config-audit/tests/scanners/cache-prefix.test.mjs

import { describe, it } from 'node:test';
import assert from 'node:assert/strict';
import { resolve } from 'node:path';
import { fileURLToPath } from 'node:url';
import { scan } from '../../scanners/cache-prefix-scanner.mjs';
import { discoverConfigFiles } from '../../scanners/lib/file-discovery.mjs';

const __dirname = fileURLToPath(new URL('.', import.meta.url));
const FIXTURES = resolve(__dirname, '../fixtures');

async function runScanner(fixtureName) {
  const path = resolve(FIXTURES, fixtureName);
  const discovery = await discoverConfigFiles(path);
  return scan(path, discovery);
}

describe('CPS scanner — basic structure', () => {
  it('reports scanner prefix CPS', async () => {
    const result = await runScanner('volatile-mid-section/volatile-line-60');
    assert.equal(result.scanner, 'CPS');
  });

  it('finding IDs match CA-CPS-NNN pattern', async () => {
    const result = await runScanner('volatile-mid-section/volatile-line-60');
    for (const f of result.findings) {
      assert.match(f.id, /^CA-CPS-\d{3}$/);
    }
  });
});

describe('CPS scanner — volatile content within cached prefix', () => {
  it('flags !git log at line 60 (medium severity)', async () => {
    const result = await runScanner('volatile-mid-section/volatile-line-60');
    const f = result.findings.find(x => /volatile content inside cached prefix/i.test(x.title || ''));
    assert.ok(f, `expected volatile-prefix finding; got: ${result.findings.map(x => x.title).join(' | ')}`);
    assert.equal(f.severity, 'medium', `expected medium, got ${f.severity}`);
    assert.match(String(f.evidence || ''), /line 60/);
    assert.match(String(f.evidence || ''), /shell-exec/i);
  });
});

describe('CPS scanner — volatile content beyond cache window', () => {
  it('does NOT flag volatility at line 200+ (outside 150-line window)', async () => {
    const result = await runScanner('volatile-mid-section/volatile-line-200');
    const f = result.findings.find(x => /volatile content inside cached prefix/i.test(x.title || ''));
    assert.equal(f, undefined,
      `expected no finding for line-200 fixture; got: ${f?.title}`);
  });
});

describe('CPS scanner — does not duplicate TOK Pattern A territory', () => {
  it('volatility at lines 1–30 is left for TOK Pattern A (no CPS finding)', async () => {
    // The opus-47/cache-breaking fixture has volatile content at the very top.
    // CPS skips lines 1–30 to avoid duplicating Pattern A's territory.
    const result = await runScanner('opus-47/cache-breaking');
    const f = result.findings.find(x => /volatile content inside cached prefix/i.test(x.title || ''));
    assert.equal(f, undefined,
      `expected no CPS finding when volatility is only in lines 1–30 (Pattern A's range)`);
  });
});

describe('CPS scanner — volatile content in @imported files (v5.10 B6)', () => {
  it('flags volatile content inside an @imported file even when the root file is stable', async () => {
    const result = await runScanner('import-volatile/positive');
    const f = result.findings.find(x => /volatile content in @imported file/i.test(x.title || ''));
    assert.ok(f, `expected @import-volatile finding; got: ${result.findings.map(x => x.title).join(' | ')}`);
    assert.equal(f.severity, 'medium', `expected medium, got ${f.severity}`);
    assert.match(String(f.evidence || ''), /imported by/i);
    assert.match(String(f.evidence || ''), /BUILD_TIMESTAMP|git log|VAR substitution|shell-exec/i);
    assert.equal(f.category, 'token-efficiency');
  });

  it('does NOT emit the in-file CPS finding when the importing file itself is stable', async () => {
    // Root CLAUDE.md carries no volatile lines; only the @imported file does.
    const result = await runScanner('import-volatile/positive');
    const inFile = result.findings.find(x => /volatile content inside cached prefix/i.test(x.title || ''));
    assert.equal(inFile, undefined, 'a byte-stable importing file must not trip the in-file finding');
  });

  it('does NOT flag a clean @imported file', async () => {
    const result = await runScanner('import-volatile/clean');
    const f = result.findings.find(x => /volatile content in @imported file/i.test(x.title || ''));
    assert.equal(f, undefined, `expected no finding for a clean import; got: ${f?.title}`);
  });
});

