fix(review): close the gate's fail-open paths an independent review found
An adversarial read of d88245c reproduced 15 problems; all fixed here, each
with a test that fails on the old code.
- verdict-gate: a greener verdict must be backed by the LAST fence being a
`json` block of the right shape, with no BLOCKER in the JSON (any case),
in `## Findings (BLOCKER)`, or a differing finding-id list; two verdict
lines and more than one file argument are exit 2. ({}, null, lowercase
"blocker", a trailing ```jsonc and a later json fence all gave exit 0.)
- engine-findings: a transcribed "narrower" key can no longer lower an
engine tier; absolute paths under --repo-root match the scope; "12" lines
parse; an empty scope is an error; out-of-scope engine findings are
unverified (`engine:out-of-scope`) and forbid ALLOW.
- recurrence: the catch-all engine keys and keys normalised from unknown
ones are never proposed; the same unfixed finding in two iterations is not
a recurrence; proposals are validated before they are offered; \r/U+2028
and damaged markers are refused; writes go through a symlinked CLAUDE.md.
Prose points --repo at the session directory, not the git toplevel.
- Workflow substrate: engines are counted from what arrived, and the
verdict's floor is recomputed from the coordinator's findings; now tested
by running the script with stubbed Workflow globals. Two literal NUL bytes
written as \u0000 (git saw the file as binary).
- Trimming keeps Pass 1's "Also flagged by" provenance; `## Declined to
Judge` and remediation steps are required from review_version 1.1 only
(N-1); the zero-diff review now carries the JSON block the gate needs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
parent
d88245c06e
commit
40f6ae1177
SSH key fingerprint:
SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
17 changed files with 581 additions and 78 deletions
|
|
@ -157,6 +157,16 @@ test('judgeFilter — only MINOR/SUGGESTION text is trimmed, and every trim is c
|
|||
assert.ok(j.kept[0].detail.endsWith('[…trimmed]'), 'the cut is visible in the text');
|
||||
});
|
||||
|
||||
test('judgeFilter — a trimmed MINOR keeps its "Also flagged by" provenance', () => {
|
||||
const [f] = dedupByTriplet([
|
||||
{ file: 'x.mjs', line: 1, rule_key: 'MISSING_ERROR_HANDLING', severity: 'MINOR', title: 'a', detail: 'q'.repeat(900), reviewer: 'code-correctness-reviewer' },
|
||||
{ file: 'x.mjs', line: 1, rule_key: 'MISSING_ERROR_HANDLING', severity: 'MINOR', title: 'b', detail: 'r', reviewer: 'claude-code-review' },
|
||||
]);
|
||||
const j = judgeFilter([f]);
|
||||
assert.ok(j.kept[0].detail.length <= 800);
|
||||
assert.match(j.kept[0].detail, /Also flagged by claude-code-review: b\.$/);
|
||||
});
|
||||
|
||||
test('judgeFilter — the trim decision reads the catalogue tier, not the reviewer label', () => {
|
||||
// MISSING_TEST is MAJOR in the catalogue; a reviewer calling it MINOR must
|
||||
// not get its text cut.
