@automattic/vip 4.1.4 → 4.1.6

package/internal/customdeploy/archive.go

@@ -1,205 +0,0 @@
-package customdeploy
-
-import (
-	"archive/tar"
-	"archive/zip"
-	"compress/gzip"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"path"
-	"regexp"
-	"strings"
-)
-
-// Error messages — validations/custom-deploy.ts:14.
-const (
-	errMissingThemes = "Missing `themes` directory from root folder."
-	errSymlink       = "Symlink detected: "
-	errSingleRootDir = "The compressed file must contain a single root directory."
-)
-
-const macosxDir = "__MACOSX"
-
-// symlinkIgnoreRE — validations/custom-deploy.ts:22.
-var symlinkIgnoreRE = regexp.MustCompile(`/node_modules/[^/]+/\.bin/`)
-
-// Per-entry name patterns — validations/custom-deploy.ts:67.
-var (
-	invalidDirCharsRE  = regexp.MustCompile(`[!:*?"<>|']|^\.\..*$`)
-	invalidFileCharsRE = regexp.MustCompile(`[!/:*?"<>|']|^\.\..*$`)
-)
-
-// validateName ports validateName (validations/custom-deploy.ts:62).
-func validateName(name string, isDirectory bool) error {
-	if strings.HasPrefix(name, "._") {
-		return nil
-	}
-	re := invalidFileCharsRE
-	chars := `[!/:*?"<>|'/^..]+`
-	if isDirectory {
-		re = invalidDirCharsRE
-		chars = `[!:*?"<>|'/^..]+`
-	}
-	if re.MatchString(name) {
-		return fmt.Errorf("Filename %s contains disallowed characters: %s", name, chars)
-	}
-	return nil
-}
-
-// ValidateZipFile ports validateZipFile (validations/custom-deploy.ts:143).
-func ValidateZipFile(filePath string) error {
-	zr, err := zip.OpenReader(filePath)
-	if err != nil {
-		return fmt.Errorf("Error reading file: %s", err.Error())
-	}
-	defer zr.Close()
-
-	var rootDirs []string
-	for _, f := range zr.File {
-		name := f.Name
-		if !strings.HasSuffix(name, "/") || strings.HasPrefix(name, macosxDir) {
-			continue
-		}
-		if strings.Count(name, "/") == 1 {
-			rootDirs = append(rootDirs, name)
-		}
-	}
-	if len(rootDirs) != 1 {
-		return errors.New(errSingleRootDir)
-	}
-	rootFolder := rootDirs[0]
-
-	// themes/ under the root (validations/custom-deploy.ts:124).
-	hasThemes := false
-	requiredPrefix := path.Join(rootFolder, "themes") + "/"
-	for _, f := range zr.File {
-		name := strings.ReplaceAll(f.Name, `\`, "/")
-		if strings.HasSuffix(f.Name, "/") && strings.HasPrefix(name, requiredPrefix) {
-			hasThemes = true
-			break
-		}
-	}
-	if !hasThemes {
-		return errors.New(errMissingThemes)
-	}
-
-	for _, f := range zr.File {
-		if strings.HasPrefix(f.Name, macosxDir) {
-			continue
-		}
-		isDir := strings.HasSuffix(f.Name, "/")
-		name := f.Name
-		if !isDir {
-			name = path.Base(f.Name)
-		}
-		if err := validateName(name, isDir); err != nil {
-			return err
-		}
-		// Symlink detection: Go's zip reader surfaces the Unix mode bits
-		// from the external attributes (the ts:97 case). The DOS-attr
-		// variant (ts:92) is not reachable through archive/zip — noted as
-		// an intentional gap.
-		if symlinkIgnoreRE.MatchString(f.Name) {
-			continue
-		}
-		if f.Mode()&os.ModeSymlink != 0 {
-			return errors.New(errSymlink + f.Name)
-		}
-	}
-	return nil
-}
-
-// ValidateTarFile ports validateTarFile (validations/custom-deploy.ts:220).
-// Handles gzipped (.tar.gz/.tgz) and plain tar input.
-func ValidateTarFile(filePath string) error {
-	f, err := os.Open(filePath) // #nosec G304 -- user-supplied CLI path
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-
-	var r io.Reader = f
-	magic := make([]byte, 2)
-	if _, err := io.ReadFull(f, magic); err == nil && magic[0] == 0x1f && magic[1] == 0x8b {
-		if _, err := f.Seek(0, io.SeekStart); err != nil {
-			return err
-		}
-		zr, err := gzip.NewReader(f)
-		if err != nil {
-			return err
-		}
-		defer zr.Close()
-		r = zr
-	} else {
-		if _, err := f.Seek(0, io.SeekStart); err != nil {
-			return err
-		}
-	}
-
-	tr := tar.NewReader(r)
-	rootFolder := ""
-	type tarEntry struct {
-		path  string
-		isDir bool
-	}
-	var entries []tarEntry
-
-	for {
-		hdr, err := tr.Next()
-		if err == io.EOF {
-			break
-		}
-		if err != nil {
-			return err
-		}
-		name := hdr.Name
-		if strings.HasPrefix(name, macosxDir) {
-			continue
-		}
-		var isDir, isSymlink bool
-		switch hdr.Typeflag {
-		case tar.TypeDir:
-			isDir = true
-		case tar.TypeReg:
-		case tar.TypeSymlink, tar.TypeLink:
-			isSymlink = hdr.Typeflag == tar.TypeSymlink
-			if !isSymlink {
-				continue
-			}
-		default:
-			continue
-		}
-
-		isRootFolder := isDir && strings.HasSuffix(name, "/") && strings.Count(name, "/") == 1
-		if isRootFolder {
-			if rootFolder == "" {
-				rootFolder = name
-			} else if rootFolder != name {
-				return errors.New(errSingleRootDir)
-			}
-		}
-
-		// validateTarEntry (ts:191): symlink check first, then name.
-		if isSymlink && !symlinkIgnoreRE.MatchString(name) {
-			return errors.New(errSymlink + name)
-		}
-		if err := validateName(path.Base(strings.TrimSuffix(name, "/")), isDir); err != nil {
-			return err
-		}
-		entries = append(entries, tarEntry{path: name, isDir: isDir})
-	}
-
-	if rootFolder == "" {
-		return errors.New(errSingleRootDir)
-	}
-
-	themesPath := path.Join(rootFolder, "themes") + "/"
-	for _, e := range entries {
-		if e.isDir && e.path == themesPath {
-			return nil
-		}
-	}
-	return errors.New(errMissingThemes)
-}

