serverless-ircd 0.10.0 → 0.11.0

package/tools/ci-hardening/tests/deploy-hostname.test.ts

@@ -0,0 +1,348 @@
+/**
+ * Deploy-time hostname placeholder rejection.
+ *
+ * The repo's deploy configs ship placeholder defaults
+ * (`SERVER_NAME = "irc.your-domain.invalid"` in both wrangler.toml
+ * files; the TCP workflow used to hardcode
+ * `TF_VAR_hostname: irc.example.com` for the Spectrum apply). A
+ * deploy that still carries one of those placeholders advertises a
+ * hostname the operator does not own — the wss Worker emits it in
+ * numerics (001/005) and the Spectrum cert/handshake targets it.
+ *
+ * The guard (`tools/ci-hardening` `hostname-guard`, driven by
+ * `runHostnameGuard`) refuses those deploys: the deploy-cf and
+ * deploy-cf-tcp workflows fail loudly unless the `hostname` input is
+ * a real hostname, and the guarded `wrangler deploy` scripts refuse
+ * when the deploy-time `SERVER_NAME` is still a placeholder. These
+ * assertions run as part of the CI-hardening suite on every PR, the
+ * same way the OIDC-only deploy contract does.
+ */
+
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { load } from 'js-yaml';
+import { describe, expect, it } from 'vitest';
+import {
+  PLACEHOLDER_HOSTNAMES,
+  checkDeployHostname,
+  isPlaceholderHostname,
+  readServerNameFromWranglerToml,
+  runHostnameGuard,
+} from '../src/deploy-hostname.js';
+
+interface WorkflowInput {
+  required?: boolean;
+  type?: string;
+  [key: string]: unknown;
+}
+
+interface WorkflowStep {
+  name?: string;
+  run?: string;
+  env?: Record<string, unknown>;
+  [key: string]: unknown;
+}
+
+interface DispatchWorkflow {
+  on?: { workflow_dispatch?: { inputs?: Record<string, WorkflowInput> } };
+  jobs?: Record<string, { steps?: WorkflowStep[] }>;
+}
+
+function loadWorkflow(rel: string): DispatchWorkflow {
+  return load(readText(rel)) as DispatchWorkflow;
+}
+
+function stepsOf(workflow: DispatchWorkflow, jobName: string): WorkflowStep[] {
+  const steps = workflow.jobs?.[jobName]?.steps;
+  expect(steps).toBeDefined();
+  return steps ?? [];
+}
+
+function stepIndex(steps: WorkflowStep[], predicate: (step: WorkflowStep) => boolean): number {
+  const index = steps.findIndex(predicate);
+  expect(index).toBeGreaterThanOrEqual(0);
+  return index;
+}
+
+function isHostnameGuardStep(step: WorkflowStep): boolean {
+  return typeof step.run === 'string' && step.run.includes('hostname-guard');
+}
+
+const REPO_ROOT = resolve(import.meta.dirname, '..', '..', '..');
+
+function repoPath(rel: string): string {
+  return resolve(REPO_ROOT, rel);
+}
+
+function readText(rel: string): string {
+  return readFileSync(repoPath(rel), 'utf8');
+}
+
+function fixturePath(name: string): string {
+  return resolve(import.meta.dirname, name);
+}
+
+describe('isPlaceholderHostname', () => {
+  it('recognizes irc.example.com as a placeholder', () => {
+    expect(isPlaceholderHostname('irc.example.com')).toBe(true);
+  });
+
+  it('recognizes irc.your-domain.invalid as a placeholder', () => {
+    expect(isPlaceholderHostname('irc.your-domain.invalid')).toBe(true);
+  });
+
+  it('does not flag a real deploy hostname', () => {
+    expect(isPlaceholderHostname('irc.example.net')).toBe(false);
+  });
+
+  it('matches case-insensitively after trimming', () => {
+    expect(isPlaceholderHostname('  IRC.Example.COM  ')).toBe(true);
+  });
+});
+
+describe('checkDeployHostname', () => {
+  it('rejects a missing hostname', () => {
