@celilo/e2e 0.11.0 → 0.11.2

package/src/cli-version-contract.ts

@@ -17,7 +17,10 @@ export const MIN_CLI_VERSION = '0.9.0';
  * it doesn't, or `null` when OK. No I/O, so it's unit-testable without a
  * running management container.
  */
-export function checkCliVersion(versionStdout: string, minVersion = MIN_CLI_VERSION): string | null {
+export function checkCliVersion(
+  versionStdout: string,
+  minVersion = MIN_CLI_VERSION,
+): string | null {
   // Output is `celilo <version>` (apps/celilo displayVersion). Grab the token.
   const version = versionStdout.match(/celilo\s+(\S+)/)?.[1];
   if (!version) {
@@ -27,11 +30,7 @@ export function checkCliVersion(versionStdout: string, minVersion = MIN_CLI_VERS
     );
   }
   if (Bun.semver.order(version, minVersion) < 0) {
-    return (
-      `Management image has celilo ${version}, harness requires >=${minVersion}. ` +
-      `Rebuild the management image against a newer @celilo/cli ` +
-      `(e.g. \`cele2e build-infra\`, or \`--published\` after publishing).`
-    );
+    return `Management image has celilo ${version}, harness requires >=${minVersion}. Rebuild the management image against a newer @celilo/cli (e.g. \`cele2e build-infra\`, or \`--published\` after publishing).`;
   }
   return null;
 }

package/src/extract-failure.ts

@@ -0,0 +1,92 @@
+/**
+ * Turns a failed test file's raw output into the one line a human reads first.
+ *
+ * Pure (Rule 10.1), and split out of runner.ts so it can be tested — runner.ts
+ * calls main() at import time, so nothing inside it is reachable from a test.
+ * Sibling of parse-line.ts / parse-line.test.ts.
+ */
+
+// Strips ANSI escape sequences so pattern matching works on bun's coloured output
+const ANSI_RE = /\x1b\[[0-9;]*m/g;
+export function stripAnsi(s: string): string {
+  return s.replace(ANSI_RE, '');
+}
+
+export function extractFailureMessage(lines: string[], exitCode: number): string {
+  const plain = lines.map(stripAnsi);
+
+  // The FIRST failing test, in bun's "(fail) name [Xms]" format, wins over
+  // everything below. In a staged suite every later stage fails too — on
+  // purpose, via requireStage — so any rule that picks by content rather than
+  // by order reports a downstream symptom as the cause.
+  //
+  // That is not hypothetical. technitium-pipeline's stage 0 timed out; the
+  // reported failure was "Module 'namecheap' not found", from a stage that had
+  // only ever been reached because stage 0 died. Three people read that as a
+  // module-import bug. The line that actually mattered — "this test timed out
+  // after 120000ms" — was 60 lines up in output.log and in no summary at all.
+  //
+  // The "✗ name" branch below never fired there: bun prints "✗" only in its
+  // per-file summary, and prints "(fail)" as each test completes.
+  const failIdx = plain.findIndex((l) => /^\(fail\)\s+\S/.test(l));
+  if (failIdx >= 0) {
+    const testName = plain[failIdx]
+      .replace(/^\(fail\)\s+/, '')
+      .replace(/\s*\[[\d.]+ms\].*$/, '')
+      .trim();
+    // bun puts the reason on the next line, indented and marked with "^".
+    const reason = (plain[failIdx + 1] ?? '').trim().replace(/^\^\s*/, '');
+    return reason ? `${testName}: ${reason}` : testName;
+  }
+
+  // bun's own test failure: "✗ test name [Xms]" — extract the failing test name
+  const bunFailIdx = plain.findIndex((l) => /^\s*✗\s+\S/.test(l) && !l.includes('failed ('));
+  if (bunFailIdx >= 0) {
+    const testName = plain[bunFailIdx]
+      .replace(/^\s*✗\s+/, '')
+      .replace(/\s*\[\d+ms\].*$/, '')
+      .trim();
+    // Grab the error detail on the next few lines (bun indents it under the test)
+    const detail = plain
+      .slice(bunFailIdx + 1, bunFailIdx + 6)
+      .map((l) => l.trim())
+      .filter((l) => l.length > 0 && !l.startsWith('at ') && !l.startsWith('│') && l !== '└─')
+      .slice(0, 2)
+      .join(' — ');
+    return detail ? `${testName}: ${detail}` : testName;
+  }
+
+  // "error: ..." lines (may be indented in bun output)
+  const errorIdx = plain.findIndex(
+    (l) => l.trimStart().startsWith('error:') && !l.includes('bun test'),
+  );
+  if (errorIdx >= 0) {
+    const context = plain
+      .slice(errorIdx, errorIdx + 5)
+      .map((l) => l.trim())
+      .filter((l) => l.length > 0 && !l.startsWith('at '));
+    return context.join('\n    ');
+  }
+
+  const celiloError = plain.find(
+    (l) => l.includes('CeliloCommandError') || (l.includes('celilo') && l.includes('failed')),
+  );
+  if (celiloError) return celiloError.slice(0, 120);
+
+  const timeout = plain.find((l) => l.includes('Timeout') || l.includes('timed out'));
+  if (timeout) return timeout.slice(0, 120);
+
+  // Last resort: print the last few non-empty, non-progress lines from the output
+  const tail = plain
+    .filter(
+      (l) =>
+        l.length > 0 &&
+        !l.startsWith('[progress') &&
+        !l.startsWith('[e2e:') &&
+        !l.startsWith('[ansible:'),
+    )
+    .slice(-3)
+    .map((l) => l.trim())
+    .join(' | ');
+  return tail || `exit code ${exitCode}`;
+}

