@decocms/blocks-cli 8.0.0 → 8.1.0-next.0

package/scripts/reconcile.ts

@@ -0,0 +1,303 @@
+#!/usr/bin/env tsx
+/**
+ * Snapshot reconcile — produces a per-file diff of everything that landed on the
+ * Fresh/Deno SOURCE repo since the migration cut, plus the context an agent needs
+ * to port each change into the already-migrated TanStack TARGET repo.
+ *
+ * Migrations take weeks. During that window the source team keeps shipping and
+ * the migration team hand-fixes what the codemod got wrong. Reconciling is a
+ * REBASE, not a re-migration: re-running `deco-migrate` over the tree overwrites
+ * the hand-fixes. So this script makes NO judgement and writes NOTHING to the
+ * target — it emits one patch per file and lets the agent (see the
+ * `deco-reconcile-snapshot` skill) work them one at a time.
+ *
+ * Usage:
+ *   npx -p @decocms/blocks-cli deco-reconcile \
+ *     --source ../site-fresh --target ../site-tanstack --snapshot <cut sha>
+ *
+ * Options:
+ *   --source <dir>           Fresh/Deno repo checkout (required)
+ *   --target <dir>           Migrated TanStack repo checkout (required)
+ *   --snapshot <sha>         Last reconciled source commit — the cut (required)
+ *   --target-snapshot <sha>  The migration commit on the target. Defaults to the
+ *                            commit that added MIGRATION_REPORT.md, else HEAD.
+ *                            Everything after it counts as a hand-fix, so a wrong
+ *                            value silently empties the collision list.
+ *   --out <dir>              Output dir (default: <target>/.reconcile/<sourceHead:7>)
+ *   --verbose                Log every file
+ *   --help, -h               Show this help
+ *
+ * Output: <out>/manifest.json (machine, also the resume state via `done`),
+ *         <out>/INDEX.md (human), <out>/patches/NNN-<slug>.patch (one per file).
+ *
+ * Exit codes: 0 ok; 2 bad args / git failure.
+ */
+
+import { execFileSync } from "node:child_process";
+import * as fs from "node:fs";
+import { isDeletedByMigration } from "./migrate/delete-sets";
+import * as path from "node:path";
+
+/** Paths whose upstream changes never reconcile into the target. */
+const SKIP = [
+  /^\.deco\//, // CMS content — syncs through its own channel
+  /^\.github\//, // target has its own scaffolded workflows
+  /^_fresh\//,
+  /(^|\/)(deno\.lock|package-lock\.json|bun\.lock|bun\.lockb|yarn\.lock)$/,
+  /\.(png|jpe?g|gif|webp|avif|ico|woff2?|ttf|eot|mp4|webm|pdf|zip)$/i,
+];
+
+export interface ReconcileFile {
+  /** git --name-status letter: A/M/D/R… */
+  status: string;
+  sourcePath: string;
+  /** Previous path, for renames only. */
+  oldPath?: string;
+  /** Patch file, relative to the output dir. */
+  patch: string;
+  /** Where this MIGHT live on the target. Candidates, not a verdict. */
+  targetCandidates: string[];
+  /** Target commits touching a candidate since the migration commit. */
+  collision: string[];
+  done: boolean;
+}
+
+export interface ReconcileManifest {
+  source: string;
+  target: string;
+  snapshot: string;
+  /** Feed this back as --snapshot on the next round. */
+  sourceHead: string;
+  targetSnapshot: string;
+  files: ReconcileFile[];
+}
+
+function git(cwd: string, args: string[]): string {
+  return execFileSync("git", ["-C", cwd, ...args], {
+    encoding: "utf8",
+    maxBuffer: 256 * 1024 * 1024,
+  });
+}
+
+function slug(p: string): string {
+  return p.replace(/[^a-zA-Z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 80);
+}
+
+/** Parse `git diff --name-status -M` output. Renames carry two tab-separated paths. */
+export function parseNameStatus(
+  out: string,
+): Array<{ status: string; path: string; oldPath?: string }> {
+  return out.split("\n").filter(Boolean).map((line) => {
+    const [status, a, b] = line.split("\t");
+    return b ? { status, path: b, oldPath: a } : { status, path: a };
+  });
+}
+
+export function isSkipped(relPath: string): boolean {
+  return SKIP.some((re) => re.test(relPath)) || isDeletedByMigration(relPath);
+}
+
+/**
+ * Guess where a source file lives on the target. The migration moved things
+ * around (islands/→src/components/, static/→public/, sections stay under src/),
+ * so this is basename matching plus the conventional `src/` prefix — deliberately
+ * a shortlist for the agent to confirm against the target tree, not a mapping.
