testguard-cli 0.18.0__tar.gz → 0.18.1__tar.gz

{testguard_cli-0.18.0 → testguard_cli-0.18.1}/CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.18.1] - 2026-10-01
+
+Automated weekly release — everything merged since `v0.18.0`.
+
+### Changed
+
+- test: consolidate native runtime acceptance checks
+- perf: isolate native admission mutation defenders
+- perf: size bounded report buffers to observed files
+- chore(homebrew): sha256 for v0.18.0 (#194)
+
+
+### Changed
+
+- Runner report and discovery-config reads reserve memory for the observed
+  file size instead of the maximum allowed size, retaining the hard byte
+  ceiling and checking file growth before parsing.
+- Native-runner admission self-probes use focused defenders, preserving the
+  fault recipes and full runner acceptance coverage while avoiding unrelated
+  timeout and process-cleanup checks for each admission confirmation.
+
 ## [0.18.0] - 2026-10-01
 
 Automated weekly release — everything merged since `v0.17.0`.

{testguard_cli-0.18.0 → testguard_cli-0.18.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: testguard-cli
-Version: 0.18.0
+Version: 0.18.1
 Summary: Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest. Ships the Node.js CLI (requires Node.js 20+).
 Project-URL: Homepage, https://github.com/raccioly/testguard
 Project-URL: Documentation, https://github.com/raccioly/testguard#readme
@@ -151,9 +151,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.18.0` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.18.1` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.18.0/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.18.1/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -809,12 +809,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.18.0
+- uses: raccioly/testguard@v0.18.1
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.18.0/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.18.1/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 

{testguard_cli-0.18.0 → testguard_cli-0.18.1}/README.md

@@ -127,9 +127,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.18.0` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.18.1` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.18.0/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.18.1/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -785,12 +785,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.18.0
+- uses: raccioly/testguard@v0.18.1
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.18.0/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.18.1/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 

{testguard_cli-0.18.0 → testguard_cli-0.18.1}/action.yml

@@ -50,7 +50,7 @@ inputs:
   version:
     description: 'testguard-cli version to run'
     required: false
-    default: '0.18.0'
+    default: '0.18.1'
   node-version:
     description: 'Node.js version (20+)'
     required: false

{testguard_cli-0.18.0 → testguard_cli-0.18.1}/docs/testguard-explained.html

@@ -144,7 +144,7 @@
 <div class="page">
   <div class="masthead">
     <div class="wordmark">Test<span class="mark">Guard</span></div>
-    <div class="meta">Technical Brief · v0.18.0 · MIT</div>
+    <div class="meta">Technical Brief · v0.18.1 · MIT</div>
   </div>
 
   <h1>Your tests pass. That is not the same as your tests working.</h1>

{testguard_cli-0.18.0 → testguard_cli-0.18.1}/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "testguard-cli",
-  "version": "0.18.0",
+  "version": "0.18.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "testguard-cli",
-      "version": "0.18.0",
+      "version": "0.18.1",
       "license": "MIT",
       "dependencies": {
         "ajv": "8.20.0"

{testguard_cli-0.18.0 → testguard_cli-0.18.1}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "testguard-cli",
-  "version": "0.18.0",
+  "version": "0.18.1",
   "description": "Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest.",
   "type": "module",
   "license": "MIT",

{testguard_cli-0.18.0 → testguard_cli-0.18.1}/packaging/gitlab/testguard.gitlab-ci.yml

@@ -3,7 +3,7 @@
 # Include it from a project's .gitlab-ci.yml, pinned to a release:
 #
 #   include:
-#     - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.18.0/packaging/gitlab/testguard.gitlab-ci.yml'
+#     - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.18.1/packaging/gitlab/testguard.gitlab-ci.yml'
 #       inputs:
 #         dir: backend            # where testguard.claims.json lives (default ".")
 #         post_note: true         # post the brief as a merge-request note (needs TESTGUARD_GITLAB_TOKEN, api scope)
@@ -29,7 +29,7 @@ spec:
   inputs:
     version:
       description: testguard-cli version to run
-      default: "0.18.0"
+      default: "0.18.1"
     dir:
       description: directory whose test runner is invoked (where testguard.claims.json lives)
       default: "."

