@grada-run/grada 0.32.0 → 0.33.0

package/tests/e2e/tier0.e2e.test.js

@@ -0,0 +1,142 @@
+// Tier 0 E2E: fast, PR-friendly, no AWS credentials. Mock-AWS scaffold,
+// local checks, and failure-path contract pinning against the real CLI.
+import { describe, it, expect, beforeAll } from 'vitest';
+import fs from 'node:fs';
+import path from 'node:path';
+import {
+    e2eEnv,
+    assertPrerequisites,
+    runCli,
+    runTerraform,
+    withTmpDir,
+} from './helpers.js';
+
+const env = e2eEnv({ mockAws: true });
+
+beforeAll(() => {
+    assertPrerequisites();
+});
+
+describe('Tier 0: scaffold (ECS)', () => {
+    it('inits, adds an addon, and generates valid Terraform', async () => {
+        await withTmpDir('tier0-ecs', async (dir) => {
+            const init = runCli(['init', '--target', 'ecs', '--headless'], { cwd: dir, env });
+            expect(init.status).toBe(0);
+
+            const add = runCli(['add', 'queue:sqs', '--headless'], { cwd: dir, env });
+            expect(add.status).toBe(0);
+
+            expect(fs.existsSync(path.join(dir, 'README.md'))).toBe(true);
+            expect(fs.existsSync(path.join(dir, 'terraform', 'main.tf'))).toBe(true);
+            expect(fs.existsSync(path.join(dir, 'terraform', 'sqs.tf'))).toBe(true);
+            const mainTf = fs.readFileSync(path.join(dir, 'terraform', 'main.tf'), 'utf-8');
+            expect(mainTf).toContain('SQS_QUEUE_URL');
+
+            runTerraform(['init', '-backend=false'], { cwd: path.join(dir, 'terraform'), env });
+            runTerraform(['validate'], { cwd: path.join(dir, 'terraform'), env });
+        });
+    });
+});
+
+describe('Tier 0: scaffold (Lambda)', () => {
+    it('inits a Lambda project with valid Terraform', async () => {
+        await withTmpDir('tier0-lambda', async (dir) => {
+            const init = runCli(['init', '--target', 'lambda', '--headless'], { cwd: dir, env });
+            expect(init.status).toBe(0);
+
+            const mainTf = fs.readFileSync(path.join(dir, 'terraform', 'main.tf'), 'utf-8');
+            expect(mainTf).toContain('resource "aws_lambda_function" "app"');
+
+            runTerraform(['init', '-backend=false'], { cwd: path.join(dir, 'terraform'), env });
+            runTerraform(['validate'], { cwd: path.join(dir, 'terraform'), env });
+        });
+    });
+});
+
+describe('Tier 0: addon matrix', () => {
+    // queue:sqs is covered by the ECS scaffold test above (including the
+    // SQS_QUEUE_URL env-injection assertion); the rest get one
+    // scaffold-and-validate pass each.
+    const ADDON_MATRIX = [
+        { capability: 'storage:s3', file: 's3.tf', extraArgs: [] },
+        { capability: 'db:dynamodb', file: 'dynamodb.tf', extraArgs: [] },
+        { capability: 'db:redis', file: 'redis.tf', extraArgs: [] },
+        { capability: 'ai:bedrock', file: 'bedrock.tf', extraArgs: [] },
+        { capability: 'email:ses', file: 'ses.tf', extraArgs: ['--domain', 'example.com'] },
+        { capability: 'cron', file: 'cron.tf', extraArgs: [] },
+    ];
+
+    for (const { capability, file, extraArgs } of ADDON_MATRIX) {
+        it(`scaffolds valid Terraform for ${capability}`, async () => {
+            await withTmpDir(`tier0-add-${capability.replace(':', '-')}`, async (dir) => {
