@soleur/opencode 0.0.0-stage → 1.0.0

package/skills/linear-fetch/test/persist-safe-integration.test.sh

@@ -0,0 +1,191 @@
+#!/usr/bin/env bash
+# Automated E2E test for the load-bearing persist-safe rail.
+#
+# Simulates a full /soleur:linear-fetch invocation cycle:
+#   1. Synthesize a Linear-MCP-response shape (description + 2 comments
+#      with TEST-FIXTURE-NOT-REAL.png CDN URLs).
+#   2. Concatenate as the skill's Phase B would.
+#   3. Pipe through the redaction primitive (Phase D persist_safe_summary).
+#   4. Render through both caller templates (one-shot subagent prompt
+#      and brainstorm leader prompt) via render-caller-template.sh.
+#   5. Assert zero uploads.linear.app matches in either rendered prompt.
+#   6. Assert disclosure-line shape matches the spec.
+#   7. Assert the telemetry wrapper sees zero forbidden patterns when
+#      the rendered prompts are scanned as if they were telemetry.
+#
+# Required by Kieran-Rails review P1.5 — for a single-user incident
+# threshold, the load-bearing rail must have automated E2E coverage,
+# not only manual runbook scenarios.
+#
+# Fixtures are synthesized per cq-test-fixtures-synthesized-only.
+# The URL strings use the non-routable allowlisted token
+# TEST-FIXTURE-NOT-REAL so the CI pii-grep job permits this test file.
+#
+# Run via:  bash plugins/soleur/skills/linear-fetch/scripts/persist-safe-integration.test.sh
+
+set -eu
+
+# Owning trap (ADR-129). These files allocated tempfiles with no cleanup for as long as they
+# sat under scripts/, where no runner reached them; relocating them into test/ put them in
+# the lint's scope and surfaced it.
+_LF_TMPS=()
+_lf_cleanup() { [[ ${#_LF_TMPS[@]} -gt 0 ]] && rm -f "${_LF_TMPS[@]}"; return 0; }
+trap _lf_cleanup EXIT INT TERM HUP
+_lf_mktemp() { local t; t="$(mktemp)" || return 1; _LF_TMPS+=("$t"); printf '%s' "$t"; }
+
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../scripts" && pwd)"
+REDACT="$SCRIPT_DIR/redact-linear-urls.sh"
+RENDER="$SCRIPT_DIR/render-caller-template.sh"
+TELEMETRY="$SCRIPT_DIR/assert-no-linear-telemetry.sh"
+
+PASS=0
+FAIL=0
+fail() { echo "  FAIL: $1"; FAIL=$((FAIL+1)); }
+pass() { echo "  pass: $1"; PASS=$((PASS+1)); }
+
+# --------------------------------------------------------------------
+# Step 1: synthesize a Linear-shaped markdown blob.
+# Description has one CDN URL. Two comments each have one CDN URL.
+# Total: 3 redaction-eligible URLs.
+# Synthesized fixture — no real Linear data.
+# --------------------------------------------------------------------
+SYNTH_ID='FEAT-1'  # NB: assertion uses generic identifier — telemetry wrapper still rejects [A-Z]{2,}-[0-9]+
+SYNTH=$(cat <<'EOF'
+# Issue description
+
+The sidebar collapse button misaligns when the panel is < 200px.
+
+Repro screenshot:
+![misalignment screenshot](https://uploads.linear.app/TEST-FIXTURE-NOT-REAL-desc.png)
+
+Expected: chevron stays centered.
+
+--- comment by alice on 2026-05-12T10:00:00Z ---
+
+Confirmed on staging. Here is the rendered diff:
+<img src="https://uploads.linear.app/TEST-FIXTURE-NOT-REAL-c1.png" alt="diff">
+
+--- comment by bob on 2026-05-12T11:30:00Z ---
+
+Same on the dashboard route. Attached: <https://uploads.linear.app/TEST-FIXTURE-NOT-REAL-c2.png>
+EOF
+)
+
+echo "Test 1: synth blob has 3 CDN URLs (sanity)"
+synth_count=$({ grep -oE 'uploads\.linear\.app' <<<"$SYNTH" || true; } | wc -l | tr -d '[:space:]')
+[[ "$synth_count" == "3" ]] && pass "synth contains 3 CDN URLs" || fail "synth count=$synth_count, expected 3"
+
+# --------------------------------------------------------------------
+# Step 2: run through redaction primitive (Phase D persist_safe_summary).