|
||||
|
|
|
|||
|
|
@ -69,6 +69,40 @@ test('engine-findings — engine and brief control meet in one verdict; engine +
|
|||
assert.deepEqual([...a.raised_by].sort(), ['brief-conformance-reviewer', 'claude-code-review']);
|
||||
});
|
||||
|
||||
test('engine-findings — a "narrower" key can never lower a security BLOCKER', () => {
|
||||
const r = toReviewerPayload({ engine: 'security-review', findings: [
|
||||
{ file: 'a.mjs', line: 1, summary: 's', rule_key: 'MISSING_ERROR_HANDLING' }, // MINOR → refused
|
||||
{ file: 'b.mjs', line: 1, summary: 's', rule_key: 'SECURITY_INJECTION' }, // BLOCKER → kept
|
||||
] });
|
||||
assert.deepEqual(r.payload.findings.map((f) => [f.rule_key, f.severity]),
|
||||
[['SECURITY_REVIEW_VULNERABILITY', 'BLOCKER'], ['SECURITY_INJECTION', 'BLOCKER']]);
|
||||
});
|
||||
|
||||
test('engine-findings — absolute paths under the repo root match the scope; a numeric-string line is kept', () => {
|
||||
const r = toReviewerPayload({ engine: 'code-review', findings: [
|
||||
{ file: '/abs/repo/lib/a.mjs', line: '12', summary: 's' },
|
||||
] }, { scopeFiles: ['lib/a.mjs'], repoRoot: '/abs/repo' });
|
||||
assert.equal(r.payload.findings.length, 1);
|
||||
assert.equal(r.payload.findings[0].file, 'lib/a.mjs');
|
||||
assert.equal(r.payload.findings[0].line, 12);
|
||||
});
|
||||
|
||||
test('engine-findings — an empty scope list is an error, never "everything out of scope"', () => {
|
||||
const r = toReviewerPayload({ engine: 'security-review', findings: [{ file: 'a.mjs', summary: 's' }] }, { scopeFiles: [] });
|
||||
assert.equal(r.ok, false);
|
||||
});
|
||||
|
||||
test('engine-findings — an out-of-scope engine finding forbids ALLOW and is declined to judge', () => {
|
||||
const r = toReviewerPayload({ engine: 'security-review', findings: [{ file: 'old/x.mjs', line: 2, summary: 'leak' }] },
|
||||
{ scopeFiles: ['in.mjs'] });
|
||||
const result = runContract(
|
||||
[r.payload, { reviewer: 'brief-conformance-reviewer', findings: [] }],
|
||||
{ expectedReviewers: [r.payload.reviewer, 'brief-conformance-reviewer'], engineOutOfScope: r.out_of_scope },
|
||||
);
|
||||
assert.equal(result.verdict, 'WARN');
|
||||
assert.deepEqual(result.declined_to_judge.map((d) => d.reason), ['engine:out-of-scope']);
|
||||
});
|
||||
|
||||
test('engine-findings — an engine that was expected but never reported forbids ALLOW', () => {
|
||||
const result = runContract([{ reviewer: 'brief-conformance-reviewer', findings: [] }],
|
||||
{ expectedReviewers: ['brief-conformance-reviewer', ENGINES['security-review'].reviewer] });
|
||||
|
|
|
|||
|
|
@ -95,6 +95,63 @@ test('trekreview — a BLOCKER is written as a numbered Step R<n> with Source fi
|
|||
assert.ok(h6.includes('verdict-gate.mjs'), 'Handover 6 names the gate');
|
||||
});
|
||||
|
||||
test('template — templates/trekreview-template.md validates strictly and the gate reads it as BLOCK', async () => {
|
||||
const { validateReview } = await import('../../lib/validators/review-validator.mjs');
|
||||
const { decideVerdictFile } = await import('../../lib/review/verdict-gate.mjs');
|
||||
const path = join(ROOT, 'templates', 'trekreview-template.md');
|
||||
const v = validateReview(path, { strict: true });
|
||||
assert.equal(v.valid, true, JSON.stringify(v.errors));
|
||||
assert.equal(decideVerdictFile(path).exit, 1);
|
||||
});
|
||||
|
||||
test('trekreview — the zero-diff review the prose prescribes passes the gate as ALLOW', async () => {
|
||||
const { decideVerdict } = await import('../../lib/review/verdict-gate.mjs');
|
||||
const p3 = section(CMD, '## Phase 3');
|
||||
assert.ok(p3.includes('findings: []') && p3.includes('"findings": []'), 'Phase 3 prescribes both');
|
||||
const text = `---
|
||||
type: trekreview
|
||||
review_version: "1.1"
|
||||
task: "t"
|
||||
slug: s
|
||||
project_dir: p/
|
||||
brief_path: p/brief.md
|
||||
scope_sha_end: abc
|
||||
reviewed_files_count: 0
|
||||
verdict: ALLOW
|
||||
findings: []
|
||||
---
|
||||
|
||||
## Executive Summary
|
||||
|
||||
No diff.
|
||||
|
||||
## Coverage
|
||||
|
||||
No diff.
|
||||
|
||||
## Declined to Judge
|
||||
|
||||
None.
|
||||
|
||||
Trimmed: 0
|
||||
|
||||
## Remediation Summary
|
||||
|
||||
No diff.