{testguard_cli-0.18.0 → testguard_cli-0.18.1}/packaging/homebrew/testguard.rb

@@ -15,8 +15,8 @@
 class Testguard < Formula
   desc "Proves a test suite defends the claims a project makes"
   homepage "https://github.com/raccioly/testguard"
-  url "https://registry.npmjs.org/testguard-cli/-/testguard-cli-0.18.0.tgz"
-  sha256 "cdb5166f73433534fe079a5a9fe97e4aebf31de52634ec1c5e3ac89d0c2082c4"
+  url "https://registry.npmjs.org/testguard-cli/-/testguard-cli-0.18.1.tgz"
+  sha256 "b722d8656f634198a483ff50db7891c21cfccae3aa136faaf9436fc79df33d7d"
   license "MIT"
 
   depends_on "node"

{testguard_cli-0.18.0 → testguard_cli-0.18.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "testguard-cli"
-version = "0.18.0"
+version = "0.18.1"
 description = "Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest. Ships the Node.js CLI (requires Node.js 20+)."
 readme = "README.md"
 license = { text = "MIT" }

{testguard_cli-0.18.0 → testguard_cli-0.18.1}/src/probe/runners/discovery.mjs

@@ -130,12 +130,21 @@ const readBoundedFile = (path, maxBytes, label, { optional = false } = {}) => {
     const stat = fstatSync(descriptor);
     if (!stat.isFile()) throw new DiscoveryError(`${label} is not a regular file`);
     if (stat.size > maxBytes) throw new DiscoveryError(`${label} exceeded ${maxBytes} bytes`);
-    const bytes = Buffer.alloc(maxBytes + 1);
+    // Reserve the observed file size, not the allowance for the largest report.
+    // The extra byte detects growth; a full buffer grows within the same hard
+    // ceiling so a concurrently appended suffix can never be silently dropped.
+    let bytes = Buffer.alloc(stat.size + 1);
     let length = 0;
     while (length < bytes.length) {
       const read = readSync(descriptor, bytes, length, bytes.length - length, null);
       if (read === 0) break;
       length += read;
+      if (length > maxBytes) throw new DiscoveryError(`${label} exceeded ${maxBytes} bytes`);
+      if (length === bytes.length) {
+        const grown = Buffer.alloc(Math.min(maxBytes + 1, Math.max(4096, bytes.length * 2)));
+        bytes.copy(grown, 0, 0, length);
+        bytes = grown;
+      }
     }
     if (length > maxBytes) throw new DiscoveryError(`${label} exceeded ${maxBytes} bytes`);
     return bytes.subarray(0, length);

