aaronrene / overseer-kit public
test_q2_ok_cli_security.py python
38 lines 1.5 KB
Raw
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1 docs: MuseHub-first before ISR #74 — staging solidify NEXT Human 2 days ago
1 """Security tests for Track Q / Q2b OK CLI entrypoint (§Q2A.10)."""
2
3 from __future__ import annotations
4
5 import json
6 from pathlib import Path
7
8 from tests.support import KIT_ROOT, OVERSEER_DEPRECATION_LINE, run_cli, run_shim, seed_git_repo, write_config
9
10
11 def test_deprecation_line_has_no_absolute_paths_or_secrets() -> None:
12 line = OVERSEER_DEPRECATION_LINE.strip()
13 assert "/" not in line
14 assert "Users" not in line
15 assert "token" not in line.lower()
16 assert line == "warning: 'overseer' is deprecated; use 'ok' (same commands)."
17
18
19 def test_overseer_json_stdout_is_single_object_deprecation_on_stderr(tmp_path: Path) -> None:
20 seed_git_repo(tmp_path)
21 write_config(tmp_path, "config-git-only.yaml")
22 run_cli(["init", "--regime", "git-only", "--non-interactive", "--force"], cwd=tmp_path)
23 result = run_shim("overseer", ["status", "--json"], cwd=tmp_path)
24 assert result.stderr == OVERSEER_DEPRECATION_LINE
25 payload = json.loads(result.stdout)
26 assert isinstance(payload, dict)
27 assert "warning:" not in result.stdout
28
29
30 def test_shims_forward_args_without_shell_expansion(tmp_path: Path) -> None:
31 seed_git_repo(tmp_path)
32 write_config(tmp_path, "config-git-only.yaml")
33 run_cli(["init", "--regime", "git-only", "--non-interactive", "--force"], cwd=tmp_path)
34 weird = run_shim("ok", ["status", "--json"], cwd=tmp_path)
35 assert weird.exit_code == 0
36 text = (KIT_ROOT / "cli" / "ok").read_text(encoding="utf-8")
37 assert '"$@"' in text
38 assert "eval" not in text
File History 1 commit
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1 docs: MuseHub-first before ISR #74 — staging solidify NEXT Human 2 days ago