7 +212,7 @@ describe("cmdList - filter suggestions", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-filter-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-filter-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 consoleMocks = createConsoleMocks();
 mockLogError.mockClear();
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-prompt-display.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync, existsSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
 * Tests for prompt-related display logic in cmdList and the
Expand DownExpand Up@@ -282,7 +282,7 @@ describe("cmdList prompt display", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-prompt-display-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-prompt-display-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-table-rendering.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync, existsSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";
import type { Manifest } from "../manifest";
Expand DownExpand Up@@ -113,7 +113,7 @@ describe("cmdList table rendering", () => {
 originalEnv = { ...process.env };

 // Set up temp history dir
 testDir = join(tmpdir(), `spawn-list-table-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 process.env.SPAWN_HOME = testDir;
 });
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/resolve-list-filters.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest, _resetCacheForTesting } from "../manifest";
import type { SpawnRecord } from "../history";
Expand DownExpand Up@@ -459,7 +459,7 @@ describe("cmdList integration with filter resolution", () => {
 let processExitSpy: ReturnType<typeof spyOn>;

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-resolve-list-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-resolve-list-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 cacheDir = join(testDir, "cache");
 mkdirSync(cacheDir, { recursive: true });
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
security: fix path traversal risk in SPAWN_HOME validation#1402

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

louisgv
merged 2 commits into

from

Feb 17, 2026
 Merged


security: fix path traversal risk in SPAWN_HOME validation
#1402
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
a41ea1f

security: fix path traversal risk in SPAWN_HOME validation


louisgv Feb 17, 2026
cafbc3f

fix: add missing join import and update tests for SPAWN_HOME security…


louisgv Feb 17, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 3 additions & 3 deletions
cli/src/__tests__/clear-history.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import {
 clearHistory,
 loadHistory,
Expand All@@ -27,7 +27,7 @@ describe("clearHistory", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-clear-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand DownExpand Up@@ -253,7 +253,7 @@ describe("cmdListClear", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-cmdclear-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

14 changes: 8 additions & 6 deletions
cli/src/__tests__/cli-core-edge-cases.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, spyOn, mock } from "bun:test";
import { existsSync, writeFileSync, mkdirSync, rmSync, readFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
 * Tests for edge cases across core CLI modules (manifest.ts, security.ts,
Expand DownExpand Up@@ -697,7 +697,7 @@ describe("history.ts additional edge cases", () => {
 let originalSpawnHome: string | undefined;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-test-history-${Date.now()}-${Math.random().toString(36).slice(2)}`);
 testDir = join(homedir(), `spawn-test-history-${Date.now()}-${Math.random().toString(36).slice(2)}`);
 mkdirSync(testDir, { recursive: true });
 originalSpawnHome = process.env.SPAWN_HOME;
 process.env.SPAWN_HOME = testDir;
Expand All@@ -716,15 +716,17 @@ describe("history.ts additional edge cases", () => {

 describe("getSpawnDir edge cases", () => {
 it("should resolve absolute SPAWN_HOME with trailing slash", () => {
 process.env.SPAWN_HOME = "/tmp/test-spawn/";
 const { homedir } = require("os");
 process.env.SPAWN_HOME = join(homedir(), "test-spawn") + "/";
 const dir = getSpawnDir();
 expect(dir).toBe("/tmp/test-spawn");
 expect(dir).toBe(join(homedir(), "test-spawn"));
 });

 it("should resolve SPAWN_HOME with .. segments", () => {
 process.env.SPAWN_HOME = "/tmp/a/../b";
 const { homedir } = require("os");
 process.env.SPAWN_HOME = join(homedir(), "a", "..", "b");
 const dir = getSpawnDir();
 expect(dir).toBe("/tmp/b");
 expect(dir).toBe(join(homedir(), "b"));
 });

 it("should throw for relative path ./data", () => {
Expand Down

11 changes: 7 additions & 4 deletions
cli/src/__tests__/cli-version-and-dispatch.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
import { describe, it, expect, beforeEach, afterEach, spyOn } from "bun:test";
import { resolve } from "path";
import { resolve, join } from "path";

