open/config-audit
1
0
Fork 0
Code Issues Releases 1 Activity

feat(scanners): the write gate now runs in code, not in the templates' prose

Browse source 
`write-scope.mjs` has existed since M-BUG-41, but only one writer ever called
it. Measured 2026-08-12: 9 files under `scanners/` write to disk, 1 imported
the gate; 21 command templates, 17 mention a write, 5 call `write-scope-cli`.
Five templates paraphrasing one policy is the shape that put the lever table in
five copies (#61) — one level up.

The defect was never "8 ungated writers = 8 bugs". Four of them write the
plugin's own bookkeeping and must STAY ungated: a gate that fires on every run
gets switched off, and then it guards nothing. The defect is that nothing
declared WHICH, so the question was answered by reading, and answered
differently each time it was asked.

`tests/lib/write-gate-coverage.test.mjs` makes the answer structural: every
writer either imports the gate or holds an EXEMPT entry naming where the bytes
land. Seen RED against today's tree before the fix (4 ungated writers), and
each of its four assertions was separately seen red against its own defect.

Two premises in the plan text were falsified by measuring them first:

  - `scan-orchestrator` was carried as "plugin-managed, legitimately exempt".
    `--save-baseline` derives its path from the SCAN TARGET, so `--global`
    lands `~/.claude/.config-audit-baseline.json` — user-scope, require-ok. It
    is gated. `lib/baseline.mjs` is the genuinely exempt one.
  - the first sweep scored 9 writers with a regex that could not match
    `writeFileSync(`, so `lib/backup.mjs` — a real writer — read as clean. The
    guard covers sync and async forms, strips comments before matching, and
    asserts non-emptiness so a regex that stops matching cannot make every
    other assertion vacuously green (#63, #64).

Gated: fix-engine, rollback-engine, campaign-export-cli, scan-orchestrator.
All five call sites share ONE reduction, `evaluateWriteTargets` — four copies
of classify/strongestGate/dedup is the drift this exists to prevent.

`campaign export` still DISCLOSES rather than refuses: cross-repo is by design
there, and tightening it into a refusal would break the feature. A dry run is
still not a write, so it is never gated (#63). A refusal is a verdict about a
config that WAS examined, so it rides in the payload and keeps the 0/1/2 exit
contract (#62) — and the verdict now reaches the success payload too, since
stderr is discarded by `2>/dev/null` (F3's class).

commands/fix.md carries `--approve-scope` from the answer the user gives, with
the rule stated where it can be read: classifying is not approving.

Dogfooded end to end: a target outside the session root refuses with zero bytes
written, then applies under `--approve-scope`.

Suite 1703 -> 1707/0. Frozen v5.0.0 + default-output snapshots: 0 changed files.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pkn22uGCgk6QZA738zNmHL
This commit is contained in:
Kjell Tore Guttormsen 2026-08-12 21:15:16 +02:00
commit 749b710de7
16 changed files with 520 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

5
tests/scanners/campaign-export-cli.test.mjs
View file

@ -35,6 +35,11 @@ function world({ withSession = true, withPlan = true } = {}) {
const repoDir = join(root, 'repo');
mkdirSync(sessionsDir, { recursive: true });
mkdirSync(repoDir, { recursive: true });
// A repo in the ledger is a real repo. Without the marker the export target
// is in no project at all, which the Q1 scope gate classifies `require-ok`
// and withholds — so a fixture missing `.git` would be testing a case the
// ledger cannot produce, and would hide the by-design cross-repo path.
mkdirSync(join(repoDir, '.git'), { recursive: true });
let l = createLedger({ now: NOW });
l = addRepo(l, { path: repoDir, name: 'repo' }, { now: NOW });