|
||||
|
||||
\`\`\`json
|
||||
{"verdict": "ALLOW", "counts": {"BLOCKER": 0, "MAJOR": 0, "MINOR": 0, "SUGGESTION": 0}, "findings": []}
|
||||
\`\`\`
|
||||
`;
|
||||
assert.equal(decideVerdict(text).exit, 0, decideVerdict(text).reason);
|
||||
});
|
||||
|
||||
test('trekreview — Phase 8.7 points recurrence at the session directory, not the git toplevel', () => {
|
||||
const p = section(CMD, '## Phase 8.7');
|
||||
assert.ok(p.includes('--repo "$PWD"'));
|
||||
assert.ok(!p.includes('--repo "$(git rev-parse --show-toplevel)"'));
|
||||
});
|
||||
|
||||
// ---- P5: project memory --------------------------------------------------------
|
||||
|
||||
test('trekreview — Phase 8.7 asks the operator per line (AskUserQuestion) before recurrence.mjs apply', () => {
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@
|
|||
import { test } from 'node:test';
|
||||
import { strict as assert } from 'node:assert';
|
||||
import { spawnSync } from 'node:child_process';
|
||||
import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, existsSync } from 'node:fs';
|
||||
import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, existsSync, symlinkSync, lstatSync } from 'node:fs';
|
||||
import { tmpdir } from 'node:os';
|
||||
import { join, dirname } from 'node:path';
|
||||
import { fileURLToPath } from 'node:url';
|
||||
|
|
@ -224,6 +224,76 @@ test('recurrence — an earlier committed version of the same review.md counts a
|
|||
} finally { rmSync(repo, { recursive: true, force: true }); }
|
||||
});
|
||||
|
||||
// ---- Independent review of d88245c: each of these was wrong before ----------
|
||||
|
||||
test('recurrence — the SAME unfixed finding in two iterations is one defect, not a recurring class', () => {
|
||||
const repo = repoWith([
|
||||
{ slug: 'one', sha: 'aaa', findings: [finding('cc', 'MISSING_TEST')] },
|
||||
{ slug: 'one', sha: 'bbbb', findings: [finding('cc', 'MISSING_TEST')] },
|
||||
]);
|
||||
try {
|
||||
assert.deepEqual(mod.proposeLessons(repo).proposals, []);
|
||||
} finally { rmSync(repo, { recursive: true, force: true }); }
|
||||
});
|
||||
|
||||
test('recurrence — catch-all engine keys and keys normalised from unknown ones are never proposed', () => {
|
||||
const repo = repoWith([
|
||||
{ slug: 'one', sha: 'aaa', findings: [finding('a1', 'CODE_REVIEW_DEFECT'), finding('a2', 'SECURITY_REVIEW_VULNERABILITY'), finding('a3', 'PLAN_EXECUTE_DRIFT', { original_rule_key: 'AD_HOC' })] },
|
||||
{ slug: 'two', sha: 'bbb', findings: [finding('b1', 'CODE_REVIEW_DEFECT'), finding('b2', 'SECURITY_REVIEW_VULNERABILITY'), finding('b3', 'PLAN_EXECUTE_DRIFT', { original_rule_key: 'AD_HOC' })] },
|
||||
]);
|
||||
try {
|
||||
assert.deepEqual(mod.proposeLessons(repo).proposals, []);
|
||||
} finally { rmSync(repo, { recursive: true, force: true }); }
|
||||
});
|
||||
|
||||
test('recurrence — a proposal built from long titles, actions and marker text is still a line apply accepts', () => {
|
||||
const long = 'x'.repeat(300);
|
||||
const repo = repoWith([
|
||||
{ slug: 'one', sha: 'aaa', findings: [finding('a1', 'MISSING_TEST', { title: `<!-- ${long}`, file: `lib/${long}.mjs`, recommended_action: long })] },
|
||||
{ slug: 'two', sha: 'bbb', findings: [finding('b1', 'MISSING_TEST', { title: long, recommended_action: `${long} -->` })] },