+ */
+export function targetCandidates(
+  relPath: string,
+  byBasename: Map<string, string[]>,
+): string[] {
+  const guesses = [
+    `src/${relPath}`,
+    `src/${relPath.replace(/^islands\//, "components/")}`,
+    relPath.replace(/^static\//, "public/"),
+  ];
+  const found = byBasename.get(path.basename(relPath)) ?? [];
+  // Only real target paths survive; the guesses just rank the likely one first.
+  return [...new Set([...guesses.filter((g) => found.includes(g)), ...found])];
+}
+
+function usage(msg?: string): never {
+  if (msg) console.error(`error: ${msg}\n`);
+  console.error(
+    "usage: deco-reconcile --source <dir> --target <dir> --snapshot <sha> [--target-snapshot <sha>] [--out <dir>] [--verbose]",
+  );
+  process.exit(msg ? 2 : 0);
+}
+
+/**
+ * The migration commit on the target — everything after it is a hand-fix.
+ * `deco-migrate` leaves no provenance except MIGRATION_REPORT.md, so the commit
+ * that added it is the marker. No marker: fall back to HEAD, which makes every
+ * collision range empty — loudly, because a silent empty list reads as "nobody
+ * touched anything" and that is exactly the wrong thing to believe.
+ */
+export function detectTargetSnapshot(log: string): string | undefined {
+  return log.split("\n").filter(Boolean).pop();
+}
+
+function main() {
+  const argv = process.argv.slice(2);
+  if (argv.includes("--help") || argv.includes("-h")) usage();
+  const flag = (name: string) => {
+    const i = argv.indexOf(`--${name}`);
+    return i === -1 ? undefined : argv[i + 1];
+  };
+  const verbose = argv.includes("--verbose");
+
+  const source = flag("source");
+  const target = flag("target");
+  const snapshot = flag("snapshot");
+  if (!source || !target || !snapshot) {
+    usage("--source, --target and --snapshot are all required");
+  }
+
+  const targetSnapshot = flag("target-snapshot") ??
+    detectTargetSnapshot(
+      git(target, [
+        "log",
+        "--diff-filter=A",
+        "--format=%H",
+        "--",
+        "MIGRATION_REPORT.md",
+      ]),
+    ) ?? git(target, ["rev-parse", "HEAD"]).trim();
+  if (!flag("target-snapshot")) {
+    console.log(
+      `--target-snapshot not given, using ${targetSnapshot.slice(0, 7)} (${
+        git(target, ["log", "-1", "--format=%s", targetSnapshot]).trim()
+      })`,
+    );
+  }
+
+  const sourceHead = git(source, ["rev-parse", "HEAD"]).trim();
+  if (sourceHead === git(source, ["rev-parse", snapshot]).trim()) {
+    console.log("Nothing to reconcile — source HEAD is already the snapshot.");
+    return;
+  }
+
+  const outDir = flag("out") ??
+    path.join(target, ".reconcile", sourceHead.slice(0, 7));
+  fs.mkdirSync(path.join(outDir, "patches"), { recursive: true });
+
+  const byBasename = new Map<string, string[]>();
+  for (const p of git(target, ["ls-files"]).split("\n").filter(Boolean)) {
+    const key = path.basename(p);
+    byBasename.set(key, [...(byBasename.get(key) ?? []), p]);
+  }
+
+  // Submodules (mode 160000) diff as a one-line gitlink bump — no source to port.