testguard_cli-0.18.1/test/probe.node.test.mjs

@@ -0,0 +1,200 @@
+// @req FR-10
+// @req FR-16
+import { describe, it, expect, beforeAll, afterAll, afterEach } from 'vitest';
+import { cpSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync, existsSync, symlinkSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { execFileSync, spawn } from 'node:child_process';
+import { probe } from '../src/probe/probe.mjs';
+import { loadClaims } from '../src/claims/load.mjs';
+import { validate } from '../spec/lib/validate.mjs';
+import { run, discoverTests } from '../src/probe/runners/node-test.mjs';
+import { selectRunner } from '../src/probe/runners/index.mjs';
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const FIXTURE = join(ROOT, 'fixtures/known-answer-node');
+const expected = JSON.parse(readFileSync(join(FIXTURE, 'expected.json'), 'utf8'));
+describe('native Node known-answer proof', () => {
+  let dir, claims, evidence;
+  beforeAll(async () => {
+    dir = mkdtempSync(join(tmpdir(), 'tg-node-fixture-'));
+    cpSync(FIXTURE, dir, { recursive: true });
+    for (const args of [['init','-q'],['add','.'],['-c','user.name=fixture','-c','user.email=fixture@example.invalid','commit','-qm','fixture']]) execFileSync('git',args,{cwd:dir,timeout:5000});
+    claims = loadClaims(join(dir,'testguard.claims.json'));
+    evidence = await probe({ projectDir:dir, claims, runnerName:'node-test', confirmRuns:3, budgetMs:5000, mode:'worktree', toolVersion:'test' });
+  }, 30_000);
+  afterAll(() => { if(dir)rmSync(dir,{recursive:true,force:true}); });
+  it('reproduces every independently verified verdict and reason', () => {
+    const actual = Object.fromEntries(evidence.records.map((r) => [`${r.claim.id}/${r.subject.id}`, { verdict:r.verdict, reason:r.detail.reason }]));
+    for (const [id, oracle] of Object.entries(expected.expected)) {
+      expect(actual[id]?.verdict,id).toBe(oracle.verdict);
+      if(oracle.reason)expect(actual[id]?.reason,id).toBe(oracle.reason);
+    }
+    expect(Object.keys(actual)).toHaveLength(Object.keys(expected.expected).length);
+  });
+  it('emits conforming builtin-runtime evidence with N/N green baselines and assertion-only kills', () => {
+    expect(validate('evidence',evidence).errors).toEqual([]);
+    expect(evidence.run.runner).toEqual({name:'node-test',version:process.versions.node,source:'builtin'});
+    for (const r of evidence.records.filter((r)=>r.verdict==='killed'||r.verdict==='survived')) {
+      expect(r.detail.baselineRuns).toHaveLength(3);expect(r.detail.probeRuns).toHaveLength(3);
+      expect(r.detail.baselineRuns.every((b)=>b.outcome==='pass')).toBe(true);
+      if(r.verdict==='killed')expect(r.detail.probeRuns.every((p)=>p.outcome==='fail'&&p.assertionFailures>0)).toBe(true);
+    }
+  });
+  it('restores every target and removes its scratch worktree after failures/timeouts', () => {
+    expect(execFileSync('git',['status','--porcelain'],{cwd:dir,encoding:'utf8'})).toBe('');
+    expect(execFileSync('git',['worktree','list','--porcelain'],{cwd:dir,encoding:'utf8'}).match(/^worktree /gm)).toHaveLength(1);
+    expect(readFileSync(join(dir,'src/policy.mjs'),'utf8')).toBe(readFileSync(join(FIXTURE,'src/policy.mjs'),'utf8'));
+  });
+  it('reuses matching Node evidence and remeasures across framework identity or worker policy', async () => {
+    const subset = {...claims,claims:claims.claims.filter((c)=>c.id==='NODE-ALLOW')};
+    const options = {projectDir:dir,claims:subset,runnerName:'node-test',confirmRuns:3,budgetMs:5000,toolVersion:'test',previous:evidence};
+    const reused = await probe(options);
+    expect(reused.records[0].reusedFrom).toBe(evidence.run.id);
+    const changed = await probe({...options,workers:2,serial:false});
+    expect(changed.records[0].reusedFrom).toBeUndefined();
+    expect(changed.records[0].verdict).toBe('killed');
+    const foreign = structuredClone(evidence);foreign.run.runner={name:'vitest',version:'5.0.2'};
+    foreign.records.forEach((r)=>{r.inputs.testUniverseHash='0'.repeat(64);});
+    const remeasured = await probe({...options,previous:foreign});
+    expect(remeasured.records[0].reusedFrom).toBeUndefined();
+    expect(remeasured.records[0].verdict).toBe('killed');
+  }, 15_000);
+  it('cancels the real CLI during a live fault, restoring targets without publishing partial evidence', async () => {
+    const scratch = mkdtempSync(join(tmpdir(), 'tg-node-cancel-'));
+    const sentinel = spawn(process.execPath, ['-e', 'setInterval(()=>{},1000)'], { stdio: 'ignore' });
+    let child;
+    try {
+      cpSync(FIXTURE, scratch, { recursive: true });
+      const source = readFileSync(join(scratch, 'src/policy.mjs'), 'utf8');
+      writeFileSync(join(scratch, 'test/policy.test.mjs'), `import { test } from 'node:test'; import { writeFileSync } from 'node:fs'; import { ready } from '../src/policy.mjs';
