@automattic/vip 4.1.4 → 4.1.6

package/internal/parity/keychain_test.go

@@ -1,201 +0,0 @@
-//go:build parity
-
-package parity
-
-import (
-	"fmt"
-	"os"
-	"testing"
-)
-
-// realCredentialsOnDevMachines is the set of service names that belong to a
-// human — a developer's actual login, a long-lived local Parker, the
-// dead-loopback and hostile-proxy hosts the harness pins. Every one of them
-// MUST be refused by the guard. This list is a TEST FIXTURE, not the guard's
-// implementation: the guard is a positive match on the ephemeral shape and has
-// no denylist, so adding a name here can only ever prove the property, never
-// create it.
-var realCredentialsOnDevMachines = []string{
-	"vip-go-cli",
-	"vip-go-cli-uuid",
-	"vip-next-cli",
-	"vip-next-cli-uuid",
-	"vip-go-cli:http---127-0-0-1-4000-uuid",
-	"vip-go-cli:http---localhost-4000",
-	"vip-go-cli:http---localhost-4000-uuid",
-	"vip-go-cli:http---127-0-0-1-9-uuid",
-	"vip-next-cli:http---127-0-0-1-9-uuid",
-	"vip-go-cli:http---127-0-0-1-1",
-	"vip-go-cli:https---api-wpvip-com",
-	"vip-next-cli:elevated",
-	"vip-next-cli:elevated:https---api-wpvip-com",
-}
-
-// TestKeychainGuardRefusesRealCredentials is the safety property the whole
-// keychain mechanism rests on. If this test ever goes red, the harness can
-// delete a developer's live login.
-func TestKeychainGuardRefusesRealCredentials(t *testing.T) {
-	for _, name := range realCredentialsOnDevMachines {
-		if IsEphemeralParityService(name) {
-			t.Errorf("guard ACCEPTED a real credential %q — the harness could destroy it", name)
-		}
-		if err := assertEphemeralParityService("write", name); err == nil {
-			t.Errorf("assertEphemeralParityService(write, %q) = nil, want refusal", name)
-		}
-		if err := assertEphemeralParityService("delete", name); err == nil {
-			t.Errorf("assertEphemeralParityService(delete, %q) = nil, want refusal", name)
-		}
-	}
-}
-
-// TestKeychainMutatorsRefuseNonEphemeralNames proves the refusal is enforced at
-// the mutating call sites, not merely available as a predicate. Neither call
-// may reach /usr/bin/security.
-func TestKeychainMutatorsRefuseNonEphemeralNames(t *testing.T) {
-	const real = "vip-go-cli"
-
-	if err := DeleteParityKeychainService(real); err == nil {
-		t.Fatalf("DeleteParityKeychainService(%q) = nil, want refusal", real)
-	}
-	// SeedNodeKeychainToken derives the service from the host, so feed it a host
-	// that yields the production name.
-	if err := SeedNodeKeychainToken("/nonexistent/vip.js", nodeProductionAPIHost, "a.b.c"); err == nil {
-		t.Fatal("SeedNodeKeychainToken against the production API host = nil, want refusal")
-	}
-	if err := CleanupParityKeychainServices([]string{real}); err == nil {
-		t.Fatalf("CleanupParityKeychainServices([%q]) = nil, want refusal", real)
-	}
-}
-
-func TestKeychainGuardAcceptsEphemeralScopedNames(t *testing.T) {
-	accepted := []string{
-		"vip-go-cli:http---127-0-0-1-63145",
-		"vip-go-cli:http---127-0-0-1-63145-uuid",
-		"vip-next-cli:http---127-0-0-1-61991",
-		"vip-next-cli:elevated:http---127-0-0-1-62010",
-		"vip-go-cli:http---127-0-0-1-32768",
-		"vip-next-cli:http---127-0-0-1-65535",
-	}
-	for _, name := range accepted {
-		if !IsEphemeralParityService(name) {
-			t.Errorf("guard refused %q, which only an httptest server can produce", name)
-		}
-	}
-
-	// Just below the ephemeral floor is refused: a port a human picked.
-	if IsEphemeralParityService("vip-go-cli:http---127-0-0-1-32767") {
-		t.Error("guard accepted port 32767, below the ephemeral floor")
-	}
-	// A port that cannot exist is refused rather than wrapped.
