mirror of
https://github.com/morluto/rea
synced 2026-10-26 22:28:27 -04:00
gensokyo-dev
d72021b0da
Return publisher refusal before unrelated private-display prerequisites can mask it. Retain display validation for admitted launchers, native launcher digest revalidation and owned cleanup. Add a public CLI fault control using an unusable Python home, preserve the ordinary control and assert display selection for admitted versus refused launchers. Affected tests: 177 passes; 13 changed-file cases passed three additional repeats; full static checks pass. Real-Hopper owner-exit identity revalidation fails identically on unchanged main and the PR; complete real-provider qualification is not passing. This pre-existing failure remains outside this focused correction. Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage) Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
67 lines
2.4 KiB
TypeScript
67 lines
2.4 KiB
TypeScript
import { access, chmod, copyFile, readFile, writeFile } from "node:fs/promises";
|
|
import { join } from "node:path";
|
|
import { expect } from "vitest";
|
|
import { cliTest } from "../../support/cli/cliFixture.js";
|
|
import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
|
|
import { analysisCliErrorEnvelopeSchema } from "../../../src/contracts/errorSchemas.js";
|
|
|
|
cliTest
|
|
.skipIf(process.platform !== "linux")
|
|
.for(["default-python-home", "missing-python-home"] as const)(
|
|
"refuses an unauthenticated Hopper launcher through the public CLI before executing it (%s)",
|
|
async (pythonHome, { cli }) => {
|
|
const home = await createTestTempDirectory("rea-hopper-publisher-cli-");
|
|
const launcher = join(home, "foreign-hopper");
|
|
const target = join(home, "sample");
|
|
const marker = join(home, "launched");
|
|
await writeFile(
|
|
launcher,
|
|
'#!/bin/sh\nprintf launched > "$REA_HOPPER_TEST_MARKER"\nexit 99\n',
|
|
);
|
|
await chmod(launcher, 0o700);
|
|
await copyFile("/usr/bin/true", target);
|
|
const original = await readFile(target);
|
|
const run = await cli.run({
|
|
arguments: [
|
|
"search",
|
|
target,
|
|
"fixture",
|
|
"--provider",
|
|
"hopper",
|
|
"--kind",
|
|
"strings",
|
|
"--mode",
|
|
"regex",
|
|
"--json",
|
|
],
|
|
environment: {
|
|
HOME: home,
|
|
TMPDIR: home,
|
|
HOPPER_LAUNCHER_PATH: launcher,
|
|
REA_HOPPER_TEST_MARKER: marker,
|
|
REA_LOG_LEVEL: "silent",
|
|
// Publisher rejection must not depend on the display probe's Python.
|
|
...(pythonHome === "missing-python-home"
|
|
? { PYTHONHOME: join(home, "missing-python-home") }
|
|
: {}),
|
|
// Reject deterministically without pretending to authenticate a build.
|
|
NODE_OPTIONS: `--import=${new URL("../../fixtures/hopperRejectionFeed.mjs", import.meta.url).href}`,
|
|
},
|
|
});
|
|
expect(run.stderr).toBe("");
|
|
expect(run.exitCode).toBe(1);
|
|
expect(analysisCliErrorEnvelopeSchema.parse(run.json)).toMatchObject({
|
|
code: "provider_unavailable",
|
|
details: {
|
|
stage: "launch",
|
|
launch_rejection: {
|
|
boundary: "publisher_verification",
|
|
reason: "unsupported_hopper_build",
|
|
},
|
|
},
|
|
});
|
|
await expect(access(marker)).rejects.toMatchObject({ code: "ENOENT" });
|
|
expect(await readFile(target)).toEqual(original);
|
|
},
|
|
);
|