start-command 0.35.4 → 0.37.0

package/test/regression-198.js

@@ -0,0 +1,281 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { resumeExecution } = require('../src/lib/execution-resume');
+const { recoverKilledExecution } = require('../src/lib/execution-recovery');
+const { SessionState } = require('../src/lib/session-probe');
+const {
+  buildDetachedDockerCompletionScript,
+  DOCKER_CONTAINER_CLEANUP_POLICY,
+} = require('../src/lib/docker-cleanup');
+
+function fixture(options = {}) {
+  let current = {
+    uuid: 'issue-198-uuid',
+    command: 'original',
+    status: 'executed',
+    exitCode: 137,
+    options: {
+      isolated: 'docker',
+      isolationMode: 'detached',
+      sessionName: 'box',
+      containerId: 'same-id',
+      ...options,
+    },
+  };
+  const store = {
+    get: () => globalThis.structuredClone(current),
+    save: (r) => {
+      current = globalThis.structuredClone(r);
+    },
+  };
+  return { store, current: () => current };
+}
+
+function mockDocker(calls, scripts = []) {
+  return (_bin, args) => {
+    calls.push(args);
+    if (args[0] === 'cp') {
+      scripts.push(fs.readFileSync(args[1], 'utf8'));
+    }
+    return {
+      success: true,
+      stdout:
+        args[0] === 'info'
+          ? JSON.stringify({ DockerRootDir: '/docker' })
+          : args.includes('--size')
+            ? '1024'
+            : args.includes('{{.State.Running}}')
+              ? 'true'
+              : args.includes('{{json .HostConfig}}')
+                ? '{}'
+                : args[0] === 'run'
+                  ? 'new-container-id'
+                  : '',
+      status: 0,
+    };
+  };
+}
+
+const stopped = () => ({ state: SessionState.STOPPED, alive: false });
+
+test('replacement command resumes the same container without a snapshot or changed ID', async () => {
+  const { store, current } = fixture({ commandHandoff: true });
+  const calls = [],
+    scripts = [];
+  const result = await resumeExecution(store, 'box', {
+    command: "printf '%s' 'new $command'",
+    probe: stopped,
+    runner: mockDocker(calls, scripts),
+    startWatcher: () => true,
+  });
+  assert.equal(result.success, true, result.error);
+  assert.ok(calls.some((args) => args[0] === 'cp'));
+  assert.ok(calls.some((args) => args[0] === 'start'));
+  assert.ok(
+    !calls.some((args) => ['commit', 'run', 'create'].includes(args[0]))
+  );
+  assert.equal(current().options.containerId, 'same-id');
+  assert.equal(current().options.sessionName, 'box');
+  assert.ok(scripts[0].includes('new $command'));
+});
+
+test('automatic recovery replaces a prior explicit handoff and exports its attempt', () => {
+  const { store } = fixture({
+    commandHandoff: true,
+    onKillResume: 1,
+    recoveryCommand: 'printf recovered',
+  });
+  const scripts = [];
+  const result = recoverKilledExecution({
+    store,
+    executionId: 'issue-198-uuid',
+    exitCode: 137,
+    oomKilled: false,
+    runner: mockDocker([], scripts),
+    startWatcher: () => true,
+  });
+  assert.equal(result.recovered, true, result.reason);
+  assert.ok(scripts[0].includes('START_COMMAND_RECOVERY_ATTEMPT=1'));
+  assert.ok(scripts[0].includes('printf recovered'));
+});
+
+test('legacy snapshots preflight before commit and remove originals only with non-forced rm after start', async () => {
+  const { store, current } = fixture();
+  const calls = [];
+  const result = await resumeExecution(store, 'box', {
+    command: 'new',
+    probe: stopped,
+    removeOriginal: true,
+    runner: mockDocker(calls),
+    snapshotOptions: { freeBytes: () => 100 * 1024 ** 3 },
+    startWatcher: () => true,
+  });
+  assert.equal(result.success, true, result.error);
+  assert.ok(
+    calls.findIndex((a) => a.includes('--size')) <
+      calls.findIndex((a) => a[0] === 'commit')
+  );
+  assert.ok(
+    calls.findIndex((a) => a[0] === 'run') <
+      calls.findIndex((a) => a[0] === 'rm')
+  );
+  assert.deepEqual(
+    calls.find((a) => a[0] === 'rm'),
+    ['rm', 'box']
+  );
+  assert.equal(current().options.commandHandoff, true);
+  assert.equal(current().options.snapshotImage, 'start-command-resume/box:1');
+  assert.match(result.output, /snapshotting/);
+});
+
+test('disk shortage rolls back the reservation without committing or removing the original', async () => {
+  const { store, current } = fixture();
+  const calls = [];
+  const result = await resumeExecution(store, 'box', {
+    command: 'new',
+    probe: stopped,
+    removeOriginal: true,
+    runner: mockDocker(calls),
+    snapshotOptions: { freeBytes: () => 0 },
+    startWatcher: () => true,
+  });
+  assert.equal(result.success, false);