package/internal/customdeploy/archive_test.go

@@ -1,174 +0,0 @@
-package customdeploy
-
-import (
-	"archive/tar"
-	"archive/zip"
-	"compress/gzip"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// buildZip writes a zip with the given entries; names ending in "/" are
-// directories; symlinkTargets maps entry name -> target.
-func buildZip(t *testing.T, entries []string, symlinks map[string]string) string {
-	t.Helper()
-	p := filepath.Join(t.TempDir(), "app.zip")
-	f, err := os.Create(p)
-	if err != nil {
-		t.Fatal(err)
-	}
-	zw := zip.NewWriter(f)
-	for _, name := range entries {
-		hdr := &zip.FileHeader{Name: name}
-		if strings.HasSuffix(name, "/") {
-			hdr.SetMode(os.ModeDir | 0o755)
-		} else {
-			hdr.SetMode(0o644)
-		}
-		w, err := zw.CreateHeader(hdr)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if !strings.HasSuffix(name, "/") {
-			_, _ = w.Write([]byte("x"))
-		}
-	}
-	for name, target := range symlinks {
-		hdr := &zip.FileHeader{Name: name}
-		hdr.SetMode(os.ModeSymlink | 0o777)
-		w, err := zw.CreateHeader(hdr)
-		if err != nil {
-			t.Fatal(err)
-		}
-		_, _ = w.Write([]byte(target))
-	}
-	if err := zw.Close(); err != nil {
-		t.Fatal(err)
-	}
-	if err := f.Close(); err != nil {
-		t.Fatal(err)
-	}
-	return p
-}
-
-// buildTarGz writes a .tar.gz with dirs (trailing /), files, and symlinks.
-func buildTarGz(t *testing.T, dirs, files []string, symlinks map[string]string) string {
-	t.Helper()
-	p := filepath.Join(t.TempDir(), "app.tar.gz")
-	f, err := os.Create(p)
-	if err != nil {
-		t.Fatal(err)
-	}
-	zw := gzip.NewWriter(f)
-	tw := tar.NewWriter(zw)
-	for _, d := range dirs {
-		if err := tw.WriteHeader(&tar.Header{Name: d, Typeflag: tar.TypeDir, Mode: 0o755}); err != nil {
-			t.Fatal(err)
-		}
-	}
-	for _, fl := range files {
-		if err := tw.WriteHeader(&tar.Header{Name: fl, Typeflag: tar.TypeReg, Mode: 0o644, Size: 1}); err != nil {
-			t.Fatal(err)
-		}
-		_, _ = tw.Write([]byte("x"))
-	}
-	for name, target := range symlinks {
-		if err := tw.WriteHeader(&tar.Header{Name: name, Typeflag: tar.TypeSymlink, Linkname: target, Mode: 0o777}); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if err := tw.Close(); err != nil {
-		t.Fatal(err)
-	}
-	if err := zw.Close(); err != nil {
-		t.Fatal(err)
-	}
-	if err := f.Close(); err != nil {
-		t.Fatal(err)
-	}
-	return p
-}
-
-func TestValidateZipFileClean(t *testing.T) {
-	p := buildZip(t, []string{
-		"app/", "app/themes/", "app/themes/style.css", "app/plugins/", "app/plugins/x.php",
-		"__MACOSX/", "__MACOSX/junk!|.txt",
-	}, nil)
-	if err := ValidateZipFile(p); err != nil {
