Files
gstack/test/script-invocation.test.ts
T
82530ac143 v1.91.117.0 fix: pregate bats lanes, WTREE_UNAVAILABLE, doctor rows, SKILL.md size guard, planMode hosts (fix wave PR 5) (#3236)
* fix(pregate): recognise bats test files so lanes does not fail in bats repos (#3161)

gstack-pregate never treated a .bats file as a test, so in a repository whose
tests are bats files the lanes check failed every run with PREGATE_NO_LANE: a
.gstack/pregate.json dependency pointing at tests/foo.bats selected nothing, a
selection manifest printing .bats paths yielded 0 files, and a bats run that
executed no tests could not trip the zero-run rule.

Recognise .bats in the test-file pattern and in the manifest-output parser, and
read the bats TAP plan and pretty summary (as a last resort, after every
existing runner's summary) so a run that reports zero tests is a failure.

Fixes #3161.

Cherry-picked from #3177 (d355c116b). Conflicts resolved as in the author's own
merges (b09476beb, 444f4e768): lane-selection.ts keeps main's isTestFile-based
manifest parser, and lanes.ts carries the bats summary on main's supervised runner.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* test(pregate): a nested .bats file is selected and run end to end (#3161)

Reviewer test for #3177: touched itself with no declaration, and through a
declared dependency; a failing nested bats run reports the bats counts.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* fix(pregate): a wtree failure is WTREE_UNAVAILABLE, not an unresolvable base (#3197)

The pregate consumers of the working-tree fingerprint (buildContext,
withFingerprint, verifyPregate) move to lib/script-invocation.ts's
{tree}|{error} form, and lib/regen.ts drops its string-returning wrapper.

- A fingerprint failure was reported as "policy source unavailable:
  origin/<base> is not a resolvable commit" with git fetch as the fix. It is
  now WTREE_UNAVAILABLE: a launch failure lists each Windows bash candidate
  with its rejection reason and names GSTACK_GIT_BASH; a gstack-wtree exit
  keeps the repair it printed (set TMPDIR to a writable directory).
- A fingerprint failing after a check is incomplete with that cause, not
  "working tree changed"; verify says the tree cannot be fingerprinted.
- #3190's gstack-config read (test_backend) goes through runScriptSync, so
  Windows reaches it through Git Bash. The tripwire learns the bin-constant
  shape that let it through.
- Under --json every context refusal is one envelope on stdout
  ({ok:false,status:'refused',code,detail,fix,docs}, exit 3); the run object
  carries ok and status too, and GSTACK_RESULT goes to stderr.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* ci(pregate): gstack-pregate joins the Windows pregate job; pregate tests return to the Windows lane (#3197)

- windows-pregate-e2e runs gstack-pregate run (preflight: regen, secrets
  through the gstack-redact bun bin, literals, guards) in both journeys, and
  asserts a missing GSTACK_GIT_BASH refuses with one WTREE_UNAVAILABLE --json
  envelope.
- test/helpers/pregate-fixture.ts and restamp-fixture.ts runBin launch bins
  through lib/script-invocation.ts (bun bins as Bun argv, bash bins through
  Git Bash on Windows), which removes the "shebang via CreateProcess" reason
  for the pregate tests; they move from KNOWN_WINDOWS_INCOMPATIBLE to
  KNOWN_WINDOWS_SAFE.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* doctor: list rescue refs and warn about CLAUDE.md skill lists

gstack-doctor's plain report gains two rows. 'rescue refs' lists each
refs/gstack/rescue/* commit in the install checkout, newest first, with its
date, a needs-manual-resolution label when the rescue held unmerged files, and
the shell-quoted inspect and delete commands bin/gstack-ff-update's banner
prints. 'CLAUDE.md' warns when a gstack section in ~/.claude/CLAUDE.md or the
project's CLAUDE.md enumerates skills (#3169) and prints the short block to
paste instead; docs/troubleshooting.md#claude-md-skill-list explains it.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* doctor: name the Windows bash gstack resolves and what chose it

