* test(#3055): add the process seam and route runGsdTools through it Adds tests/helpers/process-seam.cjs — runNode/runGit/runHook over spawnSync, each returning a typed discriminated union { outcome, exitCode, stdout, stderr, timedOut, signal, killed, code }. Every call is timeout-bounded; there is no unbounded path. runGsdTools becomes an adapter over the seam. Its legacy { success, output, error, exitCode } shape and retry-once-on-kill behaviour are preserved byte-identically, so none of its 136 caller files change. Outcome discrimination was corrected against probed runtime behaviour rather than assumption: a timeout and a maxBuffer overflow are identical on both status (null) and signal (SIGTERM), and differ only by code (ETIMEDOUT vs ENOBUFS). Overflow is therefore classified before timeout. This fixes a live defect — the previous isKilled() treated an overflow as a kill, retried it for a second full 60s run, and then reported "host OOM or scheduler contention" for a child that had merely printed too much. Also widens the ESLint tests glob from tests/**/*.test.cjs to tests/**/*.cjs, which brought 31 previously unlinted shared helpers under the same rules their sibling test files already obey, and fixes the 5 violations that surfaced — including a bare npm invocation without shell:true in tests/helpers/emitted-runtime.cjs (DEFECT.WINDOWS-TEST-PORTABILITY), now routed through the existing portable runNpm helper. Refs #3051 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * test(#3055): migrate every local spawn wrapper onto the process seam Replaces the spawn body of all 25 local runHook/runGuard/runGate definitions with a call to tests/helpers/process-seam.cjs. Each wrapper keeps its name, parameter list, return shape and post-processing (JSON parse, ANSI strip, env sanitising, field extraction) — only the spawn mechanism changes, so no test assertion moves. The 4 bash-driven wrappers use the seam's explicit `interpreter` option rather than a fourth primitive; it is explicit rather than inferred from the file extension, because guessing an interpreter from a path fails silently when a script's name does not match its shebang. Seven wrappers were previously unbounded and now carry an explicit timeout sized to what each actually runs, not the seam default. Two of those seven (gsd-write-guard, lint-docs-command-form) were absent from the issue's inventory entirely and were found by scanning after the migration. Adds the CONTEXT.md `### Process seam` glossary entry and a CONTRIBUTING.md reference section covering the three primitives, the discriminated union, and the two rules the seam enforces. Scope disclosure recorded in the phase design notes: the issue scoped three identifier names. A scan for local helpers that spawn AND return the spawn result finds 113 across 82 names, 71 of them unbounded, plus 122 unbounded direct git call sites. This change bounds 25 of those. The remaining surface is the same defect class and is NOT closed by this PR. Refs #3051 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(#3055): classify an externally-killed child as KILLED, not EXITED Blocker found in this branch's own diff, independently confirmed by an isolated reviewer. A child killed by an external signal — a genuine bench OOM kill — makes spawnSync return { status: null, signal: 'SIGKILL' } with NO .error field. The seam's "no error implies EXITED" rule therefore classified it as a clean exit, and runGsdTools returned { success: false, exitCode: 1 } without retrying. That silently defeated the #969 kill-discrimination for precisely the case it was built for: the old isKilled() fired on `signal != null`, retried once, then threw a labelled resource-starvation error. A real OOM would have been reported as an ordinary assertion failure. Adds a fifth outcome, KILLED, for "no error but a signal is set", and makes the adapter retry on TIMED_OUT or KILLED — reproducing the old `killed || signal != null || code === 'ETIMEDOUT'` condition exactly. SPAWN_FAILED still does not retry (matching the old behaviour, where signal was null). BUFFER_OVERFLOW still does not retry, which remains a deliberate divergence: the old code retried it because signal was SIGTERM, burning a second 60s run on a child that had merely printed too much. All five outcomes verified against the live runtime rather than assumed: SIGKILL -> killed, exit 0/7 -> exited, timeout -> timed_out (ETIMEDOUT), >1MB stdout -> buffer_overflow (ENOBUFS). Refs #3051 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(#3055): address