+  assert.match(result.error, /Insufficient disk/);
+  assert.ok(!calls.some((a) => ['commit', 'rm', 'rmi'].includes(a[0])));
+  assert.equal(current().options.sessionName, 'box');
+  assert.equal(current().options.launchPending, undefined);
+});
+
+test('snapshot failure removes a completed image and restores the original execution', async () => {
+  const { store, current } = fixture();
+  const calls = [];
+  const base = mockDocker(calls);
+  const result = await resumeExecution(store, 'box', {
+    command: 'new',
+    probe: stopped,
+    runner: (bin, args) =>
+      args[0] === 'run'
+        ? { success: false, stderr: 'launch failed' }
+        : base(bin, args),
+    snapshotOptions: { freeBytes: () => 100 * 1024 ** 3 },
+    startWatcher: () => true,
+  });
+  assert.equal(result.success, false);
+  assert.ok(
+    calls.some((a) => a[0] === 'rmi' && a[1] === 'start-command-resume/box:1')
+  );
+  assert.equal(current().options.sessionName, 'box');
+});
+
+test('watcher removes its generated image after the cleanup policy removes its container', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cleanup-198-'));
+  const watcher = path.join(dir, 'watcher.sh');
+  const events = path.join(dir, 'events');
+  try {
+    fs.writeFileSync(
+      watcher,
+      `#!/bin/sh
+docker() {
+case "$1" in
+  wait) echo 0 ;;
+  inspect) case "$3" in
+    *State.Running*) echo false ;;
+    *State.ExitCode*) echo '0 false 2026-10-10T00:00:00Z 2026-10-10T00:00:01Z' ;;
+    *snapshot-image*) echo 'start-command-resume/box:1' ;;
+    *) echo '' ;;
+  esac ;;
+  rm|rmi) printf '%s\\n' "$*" >> events ;;
+esac
+}
+${buildDetachedDockerCompletionScript(
+  'box-resume-1',
+  DOCKER_CONTAINER_CLEANUP_POLICY.ALWAYS,
+  null
+)}
+`
+    );
+    // Keep POSIX quoting inside a file, out of Windows process argv/PATH.
+    const result = spawnSync('sh', ['watcher.sh'], {
+      cwd: dir,
+      encoding: 'utf8',
+    });
+    assert.equal(result.status, 0, result.stderr);
+    assert.deepEqual(fs.readFileSync(events, 'utf8').trim().split('\n'), [
+      'rm -f box-resume-1',
+      'rmi start-command-resume/box:1',
+    ]);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('changed caller labels use a guarded snapshot and reapply merged labels', async () => {
+  const { store, current } = fixture({
+    commandHandoff: true,
+    labels: ['role=old', 'team=runtime'],
+  });
+  const calls = [];
+  const result = await resumeExecution(store, 'box', {
+    probe: stopped,
+    resourceOptions: { labels: ['role=new'] },
+    runner: mockDocker(calls),
+    snapshotOptions: { freeBytes: () => 100 * 1024 ** 3 },
+    startWatcher: () => true,
+  });
+  assert.equal(result.success, true, result.error);
+  const run = calls.find((args) => args[0] === 'run');
+  assert.ok(run.includes('role=new'));
+  assert.ok(run.includes('team=runtime'));
+  assert.ok(!run.includes('role=old'));
+  assert.ok(calls.some((args) => args[0] === 'commit'));
+  assert.deepEqual(current().options.labels, ['role=new', 'team=runtime']);
+  assert.equal(current().options.commandHandoff, true);
+});
+
+test('original retained by default and when a successor has already stopped', async () => {
+  for (const removeOriginal of [false, true]) {
+    const { store } = fixture();
+    const calls = [];
+    const base = mockDocker(calls);
+    const result = await resumeExecution(store, 'box', {
+      command: 'new',
+      probe: stopped,
+      removeOriginal,
+      runner: (bin, args) =>
+        args.includes('{{.State.Running}}')
+          ? { success: true, stdout: 'false' }
+          : base(bin, args),
+      snapshotOptions: { freeBytes: () => 100 * 1024 ** 3 },
+      startWatcher: () => true,
+    });
+    assert.equal(result.success, true, result.error);
+    assert.ok(!calls.some((args) => args[0] === 'rm'));
+  }
+});
+
+test('repeated snapshot successors retain the original root-session attribution', async () => {
+  const { store, current } = fixture();
+  for (const role of ['first', 'second']) {
+    const calls = [];
+    const result = await resumeExecution(store, 'box', {
+      command: 'new',
+      probe: stopped,
+      resourceOptions: { labels: [`role=${role}`] },
+      runner: mockDocker(calls),
+      snapshotOptions: { freeBytes: () => 100 * 1024 ** 3 },
+      startWatcher: () => true,
+    });
+    assert.equal(result.success, true, result.error);
+    assert.ok(
+      calls
+        .find((args) => args[0] === 'run')
+        .includes('start-command.root-session=box')
+    );
+    assert.equal(current().options.rootSession, 'box');
+  }
+  assert.equal(current().options.resumeCount, 2);
+});

