Kjell Tore Guttormsen
749b710de7
`write-scope.mjs` has existed since M-BUG-41, but only one writer ever called it. Measured 2026-08-12: 9 files under `scanners/` write to disk, 1 imported the gate; 21 command templates, 17 mention a write, 5 call `write-scope-cli`. Five templates paraphrasing one policy is the shape that put the lever table in five copies (#61) — one level up. The defect was never "8 ungated writers = 8 bugs". Four of them write the plugin's own bookkeeping and must STAY ungated: a gate that fires on every run gets switched off, and then it guards nothing. The defect is that nothing declared WHICH, so the question was answered by reading, and answered differently each time it was asked. `tests/lib/write-gate-coverage.test.mjs` makes the answer structural: every writer either imports the gate or holds an EXEMPT entry naming where the bytes land. Seen RED against today's tree before the fix (4 ungated writers), and each of its four assertions was separately seen red against its own defect. Two premises in the plan text were falsified by measuring them first: - `scan-orchestrator` was carried as "plugin-managed, legitimately exempt". `--save-baseline` derives its path from the SCAN TARGET, so `--global` lands `~/.claude/.config-audit-baseline.json` — user-scope, require-ok. It is gated. `lib/baseline.mjs` is the genuinely exempt one. - the first sweep scored 9 writers with a regex that could not match `writeFileSync(`, so `lib/backup.mjs` — a real writer — read as clean. The guard covers sync and async forms, strips comments before matching, and asserts non-emptiness so a regex that stops matching cannot make every other assertion vacuously green (#63, #64). Gated: fix-engine, rollback-engine, campaign-export-cli, scan-orchestrator. All five call sites share ONE reduction, `evaluateWriteTargets` — four copies of classify/strongestGate/dedup is the drift this exists to prevent. `campaign export` still DISCLOSES rather than refuses: cross-repo is by design there, and tightening it into a refusal would break the feature. A dry run is still not a write, so it is never gated (#63). A refusal is a verdict about a config that WAS examined, so it rides in the payload and keeps the 0/1/2 exit contract (#62) — and the verdict now reaches the success payload too, since stderr is discarded by `2>/dev/null` (F3's class). commands/fix.md carries `--approve-scope` from the answer the user gives, with the rule stated where it can be read: classifying is not approving. Dogfooded end to end: a target outside the session root refuses with zero bytes written, then applies under `--approve-scope`. Suite 1703 -> 1707/0. Frozen v5.0.0 + default-output snapshots: 0 changed files. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pkn22uGCgk6QZA738zNmHL
77 lines
3 KiB
JavaScript
77 lines
3 KiB
JavaScript
/**
|
|
* Fix verification must identify a finding INSTANCE, not just its check
|
|
* (M-BUG-28, prediction 7).
|
|
*
|
|
* A finding ID names the check, so one check failing in two files yields two
|
|
* findings sharing an ID. If verification keys on the ID alone, fixing one of
|
|
* them marks both as fixed — and the untouched one, still present in the
|
|
* re-scan, is then reported as a REGRESSION. The user is told a fix came back
|
|
* undone when it was never applied.
|
|
*
|
|
* `(findingId, file)` is the instance key, and both `planFixes` and `applyFixes`
|
|
* already carry `file` next to `findingId`.
|
|
*/
|
|
|
|
import { describe, it, before, after } from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises';
|
|
import { tmpdir } from 'node:os';
|
|
import { join } from 'node:path';
|
|
import { runAllScanners } from '../../scanners/scan-orchestrator.mjs';
|
|
import { planFixes, applyFixes, verifyFixes } from '../../scanners/fix-engine.mjs';
|
|
|
|
const RULE = (name) => `---
|
|
globs:
|
|
- "src/**/*.ts"
|
|
---
|
|
|
|
# ${name}
|
|
|
|
A path-scoped rule that uses the undocumented \`globs:\` key.
|
|
`;
|
|
|
|
describe('fix verification distinguishes two instances of one check', () => {
|
|
let dir;
|
|
|
|
before(async () => {
|
|
dir = await mkdtemp(join(tmpdir(), 'ca-mbug28-'));
|
|
await mkdir(join(dir, '.claude', 'rules'), { recursive: true });
|
|
await writeFile(join(dir, 'CLAUDE.md'), '# Project\n\nInstructions.\n');
|
|
await writeFile(join(dir, '.claude', 'rules', 'alpha.md'), RULE('Alpha'));
|
|
await writeFile(join(dir, '.claude', 'rules', 'beta.md'), RULE('Beta'));
|
|
});
|
|
|
|
after(async () => {
|
|
if (dir) await rm(dir, { recursive: true, force: true });
|
|
});
|
|
|
|
it('does not report the untouched instance as a regression', async () => {
|
|
const envelope = await runAllScanners(dir, { filterFixtures: false, suppress: false });
|
|
|
|
const globsFindings = envelope.scanners
|
|
.flatMap((s) => s.findings)
|
|
.filter((f) => f.title === 'Rule uses "globs" instead of documented "paths"');
|
|
|
|
assert.equal(globsFindings.length, 2, 'fixture must produce one finding per rule file');
|
|
assert.equal(
|
|
globsFindings[0].id,
|
|
globsFindings[1].id,
|
|
'both instances name the same check — that is the scheme, not a defect'
|
|
);
|
|
|
|
const { fixes } = planFixes(envelope);
|
|
const alphaFix = fixes.filter((p) => p.file && p.file.endsWith('alpha.md'));
|
|
assert.equal(alphaFix.length, 1, 'expected exactly one fix plan for alpha.md');
|
|
|
|
const backupDir = join(dir, '.backups');
|
|
await mkdir(backupDir, { recursive: true });
|
|
const { applied } = await applyFixes(alphaFix, { backupDir, repoRoot: dir });
|
|
assert.equal(applied.length, 1);
|
|
|
|
const { verified, regressions } = await verifyFixes(envelope, applied);
|
|
|
|
// beta.md was never fixed. It is still open — which is not a regression.
|
|
assert.deepEqual(regressions, [], 'an unfixed sibling instance must not count as a regression');
|
|
assert.equal(verified.length, 1, 'exactly the fixed instance is verified');
|
|
});
|
|
});
|