/**
 * Tests for CLI version output and dispatch routing via subprocess execution.
Expand DownExpand Up@@ -493,19 +493,22 @@ describe("subcommand alias routing", () => {

describe("list command aliases", () => {
 it("'list' should not crash with empty history", () => {
 const { exitCode } = runCLI(["list"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
 const { homedir } = require("os");
 const { exitCode } = runCLI(["list"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
 // May exit 0 (shows "no spawns") or run interactive picker in non-TTY
 // The important thing is it doesn't crash
 expect(exitCode).toBeDefined();
 });

 it("'ls' should work as alias for 'list'", () => {
 const { exitCode } = runCLI(["ls"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
 const { homedir } = require("os");
 const { exitCode } = runCLI(["ls"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
 expect(exitCode).toBeDefined();
 });

 it("'history' should work as alias for 'list'", () => {
 const { exitCode } = runCLI(["history"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
 const { homedir } = require("os");
 const { exitCode } = runCLI(["history"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
 expect(exitCode).toBeDefined();
 });

Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/cmdlast.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import type { SpawnRecord } from "../history";

Expand DownExpand Up@@ -79,7 +79,7 @@ describe("cmdLast", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-cmdlast-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-cmdlast-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });

 originalEnv = { ...process.env };
Expand Down

6 changes: 3 additions & 3 deletions
cli/src/__tests__/cmdlist-filter-resolution.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";
import type { Manifest } from "../manifest";
Expand DownExpand Up@@ -100,7 +100,7 @@ describe("cmdList filter resolution via display names", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-filter-res-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-filter-res-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });

 originalEnv = { ...process.env };
Expand DownExpand Up@@ -578,7 +578,7 @@ describe("showListFooter prompt escaping", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-footer-esc-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-footer-esc-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/cmdlist-integration.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import type { SpawnRecord } from "../history";

Expand DownExpand Up@@ -93,7 +93,7 @@ describe("cmdList integration", () => {


 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-cmdlist-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-cmdlist-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });

 originalEnv = { ...process.env };
Expand Down

6 changes: 3 additions & 3 deletions
cli/src/__tests__/cmdrun-happy-path.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";

Expand DownExpand Up@@ -164,7 +164,7 @@ describe("cmdRun happy-path pipeline", () => {
 originalFetch = global.fetch;

 // Set up isolated history directory
 historyDir = join(tmpdir(), `spawn-test-history-${Date.now()}-${Math.random()}`);
 historyDir = join(homedir(), `spawn-test-history-${Date.now()}-${Math.random()}`);
 mkdirSync(historyDir, { recursive: true });
 originalSpawnHome = process.env.SPAWN_HOME;
 process.env.SPAWN_HOME = historyDir;
Expand DownExpand Up@@ -352,7 +352,7 @@ describe("cmdRun happy-path pipeline", () => {

 it("should still execute script when history save fails", async () => {
 // Make history dir read-only to force saveSpawnRecord failure
 const readOnlyDir = join(tmpdir(), `spawn-test-readonly-${Date.now()}`);
 const readOnlyDir = join(homedir(), `spawn-test-readonly-${Date.now()}`);
 mkdirSync(readOnlyDir, { recursive: true });
 // Create a file where the directory should be, so mkdir fails
 writeFileSync(join(readOnlyDir, "history.json"), "not-a-directory");
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/history-trimming.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync, readFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import {
 loadHistory,
 saveSpawnRecord,
Expand All@@ -27,7 +27,7 @@ describe("History Trimming and Boundaries", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-history-trim-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-history-trim-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

63 changes: 52 additions & 11 deletions
cli/src/__tests__/history.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -16,7 +16,9 @@ describe("history", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-history-test-${Date.now()}-${Math.random()}`);
 // Use a directory within home directory for testing (required by security validation)
 const { homedir } = require("os");
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand All@@ -32,9 +34,11 @@ describe("history", () => {
 // ── getSpawnDir ─────────────────────────────────────────────────────────

 describe("getSpawnDir", () => {
 it("returns SPAWN_HOME when set", () => {
 process.env.SPAWN_HOME = "/custom/spawn/dir";
 expect(getSpawnDir()).toBe("/custom/spawn/dir");
 it("returns SPAWN_HOME when set to valid path within home", () => {
 const { homedir } = require("os");
 const validPath = join(homedir(), "custom", "spawn", "dir");
 process.env.SPAWN_HOME = validPath;
 expect(getSpawnDir()).toBe(validPath);
 });

 it("falls back to ~/.spawn when SPAWN_HOME is not set", () => {
Expand All@@ -53,14 +57,47 @@ describe("history", () => {
 expect(() => getSpawnDir()).toThrow("must be an absolute path");
 });

