@orkestrel/scaffold 0.0.40 → 0.0.42

package/dist/host/tests/config.test.ts

@@ -1,6 +1,7 @@
 // P1: Every checked population must exist and be non-empty; absence fails instead of passing vacuously.
 // P2: Required items are checked strictly; extra items are ignored before their shape is read.
 
+import { spawnSync } from 'node:child_process'
 import {
 	existsSync,
 	globSync,
@@ -11,13 +12,16 @@ import {
 	rmSync,
 	writeFileSync,
 } from 'node:fs'
+import { createRequire } from 'node:module'
 import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath, pathToFileURL } from 'node:url'
 import { build, loadConfigFromFile } from 'vite'
-import { createScratch } from '@orkestrel/test/server'
+import { RuleTester } from 'oxlint/plugins-dev'
 import * as configHelpers from '../configs/helpers.js'
+import { MOCKING_RULE, PRIVACY_RULE } from '../configs/policy.js'
 import configuration, { resolveWorkspacePath } from '../vite.config.js'
 import tsconfig from '../tsconfig.json' with { type: 'json' }
+import { createPolicyScratch, inspectPolicyConfiguration } from './setupPolicy.js'
 import { describe, expect, it } from 'vitest'
 
 const root = resolve(dirname(fileURLToPath(import.meta.url)), '..')
@@ -452,6 +456,215 @@ describe('root configuration', () => {
 			hasService && publishes,
 		)
 	})
+
+	it('keeps policy rules active across every linted workspace path', () => {
+		const parsed: unknown = JSON.parse(readFileSync(resolve(root, '.oxlintrc.json'), 'utf8'))
+		expect(inspectPolicyConfiguration(parsed)).toEqual([])
+		if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+			throw new Error('The Oxlint configuration is not a record')
+		}
+		const controlled = structuredClone(parsed)
+		const overrides: unknown = Object.getOwnPropertyDescriptor(controlled, 'overrides')?.value
+		if (!Array.isArray(overrides)) throw new Error('The Oxlint configuration has no overrides')
+		Object.defineProperty(controlled, 'overrides', {
+			value: overrides.concat({
+				files: ['src/**'],
+				rules: { 'policy/no-mocking': 'off' },
+			}),
+			enumerable: true,
+			configurable: true,
+			writable: true,
+		})
+		expect(inspectPolicyConfiguration(controlled)).toEqual([
+			'overrides must not configure policy/no-mocking',
+		])
+	})
+
+	it('omits the audit-confirmed dead policy type exports', () => {
+		const source = readFileSync(resolve(root, 'configs/policy.ts'), 'utf8')
+		expect(source).not.toMatch(/\bPolicy(?:Call|ClassMember)\b/u)
+	})
+})
+
+describe('policy plugin', () => {
+	RuleTester.describe = describe
+	RuleTester.it = it
+
+	const tester = new RuleTester({ languageOptions: { parserOptions: { lang: 'ts' } } })
+	tester.run('no-mocking', MOCKING_RULE, {
+		valid: [
+			{ name: 'accepts recorders', code: 'createRecorder()' },
+			{ name: 'accepts non-framework members', code: "registry.mock('./x')" },
+			{ name: 'accepts unlisted framework members', code: 'vi.clearAllMocks()' },
+		],
+		invalid: [
+			{
+				name: 'rejects module mocking [membership: named vi and jest module APIs]',
+				code: "vi.mock('./x')",
+				errors: [{ messageId: 'mock' }],
+			},
+			{
+				name: 'rejects computed module mocking [membership: named vi and jest module APIs]',
+				code: `vi['mock']('./x')`,
+				errors: [{ messageId: 'mock' }],
+			},
+			{
+				name: 'rejects template module mocking [membership: named vi and jest module APIs]',
+				code: `vi[\`mock\`]('./x')`,
+				errors: [{ messageId: 'mock' }],
+			},
+			{
+				name: 'rejects spy factories [membership: named vi and jest spy APIs]',
+				code: 'jest.fn()',
+				errors: [{ messageId: 'spy' }],
+			},
+			{
+				name: 'rejects fake clocks [membership: named vi and jest clock APIs]',
+				code: 'vi.useFakeTimers()',
+				errors: [{ messageId: 'clock' }],
+			},
+			{
+				name: 'rejects environment stubs [membership: named vi and jest stub APIs]',
+				code: "vi.stubEnv('A', '1')",
+				errors: [{ messageId: 'stub' }],
+			},
+		],
+	})
+
+	tester.run('no-keyword-privacy', PRIVACY_RULE, {
+		valid: [
+			{ name: 'accepts runtime-private fields', code: 'class Example { #value = 1 }' },
+			{
+				name: 'accepts unannotated members',
+				code: 'class Example { value = 1; read() { return this.value } }',
+			},
+		],
+		invalid: [
+			{
+				name: 'rejects private properties [membership: keyword-annotated class members]',
+				code: 'class Example { private value = 1 }',
+				errors: [{ messageId: 'keyword' }],
+			},
+			{
+				name: 'rejects private methods [membership: keyword-annotated class members]',
+				code: 'class Example { private read() { return 1 } }',