On Windows (OSTYPE msys/cygwin) gstack-doctor adds a 'windows bash' row from
lib/script-invocation.ts resolveWindowsBash, run through the new thin
bin/gstack-windows-bash.ts with the bun on PATH: the resolved bash and the
override or discovery step that chose it, a warn when GSTACK_GIT_BASH and
GSTACK_BASH differ, and a fail carrying the BASH_UNAVAILABLE line (every
candidate with its rejection reason) when none qualifies. Tests inject the
platform (GSTACK_DOCTOR_PLATFORM) and the discovery inputs
(GSTACK_DOCTOR_BASH_PROBE) so the row runs on every OS.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* doctor --check: name the held-install recovery on Windows, not bin/gstack-upgrade

bin/gstack-upgrade compares a pwd -P path (/c/...) with git's toplevel
(C:/...) and refuses on every Git Bash install, so on Windows the revision
row's upgrade fix (REVISION_BELOW_MINIMUM, the Capy-wrapper variant and
REVISION_UNMET) names the held-install recovery forms from
docs/troubleshooting.md#auto-update-held-install-recovery instead: the Git
Bash form and the Windows PowerShell 5.1 form, each labelled by shell with the
install path quoted for that shell. Other platforms keep bin/gstack-upgrade.
A test pins both printed forms to the documented ones.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* fix(skills): omit the plan-mode section on hosts without plan mode (#3168)

generatePlanModeInfo now honours capabilities.planMode. Hosts that declare
planMode:false (codex, agy, hermes, openclaw, and define-host's default:
factory, kiro, slate, cursor, gbrain) no longer render the
'## Plan Mode Safe Operations' and '## Skill Invocation During Plan Mode'
preamble sections. Claude, copilot and opencode are unchanged.

The codex, factory and agy ship goldens are regenerated. The clarity test that
pinned the plan-mode entry-order prose on every host now pins it on planMode
hosts and asserts its absence elsewhere (intentional contract change).

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* test(skills): guard generated SKILL.md size at 100,000 chars on every host (#3199)

A free test renders every host and fails when a generated SKILL.md exceeds
100,000 characters, naming host, skill, actual size, limit and the fix. The 89
current offenders are pinned at their exact size in
test/fixtures/skill-md-size-allowlist.json: growth past a pin fails, and a
shrink fails until the pin is lowered. The shared-preamble hoist is deferred
(owner Garry, revisit 2026-11-15).

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* test(pregate): keep #3177's bats tests beside the nested-directory test

Moves #3177's bats describe block verbatim from test/pregate-selection.test.ts
into test/pregate-bats-nested.test.ts, so pregate-selection.test.ts is
unchanged on this branch and the in-flight field-list-2 pregate lane
(capy/fl2-L6-pregate, which edits that file's imports and adds cases) merges
without a conflict. No assertion changes.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* doctor --check: keep bin/gstack-upgrade as the Windows fix (path spelling fixed on main)

Reverts 37bac07f8. Plan item D named the held-install recovery forms on
Windows only until bin/gstack-upgrade stopped refusing Git Bash installs.
bin/gstack-upgrade:63-67 now compares with gstack_path_same from
bin/gstack-path-spelling.sh, pinned by test/gstack-upgrade-path-spelling.test.ts,
so bin/gstack-upgrade is the right fix on every platform again.

* test(skills): measure the size-guard pins on v1.91.109.0

#3225 (merged into this branch) grew 53 pinned skills: 3 characters each from
the Aside driver resolver, and about 340 more in plan-design-review and
plan-devex-review from the #3219 summary sections. The pins are this PR's
starting measurement, so they are taken on the merged base; no skill this PR
renders grew.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* ci(windows): only the pregate tests that pass on windows-latest join the lane

windows-free-tests run 38984824731 (this branch at 8ed6da402) ran the moved
files. gstack-regen and the new pregate-wtree-refusal passed. pregate-guards,
-remote, -regate, -invalidation, -selection and -bats-nested launched
gstack-pregate fine but fail on Linux-host expectations: their fixture lanes are
Linux workflow jobs, which a Windows host records as requires-remote
obligations. They go back to KNOWN_WINDOWS_INCOMPATIBLE with that reason
instead of "shebang via CreateProcess".