package/test/regression-199.js

@@ -0,0 +1,79 @@
+const { describe, it, expect } = require('bun:test');
+const { parseArgs } = require('../src/lib/args-parser');
+const {
+  buildDockerRuntimeArgs,
+  buildDockerRuntimeMetadata,
+} = require('../src/lib/docker-runtime-args');
+const { buildNextLevelCommand } = require('../src/lib/command-builder');
+
+describe('Docker attribution labels (#199)', () => {
+  it('attributes replacement containers to their stable root and execution', () => {
+    const { dockerLabels } = require('../src/lib/docker-labels');
+    expect(
+      dockerLabels({ session: 'demo-resume-1', sessionId: 'uuid' })
+    ).toContain('start-command.root-session=demo-resume-1');
+    expect(
+      dockerLabels({
+        session: 'demo-resume-1-resume-2',
+        sessionId: 'uuid',
+        resumeCount: 2,
+      })
+    ).toEqual([
+      'start-command.session=demo-resume-1-resume-2',
+      'start-command.root-session=demo',
+      'start-command.resume-count=2',
+      'start-command.uuid=uuid',
+    ]);
+  });
+  it('parses repeated labels and preserves equals signs and empty values', () => {
+    const { wrapperOptions } = parseArgs([
+      '-i',
+      'docker',
+      '--label',
+      'hive-mind.tool=codex',
+      '--label=task.url=https://github.com/o/r/issues/1?q=a=b',
+      '--label',
+      'empty=',
+      '--',
+      'echo',
+    ]);
+    expect(wrapperOptions.labels).toEqual([
+      'hive-mind.tool=codex',
+      'task.url=https://github.com/o/r/issues/1?q=a=b',
+      'empty=',
+    ]);
+    const args = buildDockerRuntimeArgs(wrapperOptions);
+    for (const label of wrapperOptions.labels) {
+      expect(args).toContain(label);
+    }
+    expect(buildDockerRuntimeMetadata(wrapperOptions).labels).toEqual(
+      wrapperOptions.labels
+    );
+  });
+  it('rejects malformed, reserved and non-Docker labels', () => {
+    for (const label of [
+      'missing-value',
+      '=empty-key',
+      'start-command.uuid=spoof',
+    ]) {
+      expect(() =>
+        parseArgs(['-i', 'docker', '--label', label, '--', 'true'])
+      ).toThrow();
+    }
+    expect(() => parseArgs(['--label', 'task=one', '--', 'true'])).toThrow();
+  });
+  it('forwards labels safely through nested Docker isolation', () => {
+    const command = buildNextLevelCommand(
+      {
+        isolatedStack: ['screen', 'docker'],
+        labels: ['task=a "quote" $value'],
+      },
+      'true'
+    );
+    expect(
+      parseArgs(
+        require('../src/lib/shell-utils').splitShellWords(command).slice(1)
+      ).wrapperOptions.labels
+    ).toEqual(['task=a "quote" $value']);
+  });
+});