+test('live fault',async()=>{if(!await ready()){writeFileSync('live.json',JSON.stringify({pid:process.pid}));while(true){}}});`);
+      const subset = { ...claims, claims: claims.claims.filter((c) => c.id === 'NODE-READY') };
+      subset.claims[0].faults[0].replace = 'export async function ready() {\n  return false;';
+      writeFileSync(join(scratch, 'testguard.claims.json'), JSON.stringify(subset));
+      for (const args of [['init','-q'],['add','.'],['-c','user.name=fixture','-c','user.email=fixture@example.invalid','commit','-qm','fixture']]) execFileSync('git',args,{cwd:scratch,timeout:5000});
+      child = spawn(process.execPath, [join(ROOT, 'cli/testguard.mjs'), 'probe', scratch, '--runner', 'node-test', '--in-place', '--budget', '30000', '--quiet'], { stdio: ['ignore', 'pipe', 'pipe'] });
+      let diagnostic = ''; for (const stream of [child.stdout, child.stderr]) stream.on('data', (bytes) => { diagnostic = (diagnostic + bytes).slice(-4000); });
+      const closed = new Promise((resolve) => child.once('close', (code, signal) => resolve({ code, signal })));
+      const deadline = Date.now() + 10_000;
+      while (!existsSync(join(scratch, 'live.json')) && child.exitCode === null && Date.now() < deadline) await new Promise((resolve) => setTimeout(resolve, 20));
+      expect(existsSync(join(scratch, 'live.json')), diagnostic).toBe(true);
+      const worker = JSON.parse(readFileSync(join(scratch, 'live.json'), 'utf8')).pid;
+      child.kill('SIGINT');
+      expect(await closed).toEqual({ code: 130, signal: null });
+      expect(readFileSync(join(scratch, 'src/policy.mjs'), 'utf8')).toBe(source);
+      expect(existsSync(join(scratch, '.testguard/evidence.json'))).toBe(false);
+      expect(() => process.kill(worker, 0)).toThrow();
+      expect(() => process.kill(sentinel.pid, 0)).not.toThrow();
+    } finally {
+      child?.kill('SIGKILL'); sentinel.kill('SIGKILL');
+      rmSync(scratch, { recursive: true, force: true });
+    }
+  }, 15_000);
+});
+
+// Runtime acceptance remains independent of the focused self-probe defenders.
+describe('native Node collection and runtime acceptance', () => {
+  const owned = [];
+  const project = (files) => {
+    const dir = mkdtempSync(join(tmpdir(), 'tg-node-test-')); owned.push(dir);
+    writeFileSync(join(dir, 'package.json'), '{"type":"module"}');
+    for (const [file, source] of Object.entries(files)) {
+      mkdirSync(dirname(join(dir, file)), { recursive: true }); writeFileSync(join(dir, file), source);
+    }
+    return dir;
+  };
+  const body = (code) => `import { test } from 'node:test'; import assert from 'node:assert/strict';\n${code}\n`;
+  afterEach(() => { for (const dir of owned.splice(0)) rmSync(dir, { recursive: true, force: true }); });
+  const execute = (dir, files = ['test/a.test.mjs'], extra = {}) => run({ projectDir: dir, files, budgetMs: 4000, ...extra });
+  const discover = (dir, extra = {}) => discoverTests({ projectDir: dir, version: process.versions.node, ...extra });
+  const alive = (pid) => {
+    try { process.kill(pid,0);return process.platform==='win32'||!execFileSync('ps',['-p',String(pid),'-o','stat='],{encoding:'utf8',timeout:1000}).trim().startsWith('Z'); } catch {return false;}
+  };
+  
+  it('refuses an explicitly selected empty universe', async () => {
+    const selected = await selectRunner({ projectDir: project({}), name: 'node-test' });
+    expect(selected.error).toMatch(/no test files/);
+  });
+  it('does not turn a top-level assertion or syntax/import error into a test-body kill', async () => {
+    for (const source of ["import assert from 'node:assert/strict'; assert.equal(1,2);", '(', "import './missing.mjs';"]) {
+      const dir = project({ 'test/a.test.mjs': source });
+      const result = await execute(dir);
+      expect(result.run.outcome).toBe('error'); expect(result.run.assertionFailures).toBe(0);
+      await expect(discover(dir)).rejects.toThrow();
+    }
+  });
+  it('detects a genuine test-body exception and preserves its test identity', async () => {
+    const dir = project({ 'test/a.test.mjs': body("test('exception', () => { throw new Error('bad behavior'); });") });
+    const result = await execute(dir);
+    expect(result.run.outcome).toBe('fail'); expect(result.run.assertionFailures).toBe(1);
+    expect(result.failedTests).toEqual(['test/a.test.mjs::exception']);
+  });
+  it('does not double count a failing suite or accept skipped-only defenders', async () => {
+    const dir = project({ 'test/a.test.mjs': "import {describe,it} from 'node:test'; import assert from 'node:assert/strict'; describe('suite',()=>{it('failure',()=>assert.equal(1,2));it.skip('skip',()=>{});});" });
+    const result = await execute(dir);
+    expect(result.run.tests).toEqual({ total: 1, passed: 0, failed: 1 }); expect(result.run.assertionFailures).toBe(1);