package/src/fixtures.ts

@@ -1,4 +1,4 @@
-import { NetworkBuilder, network } from './network-builder';
+import { type NetworkBuilder, network } from './network-builder';
 
 /** Single caddy machine in the DMZ — basic web server deployment */
 export const CADDY_DEPLOYMENT = (): NetworkBuilder => network().dmz({ caddy: '10.226.10.10' });
@@ -15,9 +15,7 @@ export const INFRASTRUCTURE_ONLY = (): NetworkBuilder => network();
 
 /** Caddy + Authentik: web server in DMZ, identity provider in app zone */
 export const AUTHENTIK_DEPLOYMENT = (): NetworkBuilder =>
-  network()
-    .dmz({ caddy: '10.226.10.10' })
-    .app({ authentik: '10.226.20.30' });
+  network().dmz({ caddy: '10.226.10.10' }).app({ authentik: '10.226.20.30' });
 
 /** Multiple DMZ machines for testing multi-service deployments */
 export const MULTI_DMZ = (): NetworkBuilder =>
@@ -28,13 +26,8 @@ export const MULTI_DMZ = (): NetworkBuilder =>
 
 /** Technitium DNS + Caddy: internal DNS resolver + full web stack */
 export const TECHNITIUM_STACK = (): NetworkBuilder =>
-  network()
-    .internal({ 'dns-int': '10.226.1.53' })
-    .dmz({ caddy: '10.226.10.10' });
+  network().internal({ 'dns-int': '10.226.1.53' }).dmz({ caddy: '10.226.10.10' });
 
 /** Technitium DNS with DHCP client: tests DHCP DNS propagation */
 export const TECHNITIUM_DHCP_STACK = (): NetworkBuilder =>
-  network()
-    .internal({ 'dns-int': '10.226.1.53' })
-    .dmz({ caddy: '10.226.10.10' })
-    .withDhcpClient();
+  network().internal({ 'dns-int': '10.226.1.53' }).dmz({ caddy: '10.226.10.10' }).withDhcpClient();

package/src/network-builder.ts

@@ -2,7 +2,14 @@ import { execSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { startNetwork } from './container-manager';
-import type { MachineSpec, NetworkConfig, NetworkHandle, TopologyPreset, Vantage, Zone } from './types';
+import type {
+  MachineSpec,
+  NetworkConfig,
+  NetworkHandle,
+  TopologyPreset,
+  Vantage,
+  Zone,
+} from './types';
 