+# --------------------------------------------------------------------
+echo "Test 2: redaction primitive on full blob"
+err_file=$(_lf_mktemp)
+PERSIST_SAFE=$(printf '%s' "$SYNTH" | bash "$REDACT" 2>"$err_file")
+REDACT_COUNT=$(cat "$err_file" | tr -d '[:space:]')
+rm -f "$err_file"
+[[ "$REDACT_COUNT" == "3" ]] && pass "redaction count=3" || fail "redaction count=$REDACT_COUNT"
+
+residue=$({ grep -oE 'uploads\.linear\.app' <<<"$PERSIST_SAFE" || true; } | wc -l | tr -d '[:space:]')
+[[ "$residue" == "0" ]] && pass "zero uploads.linear.app in persist_safe_summary" || fail "residue=$residue"
+
+# --------------------------------------------------------------------
+# Step 3: render through caller templates.
+# Template shapes mirror the actual one-shot subagent prompt and the
+# brainstorm domain-leader prompt — placeholder is __PERSIST_SAFE_SUMMARY__.
+# --------------------------------------------------------------------
+ONE_SHOT_TPL=$(cat <<'EOF'
+Task general-purpose: "You are running the planning phase of a one-shot pipeline.
+
+WORKING DIRECTORY: /tmp/wt
+BRANCH: feat-test
+ARGUMENTS: __PERSIST_SAFE_SUMMARY__
+
+STEPS:
+1. Use the Skill tool: skill: soleur:plan, args: "__PERSIST_SAFE_SUMMARY__"
+"
+EOF
+)
+
+BRAINSTORM_TPL=$(cat <<'EOF'
+Task soleur:product:cpo: "Assess the product implications of the following brainstorm idea: __PERSIST_SAFE_SUMMARY__. Cross-reference against brand-guide.md."
+EOF
+)
+
+echo "Test 3: render one-shot template with persist_safe_summary"
+ONE_SHOT_RENDERED=$(printf '%s' "$ONE_SHOT_TPL" | bash "$RENDER" "$PERSIST_SAFE")
+os_residue=$({ grep -oE 'uploads\.linear\.app' <<<"$ONE_SHOT_RENDERED" || true; } | wc -l | tr -d '[:space:]')
+[[ "$os_residue" == "0" ]] && pass "one-shot rendered prompt has zero CDN URLs" || fail "os_residue=$os_residue"
+
+# Sanity: rendered prompt should still contain the redacted placeholder marker
+if printf '%s' "$ONE_SHOT_RENDERED" | grep -c >/dev/null '\[linear-image: REDACTED\]'; then
+  pass "one-shot rendered prompt retains REDACTED markers"
+else
+  fail "one-shot rendered prompt lost REDACTED markers — substitution corrupt"
+fi
+
+echo "Test 4: render brainstorm template with persist_safe_summary"
+BS_RENDERED=$(printf '%s' "$BRAINSTORM_TPL" | bash "$RENDER" "$PERSIST_SAFE")
+bs_residue=$({ grep -oE 'uploads\.linear\.app' <<<"$BS_RENDERED" || true; } | wc -l | tr -d '[:space:]')
+[[ "$bs_residue" == "0" ]] && pass "brainstorm rendered prompt has zero CDN URLs" || fail "bs_residue=$bs_residue"
+
+# --------------------------------------------------------------------
+# Step 4: disclosure-line shape (spec FR6).
+# This is constructed by the skill at runtime; we simulate it here.
+# --------------------------------------------------------------------
+echo "Test 5: disclosure-line shape (FR6 — images present)"
+N_total=3
+M_with_comments=2
+DISCLOSURE="Detected ${SYNTH_ID} — fetched issue + ${N_total} images from description and ${M_with_comments} comments."
+expected_pattern='^Detected [A-Z]+-[0-9]+ — fetched issue \+ [0-9]+ images from description and [0-9]+ comments\.$'
+if printf '%s' "$DISCLOSURE" | grep -cE >/dev/null "$expected_pattern"; then
+  pass "disclosure matches spec shape"
+else
+  fail "disclosure mismatch: '$DISCLOSURE'"
+fi
+
+# --------------------------------------------------------------------
+# Step 5: telemetry-wrapper boundary tests.