+				errors: [{ messageId: 'keyword' }],
+			},
+			{
+				name: 'rejects protected properties [membership: keyword-annotated class members]',
+				code: 'class Example { protected value = 1 }',
+				errors: [{ messageId: 'keyword' }],
+			},
+			{
+				name: 'rejects protected methods [membership: keyword-annotated class members]',
+				code: 'class Example { protected read() { return 1 } }',
+				errors: [{ messageId: 'keyword' }],
+			},
+		],
+	})
+
+	it('loads every configured policy rule through the real binary', () => {
+		const scratch = createPolicyScratch({ prefix: 'orkestrel-config-policy-' })
+		try {
+			scratch.write(
+				'violations/fixture.ts',
+				[
+					"vi.mock('./x')",
+					'class PrivateMember { private value = 1 }',
+					'class ParameterMember { constructor(readonly value: string) {} }',
+					'class PublicMember { public value = 1 }',
+					'void PrivateMember',
+					'void ParameterMember',
+					'void PublicMember',
+				].join('\n'),
+			)
+			scratch.write(
+				'clean/fixture.ts',
+				[
+					'class CleanMember {',
+					'\t#value = 1',
+					'\tvalue(): number { return this.#value }',
+					'}',
+					'void CleanMember',
+				].join('\n'),
+			)
+
+			// Run oxlint's real Node entry through the current interpreter rather than the
+			// `node_modules/.bin/oxlint` shim. That shim is a POSIX `sh` script — a symlink to one on
+			// Linux, a `.cmd`/`.ps1` pair on Windows — and Windows `CreateProcess` cannot execute the
+			// extensionless form; spawning the `.cmd` would need `shell: true`, which breaks on paths
+			// containing spaces. Resolving through `createRequire` reads oxlint's own `bin` field, so
+			// the entry survives hoisting, a nested `node_modules` layout, and a future rename.
+			const manifestPath = createRequire(join(root, 'package.json')).resolve('oxlint/package.json')
+			const manifest: unknown = JSON.parse(readFileSync(manifestPath, 'utf8'))
+			if (typeof manifest !== 'object' || manifest === null) {
+				throw new Error('The oxlint package manifest is not an object')
+			}
+			const bin: unknown = Object.getOwnPropertyDescriptor(manifest, 'bin')?.value
+			const entry: unknown =
+				typeof bin === 'string'
+					? bin
+					: typeof bin === 'object' && bin !== null
+						? Object.getOwnPropertyDescriptor(bin, 'oxlint')?.value
+						: undefined
+			if (typeof entry !== 'string') {
+				throw new Error('The oxlint package declares no bin.oxlint entry')
+			}
+			const binary = resolve(dirname(manifestPath), entry)
+			const config = resolve(root, '.oxlintrc.json')
+			const violations = spawnSync(
+				process.execPath,
+				[binary, '--config', config, '--format', 'json', resolve(scratch.path, 'violations')],
+				{ cwd: root, encoding: 'utf8', timeout: 15_000 },
+			)
+			const clean = spawnSync(
+				process.execPath,
+				[binary, '--config', config, '--format', 'json', resolve(scratch.path, 'clean')],
+				{ cwd: root, encoding: 'utf8', timeout: 15_000 },
+			)
+			const reports: string[][] = []
+			for (const result of [violations, clean]) {
+				if (result.error !== undefined) throw result.error
+				const report: unknown = JSON.parse(result.stdout)
+				if (typeof report !== 'object' || report === null) {
+					throw new Error('Oxlint returned no JSON report')
+				}
+				const diagnostics: unknown = Object.getOwnPropertyDescriptor(report, 'diagnostics')?.value
+				if (!Array.isArray(diagnostics)) throw new Error('Oxlint returned no diagnostic list')
+				const codes: string[] = []
+				for (const diagnostic of diagnostics) {
+					if (typeof diagnostic !== 'object' || diagnostic === null) {
+						throw new Error('Oxlint returned a malformed diagnostic')
+					}
+					const code: unknown = Object.getOwnPropertyDescriptor(diagnostic, 'code')?.value
+					if (typeof code !== 'string') {
+						throw new Error('Oxlint returned a diagnostic without a rule id')
+					}
+					codes.push(code)
+				}
+				reports.push(codes)
+			}
+
+			const violationCodes = reports[0]
+			const cleanCodes = reports[1]
+			if (violationCodes === undefined || cleanCodes === undefined) {
+				throw new Error('Oxlint returned no fixture reports')
+			}
+			expect(violations.status).toBe(1)
+			for (const rule of [
+				'policy(no-mocking)',
+				'policy(no-keyword-privacy)',
+				'typescript(parameter-properties)',
+				'typescript(explicit-member-accessibility)',
+			]) {
+				expect(violationCodes).toContain(rule)
+			}
+			expect(clean.status).toBe(0)
+			expect(cleanCodes).toHaveLength(0)
+		} finally {
+			scratch.destroy()
+		}
+	})
 })
 