package/test/regression-201.js

@@ -0,0 +1,25 @@
+const { describe, it, expect } = require('bun:test');
+const { spawnSync } = require('child_process');
+const path = require('path');
+const { parseArgs } = require('../src/lib/args-parser');
+
+describe('wrapper help (#201)', () => {
+  for (const flag of ['--help', '-h']) {
+    it(`${flag} prints the no-argument usage and exits successfully`, () => {
+      const cli = path.join(__dirname, '../src/bin/cli.js');
+      const usage = spawnSync(process.execPath, [cli], { encoding: 'utf8' });
+      const result = spawnSync(process.execPath, [cli, flag], {
+        encoding: 'utf8',
+      });
+      expect(result.status).toBe(0);
+      expect(result.stderr).toBe('');
+      expect(result.stdout).toBe(usage.stdout);
+      expect(parseArgs([flag]).wrapperOptions.help).toBe(true);
+    });
+    it(`${flag} after the separator remains part of the command`, () => {
+      const result = parseArgs(['--', 'grep', flag]);
+      expect(result.wrapperOptions.help).toBe(false);
+      expect(result.rawCommand).toEqual(['grep', flag]);
+    });
+  }
+});

package/test/regression-202.js

@@ -0,0 +1,92 @@
+const { describe, it, expect } = require('bun:test');
+const { spawnSync } = require('child_process');
+const {
+  isInteractiveShellCommand,
+  isShellInvocationWithArgs,
+  buildShellWithArgsCmdArgs,
+  buildDisplayCommand,
+} = require('../src/lib/shell-utils');
+
+describe('shell command semantics (#202)', () => {
+  for (const operator of [';', '&&', '||', '|', '&', '>', '<', '\n']) {
+    it(`keeps the whole command line when it contains ${JSON.stringify(operator)}`, () => {
+      const command = `sh -c 'exit 7'${operator} echo after $?`;
+      expect(isShellInvocationWithArgs(command)).toBe(false);
+      expect(buildDisplayCommand(command)).toBe(command);
+      expect(isInteractiveShellCommand(`sh ${operator} echo after`)).toBe(
+        false
+      );
+    });
+  }
+  it('preserves the script, empty positional argv, quotes, and quoted operators', () => {
+    const command = `sh -c 'printf "%s\\n" "$0" "$1" "$2"; echo "|"' a 'b c' ''`;
+    expect(isShellInvocationWithArgs(command)).toBe(true);
+    expect(buildShellWithArgsCmdArgs(command)).toEqual([
+      'sh',
+      '-c',
+      'printf "%s\\n" "$0" "$1" "$2"; echo "|"',
+      'a',
+      'b c',
+      '',
+    ]);
+  });
+  it('does not classify a missing script or a script-file argument as -c', () => {
+    expect(isShellInvocationWithArgs('sh -c')).toBe(false);
+    expect(isShellInvocationWithArgs("sh file -c 'echo hi'")).toBe(false);
+  });
+  it('retains direct bash -i -c behavior from #91', () => {
+    expect(buildShellWithArgsCmdArgs('bash -i -c "nvm --version"')).toEqual([
+      'bash',
+      '-i',
+      '-c',
+      'nvm --version',
+    ]);
+  });
+  it('leaves outer expansions, comments and globbing to the shell', () => {
+    for (const command of [
+      'sh -c "echo $$"',
+      'sh -c echo $HOME',
+      'sh -c echo *',
+      'sh -c echo # comment',
+      'sh -c echo {a,b}',
+      "sh -c 'echo hi'\u00a0arg",
+      'sh -c echo \\\nhi',
+    ]) {
+      expect(isShellInvocationWithArgs(command)).toBe(false);
+    }
+  });
+  it('preserves literal escapes within a directly executed script', () => {
+    expect(buildShellWithArgsCmdArgs('sh -c "printf \\q"')).toEqual([
+      'sh',
+      '-c',
+      'printf \\q',
+    ]);
+    expect(buildShellWithArgsCmdArgs('sh -c "echo \\$0" a')).toEqual([
+      'sh',
+      '-c',
+      'echo $0',
+      'a',
+    ]);
+    expect(buildShellWithArgsCmdArgs('sh -c echo a\\;b')).toEqual([
+      'sh',
+      '-c',
+      'echo',
+      'a;b',
+    ]);
+  });
+  const run = process.platform === 'win32' ? it.skip : it;
+  for (const [command, output, status] of [
+    ["sh -c 'exit 7'; echo after $?", 'after 7', 0],
+    ["sh -c 'echo $0 $1' a b", 'a b', 0],
+    ["sh -c 'kill -9 $$'; exit $?", '', 137],
+  ]) {
+    run(`executes ${command} with the expected output and exit`, () => {
+      const args = isShellInvocationWithArgs(command)
+        ? buildShellWithArgsCmdArgs(command)
+        : ['sh', '-c', command];
+      const result = spawnSync(args[0], args.slice(1), { encoding: 'utf8' });
+      expect(result.stdout.trim()).toBe(output);
+      expect(result.status).toBe(status);
+    });
+  }
+});