+# The wrapper is the gate at the telemetry boundary — it is NOT
+# applied to persist_safe_summary (which is for prompts and documents,
+# where identifiers are useful context). These tests confirm the
+# wrapper would catch a malformed telemetry payload at its boundary.
+# --------------------------------------------------------------------
+echo "Test 6: telemetry wrapper allows a clean telemetry-shape payload"
+CLEAN_TELEMETRY='{"rule": "hr-gdpr-gate", "action": "applied", "duration_ms": 12}'
+set +e
+printf '%s' "$CLEAN_TELEMETRY" | bash "$TELEMETRY" >/dev/null 2>/dev/null
+RC=$?
+set -e
+[[ "$RC" == "0" ]] && pass "wrapper allows clean telemetry" || fail "wrapper rc=$RC on clean telemetry"
+
+echo "Test 7: telemetry wrapper rejects a payload that mistakenly contains an identifier"
+DIRTY_TELEMETRY='{"rule":"linear-fetch","action":"applied","ctx":"SOL-99 processed"}'
+set +e
+printf '%s' "$DIRTY_TELEMETRY" | bash "$TELEMETRY" >/dev/null 2>/dev/null
+RC=$?
+set -e
+[[ "$RC" == "1" ]] && pass "wrapper catches identifier-shape leak" || fail "wrapper rc=$RC, expected 1"
+
+# --------------------------------------------------------------------
+# Step 6: structural integrity — persist_safe_summary still contains
+# the original markdown skeleton (delimiters, comment authors), proving
+# the redaction is surgical (URLs only) not destructive.
+# --------------------------------------------------------------------
+echo "Test 8: structural integrity of persist_safe_summary"
+if printf '%s' "$PERSIST_SAFE" | grep -c >/dev/null 'comment by alice'; then
+  pass "comment-by-alice delimiter preserved"
+else
+  fail "delimiter lost — redaction is too aggressive"
+fi
+
+if printf '%s' "$PERSIST_SAFE" | grep -c >/dev/null '\[linear-image: REDACTED\]'; then
+  pass "REDACTED placeholder present"
+else
+  fail "REDACTED placeholder missing"
+fi
+
+# --------------------------------------------------------------------
+echo
+echo "Results: $PASS passed, $FAIL failed"
+exit $((FAIL > 0 ? 1 : 0))

package/skills/linear-fetch/test/redact-linear-urls.test.sh

@@ -0,0 +1,226 @@
+#!/usr/bin/env bash
+# Tests for redact-linear-urls.sh — the load-bearing redaction primitive
+# for the /soleur:linear-fetch skill. This is the only enforcement layer
+# inside the skill (the CI grep is the durable backstop outside it).
+#
+# Brand-survival threshold: single-user incident (see plan
+# knowledge-base/project/plans/archive/20261013-014038-2026-05-12-feat-linear-issue-image-context-plan.md).
+# A regression here means a uploads.linear.app signed URL can leak into a
+# committed artifact on a public-GitHub repo.
+#
+# Test fixtures use the synthesized non-routable string
+# `uploads.linear.app/TEST-FIXTURE-NOT-REAL.png` per cq-test-fixtures-synthesized-only.
+# Never use real Linear CDN URLs in test fixtures.
+#
+# Run via:  bash plugins/soleur/skills/linear-fetch/scripts/redact-linear-urls.test.sh
+
+set -euo pipefail
+
+# Owning trap (ADR-129). These files allocated tempfiles with no cleanup for as long as they
+# sat under scripts/, where no runner reached them; relocating them into test/ put them in
+# the lint's scope and surfaced it.
+_LF_TMPS=()
+_lf_cleanup() { [[ ${#_LF_TMPS[@]} -gt 0 ]] && rm -f "${_LF_TMPS[@]}"; return 0; }
+trap _lf_cleanup EXIT INT TERM HUP
+_lf_mktemp() { local t; t="$(mktemp)" || return 1; _LF_TMPS+=("$t"); printf '%s' "$t"; }
+
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../scripts" && pwd)"
+SCRIPT="$SCRIPT_DIR/redact-linear-urls.sh"
+
+PASS=0
+FAIL=0
+fail() { echo "  FAIL: $1"; FAIL=$((FAIL+1)); }
+pass() { echo "  pass: $1"; PASS=$((PASS+1)); }
+
+if [[ ! -x "$SCRIPT" ]] && [[ ! -r "$SCRIPT" ]]; then
+  echo "ERROR: script not found at $SCRIPT" >&2
+  exit 2
+fi
+
+# Helper: pipe $1 through the script, capture stdout and stderr separately.