standards-review findings on this branch Three findings from the standards axis of the review, all in this branch's own diff. The CONTEXT.md glossary entry this branch introduced was already stale on the branch's own last commit: it enumerated a 4-member OUTCOME while the code had 5, because the KILLED fix did not update it. That is precisely the drift the "module changes update Domain-terms" gate exists to catch, so the entry now lists all five and explains KILLED. api-coverage-gate-e2e compared an outcome against the raw string 'exited' rather than OUTCOME.EXITED, the only such outlier; the enum is now imported and used. A sweep for the other four outcome literals found no further comparison sites. Three call sites hand the literal bash flag '-c' to the seam's first parameter, which the JSDoc described as an absolute script path. Rather than add a fourth primitive, the contract is corrected to match reality: the parameter is renamed `target` and documented as the first argv element handed to the interpreter — normally a script path, but for an interpreter invoked with an inline program it may be that interpreter's own flag. No behaviour change. Refs #3051 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * test(#3055): assert the cross-platform timeout contract, not the macOS one The remote runner failed on both Linux lanes (node 22 and node 24, identical) while the same tests passed locally on macOS. Two assertions encoded a platform-specific behaviour as a cross-platform guarantee. When spawnSync times out, macOS preserves the child's partial stdout/stderr; Linux discards it and returns empty strings. Verified on node v26.5.1 both ways. The seam passes through whatever spawnSync hands it and cannot manufacture output that was discarded, so the production code was correct — the tests were wrong. Both tests now assert the guarantee the seam actually makes on every platform: outcome TIMED_OUT, timedOut true, and stdout/stderr always being strings rather than undefined or a Buffer. The partial-content assertions are retained behind an explicit process.platform === 'darwin' guard so the macOS coverage is not lost, and the first test is renamed to say what it now guarantees. This is the failure mode the remote matrix exists to catch: local macOS verification would have shipped it. Refs #3051 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(#3055): classify a failed spawn as SPAWN_FAILED, not a timeout Windows CI caught two defects the Linux matrix could not. tests/context-predicates-query.test.cjs passes a 32K-char argv value. On Windows that exceeds the argv limit and spawnSync fails with code ENAMETOOLONG, signal null, status null. The seam's fallback rule — "otherwise, status === null implies TIMED_OUT" — swallowed it, so the adapter retried a spawn that can never succeed and then threw the resource-starvation error. The old isKilled() returned false for that shape and returned an ordinary failure result. TIMED_OUT is now identified positively: code === 'ETIMEDOUT' OR signal is set. Anything else carrying an error is SPAWN_FAILED, which covers ENAMETOOLONG, E2BIG, EACCES and ENOENT alike. The signal clause is what keeps a platform whose timeout errno differs classified correctly, so the greedy catch-all is no longer needed. The second defect is a contract regression I introduced and had claimed otherwise. That same test asserts `typeof r.exitCode === 'number'`, and toLegacyShape was returning null for BUFFER_OVERFLOW and SPAWN_FAILED, so the assertion failed on type. The old code returned `err.status ?? 1` on every non-retried failure path. The adapter now returns 1 again for both, and the comment claiming "never coerced to exitCode:1, unlike the pre-seam helper" is retracted: the seam keeps the richer truth (exitCode null plus a distinct outcome), the legacy adapter keeps the old numeric contract its callers actually depend on. Verified on this host: a 4MB argv yields E2BIG -> SPAWN_FAILED; ENOENT -> SPAWN_FAILED; timeout -> TIMED_OUT; >1MB stdout -> BUFFER_OVERFLOW; SIGKILL -> KILLED; clean exit -> EXITED. Refs #3051 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: sim <sim@local> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
183 lines
7.7 KiB
JavaScript
183 lines
7.7 KiB
JavaScript
'use strict';
|
|
|
|
/**
|
|
* TDD tests for scripts/lint-legacy-dir-name.cjs.
|
|
*
|
|
* Uses spawnSync to invoke the guard script against a temporary git repo
|
|
* so we can inject fixtures without touching the real repo.