-		t.Errorf("err = %v", err)
-	}
-}
-
-func TestValidateZipFileTwoRoots(t *testing.T) {
-	p := buildZip(t, []string{"a/", "a/themes/", "b/", "b/x.txt"}, nil)
-	if err := ValidateZipFile(p); err == nil || err.Error() != errSingleRootDir {
-		t.Errorf("err = %v", err)
-	}
-}
-
-func TestValidateZipFileMissingThemes(t *testing.T) {
-	p := buildZip(t, []string{"app/", "app/plugins/"}, nil)
-	if err := ValidateZipFile(p); err == nil || err.Error() != errMissingThemes {
-		t.Errorf("err = %v", err)
-	}
-}
-
-func TestValidateZipFileSymlink(t *testing.T) {
-	p := buildZip(t, []string{"app/", "app/themes/"},
-		map[string]string{"app/evil-link": "/etc/passwd"})
-	if err := ValidateZipFile(p); err == nil || !strings.Contains(err.Error(), "Symlink detected: app/evil-link") {
-		t.Errorf("err = %v", err)
-	}
-	// node_modules/.bin symlinks are exempt (validations/custom-deploy.ts:22).
-	p = buildZip(t, []string{"app/", "app/themes/"},
-		map[string]string{"app/node_modules/pkg/.bin/tool": "../lib/tool.js"})
-	if err := ValidateZipFile(p); err != nil {
-		t.Errorf("exempt symlink rejected: %v", err)
-	}
-}
-
-func TestValidateZipFileBadChars(t *testing.T) {
-	p := buildZip(t, []string{"app/", "app/themes/", "app/bad?.txt"}, nil)
-	if err := ValidateZipFile(p); err == nil || !strings.Contains(err.Error(), "contains disallowed characters") {
-		t.Errorf("err = %v", err)
-	}
-}
-
-func TestValidateTarFileClean(t *testing.T) {
-	p := buildTarGz(t,
-		[]string{"app/", "app/themes/"},
-		[]string{"app/themes/style.css"},
-		nil)
-	if err := ValidateTarFile(p); err != nil {
-		t.Errorf("err = %v", err)
-	}
-}
-
-func TestValidateTarFileMissingThemes(t *testing.T) {
-	p := buildTarGz(t, []string{"app/"}, []string{"app/x.php"}, nil)
-	if err := ValidateTarFile(p); err == nil || err.Error() != errMissingThemes {
-		t.Errorf("err = %v", err)
-	}
-}
-
-func TestValidateTarFileTwoRoots(t *testing.T) {
-	p := buildTarGz(t, []string{"a/", "a/themes/", "b/"}, nil, nil)
-	if err := ValidateTarFile(p); err == nil || err.Error() != errSingleRootDir {
-		t.Errorf("err = %v", err)
-	}
-}
-
-func TestValidateTarFileSymlink(t *testing.T) {
-	p := buildTarGz(t, []string{"app/", "app/themes/"}, nil,
-		map[string]string{"app/evil": "/etc/passwd"})
-	if err := ValidateTarFile(p); err == nil || !strings.Contains(err.Error(), "Symlink detected: app/evil") {
-		t.Errorf("err = %v", err)
-	}
-	p = buildTarGz(t, []string{"app/", "app/themes/"}, nil,
-		map[string]string{"app/node_modules/pkg/.bin/tool": "x"})
-	if err := ValidateTarFile(p); err != nil {
-		t.Errorf("exempt symlink rejected: %v", err)
-	}
-}