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* windows curation: keep CI run ids out of reason prose (pii.phone false positive)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* skill-md size pins: follow #3231's review-army line (+21 chars on five inlining hosts)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* doctor test: drop the reverted Windows upgrade-fix wording from item D's describe

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* skill-md size pins: follow #3226 (plan-devex-review +3324) and #3234 (autoplan +59)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* WTREE_UNAVAILABLE moves to lib/result-codes-release.ts (#3235 split; result-codes.ts stays at 796 of 800 lines); doctor fixture copies the release table; size pins follow #3235's review +1

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* docs(changelog): fix wave PR 5 release notes

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* v1.91.117.0 fix: fix wave PR 5 (pregate bats + WTREE_UNAVAILABLE, doctor rows, SKILL.md size guard, planMode hosts)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* fix(qa): an invalid-input probe breaks only the rule it tests

The paid gate's qa-functional-cli-report failed again on #3236 (run
39001107574): the agent probed the digits-only amount rule with -5, which
the positivity check rejected first, so the planted parseInt defect stayed
hidden and it reported no defect. The contract map's invalid-input row now
asks for each input to break only the rule it tests, so another check
cannot reject it first.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

---------

Co-authored-by: harjothkhara <48686985+harjothkhara@users.noreply.github.com>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
2026-10-17 04:36:00 +00:00