 describe('configuration helpers', () => {
@@ -490,7 +703,7 @@ describe('configuration helpers', () => {
 	})
 
 	it('resolves contained workspace paths and refuses a real outside sibling', () => {
-		const scratch = createScratch({ prefix: 'orkestrel-config-outside-' })
+		const scratch = createPolicyScratch({ prefix: 'orkestrel-config-outside-' })
 		try {
 			const outside = scratch.path
 			const importer = resolve(root, 'tests/config.test.ts')
@@ -513,7 +726,7 @@ describe('configuration helpers', () => {
 	})
 
 	it('reads bounded files and resolves package roots from real manifests', () => {
-		const scratch = createScratch({ prefix: 'orkestrel-config-package-' })
+		const scratch = createPolicyScratch({ prefix: 'orkestrel-config-package-' })
 		try {
 			const workspace = scratch.path
 			const packageRoot = resolve(workspace, 'node_modules/@sample/package')
@@ -551,7 +764,7 @@ describe('configuration helpers', () => {
 	})
 
 	it('classifies module boundaries and extracts static asset sources', async () => {
-		const scratch = createScratch({ prefix: 'orkestrel-config-assets-' })
+		const scratch = createPolicyScratch({ prefix: 'orkestrel-config-assets-' })
 		try {
 			const workspace = scratch.path
 			const source = resolve(workspace, 'entry.ts')

package/dist/host/tests/policy.test.ts

@@ -1,5 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import {
+	BRIDGE_POLICY_CONTROLS,
+	createPolicyScratch,
 	FUNCTION_SOURCE_FILES,
 	GENERIC_POLICY_SOURCES,
 	inspectPolicyControl,
@@ -7,15 +9,36 @@ import {
 	inspectPolicySources,
 	inspectPolicyWorkspace,
 	inspectSkillFamily,
+	inspectSkillBridges,
+	matchesSkillTrigger,
+	parseSkillFrontmatter,
 	POLICY_CONTROLS,
+	POLICY_SUPPRESSION_DIRECTIVE,
 	readSkillFamily,
 	SKILL_POLICY_APOSTROPHE,
+	SKILL_POLICY_BACKTICKED,
 	SKILL_POLICY_CONTROLS,
 	SKILL_POLICY_EXCLUSION,
+	SKILL_POLICY_FOLDED,
+	SKILL_POLICY_PARAGRAPHS,
 	stemToPolicyCandidates,
 	testToPolicyStem,
 } from './setupPolicy.js'
 