 /**
  * If a mounted path looks like a celilo module (has scripts/package.json),
@@ -10,10 +17,7 @@ import type { MachineSpec, NetworkConfig, NetworkHandle, TopologyPreset, Vantage
  */
 async function ensureModuleDeps(hostPath: string): Promise<void> {
   // Check common locations for a module's scripts dir
-  for (const scriptsDir of [
-    join(hostPath, 'scripts'),
-    join(hostPath, 'celilo', 'scripts'),
-  ]) {
+  for (const scriptsDir of [join(hostPath, 'scripts'), join(hostPath, 'celilo', 'scripts')]) {
     const pkgJson = join(scriptsDir, 'package.json');
     const nodeModules = join(scriptsDir, 'node_modules');
     if (existsSync(pkgJson) && !existsSync(nodeModules)) {
@@ -24,7 +28,7 @@ async function ensureModuleDeps(hostPath: string): Promise<void> {
         const msg = err instanceof Error ? err.message : String(err);
         throw new Error(
           `Failed to install module dependencies in ${scriptsDir}:\n${msg}\n\n` +
-          `Fix: cd ${scriptsDir} && bun install`,
+            `Fix: cd ${scriptsDir} && bun install`,
         );
       }
     }
@@ -173,8 +177,9 @@ export class NetworkBuilder {
    *   network().dmz({ caddy: '10.226.10.10' }).observe('internalDevice', 'publicInternet')
    */
   observe(...vantages: Vantage[]): this {
+    this.config.observers ??= [];
     for (const vantage of vantages) {
-      (this.config.observers ??= []).push({ vantage });
+      this.config.observers.push({ vantage });
     }
     return this;
   }

package/src/observer.test.ts

@@ -1,8 +1,8 @@
 import { describe, expect, test } from 'bun:test';
 import {
+  OBSERVER_PLACEMENTS,
   createObserverTransport,
   normalizeObservers,
-  OBSERVER_PLACEMENTS,
   observerEnv,
   vantageContainer,
 } from './observer';
@@ -38,7 +38,9 @@ describe('placement faithfulness (the load-bearing invariants)', () => {
   test('segmented-zone observer IPs derive from their zone gateway (no pinned subnets)', () => {
     expect(OBSERVER_PLACEMENTS.dmzSystem.gateway).toBe(ZONE_GATEWAYS.dmz);
     expect(OBSERVER_PLACEMENTS.dmzSystem.ip).toBe(ZONE_GATEWAYS.dmz.replace(/\.\d+$/, '.240'));
-    expect(OBSERVER_PLACEMENTS.secureSystem.ip).toBe(ZONE_GATEWAYS.secure.replace(/\.\d+$/, '.240'));
+    expect(OBSERVER_PLACEMENTS.secureSystem.ip).toBe(
+      ZONE_GATEWAYS.secure.replace(/\.\d+$/, '.240'),
+    );
   });
 
   test('publicInternet uses only the public resolver (never the internal split-horizon view)', () => {
@@ -55,7 +57,9 @@ describe('placement faithfulness (the load-bearing invariants)', () => {
 
 describe('normalizeObservers + vantageContainer', () => {
   test('dedupes and rejects management as an injectable observer', () => {
-    expect(normalizeObservers([{ vantage: 'internalDevice' }, { vantage: 'internalDevice' }])).toHaveLength(1);
+    expect(
+      normalizeObservers([{ vantage: 'internalDevice' }, { vantage: 'internalDevice' }]),
+    ).toHaveLength(1);
     expect(() => normalizeObservers([{ vantage: 'management' }])).toThrow(/management/);
   });
   test('management vantage maps to the real management container; others to observers', () => {
@@ -70,15 +74,26 @@ describe('observer transport — parsing + container targeting', () => {
       cmd.startsWith('getent') ? { stdout: '10.226.1.253  www.iamtheinternet.org' } : {},
     );
     const t = createObserverTransport(handle);
-    const r = await t.resolve({ from: 'internalDevice', name: 'www.iamtheinternet.org', method: 'system' });
+    const r = await t.resolve({
+      from: 'internalDevice',
+      name: 'www.iamtheinternet.org',
+      method: 'system',
+    });
     expect(r.ips).toEqual(['10.226.1.253']);
     expect(calls[0].container).toBe('observer-internal');
   });
 