+                const init = runCli(['init', '--target', 'ecs', '--headless'], { cwd: dir, env });
+                expect(init.status).toBe(0);
+
+                const add = runCli(['add', capability, ...extraArgs, '--headless'], { cwd: dir, env });
+                expect(add.status).toBe(0);
+                expect(fs.existsSync(path.join(dir, 'terraform', file))).toBe(true);
+
+                runTerraform(['init', '-backend=false'], { cwd: path.join(dir, 'terraform'), env });
+                runTerraform(['validate'], { cwd: path.join(dir, 'terraform'), env });
+            });
+        });
+    }
+
+    it('composes multiple addons via init --with', async () => {
+        await withTmpDir('tier0-add-combo', async (dir) => {
+            const init = runCli(['init', '--target', 'ecs', '--with', 'queue:sqs,db:redis', '--headless'], { cwd: dir, env });
+            expect(init.status).toBe(0);
+            expect(fs.existsSync(path.join(dir, 'terraform', 'sqs.tf'))).toBe(true);
+            expect(fs.existsSync(path.join(dir, 'terraform', 'redis.tf'))).toBe(true);
+
+            runTerraform(['init', '-backend=false'], { cwd: path.join(dir, 'terraform'), env });
+            runTerraform(['validate'], { cwd: path.join(dir, 'terraform'), env });
+        });
+    });
+});
+
+describe('Tier 0: local checks', () => {
+    it('ejects metadata from a scaffolded project', async () => {
+        await withTmpDir('tier0-eject', async (dir) => {
+            const init = runCli(['init', '--headless'], { cwd: dir, env });
+            expect(init.status).toBe(0);
+
+            const mainTfPath = path.join(dir, 'terraform', 'main.tf');
+            expect(fs.readFileSync(mainTfPath, 'utf-8')).toContain('ManagedBy');
+
+            const eject = runCli(['eject', '--yes'], { cwd: dir, env });
+            expect(eject.status).toBe(0);
+            expect(fs.readFileSync(mainTfPath, 'utf-8')).not.toContain('ManagedBy');
+        });
+    });
+
+    it('doctor exits 0', async () => {
+        await withTmpDir('tier0-doctor', async (dir) => {
+            const doctor = runCli(['doctor'], { cwd: dir, env });
+            expect(doctor.status).toBe(0);
+        });
+    });
+});
+
+describe('Tier 0: failure paths', () => {
+    it('apply outside a project exits 1 cleanly', async () => {
+        await withTmpDir('tier0-fail-apply', async (dir) => {
+            const result = runCli(['apply', '--headless'], { cwd: dir, env, capture: true });
+            expect(result.status).toBe(1);
+            expect(result.output).toContain('No terraform directory');
+            expect(result.output).not.toMatch(/^\s+at\s/m);
+        });
+    });
+
+    it('init with an invalid target exits 1 cleanly', async () => {
+        await withTmpDir('tier0-fail-target', async (dir) => {
+            // NOTE: --headless is required to reach flag validation: without
+            // it, init prompts for the target directory first and exits 0 on
+            // EOF (the spec shows this command without --headless).
+            const result = runCli(['init', '--target', 'fake-target', '--headless'], { cwd: dir, env, capture: true });
+            expect(result.status).toBe(1);
+            expect(result.output).toContain('Invalid compute target');
+            expect(result.output).not.toMatch(/^\s+at\s/m);
+        });
+    });
+});

