Kjell Tore Guttormsen
f820081bdc
Quality only, no behaviour change (four cleanup reviewers, one implementer; npm test 2480/0 on the working tree): - threat-model.mjs splitBacked(): the one known_outside backing check of plan-gate (record and bare gate), verdict-gate and review-finalize, with one why-text; the engines' security keys derived from ENGINES; isSecurity. - coordinator-contract: "not a security engine" read from ENGINES (a string engine only), not the code-review literal. - review-rounds owns trailingBlock, findingsBlockSha, isMajor, isBlocker; review-answers imports them (review-rounds still imports nothing from it). prepare keeps the archive bytes it read instead of reading the previous archive again. - engine-compare exports rowIn and payloadEngine; finalize uses them. - plan-gate: one accepted_open builder; the stop-rule check hoisted; one top-level lookup for --record --brief. - security-engine: notFullShas(), runCli's usage flag, readScopeList shared with engine-findings; findReport and reviewRoundSummary module-private; two dead defaults gone. - tests: shared plan-gate harness and threat-model brief helpers; the [CNV] table cases call convertReport in-process, one CLI case per exit path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
81 lines
3.7 KiB
JavaScript
81 lines
3.7 KiB
JavaScript
// tests/helpers/plan-gate-harness.mjs
|
|
// The critic-round and CLI harness of the plan-gate tests
|
|
// (tests/validators/plan-gate-diff-mode, -stop-rule and -threat-model):
|
|
// rounds through the real recordVerdict and dedup on buildPlan() text, and
|
|
// plan-gate.mjs run as a child in its own temp `git init` repo.
|
|
|
|
import { strict as assert } from 'node:assert';
|
|
import { spawnSync } from 'node:child_process';
|
|
import { mkdtempSync, realpathSync, rmSync } from 'node:fs';
|
|
import { tmpdir } from 'node:os';
|
|
import { dirname, join, resolve } from 'node:path';
|
|
import { fileURLToPath } from 'node:url';
|
|
import { recordVerdict, planHash, operativeText } from '../../lib/validators/plan-gate.mjs';
|
|
import { dedupFindings } from '../../lib/review/plan-review-dedup.mjs';
|
|
import { childEnv } from './child-env.mjs';
|
|
|
|
export const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
|
|
export const PATHS = [resolve('plan.md')];
|
|
|
|
/** The 1-based full-file line holding `s` (findIndex over the whole text). */
|
|
export function at(text, s) {
|
|
const n = text.split('\n').findIndex(l => l.includes(s)) + 1;
|
|
assert.ok(n > 0, `the plan holds ${JSON.stringify(s)}`);
|
|
return n;
|
|
}
|
|
|
|
/** The base a round diffs against: the operative text the previous round reviewed. */
|
|
export const baseOf = t => ({ sha256: planHash(t), text: operativeText(t) });
|
|
|
|
/** `rec(text, d, opts)`: one round as Phase 9 runs it, recorded at `now`, with the plan path known to the gate. */
|
|
export function recorder(now) {
|
|
return (text, d, opts = {}) => {
|
|
const r = recordVerdict(text, d, { reviewed: planHash(text), planPaths: PATHS, now, ...opts });
|
|
assert.equal(r.code, 0, r.message);
|
|
return r;
|
|
};
|
|
}
|
|
|
|
/** Reviewer payloads through the real dedup. */
|
|
export function dd({ pc = [], sg = [], pcPrev, sgPrev } = {}) {
|
|
return dedupFindings([
|
|
{ agent: 'plan-critic', payload: { findings: pc, ...(pcPrev ? { previous: pcPrev } : {}) } },
|
|
{ agent: 'scope-guardian', payload: { findings: sg, ...(sgPrev ? { previous: sgPrev } : {}) } },
|
|
]);
|
|
}
|
|
|
|
/** A reviewer finding on plan.md under `rule_key`. */
|
|
export const keyedFinding = (severity, line, text, rule_key, extra = {}) => ({ file: 'plan.md', line, rule_key, severity, text, ...extra });
|
|
|
|
export const R1_CHANGES = 'Add `run1()`';
|
|
export const R2_CHANGES = '- **Changes:** Add `run2()` to `src/mod2.mjs`. (new file)';
|
|
export const R2_EDITED = '- **Changes:** Add `run2()` and its error path to `src/mod2.mjs`. (new file)\n - `run2()` throws on empty input.';
|
|
|
|
/** Edit A: Step 2's Changes line becomes two lines (a two-line hunk, nothing above it moves). */
|
|
export function editA(t) {
|
|
assert.ok(t.includes(R2_CHANGES));
|
|
return t.replace(R2_CHANGES, R2_EDITED);
|
|
}
|
|
|
|
// ---- CLI ------------------------------------------------------------------------
|
|
|
|
export const GATE = join(ROOT, 'lib', 'validators', 'plan-gate.mjs');
|
|
export const GIT_CLEAN = { GIT_DIR: undefined, GIT_WORK_TREE: undefined, GIT_INDEX_FILE: undefined };
|
|
|
|
/** plan-gate.mjs as a child in `cwd`, with `input` on stdin. */
|
|
export function runGate(cwd, args, input) {
|
|
const r = spawnSync(process.execPath, [GATE, ...args], { cwd, input, encoding: 'utf-8', env: childEnv(GIT_CLEAN) });
|
|
return { code: r.status, out: r.stdout, err: r.stderr };
|
|
}
|
|
|
|
/** The last non-empty output line, parsed. */
|
|
export const lastJson = out => JSON.parse(out.split('\n').filter(l => l !== '').at(-1));
|
|
|
|
/** A fresh temp dir (real path), `git init`-ed; removed again when the init fails. */
|
|
export function tempRepo(prefix) {
|
|
const dir = realpathSync(mkdtempSync(join(tmpdir(), prefix)));
|
|
const g = spawnSync('git', ['init', '-q'], { cwd: dir, encoding: 'utf-8', env: childEnv(GIT_CLEAN) });
|
|
if (g.status !== 0) rmSync(dir, { recursive: true, force: true });
|
|
assert.equal(g.status, 0, g.stderr);
|
|
return dir;
|
|
}
|