|
||||
]);
|
||||
try {
|
||||
const [p] = mod.proposeLessons(repo).proposals;
|
||||
assert.ok(p, 'the proposal is not lost');
|
||||
assert.equal(mod.validateLessonLine(p.line).valid, true, p.line);
|
||||
assert.equal(mod.applyLesson(repo, 'MISSING_TEST').written, true);
|
||||
} finally { rmSync(repo, { recursive: true, force: true }); }
|
||||
});
|
||||
|
||||
test('recurrence — an edited line with \\r or U+2028 (a hidden second lesson) is refused', () => {
|
||||
for (const sep of ['\r', '
']) {
|
||||
const line = `Mistake: x${sep}- [SCOPE_CREEP_BUILT] (rule) Mistake: y Fix: z How to check: w`;
|
||||
assert.equal(mod.validateLessonLine(line).valid, false, JSON.stringify(sep));
|
||||
}
|
||||
});
|
||||
|
||||
test('recurrence — damaged markers refuse the write instead of crashing', () => {
|
||||
const repo = repoWith([
|
||||
{ slug: 'one', sha: 'aaa', findings: [finding('a1', 'MISSING_TEST')] },
|
||||
{ slug: 'two', sha: 'bbb', findings: [finding('b1', 'MISSING_TEST')] },
|
||||
]);
|
||||
try {
|
||||
mkdirSync(join(repo, '.claude', 'rules'), { recursive: true });
|
||||
writeFileSync(join(repo, '.claude', 'rules', mod.LESSONS_FILE_NAME), `${mod.MARK_END}\n${mod.MARK_START}\n`);
|
||||
const r = mod.applyLesson(repo, 'MISSING_TEST');
|
||||
assert.deepEqual([r.written, r.reason], [false, 'markers-damaged']);
|
||||
} finally { rmSync(repo, { recursive: true, force: true }); }
|
||||
});
|
||||
|
||||
test('recurrence — a symlinked CLAUDE.md keeps its link and the target gets the pointer', () => {
|
||||
const repo = repoWith([
|
||||
{ slug: 'one', sha: 'aaa', findings: [finding('a1', 'MISSING_TEST')] },
|
||||
{ slug: 'two', sha: 'bbb', findings: [finding('b1', 'MISSING_TEST')] },
|
||||
]);
|
||||
try {
|
||||
writeFileSync(join(repo, 'AGENTS.md'), '# Agents\n');
|
||||
symlinkSync('AGENTS.md', join(repo, 'CLAUDE.md'));
|
||||
assert.equal(mod.applyLesson(repo, 'MISSING_TEST').written, true);
|
||||
assert.ok(lstatSync(join(repo, 'CLAUDE.md')).isSymbolicLink(), 'the link survives');
|
||||
assert.ok(readFileSync(join(repo, 'AGENTS.md'), 'utf-8').includes(mod.LESSONS_FILE_NAME));
|
||||
} finally { rmSync(repo, { recursive: true, force: true }); }
|
||||
});
|
||||
|
||||
test('recurrence — CLI propose prints JSON and exits 0; a missing repo exits 2', () => {
|
||||
const repo = repoWith([
|
||||
{ slug: 'one', sha: 'aaa', findings: [finding('a1', 'MISSING_TEST')] },
|
||||
|
|
|
|||
|
|
@ -14,6 +14,7 @@ import { fileURLToPath } from 'node:url';
|
|||
|
||||
const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
|
||||
const GATE = join(ROOT, 'lib', 'review', 'verdict-gate.mjs');
|
||||
const { decideVerdict } = existsSync(GATE) ? await import('../../lib/review/verdict-gate.mjs') : {};
|
||||
|
||||
function review({ verdict, jsonVerdict, severities = [] }) {
|
||||
const ids = severities.map((_, i) => String(i + 1).padStart(40, 'a'));
|
||||
|
|
@ -135,6 +136,66 @@ test('verdict-gate — --json prints the decision as JSON', () => {
|
|||
}
|
||||
});
|
||||
|
||||
// ---- Adversarial inputs (independent review of d88245c): each was exit 0 ----
|
||||
|
||||
function swapJson(text, jsonSrc) {
|
||||