+    writeFileSync(join(dir,'test/a.test.mjs'),body("test.skip('skip',()=>{});test.todo('todo');"));
+    expect((await execute(dir)).run.outcome).toBe('error');
+  });
+  it('recognizes native test timeouts and hard command timeouts', async () => {
+    const dir = project({ 'test/a.test.mjs': body("test('hangs',{timeout:40},async(t)=>{const h=setInterval(()=>{},1000);t.signal.addEventListener('abort',()=>clearInterval(h),{once:true});try{await new Promise(()=>{});}finally{clearInterval(h);}});") });
+    const result = await execute(dir);
+    expect(result.timeouts).toBeGreaterThan(0); expect(result.run.assertionFailures).toBe(0);
+    expect(result.run.outcome).toBe('fail');
+    writeFileSync(join(dir,'test/a.test.mjs'),body("test('loop',()=>{while(true){}});"));
+    const hard = await execute(dir,undefined,{budgetMs:400});
+    expect(hard.run.outcome).toBe('timeout'); expect(hard.run.assertionFailures).toBe(0);
+  });
+  it('refuses a hook failure, incomplete process exit and a file with no tests', async () => {
+    for (const source of ["import {before,test} from 'node:test';before(()=>{throw new Error('setup');});test('case',()=>{});", body("test('first',()=>{});test('unfinished',()=>process.exit(0));"), 'export const value=1;']) {
+      const result = await execute(project({ 'test/a.test.mjs': source }));
+      expect(result.run.outcome).toBe('error'); expect(result.run.assertionFailures).toBe(0);
+    }
+  });
+
+  it('binds configuration edits to the native universe and rejects symlink escapes', async () => {
+    const dir = project({ 'test/a.test.mjs': body("test('case',()=>{});") });
+    const before = await discover(dir); writeFileSync(join(dir,'package.json'),'{"type":"module","description":"changed"}');
+    expect((await discover(dir)).testUniverseHash).not.toBe(before.testUniverseHash);
+    const external=project({'external.mjs':body("test('outside',()=>{});")});
+    symlinkSync(join(external,'external.mjs'),join(dir,'test','escape.mjs'));
+    await expect(discover(dir)).rejects.toThrow(/outside/);
+  });
+  it('executes selected entries through a symlinked project root with canonical attribution', async () => {
+    const dir = project({ 'test/a.test.mjs': body("test('through alias',()=>assert.equal(1,1));") });
+    const aliases = project({}); const alias = join(aliases, 'linked'); symlinkSync(dir, alias, 'dir');
+    expect((await discover(alias)).files).toEqual(['test/a.test.mjs']);
+    expect((await execute(alias)).run).toMatchObject({ outcome: 'pass', tests: { total: 1, passed: 1, failed: 0 } });
+  });
+  it('bounds native collection output and command time', async () => {
+    const dir = project({ 'test/a.test.mjs': body("test('case',()=>{});") });
+    await expect(discover(dir,{maxOutputBytes:1})).rejects.toThrow(/exceeded/);
+    writeFileSync(join(dir,'test/a.test.mjs'),'while(true){}');
+    await expect(discover(dir,{timeoutMs:300})).rejects.toThrow(/timeout/);
+  });
+  it('retains process isolation and serial worker policy', async () => {
+    const dir = project({ 'test/a.test.mjs': body("test('isolated',()=>{globalThis.nativeSentinel=1;assert.equal(1,1);});"),
+      'test/b.test.mjs':body("test('separate',()=>assert.equal(globalThis.nativeSentinel,undefined));") });
+    expect((await execute(dir,['test/a.test.mjs','test/b.test.mjs'],{workers:2})).run.tests.passed).toBe(2);
+    expect((await execute(dir,['test/a.test.mjs','test/b.test.mjs'],{workers:4,serial:true})).run.tests.passed).toBe(2);
+    expect(existsSync(join(dir,'node_modules'))).toBe(false);
+  });
+
+  it('cleans its worker descendants on timeout and abnormal exit while preserving an unrelated sentinel', async () => {
+    const sentinel=spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{stdio:'ignore'});
+    const source = body("import {spawn} from 'node:child_process';import {writeFileSync} from 'node:fs';test('child',()=>{const c=spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{stdio:'ignore'});writeFileSync('owned.json',JSON.stringify([process.pid,c.pid]));while(true){}});");
+    const dir=project({'test/a.test.mjs':source});
+    try {
+      expect((await execute(dir,undefined,{budgetMs:800})).run.outcome).toBe('timeout');
+      const pids=JSON.parse(readFileSync(join(dir,'owned.json'),'utf8'));
+      for(const pid of pids)expect(alive(pid)).toBe(false);
+      expect(alive(sentinel.pid)).toBe(true);
+      writeFileSync(join(dir,'test/a.test.mjs'),source.replace('while(true){}','process.exit(0);'));
+      expect((await execute(dir)).run.outcome).toBe('error');
+      for(const pid of JSON.parse(readFileSync(join(dir,'owned.json'),'utf8')))expect(alive(pid)).toBe(false);
+      expect(alive(sentinel.pid)).toBe(true);
+    } finally {sentinel.kill('SIGKILL');}
+  }, 10_000);
+});

