feat(config-audit): add token-hotspots CLI (node scanners/token-hotspots-cli.mjs)

plugins/config-audit/tests/scanners/token-hotspots-cli.test.mjs

@@ -0,0 +1,66 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { readFile, unlink } from 'node:fs/promises';
+
+const exec = promisify(execFile);
+const __dirname = fileURLToPath(new URL('.', import.meta.url));
+const REPO = resolve(__dirname, '../..');
+const CLI = resolve(REPO, 'scanners/token-hotspots-cli.mjs');
+const ORCH = resolve(REPO, 'scanners/scan-orchestrator.mjs');
+const FIXTURE = resolve(REPO, 'tests/fixtures/marketplace-large');
+
+describe('token-hotspots-cli', () => {
+  it('returns valid JSON with hotspots.length >= 3', async () => {
+    const { stdout } = await exec('node', [CLI, FIXTURE, '--json'], {
+      timeout: 30000,
+      cwd: REPO,
+    });
+    const json = JSON.parse(stdout);
+    assert.equal(json.scanner, 'TOK');
+    assert.ok(Array.isArray(json.hotspots), 'hotspots must be an array');
+    assert.ok(json.hotspots.length >= 3, `expected ≥3 hotspots, got ${json.hotspots.length}`);
+    assert.equal(typeof json.total_estimated_tokens, 'number');
+    assert.ok(json.total_estimated_tokens > 0, 'expected non-zero token estimate');
+  });
+
+  it('writes JSON to --output-file when provided', async () => {
+    const out = `/tmp/tok-cli-${process.pid}-${Date.now()}.json`;
+    try {
+      await exec('node', [CLI, FIXTURE, '--output-file', out], {
+        timeout: 30000,
+        cwd: REPO,
+      });
+      const written = await readFile(out, 'utf-8');
+      const json = JSON.parse(written);
+      assert.equal(json.scanner, 'TOK');
+      assert.ok(json.hotspots.length >= 3);
+    } finally {
+      await unlink(out).catch(() => {});
+    }
+  });
+});
+
+describe('scan-orchestrator integration — TOK hotspots survive envelope', () => {
+  it('envelope.scanners contains TOK with hotspots field', async () => {
+    const out = `/tmp/tok-orch-${process.pid}-${Date.now()}.json`;
+    try {
+      await exec('node', [ORCH, FIXTURE, '--output-file', out], {
+        timeout: 60000,
+        cwd: REPO,
+      });
+      const written = await readFile(out, 'utf-8');
+      const envelope = JSON.parse(written);
+      const tok = envelope.scanners.find(s => s.scanner === 'TOK');
+      assert.ok(tok, 'expected TOK scanner result in envelope.scanners');
+      assert.ok(Array.isArray(tok.hotspots), 'TOK result must carry hotspots through the envelope');
+      assert.ok(tok.hotspots.length > 0, 'expected hotspots to survive into final envelope');
+      assert.equal(typeof tok.total_estimated_tokens, 'number');
+    } finally {
+      await unlink(out).catch(() => {});
+    }
+  });
+});