return text.replace(/```json\n[\s\S]*?```\n$/, `\`\`\`json\n${jsonSrc}\n\`\`\`\n`);
|
||||
}
|
||||
|
||||
test('verdict-gate — a greener verdict over a malformed or evasive JSON block is exit 2', () => {
|
||||
const base = review({ verdict: 'WARN', severities: ['MAJOR'] });
|
||||
assert.equal(decideVerdict(base).exit, 0, 'control: the untouched WARN review passes');
|
||||
const id = String(1).padStart(40, 'a');
|
||||
for (const json of [
|
||||
'{}',
|
||||
'null',
|
||||
`{"verdict":"WARN","counts":{"BLOCKER":0},"findings":[{"id":"${id}","severity":"blocker"}]}`,
|
||||
`{"verdict":"WARN","counts":{"blocker":1},"findings":[{"id":"${id}","severity":"MAJOR"}]}`,
|
||||
`{"verdict":"WARN","counts":{},"findings":{"${id}":{"severity":"BLOCKER"}}}`,
|
||||
]) {
|
||||
assert.equal(decideVerdict(swapJson(base, json)).exit, 2, json);
|
||||
}
|
||||
});
|
||||
|
||||
test('verdict-gate — the trailing json block must be the last fence', () => {
|
||||
const base = review({ verdict: 'WARN', severities: ['MAJOR'] });
|
||||
assert.equal(decideVerdict(`${base}\n\`\`\`json\n{"verdict":"WARN","counts":{},"findings":[]}\n\`\`\`\n`).exit, 2,
|
||||
'a later json fence cannot replace the real block');
|
||||
assert.equal(decideVerdict(base.replace(/```json\n(?=[\s\S]*```\n$)/, '```jsonc\n')).exit, 2,
|
||||
'a jsonc last fence is not the json block');
|
||||
});
|
||||
|
||||
test('verdict-gate — a ## Findings (BLOCKER) entry under a WARN verdict is exit 2', () => {
|
||||
const base = review({ verdict: 'WARN', severities: ['MAJOR'] });
|
||||
const t = base.replace('## Coverage', '## Findings (BLOCKER)\n\n### deadbeef\n\n- file: a.mjs\n\n## Coverage');
|
||||
assert.equal(decideVerdict(t).exit, 2);
|
||||
});
|
||||
|
||||
test('verdict-gate — two verdict lines in the frontmatter are exit 2', () => {
|
||||
const base = review({ verdict: 'ALLOW', severities: ['MINOR'] });
|
||||
assert.equal(decideVerdict(base.replace('verdict: ALLOW\n', 'verdict: BLOCK\nverdict: ALLOW\n')).exit, 2);
|
||||
});
|
||||
|
||||
test('verdict-gate — frontmatter finding ids that differ from the JSON block are exit 2', () => {
|
||||
const base = review({ verdict: 'WARN', severities: ['MAJOR'] });
|
||||
const t = base.replace(` - ${String(1).padStart(40, 'a')}`, ` - ${'b'.repeat(40)}`);
|
||||
assert.equal(decideVerdict(t).exit, 2);
|
||||
});
|
||||
|
||||
test('verdict-gate — more than one file argument is refused (exit 2), never a first-match decision', () => {
|
||||
const dir = mkdtempSync(join(tmpdir(), 'verdict-gate-'));
|
||||
try {
|
||||
const a = join(dir, 'a.md');
|
||||
const b = join(dir, 'b.md');
|
||||
writeFileSync(a, review({ verdict: 'ALLOW', severities: ['MINOR'] }));
|
||||
writeFileSync(b, review({ verdict: 'BLOCK', severities: ['BLOCKER'] }));
|
||||
const r = spawnSync(process.execPath, [GATE, a, b], { encoding: 'utf-8' });
|
||||
assert.equal(r.status, 2);
|
||||
} finally {
|
||||
rmSync(dir, { recursive: true, force: true });
|
||||
}
|
||||
});
|
||||
|
||||
test('verdict-gate — run through a symlink and a path with a space it still decides (realpath main guard)', () => {
|
||||
// The old `file://${argv[1]}` guard is a no-op under a symlink or a space:
|
||||
// the CLI would exit 0 without reading anything — a silent green.