+# Sets globals OUT and ERR. Stderr-count must be an integer; we strip
+# trailing whitespace.
+run_redact() {
+  local input="$1"
+  local err_file
+  err_file="$(_lf_mktemp)"
+  OUT="$(printf '%s' "$input" | bash "$SCRIPT" 2>"$err_file")"
+  ERR="$(cat "$err_file" | tr -d '[:space:]')"
+  rm -f "$err_file"
+}
+
+# ------------------------------------------------------------------------
+# Fixture 1: raw URL alone.
+# ------------------------------------------------------------------------
+echo "Test 1: raw URL"
+run_redact "https://uploads.linear.app/TEST-FIXTURE-NOT-REAL.png"
+[[ "$OUT" == "[linear-image: REDACTED]" ]] && pass "stdout" || fail "stdout (got: '$OUT')"
+[[ "$ERR" == "1" ]] && pass "count=1" || fail "count (got: '$ERR')"
+
+# ------------------------------------------------------------------------
+# Fixture 2: markdown image syntax ![alt](URL).
+# ------------------------------------------------------------------------
+echo "Test 2: markdown image"
+run_redact 'before ![alt text](https://uploads.linear.app/TEST-FIXTURE-NOT-REAL.png) after'
+[[ "$OUT" == "before ![alt text]([linear-image: REDACTED]) after" ]] && pass "stdout" || fail "stdout (got: '$OUT')"
+[[ "$ERR" == "1" ]] && pass "count=1" || fail "count (got: '$ERR')"
+
+# ------------------------------------------------------------------------
+# Fixture 3: HTML img tag with double-quoted src.
+# ------------------------------------------------------------------------
+echo "Test 3: HTML img tag (double quotes)"
+run_redact '<img src="https://uploads.linear.app/TEST-FIXTURE-NOT-REAL.png" alt="x">'
+[[ "$OUT" == '<img src="[linear-image: REDACTED]" alt="x">' ]] && pass "stdout" || fail "stdout (got: '$OUT')"
+[[ "$ERR" == "1" ]] && pass "count=1" || fail "count (got: '$ERR')"
+
+# ------------------------------------------------------------------------
+# Fixture 4: HTML img tag with single-quoted src.
+# ------------------------------------------------------------------------
+echo "Test 4: HTML img tag (single quotes)"
+run_redact "<img src='https://uploads.linear.app/TEST-FIXTURE-NOT-REAL.png' alt='x'>"
+expected="<img src='[linear-image: REDACTED]' alt='x'>"
+[[ "$OUT" == "$expected" ]] && pass "stdout" || fail "stdout (got: '$OUT')"
+[[ "$ERR" == "1" ]] && pass "count=1" || fail "count (got: '$ERR')"
+
+# ------------------------------------------------------------------------
+# Fixture 5: markdown autolink <URL> — leading/trailing angle brackets.
+# ------------------------------------------------------------------------
+echo "Test 5: markdown autolink"
+run_redact 'See <https://uploads.linear.app/TEST-FIXTURE-NOT-REAL.png> for details'
+[[ "$OUT" == "See <[linear-image: REDACTED]> for details" ]] && pass "stdout" || fail "stdout (got: '$OUT')"
+[[ "$ERR" == "1" ]] && pass "count=1" || fail "count (got: '$ERR')"
+
+# ------------------------------------------------------------------------
+# Fixture 6: URL-encoded path (e.g., %20 for space, %2F for slash).
+# ------------------------------------------------------------------------
+echo "Test 6: URL-encoded path"
+run_redact 'https://uploads.linear.app/TEST-FIXTURE-NOT-REAL-folder%2Fimage%20name.png'
+[[ "$OUT" == "[linear-image: REDACTED]" ]] && pass "stdout" || fail "stdout (got: '$OUT')"
+[[ "$ERR" == "1" ]] && pass "count=1" || fail "count (got: '$ERR')"
+
+# ------------------------------------------------------------------------
+# Fixture 7: five URLs across three lines — count must equal 5.