package/tests/e2e/tier1.live.e2e.test.js

@@ -0,0 +1,118 @@
+// Tier 1 E2E: full live lifecycle against real AWS (nightly/manual only).
+// Skips gracefully without credentials. Validated in CI, not locally.
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { S3Client, HeadBucketCommand } from '@aws-sdk/client-s3';
+import fs from 'node:fs';
+import path from 'node:path';
+import {
+    e2eEnv,
+    assertPrerequisites,
+    makeTmpDir,
+    removeDir,
+    runCli,
+    sleep,
+    readBackendBucket,
+    readBackendRegion,
+} from './helpers.js';
+
+const env = e2eEnv({ mockAws: false });
+const STATUS_POLL_INTERVAL_MS = 15000;
+const STATUS_POLL_BUDGET_MS = 6 * 60 * 1000;
+const BUCKET_POLL_INTERVAL_MS = 10000;
+const BUCKET_POLL_BUDGET_MS = 3 * 60 * 1000;
+
+// Serial execution is mandatory (ordered lifecycle); the whole suite is
+// skipped without credentials. (Vitest 5 cannot chain .serial.skipIf.)
+const describeLive = process.env.AWS_ACCESS_KEY_ID ? describe.serial : describe.skip;
+
+describeLive('Tier 1: live lifecycle', () => {
+    let dir;
+    let suiteFailed = false;
+
+    beforeAll(() => {
+        assertPrerequisites();
+        dir = makeTmpDir('tier1-live');
+    });
+
+    afterAll(() => {
+        if (suiteFailed) {
+            console.log(`Tier 1 workspace preserved for debugging: ${dir}`);
+            return;
+        }
+        removeDir(dir);
+    });
+
+    async function step(fn) {
+        try {
+            await fn();
+        } catch (error) {
+            suiteFailed = true;
+            throw error;
+        }
+    }
+
+    it('init scaffolds the project', async () => {
+        await step(async () => {
+            const init = runCli(['init', '--target', 'ecs', '--headless'], { cwd: dir, env });
+            expect(init.status).toBe(0);
+            expect(fs.existsSync(path.join(dir, 'terraform', 'main.tf'))).toBe(true);
+        });
+    });
+
+    it('apply provisions infrastructure', async () => {
+        await step(async () => {
+            const apply = runCli(['apply', '--auto-approve'], { cwd: dir, env });
+            expect(apply.status).toBe(0);
+        });
+    });
+
+    it('status becomes healthy', async () => {
+        await step(async () => {
+            const deadline = Date.now() + STATUS_POLL_BUDGET_MS;
+            let healthy = false;
+            let lastOutput = '';
+            while (Date.now() < deadline) {
+                // --json exits 0 even when degraded, so the payload (not the
+                // exit code) drives the loop; parse failures just mean "wait".
+                const result = runCli(['status', '--json'], { cwd: dir, env, capture: true });
+                lastOutput = result.output;
+                try {
+                    healthy = JSON.parse(result.stdout).healthy === true;
+                } catch {
+                    healthy = false;
+                }
+                if (healthy) break;
+                await sleep(STATUS_POLL_INTERVAL_MS);
+            }
+            expect([healthy, lastOutput]).toEqual([true, expect.any(String)]);
+
+            const final = runCli(['status'], { cwd: dir, env });
+            expect(final.status).toBe(0);
+        });
+    });
+
+    it('destroy tears everything down', async () => {
+        await step(async () => {
+            const bucket = readBackendBucket(dir);
+            const region = readBackendRegion(dir);
+
+            const destroy = runCli(['destroy', '--yes'], { cwd: dir, env });
+            expect(destroy.status).toBe(0);
+
+            const s3 = new S3Client({ region });
+            const deadline = Date.now() + BUCKET_POLL_BUDGET_MS;
+            for (;;) {
+                try {
+                    await s3.send(new HeadBucketCommand({ Bucket: bucket }));
+                } catch (error) {
+                    if (error?.name === 'NotFound' || error?.$metadata?.httpStatusCode === 404) return;
+                    throw error;
+                }
+                if (Date.now() >= deadline) {
+                    throw new Error(`state bucket ${bucket} still exists after destroy`);
+                }
+                await sleep(BUCKET_POLL_INTERVAL_MS);
+            }
+        });
+    });
+});

package/tests/exec.test.js

@@ -1,4 +1,8 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+// NOTE: helper imports must stay above src imports: vi.mock factories run
+// during module evaluation and need the factories initialized.
+import { clackPromptsMockFactory } from './helpers/clack.js';
+import { telemetryMockFactory } from './helpers/telemetry.js';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
@@ -19,27 +23,9 @@ import {
 import { hasAwsCli } from '../src/utils/aws.js';
 import { trackEvent } from '../src/core/telemetry.js';
 
-vi.mock('@clack/prompts', () => ({
-    intro: vi.fn(),
-    outro: vi.fn(),
-    spinner: () => ({ start: vi.fn(), stop: vi.fn(), message: vi.fn() }),
-}));
+vi.mock('@clack/prompts', () => clackPromptsMockFactory());
 
-vi.mock('../src/core/telemetry.js', () => {
-    const trackEvent = vi.fn();
-    const flushTelemetry = vi.fn(() => Promise.resolve());
-    // Mirrors the real trackSuccess delegation so success-path assertions
-    // keep observing trackEvent (the real helper is unit-tested separately).
-    const trackSuccess = vi.fn(async (event, properties) => {
-        trackEvent(event, { ...properties, success: true });
-        await flushTelemetry();
-    });
-    const trackFailure = vi.fn(async (event, properties) => {
-        trackEvent(event, { ...properties, success: false });
-        await flushTelemetry();
-    });
-    return { trackEvent, flushTelemetry, trackSuccess, trackFailure };
-});
+vi.mock('../src/core/telemetry.js', (importOriginal) => telemetryMockFactory(importOriginal));
 
 const {
     MockListTasksCommand,

package/tests/gc.test.js

@@ -1,4 +1,8 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+// NOTE: helper imports must stay above src imports: vi.mock factories run
+// during module evaluation and need the factories initialized.
+import { clackPromptsMockFactory, clackMocks as clack } from './helpers/clack.js';
+import { telemetryMockFactory } from './helpers/telemetry.js';
 import {
     runGc,
     parseGcArgs,
@@ -87,43 +91,9 @@ vi.mock('@aws-sdk/client-ec2', () => ({
 }));
 