|
||||
|
|
|
|||
71
tests/scripts/trekreview-armb-workflow.test.mjs
Normal file
71
tests/scripts/trekreview-armb-workflow.test.mjs
Normal file
|
|
@ -0,0 +1,71 @@
|
|||
// tests/scripts/trekreview-armb-workflow.test.mjs
|
||||
// The opt-in Workflow substrate for /trekreview Phase 5–6, run for real with
|
||||
// stubbed Workflow globals (agent/parallel/phase/log). Ordre 5: a reviewer or
|
||||
// engine that did not report forbids ALLOW, and the verdict's floor is
|
||||
// recomputed from the findings the coordinator returns.
|
||||
|
||||
import { test } from 'node:test';
|
||||
import { strict as assert } from 'node:assert';
|
||||
import { readFileSync } from 'node:fs';
|
||||
import { join, dirname } from 'node:path';
|
||||
import { fileURLToPath } from 'node:url';
|
||||
|
||||
const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
|
||||
const SRC = readFileSync(join(ROOT, 'scripts', 'trekreview-armB.workflow.mjs'), 'utf-8')
|
||||
.replace('export const meta', 'const meta');
|
||||
const AsyncFunction = Object.getPrototypeOf(async () => {}).constructor;
|
||||
const run = new AsyncFunction('args', 'agent', 'parallel', 'phase', 'log', SRC);
|
||||
|
||||
const BASE = { briefPath: 'b.md', diffPath: 'd.diff', triage: '' };
|
||||
const engine = (reviewer, findings = []) => ({ reviewer, findings });
|
||||
|
||||
function stubs({ reviewers = [], coordinator = null } = {}) {
|
||||
let i = 0;
|
||||
return {
|
||||
agent: async (_prompt, opts) => (opts.label === 'coordinator' ? coordinator : reviewers[i++] ?? null),
|
||||
parallel: async (thunks) => Promise.all(thunks.map((t) => t())),
|
||||
phase: () => {},
|
||||
log: () => {},
|
||||
};
|
||||
}
|
||||
|
||||
async function exec(args, s) {
|
||||
return run(args, s.agent, s.parallel, s.phase, s.log);
|
||||
}
|
||||
|
||||
test('armB — both reviewers and both engines clean → ALLOW (known-positive control)', async () => {
|
||||
const s = stubs({ reviewers: [{ reviewer: 'c', findings: [] }, { reviewer: 'k', findings: [] }] });
|
||||
const r = await exec({ ...BASE, enginePayloads: [engine('claude-code-review'), engine('claude-security-review')] }, s);
|
||||
assert.equal(r.verdict, 'ALLOW');
|
||||
assert.deepEqual(r.missing_engines, []);
|
||||
});
|
||||
|
||||
test('armB — engines the caller never mentioned are missing → not ALLOW', async () => {
|
||||
const s = stubs({ reviewers: [{ reviewer: 'c', findings: [] }, { reviewer: 'k', findings: [] }] });
|
||||
const r = await exec({ ...BASE }, s);
|
||||
assert.equal(r.verdict, 'WARN');
|
||||
assert.deepEqual(r.missing_engines, ['claude-code-review', 'claude-security-review']);
|
||||
});
|
||||
|
||||
test('armB — a reviewer that returned nothing → not ALLOW', async () => {
|
||||
const s = stubs({ reviewers: [null, { reviewer: 'k', findings: [] }] });
|
||||
const r = await exec({ ...BASE, enginePayloads: [engine('claude-code-review'), engine('claude-security-review')] }, s);
|
||||
assert.equal(r.verdict, 'WARN');
|
||||
});
|
||||
|
||||
test('armB — a coordinator ALLOW over a BLOCKER finding is recomputed to BLOCK', async () => {
|
||||
const f = { severity: 'BLOCKER', rule_key: 'UNIMPLEMENTED_CRITERION', file: 'a.mjs', line: 1, title: 't', detail: 'd' };
|
||||
const s = stubs({
|
||||
reviewers: [{ reviewer: 'c', findings: [f] }, { reviewer: 'k', findings: [] }],
|
||||
coordinator: { verdict: 'ALLOW', findings: [f] },