testguard_cli-0.18.1/test/runner-node-admission.test.mjs

@@ -0,0 +1,35 @@
+// @req FR-10
+// Focused admission defenders; runner-node.test.mjs retains runtime acceptance.
+import { afterEach, describe, expect, it } from 'vitest';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { check, run } from '../src/probe/runners/node-test.mjs';
+import { selectRunner } from '../src/probe/runners/index.mjs';
+
+const dirs = [];
+const project = () => {
+  const dir = mkdtempSync(join(tmpdir(), 'tg-node-admission-'));
+  dirs.push(dir);
+  mkdirSync(join(dir, 'test'));
+  writeFileSync(join(dir, 'package.json'), '{"type":"module"}');
+  writeFileSync(join(dir, 'test/a.test.mjs'), "import { test } from 'node:test'; import assert from 'node:assert/strict'; test('real', () => assert.equal(2+2,4));\n");
+  return dir;
+};
+afterEach(() => { for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true }); });
+
+describe('native Node admission', () => {
+  it('runs without node_modules and records the actual built-in runtime', async () => {
+    expect(await check()).toEqual({ ok: true, version: process.versions.node, source: 'builtin' });
+    const dir = project();
+    const selected = await selectRunner({ projectDir: dir, name: 'node-test' });
+    expect(selected.runner.name).toBe('node-test'); expect(selected.testFiles).toBe(1);
+    expect((await run({ projectDir: dir, files: ['test/a.test.mjs'], budgetMs: 4000 })).run.outcome).toBe('pass');
+  });
+  it('refuses non-default loading and never silently routes a Node project through auto', async () => {
+    const original = process.env.NODE_OPTIONS; process.env.NODE_OPTIONS = '--import=unsupported';
+    try { expect((await check()).ok).toBe(false); } finally { if(original===undefined)delete process.env.NODE_OPTIONS;else process.env.NODE_OPTIONS=original; }
+    const selected = await selectRunner({ projectDir: project(), name: 'auto', budgetMs: 2000 });
+    expect(selected.runner?.name).not.toBe('node-test');
+  });
+});

