Files
msd-core/tests/close-phase-todos-padded-resolves.test.cjs
Tom Boucher 9faacc0c15 test(#3148): bound the long tail and delete the unbounded-spawn allowlist (#3192)
* test(#3148): bound the long tail and delete the allowlist

Migrates the final 170 unbounded sync spawn sites across 49 files, then
removes the allowlist entirely. local/no-unbounded-spawn now runs with no
exemption surface across tests/**: there is no file to add a name to.

drift-detection's throw-native git() helper routes to gitOrThrow -- bare
runGit would have taken 16 call sites quiet on failure. commands.test.cjs
has two independently-scoped runGsdTools/runCli helpers, one already bounded
and one not; they are kept distinct rather than unified, the same trap as the
two same-named git() helpers in Wave 1.

runNpm's bound was erasable. Its options spread callerOptions after the
defaults, so an explicit timeout:undefined silently dropped the 180000ms
bound -- the rule flagged it and was right; it was not a false positive. Fixed
by destructuring with a default, with a test that fails when the default is
removed.

Two sites stay on a raw spawn with an explicit timeout because the seam
cannot express them: one needs shell:true for npm.cmd on Windows, one
redirects stdout to a real fd. Both are the rule's own documented second
option, not an escape from it.

Closure verified rather than asserted: the derivation scan reports 0 unbounded
spawn helpers and 0 unbounded direct git call sites, and a temporary file
carrying an unbounded spawn still errors with the allowlist gone.

Closes #3064.

* test(#3148): close a hole in the guard's own eslint-disable ban

The ban listed only the top level of tests/, so it was blind to 37 .cjs
files under tests/helpers, qa, observability, fixtures and dispatch. With the
allowlist deleted this test is the sole remaining way to detect someone
silencing the rule inline, so the gap was load-bearing: a nested file could
carry an unbounded spawn plus an eslint-disable and pass everything.

Proven before and after. A probe planted under tests/helpers with both was
invisible to the guard and clean under eslint; after making the listing
recursive the guard fails on it. The scanned set goes from 771 files to 808.

Pre-existing since the guard shipped, but this wave is what promoted it to
sole defense, so it is fixed here rather than filed.

Also converts the last hand-rolled throw check to throwIfFailed and the last
re-derived legacy shape to compose toLegacyResult, which makes the epic's
none-remain claim true rather than nearly true. toLegacyResult itself is not
widened -- eight callers depend on its shape and one consumer does not
justify changing a shared contract.

* fix(#3148): correct seam incoherence at the bound and a slow review-lane error path

Two real failures from the remote runner, both fixed at the cause.

The seam could return outcome TIMED_OUT together with exitCode 0. At the
exact bound spawnSync reports ETIMEDOUT while the child has already exited
with a real status, and toSeamResult classified on the error code while
passing status straight through -- an incoherent pair its own boundary test
was written to catch, and did. A status that is not null is direct evidence
the child exited on its own, so it now decides the outcome before the
error-code branches run. process-seam.cjs was deliberately untouched by every
earlier wave; this is a defect in the module itself, kept surgical, with a
unit test that fails against the old logic.

review-lane with an unknown subcommand fell through to its usage error only
after loading the capability registry and building a per-lane plan, which
spawns one child process per lane -- up to twelve. The error path took
~1288ms instead of ~119ms, and under bench load it outran a caller's spawn
timeout and was killed before writing anything, which is the empty stdout and
stderr CI saw. It now fails fast before any of that work begins.

This is the epic's first production change. It is user-facing, so it carries
a changeset rather than a no-changelog label.

* test(#3148): replace a real-race timeout test with a deterministic one

E9 raced git rev-parse against a 1ms bound and assumed git always lost. On a
warm container git finishes first, spawnSync returns status 0 with no error
at all, the seam correctly classifies EXITED, and gitOrThrow correctly does
not throw -- so the test failed on both lanes. A probe confirms a genuine
timeout always carries status null, so this was never the seam misbehaving.

Raising the bound would only lengthen the odds, which is the same defect with
better luck. The test now drives gitOrThrow against a stubbed runGit that
returns a synthetic TIMED_OUT result, so it asserts exactly what it always
meant to -- that a timeout propagates as a throw -- with no timing
dependence. Five consecutive runs are identical where the old one varied.

I wrote this test in Wave 0; it is a real-race test by construction and
CLAUDE.md says to replace those rather than re-run them.