22
tests/scanners/fix-cli.test.mjs
View file

@ -68,10 +68,16 @@ describe('fix-cli --apply', () => {
});
it('applies fixes and creates backup', () => {
const result = execFileSync('node', [FIX_CLI, tmpDir, '--apply', '--json'], {
const result = execFileSync('node', [FIX_CLI, tmpDir, '--apply', '--json', '--repo', tmpDir], {
encoding: 'utf-8',
timeout: 30000,
env: hermeticEnv(),
// `--repo` above names the session root the Q1 gate classifies against,
// the same job `--repo "$PWD"` does in commands/fix.md. It is passed
// explicitly rather than via `cwd` because on macOS the tmp path is a
// symlink (/var -> /private/var) and `process.cwd()` reports the resolved
// form — root and target would then disagree as strings while naming one
// directory, and the gate would withhold an in-repo write.
});
const output = JSON.parse(result);
assert.ok(output.applied.length > 0, 'Should have applied fixes');
@ -88,7 +94,7 @@ describe('fix-cli --apply', () => {
});
it('actually modifies files after --apply', async () => {
execFileSync('node', [FIX_CLI, tmpDir, '--apply'], {
execFileSync('node', [FIX_CLI, tmpDir, '--apply', '--repo', tmpDir], {
encoding: 'utf-8',
timeout: 30000,
env: hermeticEnv(),
@ -101,10 +107,16 @@ describe('fix-cli --apply', () => {
});
it('reports verified fixes', () => {
const result = execFileSync('node', [FIX_CLI, tmpDir, '--apply', '--json'], {
const result = execFileSync('node', [FIX_CLI, tmpDir, '--apply', '--json', '--repo', tmpDir], {
encoding: 'utf-8',
timeout: 30000,
env: hermeticEnv(),
// `--repo` above names the session root the Q1 gate classifies against,
// the same job `--repo "$PWD"` does in commands/fix.md. It is passed
// explicitly rather than via `cwd` because on macOS the tmp path is a
// symlink (/var -> /private/var) and `process.cwd()` reports the resolved
// form — root and target would then disagree as strings while naming one
// directory, and the gate would withhold an in-repo write.
});
const output = JSON.parse(result);
assert.ok(Array.isArray(output.verified), 'Should have verified array');
@ -185,7 +197,7 @@ describe('fix-cli exit codes (F8)', () => {
const rulesDir = join(dir, '.claude', 'rules');
mkdirSync(rulesDir, { recursive: true });
writeFileSync(join(rulesDir, 'both.txt'), '---\nglobs: "**/*.ts"\n---\n\nBody.\n');
const { status, stdout } = runCli([dir, '--apply', '--json']);
const { status, stdout } = runCli([dir, '--apply', '--json', '--repo', dir]);
const output = JSON.parse(stdout);
if (output.failed.length > 0) {
assert.strictEqual(status, 2, 'A failed fix must not be reported as exit 0');
@ -205,7 +217,7 @@ describe('fix-cli backup completeness (F4)', () => {
// file-rename is the only planned fix for this file.
writeFileSync(join(rulesDir, 'renameonly.txt'), '---\npaths: ["**/*.ts"]\n---\n\nBody.\n');
const { stdout } = runCli([dir, '--apply', '--json']);
const { stdout } = runCli([dir, '--apply', '--json', '--repo', dir]);
const output = JSON.parse(stdout);
const renames = output.applied.filter((a) => /renameonly\.txt$/.test(a.file));
assert.strictEqual(renames.length, 1, 'The rename must have been applied');