+    const check = checkDeployHostname(undefined);
+    expect(check.ok).toBe(false);
+  });
+
+  it('rejects an empty hostname', () => {
+    const check = checkDeployHostname('');
+    expect(check.ok).toBe(false);
+  });
+
+  it('rejects a whitespace-only hostname', () => {
+    const check = checkDeployHostname('   ');
+    expect(check.ok).toBe(false);
+  });
+
+  it('explains that a missing hostname is required', () => {
+    const check = checkDeployHostname(undefined);
+    expect(check.ok === false && check.error).toMatch(/required/);
+  });
+
+  it('rejects irc.example.com naming the placeholder', () => {
+    const check = checkDeployHostname('irc.example.com');
+    expect(check.ok === false && check.error).toContain('irc.example.com');
+  });
+
+  it('rejects irc.your-domain.invalid naming the placeholder', () => {
+    const check = checkDeployHostname('irc.your-domain.invalid');
+    expect(check.ok === false && check.error).toContain('irc.your-domain.invalid');
+  });
+
+  it('rejects a case-variant placeholder', () => {
+    const check = checkDeployHostname('IRC.Your-Domain.Invalid');
+    expect(check.ok).toBe(false);
+  });
+
+  it('accepts a real hostname, trimmed and lowercased', () => {
+    expect(checkDeployHostname('  IRC.Example.Org  ')).toEqual({
+      ok: true,
+      hostname: 'irc.example.org',
+    });
+  });
+});
+
+describe('readServerNameFromWranglerToml', () => {
+  it('extracts SERVER_NAME from a [vars] block', () => {
+    const toml = '[vars]\nSERVER_NAME = "irc.your-domain.invalid"\n';
+    expect(readServerNameFromWranglerToml(toml)).toBe('irc.your-domain.invalid');
+  });
+
+  it('accepts single-quoted values', () => {
+    const toml = "[vars]\nSERVER_NAME = 'irc.example.net'\n";
+    expect(readServerNameFromWranglerToml(toml)).toBe('irc.example.net');
+  });
+
+  it('returns undefined when SERVER_NAME is absent', () => {
+    expect(readServerNameFromWranglerToml('[vars]\nNETWORK_NAME = "x"\n')).toBeUndefined();
+  });
+
+  it('ignores commented-out assignments', () => {
+    const toml = '[vars]\n# SERVER_NAME = "irc.example.com"\n';
+    expect(readServerNameFromWranglerToml(toml)).toBeUndefined();
+  });
+});
+
+describe('runHostnameGuard', () => {
+  it('accepts an explicit real hostname (exit 0)', () => {
+    const result = runHostnameGuard(['irc.example.net'], {});
+    expect(result.exitCode).toBe(0);
+  });
+
+  it('rejects an explicit placeholder hostname with a GitHub error annotation (exit 1)', () => {
+    const result = runHostnameGuard(['irc.example.com'], {});
+    expect(result.exitCode).toBe(1);
+    expect(result.message).toMatch(/^::error::/);
+    expect(result.message).toContain('irc.example.com');
+  });
+
+  it('rejects a missing argument with usage (exit 2)', () => {
+    const result = runHostnameGuard([], {});
+    expect(result.exitCode).toBe(2);
+    expect(result.message).toMatch(/usage/);
+  });
+
+  it('rejects multiple arguments with usage (exit 2)', () => {
+    const result = runHostnameGuard(['irc.example.net', 'extra'], {});
+    expect(result.exitCode).toBe(2);
+  });
+
+  it('rejects --from-config without a path with usage (exit 2)', () => {
+    const result = runHostnameGuard(['--from-config'], {});
+    expect(result.exitCode).toBe(2);
+    expect(result.message).toMatch(/usage/);
+  });
+
+  it('rejects --from-config with an empty path with usage (exit 2)', () => {