-	if IsEphemeralParityService("vip-go-cli:http---127-0-0-1-65536") {
-		t.Error("guard accepted port 65536")
-	}
-	// Suffixes and prefixes must not sneak past.
-	for _, name := range []string{
-		"xvip-go-cli:http---127-0-0-1-63145",
-		"vip-go-cli:http---127-0-0-1-63145-uuid-extra",
-		"vip-go-cli:http---127-0-0-1-63145:legacy-fallback-disabled",
-		"vip-other-cli:http---127-0-0-1-63145",
-	} {
-		if IsEphemeralParityService(name) {
-			t.Errorf("guard accepted %q", name)
-		}
-	}
-}
-
-// TestNodeKeychainServiceMatchesNodeDerivation pins the port of
-// Token.getServiceName (src/lib/token.ts:119-129). If Node's derivation ever
-// changes, the differential would silently authenticate nothing; this catches
-// it at the unit level instead.
-func TestNodeKeychainServiceMatchesNodeDerivation(t *testing.T) {
-	cases := []struct {
-		host, modifier, want string
-	}{
-		// PRODUCTION_API_HOST !== API_HOST is false -> bare SERVICE.
-		{nodeProductionAPIHost, "", "vip-go-cli"},
-		{nodeProductionAPIHost, "-uuid", "vip-go-cli-uuid"},
-		// Everything else is suffixed with the sanitised host.
-		{"http://127.0.0.1:63145", "", "vip-go-cli:http---127-0-0-1-63145"},
-		{"http://127.0.0.1:63145", "-uuid", "vip-go-cli:http---127-0-0-1-63145-uuid"},
-		{"http://localhost:4000", "", "vip-go-cli:http---localhost-4000"},
-		// The /i flag on Node's regex means uppercase is alphanumeric too.
-		{"https://API.WPVIP.com", "", "vip-go-cli:https---API-WPVIP-com"},
-	}
-	for _, tc := range cases {
-		if got := NodeKeychainService(tc.host, tc.modifier); got != tc.want {
-			t.Errorf("NodeKeychainService(%q, %q) = %q, want %q", tc.host, tc.modifier, got, tc.want)
-		}
-	}
-}
-
-// TestParityKeychainServicesCoversBothCLIs asserts the cleanup set names every
-// entry a differential run can create, and that all of them clear the guard —
-// an entry the guard would refuse is an entry cleanup cannot remove.
-func TestParityKeychainServicesCoversBothCLIs(t *testing.T) {
-	const host = "http://127.0.0.1:54321"
-	got := ParityKeychainServices(host)
-
-	want := map[string]bool{
-		"vip-go-cli:http---127-0-0-1-54321":            false, // Node token (seeded here)
-		"vip-go-cli:http---127-0-0-1-54321-uuid":       false, // Node analytics anon-id
-		"vip-next-cli:http---127-0-0-1-54321":          false, // Go auth store
-		"vip-next-cli:elevated:http---127-0-0-1-54321": false, // Go rechallenge cache
-	}
-	for _, name := range got {
-		if _, ok := want[name]; !ok {
-			t.Errorf("unexpected service %q in the cleanup set", name)
-			continue
-		}
-		want[name] = true
-		if !IsEphemeralParityService(name) {
-			t.Errorf("cleanup set contains %q, which the guard refuses to delete", name)
-		}
-	}
-	for name, seen := range want {
-		if !seen {
-			t.Errorf("cleanup set is missing %q", name)
-		}
-	}
-}
-
-// TestMain brackets the whole parity suite with credential cleanup.
-//
-// PRE-RUN SWEEP: collect entries left by a run that was killed before any
-// cleanup could fire. POST-RUN: tear down the shared differential rig (which
-// deletes the one credential the run seeded, through Node's own keychain layer
-// so it works on any backend), then sweep again for entries the CLIs under
-// test wrote for THEMSELVES — the Go binary creates its own vip-next-cli:<host>
-// and vip-next-cli:elevated:<host> credentials during the login and rechallenge
-// scenarios, which no named cleanup knows about.
-//
-// Order matters: the rig teardown must run before the sweep, so that anything
-// it fails to remove is still caught by the sweep rather than surviving to the
-// next run.
-//
-// Together this is what makes the `vip*` service count identical before and
-// after `make test-parity-unit`, and keeps it identical as scenarios are added
-// — the run seeds ONE credential regardless of how many differentials there
-// are (see differential_test.go).