   test('resolve(dns) with explicit server', async () => {
-    const { handle, calls } = fakeHandle((_c, cmd) => (cmd.includes('dig') ? { stdout: '10.226.10.10\n' } : {}));
+    const { handle, calls } = fakeHandle((_c, cmd) =>
+      cmd.includes('dig') ? { stdout: '10.226.10.10\n' } : {},
+    );
     const t = createObserverTransport(handle);
-    const r = await t.resolve({ from: 'dmzSystem', name: 'auth.x', method: 'dns', server: '10.226.1.10' });
+    const r = await t.resolve({
+      from: 'dmzSystem',
+      name: 'auth.x',
+      method: 'dns',
+      server: '10.226.1.10',
+    });
     expect(r.ips).toEqual(['10.226.10.10']);
     expect(calls[0].cmd).toContain('@10.226.1.10');
   });
@@ -88,15 +103,23 @@ describe('observer transport — parsing + container targeting', () => {
       cmd.startsWith('grep -F') ? { stdout: '10.226.10.10 auth.iamtheinternet.org' } : {},
     );
     const t = createObserverTransport(handle);
-    const r = await t.resolve({ from: 'dmzSystem', name: 'auth.iamtheinternet.org', method: 'hostfiles' });
+    const r = await t.resolve({
+      from: 'dmzSystem',
+      name: 'auth.iamtheinternet.org',
+      method: 'hostfiles',
+    });
     expect(r.ips).toEqual(['10.226.10.10']);
   });
 
   test('tcpConnect maps the container exit code', async () => {
     const { handle } = fakeHandle((_c, cmd) => ({ exitCode: cmd.includes('443') ? 0 : 1 }));
     const t = createObserverTransport(handle);
-    expect((await t.tcpConnect({ from: 'internalDevice', host: '10.226.1.253', port: 443 })).connected).toBe(true);
-    expect((await t.tcpConnect({ from: 'internalDevice', host: '10.226.10.10', port: 22 })).connected).toBe(false);
+    expect(
+      (await t.tcpConnect({ from: 'internalDevice', host: '10.226.1.253', port: 443 })).connected,
+    ).toBe(true);
+    expect(
+      (await t.tcpConnect({ from: 'internalDevice', host: '10.226.10.10', port: 22 })).connected,
+    ).toBe(false);
   });
 
   test('httpsRequest parses cert (CN/issuer/SAN/selfSigned) + status', async () => {
@@ -113,7 +136,10 @@ describe('observer transport — parsing + container targeting', () => {
       return { stdout: 'Caddy reverse proxy is running' };
     });
     const t = createObserverTransport(handle);
-    const r = await t.httpsRequest({ from: 'publicInternet', url: 'https://deathstar.iamtheinternet.org' });
+    const r = await t.httpsRequest({
+      from: 'publicInternet',
+      url: 'https://deathstar.iamtheinternet.org',
+    });
     expect(r.status).toBe(200);
     expect(r.cert.cn).toBe('deathstar.iamtheinternet.org');
     expect(r.cert.issuer).toContain('Pebble');
@@ -140,7 +166,12 @@ describe('host-shell footgun guard', () => {
     const { handle, calls } = fakeHandle(() => ({ stdout: '200', exitCode: 0 }));
     const t = createObserverTransport(handle);
     await t.resolve({ from: 'internalDevice', name: 'www.x', method: 'system' });
-    await t.resolve({ from: 'internalDevice', name: 'www.x', method: 'dns', server: '10.226.1.10' });
+    await t.resolve({
+      from: 'internalDevice',
+      name: 'www.x',
+      method: 'dns',
+      server: '10.226.1.10',
+    });
     await t.resolve({ from: 'internalDevice', name: 'www.x', method: 'hostfiles' });
     await t.tcpConnect({ from: 'internalDevice', host: '10.226.10.10', port: 443 });
     await t.ping({ from: 'internalDevice', target: '10.226.1.253' });

