test_q2_ok_cli_security.py
file-level
1
files
1
commits
0
hotspots
0
🧊 dead
0
💥 blast risk
| 1 | """Security tests for Track Q / Q2b OK CLI entrypoint (§Q2A.10).""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | import json |
| 6 | from pathlib import Path |
| 7 | |
| 8 | from tests.support import KIT_ROOT, OVERSEER_DEPRECATION_LINE, run_cli, run_shim, seed_git_repo, write_config |
| 9 | |
| 10 | |
| 11 | def test_deprecation_line_has_no_absolute_paths_or_secrets() -> None: |
| 12 | line = OVERSEER_DEPRECATION_LINE.strip() |
| 13 | assert "/" not in line |
| 14 | assert "Users" not in line |
| 15 | assert "token" not in line.lower() |
| 16 | assert line == "warning: 'overseer' is deprecated; use 'ok' (same commands)." |
| 17 | |
| 18 | |
| 19 | def test_overseer_json_stdout_is_single_object_deprecation_on_stderr(tmp_path: Path) -> None: |
| 20 | seed_git_repo(tmp_path) |
| 21 | write_config(tmp_path, "config-git-only.yaml") |
| 22 | run_cli(["init", "--regime", "git-only", "--non-interactive", "--force"], cwd=tmp_path) |
| 23 | result = run_shim("overseer", ["status", "--json"], cwd=tmp_path) |
| 24 | assert result.stderr == OVERSEER_DEPRECATION_LINE |
| 25 | payload = json.loads(result.stdout) |
| 26 | assert isinstance(payload, dict) |
| 27 | assert "warning:" not in result.stdout |
| 28 | |
| 29 | |
| 30 | def test_shims_forward_args_without_shell_expansion(tmp_path: Path) -> None: |
| 31 | seed_git_repo(tmp_path) |
| 32 | write_config(tmp_path, "config-git-only.yaml") |
| 33 | run_cli(["init", "--regime", "git-only", "--non-interactive", "--force"], cwd=tmp_path) |
| 34 | weird = run_shim("ok", ["status", "--json"], cwd=tmp_path) |
| 35 | assert weird.exit_code == 0 |
| 36 | text = (KIT_ROOT / "cli" / "ok").read_text(encoding="utf-8") |
| 37 | assert '"$@"' in text |
| 38 | assert "eval" not in text |