package/internal/customdeploy/customdeploy.go

@@ -1,91 +0,0 @@
-// Package customdeploy ports src/lib/custom-deploy/custom-deploy.ts and
-// src/lib/validations/custom-deploy.ts — the gates and archive checks
-// behind `vip app deploy` (+ `validate`).
-package customdeploy
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"regexp"
-	"strings"
-
-	"github.com/Automattic/vip/internal/upload"
-)
-
-// DeployMaxFileSize — DEPLOY_MAX_FILE_SIZE = 4 GiB (custom-deploy.ts:11).
-const DeployMaxFileSize = int64(4) * 1024 * 1024 * 1024
-
-// DeployInfo mirrors CustomDeployInfo (custom-deploy.ts:14).
-type DeployInfo struct {
-	AppID             int64
-	EnvID             int64
-	EnvType           string
-	EnvUniqueLabel    string
-	PrimaryDomainName string
-	Launched          bool
-}
-
-// validFilenameRE — validations/custom-deploy.ts:49 (same charset as
-// import sql, different message).
-var validFilenameRE = regexp.MustCompile(`(?i)^[a-z0-9\-_.]+$`)
-
-// ValidateDeployFilename ports validateFilename (validations/custom-deploy.ts:48).
-func ValidateDeployFilename(filename string) error {
-	if !validFilenameRE.MatchString(filename) {
-		return fmt.Errorf("Filename %s contains disallowed characters: [0-9,a-z,A-Z,-,_,.]", filename)
-	}
-	return nil
-}
-
-// ValidateDeployFileExt ports validateDeployFileExt
-// (validations/custom-deploy.ts:31): .zip, .tar.gz, or .tgz.
-func ValidateDeployFileExt(filename string) error {
-	ext := strings.ToLower(filepath.Ext(filename))
-	if ext == ".gz" && strings.ToLower(filepath.Ext(strings.TrimSuffix(filename, filepath.Ext(filename)))) == ".tar" {
-		ext = ".tar.gz"
-	}
-	if ext != ".zip" && ext != ".tar.gz" && ext != ".tgz" {
-		return errors.New("Invalid file extension. Please provide a .zip, .tar.gz, or a .tgz file.")
-	}
-	return nil
-}
-
-// ValidateFile ports validateFile (custom-deploy.ts:74): the gate
-// sequence ahead of upload. maxSize is injectable for tests; 0 uses the
-// 4 GiB production limit.
-func ValidateFile(meta upload.FileMeta, maxSize int64) error {
-	if maxSize == 0 {
-		maxSize = DeployMaxFileSize
-	}
-
-	fi, statErr := os.Stat(meta.FileName)
-	if statErr != nil {
-		return fmt.Errorf("Unable to access file %s", meta.FileName)
-	}
-	if !meta.IsCompressed {
-		return fmt.Errorf("Please compress file %s before uploading.", meta.FileName)
-	}
-	if err := ValidateDeployFilename(meta.BaseName); err != nil {
-		return err
-	}
-	if err := ValidateDeployFileExt(meta.FileName); err != nil {
-		return err
-	}
-	if f, err := os.Open(meta.FileName); err != nil { // #nosec G304 -- checkFileAccess parity
-		return fmt.Errorf("File '%s' does not exist or is not readable.", meta.FileName)
-	} else {
-		f.Close()
-	}
-	if fi.IsDir() {
-		return fmt.Errorf("Path '%s' is not a file.", meta.FileName)
-	}
-	if fi.Size() == 0 {
-		return fmt.Errorf("File '%s' is empty.", meta.FileName)
-	}
-	if fi.Size() > maxSize {
-		return fmt.Errorf("The deploy file size (%d bytes) exceeds the limit (%d bytes).", fi.Size(), maxSize)
-	}
-	return nil
-}

