open/config-audit
1
0
Fork 0
Code Issues Releases 2 Activity

test: isolate HOME in all CLI-spawning tests (close leak class)

Browse source 
Follow-up to the posture-grade-stability fix in 66433fe. Audited every
test that spawns a CLI and found more of the same class: tests running
HOME-scoped scanners (SKL/COL) or the CLAUDE.md cascade against the
developer's real ~/.claude instead of an isolated HOME.

Fixed (env: hermeticEnv()):
- posture.test.mjs        — runs full posture (SKL/COL/cascade); twin of
                            the posture-grade-stability leak, masked only
                            because its asserts are structural/relative
- drift-cli.test.mjs      — ACTIVE bug: the CLI wrote baselines into the
                            real ~/.claude during the run (pollution); now
                            isolated, and afterEach cleanup wrapped in
                            withHermeticHome so it looks in the same HOME
- token-hotspots-cli.test.mjs — scan-orchestrator run executes SKL/COL on
                            real HOME; TOK reads the HOME cascade
- accurate-tokens.test.mjs — TOK reads the HOME cascade (kept the
                            ANTHROPIC_API_KEY deletion)

Proven safe, left as-is (no HOME-scoped scan affecting assertions, no
HOME writes): post-edit-verify.test.mjs (fast-path early-returns only),
fix-cli.test.mjs (output byte-identical real vs empty HOME — fixable
findings are project-local HKV/RUL/SET, never SKL/COL),
lint-default-output (caller already uses withHermeticHome).

Suite 875/875, no snapshot drift. No test regressed under isolation,
confirming none had a hidden real-HOME dependency.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8
This commit is contained in:
Kjell Tore Guttormsen 2026-06-18 18:17:09 +02:00
commit 325182ddc9
4 changed files with 34 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

5
tests/scanners/accurate-tokens.test.mjs
View file

@ -4,6 +4,7 @@ import { resolve } from 'node:path';
import { fileURLToPath } from 'node:url';
import { execFile } from 'node:child_process';
import { promisify } from 'node:util';
import { hermeticEnv } from '../helpers/hermetic-home.mjs';
const exec = promisify(execFile);
const __dirname = fileURLToPath(new URL('.', import.meta.url));
@ -14,7 +15,8 @@ const FIXTURE = resolve(REPO, 'tests/fixtures/marketplace-large');
describe('--accurate-tokens (no API key)', () => {
it('skips API calibration and reports calibration.skipped === "no-api-key"', async () => {
const env = { ...process.env };
// Isolate HOME (TOK reads the CLAUDE.md cascade) while dropping the API key.
const env = hermeticEnv();
delete env.ANTHROPIC_API_KEY;
const { stdout, stderr } = await exec(
'node',
@ -30,6 +32,7 @@ describe('--accurate-tokens (no API key)', () => {
const { stdout } = await exec('node', [CLI, FIXTURE, '--json'], {
timeout: 30000,
cwd: REPO,
env: hermeticEnv(),
});
const json = JSON.parse(stdout);
assert.equal(json.calibration, undefined);