+describe('policy scratch', () => {
+	it('contains every write within its root', () => {
+		const scratch = createPolicyScratch({ prefix: 'orkestrel-policy-containment-' })
+		try {
+			expect(() => scratch.write('inside/fixture.ts', '')).not.toThrow()
+			expect(() => scratch.write('../escape', '')).toThrow(
+				'Scratch target must stay within its root',
+			)
+		} finally {
+			scratch.destroy()
+		}
+	})
+})
+
 describe('fleet policy register', () => {
 	it('keeps handlers in the function set and routes out', () => {
 		expect(FUNCTION_SOURCE_FILES).toContain('handlers.ts')
@@ -285,6 +308,22 @@ describe('policy population controls', () => {
 			}),
 		).toEqual([])
 	})
+
+	it('excludes documentation from the suppression population', () => {
+		expect(
+			inspectPolicyControl({
+				label: 'excludes documentation from the suppression population',
+				membership: 'files outside source, test, config, and script code',
+				rule: 'suppression',
+				files: [
+					{
+						path: 'guides/sample.md',
+						content: `<!-- ${POLICY_SUPPRESSION_DIRECTIVE} -->\n`,
+					},
+				],
+			}),
+		).toEqual([])
+	})
 })
 
 describe('instrument negative controls', () => {
@@ -307,11 +346,20 @@ describe('skill family policy', () => {
 		expect(inspectSkillFamily(process.cwd())).toEqual([])
 	})
 
+	it('parses a folded description containing a colon as exactly two frontmatter keys', () => {
+		const skill = SKILL_POLICY_FOLDED.files.find((file) => file.path.endsWith('/SKILL.md'))
+		const frontmatter = parseSkillFrontmatter(skill?.content ?? '')
+		expect(frontmatter?.keys).toEqual(['name', 'description'])
+		expect(frontmatter?.name).toBe('sample')
+		expect(frontmatter?.description).toBe('Use this skill when a continuation contains: a colon.')
+	})
+
 	for (const control of SKILL_POLICY_CONTROLS) {
 		it(`${control.label} [membership: ${control.membership}]`, () => {
 			const violations = inspectPolicyControl(control)
 			expect(violations).toHaveLength(1)
 			expect(violations[0]?.rule).toBe(control.rule)
+			expect(control.message === undefined || violations[0]?.message === control.message).toBe(true)
 		})
 	}
 
@@ -319,11 +367,45 @@ describe('skill family policy', () => {
 		expect(inspectPolicyControl(SKILL_POLICY_APOSTROPHE)).toEqual([])
 	})
 
+	it(`${SKILL_POLICY_FOLDED.label} [membership: ${SKILL_POLICY_FOLDED.membership}]`, () => {
+		expect(inspectPolicyControl(SKILL_POLICY_FOLDED)).toEqual([])
+	})
+
+	it(`${SKILL_POLICY_BACKTICKED.label} [membership: ${SKILL_POLICY_BACKTICKED.membership}]`, () => {
+		expect(inspectPolicyControl(SKILL_POLICY_BACKTICKED)).toEqual([])
+	})
+
+	it('parses a folded description containing two paragraphs', () => {
+		const skill = SKILL_POLICY_PARAGRAPHS.files.find((file) => file.path.endsWith('/SKILL.md'))
+		const frontmatter = parseSkillFrontmatter(skill?.content ?? '')
+		expect(frontmatter?.keys).toEqual(['name', 'description'])
+		expect(frontmatter?.description).toBe(
+			'First paragraph.\nUse `--app` when a policy fixture needs it.',
+		)
+		expect(matchesSkillTrigger(frontmatter?.description ?? '')).toBe(true)
+		expect(inspectPolicyControl(SKILL_POLICY_PARAGRAPHS)).toEqual([])
+	})
+
 	it(`${SKILL_POLICY_EXCLUSION.label} [membership: ${SKILL_POLICY_EXCLUSION.membership}]`, () => {
 		expect(inspectPolicyControl(SKILL_POLICY_EXCLUSION)).toEqual([])
 	})
 })
 
+describe('skill bridge policy', () => {
+	it('matches every real provider bridge to its canonical skill', () => {
+		expect(inspectSkillBridges(process.cwd())).toEqual([])
+	})
+
+	for (const control of BRIDGE_POLICY_CONTROLS) {
+		it(`${control.label} [membership: ${control.membership}]`, () => {
+			const violations = inspectPolicyControl(control)
+			expect(violations).toHaveLength(1)
+			expect(violations[0]?.rule).toBe(control.rule)
+			expect(control.message === undefined || violations[0]?.message === control.message).toBe(true)
+		})
+	}
+})
+
 describe('repository policy', () => {
 	it('enforces placement and mirrors over the real workspace', () => {
 		expect(inspectPolicyWorkspace(process.cwd())).toEqual([])