package/internal/customdeploy/customdeploy_test.go

@@ -1,82 +0,0 @@
-package customdeploy
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/Automattic/vip/internal/upload"
-)
-
-func metaFor(t *testing.T, name string, content []byte) upload.FileMeta {
-	t.Helper()
-	p := filepath.Join(t.TempDir(), name)
-	if err := os.WriteFile(p, content, 0o600); err != nil {
-		t.Fatal(err)
-	}
-	meta, err := upload.GetFileMeta(p)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return meta
-}
-
-// gzMagic makes content sniff as gzip so IsCompressed is true.
-var gzMagic = []byte{0x1f, 0x8b, 0x08, 0x00, 0x01, 0x02, 0x03}
-
-func TestValidateDeployFileExt(t *testing.T) {
-	for name, ok := range map[string]bool{
-		"app.zip": true, "app.tar.gz": true, "app.tgz": true, "APP.TGZ": true,
-		"app.sql": false, "app.gz": false, "app.tar": false,
-	} {
-		err := ValidateDeployFileExt(name)
-		if ok && err != nil {
-			t.Errorf("%s: unexpected err %v", name, err)
-		}
-		if !ok && (err == nil || !strings.Contains(err.Error(), "Invalid file extension. Please provide a .zip, .tar.gz, or a .tgz file.")) {
-			t.Errorf("%s: err = %v", name, err)
-		}
-	}
-}
-
-func TestValidateDeployFilename(t *testing.T) {
-	if err := ValidateDeployFilename("release-1.2.3.tgz"); err != nil {
-		t.Errorf("err = %v", err)
-	}
-	err := ValidateDeployFilename("bad name!.zip")
-	if err == nil || !strings.Contains(err.Error(), "Filename bad name!.zip contains disallowed characters: [0-9,a-z,A-Z,-,_,.]") {
-		t.Errorf("err = %v", err)
-	}
-}
-
-func TestValidateFileGates(t *testing.T) {
-	uncompressed := metaFor(t, "app.tgz", []byte("plain text, not gzip"))
-	if err := ValidateFile(uncompressed, 0); err == nil ||
-		!strings.Contains(err.Error(), "Please compress file") {
-		t.Errorf("err = %v", err)
-	}
-
-	good := metaFor(t, "app.tgz", gzMagic)
-	if err := ValidateFile(good, 0); err != nil {
-		t.Errorf("err = %v", err)
-	}
-
-	tooBig := metaFor(t, "app.tgz", append(gzMagic, make([]byte, 100)...))
-	if err := ValidateFile(tooBig, 10); err == nil ||
-		!strings.Contains(err.Error(), "exceeds the limit (10 bytes).") {
-		t.Errorf("err = %v", err)
-	}
-
-	missing := upload.FileMeta{FileName: filepath.Join(t.TempDir(), "nope.tgz"), BaseName: "nope.tgz", IsCompressed: true}
-	if err := ValidateFile(missing, 0); err == nil ||
-		!strings.Contains(err.Error(), "Unable to access file") {
-		t.Errorf("err = %v", err)
-	}
-
-	badExt := metaFor(t, "app.gz", gzMagic)
-	if err := ValidateFile(badExt, 0); err == nil ||
-		!strings.Contains(err.Error(), "Invalid file extension.") {
-		t.Errorf("err = %v", err)
-	}
-}