+    const result = runHostnameGuard(['--from-config', ''], {});
+    expect(result.exitCode).toBe(2);
+  });
+
+  it('rejects the shipped placeholder read from a wrangler config (exit 1)', () => {
+    const result = runHostnameGuard(
+      ['--from-config', fixturePath('__wrangler_placeholder__.toml')],
+      {},
+    );
+    expect(result.exitCode).toBe(1);
+    expect(result.message).toContain('irc.your-domain.invalid');
+  });
+
+  it('accepts a real SERVER_NAME read from a wrangler config (exit 0)', () => {
+    const result = runHostnameGuard(['--from-config', fixturePath('__wrangler_real__.toml')], {});
+    expect(result.exitCode).toBe(0);
+  });
+
+  it('prefers the SERVER_NAME env override over the config file', () => {
+    const result = runHostnameGuard(
+      ['--from-config', fixturePath('__wrangler_placeholder__.toml')],
+      { SERVER_NAME: 'irc.example.net' },
+    );
+    expect(result.exitCode).toBe(0);
+  });
+
+  it('falls back to the config when the SERVER_NAME env override is blank', () => {
+    const result = runHostnameGuard(
+      ['--from-config', fixturePath('__wrangler_placeholder__.toml')],
+      { SERVER_NAME: '' },
+    );
+    expect(result.exitCode).toBe(1);
+  });
+
+  it('fails clearly when the config sets no SERVER_NAME and no override exists', () => {
+    const result = runHostnameGuard(['--from-config', fixturePath('__wrangler_missing__.toml')], {
+      SERVER_NAME: undefined,
+    });
+    expect(result.exitCode).toBe(1);
+    expect(result.message).toContain('SERVER_NAME is not set');
+  });
+
+  it('crashes loudly when the config path does not exist', () => {
+    expect(() =>
+      runHostnameGuard(['--from-config', fixturePath('__no_such_file__.toml')], {}),
+    ).toThrow();
+  });
+});
+
+describe('shipped wrangler defaults stay recognized placeholders', () => {
+  it('cf-worker SERVER_NAME default is a recognized placeholder', () => {
+    const serverName = readServerNameFromWranglerToml(readText('apps/cf-worker/wrangler.toml'));
+    expect(serverName !== undefined && PLACEHOLDER_HOSTNAMES.has(serverName)).toBe(true);
+  });
+
+  it('cf-tcp-container SERVER_NAME default is a recognized placeholder', () => {
+    const serverName = readServerNameFromWranglerToml(
+      readText('apps/cf-tcp-container/wrangler.toml'),
+    );
+    expect(serverName !== undefined && PLACEHOLDER_HOSTNAMES.has(serverName)).toBe(true);
+  });
+});
+
+describe('deploy-cf-tcp.yml: hostname is a required, guarded deploy input', () => {
+  it('declares the hostname workflow_dispatch input as required', () => {
+    const hostname = loadWorkflow('.github/workflows/deploy-cf-tcp.yml').on?.workflow_dispatch
+      ?.inputs?.hostname;
+    expect(hostname?.required).toBe(true);
+  });
+
+  it('sources TF_VAR_hostname from the input instead of a hardcoded placeholder', () => {
+    const steps = stepsOf(loadWorkflow('.github/workflows/deploy-cf-tcp.yml'), 'deploy');
+    const terraform = steps[stepIndex(steps, (s) => s.run?.includes('terraform apply') === true)];
+    expect(terraform?.env?.TF_VAR_hostname).toBe('${{ inputs.hostname }}');
+  });
+
+  it('guards against placeholder hostnames before any deploy or terraform step', () => {
+    const steps = stepsOf(loadWorkflow('.github/workflows/deploy-cf-tcp.yml'), 'deploy');
+    const guard = stepIndex(steps, isHostnameGuardStep);
+    const deploy = stepIndex(steps, (s) => s.name === 'Deploy container');