 it("resolves .. segments in absolute SPAWN_HOME", () => {
 process.env.SPAWN_HOME = "/tmp/foo/../bar";
 expect(getSpawnDir()).toBe("/tmp/bar");
 it("resolves .. segments in absolute SPAWN_HOME within home", () => {
 const { homedir } = require("os");
 const pathWithDots = join(homedir(), "foo", "..", "bar");
 process.env.SPAWN_HOME = pathWithDots;
 expect(getSpawnDir()).toBe(join(homedir(), "bar"));
 });

 it("accepts normal absolute SPAWN_HOME within home", () => {
 const { homedir } = require("os");
 const validPath = join(homedir(), ".spawn");
 process.env.SPAWN_HOME = validPath;
 expect(getSpawnDir()).toBe(validPath);
 });

 it("accepts normal absolute SPAWN_HOME", () => {
 process.env.SPAWN_HOME = "/home/user/.spawn";
 expect(getSpawnDir()).toBe("/home/user/.spawn");
 it("throws for SPAWN_HOME outside home directory", () => {
 process.env.SPAWN_HOME = "/tmp/spawn";
 expect(() => getSpawnDir()).toThrow("must be within your home directory");
 });

 it("throws for SPAWN_HOME pointing to /root when user home is different", () => {
 const { homedir } = require("os");
 // Only run this test if we're not actually running as root
 if (homedir() !== "/root") {
 process.env.SPAWN_HOME = "/root/.spawn";
 expect(() => getSpawnDir()).toThrow("must be within your home directory");
 }
 });

 it("throws for path traversal attempt to escape home directory", () => {
 const { homedir } = require("os");
 // Attempt to traverse outside home using .. segments
 // e.g., /home/user/../../etc/.spawn
 const traversalPath = join(homedir(), "..", "..", "etc", ".spawn");
 process.env.SPAWN_HOME = traversalPath;
 expect(() => getSpawnDir()).toThrow("must be within your home directory");
 });

 it("accepts home directory itself as SPAWN_HOME", () => {
 const { homedir } = require("os");
 process.env.SPAWN_HOME = homedir();
 expect(getSpawnDir()).toBe(homedir());
 });
 });

Expand DownExpand Up@@ -142,7 +179,8 @@ describe("history", () => {

 describe("saveSpawnRecord", () => {
 it("creates directory and file when neither exist", () => {
 const nestedDir = join(testDir, "nested", "spawn");
 const { homedir } = require("os");
 const nestedDir = join(homedir(), ".spawn-test", "nested", "spawn");
 process.env.SPAWN_HOME = nestedDir;

 saveSpawnRecord({ agent: "claude", cloud: "sprite", timestamp: "2026-01-01T00:00:00.000Z" });
Expand All@@ -151,6 +189,9 @@ describe("history", () => {
 const data = JSON.parse(readFileSync(join(nestedDir, "history.json"), "utf-8"));
 expect(data).toHaveLength(1);
 expect(data[0].agent).toBe("claude");

 // Clean up
 rmSync(join(homedir(), ".spawn-test"), { recursive: true, force: true });
 });

 it("appends to existing history", () => {
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-display.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
 * Tests for the `spawn list` display logic in commands.ts and index.ts.
Expand DownExpand Up@@ -304,7 +304,7 @@ describe("cmdList output", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-list-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-list-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-filter-suggestions.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest, type Manifest } from "../manifest";

Expand DownExpand Up@@ -212,7 +212,7 @@ describe("cmdList - filter suggestions", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-filter-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-filter-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 consoleMocks = createConsoleMocks();
 mockLogError.mockClear();
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-prompt-display.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync, existsSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
 * Tests for prompt-related display logic in cmdList and the
Expand DownExpand Up@@ -282,7 +282,7 @@ describe("cmdList prompt display", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-prompt-display-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-prompt-display-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-table-rendering.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync, existsSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";
import type { Manifest } from "../manifest";
Expand DownExpand Up@@ -113,7 +113,7 @@ describe("cmdList table rendering", () => {
 originalEnv = { ...process.env };

 // Set up temp history dir
 testDir = join(tmpdir(), `spawn-list-table-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 process.env.SPAWN_HOME = testDir;
 });
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/resolve-list-filters.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest, _resetCacheForTesting } from "../manifest";
import type { SpawnRecord } from "../history";
Expand DownExpand Up@@ -459,7 +459,7 @@ describe("cmdList integration with filter resolution", () => {
 let processExitSpy: ReturnType<typeof spyOn>;

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-resolve-list-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-resolve-list-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 cacheDir = join(testDir, "cache");
 mkdirSync(cacheDir, { recursive: true });
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
security: fix path traversal risk in SPAWN_HOME validation#1402