package/internal/debuglog/debuglog.go

@@ -1,85 +0,0 @@
-// Package debuglog emits opt-in diagnostics using Node debug namespace selectors.
-// Loggers belong to an invocation context, so commands and tests cannot leak
-// their debug settings or output writers into another invocation.
-package debuglog
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"regexp"
-	"strings"
-	"sync"
-	"unicode"
-)
-
-type contextKey struct{}
-
-type logger struct {
-	mu               sync.Mutex
-	out              io.Writer
-	include, exclude []*regexp.Regexp
-}
-
-// WithLogger accepts comma/whitespace-separated namespaces, '*' wildcards,
-// and '-' exclusions, matching the Node debug package's selector grammar.
-func WithLogger(ctx context.Context, namespaces string, out io.Writer) context.Context {
-	l := &logger{out: out}
-	for _, pattern := range strings.FieldsFunc(namespaces, func(r rune) bool { return r == ',' || unicode.IsSpace(r) }) {
-		exclude := strings.HasPrefix(pattern, "-")
-		pattern = strings.TrimPrefix(pattern, "-")
-		if pattern == "" {
-			continue
-		}
-		expression := "^" + strings.ReplaceAll(regexp.QuoteMeta(pattern), `\*`, ".*") + "$"
-		re := regexp.MustCompile(expression)
-		if exclude {
-			l.exclude = append(l.exclude, re)
-		} else {
-			l.include = append(l.include, re)
-		}
-	}
-	return context.WithValue(ctx, contextKey{}, l)
-}
-
-// Enabled lets callers avoid constructing expensive diagnostic metadata when
-// its namespace is disabled.
-func Enabled(ctx context.Context, namespace string) bool {
-	if ctx == nil {
-		return false
-	}
-	l, _ := ctx.Value(contextKey{}).(*logger)
-	if l == nil || l.out == nil {
-		return false
-	}
-	for _, re := range l.exclude {
-		if re.MatchString(namespace) {
-			return false
-		}
-	}
-	for _, re := range l.include {
-		if re.MatchString(namespace) {
-			return true
-		}
-	}
-	return false
-}
-
-// Printf writes one diagnostic line if namespace is enabled. Callers must pass
-// only safe fields: this function escapes terminal controls, not secrets.
-func Printf(ctx context.Context, namespace, format string, args ...any) {
-	if !Enabled(ctx, namespace) {
-		return
-	}
-	l := ctx.Value(contextKey{}).(*logger)
-	line := namespace + " " + fmt.Sprintf(format, args...)
-	line = strings.Map(func(r rune) rune {
-		if unicode.IsControl(r) {
-			return ' '
-		}
-		return r
-	}, line)
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	_, _ = fmt.Fprintln(l.out, line)
-}

package/internal/debuglog/debuglog_test.go

@@ -1,44 +0,0 @@
-package debuglog
-
-import (
-	"bytes"
-	"context"
-	"strings"
-	"testing"
-)
-
-func TestNamespaceFiltering(t *testing.T) {
-	for _, tc := range []struct{ selector, want string }{
-		{"", ""},
-		{"*", "alpha one\nbeta two\n"},
-		{"alpha", "alpha one\n"},
-		{"a*,beta", "alpha one\nbeta two\n"},
-		{"*,-beta", "alpha one\n"},
-		{"-beta,*", "alpha one\n"},
-		{"alpha beta", "alpha one\nbeta two\n"},
-		{"[ab]*", ""},
-	} {
-		t.Run(tc.selector, func(t *testing.T) {
-			var out bytes.Buffer
-			ctx := WithLogger(context.Background(), tc.selector, &out)
-			Printf(ctx, "alpha", "%s", "one")
-			Printf(ctx, "beta", "%s", "two")
-			if out.String() != tc.want {
-				t.Fatalf("output = %q, want %q", out.String(), tc.want)
-			}
-		})
-	}
-}
-
-func TestLoggerIsScopedToContextAndEscapesControls(t *testing.T) {
-	var out bytes.Buffer
-	ctx := WithLogger(context.Background(), "*", &out)
-	Printf(context.Background(), "alpha", "must stay silent")
-	Printf(ctx, "alpha", "name=%s", "one\n\x1b[31mtwo")
-	if strings.Count(out.String(), "\n") != 1 || strings.Contains(out.String(), "\x1b") {
-		t.Fatalf("unsafe output: %q", out.String())
-	}
-	if !strings.Contains(out.String(), "one") || !strings.Contains(out.String(), "two") {
-		t.Fatalf("missing diagnostic: %q", out.String())
-	}
-}