 // --- Mock interactive prompts (controllable confirm) ---
-const clack = vi.hoisted(() => ({
-    mockIntro: vi.fn(),
-    mockOutro: vi.fn(),
-    mockConfirm: vi.fn(),
-    mockCancel: vi.fn(),
-    mockSpinnerStart: vi.fn(),
-    mockSpinnerStop: vi.fn(),
-    mockSpinnerMessage: vi.fn(),
-}));
-
-vi.mock('@clack/prompts', () => ({
-    intro: clack.mockIntro,
-    outro: clack.mockOutro,
-    confirm: clack.mockConfirm,
-    cancel: clack.mockCancel,
-    spinner: vi.fn(() => ({
-        start: clack.mockSpinnerStart,
-        stop: clack.mockSpinnerStop,
-        message: clack.mockSpinnerMessage,
-    })),
-}));
+vi.mock('@clack/prompts', () => clackPromptsMockFactory());
 
-vi.mock('../src/core/telemetry.js', () => {
-    const trackEvent = vi.fn();
-    const flushTelemetry = vi.fn(() => Promise.resolve());
-    // Mirrors the real trackSuccess delegation so success-path assertions
-    // keep observing trackEvent (the real helper is unit-tested separately).
-    const trackSuccess = vi.fn(async (event, properties) => {
-        trackEvent(event, { ...properties, success: true });
-        await flushTelemetry();
-    });
-    const trackFailure = vi.fn(async (event, properties) => {
-        trackEvent(event, { ...properties, success: false });
-        await flushTelemetry();
-    });
-    return { trackEvent, flushTelemetry, trackSuccess, trackFailure };
-});
+vi.mock('../src/core/telemetry.js', (importOriginal) => telemetryMockFactory(importOriginal));
 
 const PROJECT = 'myapp';
 

package/tests/headless.test.js

@@ -1,4 +1,9 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+// NOTE: helper imports must stay above src imports: vi.mock factories run
+// during module evaluation and need the factories initialized.
+import { clackPromptsMockFactory, clackMocks as clack } from './helpers/clack.js';
+import { telemetryMockFactory } from './helpers/telemetry.js';
+import { mockConsoleTrio } from './helpers/console.js';
 import os from 'os';
 import fs from 'fs/promises';
 import path from 'path';
@@ -13,50 +18,7 @@ import { mainStack } from '../src/commands/init.js';
 // `commander` prompt calls exist under src/ or bin/), so mocking every
 // `@clack/prompts` export is the correct automation guard. `inquirer` is
 // not a dependency, so there is nothing to mock there.
-const clack = vi.hoisted(() => ({
-    mockText: vi.fn(),
-    mockSelect: vi.fn(),
-    mockMultiselect: vi.fn(),
-    mockConfirm: vi.fn(),
-    mockGroup: vi.fn(),
-    mockCancel: vi.fn(),
-    mockIsCancel: vi.fn(() => false),
-    mockIntro: vi.fn(),
-    mockOutro: vi.fn(),
-    mockNote: vi.fn(),
-    mockLogSuccess: vi.fn(),
-    mockLogWarn: vi.fn(),
-    mockLogError: vi.fn(),
-    mockLogInfo: vi.fn(),
-    mockSpinnerStart: vi.fn(),
-    mockSpinnerStop: vi.fn(),
-    mockSpinnerMessage: vi.fn(),
-}));
-
-vi.mock('@clack/prompts', () => ({
-    text: clack.mockText,
-    select: clack.mockSelect,
-    multiselect: clack.mockMultiselect,
-    confirm: clack.mockConfirm,
-    group: clack.mockGroup,
-    cancel: clack.mockCancel,
-    isCancel: clack.mockIsCancel,
-    intro: clack.mockIntro,
-    outro: clack.mockOutro,
-    note: clack.mockNote,
-    log: {
-        success: clack.mockLogSuccess,
-        warn: clack.mockLogWarn,
-        error: clack.mockLogError,
-        info: clack.mockLogInfo,
-        message: clack.mockLogInfo,
-    },
-    spinner: vi.fn(() => ({
-        start: clack.mockSpinnerStart,
-        stop: clack.mockSpinnerStop,
-        message: clack.mockSpinnerMessage,
-    })),
-}));
+vi.mock('@clack/prompts', () => clackPromptsMockFactory());
 