22
tests/scanners/fix-engine.test.mjs
View file

@ -197,7 +197,7 @@ describe('applyFixes on tmp copy', () => {
it('applies json-key-add ($schema) successfully', async () => {
const { fixes } = planFixes(envelope);
const schemaFix = fixes.filter(f => f.type === FIX_TYPES.JSON_KEY_ADD);
const result = await applyFixes(schemaFix, { dryRun: false, backupDir: tmpDir });
const result = await applyFixes(schemaFix, { dryRun: false, backupDir: tmpDir, repoRoot: tmpDir });
assert.ok(result.applied.length > 0, 'Should apply at least one fix');
assert.strictEqual(result.failed.length, 0, 'No failures');
@ -212,7 +212,7 @@ describe('applyFixes on tmp copy', () => {
it('applies json-key-type-fix successfully', async () => {
const { fixes } = planFixes(envelope);
const typeFix = fixes.filter(f => f.type === FIX_TYPES.JSON_KEY_TYPE_FIX && f.key === 'alwaysThinkingEnabled');
const result = await applyFixes(typeFix, { dryRun: false, backupDir: tmpDir });
const result = await applyFixes(typeFix, { dryRun: false, backupDir: tmpDir, repoRoot: tmpDir });
assert.ok(result.applied.length > 0);
const content = await readFile(join(tmpDir, '.claude', 'settings.json'), 'utf-8');
@ -223,7 +223,7 @@ describe('applyFixes on tmp copy', () => {
it('applies json-restructure (hooks array→object) successfully', async () => {
const { fixes } = planFixes(envelope);
const hooksFix = fixes.filter(f => f.restructureType === 'hooks-array-to-object');
const result = await applyFixes(hooksFix, { dryRun: false, backupDir: tmpDir });
const result = await applyFixes(hooksFix, { dryRun: false, backupDir: tmpDir, repoRoot: tmpDir });
assert.ok(result.applied.length > 0);
const content = await readFile(join(tmpDir, '.claude', 'settings.json'), 'utf-8');
@ -235,7 +235,7 @@ describe('applyFixes on tmp copy', () => {
it('applies json-restructure (matcher object→string) successfully', async () => {
const { fixes } = planFixes(envelope);
const matcherFix = fixes.filter(f => f.restructureType === 'matcher-object-to-string');
const result = await applyFixes(matcherFix, { dryRun: false, backupDir: tmpDir });
const result = await applyFixes(matcherFix, { dryRun: false, backupDir: tmpDir, repoRoot: tmpDir });
assert.ok(result.applied.length > 0);
const content = await readFile(join(tmpDir, 'hooks', 'hooks.json'), 'utf-8');
@ -247,7 +247,7 @@ describe('applyFixes on tmp copy', () => {
it('applies frontmatter-rename (globs→paths) successfully', async () => {
const { fixes } = planFixes(envelope);
const fmFix = fixes.filter(f => f.type === FIX_TYPES.FRONTMATTER_RENAME);
const result = await applyFixes(fmFix, { dryRun: false, backupDir: tmpDir });
const result = await applyFixes(fmFix, { dryRun: false, backupDir: tmpDir, repoRoot: tmpDir });
assert.ok(result.applied.length > 0);
const content = await readFile(join(tmpDir, '.claude', 'rules', 'typescript.md'), 'utf-8');
@ -258,7 +258,7 @@ describe('applyFixes on tmp copy', () => {
it('applies file-rename (non-.md → .md) successfully', async () => {
const { fixes } = planFixes(envelope);
const renameFix = fixes.filter(f => f.type === FIX_TYPES.FILE_RENAME);
const result = await applyFixes(renameFix, { dryRun: false, backupDir: tmpDir });
const result = await applyFixes(renameFix, { dryRun: false, backupDir: tmpDir, repoRoot: tmpDir });
assert.ok(result.applied.length > 0);
// Old file should be gone
@ -282,7 +282,7 @@ describe('applyFixes on tmp copy', () => {
const { fixes } = planFixes(env);
const effortFix = fixes.filter(f => f.key === 'effortLevel');
assert.strictEqual(effortFix.length, 1, `"${raw}" must be planned as exactly one effortLevel fix`);
await applyFixes(effortFix, { dryRun: false, backupDir: dir });
await applyFixes(effortFix, { dryRun: false, backupDir: dir, repoRoot: dir });
return parseJson(await readFile(settingsPath, 'utf-8')).effortLevel;
}
@ -313,7 +313,7 @@ describe('applyFixes on tmp copy', () => {
it('validates JSON output after fix', async () => {
const { fixes } = planFixes(envelope);
const jsonFixes = fixes.filter(f => f.file.endsWith('.json'));
await applyFixes(jsonFixes, { dryRun: false, backupDir: tmpDir });
await applyFixes(jsonFixes, { dryRun: false, backupDir: tmpDir, repoRoot: tmpDir });
// All JSON files should still parse
const settingsContent = await readFile(join(tmpDir, '.claude', 'settings.json'), 'utf-8');
@ -335,7 +335,7 @@ describe('applyFixes on tmp copy', () => {
key: 'test',
value: true,
}];
const result = await applyFixes(fakeFix, { dryRun: false, backupDir: tmpDir });
const result = await applyFixes(fakeFix, { dryRun: false, backupDir: tmpDir, repoRoot: tmpDir });
assert.strictEqual(result.failed.length, 1, 'Should have one failure');
assert.strictEqual(result.applied.length, 0);
});
@ -360,7 +360,7 @@ describe('verifyFixes', () => {
// Apply a subset of fixes
const fmFix = fixes.filter(f => f.type === FIX_TYPES.FRONTMATTER_RENAME);
const result = await applyFixes(fmFix, { dryRun: false, backupDir: tmpDir });
const result = await applyFixes(fmFix, { dryRun: false, backupDir: tmpDir, repoRoot: tmpDir });
const verification = await verifyFixes(envelope, result.applied);
assert.ok(verification.verified.length > 0, 'Should verify at least one fix');
@ -391,7 +391,7 @@ describe('planFixes ordering (M-BUG-29)', () => {
// …and the whole batch must therefore apply cleanly.
const backupDir = join(dir, '.backup-test');
mkdirSync(backupDir, { recursive: true });
const result = await applyFixes(fixes, { dryRun: false, backupDir });
const result = await applyFixes(fixes, { dryRun: false, backupDir, repoRoot: dir });
assert.deepStrictEqual(result.failed, [], 'No fix may fail because of ordering');
await rm(dir, { recursive: true, force: true });