package/test/regression-91.js

@@ -69,7 +69,7 @@ function buildAttachedCmdArgs(command, shellToUse = '/bin/bash') {
 describe('isShellInvocationWithArgs (issue #91)', () => {
   it('should return true for "bash -i -c nvm --version"', () => {
     assert.strictEqual(
-      isShellInvocationWithArgs('bash -i -c nvm --version'),
+      isShellInvocationWithArgs('bash -i -c "nvm --version"'),
       true
     );
   });
@@ -79,11 +79,14 @@ describe('isShellInvocationWithArgs (issue #91)', () => {
   });
 
   it('should return true for "bash -c echo hello"', () => {
-    assert.strictEqual(isShellInvocationWithArgs('bash -c echo hello'), true);
+    assert.strictEqual(isShellInvocationWithArgs('bash -c "echo hello"'), true);
   });
 
   it('should return true for "zsh -c nvm --version"', () => {
-    assert.strictEqual(isShellInvocationWithArgs('zsh -c nvm --version'), true);
+    assert.strictEqual(
+      isShellInvocationWithArgs('zsh -c "nvm --version"'),
+      true
+    );
   });
 
   it('should return true for "sh -c ls"', () => {
@@ -115,12 +118,12 @@ describe('isShellInvocationWithArgs (issue #91)', () => {
 
 describe('buildShellWithArgsCmdArgs (issue #91)', () => {
   it('should reconstruct "bash -i -c nvm --version" correctly', () => {
-    const result = buildShellWithArgsCmdArgs('bash -i -c nvm --version');
+    const result = buildShellWithArgsCmdArgs('bash -i -c "nvm --version"');
     assert.deepStrictEqual(result, ['bash', '-i', '-c', 'nvm --version']);
   });
 
   it('should reconstruct "bash -c echo hello" correctly', () => {
-    const result = buildShellWithArgsCmdArgs('bash -c echo hello');
+    const result = buildShellWithArgsCmdArgs('bash -c "echo hello"');
     assert.deepStrictEqual(result, ['bash', '-c', 'echo hello']);
   });
 