package/src/observer.ts

@@ -109,7 +109,9 @@ export const OBSERVER_PLACEMENTS: Record<Exclude<Vantage, 'management'>, Observe
 /** The placement for an injectable vantage; throws for `management` (not injectable). */
 export function observerPlacement(vantage: Vantage): ObserverPlacement {
   if (vantage === 'management') {
-    throw new Error('management has no observer placement — it reuses the real management container.');
+    throw new Error(
+      'management has no observer placement — it reuses the real management container.',
+    );
   }
   return OBSERVER_PLACEMENTS[vantage];
 }
@@ -209,7 +211,10 @@ export function createObserverTransport(handle: NetworkHandle): ProbeTransport {
         `timeout 4 bash -c 'exec 3<>/dev/tcp/${opts.host}/${opts.port}'`,
         8_000,
       );
-      return { connected: res.exitCode === 0, detail: res.exitCode === 0 ? undefined : 'connect failed/timed out' };
+      return {
+        connected: res.exitCode === 0,
+        detail: res.exitCode === 0 ? undefined : 'connect failed/timed out',
+      };
     },
 
     async ping(opts) {
@@ -223,8 +228,7 @@ export function createObserverTransport(handle: NetworkHandle): ProbeTransport {
       const { host, port } = hostPort(opts.url);
       const certRes = await handle.exec(
         c,
-        `echo | openssl s_client -connect ${host}:${port} -servername ${host} 2>/dev/null | ` +
-          'openssl x509 -noout -subject -issuer -ext subjectAltName',
+        `echo | openssl s_client -connect ${host}:${port} -servername ${host} 2>/dev/null | openssl x509 -noout -subject -issuer -ext subjectAltName`,
         10_000,
       );
       // -k gathers the status even for an untrusted chain; the cert is reported truthfully
@@ -249,7 +253,10 @@ export function createObserverTransport(handle: NetworkHandle): ProbeTransport {
       const hosts = await handle.exec(c, `grep -F ${opts.name} /etc/hosts`, 5_000);
       return {
         resolvConf: resolv.stdout.trim(),
-        hostsLines: hosts.stdout.split('\n').map((l) => l.trim()).filter(Boolean),
+        hostsLines: hosts.stdout
+          .split('\n')
+          .map((l) => l.trim())
+          .filter(Boolean),
       };
     },
   };

package/src/registry-bundle.ts

@@ -39,9 +39,7 @@ export function ensureRegistryServerBundle(pkgDir: string): void {
   if (!existsSync(upstream)) {
     if (!existsSync(bundle)) {
       throw new Error(
-        `cele2e: ${bundle} is missing and ../registry-server doesn't exist either.\n` +
-          'The @celilo/e2e package was published without its registry-server bundle. ' +
-          'Re-publish from infra/scripts/publish.ts so the bundle is recreated.',
+        `cele2e: ${bundle} is missing and ../registry-server doesn't exist either.\nThe @celilo/e2e package was published without its registry-server bundle. Re-publish from infra/scripts/publish.ts so the bundle is recreated.`,
       );
     }
     return; // npm-installed; bundle ships in tarball

package/src/run-lock.test.ts

@@ -3,10 +3,10 @@ import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { hostname, tmpdir } from 'node:os';
 import { join } from 'node:path';
 import {
-  acquireRunLock,
-  clearLock,
   E2eBusyError,
   type LockHolder,
+  acquireRunLock,
+  clearLock,
   lockStatus,
   markKept,
   readHolder,

package/src/run-lock.ts

@@ -24,7 +24,7 @@
  */
 
 import { execFileSync } from 'node:child_process';
-import { mkdirSync, openSync, closeSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { closeSync, mkdirSync, openSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
 import { homedir, hostname } from 'node:os';
 import { basename, dirname, join } from 'node:path';
 