+    const terraform = stepIndex(steps, (s) => s.run?.includes('terraform apply') === true);
+    expect(guard).toBeLessThan(deploy);
+    expect(guard).toBeLessThan(terraform);
+  });
+
+  it('validates the hostname input through the guard step', () => {
+    const steps = stepsOf(loadWorkflow('.github/workflows/deploy-cf-tcp.yml'), 'deploy');
+    const guard = steps[stepIndex(steps, isHostnameGuardStep)];
+    expect(guard?.env?.DEPLOY_HOSTNAME).toBe('${{ inputs.hostname }}');
+    expect(guard?.run).toContain('"$DEPLOY_HOSTNAME"');
+  });
+
+  it('overrides the container SERVER_NAME with the input hostname at deploy time', () => {
+    const steps = stepsOf(loadWorkflow('.github/workflows/deploy-cf-tcp.yml'), 'deploy');
+    const deploy = steps[stepIndex(steps, (s) => s.name === 'Deploy container')];
+    expect(deploy?.env?.SERVER_NAME).toBe('${{ inputs.hostname }}');
+    expect(deploy?.run).toContain('--var');
+    expect(deploy?.run).toContain('SERVER_NAME:');
+  });
+});
+
+describe('deploy-cf.yml: hostname is a required, guarded deploy input', () => {
+  it('declares the hostname workflow_dispatch input as required', () => {
+    const hostname = loadWorkflow('.github/workflows/deploy-cf.yml').on?.workflow_dispatch?.inputs
+      ?.hostname;
+    expect(hostname?.required).toBe(true);
+  });
+
+  it('guards against placeholder hostnames before the deploy step', () => {
+    const steps = stepsOf(loadWorkflow('.github/workflows/deploy-cf.yml'), 'deploy');
+    const guard = stepIndex(steps, isHostnameGuardStep);
+    const deploy = stepIndex(steps, (s) => s.name === 'Deploy Worker');
+    expect(guard).toBeLessThan(deploy);
+  });
+
+  it('overrides the worker SERVER_NAME with the input hostname at deploy time', () => {
+    const steps = stepsOf(loadWorkflow('.github/workflows/deploy-cf.yml'), 'deploy');
+    const deploy = steps[stepIndex(steps, (s) => s.name === 'Deploy Worker')];
+    // The guarded cf-deploy wrapper resolves SERVER_NAME from the step env
+    // (the workflow input) and injects it into wrangler itself — the run
+    // step only needs `pnpm run deploy`.
+    expect(deploy?.env?.SERVER_NAME).toBe('${{ inputs.hostname }}');
+    expect(deploy?.run).toContain('pnpm run deploy');
+  });
+});
+
+describe('wrangler deploy is guarded by the hostname check', () => {
+  it('cf-worker deploy script runs the guarded cf-deploy wrapper', () => {
+    const pkg = JSON.parse(readText('apps/cf-worker/package.json')) as {
+      scripts?: Record<string, string>;
+    };
+    const deploy = pkg.scripts?.deploy ?? '';
+    expect(deploy).toContain('ci-hardening/dist/cf-deploy-cli.js');
+    expect(deploy).toContain('wrangler.toml');
+  });
+
+  it('cf-tcp-container deploy script runs the guarded cf-deploy wrapper', () => {
+    const pkg = JSON.parse(readText('apps/cf-tcp-container/package.json')) as {
+      scripts?: Record<string, string>;
+    };
+    const deploy = pkg.scripts?.deploy ?? '';
+    expect(deploy).toContain('ci-hardening/dist/cf-deploy-cli.js');
+    expect(deploy).toContain('wrangler.toml');
+  });
+
+  it('root deploy:cf builds the workspace first (the guard ships as built dist)', () => {
+    const pkg = JSON.parse(readText('package.json')) as { scripts?: Record<string, string> };
+    expect(pkg.scripts?.['deploy:cf']).toContain('pnpm build');
+  });
+});

package/tools/ci-hardening/tests/env-var-drift.test.ts

@@ -0,0 +1,284 @@
+/**
+ * Env-var / secret documentation drift guard.
