stack6:feat: add git sync, telemetry, and ui command updates

cli/README.md

@@ -247,10 +247,16 @@ notifications:
   discord_webhook: "https://discord.com/api/webhooks/..."
   slack_webhook: "https://hooks.slack.com/services/..."
   custom_webhook: "https://your-api.com/webhook"
+  telemetry_webhook: "https://your-api.com/telemetry"  # optional
 ```
 
 Notifications include task completion counts and status (completed/failed).
 
+Webhook safety:
+- Only `https://` webhook URLs are accepted.
+- Localhost/private IP targets are blocked, including DNS-resolved internal addresses.
+- URL credentials are rejected.
+
 ## Sandbox Mode
 
 For large repos with big dependency directories, sandbox mode is faster than git worktrees:

cli/__tests__/json-validation.test.ts

@@ -0,0 +1,157 @@
+import { describe, expect, it } from "bun:test";
+import {
+	ErrorSchema,
+	ResultSchema,
+	StepFinishSchema,
+	TextSchema,
+	extractSessionId,
+	parseJsonLine,
+} from "../src/utils/json-validation";
+
+describe("JSON Validation", () => {
+	describe("parseJsonLine", () => {
+		it("should parse valid StepFinish event", () => {
+			const line = JSON.stringify({
+				type: "step_finish",
+				part: {
+					tokens: {
+						input: 100,
+						output: 200,
+					},
+				},
+			});
+			const result = parseJsonLine(line);
+			expect(result).not.toBeNull();
+			const stepFinish = StepFinishSchema.safeParse(result?.event);
+			expect(stepFinish.success).toBe(true);
+			if (stepFinish.success) {
+				expect(stepFinish.data.type).toBe("step_finish");
+			}
+		});
+
+		it("should parse valid Text event", () => {
+			const line = JSON.stringify({
+				type: "text",
+				part: {
+					text: "Test response",
+				},
+			});
+			const result = parseJsonLine(line);
+			expect(result).not.toBeNull();
+			const textEvent = TextSchema.safeParse(result?.event);
+			expect(textEvent.success).toBe(true);
+			if (textEvent.success) {
+				expect(textEvent.data.type).toBe("text");
+				expect(textEvent.data.part.text).toBe("Test response");
+			}
+		});
+
+		it("should parse valid Error event", () => {
+			const line = JSON.stringify({
+				type: "error",
+				error: {
+					message: "Test error",
+				},
+			});
+			const result = parseJsonLine(line);
+			expect(result).not.toBeNull();
+			const errorEvent = ErrorSchema.safeParse(result?.event);
+			expect(errorEvent.success).toBe(true);
+			if (errorEvent.success) {
+				expect(errorEvent.data.type).toBe("error");
+			}
+		});
+
+		it("should parse valid Result event", () => {
+			const line = JSON.stringify({
+				type: "result",
+				result: "Task completed",
+				usage: {
+					input_tokens: 100,
+					output_tokens: 200,
+				},
+			});
+			const result = parseJsonLine(line);
+			expect(result).not.toBeNull();
+			const resultEvent = ResultSchema.safeParse(result?.event);
+			expect(resultEvent.success).toBe(true);
+			if (resultEvent.success) {
+				expect(resultEvent.data.type).toBe("result");
+			}
+		});
+
+		it("should return null for invalid JSON", () => {
+			const result = parseJsonLine("not valid json");
+			expect(result).toBeNull();
+		});
+
+		it("should return null for empty string", () => {
+			const result = parseJsonLine("");
+			expect(result).toBeNull();
+		});
+
+		it("should return null for non-object JSON", () => {
+			const result = parseJsonLine(JSON.stringify("string"));
+			expect(result).toBeNull();
+		});
+
+		it("should return null for invalid schema", () => {
+			const line = JSON.stringify({
+				type: "invalid_type",
+				data: "test",
+			});
+			const result = parseJsonLine(line);
+			expect(result).toBeNull();
+		});
+	});
+
+	describe("extractSessionId", () => {
+		it("should extract sessionID (camelCase)", () => {
+			const event = {
+				type: "text",
+				sessionID: "session-123",
+			} as { type: string; sessionID?: string };
+			const sessionId = extractSessionId(event);
+			expect(sessionId).toBe("session-123");
+		});
+
+		it("should extract sessionId (camelCase variant)", () => {
+			const event = {
+				type: "text",
+				sessionId: "session-456",
+			} as { type: string; sessionId?: string };
+			const sessionId = extractSessionId(event);
+			expect(sessionId).toBe("session-456");
+		});
+
+		it("should extract session_id (snake_case)", () => {
+			const event = {
+				type: "text",
+				session_id: "session-789",
+			} as { type: string; session_id?: string };
+			const sessionId = extractSessionId(event);
+			expect(sessionId).toBe("session-789");
+		});
+
+		it("should return null when no session ID present", () => {
+			const event = {
+				type: "text",
+				part: {
+					text: "test",
+				},
+			} as { type: string; part?: { text?: string } };
+			const sessionId = extractSessionId(event);
+			expect(sessionId).toBeNull();
+		});
+
+		it("should prioritize sessionID over sessionId", () => {
+			const event = {
+				type: "text",
+				sessionID: "session-1",
+				sessionId: "session-2",
+			} as { type: string; sessionID?: string; sessionId?: string };
+			const sessionId = extractSessionId(event);
+			expect(sessionId).toBe("session-1");
+		});
+	});
+});

cli/__tests__/run-tests.test.ts

@@ -0,0 +1,70 @@
+#!/usr/bin/env bun
+
+/**
+ * Comprehensive test runner for all sandbox and security fixes
+ */
+
+import { spawn } from "bun";
+
+const testFiles = ["__tests__/sandbox-security.test.ts", "__tests__/locking-security.test.ts"];
+
+console.log("🧪 Running Security and Reliability Tests...\n");
+
+async function runTestFile(testFile: string) {
+	console.log(`\n📋 Running ${testFile}...`);
+
+	try {
+		const childProcess = spawn(["bun", "test", testFile], {
+			stdout: "inherit",
+			stderr: "inherit",
+			cwd: process.cwd(),
+		});
+
+		const exitCode = await childProcess.exited;
+
+		if (exitCode === 0) {
+			console.log(`✅ ${testFile} - PASSED`);
+		} else {
+			console.log(`❌ ${testFile} - FAILED (exit code: ${exitCode})`);
+			return false;
+		}
+	} catch (error) {
+		console.log(`💥 ${testFile} - ERROR: ${error}`);
+		return false;
+	}
+
+	return true;
+}
+
+async function main() {
+	const startTime = Date.now();
+	let allPassed = true;
+
+	for (const testFile of testFiles) {
+		const passed = await runTestFile(testFile);
+		if (!passed) {
+			allPassed = false;
+		}
+	}
+
+	const endTime = Date.now();
+	const duration = endTime - startTime;
+
+	console.log(`\n${"=".repeat(50)}`);
+	console.log("📊 Test Summary:");
+	console.log(`⏱️  Duration: ${Math.round(duration / 1000)}s`);
+	console.log(`📁  Status: ${allPassed ? "ALL TESTS PASSED ✅" : "SOME TESTS FAILED ❌"}`);
+
+	if (allPassed) {
+		console.log("\n🎉 All security and reliability tests passed!");
+		process.exit(0);
+	} else {
+		console.log("\n🚨 Some tests failed. Please review the output above.");
+		process.exit(1);
+	}
+}
+
+main().catch((error) => {
+	console.error("💥 Test runner failed:", error);
+	process.exit(1);
+});