test: add Hypothesis fuzz coverage and macos-latest CI matrix (#75)

* test: add Hypothesis fuzz coverage and macos-latest CI matrix

Add tests/test_parser_fuzz.py with strategies for malformed/truncated JSONL, unknown record types, missing/extra fields, deep nesting, long lines, empty lines, and null bytes. Harden parse_session against adversarial inputs found by fuzz (non-dict JSON values, unhashable type keys, non-str metadata fields). Extend CI matrix to macos-latest for pytest, integration-tests, js-tests, and lint-and-audit. Document Ubuntu + Windows + macOS CI in CONTRIBUTING.

* fix: macOS js-tests rollup install and fuzz tmp_path cleanup

Install platform Rollup binary after npm ci; drop Linux-only optionalDep.
Use pytest tmp_path in test_parser_fuzz.py instead of leaking mkdtemp dirs.

* fix(test): guard dict() cast in structured_entry to fix mypy arg-type error

* fix(parser,test): harden token arithmetic and wire fuzz CI profile

Add _safe_int() so non-numeric usage fields coerce to 0 instead of raising
TypeError during token accumulation; apply to all token fields. Drop
max_examples/deadline from the test decorator so the conftest ci/dev profile
actually governs fuzz runtime. Inline _fuzz_jsonl_path, tighten truncation
model and unknown-type assertion, simplify ALLOWED_EXCEPTIONS, and note macOS
in the CONTRIBUTING PR checklist.

* fix(parser): coerce non-finite usage tokens and tidy review nits

Guard _safe_int against NaN/Infinity (json.loads accepts these literals;
int(nan)/int(inf) raise), broaden fuzz floats to cover them, and add an
explicit non-finite regression test. Revert entry_counts to truthiness so
empty-string types stay skipped, wrap service_tier in the message payload,
and drop the no-op [tool.hypothesis] block from pyproject.toml.

* fix(parser): clamp _safe_int to non-negative for token accounting

Negative usage token values from adversarial JSONL must not reduce session
metadata totals; apply max(0, ...) in _safe_int and add regression test.

Author: clean6378-max-it

.github/workflows/ci.yml

@@ -49,7 +49,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest]
     permissions:
       contents: read
     steps:
@@ -83,7 +83,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest]
     permissions:
       contents: read
     steps:
@@ -138,7 +138,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest]
     permissions:
       contents: read
       actions: write
@@ -174,7 +174,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest]
     permissions:
       contents: read
     steps:
@@ -188,4 +188,19 @@ jobs:
           cache: npm
 
       - run: npm ci
+      # npm optional-deps bug: platform rollup binaries are sometimes skipped after npm ci
+      # (https://github.com/npm/cli/issues/4828). Install the native package explicitly.
+      - name: Ensure Rollup native binary
+        shell: bash
+        run: |
+          ROLLUP_VERSION=$(node -p "require('./node_modules/rollup/package.json').version")
+          case "$(node -p "process.platform + '-' + process.arch")" in
+            darwin-arm64) PKG="@rollup/rollup-darwin-arm64" ;;
+            darwin-x64)   PKG="@rollup/rollup-darwin-x64" ;;
+            linux-x64)    PKG="@rollup/rollup-linux-x64-gnu" ;;
+            win32-x64)    PKG="@rollup/rollup-win32-x64-msvc" ;;
+            win32-arm64)  PKG="@rollup/rollup-win32-arm64-msvc" ;;
+            *) echo "Unsupported Node platform: $(node -p "process.platform + '-' + process.arch")"; exit 1 ;;
+          esac
+          npm install --no-save "${PKG}@${ROLLUP_VERSION}"
       - run: npm test

CONTRIBUTING.md

@@ -9,7 +9,7 @@ Thanks for considering a patch. This repo is a small Flask app plus a hash-route
 - **Python 3.12** (matches CI)
 - **Node 20+** (only if you change `static/js/` or run frontend unit tests)
 
-CI runs **`ruff check`**, **`ruff format --check`**, **`pip-audit`**, **`pytest`**, **integration tests**, and **Vitest** on **ubuntu-latest** and **windows-latest** (Python 3.12, Node 20). Type-check (`mypy`) and production install smoke run on Ubuntu only.
+CI runs **`ruff check`**, **`ruff format --check`**, **`pip-audit`**, **`pytest`**, **integration tests**, and **Vitest** on **Ubuntu, Windows, and macOS** (`ubuntu-latest`, `windows-latest`, `macos-latest`; Python 3.12, Node 20). Type-check (`mypy`) and production install smoke run on Ubuntu only.
 
 ### Bootstrap (Windows PowerShell)
 
@@ -112,7 +112,7 @@ npm run test:coverage   # optional
   - [ ] `ruff check .` and `ruff format --check .` green locally
   - [ ] `pytest -q` green locally
   - [ ] `npm test` green if JS changed
-  - [ ] CI jobs green (`lint-and-audit`, `pytest`, `integration-tests`, `js-tests` on Ubuntu + Windows; `mypy`, `prod-install-smoke` on Ubuntu)
+  - [ ] CI jobs green (`lint-and-audit`, `pytest`, `integration-tests`, `js-tests` on Ubuntu + Windows + macOS; `mypy`, `prod-install-smoke` on Ubuntu)
   - [ ] PR description includes a **Test plan** section
   - [ ] API changes update [`docs/api-reference.md`](docs/api-reference.md) if behavior or errors change
 

package-lock.json

@@ -12,8 +12,5 @@
     "jsdom": "^26.1.0",
     "marked": "^12.0.1",
     "vitest": "^3.2.4"
-  },
-  "optionalDependencies": {
-    "@rollup/rollup-linux-x64-gnu": "4.60.4"
   }
 }

package.json

@@ -5,3 +5,4 @@ types-Flask==1.1.6
 pytest-cov>=5.0
 ruff>=0.9.0
 pip-audit>=2.7.0
+hypothesis>=6.100.0

requirements-dev.txt

@@ -2,14 +2,22 @@
 
 from __future__ import annotations
 
+import os
 import shutil
 from collections.abc import Mapping
 from pathlib import Path
 
 import pytest
+from hypothesis import settings
 
 from app import create_app
 
+# Hypothesis profiles drive fuzz example counts/deadlines (deadline disabled to
+# avoid timing flakiness on slow/CI runners). CI runs fewer examples for speed.
+settings.register_profile("dev", max_examples=200, deadline=None)
+settings.register_profile("ci", max_examples=100, deadline=None)
+settings.load_profile("ci" if os.environ.get("CI") else "dev")
+
 FIXTURES = Path(__file__).parent / "fixtures"