-//
-// Sweep failures are reported but never fail the suite: this is hygiene, not an
-// assertion about the code under test.
-func TestMain(m *testing.M) {
-	reportSweep("pre-run (orphans from an interrupted run)")
-	code := m.Run()
-	teardownDifferentialRig()
-	reportSweep("post-run (entries the CLIs under test created)")
-	os.Exit(code)
-}
-
-func reportSweep(phase string) {
-	removed, err := SweepEphemeralParityKeychain()
-	if err != nil {
-		// Not fatal: on Linux/CI there is no keychain to sweep, and a locked
-		// keychain is the developer's business, not this suite's.
-		fmt.Fprintf(os.Stderr, "parity keychain sweep %s: %v\n", phase, err)
-	}
-	// Service names are not secrets; the values under them are never read.
-	for _, name := range removed {
-		fmt.Fprintf(os.Stderr, "parity keychain sweep %s: removed %s\n", phase, name)
-	}
-}

package/internal/parity/m5_differential_test.go

@@ -1,185 +0,0 @@
-//go:build parity
-
-package parity
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// m5DifferentialScenarios is the vetted allowlist of M5 scenarios that run as
-// REAL Node-vs-Go differentials: both CLIs are executed against the same
-// httptest mock and stdout+stderr+exit-code are diffed.
-//
-// TestM5Scenarios (m5_scenarios_test.go) runs the same YAML against vip-next
-// ONLY, and asserts nothing but the exit code. That is a Go-behaviour test
-// wearing a parity build tag — it is how the `--format=keyValue` shape
-// divergence survived a review. Membership here is what makes a scenario
-// actually compare the two implementations.
-//
-// A scenario belongs here only if all three hold:
-//
-//  1. read-only and side-effect free (no mutation reaches the mock),
-//  2. the mock already serves every operation BOTH CLIs issue,
-//  3. the Node CLI needs no credential beyond the one the rig seeds.
-//
-// Everything else must be listed in m5DifferentialExclusions with a reason.
-// TestEveryM5ScenarioIsClassified fails when a scenario appears in neither, so
-// a new YAML cannot quietly opt out of the differential.
-var m5DifferentialScenarios = []string{
-	// `app list` — the review's named high-signal target. Covers the default
-	// table renderer plus the three --format branches and the empty case.
-	"app-list-baseline",
-	"app-list-json",
-	"app-list-csv",
-	"app-list-empty",
-	// Two --format branches the review named that had no scenario at all.
-	"app-list-ids",
-	"app-list-unknown-format",
-
-	// `config envvar list` — the format matrix the keyValue divergence hid in.
-	"envvar-list-baseline",
-	"envvar-list-json",
-	"envvar-list-keyvalue",
-	"envvar-list-ids",
-	"envvar-list-empty",
-
-	// `config envvar get-all` — second keyValue surface (key + value columns).
-	"envvar-getall-baseline",
-	"envvar-getall-keyvalue",
-	"envvar-getall-empty",
-
-	// `config envvar get` — single-value read path. envvar-get-named-help is
-	// the cutover-2.13 repro: the positional is a VARIABLE named "help", not a
-	// help request, so it is an ordinary read and belongs here.
-	"envvar-get-baseline",
-	"envvar-get-not-found",
-	"envvar-get-lowercase-input",
-	"envvar-get-named-help",
-
-	// `logs` — the review flagged tab mangling and a `__typename` column shift.
-	"logs-baseline",
-	"logs-format-json",
-	"logs-empty",
-	"logs-batch",
-	"logs-limit-100",
-
-	// `slowlogs` — same renderer family, independent query.
-	"slowlogs-baseline",
-	"slowlogs-csv",
-	"slowlogs-empty",
-	"slowlogs-limit-50",
-
-	// `app get` — read-only app lookup. app-get-custom-deploy is named for the
-	// environment's deploymentStrategy in the recording, not for a deploy
-	// token; it needs no credential beyond the seeded one.
-	"app-get-baseline",
-	"app-get-json",
-	"app-get-not-found",
-	"app-get-custom-deploy",
-}
-
-// m5DifferentialExclusions records M5 scenarios deliberately NOT run as
-// differentials, each with the reason. Keep the reason specific: "flaky" is not
-// a reason, "Node authenticates with a deploy token the fixture env does not
-// carry" is. Verify the reason against the scenario's YAML and the Node source
-// before adding an entry — a plausible-sounding reason that turns out to be
-// wrong is how coverage silently disappears.