+ *
+ * The wrangler.toml `consumed-env-vars` comment block is the operator
+ * contract for what the Cloudflare Worker consumes and which vars are
+ * secrets. Two test layers:
+ *
+ *   1. A contract test against the REAL repo files — the loader
+ *      source and the shipped wrangler.toml — so any env var added to
+ *      `CfConfigEnv` without a matching doc entry (or vice versa)
+ *      fails CI with a named error.
+ *   2. Unit tests over synthetic fixtures pinning each pure helper
+ *      and each drift finding (missing / stale / misclassified /
+ *      leaked-secret).
+ */
+
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { describe, expect, it } from 'vitest';
+import {
+  EXTRA_DOCUMENTED_ENV_VARS,
+  REQUIRED_SECRET_ENV_VARS,
+  checkEnvVarDrift,
+  extractLoaderEnvVars,
+  extractVarsTableKeys,
+  parseConsumedEnvBlock,
+} from '../src/env-var-drift.js';
+
+const REPO_ROOT = resolve(import.meta.dirname, '..', '..', '..');
+
+function repoPath(rel: string): string {
+  return resolve(REPO_ROOT, rel);
+}
+
+function readText(rel: string): string {
+  return readFileSync(repoPath(rel), 'utf8');
+}
+
+const CONFIG_LOADER = 'packages/cf-adapter/src/config-loader.ts';
+const WRANGLER_TOML = 'apps/cf-worker/wrangler.toml';
+
+// ---------------------------------------------------------------------------
+// Contract — the real repo files must not drift.
+// ---------------------------------------------------------------------------
+
+describe('wrangler.toml consumed-env-vars block (drift guard)', () => {
+  it('documents every env var the cf-adapter config loader consumes', () => {
+    const result = checkEnvVarDrift(readText(CONFIG_LOADER), readText(WRANGLER_TOML));
+    if (!result.ok) {
+      throw new Error(`env-var documentation drift:\n  - ${result.errors.join('\n  - ')}`);
+    }
+    expect(result.documentedCount).toBeGreaterThan(0);
+  });
+
+  it('ships no credential material as a plaintext [vars] key', () => {
+    const varsKeys = extractVarsTableKeys(readText(WRANGLER_TOML));
+    for (const name of REQUIRED_SECRET_ENV_VARS) {
+      expect(varsKeys.has(name)).toBe(false);
+    }
+  });
+});
+
+// ---------------------------------------------------------------------------
+// extractLoaderEnvVars — the CfConfigEnv member scan.
+// ---------------------------------------------------------------------------
+
+describe('extractLoaderEnvVars', () => {
+  it('extracts and sorts the interface members (required and optional)', () => {
+    const source = [
+      'const DEFAULT_PER_IP_RATE_MAX = 5;',
+      '',
+      'export interface CfConfigEnv {',
+      '  ZEBRA?: string;',
+      '  ALPHA: string;',
+      '  /**',
+      '   * OPER_PASSWORD prose mentioning names does not match.',
+      '   */',
+      '  MOTD_LINES?: string;',
+      '}',
+      '',
+      'export interface Unrelated {',
+      '  OTHER?: string;',
+      '}',
+    ].join('\n');
+    expect(extractLoaderEnvVars(source)).toEqual(['ALPHA', 'MOTD_LINES', 'ZEBRA']);
+  });
+
+  it('de-duplicates repeated member names', () => {
+    const source =
+      'export interface CfConfigEnv {\n  MAX_CLIENTS?: string;\n  MAX_CLIENTS?: string;\n}';
+    expect(extractLoaderEnvVars(source)).toEqual(['MAX_CLIENTS']);
+  });
+
+  it('returns an empty list when the interface is absent', () => {
+    expect(extractLoaderEnvVars('export const nothing = 1;')).toEqual([]);
+  });
+
+  it('scans to end-of-file when the interface has no closing brace', () => {
+    const source = 'export interface CfConfigEnv {\n  MAX_CLIENTS?: string;';
+    expect(extractLoaderEnvVars(source)).toEqual(['MAX_CLIENTS']);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// parseConsumedEnvBlock — the wrangler.toml block parser.