|
|
*/
|
|
|
|
const { describe, test } = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const { execFileSync } = require('node:child_process');
|
|
const fs = require('node:fs');
|
|
const os = require('node:os');
|
|
const path = require('node:path');
|
|
const { runNode } = require('./helpers/process-seam.cjs');
|
|
|
|
const GUARD_SCRIPT = path.resolve(__dirname, '..', 'scripts', 'lint-legacy-dir-name.cjs');
|
|
|
|
// The guard itself does trivial work here (git ls-files against a 1-2 file
|
|
// fixture repo, then a per-line regex scan), but it shells out to `git` as a
|
|
// real subprocess and this call previously had NO timeout at all (unbounded
|
|
// spawnSync). The seam requires an explicit bound, so pick one generous
|
|
// enough to absorb a slow/contended CI runner's process-spawn and git-init
|
|
// overhead without masking a genuine hang: 30s, matching the timeout this
|
|
// suite already uses for the sibling check-npm-integrity.cjs script
|
|
// invocation in tests/npm-integrity-gate.test.cjs (also a small-fixture,
|
|
// single-subprocess CLI script).
|
|
const GUARD_TIMEOUT_MS = 30_000;
|
|
|
|
function createTempRepo() {
|
|
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gsd-lint-legacy-test-'));
|
|
execFileSync('git', ['init', '--initial-branch=main'], { cwd: dir });
|
|
execFileSync('git', ['config', 'user.email', 'test@example.com'], { cwd: dir });
|
|
execFileSync('git', ['config', 'user.name', 'Test'], { cwd: dir });
|
|
return dir;
|
|
}
|
|
|
|
function writeFile(dir, relPath, content) {
|
|
const fullPath = path.join(dir, relPath);
|
|
fs.mkdirSync(path.dirname(fullPath), { recursive: true });
|
|
fs.writeFileSync(fullPath, content, 'utf8');
|
|
}
|
|
|
|
function gitAdd(dir, relPath) {
|
|
execFileSync('git', ['add', relPath], { cwd: dir });
|
|
}
|
|
|
|
function cleanup(dir) {
|
|
// eslint-disable-next-line local/no-raw-rmsync-in-tests -- local cleanup in lint test; no helpers import available
|
|
fs.rmSync(dir, { recursive: true, force: true });
|
|
}
|
|
|
|
function runGuard(cwd) {
|
|
// Invoke the guard script with the REPO_ROOT overridden via cwd.
|
|
// The guard uses path.resolve(__dirname, '..') as REPO_ROOT, but we need
|
|
// it to operate on our fixture repo. We achieve this by temporarily
|
|
// injecting a wrapper that adjusts the module resolution.
|
|
//
|
|
// Simpler: run as a child process with the --cwd trick is not available for
|
|
// scripts. Instead we pass the fixture dir path as an env var that the guard
|
|
// can use to override REPO_ROOT when present.
|
|
const r = runNode([GUARD_SCRIPT], {
|
|
cwd,
|
|
env: { ...process.env, GSD_LINT_LEGACY_REPO_ROOT: cwd },
|
|
timeoutMs: GUARD_TIMEOUT_MS,
|
|
});
|
|
return { status: r.exitCode, stdout: r.stdout, stderr: r.stderr };
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// The guard script needs to respect GSD_LINT_LEGACY_REPO_ROOT for testing.
|
|
// We check how the script is designed and decide if we need a wrapper approach.
|
|
// Read the script to see if it already uses the env var, or patch inline.
|
|
// ---------------------------------------------------------------------------
|
|
|
|
// Since the guard script uses path.resolve(__dirname, '..') as REPO_ROOT,
|
|
// we cannot override it without modifying the script. Instead, run the guard
|
|
// against the real repo (which should be clean) for Case 1, and test
|
|
// individual detection logic by creating fixture files in the actual repo
|
|
// in a tracked-but-not-committed state... but git ls-files only shows
|
|
// tracked (committed/staged) files.
|
|
//
|
|
// The cleanest approach: create a wrapper that sets REPO_ROOT via env var
|
|
// and a thin shim. Let's use a different strategy: write the fixture to a
|
|
// temp dir, initialize a git repo there, and run the guard with an
|
|
// explicit --repo-root flag override.
|
|
//
|
|
// Since the script does not support --repo-root, we create a tiny shim that
|
|
// requires the real script after patching __dirname. This is a common test
|
|
// pattern for such scripts.
|
|
//
|
|
// Simplest testable approach: run the script in the REAL repo dir (which is
|
|
// clean) for Case 1, and for Cases 2-4 write temporary files to the real
|
|
// tracked repo's working tree, git-add them, run, then delete + git-reset.
|
|
// BUT that is too invasive.