2
tests/scanners/fix-verify-instance-identity.test.mjs
View file

@ -65,7 +65,7 @@ describe('fix verification distinguishes two instances of one check', () => {
const backupDir = join(dir, '.backups');
await mkdir(backupDir, { recursive: true });
const { applied } = await applyFixes(alphaFix, { backupDir });
const { applied } = await applyFixes(alphaFix, { backupDir, repoRoot: dir });
assert.equal(applied.length, 1);
const { verified, regressions } = await verifyFixes(envelope, applied);

6
tests/scanners/rollback-engine.test.mjs
View file

@ -76,7 +76,7 @@ describe('restoreBackup', () => {
});
it('restores files to original content', async () => {
const result = await restoreBackup(backup.backupId);
const result = await restoreBackup(backup.backupId, { repoRoot: tmpDir });
assert.ok(result.restored.length > 0, 'Should restore at least one file');
assert.strictEqual(result.failed.length, 0, 'No failures');
@ -85,14 +85,14 @@ describe('restoreBackup', () => {
});
it('verifies checksums after restore', async () => {
const result = await restoreBackup(backup.backupId, { verify: true });
const result = await restoreBackup(backup.backupId, { verify: true, repoRoot: tmpDir });
for (const r of result.restored) {
assert.strictEqual(r.status, 'restored');
}
});
it('dry-run returns plan without writing', async () => {
const result = await restoreBackup(backup.backupId, { dryRun: true });
const result = await restoreBackup(backup.backupId, { dryRun: true, repoRoot: tmpDir });
assert.ok(result.restored.length > 0);
for (const r of result.restored) {
assert.strictEqual(r.status, 'dry-run');

2
tests/scanners/rollback-paths.test.mjs
View file

@ -143,7 +143,7 @@ describe('listBackups / restoreBackup across both roots', () => {
process.env.CONFIG_AUDIT_BACKUP_ROOT = canonical;
writeFileSync(target, '{"modified": true}');
const result = await restoreBackup(backupId);
const result = await restoreBackup(backupId, { repoRoot: work });
assert.strictEqual(result.failed.length, 0, 'no failures expected');
assert.strictEqual(result.restored.length, 1, 'the legacy backup should resolve');