+# ------------------------------------------------------------------------
+echo "Test 7: five URLs across three lines"
+multi=$'line1 https://uploads.linear.app/TEST-FIXTURE-NOT-REAL-a.png https://uploads.linear.app/TEST-FIXTURE-NOT-REAL-b.png\nline2 https://uploads.linear.app/TEST-FIXTURE-NOT-REAL-c.png\nline3 https://uploads.linear.app/TEST-FIXTURE-NOT-REAL-d.png https://uploads.linear.app/TEST-FIXTURE-NOT-REAL-e.png'
+run_redact "$multi"
+# Each URL becomes [linear-image: REDACTED]
+if ! printf '%s' "$OUT" | grep -c >/dev/null 'uploads.linear.app'; then pass "no CDN URL remains"; else fail "URL still present in: '$OUT'"; fi
+[[ "$ERR" == "5" ]] && pass "count=5" || fail "count (got: '$ERR')"
+
+# ------------------------------------------------------------------------
+# Fixture 8: zero URLs — input passes through unchanged with count=0.
+# ------------------------------------------------------------------------
+echo "Test 8: zero URLs"
+run_redact "This text contains no Linear URLs, just SOL-39 as a reference."
+[[ "$OUT" == "This text contains no Linear URLs, just SOL-39 as a reference." ]] && pass "stdout unchanged" || fail "stdout (got: '$OUT')"
+[[ "$ERR" == "0" ]] && pass "count=0" || fail "count (got: '$ERR')"
+
+# ------------------------------------------------------------------------
+# Fixture 9: URL followed by closing bracket — markdown link-reference shape.
+# The trailing `]` must NOT be consumed by the URL match.
+# ------------------------------------------------------------------------
+echo "Test 9: URL followed by ]"
+run_redact '[![image][1]] caption: [1]: https://uploads.linear.app/TEST-FIXTURE-NOT-REAL.png'
+# Either the URL is at end (no closing bracket on this line) → eat to end
+# OR there's a closing bracket → bracket survives.
+# Our chosen class excludes `]`, so any `]` must remain.
+case "$OUT" in
+  *uploads.linear.app*) fail "URL still present in: '$OUT'" ;;
+  *) pass "no CDN URL remains" ;;
+esac
+[[ "$ERR" == "1" ]] && pass "count=1" || fail "count (got: '$ERR')"
+
+# ------------------------------------------------------------------------
+# Fixture 10: URL followed by closing paren — markdown link shape.
+# The trailing `)` must NOT be consumed.
+# ------------------------------------------------------------------------
+echo "Test 10: URL followed by )"
+run_redact '(see [here](https://uploads.linear.app/TEST-FIXTURE-NOT-REAL.png))'
+[[ "$OUT" == "(see [here]([linear-image: REDACTED]))" ]] && pass "stdout (paren preserved)" || fail "stdout (got: '$OUT')"
+[[ "$ERR" == "1" ]] && pass "count=1" || fail "count (got: '$ERR')"
+
+# ------------------------------------------------------------------------
+# Fixture 11: mixed-case hostname (security-sentinel P1-1 regression guard).
+# DNS is case-insensitive — Linear's CDN serves the same signed bearer
+# credential whether the hostname is lowercase or Camel-Case. The redactor
+# MUST redact regardless of case.
+# ------------------------------------------------------------------------
+echo "Test 11: mixed-case hostname"
+run_redact 'See https://Uploads.Linear.App/TEST-FIXTURE-NOT-REAL-mixed.png here'
+[[ "$OUT" == "See [linear-image: REDACTED] here" ]] && pass "mixed-case redacted" || fail "stdout (got: '$OUT')"
+[[ "$ERR" == "1" ]] && pass "count=1" || fail "count (got: '$ERR')"
+
+# ------------------------------------------------------------------------
+# Fixture 12: ALL-UPPERCASE hostname.
+# ------------------------------------------------------------------------
+echo "Test 12: all-uppercase hostname"
+run_redact 'See HTTPS://UPLOADS.LINEAR.APP/TEST-FIXTURE-NOT-REAL-upper.png after'
+[[ "$OUT" == "See [linear-image: REDACTED] after" ]] && pass "uppercase redacted" || fail "stdout (got: '$OUT')"
+[[ "$ERR" == "1" ]] && pass "count=1" || fail "count (got: '$ERR')"
+
+# ------------------------------------------------------------------------
+# Fixture 13: URL followed by U+2028 LINE SEPARATOR (\xe2\x80\xa8) —
+# security-sentinel P2-3. POSIX [:space:] does NOT cover U+2028, so the
+# previous regex could consume past it. The new ASCII-only path class
+# stops at the first non-ASCII byte (the leading \xe2 of the UTF-8
+# sequence), terminating the match cleanly.