@@ -71,7 +71,10 @@ export class E2eBusyError extends Error {
 export function formatBusy(h: LockHolder): string {
   const age = ageString(Date.parse(h.startedAt));
   const verb = h.state === 'kept' ? 'holds a kept stack from' : 'running';
-  const what = h.state === 'kept' ? `(run \`cele2e release\` to free it)` : `${h.test}, started ${age} ago (pid ${h.pid})`;
+  const what =
+    h.state === 'kept'
+      ? '(run `cele2e release` to free it)'
+      : `${h.test}, started ${age} ago (pid ${h.pid})`;
   return `e2e busy: ${h.session} ${verb} ${what}`;
 }
 
@@ -88,7 +91,11 @@ function deriveSession(): string {
   const cwd = process.cwd();
   const git = (args: string[]): string => {
     try {
-      return execFileSync('git', args, { cwd, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+      return execFileSync('git', args, {
+        cwd,
+        encoding: 'utf-8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+      }).trim();
     } catch {
       return '';
     }
@@ -164,7 +171,9 @@ export function acquireRunLock(opts: { test: string; runId: string; allowKept?:
       // Reclaim when: corrupt/unreadable, the holder is stale, OR this is a
       // `--reuse` run taking over a `kept` stack it's deliberately reusing.
       if (!existing || isStale(existing) || (opts.allowKept && existing.state === 'kept')) {
-        try { unlinkSync(lockPath()); } catch {}
+        try {
+          unlinkSync(lockPath());
+        } catch {}
         continue;
       }
       throw new E2eBusyError(existing);
@@ -224,7 +233,12 @@ export function releaseRunLock(): void {
   if (held.keepOnRelease) {
     const cur = readHolder();
     if (cur && cur.pid === process.pid) {
-      try { writeFileSync(lockPath(), JSON.stringify({ ...cur, state: 'kept', beatAt: Date.now() }, null, 2)); } catch {}
+      try {
+        writeFileSync(
+          lockPath(),
+          JSON.stringify({ ...cur, state: 'kept', beatAt: Date.now() }, null, 2),
+        );
+      } catch {}
     }
     return;
   }

package/src/runner.ts

@@ -29,6 +29,7 @@ import {
   emitTestCompleted,
   emitTestStarted,
 } from './bus-events';
+import { extractFailureMessage, stripAnsi } from './extract-failure';
 import { parseLine } from './parse-line';
 import { E2eBusyError, acquireRunLock, markKept } from './run-lock';
 import { SIMULATOR_IPS } from './simulator-ips';
@@ -176,7 +177,7 @@ function loadTiming(): TimingHistory {
 }
 
 function saveTiming(history: TimingHistory): void {
-  writeFileSync(timingFile, JSON.stringify(history, Object.keys(history).sort(), 2) + '\n');
+  writeFileSync(timingFile, `${JSON.stringify(history, Object.keys(history).sort(), 2)}\n`);
 }
 
 function formatDuration(secs: number): string {
@@ -185,67 +186,8 @@ function formatDuration(secs: number): string {
 }
 