 // Never touch the real environment: fake terraform presence and AWS.
 vi.mock('../src/utils/system.js', () => ({
@@ -77,10 +39,7 @@ vi.mock('../src/utils/aws.js', () => ({
 }));
 
 // Silence telemetry so tests never hit the network.
-vi.mock('../src/core/telemetry.js', () => ({
-    trackEvent: vi.fn(),
-    flushTelemetry: vi.fn(async () => {}),
-}));
+vi.mock('../src/core/telemetry.js', (importOriginal) => telemetryMockFactory(importOriginal));
 
 function expectNoInteractivePrompts() {
     expect(clack.mockText).not.toHaveBeenCalled();
@@ -165,9 +124,8 @@ describe('Headless contract (automation-safe)', () => {
         const parsed = parseCliArgs(process.argv.slice(2));
         expect(parsed.isHeadless).toBe(true);
 
-        const exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {});
-        const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-        const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+        const spies = mockConsoleTrio();
+        const { exitSpy, logSpy, errorSpy } = spies;
 
         try {
             await mainStack({
@@ -187,17 +145,14 @@ describe('Headless contract (automation-safe)', () => {
             const dockerfile = await fs.readFile(path.join(tmpDir, 'Dockerfile'), 'utf-8');
             expect(dockerfile).toContain('EXPOSE 3000');
         } finally {
-            exitSpy.mockRestore();
-            logSpy.mockRestore();
-            errorSpy.mockRestore();
+            spies.restore();
         }
     });
 
     it('tolerates null headlessOptions in headless mode', async () => {
         process.chdir(tmpDir);
-        const exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {});
-        const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-        const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+        const spies = mockConsoleTrio();
+        const { exitSpy, logSpy, errorSpy } = spies;
 
         try {
             await mainStack({ isHeadless: true, headlessOptions: null });
@@ -207,9 +162,7 @@ describe('Headless contract (automation-safe)', () => {
             const mainTf = await fs.readFile(path.join(tmpDir, 'terraform', 'main.tf'), 'utf-8');
             expect(mainTf).toContain('region = "us-east-2"');
         } finally {
-            exitSpy.mockRestore();
-            logSpy.mockRestore();
-            errorSpy.mockRestore();
+            spies.restore();
         }
     });
 
@@ -241,9 +194,8 @@ describe('Headless contract (automation-safe)', () => {
             path.join(tmpDir, 'package.json'),
             JSON.stringify({ dependencies: { ioredis: '^5.0.0', pg: '^8.0.0' } })
         );
-        const exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {});
-        const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-        const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+        const spies = mockConsoleTrio();
+        const { exitSpy, logSpy, errorSpy } = spies;
 
         try {
             await mainStack({ isHeadless: true, headlessOptions: { dir: '.', framework: 'node' } });
@@ -258,9 +210,7 @@ describe('Headless contract (automation-safe)', () => {
                 expect.objectContaining({ selected_addons: [], detected_addons: ['db:redis'] })
             );
         } finally {
-            exitSpy.mockRestore();
-            logSpy.mockRestore();
-            errorSpy.mockRestore();
+            spies.restore();
         }
     });
 
@@ -270,9 +220,8 @@ describe('Headless contract (automation-safe)', () => {
         const parsed = parseCliArgs([
             '--headless', '--framework=node', '--with=db:redis,queue:sqs,ai:bedrock',
         ]);
-        const exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {});
-        const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-        const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+        const spies = mockConsoleTrio();
+        const { exitSpy, logSpy, errorSpy } = spies;
 
         try {
             await mainStack({
@@ -296,9 +245,7 @@ describe('Headless contract (automation-safe)', () => {
                 expect.objectContaining({ selected_addons: ['db:redis', 'queue:sqs', 'ai:bedrock'] })
             );
         } finally {
-            exitSpy.mockRestore();
-            logSpy.mockRestore();
-            errorSpy.mockRestore();
+            spies.restore();
         }
     });
 