describe('CPS scanner — CC-stable vars are not cache-busters (M-BUG-7)', () => {
  it('does NOT flag ${CLAUDE_PLUGIN_ROOT} / ${CLAUDE_PROJECT_DIR} in prose', async () => {
    // These are CC-provided path substitutions that resolve to a stable value
    // every turn — referencing them in CLAUDE.md prose is not a cache-buster.
    const result = await runScanner('cps-stable-vars/whitelisted');
    const f = result.findings.find(x => /volatile content inside cached prefix/i.test(x.title || ''));
    assert.equal(f, undefined,
      `CC-stable path vars must not trip CPS; got: ${f?.evidence}`);
  });

  it('STILL flags a genuine non-CC ${VAR} substitution (whitelist is selective)', async () => {
    const result = await runScanner('cps-stable-vars/non-whitelisted');
    const f = result.findings.find(x => /volatile content inside cached prefix/i.test(x.title || ''));
    assert.ok(f, `expected a finding for a genuine runtime var; got none`);
    assert.match(String(f.evidence || ''), /line 40/);
    assert.match(String(f.evidence || ''), /\$\{VAR\} substitution/i);
  });
});

describe('CPS scanner — volatility inside fenced code blocks is documentation (M-BUG-7)', () => {
  it('does NOT flag volatile-looking lines inside a ```fence```', async () => {
    // Content inside a fenced code block is illustrative, byte-stable literal
    // text — not runtime volatility — so it must not break the cached prefix.
    const result = await runScanner('cps-fenced/inside-fence');
    const f = result.findings.find(x => /volatile content inside cached prefix/i.test(x.title || ''));
    assert.equal(f, undefined,
      `fenced code content must not trip CPS; got: ${f?.evidence}`);
  });

  it('STILL flags genuine volatility in live prose outside the fence', async () => {
    const result = await runScanner('cps-fenced/mixed');
    const f = result.findings.find(x => /volatile content inside cached prefix/i.test(x.title || ''));
    assert.ok(f, `expected a finding for the out-of-fence volatile line; got none`);
    assert.match(String(f.evidence || ''), /line 50/);
    assert.match(String(f.evidence || ''), /shell-exec/i);
    assert.doesNotMatch(String(f.evidence || ''), /line 3[567]/,
      'fenced lines 35–37 must not appear in the evidence');
  });
});

describe('CPS scanner — volatility inside inline code is documentation (M-BUG-7)', () => {
  it('does NOT flag a {date} placeholder shown inside `inline code`', async () => {
    // A filename template like `.claude/plans/run-{date}.md` in backticks is
    // literal documentation text — byte-stable, not a runtime substitution.
    const result = await runScanner('cps-inline-code/pure');
    const f = result.findings.find(x => /volatile content inside cached prefix/i.test(x.title || ''));
    assert.equal(f, undefined,
      `inline-code documentation must not trip CPS; got: ${f?.evidence}`);
  });

  it('STILL flags a live ${VAR} that sits outside backticks', async () => {
    const result = await runScanner('cps-inline-code/mixed');
    const f = result.findings.find(x => /volatile content inside cached prefix/i.test(x.title || ''));
    assert.ok(f, `expected a finding for the out-of-backtick volatile line; got none`);
    assert.match(String(f.evidence || ''), /line 50/);
    assert.doesNotMatch(String(f.evidence || ''), /line 40/,
      'the backticked {date} on line 40 must not appear in the evidence');
  });
});

describe('CPS scanner — orchestrator wiring', () => {
  it('CPS appears in scan-orchestrator scanner list', async () => {
    const orch = await import('../../scanners/scan-orchestrator.mjs');
    const path = resolve(FIXTURES, 'volatile-mid-section/volatile-line-60');
    const env = await orch.runAllScanners(path, { filterFixtures: false });
    const cps = env.scanners.find(r => r.scanner === 'CPS');
    assert.ok(cps, `expected CPS in orchestrator results; got: ${env.scanners.map(r => r.scanner).join(', ')}`);
  });

  it('CPS findings carry the token-efficiency category', async () => {
    const result = await runScanner('volatile-mid-section/volatile-line-60');
    const f = result.findings.find(x => /volatile content inside cached prefix/i.test(x.title || ''));
    assert.ok(f);
    assert.equal(f.category, 'token-efficiency');
  });
});