+// ---------------------------------------------------------------------------
+
+describe('parseConsumedEnvBlock', () => {
+  it('parses [vars] and [secret] entries and ignores prose lines', () => {
+    const toml = [
+      '## lead-in prose',
+      '## BEGIN consumed-env-vars',
+      '## [vars] SERVER_NAME — required hostname',
+      '## prose line without a classification marker',
+      '## [secret] SERVER_PASSWORD — PASS gate',
+      '## END consumed-env-vars',
+      '## [vars] AFTER_BLOCK — must not be collected',
+    ].join('\n');
+    expect(parseConsumedEnvBlock(toml)).toEqual([
+      { name: 'SERVER_NAME', classification: 'vars' },
+      { name: 'SERVER_PASSWORD', classification: 'secret' },
+    ]);
+  });
+
+  it('returns an empty list when the block markers are absent', () => {
+    expect(parseConsumedEnvBlock('## [vars] SERVER_NAME — no block here')).toEqual([]);
+  });
+
+  it('scans to end-of-file when the END marker is missing', () => {
+    const toml = '## BEGIN consumed-env-vars\n## [secret] SASL_ACCOUNTS — seed list';
+    expect(parseConsumedEnvBlock(toml)).toEqual([
+      { name: 'SASL_ACCOUNTS', classification: 'secret' },
+    ]);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// extractVarsTableKeys — the plaintext [vars] table scan.
+// ---------------------------------------------------------------------------
+
+describe('extractVarsTableKeys', () => {
+  it('collects keys from [vars] only, skipping comments and other tables', () => {
+    const toml = [
+      '## comment header',
+      '[observability]',
+      'enabled = true',
+      '',
+      '[vars]',
+      'SERVER_NAME = "irc.example.net"',
+      '# SERVER_PASSWORD = "commented-out"',
+      'NETWORK_NAME = "net"',
+      '',
+      '[assets]',
+      'directory = "dist"',
+    ].join('\n');
+    expect(extractVarsTableKeys(toml)).toEqual(new Set(['SERVER_NAME', 'NETWORK_NAME']));
+  });
+
+  it('returns an empty set when there is no [vars] table', () => {
+    expect(extractVarsTableKeys('[observability]\nenabled = true')).toEqual(new Set());
+  });
+});
+
+// ---------------------------------------------------------------------------
+// checkEnvVarDrift — the combined findings.
+// ---------------------------------------------------------------------------
+
+/** Minimal in-sync fixture used as the base for each failure mutation. */
+function inSyncFixture(): { loader: string; toml: string } {
+  const loader = [
+    'export interface CfConfigEnv {',
+    '  SERVER_NAME?: string;',
+    '  OPER_PASSWORD?: string;',
+    '  SASL_ACCOUNTS?: string;',
+    '}',
+  ].join('\n');
+  const toml = [
+    '## BEGIN consumed-env-vars',
+    '## [vars] SERVER_NAME — required hostname',
+    '## [secret] OPER_PASSWORD — oper credential',
+    '## [secret] SASL_ACCOUNTS — SASL seed list',
+    '## END consumed-env-vars',
+    '',
+    '[vars]',
+    'SERVER_NAME = "irc.example.net"',
+  ].join('\n');
+  return { loader, toml };
+}
+
+describe('checkEnvVarDrift', () => {
+  it('passes an in-sync loader/block pair', () => {
+    const { loader, toml } = inSyncFixture();
+    expect(checkEnvVarDrift(loader, toml)).toEqual({ ok: true, documentedCount: 3 });
+  });
+
+  it('flags a consumed var missing from the block', () => {
+    const { loader, toml } = inSyncFixture();
+    const grownLoader = loader.replace(
+      '  SASL_ACCOUNTS?: string;',
+      '  SASL_ACCOUNTS?: string;\n  MAX_FRAMES_PER_WINDOW?: string;',
+    );
+    const result = checkEnvVarDrift(grownLoader, toml);
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.errors.length).toBe(1);
+    expect(result.errors[0]).toContain('MAX_FRAMES_PER_WINDOW');