-//
-// Currently empty: every M5 scenario runs as a real differential.
-var m5DifferentialExclusions = map[string]string{}
-
-func TestM5DifferentialParity(t *testing.T) {
-	rig, skip := differentialAvailable(t)
-	if skip != "" {
-		t.Skip(LoudSkip("TestM5DifferentialParity — every M5 Node-vs-Go differential scenario", skip))
-	}
-
-	for _, name := range m5DifferentialScenarios {
-		// No t.Parallel: subtests swap the shared server's handler.
-		t.Run(name, func(t *testing.T) {
-			path := "../../testdata/parity/" + name + ".yaml"
-			scenario, err := LoadScenario(path)
-			if err != nil {
-				t.Fatalf("LoadScenario(%s): %v", path, err)
-			}
-
-			rig.serve(t, m5Mux(t, scenario.Recording))
-			scenario.Env = rig.scenarioEnv(scenario)
-
-			d, err := CompareBinaries(scenario, rig.nodeBin, rig.goBin)
-			if err != nil {
-				t.Fatalf("CompareBinaries(%s): %v", name, err)
-			}
-			if d.Equal {
-				if scenario.ExpectedDrift != nil {
-					t.Errorf("%s carries expected_drift (%s) but Node and Go now agree. "+
-						"Delete the annotation.", name, scenario.ExpectedDrift.Reason)
-				}
-				return
-			}
-
-			// A divergence is a FINDING. It may only be downgraded to a note by
-			// an explicit, reasoned and fingerprinted expected_drift in the scenario YAML — which
-			// is a decision about product behaviour, recorded next to the
-			// scenario, not something the harness may infer.
-			report := "Node vs Go diverge (argv: %v):\n  %s\n  %s\n  %s"
-			if scenario.ExpectedDrift != nil {
-				// Announced on stderr as well as via t.Log so it survives into
-				// any run that keeps output. `go test` discards a PASSING
-				// package's output entirely without -v, which is why
-				// `make test-parity-unit` also prints the blessed list up front
-				// (blessed-drift-status), reading the same YAML annotations.
-				fmt.Fprintf(os.Stderr, "parity: BLESSED DRIFT %s — %s\n",
-					name, strings.Join(strings.Fields(scenario.ExpectedDrift.Reason), " "))
-				t.Logf("BLESSED DRIFT — "+scenario.ExpectedDrift.Reason+"\n"+report,
-					scenario.Argv, d.ExitCodeDelta, d.StdoutDelta, d.StderrDelta)
-				return
-			}
-			t.Errorf(report, scenario.Argv, d.ExitCodeDelta, d.StdoutDelta, d.StderrDelta)
-		})
-	}
-}
-
-// TestEveryM5ScenarioIsClassified is the anti-drift guard. Every M5 YAML must
-// be either a differential or an explicitly-reasoned exclusion. Without it,
-// adding a scenario silently produces another Go-vs-mock test that looks like
-// parity coverage and is not.
-func TestEveryM5ScenarioIsClassified(t *testing.T) {
-	entries, err := filepath.Glob("../../testdata/parity/*.yaml")
-	if err != nil {
-		t.Fatalf("glob yaml: %v", err)
-	}
-
-	inDifferential := make(map[string]bool, len(m5DifferentialScenarios))
-	for _, name := range m5DifferentialScenarios {
-		inDifferential[name] = true
-	}
-
-	var seen int
-	for _, path := range entries {
-		base := strings.TrimSuffix(filepath.Base(path), ".yaml")
-		if !isM5Scenario(base) {
-			continue
-		}
-		seen++
-		if inDifferential[base] {
-			continue
-		}
-		if reason, ok := m5DifferentialExclusions[base]; ok {
-			if strings.TrimSpace(reason) == "" {
-				t.Errorf("%s is excluded from the differential with an empty reason", base)
-			}
-			continue
-		}
-		t.Errorf("M5 scenario %s runs against the mock only. Add it to "+
-			"m5DifferentialScenarios, or to m5DifferentialExclusions with a reason "+
-			"saying why Node cannot run it.", base)
-	}
-	if seen == 0 {
-		t.Fatal("no M5 scenarios found — testdata may have moved")
-	}
-}

package/internal/parity/m5_scenarios_test.go

@@ -1,225 +0,0 @@
-//go:build parity
-
-package parity
-
-import (
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// m5Mux returns an HTTP handler that dispatches GraphQL requests to recording
-// files by matching the "operationName" field in the request body.