+  const submodules = new Set(
+    git(source, ["ls-files", "--stage"]).split("\n")
+      .filter((l) => l.startsWith("160000"))
+      .map((l) => l.split("\t")[1]),
+  );
+
+  const changes = parseNameStatus(
+    git(source, ["diff", "--name-status", "-M", `${snapshot}..${sourceHead}`]),
+  );
+  const files: ReconcileFile[] = [];
+
+  for (const change of changes) {
+    if (isSkipped(change.path) || submodules.has(change.path)) {
+      if (verbose) console.log(`  skip  ${change.path}`);
+      continue;
+    }
+    const n = String(files.length + 1).padStart(3, "0");
+    const patch = `patches/${n}-${slug(change.path)}.patch`;
+    fs.writeFileSync(
+      path.join(outDir, patch),
+      git(source, [
+        "diff",
+        "-M",
+        `${snapshot}..${sourceHead}`,
+        "--",
+        ...(change.oldPath ? [change.oldPath, change.path] : [change.path]),
+      ]),
+    );
+
+    const candidates = targetCandidates(change.path, byBasename);
+    // A target file touched since the migration commit is a hand-fix. The agent
+    // must reconcile hunk by hunk instead of applying the upstream change whole.
+    // Deduped by SHA: one commit touching two candidates (the island/section
+    // re-export pair) is one hand-fix, not two — an inflated count misreads the
+    // "does this fit one human review sitting" gate.
+    const bySha = new Map<string, string>();
+    for (const c of candidates) {
+      for (
+        const line of git(target, [
+          "log",
+          "--format=%h %s",
+          `${targetSnapshot}..HEAD`,
+          "--",
+          c,
+        ]).split("\n").filter(Boolean)
+      ) {
+        const sha = line.split(" ")[0];
+        if (!bySha.has(sha)) bySha.set(sha, `${c}: ${line}`);
+      }
+    }
+    const collision = [...bySha.values()];
+
+    files.push({
+      status: change.status,
+      sourcePath: change.path,
+      oldPath: change.oldPath,
+      patch,
+      targetCandidates: candidates,
+      collision,
+      done: false,
+    });
+    if (verbose) {
+      console.log(
+        `  ${change.status.padEnd(4)} ${change.path} → ${
+          candidates.join(", ") || "(no target match — new file?)"
+        }${collision.length ? `  [COLLISION x${collision.length}]` : ""}`,
+      );
+    }
+  }
+
+  const manifest: ReconcileManifest = {
+    source,
+    target,
+    snapshot,
+    sourceHead,
+    targetSnapshot,
+    files,
+  };
+  fs.writeFileSync(
+    path.join(outDir, "manifest.json"),
+    JSON.stringify(manifest, null, 2) + "\n",
+  );
+
+  const collided = files.filter((f) => f.collision.length);
+  fs.writeFileSync(
+    path.join(outDir, "INDEX.md"),
+    [
+      `# Reconcile ${snapshot.slice(0, 7)}..${sourceHead.slice(0, 7)}`,
+      "",
+      `SOURCE_HEAD \`${sourceHead}\` — feed this back as \`--snapshot\` next round.`,
+      "",
+      `Target snapshot \`${targetSnapshot}\` — commits after it count as hand-fixes.`,
+      "",
+      `${files.length} files, ${collided.length} with collisions.`,
+      "",
+      "| # | status | source | target candidates | collision |",
+      "|---|---|---|---|---|",
+      ...files.map((f, i) =>
+        `| ${i + 1} | ${f.status} | \`${f.sourcePath}\` | ${
+          f.targetCandidates.map((c) => `\`${c}\``).join("<br>") || "—"
+        } | ${f.collision.length || ""} |`
+      ),
+      "",
+    ].join("\n"),
+  );
+
+  console.log(
+    `${files.length} files (${collided.length} colliding) → ${outDir}\nSOURCE_HEAD ${sourceHead}`,
+  );
+}
+
+// realpath: under npx/bunx argv[1] is the `.bin/deco-reconcile` symlink, which
+// the regex alone never matched — the CLI exited 0 without running (#515).