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

louisgv
merged 2 commits into

from

Feb 17, 2026
 Merged


security: fix path traversal risk in SPAWN_HOME validation
#1402
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
a41ea1f

security: fix path traversal risk in SPAWN_HOME validation


louisgv Feb 17, 2026
cafbc3f

fix: add missing join import and update tests for SPAWN_HOME security…


louisgv Feb 17, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


6 changes: 3 additions & 3 deletions
cli/src/__tests__/clear-history.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import {
 clearHistory,
 loadHistory,
Expand All@@ -27,7 +27,7 @@ describe("clearHistory", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-clear-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand DownExpand Up@@ -253,7 +253,7 @@ describe("cmdListClear", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-cmdclear-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

14 changes: 8 additions & 6 deletions
cli/src/__tests__/cli-core-edge-cases.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, spyOn, mock } from "bun:test";
import { existsSync, writeFileSync, mkdirSync, rmSync, readFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
 * Tests for edge cases across core CLI modules (manifest.ts, security.ts,
Expand DownExpand Up@@ -697,7 +697,7 @@ describe("history.ts additional edge cases", () => {
 let originalSpawnHome: string | undefined;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-test-history-${Date.now()}-${Math.random().toString(36).slice(2)}`);
 testDir = join(homedir(), `spawn-test-history-${Date.now()}-${Math.random().toString(36).slice(2)}`);
 mkdirSync(testDir, { recursive: true });
 originalSpawnHome = process.env.SPAWN_HOME;
 process.env.SPAWN_HOME = testDir;
Expand All@@ -716,15 +716,17 @@ describe("history.ts additional edge cases", () => {

 describe("getSpawnDir edge cases", () => {
 it("should resolve absolute SPAWN_HOME with trailing slash", () => {
 process.env.SPAWN_HOME = "/tmp/test-spawn/";
 const { homedir } = require("os");
 process.env.SPAWN_HOME = join(homedir(), "test-spawn") + "/";
 const dir = getSpawnDir();
 expect(dir).toBe("/tmp/test-spawn");
 expect(dir).toBe(join(homedir(), "test-spawn"));
 });

 it("should resolve SPAWN_HOME with .. segments", () => {
 process.env.SPAWN_HOME = "/tmp/a/../b";
 const { homedir } = require("os");
 process.env.SPAWN_HOME = join(homedir(), "a", "..", "b");
 const dir = getSpawnDir();
 expect(dir).toBe("/tmp/b");
 expect(dir).toBe(join(homedir(), "b"));
 });

 it("should throw for relative path ./data", () => {
Expand Down

11 changes: 7 additions & 4 deletions
cli/src/__tests__/cli-version-and-dispatch.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
import { describe, it, expect, beforeEach, afterEach, spyOn } from "bun:test";
import { resolve } from "path";
import { resolve, join } from "path";

/**
 * Tests for CLI version output and dispatch routing via subprocess execution.
Expand DownExpand Up@@ -493,19 +493,22 @@ describe("subcommand alias routing", () => {

describe("list command aliases", () => {
 it("'list' should not crash with empty history", () => {
 const { exitCode } = runCLI(["list"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
 const { homedir } = require("os");
 const { exitCode } = runCLI(["list"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
 // May exit 0 (shows "no spawns") or run interactive picker in non-TTY
 // The important thing is it doesn't crash
 expect(exitCode).toBeDefined();
 });

 it("'ls' should work as alias for 'list'", () => {
 const { exitCode } = runCLI(["ls"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
 const { homedir } = require("os");
 const { exitCode } = runCLI(["ls"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
 expect(exitCode).toBeDefined();
 });

 it("'history' should work as alias for 'list'", () => {
 const { exitCode } = runCLI(["history"], { SPAWN_HOME: "/tmp/spawn-test-empty-home-" + Date.now() });
 const { homedir } = require("os");
 const { exitCode } = runCLI(["history"], { SPAWN_HOME: join(homedir(), ".spawn-test-empty-home-" + Date.now()) });
 expect(exitCode).toBeDefined();
 });

Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/cmdlast.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import type { SpawnRecord } from "../history";

