Harden CLI entrypoint guard tests

Author: AbrahamGreenman

scripts/cli-entrypoints.test.ts

@@ -1,26 +1,59 @@
 import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
 import test from "node:test";
+import { promisify } from "node:util";
 
+const execFileAsync = promisify(execFile);
 const repoRoot = process.cwd();
-const embeddableCliEntrypoints = [
-  "apps/gateway/src/index.ts",
-  "packages/core/scripts/release/check-source.mjs",
-  "packages/deploy/src/cli.ts",
-  "packages/sdk/scripts/release/check-source.mjs",
-  "scripts/benchmark.ts",
-  "scripts/deploy-storage-preflight.ts",
-  "scripts/docs-link-check.ts",
-  "scripts/package-runtime-coverage.ts",
-  "scripts/test.mjs",
-];
-
-test("embeddable CLI entrypoints avoid abrupt process exits", async () => {
-  for (const relativePath of embeddableCliEntrypoints) {
-    const contents = await readFile(path.join(repoRoot, relativePath), "utf8");
+const sourceRoots = ["apps", "packages", "scripts"] as const;
+const sourceExtensions = new Set([".mjs", ".ts"]);
+const cliEntrypointGuardPattern =
+  /import\.meta\.url\s*===\s*pathToFileURL\(process\.argv\[1\]\)\.href/;
+
+async function collectCheckedInSourceFiles(): Promise<string[]> {
+  const { stdout } = await execFileAsync("git", ["ls-files", "--", ...sourceRoots], {
+    cwd: repoRoot,
+    maxBuffer: 1024 * 1024,
+  });
+
+  return stdout
+    .split(/\r?\n/)
+    .filter(
+      (relativePath) =>
+        sourceExtensions.has(path.extname(relativePath)) && !relativePath.endsWith(".test.ts"),
+    )
+    .sort((left, right) => left.localeCompare(right));
+}
+
+async function readRelativeSource(relativePath: string): Promise<string> {
+  return await readFile(path.join(repoRoot, relativePath), "utf8");
+}
+
+test("checked-in non-test source files avoid abrupt process exits", async () => {
+  const sourceFiles = await collectCheckedInSourceFiles();
+
+  assert.ok(sourceFiles.length > 0);
+  for (const relativePath of sourceFiles) {
+    const contents = await readRelativeSource(relativePath);
 
     assert.doesNotMatch(contents, /\bprocess\.exit\s*\(/, relativePath);
+  }
+});
+
+test("embeddable CLI entrypoints set process.exitCode", async () => {
+  const entrypoints = [];
+
+  for (const relativePath of await collectCheckedInSourceFiles()) {
+    const contents = await readRelativeSource(relativePath);
+    if (cliEntrypointGuardPattern.test(contents)) {
+      entrypoints.push({ contents, relativePath });
+    }
+  }
+
+  assert.ok(entrypoints.length >= 20);
+  for (const { contents, relativePath } of entrypoints) {
     assert.match(contents, /\bprocess\.exitCode\s*=/, relativePath);
   }
 });

scripts/gateway-smoke.test.ts

@@ -13,11 +13,13 @@ import {
 
 const repoRoot = process.cwd();
 
-function createIoCapture(): {
+interface IoCapture {
   io: Pick<NodeJS.Process, "stdout" | "stderr">;
   stdout: () => string;
   stderr: () => string;
-} {
+}
+
+function createIoCapture(): IoCapture {
   let stdout = "";
   let stderr = "";
 
@@ -41,6 +43,15 @@ function createIoCapture(): {
   };
 }
 
+function assertCliSucceeded(exitCode: number, capture: IoCapture): void {
+  assert.equal(
+    exitCode,
+    0,
+    `expected gateway smoke CLI to exit 0\nstderr:\n${capture.stderr()}\nstdout:\n${capture.stdout()}`,
+  );
+  assert.equal(capture.stderr(), "");
+}
+
 test("parseArgs accepts strict gateway smoke options", () => {
   const args = parseArgs([
     "--cwd",
@@ -383,8 +394,7 @@ test("runGatewaySmokeCli starts the tiny profile and verifies inference", async
 
   const exitCode = await runGatewaySmokeCli(["--cwd", repoRoot, "--json"], capture.io);
 
-  assert.equal(exitCode, 0);
-  assert.equal(capture.stderr(), "");
+  assertCliSucceeded(exitCode, capture);
 
   const summary = JSON.parse(capture.stdout()) as GatewaySmokeSummary;
   assert.equal(summary.ok, true);
@@ -440,8 +450,7 @@ test("runGatewaySmokeCli verifies public auth guards and rate limiting", async (
     capture.io,
   );
 
-  assert.equal(exitCode, 0);
-  assert.equal(capture.stderr(), "");
+  assertCliSucceeded(exitCode, capture);
 
   const summary = JSON.parse(capture.stdout()) as GatewaySmokeSummary;
   assert.equal(summary.ok, true);
@@ -485,8 +494,7 @@ test("runGatewaySmokeCli verifies async queue submission and completion", async
     capture.io,
   );
 
-  assert.equal(exitCode, 0);
-  assert.equal(capture.stderr(), "");
+  assertCliSucceeded(exitCode, capture);
 
   const summary = JSON.parse(capture.stdout()) as GatewaySmokeSummary;
   assert.equal(summary.ok, true);
@@ -520,8 +528,7 @@ test("runGatewaySmokeCli verifies authenticated public async queue submission",
     capture.io,
   );
 
-  assert.equal(exitCode, 0);
-  assert.equal(capture.stderr(), "");
+  assertCliSucceeded(exitCode, capture);
 
   const summary = JSON.parse(capture.stdout()) as GatewaySmokeSummary;
   assert.equal(summary.ok, true);