|
||||
});
|
||||
const r = await exec({ ...BASE, enginePayloads: [engine('claude-code-review'), engine('claude-security-review')] }, s);
|
||||
assert.equal(r.verdict, 'BLOCK');
|
||||
});
|
||||
|
||||
test('armB — quick mode expects only the /code-review engine', async () => {
|
||||
const s = stubs({ reviewers: [{ reviewer: 'k', findings: [] }] });
|
||||
const r = await exec({ ...BASE, quick: true, enginePayloads: [engine('claude-code-review')] }, s);
|
||||
assert.equal(r.verdict, 'ALLOW');
|
||||
assert.deepEqual(r.missing_engines, []);
|
||||
});
|
||||
|
|
@ -150,7 +150,9 @@ test('validateReview — a verdict outside ALLOW|WARN|BLOCK is an error in both
|
|||
// ---- A BLOCKER is written as a plan step Handover 6 can append (ordre 5) ----
|
||||
|
||||
const BLOCKER_ID = '763d174e6c519fafbadcba5d1706708479e36e61';
|
||||
const WITH_BLOCKER = GOOD_REVIEW.replace('verdict: ALLOW', 'verdict: BLOCK') + `
|
||||
const WITH_BLOCKER = GOOD_REVIEW.replace('verdict: ALLOW', 'verdict: BLOCK')
|
||||
.replace('review_version: "1.0"', 'review_version: "1.1"')
|
||||
.replace('## Remediation Summary', '## Declined to Judge\n\nNone.\n\nTrimmed: 0\n\n## Remediation Summary') + `
|
||||
\`\`\`json
|
||||
{"verdict": "BLOCK", "counts": {"BLOCKER": 1, "MAJOR": 0, "MINOR": 0, "SUGGESTION": 0},
|
||||
"findings": [{"id": "${BLOCKER_ID}", "severity": "BLOCKER", "rule_key": "UNIMPLEMENTED_CRITERION", "file": "lib/login.mjs", "line": 23}]}
|
||||
|
|
@ -178,6 +180,11 @@ test('validateReview — strict: a BLOCKER with its "Step R1 … Source finding"
|
|||
assert.equal(r.valid, true, JSON.stringify(r.errors));
|
||||
});
|
||||
|
||||
test('validateReview — a 1.0 review with a BLOCKER is not held to the 1.1 remediation-step rule (N-1)', () => {
|
||||
const v10 = WITH_BLOCKER.replace('review_version: "1.1"', 'review_version: "1.0"');
|
||||
assert.equal(validateReviewContent(v10, { strict: true }).valid, true);
|
||||
});
|
||||
|
||||
test('validateReview — soft: a missing remediation step only warns', () => {
|
||||
const r = validateReviewContent(WITH_BLOCKER, { strict: false });
|
||||
assert.equal(r.valid, true);
|
||||
|
|
@ -191,6 +198,16 @@ test('validateReview — a clean review with zero findings validates with `findi
|
|||
assert.equal(validateReviewContent(GOOD_REVIEW.replace(ids, 'findings:\n'), { strict: true }).valid, false);
|
||||
});
|
||||
|
||||
test('validateReview — strict: a 1.1 review needs ## Declined to Judge; a 1.0 review does not', () => {
|
||||
const v11 = GOOD_REVIEW.replace('review_version: "1.0"', 'review_version: "1.1"');
|
||||
const r = validateReviewContent(v11, { strict: true });
|
||||
assert.equal(r.valid, false);
|
||||
assert.ok(r.errors.find(e => e.code === 'REVIEW_MISSING_SECTION' && /Declined to Judge/.test(e.message)));
|
||||
const fixed = v11.replace('## Remediation Summary', '## Declined to Judge\n\nNone.\n\nTrimmed: 0\n\n## Remediation Summary');
|
||||
assert.equal(validateReviewContent(fixed, { strict: true }).valid, true);
|
||||
assert.equal(validateReviewContent(GOOD_REVIEW, { strict: true }).valid, true, '1.0 stays valid');
|
||||
});
|
||||
|
||||
test('review-validator CLI — run through a symlink and a path with a space it still validates (exit 1, not a silent 0)', () => {
|
||||
const dir = mkdtempSync(join(tmpdir(), 'review validator '));
|
||||
try {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue