compass-st 1.1.2 → 1.2.0

package/cli/src/cmd/hook.rs

@@ -1,11 +1,18 @@
-use std::path::Path;
+use std::path::{Path, PathBuf};
 
 pub fn run(args: &[String]) -> Result<String, String> {
-    if args.is_empty() { return Err("Usage: compass-cli hook <statusline|update-checker>".into()); }
+    if args.is_empty() { return Err("Usage: compass-cli hook <statusline|update-checker|context-monitor|manifest-tracker>".into()); }
     match args[0].as_str() {
         "statusline" => statusline(),
         "update-checker" | "check-update" => update_checker(),
-        "context-monitor" => Ok(String::new()), // placeholder
+        "context-monitor" => context_monitor(),
+        "manifest-tracker" => {
+            let sub = args.get(1).map(|s| s.as_str()).unwrap_or("check");
+            match sub {
+                "generate" => manifest_tracker_generate(None),
+                _ => Err(format!("Unknown manifest-tracker subcommand: {}", sub)),
+            }
+        }
         _ => Err(format!("Unknown hook: {}", args[0])),
     }
 }
@@ -49,3 +56,256 @@ fn update_checker() -> Result<String, String> {
     // The shell hook handles the actual GitHub API call
     Ok(String::new())
 }
+
+/// PostToolUse hook — context utilization monitor.
+/// Currently a placeholder that emits a status JSON. Future enhancement may
+/// track real session-context size and warn on thresholds.
+fn context_monitor() -> Result<String, String> {
+    // Detect if we're inside a Compass session by checking $HOME/.compass/projects.json
+    // If found and last_active is set, surface session_id; else null.
+    let home = std::env::var("HOME").unwrap_or_else(|_| "/".to_string());
+    let registry_path = std::path::Path::new(&home).join(".compass").join("projects.json");
+
+    let session_id: Option<String> = if registry_path.exists() {
+        std::fs::read_to_string(&registry_path)
+            .ok()
+            .and_then(|s| serde_json::from_str::<serde_json::Value>(&s).ok())
+            .and_then(|v| v.get("last_active").and_then(|x| x.as_str()).map(|s| s.to_string()))
+    } else {
+        None
+    };
+
+    Ok(serde_json::json!({
+        "status": "ok",
+        "session_id": session_id,
+        "event_count": 0,
+        "last_event": null,
+        "log_path": null,
+    }).to_string())
+}
+
+/// Hard-coded skip patterns for the manifest walker. A path is skipped if
+/// ANY of these substrings appear in its full path. This mirrors the bash
+/// `find -not -path / -not -name` filters and adds `target/` for Rust builds.
+const SKIP_PATTERNS: &[&str] = &[
+    "/.git/",
+    "/node_modules/",
+    "/target/",
+    ".file-manifest.json",
+    ".update-check-cache",
+    ".DS_Store",
+];
+
+/// Recursively walk `dir`, pushing every file path into `out` that does not
+/// match a hard-coded skip pattern.
+fn walk_collect(dir: &Path, out: &mut Vec<PathBuf>) -> Result<(), String> {
+    let rd = match std::fs::read_dir(dir) {
+        Ok(r) => r,
+        Err(e) => return Err(format!("read_dir({}) failed: {}", dir.display(), e)),
+    };
+    for entry in rd {
+        let entry = entry.map_err(|e| e.to_string())?;
+        let path = entry.path();
+        let path_str = path.to_string_lossy();
+        // Skip if any pattern is a substring of the path
+        if SKIP_PATTERNS.iter().any(|p| path_str.contains(p)) {
+            continue;
+        }
+        let ft = entry.file_type().map_err(|e| e.to_string())?;
+        if ft.is_dir() {
+            walk_collect(&path, out)?;
+        } else if ft.is_file() {
+            out.push(path);
+        }
+    }
+    Ok(())
+}
+
+/// PreUpdate hook — generate a manifest of all tracked files under `root`
+/// (defaults to `~/.compass`) with SHA256 hashes. Writes
+/// `<root>/.file-manifest.json` and returns a small status JSON.
+pub fn manifest_tracker_generate(root: Option<&Path>) -> Result<String, String> {
+    use sha2::{Digest, Sha256};
+
+    let home = std::env::var("HOME").unwrap_or_else(|_| "/".to_string());
+    let default_root = PathBuf::from(&home).join(".compass");
+    let root: PathBuf = root.map(|p| p.to_path_buf()).unwrap_or(default_root);
+
+    if !root.exists() {
+        return Err(format!("root does not exist: {}", root.display()));
+    }
+
+    // Collect files
+    let mut files: Vec<PathBuf> = Vec::new();
+    walk_collect(&root, &mut files)?;
+    files.sort();
+
+    // Read version file if present
+    let version = std::fs::read_to_string(root.join("VERSION"))
+        .map(|s| s.trim().to_string())
+        .unwrap_or_else(|_| "unknown".to_string());
+
+    // Build files map preserving sorted order
+    let mut files_map = serde_json::Map::new();
+    for f in &files {
+        let rel = f.strip_prefix(&root).map_err(|e| e.to_string())?;
+        let rel_str = rel.to_string_lossy().to_string();
+        let bytes = std::fs::read(f).map_err(|e| format!("read {}: {}", f.display(), e))?;
+        let mut hasher = Sha256::new();
+        hasher.update(&bytes);
+        let hex_hash = hex::encode(hasher.finalize());
+        files_map.insert(rel_str, serde_json::Value::String(hex_hash));
+    }
+
+    // ISO-8601 UTC timestamp without extra deps: compute from SystemTime.
+    let generated_at = iso8601_utc_now();
+
+    let manifest = serde_json::json!({
+        "version": version,
+        "generated_at": generated_at,
+        "files": serde_json::Value::Object(files_map),
+    });
+
+    let manifest_path = root.join(".file-manifest.json");
+    let pretty = serde_json::to_string_pretty(&manifest).map_err(|e| e.to_string())?;
+    std::fs::write(&manifest_path, pretty)
+        .map_err(|e| format!("write {}: {}", manifest_path.display(), e))?;
+
+    Ok(serde_json::json!({
+        "ok": true,
+        "file_count": files.len(),
+        "manifest_path": manifest_path.to_string_lossy(),
+    }).to_string())
+}
+
+/// Minimal ISO-8601 UTC formatter (YYYY-MM-DDTHH:MM:SSZ) without chrono.
+fn iso8601_utc_now() -> String {
+    let secs = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0);
+    // Days since 1970-01-01
+    let days = (secs / 86400) as i64;
+    let tod = secs % 86400;
+    let hour = tod / 3600;
+    let minute = (tod % 3600) / 60;
+    let second = tod % 60;
+
+    // Convert days to Y-M-D via civil_from_days (Howard Hinnant algorithm)
+    let (y, m, d) = civil_from_days(days);
+    format!("{:04}-{:02}-{:02}T{:02}:{:02}:{:02}Z", y, m, d, hour, minute, second)
+}
+
+fn civil_from_days(z: i64) -> (i64, u32, u32) {
+    let z = z + 719468;
+    let era = if z >= 0 { z } else { z - 146096 } / 146097;
+    let doe = (z - era * 146097) as u64;
+    let yoe = (doe - doe / 1460 + doe / 36524 - doe / 146096) / 365;
+    let y = yoe as i64 + era * 400;
+    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
+    let mp = (5 * doy + 2) / 153;
+    let d = (doy - (153 * mp + 2) / 5 + 1) as u32;
+    let m = (if mp < 10 { mp + 3 } else { mp - 9 }) as u32;
+    let y = if m <= 2 { y + 1 } else { y };
+    (y, m, d)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn context_monitor_returns_ok_status() {
+        let out = context_monitor().expect("ok");
+        let v: serde_json::Value = serde_json::from_str(&out).expect("json");
+        assert_eq!(v["status"], "ok");
+        assert!(v.get("event_count").is_some());
+    }
+
+    #[test]
+    fn context_monitor_handles_no_session() {
+        // With $HOME pointing at a tmp dir with no registry, session_id is null.
+        let tmp = std::env::temp_dir().join(format!("compass-ctx-mon-test-{}", std::process::id()));
+        let _ = std::fs::create_dir_all(&tmp);
+        // Cannot mutate $HOME in tests without races; just verify the no-registry path
+        // by reading from a known-empty path. Acceptable: assert function returns Ok and
+        // status="ok".
+        let out = context_monitor().expect("ok");
+        assert!(out.contains("\"status\""));
+    }
+
+    #[test]
+    fn manifest_tracker_creates_file() {
+        let tmp = tempfile::tempdir().expect("tmpdir");
+        let root = tmp.path();
+        std::fs::write(root.join("a.md"), "alpha\n").unwrap();
+        std::fs::write(root.join("b.md"), "beta\n").unwrap();
+
+        let out = manifest_tracker_generate(Some(root)).expect("gen ok");
+        let v: serde_json::Value = serde_json::from_str(&out).expect("json");
+        assert_eq!(v["ok"], true);
+        assert_eq!(v["file_count"], 2);
+
+        let manifest_path = root.join(".file-manifest.json");
+        assert!(manifest_path.exists(), "manifest file created");
+
+        let raw = std::fs::read_to_string(&manifest_path).unwrap();
+        let m: serde_json::Value = serde_json::from_str(&raw).unwrap();
+        let files = m["files"].as_object().expect("files obj");
+        assert_eq!(files.len(), 2);
+        assert!(files.contains_key("a.md"));
+        assert!(files.contains_key("b.md"));
+    }
+
+    #[test]
+    fn manifest_tracker_skips_gitignored() {
+        let tmp = tempfile::tempdir().expect("tmpdir");
+        let root = tmp.path();
+        std::fs::write(root.join("keep.md"), "keep\n").unwrap();
+
+        // target/dummy.txt — should be skipped
+        let target_dir = root.join("target");
+        std::fs::create_dir_all(&target_dir).unwrap();
+        std::fs::write(target_dir.join("dummy.txt"), "ignore me\n").unwrap();
+
+        // .git/config — should be skipped
+        let git_dir = root.join(".git");
+        std::fs::create_dir_all(&git_dir).unwrap();
+        std::fs::write(git_dir.join("config"), "[core]\n").unwrap();
+
+        // .DS_Store — should be skipped
+        std::fs::write(root.join(".DS_Store"), "junk").unwrap();
+
+        let out = manifest_tracker_generate(Some(root)).expect("gen ok");
+        let v: serde_json::Value = serde_json::from_str(&out).expect("json");
+        assert_eq!(v["file_count"], 1, "only keep.md should be tracked");
+
+        let manifest_path = root.join(".file-manifest.json");
+        let raw = std::fs::read_to_string(&manifest_path).unwrap();
+        let m: serde_json::Value = serde_json::from_str(&raw).unwrap();
+        let files = m["files"].as_object().unwrap();
+        assert!(files.contains_key("keep.md"));
+        // No skipped file should appear
+        for k in files.keys() {
+            assert!(!k.contains("target"), "target/ not skipped: {}", k);
+            assert!(!k.contains(".git"), ".git/ not skipped: {}", k);
+            assert!(!k.contains(".DS_Store"), ".DS_Store not skipped: {}", k);
+        }
+    }
+
+    #[test]
+    fn manifest_tracker_sha256_is_correct() {
+        let tmp = tempfile::tempdir().expect("tmpdir");
+        let root = tmp.path();
+        std::fs::write(root.join("hello.txt"), "hello\n").unwrap();
+
+        manifest_tracker_generate(Some(root)).expect("gen ok");
+        let raw = std::fs::read_to_string(root.join(".file-manifest.json")).unwrap();
+        let m: serde_json::Value = serde_json::from_str(&raw).unwrap();
+        let files = m["files"].as_object().unwrap();
+        assert_eq!(
+            files["hello.txt"].as_str().unwrap(),
+            "5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03"
+        );
+    }
+}

package/cli/src/cmd/version.rs

@@ -81,8 +81,8 @@ mod tests {
         // a partial bump (e.g. VERSION updated but Cargo.toml not)
         // even if all sources agree on the wrong value.
         assert_eq!(
-            version_txt, "1.1.2",
-            "expected VERSION to be 1.1.2; got {}",
+            version_txt, "1.2.0",
+            "expected VERSION to be 1.2.0; got {}",
             version_txt
         );
     }

package/cli/tests/e2e_check_validates_prd.rs

@@ -0,0 +1,104 @@
+//! E2E validator gate test for the `/compass:check` workflow.
+//!
+//! Port of `tests/integration/e2e_check_validates_prd.sh`. Exercises the same
+//! CLI call that `check.md`'s Step 3b invokes:
+//!
+//!   compass-cli validate prd <path>
+//!
+//! Covers REQ-02 (PRD taste gate: R-FLOW + R-XREF). Runs five scenarios —
+//! one good PRD, two R-FLOW violations (prose + bullet), one R-XREF dangling,
+//! one R-XREF valid — asserting the gate blocks on bad input and passes on
+//! good input.
+
+#[path = "e2e_common.rs"]
+mod e2e_common;
+
+use e2e_common::{fixture_root, run_cli};
+
+#[test]
+fn good_flow_passes() {
+    let path = fixture_root().join("prd_good_flow.md");
+    let out = run_cli(&["validate", "prd", path.to_str().unwrap()]);
+    assert!(
+        out.status.success(),
+        "expected exit 0, got {:?}\nstdout: {}\nstderr: {}",
+        out.status,
+        String::from_utf8_lossy(&out.stdout),
+        String::from_utf8_lossy(&out.stderr)
+    );
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let v: serde_json::Value = serde_json::from_str(&stdout)
+        .unwrap_or_else(|e| panic!("parse json: {e}\nstdout: {stdout}"));
+    assert_eq!(v["ok"], true, "expected ok=true, got {}", stdout);
+}
+
+#[test]
+fn bad_flow_prose_fails() {
+    let path = fixture_root().join("prd_bad_flow_prose.md");
+    let out = run_cli(&["validate", "prd", path.to_str().unwrap()]);
+    assert!(
+        !out.status.success(),
+        "expected non-zero exit, got 0\nstdout: {}",
+        String::from_utf8_lossy(&out.stdout)
+    );
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    let combined = format!("{stdout}{stderr}");
+    assert!(
+        combined.contains("R-FLOW"),
+        "expected R-FLOW violation, got stdout: {stdout}\nstderr: {stderr}"
+    );
+}
+
+#[test]
+fn bad_flow_bullet_fails() {
+    let path = fixture_root().join("prd_bad_flow_bullet.md");
+    let out = run_cli(&["validate", "prd", path.to_str().unwrap()]);
+    assert!(
+        !out.status.success(),
+        "expected non-zero exit, got 0\nstdout: {}",
+        String::from_utf8_lossy(&out.stdout)
+    );
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    let combined = format!("{stdout}{stderr}");
+    assert!(
+        combined.contains("R-FLOW"),
+        "expected R-FLOW violation, got stdout: {stdout}\nstderr: {stderr}"
+    );
+}
+
+#[test]
+fn xref_dangling_fails() {
+    let path = fixture_root().join("prd_xref_dangling.md");
+    let out = run_cli(&["validate", "prd", path.to_str().unwrap()]);
+    assert!(
+        !out.status.success(),
+        "expected non-zero exit, got 0\nstdout: {}",
+        String::from_utf8_lossy(&out.stdout)
+    );
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    let combined = format!("{stdout}{stderr}");
+    assert!(
+        combined.contains("R-XREF"),
+        "expected R-XREF violation, got stdout: {stdout}\nstderr: {stderr}"
+    );
+}
+
+#[test]
+fn xref_valid_passes() {
+    let path = fixture_root().join("prd_xref_valid.md");
+    let out = run_cli(&["validate", "prd", path.to_str().unwrap()]);
+    assert!(
+        out.status.success(),
+        "expected exit 0, got {:?}\nstdout: {}\nstderr: {}",
+        out.status,
+        String::from_utf8_lossy(&out.stdout),
+        String::from_utf8_lossy(&out.stderr)
+    );
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let v: serde_json::Value = serde_json::from_str(&stdout)
+        .unwrap_or_else(|e| panic!("parse json: {e}\nstdout: {stdout}"));
+    assert_eq!(v["ok"], true, "expected ok=true, got {}", stdout);
+}

package/cli/tests/e2e_common.rs

@@ -0,0 +1,217 @@
+//! Shared helpers for `cli/tests/e2e_*.rs` integration test binaries.
+//!
+//! Cargo treats every file directly under `cli/tests/` as its own integration
+//! test binary. Because of that, this file is NOT a library — consumers pull
+//! it in with a path-based module declaration:
+//!
+//! ```ignore
+//! #[path = "e2e_common.rs"] mod e2e_common;
+//! use e2e_common::{HomeGuard, tmp_project, run_cli, run_cli_ok, run_cli_err, fixture_root};
+//! ```
+//!
+//! This avoids the `tests/common/mod.rs` convention (which Cargo treats
+//! inconsistently on some platforms) while still giving every binary its own
+//! copy of the helpers compiled against its own crate graph.
+//!
+//! Each integration-test binary is its own OS process, so cross-binary races
+//! on `$HOME` cannot happen — but tests WITHIN a single binary run on
+//! multiple threads by default, so `HOME_GUARD` serializes them.
+
+#![allow(dead_code)]
+
+use std::path::{Path, PathBuf};
+use std::sync::Mutex;
+
+/// Process-global lock for tests that mutate `$HOME`. Serializes tests within
+/// one integration-test binary; cross-binary isolation is handled by Cargo
+/// running each binary in its own process.
+pub static HOME_GUARD: Mutex<()> = Mutex::new(());
+
+/// RAII guard: locks `HOME_GUARD`, swaps `$HOME` to a fresh tempdir, and
+/// restores the previous `$HOME` (and best-effort cwd) on drop.
+pub struct HomeGuard {
+    pub tmp: tempfile::TempDir,
+    prev_home: Option<std::ffi::OsString>,
+    prev_cwd: Option<PathBuf>,
+    // Held for the lifetime of the guard. `'static` is sound because
+    // `HOME_GUARD` is a `static`.
+    _lock: std::sync::MutexGuard<'static, ()>,
+}
+
+impl HomeGuard {
+    /// Acquire the global HOME lock, create a fresh tempdir, and point
+    /// `$HOME` at it. Panics on failure — these are test helpers.
+    pub fn new() -> Self {
+        // Recover from a poisoned mutex: a prior test panicked while holding
+        // it, but the data we guard (a `()`) is fine to reuse.
+        let lock = HOME_GUARD.lock().unwrap_or_else(|e| e.into_inner());
+
+        let prev_home = std::env::var_os("HOME");
+        let prev_cwd = std::env::current_dir().ok();
+
+        let tmp = tempfile::tempdir().expect("create tempdir for HomeGuard");
+        std::env::set_var("HOME", tmp.path());
+
+        HomeGuard {
+            tmp,
+            prev_home,
+            prev_cwd,
+            _lock: lock,
+        }
+    }
+
+    /// Path of the tempdir now pointed at by `$HOME`.
+    pub fn home_path(&self) -> &Path {
+        self.tmp.path()
+    }
+}
+
+impl Default for HomeGuard {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Drop for HomeGuard {
+    fn drop(&mut self) {
+        // Restore `$HOME` first so any Drop-time lookups see a sane value.
+        match self.prev_home.take() {
+            Some(v) => std::env::set_var("HOME", v),
+            None => std::env::remove_var("HOME"),
+        }
+        // Best-effort: restore cwd so tests that cd'd into the tempdir don't
+        // leave a dangling cwd after the tempdir is unlinked.
+        if let Some(cwd) = self.prev_cwd.take() {
+            let _ = std::env::set_current_dir(cwd);
+        }
+        // `_lock` drops automatically, releasing HOME_GUARD.
+    }
+}
+
+/// Resolve `cli/tests/fixtures/...` as an absolute path.
+pub fn fixture_root() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("tests")
+        .join("fixtures")
+}
+
+/// Create a tmp dir and seed a minimal valid Compass project rooted at it.
+///
+/// Layout:
+/// - `<root>/.compass/.state/config.json` — v1.2.0 skeleton
+/// - `<root>/prd/` (empty)
+/// - `<root>/epics/` (empty)
+///
+/// Returns `(TempDir guard, project_root)`. Keep the `TempDir` alive for the
+/// duration of the test — dropping it deletes the directory.