+# ------------------------------------------------------------------------
+echo "Test 13: URL followed by U+2028 line separator"
+url_then_u2028=$(printf 'before https://uploads.linear.app/TEST-FIXTURE-NOT-REAL-u2028.png\xe2\x80\xa8after')
+run_redact "$url_then_u2028"
+# After redaction, the U+2028 and trailing text MUST remain (URL match
+# cannot extend into the separator's bytes).
+if printf '%s' "$OUT" | grep -c >/dev/null 'after' && printf '%s' "$OUT" | grep -c >/dev/null '\[linear-image: REDACTED\]'; then
+  pass "U+2028 terminates URL match cleanly"
+else
+  fail "U+2028 not handled (got: '$OUT')"
+fi
+[[ "$ERR" == "1" ]] && pass "count=1" || fail "count (got: '$ERR')"
+
+# ------------------------------------------------------------------------
+# Fixture 14: URL followed by NBSP (\xc2\xa0). Same class as U+2028 —
+# multi-byte sequence not in POSIX [:space:]. Must terminate match.
+# ------------------------------------------------------------------------
+echo "Test 14: URL followed by NBSP"
+url_then_nbsp=$(printf 'leading https://uploads.linear.app/TEST-FIXTURE-NOT-REAL-nbsp.png\xc2\xa0trailing')
+run_redact "$url_then_nbsp"
+if printf '%s' "$OUT" | grep -c >/dev/null 'trailing' && printf '%s' "$OUT" | grep -c >/dev/null '\[linear-image: REDACTED\]'; then
+  pass "NBSP terminates URL match cleanly"
+else
+  fail "NBSP not handled (got: '$OUT')"
+fi
+[[ "$ERR" == "1" ]] && pass "count=1" || fail "count (got: '$ERR')"
+
+# ------------------------------------------------------------------------
+# Negative-space check: a public Linear issue URL (NOT a CDN URL) MUST NOT
+# be redacted. The skill's redaction is strict to `uploads.linear.app`.
+# ------------------------------------------------------------------------
+echo "Negative-space: public linear.app/team/issue URL"
+run_redact 'See https://linear.app/jikig-ai/issue/SOL-39/title-here for context'
+[[ "$OUT" == "See https://linear.app/jikig-ai/issue/SOL-39/title-here for context" ]] && pass "public URL preserved" || fail "stdout (got: '$OUT')"
+[[ "$ERR" == "0" ]] && pass "count=0 (no CDN URLs)" || fail "count (got: '$ERR')"
+
+# ------------------------------------------------------------------------
+# Negative-space: prefix-injection / hyphen-substitution attacks
+# (security-sentinel P3-1).
+# ------------------------------------------------------------------------
+echo "Negative-space: hostname prefix/suffix injection"
+run_redact 'attack1: https://uploads-linear.app/x.png'
+[[ "$ERR" == "0" ]] && pass "uploads-linear.app (hyphen) not redacted" || fail "false positive (got: '$ERR')"
+run_redact 'attack2: https://myuploads.linear.app/x.png'
+[[ "$ERR" == "0" ]] && pass "myuploads.linear.app (prefix) not redacted" || fail "false positive (got: '$ERR')"
+run_redact 'attack3: https://uploads.linear.app.evil.com/x.png'
+# The hostname regex requires `/` immediately after `uploads.linear.app`,
+# so `.evil.com` after the hostname causes a non-match. The URL is left
+# alone, which is correct — the attacker's domain is different and the
+# CDN-bearer-credential threat does not apply.
+[[ "$ERR" == "0" ]] && pass "uploads.linear.app.evil.com (subdomain injection) not matched" || fail "got: '$ERR'"
+
+# ------------------------------------------------------------------------
+# Summary
+# ------------------------------------------------------------------------
+echo
+echo "Results: $PASS passed, $FAIL failed"
+exit $((FAIL > 0 ? 1 : 0))