Expand DownExpand Up@@ -79,7 +79,7 @@ describe("cmdLast", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-cmdlast-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-cmdlast-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });

 originalEnv = { ...process.env };
Expand Down

6 changes: 3 additions & 3 deletions
cli/src/__tests__/cmdlist-filter-resolution.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";
import type { Manifest } from "../manifest";
Expand DownExpand Up@@ -100,7 +100,7 @@ describe("cmdList filter resolution via display names", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-filter-res-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-filter-res-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });

 originalEnv = { ...process.env };
Expand DownExpand Up@@ -578,7 +578,7 @@ describe("showListFooter prompt escaping", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-footer-esc-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-footer-esc-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/cmdlist-integration.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import type { SpawnRecord } from "../history";

Expand DownExpand Up@@ -93,7 +93,7 @@ describe("cmdList integration", () => {


 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-cmdlist-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-cmdlist-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });

 originalEnv = { ...process.env };
Expand Down

6 changes: 3 additions & 3 deletions
cli/src/__tests__/cmdrun-happy-path.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";

Expand DownExpand Up@@ -164,7 +164,7 @@ describe("cmdRun happy-path pipeline", () => {
 originalFetch = global.fetch;

 // Set up isolated history directory
 historyDir = join(tmpdir(), `spawn-test-history-${Date.now()}-${Math.random()}`);
 historyDir = join(homedir(), `spawn-test-history-${Date.now()}-${Math.random()}`);
 mkdirSync(historyDir, { recursive: true });
 originalSpawnHome = process.env.SPAWN_HOME;
 process.env.SPAWN_HOME = historyDir;
Expand DownExpand Up@@ -352,7 +352,7 @@ describe("cmdRun happy-path pipeline", () => {

 it("should still execute script when history save fails", async () => {
 // Make history dir read-only to force saveSpawnRecord failure
 const readOnlyDir = join(tmpdir(), `spawn-test-readonly-${Date.now()}`);
 const readOnlyDir = join(homedir(), `spawn-test-readonly-${Date.now()}`);
 mkdirSync(readOnlyDir, { recursive: true });
 // Create a file where the directory should be, so mkdir fails
 writeFileSync(join(readOnlyDir, "history.json"), "not-a-directory");
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/history-trimming.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync, readFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import {
 loadHistory,
 saveSpawnRecord,
Expand All@@ -27,7 +27,7 @@ describe("History Trimming and Boundaries", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-history-trim-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-history-trim-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

63 changes: 52 additions & 11 deletions
cli/src/__tests__/history.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -16,7 +16,9 @@ describe("history", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-history-test-${Date.now()}-${Math.random()}`);
 // Use a directory within home directory for testing (required by security validation)
 const { homedir } = require("os");
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand All@@ -32,9 +34,11 @@ describe("history", () => {
 // ── getSpawnDir ─────────────────────────────────────────────────────────

 describe("getSpawnDir", () => {
 it("returns SPAWN_HOME when set", () => {
 process.env.SPAWN_HOME = "/custom/spawn/dir";
 expect(getSpawnDir()).toBe("/custom/spawn/dir");
 it("returns SPAWN_HOME when set to valid path within home", () => {
 const { homedir } = require("os");
 const validPath = join(homedir(), "custom", "spawn", "dir");
 process.env.SPAWN_HOME = validPath;
 expect(getSpawnDir()).toBe(validPath);
 });

 it("falls back to ~/.spawn when SPAWN_HOME is not set", () => {
Expand All@@ -53,14 +57,47 @@ describe("history", () => {
 expect(() => getSpawnDir()).toThrow("must be an absolute path");
 });

 it("resolves .. segments in absolute SPAWN_HOME", () => {
 process.env.SPAWN_HOME = "/tmp/foo/../bar";
 expect(getSpawnDir()).toBe("/tmp/bar");
 it("resolves .. segments in absolute SPAWN_HOME within home", () => {
 const { homedir } = require("os");
 const pathWithDots = join(homedir(), "foo", "..", "bar");
 process.env.SPAWN_HOME = pathWithDots;
 expect(getSpawnDir()).toBe(join(homedir(), "bar"));
 });

 it("accepts normal absolute SPAWN_HOME within home", () => {
 const { homedir } = require("os");
 const validPath = join(homedir(), ".spawn");
 process.env.SPAWN_HOME = validPath;
 expect(getSpawnDir()).toBe(validPath);
 });

 it("accepts normal absolute SPAWN_HOME", () => {
 process.env.SPAWN_HOME = "/home/user/.spawn";
 expect(getSpawnDir()).toBe("/home/user/.spawn");
 it("throws for SPAWN_HOME outside home directory", () => {
 process.env.SPAWN_HOME = "/tmp/spawn";
 expect(() => getSpawnDir()).toThrow("must be within your home directory");
 });