228 lines
11 KiB
TypeScript

/**
* #3197: lib/script-invocation.ts is the one way TypeScript runs gstack's
* shebang bins and `bash -c` strings. Windows is simulated with an injected
* platform and filesystem; the fixture table is the shared contract for
* Windows bash discovery.
*/
import { describe, expect, test } from 'bun:test';
import { spawnSync } from 'node:child_process';
import * as fs from 'node:fs';
import * as os from 'node:os';
import * as path from 'node:path';
import {
bashCommandInvocation, resolveWindowsBash, resolveWindowsBashCached, runBashSync, runScriptSync, scriptInvocation, wtreeFingerprint,
type BashProbe,
} from '../lib/script-invocation';
const ROOT = path.resolve(import.meta.dir, '..');
const BIN = path.join(ROOT, 'bin');
const table = JSON.parse(fs.readFileSync(path.join(ROOT, 'test/fixtures/windows-bash-resolution.json'), 'utf8')) as {
rows: Array<{ name: string; env?: Record<string, string>; exists: string[]; gitExecPath?: string; which?: Record<string, string>; uname?: string;
expect: { bash: string; source: string } | { refused: true; mentions: string[] }; warning?: string | null }>;
};
const WIN_GIT_BASH = 'C:/Program Files/Git/bin/bash.exe';
const noBash: BashProbe = { platform: 'win32', env: {}, exists: () => false, gitExecPath: () => null, which: () => null };
function probeFor(row: (typeof table.rows)[number]): BashProbe {
return {
platform: 'win32',
env: row.env ?? {},
exists: p => row.exists.includes(p),
gitExecPath: () => row.gitExecPath ?? null,
which: c => row.which?.[c] ?? null,
uname: () => row.uname ?? null,
};
}
describe('Windows bash resolution (fixture table)', () => {
for (const row of table.rows) {
test(row.name, () => {
const res = resolveWindowsBash(probeFor(row));
if ('bash' in row.expect) {
expect(res.ok).toBe(true);
if (!res.ok) return;
expect({ bash: res.bash, source: res.source }).toEqual(row.expect);
} else {
expect(res.ok).toBe(false);
if (res.ok) return;
for (const m of row.expect.mentions) expect(res.message).toContain(m);
expect(res.message).toContain('GSTACK_GIT_BASH');
}
if (row.warning !== undefined) expect(res.warning ?? null).toBe(row.warning === null ? null : `gstack: ${row.warning}`);
});
}
test('WSL launchers are rejected without being probed', () => {
let probed = false;
const res = resolveWindowsBash({ ...noBash, which: () => 'C:\\Windows\\System32\\bash.exe', uname: () => { probed = true; return 'MINGW64_NT'; } });
expect(res.ok).toBe(false);
expect(probed).toBe(false);
});
});
describe('scriptInvocation', () => {
const win: BashProbe = { platform: 'win32', env: {}, exists: p => p === WIN_GIT_BASH, gitExecPath: () => null, which: () => null };
test('a bash-shebang bin on Windows runs through Git Bash with a forward-slashed script path', () => {
const inv = scriptInvocation(path.join(BIN, 'gstack-wtree'), ['--x'], win);
expect(inv).toEqual({ ok: true, cmd: WIN_GIT_BASH, argv: [path.join(BIN, 'gstack-wtree').replace(/\\/g, '/'), '--x'] });
});
test('a bash-shebang bin on POSIX execs directly', () => {
expect(scriptInvocation(path.join(BIN, 'gstack-slug'), [], { platform: 'linux' })).toEqual({ ok: true, cmd: path.join(BIN, 'gstack-slug'), argv: [] });
});
test('a bun-shebang bin runs under Bun on every platform', () => {
for (const platform of ['win32', 'linux', 'darwin']) {
const inv = scriptInvocation(path.join(BIN, 'gstack-redact'), ['--json'], { ...win, platform });
expect(inv).toEqual({ ok: true, cmd: process.execPath, argv: [path.join(BIN, 'gstack-redact'), '--json'] });
}
});
test('no bash on Windows: an actionable refusal, not a spawn error', () => {
const inv = scriptInvocation(path.join(BIN, 'gstack-wtree'), [], noBash);
expect(inv.ok).toBe(false);
if (inv.ok) return;
expect(inv.error).toContain('(BASH_UNAVAILABLE)');
expect(inv.error).toContain('GSTACK_GIT_BASH');
});
test('bash -c goes through the same resolver', () => {
expect(bashCommandInvocation('echo hi', win)).toEqual({ ok: true, cmd: WIN_GIT_BASH, argv: ['-c', 'echo hi'] });
expect(bashCommandInvocation('echo hi', { platform: 'linux' })).toEqual({ ok: true, cmd: 'bash', argv: ['-c', 'echo hi'] });
expect(bashCommandInvocation('echo hi', noBash).ok).toBe(false);
});
test('runScriptSync and runBashSync return a spawnSync-shaped failure the callers already handle', () => {
const r = runScriptSync(path.join(BIN, 'gstack-wtree'), [], { encoding: 'utf8', timeout: 5_000 }, noBash);
expect(r.status).toBeNull();
expect(r.stdout).toBe('');
expect((r.error as NodeJS.ErrnoException).code).toBe('BASH_UNAVAILABLE');
expect(r.error?.message).toContain('GSTACK_GIT_BASH');
const b = runBashSync('true', { encoding: 'utf8', timeout: 5_000 }, noBash);
expect((b.error as NodeJS.ErrnoException).code).toBe('BASH_UNAVAILABLE');
expect(runBashSync('echo ok', { encoding: 'utf8', timeout: 5_000 }).stdout.trim()).toBe('ok');
});
});
describe('resolveWindowsBashCached (the hooks hot path)', () => {
const tmp = () => fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-bash-cache-'));