@@ -130,13 +133,13 @@ describe('buildShellWithArgsCmdArgs (issue #91)', () => {
   });
 
   it('should handle zsh with -c', () => {
-    const result = buildShellWithArgsCmdArgs('zsh -c nvm --version');
+    const result = buildShellWithArgsCmdArgs('zsh -c "nvm --version"');
     assert.deepStrictEqual(result, ['zsh', '-c', 'nvm --version']);
   });
 
   it('should handle /bin/bash -i -c with multi-word script', () => {
     const result = buildShellWithArgsCmdArgs(
-      '/bin/bash -i -c node -e process.version'
+      '/bin/bash -i -c "node -e process.version"'
     );
     assert.deepStrictEqual(result, [
       '/bin/bash',
@@ -147,7 +150,7 @@ describe('buildShellWithArgsCmdArgs (issue #91)', () => {
   });
 
   it('should not include -c argument inside script argument (no double -c)', () => {
-    const result = buildShellWithArgsCmdArgs('bash -i -c nvm --version');
+    const result = buildShellWithArgsCmdArgs('bash -i -c "nvm --version"');
     // The script arg must be 'nvm --version', not '-c nvm --version'
     assert.strictEqual(result[result.length - 1], 'nvm --version');
     assert.strictEqual(result.indexOf('-c'), 2);
@@ -159,13 +162,13 @@ describe('Regression: No Double-Wrapping for Shell With -c (issue #91)', () => {
   // Each test verifies that `bash -i -c "cmd"` style commands are NOT re-wrapped
   // in another outer shell -c invocation.
   //
-  // Before fix: buildAttachedCmdArgs('bash -i -c nvm --version')
-  //   → ['/bin/bash', '-i', '-c', 'bash -i -c nvm --version']   (WRONG: double-wrap)
-  // After fix:  buildAttachedCmdArgs('bash -i -c nvm --version')
+  // Before fix: buildAttachedCmdArgs('bash -i -c "nvm --version"')
+  //   → ['/bin/bash', '-i', '-c', 'bash -i -c "nvm --version"']   (WRONG: double-wrap)
+  // After fix:  buildAttachedCmdArgs('bash -i -c "nvm --version"')
   //   → ['bash', '-i', '-c', 'nvm --version']                   (CORRECT: direct pass)
 
   it('should pass "bash -i -c nvm --version" directly without outer shell wrapper', () => {
-    const args = buildAttachedCmdArgs('bash -i -c nvm --version');
+    const args = buildAttachedCmdArgs('bash -i -c "nvm --version"');
     // Must start with 'bash', not with '/bin/bash' (the outer shellToUse)
     assert.strictEqual(args[0], 'bash');
     // Must not wrap in outer bash -i -c
@@ -182,7 +185,7 @@ describe('Regression: No Double-Wrapping for Shell With -c (issue #91)', () => {
   });
 
   it('should pass "zsh -c nvm --version" directly without outer shell wrapper', () => {
-    const args = buildAttachedCmdArgs('zsh -c nvm --version', '/bin/zsh');
+    const args = buildAttachedCmdArgs('zsh -c "nvm --version"', '/bin/zsh');
     assert.deepStrictEqual(args, ['zsh', '-c', 'nvm --version']);
     assert.ok(
       args.filter((a) => a === '-c').length === 1,
@@ -191,12 +194,12 @@ describe('Regression: No Double-Wrapping for Shell With -c (issue #91)', () => {
   });
 
   it('should pass "bash -c echo hello" directly', () => {
-    const args = buildAttachedCmdArgs('bash -c echo hello');
+    const args = buildAttachedCmdArgs('bash -c "echo hello"');
     assert.deepStrictEqual(args, ['bash', '-c', 'echo hello']);
   });
 