 it("throws for SPAWN_HOME pointing to /root when user home is different", () => {
 const { homedir } = require("os");
 // Only run this test if we're not actually running as root
 if (homedir() !== "/root") {
 process.env.SPAWN_HOME = "/root/.spawn";
 expect(() => getSpawnDir()).toThrow("must be within your home directory");
 }
 });

 it("throws for path traversal attempt to escape home directory", () => {
 const { homedir } = require("os");
 // Attempt to traverse outside home using .. segments
 // e.g., /home/user/../../etc/.spawn
 const traversalPath = join(homedir(), "..", "..", "etc", ".spawn");
 process.env.SPAWN_HOME = traversalPath;
 expect(() => getSpawnDir()).toThrow("must be within your home directory");
 });

 it("accepts home directory itself as SPAWN_HOME", () => {
 const { homedir } = require("os");
 process.env.SPAWN_HOME = homedir();
 expect(getSpawnDir()).toBe(homedir());
 });
 });

Expand DownExpand Up@@ -142,7 +179,8 @@ describe("history", () => {

 describe("saveSpawnRecord", () => {
 it("creates directory and file when neither exist", () => {
 const nestedDir = join(testDir, "nested", "spawn");
 const { homedir } = require("os");
 const nestedDir = join(homedir(), ".spawn-test", "nested", "spawn");
 process.env.SPAWN_HOME = nestedDir;

 saveSpawnRecord({ agent: "claude", cloud: "sprite", timestamp: "2026-01-01T00:00:00.000Z" });
Expand All@@ -151,6 +189,9 @@ describe("history", () => {
 const data = JSON.parse(readFileSync(join(nestedDir, "history.json"), "utf-8"));
 expect(data).toHaveLength(1);
 expect(data[0].agent).toBe("claude");

 // Clean up
 rmSync(join(homedir(), ".spawn-test"), { recursive: true, force: true });
 });

 it("appends to existing history", () => {
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-display.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
 * Tests for the `spawn list` display logic in commands.ts and index.ts.
Expand DownExpand Up@@ -304,7 +304,7 @@ describe("cmdList output", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-list-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-list-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-filter-suggestions.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest, type Manifest } from "../manifest";

Expand DownExpand Up@@ -212,7 +212,7 @@ describe("cmdList - filter suggestions", () => {
 }

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-filter-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-filter-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 consoleMocks = createConsoleMocks();
 mockLogError.mockClear();
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-prompt-display.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync, existsSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";

/**
 * Tests for prompt-related display logic in cmdList and the
Expand DownExpand Up@@ -282,7 +282,7 @@ describe("cmdList prompt display", () => {
 let originalEnv: NodeJS.ProcessEnv;

 beforeEach(() => {
 testDir = join(tmpdir(), `spawn-prompt-display-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-prompt-display-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 originalEnv = { ...process.env };
 process.env.SPAWN_HOME = testDir;
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/list-table-rendering.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { mkdirSync, writeFileSync, rmSync, existsSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest } from "../manifest";
import type { Manifest } from "../manifest";
Expand DownExpand Up@@ -113,7 +113,7 @@ describe("cmdList table rendering", () => {
 originalEnv = { ...process.env };

 // Set up temp history dir
 testDir = join(tmpdir(), `spawn-list-table-test-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `.spawn-test-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 process.env.SPAWN_HOME = testDir;
 });
Expand Down

4 changes: 2 additions & 2 deletions
cli/src/__tests__/resolve-list-filters.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
import { describe, it, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
import { existsSync, mkdirSync, rmSync, writeFileSync } from "fs";
import { join } from "path";
import { tmpdir } from "os";
import { homedir } from "os";
import { createMockManifest, createConsoleMocks, restoreMocks } from "./test-helpers";
import { loadManifest, _resetCacheForTesting } from "../manifest";
import type { SpawnRecord } from "../history";
Expand DownExpand Up@@ -459,7 +459,7 @@ describe("cmdList integration with filter resolution", () => {
 let processExitSpy: ReturnType<typeof spyOn>;

 beforeEach(async () => {
 testDir = join(tmpdir(), `spawn-resolve-list-${Date.now()}-${Math.random()}`);
 testDir = join(homedir(), `spawn-resolve-list-${Date.now()}-${Math.random()}`);
 mkdirSync(testDir, { recursive: true });
 cacheDir = join(testDir, "cache");
 mkdirSync(cacheDir, { recursive: true });
Expand Down
Loading
Loading