const base = (calls: { n: number }, mtime = { v: 1 }, live = new Set([WIN_GIT_BASH])): Parameters<typeof resolveWindowsBashCached>[1] => ({
platform: 'win32', env: {},
exists: p => live.has(p),
gitExecPath: () => { calls.n++; return 'C:/Program Files/Git/mingw64/libexec/git-core'; },
which: c => (c === 'git' ? 'C:/Program Files/Git/cmd/git.exe' : null),
stat: () => ({ mtimeMs: mtime.v }),
});
test('second resolution is served from the cache without asking git', () => {
const dir = tmp();
try {
const file = path.join(dir, 'windows-bash.json');
const calls = { n: 0 };
const first = resolveWindowsBashCached(file, base(calls));
expect(first.ok && first.bash).toBe(WIN_GIT_BASH);
expect(calls.n).toBe(1);
const second = resolveWindowsBashCached(file, base(calls));
expect(second.ok && second.bash).toBe(WIN_GIT_BASH);
expect(second.ok && second.source).toBe('git --exec-path (cached)');
expect(calls.n).toBe(1);
expect(fs.readdirSync(dir)).toEqual(['windows-bash.json']);
} finally { fs.rmSync(dir, { recursive: true, force: true }); }
});
test('a new git.exe mtime or a vanished cached bash re-resolves', () => {
const dir = tmp();
try {
const file = path.join(dir, 'windows-bash.json');
const calls = { n: 0 };
const mtime = { v: 1 };
resolveWindowsBashCached(file, base(calls, mtime));
mtime.v = 2;
resolveWindowsBashCached(file, base(calls, mtime));
expect(calls.n).toBe(2);
const live = new Set(['C:/Program Files/Git/usr/bin/bash.exe']);
const moved = resolveWindowsBashCached(file, base(calls, mtime, live));
expect(moved.ok && moved.bash).toBe('C:/Program Files/Git/usr/bin/bash.exe');
expect(calls.n).toBe(3);
} finally { fs.rmSync(dir, { recursive: true, force: true }); }
});
test('the override bypasses the cache and is never written to it', () => {
const dir = tmp();
try {
const file = path.join(dir, 'windows-bash.json');
const calls = { n: 0 };
const res = resolveWindowsBashCached(file, { ...base(calls), env: { GSTACK_GIT_BASH: 'D:/x/bash.exe' }, exists: p => p === 'D:/x/bash.exe' });
expect(res.ok && res.source).toBe('GSTACK_GIT_BASH');
expect(fs.existsSync(file)).toBe(false);
expect(calls.n).toBe(0);
} finally { fs.rmSync(dir, { recursive: true, force: true }); }
});
test('a refusal is not cached', () => {
const dir = tmp();
try {
const file = path.join(dir, 'windows-bash.json');
const res = resolveWindowsBashCached(file, { ...base({ n: 0 }), exists: () => false });
expect(res.ok).toBe(false);
expect(fs.existsSync(file)).toBe(false);
} finally { fs.rmSync(dir, { recursive: true, force: true }); }
});
});
describe('wtreeFingerprint', () => {
const repo = (extra: string[] = []) => {
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-wtree-fp-'));
const git = (...a: string[]) => spawnSync('git', a, { cwd: dir, encoding: 'utf8', timeout: 30_000 });
git('init', '-q', ...extra);
fs.writeFileSync(path.join(dir, 'a.txt'), 'a\n');
git('add', '.');
git('-c', 'user.name=t', '-c', 'user.email=t@t', '-c', 'commit.gpgsign=false', 'commit', '-q', '-m', 'init');
return dir;
};
test('a SHA-1 repository yields a 40-hex tree', () => {
const dir = repo();
try {
const r = wtreeFingerprint({ cwd: dir });
expect('tree' in r && r.tree).toMatch(/^[0-9a-f]{40}$/);
} finally { fs.rmSync(dir, { recursive: true, force: true }); }
});
test('a SHA-256 repository yields a 64-hex tree', () => {
const dir = repo(['--object-format=sha256']);
try {
const r = wtreeFingerprint({ cwd: dir });
expect('tree' in r && r.tree).toMatch(/^[0-9a-f]{64}$/);
} finally { fs.rmSync(dir, { recursive: true, force: true }); }
});
test('a launch failure (no bash on Windows) is distinguished from a helper exit', () => {
const dir = repo();
try {
const launch = wtreeFingerprint({ cwd: dir, invocation: noBash });
expect(launch).toMatchObject({ kind: 'launch' });
expect('error' in launch && launch.error).toContain('GSTACK_GIT_BASH');
const exit = wtreeFingerprint({ cwd: dir, env: { ...process.env, TMPDIR: path.join(dir, 'no-such-dir') } });
expect(exit).toMatchObject({ kind: 'exit' });
expect('error' in exit && exit.error).toMatch(/^gstack-wtree exited 1: .*set TMPDIR to a writable directory/);
expect(wtreeFingerprint({ cwd: os.tmpdir() })).toMatchObject({ kind: 'exit' });
} finally { fs.rmSync(dir, { recursive: true, force: true }); }
});
test('always runs with GIT_OPTIONAL_LOCKS=0', () => {
const dir = repo();
const shim = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-wtree-shim-'));
try {
const realGit = Bun.which('git')!;
const log = path.join(shim, 'locks.log');
fs.writeFileSync(path.join(shim, 'git'), `#!/bin/sh\necho "\${GIT_OPTIONAL_LOCKS:-unset}" >> '${log}'\nexec '${realGit}' "$@"\n`, { mode: 0o755 });
const r = wtreeFingerprint({ cwd: dir, env: { ...process.env, PATH: `${shim}${path.delimiter}${process.env.PATH}`, GIT_OPTIONAL_LOCKS: '1' } });
expect('tree' in r).toBe(true);
const seen = new Set(fs.readFileSync(log, 'utf8').trim().split('\n'));
expect([...seen]).toEqual(['0']);
} finally { fs.rmSync(dir, { recursive: true, force: true }); fs.rmSync(shim, { recursive: true, force: true }); }
});
});