|
|
//
|
|
// The correct approach: the guard needs to support an override. Since we own
|
|
// the guard, add GSD_LINT_LEGACY_REPO_ROOT env var support to it. We test
|
|
// against that.
|
|
|
|
// *** Re-reading the guard script: it uses path.resolve(__dirname, '..')
|
|
// for REPO_ROOT. We will modify the guard to support the env var override
|
|
// for testability, which is standard for lint script testing in this repo.
|
|
|
|
// Let's check: does the guard script support the env var?
|
|
// Since we wrote it without env var support, and this test expects it,
|
|
// we need to add the env var support to the guard first.
|
|
// (This test file will be the spec that drives us to add it.)
|
|
|
|
describe('lint-legacy-dir-name — clean repo', () => {
|
|
test('exits 0 on a clean temporary repo with no forbidden token', () => {
|
|
const dir = createTempRepo();
|
|
try {
|
|
writeFile(dir, 'README.md', '# My Project\n\nThis is gsd-core.\n');
|
|
writeFile(dir, 'src/index.js', 'module.exports = {};\n');
|
|
gitAdd(dir, 'README.md');
|
|
gitAdd(dir, 'src/index.js');
|
|
|
|
const result = runGuard(dir);
|
|
assert.equal(result.status, 0, `expected exit 0, got ${result.status}; stderr: ${result.stderr}`);
|
|
assert.ok(result.stdout.includes('0 violations'), `stdout: ${result.stdout}`);
|
|
} finally {
|
|
cleanup(dir);
|
|
}
|
|
});
|
|
});
|
|
|
|
describe('lint-legacy-dir-name — bare forbidden token detected', () => {
|
|
test('exits 1 when a tracked file contains the bare forbidden token', () => {
|
|
const dir = createTempRepo();
|
|
try {
|
|
// Construct the forbidden string without putting it in a literal that the
|
|
// guard would catch in this test file itself:
|
|
const bare = 'get-shit' + '-done'; // the bare directory token
|
|
writeFile(dir, 'src/config.js', `const dir = '${bare}';\n`);
|
|
gitAdd(dir, 'src/config.js');
|
|
|
|
const result = runGuard(dir);
|
|
assert.equal(result.status, 1, `expected exit 1, got ${result.status}; stdout: ${result.stdout}`);
|
|
assert.ok(result.stderr.includes('1 violation'), `stderr: ${result.stderr}`);
|
|
assert.ok(result.stderr.includes('src/config.js'), `stderr should name the file: ${result.stderr}`);
|
|
} finally {
|
|
cleanup(dir);
|
|
}
|
|
});
|
|
});
|
|
|
|
describe('lint-legacy-dir-name — slug variant allowed', () => {
|
|
test('exits 0 when token is a hyphenated slug variant (not bare)', () => {
|
|
const dir = createTempRepo();
|
|
try {
|
|
// Slug variants like get-shit-done-redux, get-shit-done-cli should be allowed.
|
|
// Construct without creating a bare literal:
|
|
const slugVariant = 'get-shit' + '-done-redux';
|
|
writeFile(dir, 'src/legacy.js', `const old = '${slugVariant}';\n`);
|
|
gitAdd(dir, 'src/legacy.js');
|
|
|
|
const result = runGuard(dir);
|
|
assert.equal(result.status, 0, `expected exit 0 for slug variant, got ${result.status}; stderr: ${result.stderr}`);
|
|
} finally {
|
|
cleanup(dir);
|
|
}
|
|
});
|
|
});
|
|
|
|
describe('lint-legacy-dir-name — gsd-allow-legacy-name marker', () => {
|
|
test('exits 0 when forbidden token is on a line with the allow marker', () => {
|
|
const dir = createTempRepo();
|
|
try {
|
|
const bare = 'get-shit' + '-done';
|
|
// Line contains the token BUT also the allow marker.
|
|
writeFile(dir, 'src/migration.js', `const legacyRoot = '${bare}'; // gsd-allow-legacy-name\n`);
|
|
gitAdd(dir, 'src/migration.js');
|
|
|
|
const result = runGuard(dir);
|
|
assert.equal(result.status, 0, `expected exit 0 with allow marker, got ${result.status}; stderr: ${result.stderr}`);
|
|
} finally {
|
|
cleanup(dir);
|
|
}
|
|
});
|
|
});
|