   it('should not introduce a second bash layer (no shell-inside-shell)', () => {
-    const args = buildAttachedCmdArgs('bash -i -c nvm --version');
+    const args = buildAttachedCmdArgs('bash -i -c "nvm --version"');
     // The first element of the docker image command args must NOT be the outer shell
     // i.e., must not be ['/bin/bash', '-i', '-c', 'bash ...']
     assert.notStrictEqual(
@@ -206,7 +209,7 @@ describe('Regression: No Double-Wrapping for Shell With -c (issue #91)', () => {
     );
     // Must not contain the original full command string as an argument
     assert.ok(
-      !args.includes('bash -i -c nvm --version'),
+      !args.includes('bash -i -c "nvm --version"'),
       'Must not contain the full command string as a single argument (double-wrap)'
     );
   });
@@ -241,7 +244,7 @@ describe('isShellInvocationWithArgs is mutually exclusive with isInteractiveShel
     'bash',
     'bash -i',
     'bash --norc',
-    'bash -i -c nvm --version',
+    'bash -i -c "nvm --version"',
     'bash -c echo hi',
     'zsh -c ls',
     'nvm --version',
@@ -263,14 +266,14 @@ describe('isShellInvocationWithArgs is mutually exclusive with isInteractiveShel
 describe('buildDisplayCommand (issue #91 display fix)', () => {
   it('should quote the -c script argument when it contains spaces', () => {
     assert.strictEqual(
-      buildDisplayCommand('bash -i -c nvm --version'),
+      buildDisplayCommand('bash -i -c "nvm --version"'),
       'bash -i -c "nvm --version"'
     );
   });
 
   it('should quote the -c script argument for plain "bash -c echo hello"', () => {
     assert.strictEqual(
-      buildDisplayCommand('bash -c echo hello'),
+      buildDisplayCommand('bash -c "echo hello"'),
       'bash -c "echo hello"'
     );
   });
@@ -289,7 +292,7 @@ describe('buildDisplayCommand (issue #91 display fix)', () => {
 
   it('should handle zsh -c with spaces', () => {
     assert.strictEqual(
-      buildDisplayCommand('zsh -c echo hello world'),
+      buildDisplayCommand('zsh -c "echo hello world"'),
       'zsh -c "echo hello world"'
     );
   });

package/test/shared-golden.js

@@ -0,0 +1,54 @@
+const { describe, it } = require('node:test');
+const assert = require('node:assert/strict');
+const { readFileSync } = require('node:fs');
+const { resolve } = require('node:path');
+const { parseArgs } = require('../src/lib/args-parser');
+const { buildDockerRuntimeArgs } = require('../src/lib/docker-runtime-args');
+const { ExecutionRecord } = require('../src/lib/execution-store');
+const { formatRecord } = require('../src/lib/status-formatter');
+const fixtures = JSON.parse(
+  readFileSync(resolve(__dirname, '../../parity/fixtures/contracts.json'))
+);
+
+describe('shared JavaScript and Rust golden contracts', () => {
+  for (const fixture of fixtures['cli-parsing']) {
+    it(`CLI parsing: ${fixture.name}`, () => {
+      if (fixture.error) {
+        assert.throws(() => parseArgs(fixture.argv), new RegExp(fixture.error));
+        return;
+      }
+      const parsed = parseArgs(fixture.argv);
+      assert.equal(parsed.command, fixture.command);
+      assert.deepEqual(parsed.rawCommand, fixture.rawCommand);
+      for (const [key, value] of Object.entries(fixture.options)) {
+        assert.deepEqual(parsed.wrapperOptions[key], value, key);
+      }
+    });
+  }
+  for (const fixture of fixtures['isolation-arguments']) {
+    it(`isolation argv: ${fixture.name}`, () => {
+      assert.deepEqual(buildDockerRuntimeArgs(fixture.options), fixture.argv);
+    });
+  }
+  it('uses the same JSON and text status output', () => {
+    const fixture = fixtures['status-output'];
+    const record = new ExecutionRecord(fixture.record);
+    assert.deepEqual(JSON.parse(formatRecord(record, 'json')), fixture.json);
+    assert.equal(formatRecord(record, 'text'), fixture.text);
+  });
+  for (const fixture of fixtures['execution-record-format']) {
+    it(`preserves the complete execution record format (exit ${fixture.exitCode})`, () => {
+      assert.deepEqual(ExecutionRecord.fromObject(fixture).toObject(), fixture);
+    });
+  }
+  it('executes the JavaScript source of the generated Rust parity policy', async () => {
+    const { minimumRustTestCount } =
+      await import('../../scripts/parity-threshold.mjs');
+    for (const fixture of fixtures['parity-threshold']) {
+      assert.equal(
+        minimumRustTestCount(fixture.javascript),
+        fixture.minimumRust
+      );
+    }
+  });
+});