Nick
2d09bee39e
CI Pipeline / best-practices (push) Successful in 10s
CI Pipeline / documentation (push) Successful in 10s
CI Pipeline / lint (push) Failing after 52s
Auto-version and Release / release (push) Successful in 52s
CI Pipeline / gitea-offline (push) Successful in 17s
CI Pipeline / type-check (push) Successful in 32s
CI Pipeline / canary (push) Successful in 34s
CI Pipeline / unit-tests (push) Successful in 3m11s
CI Pipeline / required-checks (push) Failing after 2s
CI Pipeline / CI Pipeline / notify-event-bridge (push) Successful in 8s
deploy / deploy (push) Failing after 7m32s
- 21.2B: resolve_cwd returns repo_identity (git:<path> stripped) not scaffold_location; worktree override; unknown project raises; no repo → refuse; 8 held-outs incl. old-bug reproduction. - 21.2C: wait_guard covers time.sleep(N) (inline + heredoc), polling loops (while/until + status on full command), repeated delay+status; 7 new held-outs; legitimate cases still pass. - 21.2D: canonical hook source at config/mimo-hooks/event-wait-guard.ts; scripts/install_mimo_hook.py verifies hash; drift test detects canonical↔installed divergence. - 21.2G: programme_gates.py — mandatory gates end in PASS/BLOCKED/ WAIVED_BY_USER only; GateDemotionError prevents mandatory→optional demotion; 6 held-outs.
58 lines
1.9 KiB
Python
58 lines
1.9 KiB
Python
"""test_cwd_guard.py — T21.1 §21.1C: execution-context hardening held-outs.
|
|
|
|
The systemic rule: repo-affecting commands carry explicit cwd.
|
|
Mirrors the hook's REPO_TOUCH/EXPLICIT_CWD logic in Python so the
|
|
convention is regression-tested in the suite."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import re
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
REPO = Path(__file__).resolve().parent.parent
|
|
sys.path.insert(0, str(REPO / "src"))
|
|
|
|
REPO_TOUCH = re.compile(
|
|
r"\b(git\s+(fetch|pull|push|log|status|show|diff|commit|add)"
|
|
r"|src/|scripts/|store/|rune-code/)")
|
|
EXPLICIT_CWD = re.compile(
|
|
r"(^|\s)(cd\s+\/|workdir=|/mnt/workdrive/issue161-harness)")
|
|
|
|
|
|
def needs_explicit_cwd(command: str) -> bool:
|
|
"""True when the command touches the repo without explicit cwd."""
|
|
return bool(REPO_TOUCH.search(command)) and not bool(
|
|
EXPLICIT_CWD.search(command))
|
|
|
|
|
|
def test_211c_bare_git_command_needs_cwd():
|
|
assert needs_explicit_cwd("git status -s") is True
|
|
assert needs_explicit_cwd("git fetch gitea -q") is True
|
|
|
|
|
|
def test_211c_chained_cd_satisfies():
|
|
assert needs_explicit_cwd(
|
|
"cd /mnt/workdrive/issue161-harness && git status") is False
|
|
|
|
|
|
def test_211c_generic_shell_unrestricted():
|
|
assert needs_explicit_cwd("ls ~/downloads") is False
|
|
assert needs_explicit_cwd("sleep 45") is False
|
|
assert needs_explicit_cwd("echo hello") is False
|
|
|
|
|
|
def test_211c_registry_resolve_cwd():
|
|
"""T21.2 correction: resolve_cwd returns the REPO, not scaffold."""
|
|
from rune import project_registry as pr
|
|
import tempfile
|
|
r = pr.ProjectRegistry(tempfile.mkdtemp())
|
|
r.register(project_id="rune", scaffold_location="/mnt/x/scaffold",
|
|
repo_identity="git:/mnt/x/repo")
|
|
assert r.resolve_cwd("rune") == "/mnt/x/repo"
|
|
try:
|
|
r.resolve_cwd("ghost-project")
|
|
assert False, "unknown project must raise"
|
|
except ValueError as e:
|
|
assert "resolve identity" in str(e)
|