@@ -312,9 +259,8 @@ describe('Headless contract (automation-safe)', () => {
             '--headless', '--framework=node', '--needsDatabase',
             '--with=email:ses', '--domain=example.com', '--setup-ci-migrate',
         ]);
-        const exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {});
-        const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-        const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+        const spies = mockConsoleTrio();
+        const { exitSpy, logSpy, errorSpy } = spies;
 
         try {
             await mainStack({
@@ -336,18 +282,15 @@ describe('Headless contract (automation-safe)', () => {
                 expect.objectContaining({ selected_addons: ['email:ses'], migration_gate_enabled: true })
             );
         } finally {
-            exitSpy.mockRestore();
-            logSpy.mockRestore();
-            errorSpy.mockRestore();
+            spies.restore();
         }
     });
 
     it('scaffolds drift.yml headless with --setup-ci-drift and skips it by default', async () => {
         process.chdir(tmpDir);
         const parsed = parseCliArgs(['--headless', '--framework=node', '--setup-ci-drift']);
-        const exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {});
-        const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-        const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+        const spies = mockConsoleTrio();
+        const { exitSpy, logSpy, errorSpy } = spies;
 
         try {
             await mainStack({
@@ -367,18 +310,15 @@ describe('Headless contract (automation-safe)', () => {
                 expect.objectContaining({ drift_detection_enabled: true })
             );
         } finally {
-            exitSpy.mockRestore();
-            logSpy.mockRestore();
-            errorSpy.mockRestore();
+            spies.restore();
         }
     });
 
     it('does not scaffold drift.yml without the flag', async () => {
         process.chdir(tmpDir);
         const parsed = parseCliArgs(['--headless', '--framework=node']);
-        const exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {});
-        const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-        const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+        const spies = mockConsoleTrio();
+        const { exitSpy, logSpy, errorSpy } = spies;
 
         try {
             await mainStack({
@@ -394,9 +334,7 @@ describe('Headless contract (automation-safe)', () => {
                 expect.objectContaining({ drift_detection_enabled: false })
             );
         } finally {
-            exitSpy.mockRestore();
-            logSpy.mockRestore();
-            errorSpy.mockRestore();
+            spies.restore();
         }
     });
 
@@ -411,9 +349,8 @@ describe('Headless contract (automation-safe)', () => {
         await fs.mkdir(path.join(tmpDir, 'terraform'), { recursive: true });
         await fs.writeFile(path.join(tmpDir, 'terraform', 'keep.tf'), '# user file');
         const parsed = parseCliArgs(argv);
-        const exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {});
-        const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-        const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+        const spies = mockConsoleTrio();
+        const { exitSpy, logSpy, errorSpy } = spies;
 
         try {
             const result = await mainStack({
@@ -434,9 +371,7 @@ describe('Headless contract (automation-safe)', () => {
             expect(await fs.readdir(tmpDir)).toEqual(['terraform']);
             expect(await fs.readFile(path.join(tmpDir, 'terraform', 'keep.tf'), 'utf-8')).toBe('# user file');
         } finally {
-            exitSpy.mockRestore();
-            logSpy.mockRestore();
-            errorSpy.mockRestore();
+            spies.restore();
         }
     });
 
@@ -448,9 +383,8 @@ describe('Headless contract (automation-safe)', () => {
         const parsed = parseCliArgs([
             '--headless', '--framework=node', '--needsDatabase', `--db-engine=${engine}`,
         ]);
-        const exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {});
-        const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-        const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+        const spies = mockConsoleTrio();
+        const { exitSpy, logSpy, errorSpy } = spies;
 
         try {
             await mainStack({
@@ -471,9 +405,7 @@ describe('Headless contract (automation-safe)', () => {
                 expect.objectContaining({ has_database: true, db_engine: engine })
             );
         } finally {
-            exitSpy.mockRestore();
-            logSpy.mockRestore();
-            errorSpy.mockRestore();
+            spies.restore();
         }
     });
 });
@@ -493,9 +425,8 @@ describe('Headless: --target lambda', () => {
 
     async function runHeadlessLambda(argv) {
         const parsed = parseCliArgs(argv);
-        const exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => { });
-        const logSpy = vi.spyOn(console, 'log').mockImplementation(() => { });
-        const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => { });
+        const spies = mockConsoleTrio();
+        const { exitSpy, logSpy, errorSpy } = spies;
         try {
             await mainStack({
                 isHeadless: parsed.isHeadless,
@@ -505,9 +436,7 @@ describe('Headless: --target lambda', () => {
             });
             return { exitSpy };
         } finally {
-            exitSpy.mockRestore();
-            logSpy.mockRestore();
-            errorSpy.mockRestore();
+            spies.restore();
         }
     }