-//
-// It must answer BOTH CLIs, because these recordings back real Node-vs-Go
-// differentials (TestM5DifferentialParity), not just vip-next. The two
-// implementations name the same operations differently — Node's queries are
-// written inline in src/, Go's are genqlient operations in
-// internal/gql/operations/ — so each fixture is reachable under either name.
-//
-// Go operation → file mapping:
-//
-//	AppList                              -> apps.json
-//	AppGetByName, AppGetByID             -> app.json
-//	ResolveAppByName, ResolveAppByID     -> resolve-app.json
-//	GetEnvironmentVariables              -> envvars.json
-//	GetEnvironmentVariablesWithValues    -> envvars.json
-//	GetAppLogs                           -> logs.json
-//	GetAppSlowlogs                       -> slowlogs.json
-//
-// Node operation → file mapping (names verified against trunk 4.1.0):
-//
-//	Apps  (src/bin/vip-app-list.js:37)   -> apps.json
-//	App   (src/lib/api/app.ts:46,69)     -> resolve-app.json, else app.json
-//	GetEnvironmentVariables              (src/lib/envvar/api-list.ts:11)
-//	GetEnvironmentVariablesWithValues    (src/lib/envvar/api-get-all.ts:11)
-//	GetAppLogs                           (src/lib/app-logs/app-logs.ts:10 AND
-//	                                      src/lib/app-slowlogs/app-slowlogs.ts:12)
-//
-// Node issues ONE `App` operation where Go issues two differently-named ones:
-// src/lib/api/app.ts serves both the `@app.env` context resolution and
-// `vip app <name>`, varying only the requested field set. The recordings keep
-// that split (resolve-app.json vs app.json), so `App` prefers resolve-app.json
-// and falls back to app.json — which is exactly the file the correspondingly
-// named Go operation would have been served.
-//
-// If a recording file is absent, serves {"data":null} (non-fatal).
-func m5Mux(t *testing.T, recordingDir string) http.Handler {
-	t.Helper()
-	base := "../../testdata/parity/recordings/" + recordingDir + "/"
-
-	maybeRead := func(name string) []byte {
-		b, err := os.ReadFile(base + name)
-		if err != nil {
-			return nil
-		}
-		return b
-	}
-
-	appsBody := maybeRead("apps.json")
-	appBody := maybeRead("app.json")
-	resolveAppBody := maybeRead("resolve-app.json")
-	envvarsBody := maybeRead("envvars.json")
-	logsBody := maybeRead("logs.json")
-	slowlogsBody := maybeRead("slowlogs.json")
-
-	nullBody := []byte(`{"data":null}`)
-
-	serve := func(w http.ResponseWriter, body []byte) {
-		if body == nil {
-			body = nullBody
-		}
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write(body)
-	}
-
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		body, _ := io.ReadAll(r.Body)
-		s := string(body)
-
-		switch {
-		// Node's `Apps` must be matched before its `App`: the trailing quote in
-		// the literal already prevents `"App"` from matching `"Apps"`, but
-		// keeping the wider name first documents the intent.
-		case strings.Contains(s, `"operationName":"AppList"`),
-			strings.Contains(s, `"operationName":"Apps"`):
-			serve(w, appsBody)
-		case strings.Contains(s, `"operationName":"AppGetByName"`),
-			strings.Contains(s, `"operationName":"AppGetByID"`):
-			serve(w, appBody)
-		case strings.Contains(s, `"operationName":"ResolveAppByName"`),
-			strings.Contains(s, `"operationName":"ResolveAppByID"`):
-			serve(w, resolveAppBody)
-		// Node's single `App` operation covers both of the two cases above.
-		case strings.Contains(s, `"operationName":"App"`):
-			if resolveAppBody != nil {
-				serve(w, resolveAppBody)
-			} else {
-				serve(w, appBody)
-			}
-		// Order matters: WithValues is checked first because its op-name
-		// contains "GetEnvironmentVariables" as a substring. Swapping
-		// these cases would silently misroute the values variant.