* chore(#3148): backfill changeset PR number 3192

---------

Co-authored-by: sim <sim@local>
2026-08-07 21:03:50 -04:00

184 lines
8.5 KiB
JavaScript

// allow-test-rule: source-text-is-the-product see #2576
// Workflow .md files — their text IS what the runtime loads. Testing text content
// tests the deployed contract. Per CONTRIBUTING.md exception matrix. The behavioral
// cases below also extract the actual bash helper from the workflow text and
// exercise it, so the test is pinned to the deployed logic, not a paraphrase.
'use strict';
const { describe, test } = require('node:test');
const assert = require('node:assert/strict');
const fs = require('node:fs');
const os = require('node:os');
const path = require('node:path');
const { cleanup } = require('./helpers.cjs');
const { runHook } = require('./helpers/process-seam.cjs');
const { throwIfFailed } = require('./helpers/git-fixture.cjs');
const { PROBE_TIMEOUT_MS } = require('./helpers/timeouts.cjs');
const EXECUTE_PHASE = path.join(__dirname, '..', 'gsd-core', 'workflows', 'execute-phase.md');
// Extract the close_phase_todos step body so assertions never match unrelated
// steps elsewhere in the workflow (same isolation pattern as the #2415 test).
function readClosePhaseTodosStep() {
const content = fs.readFileSync(EXECUTE_PHASE, 'utf8');
const stepStart = content.indexOf('<step name="close_phase_todos">');
assert.ok(stepStart > -1, 'close_phase_todos step must exist in execute-phase.md');
const stepEnd = content.indexOf('</step>', stepStart);
assert.ok(stepEnd > stepStart, 'close_phase_todos step must be properly closed');
return content.slice(stepStart, stepEnd);
}
// Strip bash `#` comment lines so doc prose mentioning a name doesn't satisfy a
// structural assertion about the actual command. Same approach as the #2415 test.
function stripBashComments(text) {
return text.replace(/^\s*#.*$/gm, '');
}
describe('#2576: close_phase_todos normalizes padded vs unpadded resolves_phase before comparing', () => {
// ── Structural: the step must normalize BOTH sides of the comparison ──
// The bug was a raw string compare: `[ "$RP" = "$PHASE_NUM" ]`. PHASE_NUM is
// zero-padded ("05") but new-milestone.md writes resolves_phase unpadded ("5"),
// so every single-digit phase silently failed to auto-close its todos.
test('close_phase_todos defines a normalize_phase_num bash helper', () => {
const step = stripBashComments(readClosePhaseTodosStep());
// The helper name documents intent at the call site; pin the name so a future
// contributor cannot quietly revert to a raw compare without renaming it.
assert.match(
step,
/normalize_phase_num\s*\(\)\s*\{/,
'close_phase_todos must define a normalize_phase_num() bash helper'
);
});
test('close_phase_todos normalizes PHASE_NUM into PHASE_NUM_NORM before the loop', () => {
const step = stripBashComments(readClosePhaseTodosStep());
assert.match(
step,
/PHASE_NUM_NORM\s*=\s*\$\(\s*normalize_phase_num\s+"\$PHASE_NUM"\s*\)/,
'PHASE_NUM (zero-padded) must be normalized into PHASE_NUM_NORM once before the loop'
);
});
test('close_phase_todos normalizes the extracted RP into RP_NORM inside the loop', () => {
const step = stripBashComments(readClosePhaseTodosStep());
assert.match(
step,
/RP_NORM\s*=\s*\$\(\s*normalize_phase_num\s+"\$RP"\s*\)/,
'the extracted resolves_phase value (RP) must be normalized into RP_NORM before comparing'
);
});
test('close_phase_todos compares NORMALIZED values (RP_NORM = PHASE_NUM_NORM), not raw strings', () => {
const step = stripBashComments(readClosePhaseTodosStep());
assert.match(
step,
/\[\s*"\$RP_NORM"\s*=\s*"\$PHASE_NUM_NORM"\s*\]/,
'the comparison must be between normalized values: [ "$RP_NORM" = "$PHASE_NUM_NORM" ]'
);
// The #2576 bug itself: the old raw-string compare must NOT remain.
assert.doesNotMatch(
step,
/\[\s*"\$RP"\s*=\s*"\$PHASE_NUM"\s*\]/,
'the raw [ "$RP" = "$PHASE_NUM" ] compare must be gone — it is the #2576 defect'
);
});
test('close_phase_todos guards against empty RP_NORM (missing/blank resolves_phase never matches)', () => {
const step = stripBashComments(readClosePhaseTodosStep());
// A todo with no resolves_phase (or an unparseable one) must NOT match phase 0