+    expect(result.errors[0]).toContain('not documented');
+  });
+
+  it('flags a stale block entry the loader no longer consumes', () => {
+    const { loader, toml } = inSyncFixture();
+    const staleToml = toml.replace(
+      '## END consumed-env-vars',
+      '## [vars] RETIRED_KNOB — removed last release\n## END consumed-env-vars',
+    );
+    const result = checkEnvVarDrift(loader, staleToml);
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.errors.length).toBe(1);
+    expect(result.errors[0]).toContain('RETIRED_KNOB');
+    expect(result.errors[0]).toContain('no longer consumed');
+  });
+
+  it('permits documented vars consumed outside the config loader (WEB_ORIGINS)', () => {
+    const { loader, toml } = inSyncFixture();
+    const extraToml = toml.replace(
+      '## END consumed-env-vars',
+      '## [vars] WEB_ORIGINS — read by the worker edge, not the loader\n## END consumed-env-vars',
+    );
+    expect(checkEnvVarDrift(loader, extraToml)).toEqual({ ok: true, documentedCount: 4 });
+    expect(EXTRA_DOCUMENTED_ENV_VARS.has('WEB_ORIGINS')).toBe(true);
+  });
+
+  it('flags a credential var classified [vars] instead of [secret]', () => {
+    const { loader, toml } = inSyncFixture();
+    const misclassified = toml.replace(
+      '## [secret] OPER_PASSWORD — oper credential',
+      '## [vars] OPER_PASSWORD — oper credential',
+    );
+    const result = checkEnvVarDrift(loader, misclassified);
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.errors.length).toBe(1);
+    expect(result.errors[0]).toContain('OPER_PASSWORD');
+    expect(result.errors[0]).toContain('credential material');
+  });
+
+  it('does not double-flag a missing required secret as misclassified', () => {
+    const { loader, toml } = inSyncFixture();
+    const removed = toml.replace('## [secret] SASL_ACCOUNTS — SASL seed list\n', '');
+    const result = checkEnvVarDrift(loader, removed);
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.errors.length).toBe(1);
+    expect(result.errors[0]).toContain('not documented');
+  });
+
+  it('flags a [secret] var that also ships as a plaintext [vars] key', () => {
+    const { loader, toml } = inSyncFixture();
+    const leaked = toml.replace(
+      'SERVER_NAME = "irc.example.net"',
+      'SERVER_NAME = "irc.example.net"\nOPER_PASSWORD = "hunter2"',
+    );
+    const result = checkEnvVarDrift(loader, leaked);
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.errors.length).toBe(1);
+    expect(result.errors[0]).toContain('OPER_PASSWORD');
+    expect(result.errors[0]).toContain('wrangler secret put');
+  });
+
+  it('aggregates multiple independent findings', () => {
+    const loader = 'export interface CfConfigEnv {\n  NEW_KNOB?: string;\n}';
+    const toml = [
+      '## BEGIN consumed-env-vars',
+      '## [vars] STALE_KNOB — gone',
+      '## END consumed-env-vars',
+    ].join('\n');
+    const result = checkEnvVarDrift(loader, toml);
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.errors.length).toBe(2);
+  });
+});

package/tools/ci-hardening/vitest.config.ts

@@ -8,7 +8,11 @@ export default defineConfig({
       provider: 'v8',
       all: false,
       include: ['src/**/*.ts'],
-      exclude: ['src/index.ts'],
+      // `src/index.ts` is a pure barrel; `src/hostname-guard.ts` and
+      // `src/cf-deploy-cli.ts` are the side-effectful CLI shims
+      // (argv/env wiring + process.exit) whose logic lives in
+      // `deploy-hostname.ts` / `cf-deploy.ts`.
+      exclude: ['src/index.ts', 'src/hostname-guard.ts', 'src/cf-deploy-cli.ts'],
       reporter: ['text', 'html', 'json-summary'],
       thresholds: {
         lines: 100,