-		case strings.Contains(s, `"operationName":"GetEnvironmentVariablesWithValues"`):
-			serve(w, envvarsBody)
-		case strings.Contains(s, `"operationName":"GetEnvironmentVariables"`):
-			serve(w, envvarsBody)
-		case strings.Contains(s, `"operationName":"GetAppSlowlogs"`):
-			serve(w, slowlogsBody)
-		// Node names its slowlogs query `GetAppLogs` too
-		// (src/lib/app-slowlogs/app-slowlogs.ts:12 and
-		// src/lib/app-logs/app-logs.ts:10 declare the same operation name), so
-		// the operation name alone cannot route Node's two log queries. The
-		// selection set is what distinguishes them: slowlogs selects
-		// `slowlogs(`, runtime logs select `logs(`.
-		case strings.Contains(s, `"operationName":"GetAppLogs"`):
-			if strings.Contains(s, "slowlogs(") {
-				serve(w, slowlogsBody)
-			} else {
-				serve(w, logsBody)
-			}
-		default:
-			w.Header().Set("Content-Type", "application/json")
-			_, _ = w.Write(nullBody)
-		}
-	})
-}
-
-// m5Prefixes are the YAML name prefixes that identify M5 backlog scenarios.
-var m5Prefixes = []string{
-	"app-list-",
-	"app-get-",
-	"envvar-list-",
-	"envvar-get-",
-	"envvar-getall-",
-	"logs-",
-	"slowlogs-",
-}
-
-func isM5Scenario(name string) bool {
-	for _, p := range m5Prefixes {
-		if strings.HasPrefix(name, p) {
-			return true
-		}
-	}
-	return false
-}
-
-// TestM5Scenarios discovers every YAML under testdata/parity/ whose filename
-// matches an M5 prefix, starts a mock GraphQL server backed by the scenario's
-// recording directory, and asserts the Go binary exits with the expected code.
-func TestM5Scenarios(t *testing.T) {
-	yamlDir := "../../testdata/parity"
-	entries, err := filepath.Glob(yamlDir + "/*.yaml")
-	if err != nil {
-		t.Fatalf("glob yaml: %v", err)
-	}
-
-	var m5 []string
-	for _, path := range entries {
-		base := strings.TrimSuffix(filepath.Base(path), ".yaml")
-		if isM5Scenario(base) {
-			m5 = append(m5, path)
-		}
-	}
-	if len(m5) == 0 {
-		t.Fatal("no M5 scenarios found — testdata may have moved")
-	}
-
-	// Build the binary once for all subtests.
-	goBin := buildVipNextWithVersion(t, "test", "test")
-
-	for _, path := range m5 {
-		scenarioName := strings.TrimSuffix(filepath.Base(path), ".yaml")
-
-		t.Run(scenarioName, func(t *testing.T) {
-			scenario, err := LoadScenario(path)
-			if err != nil {
-				t.Fatalf("LoadScenario(%s): %v", path, err)
-			}
-
-			// A scenario carrying expected_drift asserts NODE's behaviour, which
-			// vip-next deliberately does not reproduce, so the exit-code check
-			// here would be wrong. Skipping loses nothing: every M5 scenario now
-			// also runs as a real Node-vs-Go differential
-			// (TestM5DifferentialParity), which compares stdout, stderr AND the
-			// exit code and announces the blessed divergence on stderr — that is
-			// strictly stronger than this exit-code-only assertion.
-			if scenario.ExpectedDrift != nil {
-				t.Skipf("expected drift (%s); asserted by TestM5DifferentialParity instead of %s",
-					scenario.ExpectedDrift.Reason, scenarioName)
-				return
-			}
-
-			mux := m5Mux(t, scenario.Recording)
-			srv := httptest.NewServer(mux)
-			defer srv.Close()
-
-			if scenario.Env == nil {
-				scenario.Env = map[string]string{}
-			}
-			scenario.Env["API_HOST"] = srv.URL
-			scenario.Env["VIP_TOKEN_OVERRIDE"] = makeTestToken(t)
-
-			res, err := Run(RunSpec{
-				Binary: goBin,
-				Argv:   scenario.Argv,
-				Env:    FixtureEnv(scenario.Env),
-			})
-			if err != nil {
-				t.Errorf("Run(%s): %v", scenarioName, err)
-				return
-			}
-
-			if res.ExitCode != scenario.Expect.ExitCode {
-				t.Errorf("%s: exit code = %d, want %d\n  stderr: %s\n  stdout: %s",
-					scenarioName, res.ExitCode, scenario.Expect.ExitCode,
-					res.Stderr, res.Stdout)
-			}
-		})
-	}
-}