Kjell Tore Guttormsen
325182ddc9
Follow-up to the posture-grade-stability fix in 66433fe. Audited every
test that spawns a CLI and found more of the same class: tests running
HOME-scoped scanners (SKL/COL) or the CLAUDE.md cascade against the
developer's real ~/.claude instead of an isolated HOME.
Fixed (env: hermeticEnv()):
- posture.test.mjs — runs full posture (SKL/COL/cascade); twin of
the posture-grade-stability leak, masked only
because its asserts are structural/relative
- drift-cli.test.mjs — ACTIVE bug: the CLI wrote baselines into the
real ~/.claude during the run (pollution); now
isolated, and afterEach cleanup wrapped in
withHermeticHome so it looks in the same HOME
- token-hotspots-cli.test.mjs — scan-orchestrator run executes SKL/COL on
real HOME; TOK reads the HOME cascade
- accurate-tokens.test.mjs — TOK reads the HOME cascade (kept the
ANTHROPIC_API_KEY deletion)
Proven safe, left as-is (no HOME-scoped scan affecting assertions, no
HOME writes): post-edit-verify.test.mjs (fast-path early-returns only),
fix-cli.test.mjs (output byte-identical real vs empty HOME — fixable
findings are project-local HKV/RUL/SET, never SKL/COL),
lint-default-output (caller already uses withHermeticHome).
Suite 875/875, no snapshot drift. No test regressed under isolation,
confirming none had a hidden real-HOME dependency.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8
83 lines
3.3 KiB
JavaScript
83 lines
3.3 KiB
JavaScript
import { describe, it, afterEach } from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { resolve, join } from 'node:path';
|
|
import { fileURLToPath } from 'node:url';
|
|
import { execFileSync } from 'node:child_process';
|
|
import { deleteBaseline } from '../../scanners/lib/baseline.mjs';
|
|
import { hermeticEnv, withHermeticHome } from '../helpers/hermetic-home.mjs';
|
|
|
|
const __dirname = fileURLToPath(new URL('.', import.meta.url));
|
|
const FIXTURES = resolve(__dirname, '../fixtures');
|
|
const HEALTHY = resolve(FIXTURES, 'healthy-project');
|
|
const DRIFT_CLI = resolve(__dirname, '../../scanners/drift-cli.mjs');
|
|
|
|
// Isolate HOME: drift runs a full scan (HOME-scoped SKL/COL) AND writes its
|
|
// baselines under ~/.claude. Without this, the CLI would pollute the real
|
|
// ~/.claude during the run. See tests/helpers/hermetic-home.mjs.
|
|
const RUN = { encoding: 'utf-8', timeout: 30000, env: hermeticEnv() };
|
|
|
|
const TEST_BASELINE = `_drift_test_${Date.now()}`;
|
|
|
|
afterEach(async () => {
|
|
// Cleanup must look in the SAME hermetic HOME the CLI wrote to.
|
|
await withHermeticHome(() => deleteBaseline(TEST_BASELINE));
|
|
});
|
|
|
|
describe('drift-cli --save', () => {
|
|
it('saves a baseline and confirms', () => {
|
|
const result = execFileSync('node', [DRIFT_CLI, HEALTHY, '--save', '--name', TEST_BASELINE, '--json'], RUN);
|
|
const output = JSON.parse(result);
|
|
assert.equal(output.saved, true);
|
|
assert.equal(output.name, TEST_BASELINE);
|
|
assert.ok(output.path);
|
|
});
|
|
});
|
|
|
|
describe('drift-cli --list', () => {
|
|
it('lists baselines including saved one', async () => {
|
|
// Save first
|
|
execFileSync('node', [DRIFT_CLI, HEALTHY, '--save', '--name', TEST_BASELINE], RUN);
|
|
|
|
const result = execFileSync('node', [DRIFT_CLI, '--list', '--json'], RUN);
|
|
const output = JSON.parse(result);
|
|
assert.ok(Array.isArray(output.baselines));
|
|
const found = output.baselines.find(b => b.name === TEST_BASELINE);
|
|
assert.ok(found, 'Should find test baseline in list');
|
|
});
|
|
});
|
|
|
|
describe('drift-cli compare', () => {
|
|
it('outputs valid JSON with --json flag', () => {
|
|
// Save baseline first
|
|
execFileSync('node', [DRIFT_CLI, HEALTHY, '--save', '--name', TEST_BASELINE], RUN);
|
|
|
|
// Compare same fixture against itself
|
|
const result = execFileSync('node', [DRIFT_CLI, HEALTHY, '--baseline', TEST_BASELINE, '--json'], RUN);
|
|
const diff = JSON.parse(result);
|
|
assert.ok('newFindings' in diff);
|
|
assert.ok('resolvedFindings' in diff);
|
|
assert.ok('unchangedFindings' in diff);
|
|
assert.ok('movedFindings' in diff);
|
|
assert.ok('scoreChange' in diff);
|
|
assert.ok('summary' in diff);
|
|
});
|
|
|
|
it('shows stable trend when comparing same fixture', () => {
|
|
execFileSync('node', [DRIFT_CLI, HEALTHY, '--save', '--name', TEST_BASELINE], RUN);
|
|
|
|
const result = execFileSync('node', [DRIFT_CLI, HEALTHY, '--baseline', TEST_BASELINE, '--json'], RUN);
|
|
const diff = JSON.parse(result);
|
|
assert.equal(diff.summary.trend, 'stable');
|
|
assert.equal(diff.summary.newCount, 0);
|
|
assert.equal(diff.summary.resolvedCount, 0);
|
|
});
|
|
|
|
it('exits with code 1 when baseline not found', () => {
|
|
assert.throws(() => {
|
|
execFileSync('node', [DRIFT_CLI, HEALTHY, '--baseline', `nonexistent_${Date.now()}`, '--json'], RUN);
|
|
}, (err) => {
|
|
assert.equal(err.status, 1);
|
|
return true;
|
|
});
|
|
});
|
|
});
|