+if (process.argv[1] && /reconcile\.ts$/.test(fs.realpathSync(process.argv[1]))) main();

package/scripts/sync-blocks-bot.test.ts

@@ -0,0 +1,276 @@
+import { execFileSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+  DEFAULT_DENY,
+  fetchDecofile,
+  findPlaintextSecrets,
+  hasEncryptedSecretRef,
+  matchesGlob,
+  writeDecofileToDir,
+} from "./sync-blocks-bot";
+
+function tmpBlocksDir(files: Record<string, unknown> = {}): string {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "sync-blocks-bot-"));
+  const out = path.join(dir, ".deco", "blocks");
+  fs.mkdirSync(out, { recursive: true });
+  for (const [file, content] of Object.entries(files)) {
+    fs.writeFileSync(path.join(out, file), `${JSON.stringify(content, null, 2)}\n`);
+  }
+  return out;
+}
+
+const ls = (dir: string) => fs.readdirSync(dir).sort();
+const read = (dir: string, file: string) =>
+  JSON.parse(fs.readFileSync(path.join(dir, file), "utf-8")) as Record<string, unknown>;
+
+describe("matchesGlob", () => {
+  it("matches whole keys with a * wildcard", () => {
+    expect(matchesGlob("Site", "Site")).toBe(true);
+    expect(matchesGlob("Sitemap", "Site")).toBe(false);
+    expect(matchesGlob("pages-Home", "pages-*")).toBe(true);
+    expect(matchesGlob("deco-vtex", "deco-*")).toBe(true);
+    // dots are literal, not "any char"
+    expect(matchesGlob("axb", "a.b")).toBe(false);
+  });
+});
+
+describe("hasEncryptedSecretRef", () => {
+  it("finds a {name, encrypted} ref at any depth", () => {
+    expect(hasEncryptedSecretRef({ appKey: { name: "BANANA", encrypted: "3a714de1" } })).toBe(true);
+    expect(hasEncryptedSecretRef({ a: [{ b: { name: "X", encrypted: "y" } }] })).toBe(true);
+    expect(hasEncryptedSecretRef({ name: "X", encrypted: "" })).toBe(false);
+    expect(hasEncryptedSecretRef({ sections: [{ __resolveType: "site/x.tsx" }] })).toBe(false);
+  });
+});
+
+describe("findPlaintextSecrets", () => {
+  it("flags credential-shaped props holding a raw string", () => {
+    expect(findPlaintextSecrets({ appToken: "abcdefghijklmnop" })).toEqual(["appToken"]);
+    expect(findPlaintextSecrets({ nested: { api_key: "abcdefghijklmnop" } })).toEqual([
+      "nested.api_key",
+    ]);
+    expect(findPlaintextSecrets({ list: [{ password: "abcdefghijklmnop" }] })).toEqual([
+      "list[0].password",
+    ]);
+  });
+
+  it("ignores a bare `key` prop — CMS content is full of them", () => {
+    // real shape: every VTEX PLP loader block carries selectedFacets[].key
+    expect(
+      findPlaintextSecrets({ selectedFacets: [{ key: "productClusterIds", value: "140" }] }),
+    ).toEqual([]);
+    // …but a qualified key still counts
+    expect(findPlaintextSecrets({ apiKey: "abcdefghijklmnop" })).toEqual(["apiKey"]);
+    expect(findPlaintextSecrets({ "private-key": "abcdefghijklmnop" })).toEqual(["private-key"]);
+  });
+
+  it("does not flag encrypted refs, urls, prose or short values", () => {
+    expect(findPlaintextSecrets({ appKey: { name: "X", encrypted: "abcdefghijklmnop" } })).toEqual(
+      [],
+    );
+    expect(findPlaintextSecrets({ tokenUrl: "https://x.com/very/long/path" })).toEqual([]);
+    expect(findPlaintextSecrets({ secret: "short" })).toEqual([]);
+    expect(findPlaintextSecrets({ password: "uma frase com espacos" })).toEqual([]);
+    expect(findPlaintextSecrets({ apiKey: "{{ FROM_ENV_VAR_HERE }}" })).toEqual([]);
+  });
+});
+
+describe("writeDecofileToDir", () => {
+  it("writes one single-encoded file per block and skips unchanged ones", () => {
+    const out = tmpBlocksDir();
+    const remote = {
+      "pages-Home": { name: "Home", path: "/", sections: [] },
+      "pages-A B": { name: "A B", path: "/a-b", sections: [] },
+    };
+
+    const first = writeDecofileToDir(remote, { out });
+    expect(first.added.sort()).toEqual(["pages-A B", "pages-Home"]);
