Type: build · Size: S (10 TP) · Privacy: P0 · Repo: https://github.com/mxx1111/remote-code-mobile
What needs doing
The README opens with this:
This project is a remote command execution gateway, not an ordinary website. Any client that can reach it may be able to read files, run commands, and use CLI sessions already authenticated as the macOS user running the service.
There is not a single test in the repository. CI runs lint && typecheck && build and npm audit, none of which say anything about behaviour.
server/project-catalog.mjs (81 lines) decides which directories on the host become reachable projects. It has a containment guard on line 46:
const cwd = resolve(join(resolvedRoot, entry.name));
if (!cwd.startsWith(`${resolvedRoot}${sep}`)) return null;That guard, the hidden-directory filter on line 43, and the get() lookup on line 76 are the boundary between "projects the operator meant to expose" and "everything else on the disk". Nothing verifies any of them, so nothing would notice if a refactor quietly removed one.
Write the repository's first tests, covering this file.
中文：README 开宗明义说这是一个远程命令执行网关，不是普通网站。但仓库里一个测试都没有，CI 只跑 lint/typecheck/build 和 npm audit，都不检验行为。server/project-catalog.mjs 决定宿主机上哪些目录会变成可访问的项目，第 46 行的包含性检查、第 43 行的隐藏目录过滤、第 76 行的查找，共同构成「运维者有意暴露的项目」和「磁盘上其他一切」之间的边界。没有任何东西验证它们，所以某次重构悄悄删掉一条也不会有人发现。本任务写下这个仓库的第一批测试，覆盖这个文件。
Acceptance criteria
Notes
node --test is built in and needs no dependency. That is a suggestion; use whatever you would maintain.
shortName and displayPath are not exported. Prefer testing through createProjectCatalog rather than exporting internals just to reach them — the public surface is what the rest of the server actually depends on. If you conclude something genuinely needs exporting, say why in the PR.
displayPath calls homedir(), so avoid assertions that only hold on your own machine.
node --test 是内置的，不需要依赖。这是建议，用你自己愿意维护的即可。
shortName 和 displayPath 没有导出。优先通过 createProjectCatalog 测试，不要为了够到它们而把内部函数导出——服务器其余部分依赖的是公开接口。如果你认为确实有导出的必要，在 PR 里说明理由。
displayPath 会调 homedir()，别写只在你自己机器上成立的断言。
Stack
Node 22, TypeScript + ESM. npm ci then npm run check.
Confirmations
Type: build · Size: S (10 TP) · Privacy: P0 · Repo: https://github.com/mxx1111/remote-code-mobile
What needs doing
The README opens with this:
There is not a single test in the repository. CI runs
lint && typecheck && buildandnpm audit, none of which say anything about behaviour.server/project-catalog.mjs(81 lines) decides which directories on the host become reachable projects. It has a containment guard on line 46:That guard, the hidden-directory filter on line 43, and the
get()lookup on line 76 are the boundary between "projects the operator meant to expose" and "everything else on the disk". Nothing verifies any of them, so nothing would notice if a refactor quietly removed one.Write the repository's first tests, covering this file.
中文：README 开宗明义说这是一个远程命令执行网关，不是普通网站。但仓库里一个测试都没有，CI 只跑 lint/typecheck/build 和 npm audit，都不检验行为。
server/project-catalog.mjs决定宿主机上哪些目录会变成可访问的项目，第 46 行的包含性检查、第 43 行的隐藏目录过滤、第 76 行的查找，共同构成「运维者有意暴露的项目」和「磁盘上其他一切」之间的边界。没有任何东西验证它们，所以某次重构悄悄删掉一条也不会有人发现。本任务写下这个仓库的第一批测试，覆盖这个文件。Acceptance criteria
cwdescapesresolvedRootget()returnsnullfor an unknown idfoldernumeric: truebehaviour (project2beforeproject10)list()does not rescan, andlist({ refresh: true })doesnpm run checkNotes
node --testis built in and needs no dependency. That is a suggestion; use whatever you would maintain.shortNameanddisplayPathare not exported. Prefer testing throughcreateProjectCatalograther than exporting internals just to reach them — the public surface is what the rest of the server actually depends on. If you conclude something genuinely needs exporting, say why in the PR.displayPathcallshomedir(), so avoid assertions that only hold on your own machine.node --test是内置的，不需要依赖。这是建议，用你自己愿意维护的即可。shortName和displayPath没有导出。优先通过createProjectCatalog测试，不要为了够到它们而把内部函数导出——服务器其余部分依赖的是公开接口。如果你认为确实有导出的必要，在 PR 里说明理由。displayPath会调homedir()，别写只在你自己机器上成立的断言。Stack
Node 22, TypeScript + ESM.
npm cithennpm run check.Confirmations