+pub fn tmp_project(name: &str) -> (tempfile::TempDir, PathBuf) {
+    let tmp = tempfile::tempdir().expect("create tempdir for tmp_project");
+    let root = tmp.path().to_path_buf();
+
+    let state_dir = root.join(".compass").join(".state");
+    std::fs::create_dir_all(&state_dir).expect("mkdir .compass/.state");
+    std::fs::create_dir_all(root.join("prd")).expect("mkdir prd");
+    std::fs::create_dir_all(root.join("epics")).expect("mkdir epics");
+
+    // Build via serde_json so the name is safely escaped rather than
+    // string-interpolated into JSON.
+    let cfg = serde_json::json!({
+        "version": "1.2.0",
+        "project": { "name": name, "po": "@t" },
+        "lang": "en",
+        "spec_lang": "en",
+        "mode": "standalone",
+        "prefix": "PX",
+        "domain": "ard",
+        "output_paths": {
+            "prd": "prd",
+            "story": "epics/{EPIC}/user-stories",
+            "epic": "epics"
+        },
+        "naming": { "prd": "{slug}.md" }
+    });
+
+    std::fs::write(
+        state_dir.join("config.json"),
+        serde_json::to_vec_pretty(&cfg).expect("serialize config"),
+    )
+    .expect("write config.json");
+
+    (tmp, root)
+}
+
+/// Absolute path to the release `compass-cli` binary.
+fn compass_cli_path() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("target")
+        .join("release")
+        .join("compass-cli")
+}
+
+/// Ensure the release binary exists; build it if not.
+fn ensure_release_binary() -> PathBuf {
+    let bin = compass_cli_path();
+    if bin.exists() {
+        return bin;
+    }
+
+    let manifest_dir = env!("CARGO_MANIFEST_DIR");
+    let status = std::process::Command::new("cargo")
+        .args(["build", "--release", "--bin", "compass-cli"])
+        .current_dir(manifest_dir)
+        .status()
+        .expect("spawn `cargo build --release`");
+    assert!(
+        status.success(),
+        "`cargo build --release --bin compass-cli` failed with {status}"
+    );
+
+    assert!(
+        bin.exists(),
+        "release binary still missing after build: {}",
+        bin.display()
+    );
+    bin
+}
+
+/// Spawn the release `compass-cli` binary with the given args and return its
+/// raw `Output`. Builds the binary on demand the first time it's needed.
+pub fn run_cli(args: &[&str]) -> std::process::Output {
+    let bin = ensure_release_binary();
+    std::process::Command::new(&bin)
+        .args(args)
+        .output()
+        .unwrap_or_else(|e| panic!("spawn {}: {e}", bin.display()))
+}
+
+/// Run the CLI, assert exit code 0, and return stdout as a `String`.
+/// Panics with stdout+stderr on non-zero exit — test failure output is
+/// useless without both streams.
+pub fn run_cli_ok(args: &[&str]) -> String {
+    let out = run_cli(args);
+    if !out.status.success() {
+        panic!(
+            "run_cli_ok({:?}) failed: status={:?}\n--- stdout ---\n{}\n--- stderr ---\n{}",
+            args,
+            out.status,
+            String::from_utf8_lossy(&out.stdout),
+            String::from_utf8_lossy(&out.stderr),
+        );
+    }
+    String::from_utf8(out.stdout).expect("stdout not valid UTF-8")
+}
+
+/// Run the CLI, assert exit code non-zero, and return stderr as a `String`.
+/// Panics on unexpected success.
+pub fn run_cli_err(args: &[&str]) -> String {
+    let out = run_cli(args);
+    if out.status.success() {
+        panic!(
+            "run_cli_err({:?}) unexpectedly succeeded\n--- stdout ---\n{}\n--- stderr ---\n{}",
+            args,
+            String::from_utf8_lossy(&out.stdout),
+            String::from_utf8_lossy(&out.stderr),
+        );
+    }
+    String::from_utf8(out.stderr).expect("stderr not valid UTF-8")
+}