+    expect(ls(out)).toEqual(["pages-A%20B.json", "pages-Home.json"]);
+    expect(read(out, "pages-Home.json").path).toBe("/");
+
+    const second = writeDecofileToDir(remote, { out });
+    expect(second.unchanged).toBe(2);
+    expect(second.added).toEqual([]);
+    expect(second.updated).toEqual([]);
+  });
+
+  it("compares content, not bytes — minified or reordered locals are not churn", () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "sync-blocks-bot-"));
+    const out = path.join(dir, "blocks");
+    fs.mkdirSync(out, { recursive: true });
+    // how the Studio daemon / old sync bot write it: one minified line, no newline
+    fs.writeFileSync(path.join(out, "pages-Home.json"), '{"sections":[],"path":"/","name":"Home"}');
+
+    const report = writeDecofileToDir(
+      { "pages-Home": { name: "Home", path: "/", sections: [] } },
+      { out },
+    );
+    expect(report.unchanged).toBe(1);
+    expect(report.updated).toEqual([]);
+    // untouched: no reformat commit
+    expect(fs.readFileSync(path.join(out, "pages-Home.json"), "utf-8")).toBe(
+      '{"sections":[],"path":"/","name":"Home"}',
+    );
+
+    // a real content change does get written, pretty-printed
+    const changed = writeDecofileToDir({ "pages-Home": { name: "Home v2", path: "/" } }, { out });
+    expect(changed.updated).toEqual(["pages-Home"]);
+    expect(fs.readFileSync(path.join(out, "pages-Home.json"), "utf-8")).toContain('\n  "name"');
+  });
+
+  it("denies keys by glob, defaulting to the Site block", () => {
+    const out = tmpBlocksDir({ "Site.json": { seo: { title: "local" } } });
+    const report = writeDecofileToDir(
+      { Site: { seo: { title: "prod" } }, "pages-Home": { path: "/" } },
+      { out },
+    );
+    expect(DEFAULT_DENY).toContain("Site");
+    expect(report.denied).toEqual(["Site"]);
+    expect(read(out, "Site.json").seo).toEqual({ title: "local" });
+
+    const custom = writeDecofileToDir({ "pages-Home": { path: "/x" } }, { out, deny: ["pages-*"] });
+    expect(custom.denied).toEqual(["pages-Home"]);
+  });
+
+  it("never overwrites a block that carries an encrypted secret", () => {
+    const out = tmpBlocksDir({
+      "deco-vtex.json": { account: "loja", appKey: { name: "KEY", encrypted: "local" } },
+    });
+    const report = writeDecofileToDir(
+      { "deco-vtex": { account: "outra", appKey: { name: "KEY", encrypted: "prod" } } },
+      { out },
+    );
+    expect(report.protectedSecretBlocks).toEqual(["deco-vtex"]);
+    expect(read(out, "deco-vtex.json").account).toBe("loja");
+
+    const forced = writeDecofileToDir(
+      { "deco-vtex": { account: "outra", appKey: { name: "KEY", encrypted: "prod" } } },
+      { out, allowSecretBlocks: true },
+    );
+    expect(forced.updated).toEqual(["deco-vtex"]);
+  });
+
+  it("overwrites a legacy double-encoded filename in place instead of duplicating it", () => {
+    const out = tmpBlocksDir({ "pages-A%2520B.json": { name: "old", path: "/a-b" } });
+    const report = writeDecofileToDir({ "pages-A B": { name: "new", path: "/a-b" } }, { out });
+    expect(report.updated).toEqual(["pages-A B"]);
+    expect(ls(out)).toEqual(["pages-A%2520B.json"]);
+    expect(read(out, "pages-A%2520B.json").name).toBe("new");
+  });
+
+  it("collapses colliding encodings onto the canonical name", () => {
+    const out = tmpBlocksDir({
+      "pages-A%2520B.json": { name: "stale", path: "/a-b" },
+      "pages-A%20B.json": { name: "also stale", path: "/a-b" },
+    });
+    const report = writeDecofileToDir({ "pages-A B": { name: "new", path: "/a-b" } }, { out });
+    expect(report.updated).toEqual(["pages-A B"]);
+    expect(ls(out)).toEqual(["pages-A%20B.json"]);
+    expect(read(out, "pages-A%20B.json").name).toBe("new");
+  });
+
+  it("prunes blocks absent upstream, but keeps denied and secret-bearing ones", () => {