 // ─── Error Extraction ────────────────────────────────────────────────
-
-// Strips ANSI escape sequences so pattern matching works on bun's coloured output
-const ANSI_RE = /\x1b\[[0-9;]*m/g;
-function stripAnsi(s: string): string {
-  return s.replace(ANSI_RE, '');
-}
-
-function extractFailureMessage(lines: string[], exitCode: number): string {
-  const plain = lines.map(stripAnsi);
-
-  // bun's own test failure: "✗ test name [Xms]" — extract the failing test name
-  const bunFailIdx = plain.findIndex((l) => /^\s*✗\s+\S/.test(l) && !l.includes('failed ('));
-  if (bunFailIdx >= 0) {
-    const testName = plain[bunFailIdx]
-      .replace(/^\s*✗\s+/, '')
-      .replace(/\s*\[\d+ms\].*$/, '')
-      .trim();
-    // Grab the error detail on the next few lines (bun indents it under the test)
-    const detail = plain
-      .slice(bunFailIdx + 1, bunFailIdx + 6)
-      .map((l) => l.trim())
-      .filter((l) => l.length > 0 && !l.startsWith('at ') && !l.startsWith('│') && l !== '└─')
-      .slice(0, 2)
-      .join(' — ');
-    return detail ? `${testName}: ${detail}` : testName;
-  }
-
-  // "error: ..." lines (may be indented in bun output)
-  const errorIdx = plain.findIndex(
-    (l) => l.trimStart().startsWith('error:') && !l.includes('bun test'),
-  );
-  if (errorIdx >= 0) {
-    const context = plain
-      .slice(errorIdx, errorIdx + 5)
-      .map((l) => l.trim())
-      .filter((l) => l.length > 0 && !l.startsWith('at '));
-    return context.join('\n    ');
-  }
-
-  const celiloError = plain.find(
-    (l) => l.includes('CeliloCommandError') || (l.includes('celilo') && l.includes('failed')),
-  );
-  if (celiloError) return celiloError.slice(0, 120);
-
-  const timeout = plain.find((l) => l.includes('Timeout') || l.includes('timed out'));
-  if (timeout) return timeout.slice(0, 120);
-
-  // Last resort: print the last few non-empty, non-progress lines from the output
-  const tail = plain
-    .filter(
-      (l) =>
-        l.length > 0 &&
-        !l.startsWith('[progress') &&
-        !l.startsWith('[e2e:') &&
-        !l.startsWith('[ansible:'),
-    )
-    .slice(-3)
-    .map((l) => l.trim())
-    .join(' | ');
-  return tail || `exit code ${exitCode}`;
-}
+// extractFailureMessage / stripAnsi live in extract-failure.ts: this file
+// calls main() at import time, so nothing declared here is testable.
 
 // ─── Test Execution ──────────────────────────────────────────────────
 
@@ -409,7 +351,7 @@ async function runTest(
         display.abandonFailed();
       }
 
-      writeFileSync(logFile, stdout + '\n---STDERR---\n' + stderr);
+      writeFileSync(logFile, `${stdout}\n---STDERR---\n${stderr}`);
 
       const expectMatch = stdout.match(/(\d+) expect\(\) calls/);
       const expectCount = expectMatch ? Number.parseInt(expectMatch[1], 10) : undefined;
@@ -816,7 +758,7 @@ async function main() {
     if (flagKeep && result.projectName) {
       writeFileSync(
         persistentFile,
-        JSON.stringify(
+        `${JSON.stringify(
           {
             projectName: result.projectName,
             testFile: file,
@@ -824,7 +766,7 @@ async function main() {
           },
           null,
           2,
-        ) + '\n',
+        )}\n`,
       );
       console.log(`${dim}  Persistent network: ${result.projectName}${reset}`);
       console.log(`${dim}  Reuse: ${basename(process.argv[1])} --reuse${reset}`);
@@ -886,7 +828,7 @@ async function main() {
     const icon = r.status === 'pass' ? '✓' : '✗';
     const color = r.status === 'pass' ? green : red;
     console.log(
-      `${bold}║${reset}  ${color}${icon}${reset} ${r.name.padEnd(28)} ${dim}${(r.duration + 's').padStart(6)}${reset}`,
+      `${bold}║${reset}  ${color}${icon}${reset} ${r.name.padEnd(28)} ${dim}${(`${r.duration}s`).padStart(6)}${reset}`,
     );
     if (r.error) {
       console.log(`${bold}║${reset}    ${red}└─ ${r.error}${reset}`);
@@ -911,7 +853,7 @@ async function main() {
   const adds: string[] = [];
   if (!content.includes('results/')) adds.push('results/');
   if (!content.includes('.e2e-timing.json')) adds.push('.e2e-timing.json');
-  if (adds.length) writeFileSync(gitignore, content.trimEnd() + '\n' + adds.join('\n') + '\n');
+  if (adds.length) writeFileSync(gitignore, `${content.trimEnd()}\n${adds.join('\n')}\n`);
 
   emitRunCompleted({
     runId,