// via empty-string equality. The `-n` guard is the defensive seam.
assert.match(
step,
/\[\s*-n\s+"\$RP_NORM"\s*\]/,
'comparison must be guarded by [ -n "$RP_NORM" ] so empty resolves_phase never matches'
);
});
// ── Behavioral: extract the actual helper from the deployed workflow text and
// exercise it against the #2576 acceptance criteria. This pins the test to the
// real logic rather than a paraphrase, and proves the normalization is correct
// for every padded/unpadded pair the bug affected.
function extractNormalizeHelper() {
const step = readClosePhaseTodosStep();
// Match `normalize_phase_num() { ... \n}` up to the first newline-anchored `}`.
// Exact today because no interior line of the helper ends in a bare `}` (they
// end in quotes / then / else / fi). If the helper is ever refactored so an
// interior line ends in `}`, tighten this to a brace-counting parser.
const m = step.match(/normalize_phase_num\s*\(\)\s*\{[\s\S]*?\n\}/);
assert.ok(m, 'normalize_phase_num helper must exist in the step for behavioral extraction');
return m[0];
}
function runHelper(t, input) {
const helper = extractNormalizeHelper();
const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'gsd-2576-'));
t.after(() => cleanup(tmp));
const script = path.join(tmp, 'normalize.sh');
// argv array (no shell string) so a quoted input like '"05"' is passed verbatim.
fs.writeFileSync(script, `${helper}\nnormalize_phase_num "$1"\n`);
const result = runHook(script, [input], { interpreter: 'bash', timeoutMs: PROBE_TIMEOUT_MS });
throwIfFailed(result, `bash ${script} ${input}`);
return result.stdout;
}
// The headline #2576 case: single-digit phase, padded vs unpadded.
test('acceptance: "05" and "5" both normalize to "5" (the reported bug)', (t) => {
assert.equal(runHelper(t, '05'), '5');
assert.equal(runHelper(t, '5'), '5');
assert.equal(runHelper(t, '05'), runHelper(t, '5'));
});
// Acceptance: decimal sub-phases — strip leading zeros from the leading integer
// run only, leave the dotted tail untouched.
test('acceptance: decimal sub-phase "04.1" normalizes to "4.1" (decimal preserved)', (t) => {
assert.equal(runHelper(t, '04.1'), '4.1');
assert.equal(runHelper(t, '4.1'), '4.1');
assert.equal(runHelper(t, '4.1'), runHelper(t, '04.1'));
});
// Acceptance: letter suffixes must compare correctly.
test('acceptance: letter suffix "03A" normalizes to "3A", "12A" stays "12A"', (t) => {
assert.equal(runHelper(t, '03A'), '3A');
assert.equal(runHelper(t, '12A'), '12A');
assert.equal(runHelper(t, '3A'), runHelper(t, '03A'));
});
// Acceptance: the "00"/"0" edge case must compare equal (not collapse to empty).
test('acceptance: "00" and "0" both normalize to "0" (all-zeros collapse to one zero)', (t) => {
assert.equal(runHelper(t, '0'), '0');
assert.equal(runHelper(t, '00'), '0');
assert.equal(runHelper(t, '0'), runHelper(t, '00'));
});
// Acceptance: quoted YAML values ("5") must compare correctly. The helper strips
// surrounding double quotes before normalizing.
test('acceptance: quoted YAML value "5" normalizes to "5" (quotes stripped)', (t) => {
assert.equal(runHelper(t, '"5"'), '5');
assert.equal(runHelper(t, '"05"'), '5');
assert.equal(runHelper(t, '"5"'), runHelper(t, '5'));
});
// Defensive: double-digit phases already matched before the fix; they must still.
test('regression: double-digit "12" stays "12" (no leading zero, no change)', (t) => {
assert.equal(runHelper(t, '12'), '12');
});
// Defensive: arbitrary over-padding (e.g. a hand-edited "012") is tolerated too.
test('defensive: "012" normalizes to "12" (over-padding tolerated beyond the 2-digit convention)', (t) => {
assert.equal(runHelper(t, '012'), '12');
assert.equal(runHelper(t, '12'), runHelper(t, '012'));
});
// Defensive: a blank or non-numeric resolves_phase must not crash and must not
// spuriously match any phase (the `[ -n "$RP_NORM" ]` guard relies on empty out).
test('defensive: empty input returns empty (no crash, no spurious match)', (t) => {
assert.equal(runHelper(t, ''), '');
});
test('defensive: non-numeric "abc" passes through unchanged (will not equal any phase number)', (t) => {
assert.equal(runHelper(t, 'abc'), 'abc');
});
});