+    const out = tmpBlocksDir({
+      "pages-Gone.json": { name: "gone", path: "/gone" },
+      "pages-Home.json": { name: "home", path: "/" },
+      "Site.json": { seo: {} },
+      "deco-vtex.json": { appKey: { name: "KEY", encrypted: "local" } },
+    });
+    const report = writeDecofileToDir(
+      { "pages-Home": { name: "home", path: "/" } },
+      {
+        out,
+        prune: true,
+      },
+    );
+    expect(report.removed).toEqual(["pages-Gone"]);
+    expect(report.denied).toEqual(["Site"]);
+    expect(report.protectedSecretBlocks).toEqual(["deco-vtex"]);
+    expect(ls(out)).toEqual(["Site.json", "deco-vtex.json", "pages-Home.json"]);
+  });
+
+  it("--dry-run touches nothing", () => {
+    const out = tmpBlocksDir({ "pages-Gone.json": { path: "/gone" } });
+    const report = writeDecofileToDir(
+      { "pages-Home": { path: "/" } },
+      {
+        out,
+        prune: true,
+        dryRun: true,
+      },
+    );
+    expect(report.added).toEqual(["pages-Home"]);
+    expect(report.removed).toEqual(["pages-Gone"]);
+    expect(ls(out)).toEqual(["pages-Gone.json"]);
+  });
+
+  it("skips non-object payload values and reports plaintext secrets", () => {
+    const out = tmpBlocksDir();
+    const report = writeDecofileToDir(
+      { broken: "not a block", leak: { appToken: "abcdefghijklmnop" } },
+      { out },
+    );
+    expect(report.skipped).toEqual(["broken"]);
+    expect(report.plaintextSecrets).toEqual(["leak.appToken"]);
+  });
+});
+
+describe("fetchDecofile", () => {
+  afterEach(() => vi.unstubAllGlobals());
+
+  const stub = (body: string, init: { status?: number; headers?: Record<string, string> } = {}) => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(
+        async () =>
+          new Response(body, {
+            status: init.status ?? 200,
+            headers: { "content-type": "application/json", ...init.headers },
+          }),
+      ),
+    );
+  };
+
+  it("returns the parsed decofile plus the ETag revision", async () => {
+    stub(JSON.stringify({ "pages-Home": { path: "/" } }), { headers: { etag: '"abc123"' } });
+    const result = await fetchDecofile("https://x.com/.decofile");
+    expect(result.blocks).toEqual({ "pages-Home": { path: "/" } });
+    expect(result.revision).toBe('"abc123"');
+  });
+
+  it("rejects a non-200, a non-JSON content-type, a non-object payload and an oversized body", async () => {
+    stub("{}", { status: 500 });
+    await expect(fetchDecofile("https://x.com/.decofile")).rejects.toThrow(/responded 500/);
+
+    stub("<html>", { headers: { "content-type": "text/html" } });
+    await expect(fetchDecofile("https://x.com/.decofile")).rejects.toThrow(/expected JSON/);
+
+    stub("[]");
+    await expect(fetchDecofile("https://x.com/.decofile")).rejects.toThrow(/an array/);
+
+    stub(JSON.stringify({ a: { b: 1 } }));
+    await expect(fetchDecofile("https://x.com/.decofile", { maxBytes: 4 })).rejects.toThrow(
+      /over the 4 byte cap/,
+    );
+  });
+});
+
+describe("CLI entrypoint", () => {
+  // Regression: invoked through the package `bin`, argv[1] is the
+  // node_modules/.bin symlink while import.meta.url is the real file. A string
+  // compare of the two fails, main() never runs, and the CLI exits 0 having
+  // printed nothing — a silently green CI job. Exercise the symlink path.
+  it("runs when invoked through a bin symlink", () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "sync-blocks-bin-"));
+    const link = path.join(dir, "deco-sync-blocks-bot");
+    fs.symlinkSync(path.join(__dirname, "sync-blocks-bot.ts"), link);
+
+    const out = execFileSync(process.execPath, [require.resolve("tsx/cli"), link, "--help"], {
+      encoding: "utf-8",
+    });
+    expect(out).toContain("--fail-on-plaintext-secret");
+  });
+});