testguard_cli-0.18.1/test/runner-report-allocation.test.mjs

@@ -0,0 +1,81 @@
+// @req FR-10
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { appendFileSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { readBoundedJsonFile } from '../src/probe/runners/discovery.mjs';
+
+const race = vi.hoisted(() => ({ afterStat: undefined }));
+vi.mock('node:fs', async (importOriginal) => {
+  const fs = await importOriginal();
+  return { ...fs, fstatSync: (...args) => {
+    const stat = fs.fstatSync(...args);
+    const change = race.afterStat;
+    race.afterStat = undefined;
+    change?.();
+    return stat;
+  } };
+});
+
+const dirs = [];
+const reportFile = (text) => {
+  const dir = mkdtempSync(join(tmpdir(), 'tg-report-allocation-'));
+  dirs.push(dir);
+  const path = join(dir, 'report.json');
+  writeFileSync(path, text);
+  return path;
+};
+afterEach(() => {
+  race.afterStat = undefined;
+  vi.restoreAllMocks();
+  for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true });
+});
+
+describe('bounded report allocation', () => {
+  it('can read a tiny report under a large byte ceiling without reserving the ceiling', () => {
+    const path = reportFile('{"cases":[]}');
+    const alloc = Buffer.alloc;
+    const sizes = [];
+    vi.spyOn(Buffer, 'alloc').mockImplementation((size, ...args) => {
+      sizes.push(size);
+      if (size > 1024) throw new Error('tiny report exceeded its memory allowance');
+      return alloc(size, ...args);
+    });
+    expect(readBoundedJsonFile(path, 1024 * 1024 * 1024)).toEqual({ cases: [] });
+    expect(sizes.length).toBeGreaterThan(0);
+  });
+
+  it('reads growth after the size snapshot instead of accepting a valid truncated prefix', () => {
+    const path = reportFile('{}');
+    race.afterStat = () => appendFileSync(path, ' x');
+    expect(() => readBoundedJsonFile(path, 32)).toThrow(/not valid JSON/);
+  });
+
+  it('can grow repeatedly to complete a report within the byte ceiling', () => {
+    const text = JSON.stringify({ text: 'x'.repeat(20_000) });
+    const path = reportFile(text.slice(0, 2));
+    race.afterStat = () => appendFileSync(path, text.slice(2));
+    expect(readBoundedJsonFile(path, Buffer.byteLength(text))).toEqual({ text: 'x'.repeat(20_000) });
+  });
+
+  it('rejects growth beyond the ceiling even when its initial prefix was valid JSON', () => {
+    const path = reportFile('{}');
+    race.afterStat = () => appendFileSync(path, ' '.repeat(100));
+    expect(() => readBoundedJsonFile(path, 16)).toThrow(/exceeded 16 bytes/);
+  });
+
+  it('keeps exact-byte, empty, UTF-8 and regular-file boundaries', () => {
+    const text = '{"text":"é"}';
+    const path = reportFile(text);
+    expect(readBoundedJsonFile(path, Buffer.byteLength(text))).toEqual({ text: 'é' });
+    expect(() => readBoundedJsonFile(path, Buffer.byteLength(text) - 1)).toThrow(/exceeded/);
+    writeFileSync(path, '');
+    expect(() => readBoundedJsonFile(path)).toThrow(/not valid JSON/);
+    writeFileSync(path, Buffer.from([0xff]));
+    expect(() => readBoundedJsonFile(path)).toThrow(/UTF-8/);
+    const link = join(dirs.at(-1), 'link.json');
+    symlinkSync(path, link);
+    expect(() => readBoundedJsonFile(link)).toThrow(/not readable/);
+    expect(() => readBoundedJsonFile(dirs.at(-1))).toThrow(/not a regular file/);
+  });
+});

{testguard_cli-0.18.0 → testguard_cli-0.18.1}/testguard.claims.json

@@ -2,6 +2,37 @@
   "$schema": "./spec/schemas/claims.schema.json",
   "schemaVersion": 1,
   "claims": [
+    {
+      "id": "TG-REPORT-READ-ALLOCATION-TRACKS-FILE",
+      "statement": "Bounded runner-report reads reserve memory for observed file bytes rather than the maximum allowance, and still read a file that grows within the allowance without accepting a truncated prefix.",
+      "source": {
+        "kind": "manual",
+        "ref": "test/runner-report-allocation.test.mjs"
+      },
+      "severity": "high",
+      "producedBy": { "producer": "agent", "by": "codex" },
+      "defendedBy": ["test/runner-report-allocation.test.mjs"],
+      "faults": [
+        {
+          "id": "F1",
+          "description": "Reserve the maximum report allowance for every tiny file.",
+          "faultClass": "other",
+          "file": "src/probe/runners/discovery.mjs",
+          "find": "    let bytes = Buffer.alloc(stat.size + 1);",
+          "replace": "    let bytes = Buffer.alloc(maxBytes + 1);",
+          "producedBy": { "producer": "agent", "by": "codex" }
+        },
+        {
+          "id": "F2",
+          "description": "Stop reading when the initial size-based buffer fills.",
+          "faultClass": "guard-removed",
+          "file": "src/probe/runners/discovery.mjs",
+          "find": "      if (length === bytes.length) {",
+          "replace": "      if (false) {",
+          "producedBy": { "producer": "agent", "by": "codex" }
+        }
+      ]
+    },
     {
       "id": "TG-NODE-ENTRY-SELECTION-AND-LOADING",
       "statement": "Explicit native runs select files within the admitted canonical project root and refuse inherited alternative module loading before launching.",
@@ -15,7 +46,7 @@
         "by": "codex"
       },
       "defendedBy": [
-        "test/runner-node.test.mjs"
+        "test/runner-node-admission.test.mjs"
       ],
       "faults": [
         {