Restrict package-script trimming to ASCII whitespace

CHANGELOG.md

@@ -6,6 +6,7 @@ All notable changes are documented here. This project follows Semantic Versionin
 
 ### Fixed
 
+- Restricted recognized Node/Jest/Vitest package-script trimming to ASCII spaces and tabs. JavaScript `String.trim()` also removes non-ASCII whitespace such as NBSP, which shells do not treat as ordinary script separators; leading or trailing Unicode whitespace can therefore no longer be erased into a different executable command and accidentally qualify for exact targeted evidence.
 - Stopped `.pyi` stub files with test-like names from inventing executable pytest or `unittest` checks. Stubs remain available to static Python analysis and relationship discovery, but framework discovery now requires an executable `.py` test file; this prevents `--run-checks` from launching a Python test runner merely because a repository contains test-shaped type stubs.
 - Updated current stable Action guidance and the published-Action CI smoke from v0.5.2 to the already-released v0.5.3 snapshot, including the immutable full-SHA pin, so documentation and release verification no longer lag the latest public release.
 

src/checks.ts

@@ -241,7 +241,7 @@ function classifyScript(name: string): CheckDefinition["kind"] | null {
 function targetingForScript(kind: CheckDefinition["kind"], command: string): Pick<CheckDefinition, "targetRunner" | "targetRunnerArgs" | "targetPattern" | "targetPatterns"> | null {
   if (kind !== "test") return null;
   if (/[\r\n]/.test(command)) return null;
-  const normalized = command.trim().replaceAll(/[ \t]+/g, " ");
+  const normalized = command.replace(/^[ \t]+|[ \t]+$/g, "").replaceAll(/[ \t]+/g, " ");
   const invocation = normalized.match(/^(?:node|node\.exe) --test(?: (.+))?$/);
   if (!invocation) return null;
   const runnerArgs: string[] = [];

src/js-runners.ts

@@ -35,7 +35,7 @@ function safeEnvironmentAssignment(token: string): [name: string, value: string]
 
 function recognizedRunnerScript(command: string): RecognizedRunnerScript | null {
   if (/[\r\n]/.test(command)) return null;
-  const tokens = command.trim().replaceAll(/[ \t]+/g, " ").split(" ").filter(Boolean);
+  const tokens = command.replace(/^[ \t]+|[ \t]+$/g, "").replaceAll(/[ \t]+/g, " ").split(" ").filter(Boolean);
   if (tokens.length === 0) return null;
 
   let index = 0;

tests/checks.test.ts

@@ -129,6 +129,24 @@ test("targeted execution rejects symbolic-link test paths", { skip: process.plat
   assert.deepEqual(targeted.checks, []);
 });
 
+test("Node targeted discovery trims only ASCII space and tab around scripts", async (context) => {
+  const root = await initializeRepository({
+    "package.json": JSON.stringify({ scripts: {
+      test: " \tnode --test\t ",
+      "test:unit": "\u00a0node --test",
+      "test:ci": "node --test\u00a0",
+    } }),
+    "test/value.test.js": "import test from 'node:test'; test('value', () => {});\n",
+  });
+  context.after(() => rm(root, { recursive: true, force: true }));
+
+  const { checks } = await discoverChecks(root);
+  assert.equal(checks.find((check) => check.id === "js:test:test")?.targetRunner, "node-test");
+  assert.equal(checks.find((check) => check.id === "js:test:test:unit")?.targetRunner, undefined);
+  assert.equal(checks.find((check) => check.id === "js:test:test:ci")?.targetRunner, undefined);
+  assert.deepEqual((await targetedTestChecks(root, checks, ["test/value.test.js"])).checks.map((check) => check.id), ["js:test:test:targeted"]);
+});
+
 test("Node targeted discovery rejects command-chain prefixes", async (context) => {
   const root = await initializeRepository({
     "package.json": JSON.stringify({ scripts: {

tests/js-runners.test.ts

@@ -91,7 +91,7 @@ test("literal environment prefixes are preserved for targeted Jest execution", a
 if (process.env.NODE_ENV !== "test" || process.env.CI !== "1") process.exit(7);
 ` + JEST_BIN;
   const root = await initializeRepository({
-    "package.json": JSON.stringify({ scripts: { test: "NODE_ENV=test CI=1 jest --ci" } }),
+    "package.json": JSON.stringify({ scripts: { test: " \tNODE_ENV=test CI=1 jest --ci\t " } }),
     "test/env.test.js": "export const env = true;\n",
     "node_modules/jest/package.json": JSON.stringify({ bin: { jest: "./bin/jest.cjs" } }),
     "node_modules/jest/bin/jest.cjs": envAwareJest,
@@ -212,6 +212,8 @@ test("unsafe Jest and Vitest script shapes are individually exercised and stay o
     { label: "too many environment assignments", script: "A=1 B=2 C=3 D=4 E=5 jest" },
     { label: "duplicate environment assignment", script: "CI=1 CI=true jest" },
     { label: "non-ASCII whitespace", script: "jest\u00a0--ci" },
+    { label: "leading non-ASCII whitespace", script: "\u00a0jest --ci" },
+    { label: "trailing non-ASCII whitespace", script: "jest --ci\u00a0" },
   ];
 
   for (const { label, script } of cases) {