test(e2e): tighten fake-passing assertions across the suite

Several tests were passing without actually exercising the path their
name claimed. The common patterns:

- Loose regexes like `/checking availability|deploy/i` always matched
  because "deploy" is the command name itself, so the test passed even
  when nothing of substance ran.
- exitCode-only assertions on failure paths — any unrelated crash that
  produced a non-zero exit satisfied the check.
- Generic word matches (`/not found/i`, `/signer|init|log.?in/i`) that
  could match help text, stack traces, or transient gateway errors
  rather than the specific failure mode under test.

Fixes per file:

- deploy.test.ts: replaced `/checking availability|deploy/i` with the
  literal "Checking availability" checkpoint (only printed after
  preflight succeeds). Tightened the mainnet, --contracts-no-project,
  and "domain taken by another account" tests with exit-code
  assertions and exact error fragments.

- mod.test.ts: registry-miss now asserts the exact "not found in
  registry" wording plus the domain; signer-suggestion asserts the
  exact "No signer available" / "dot init" text rather than matching
  any of those words anywhere.

- diagnostic.test.ts: DOT_DEPLOY_VERBOSE test switched off ALICE
  (unfunded → would abort before producing verbose output) onto
  SIGNER + --no-build so it actually reaches the availability check.

- session.test.ts: "build does not touch sessions" now verifies both
  builds returned exit 0 (a crashed build can't write any file, so the
  previous version was tautological); "logout with no session" now
  asserts exitCode === 0.

- init.test.ts: dropped `-y` from the session-detection tests — with
  -y, init skips the connect()/login block entirely, so the tests
  were really just verifying that toolchain installation in a fresh
  tempHome takes longer than 15s. Now they assert on the actual
  "Scan with the Polkadot mobile app" / "Login skipped" output.
  Added a new `dot init — toolchain detection` test that strips
  rustup/cargo/foundry from PATH and verifies init does NOT report
  ✓ rustup — catches detection regressions even though CI runners
  have toolchains pre-installed.

Author: ottovlotto

e2e/cli/deploy.test.ts

@@ -30,6 +30,18 @@ function absBuildDir(fixture: string, dir = "dist"): string {
 	return resolve(fixture, dir);
 }
 
+/**
+ * Assertion notes for the preflight tests below:
+ * - "Checking availability" is printed by `src/commands/deploy/index.ts` ONLY
+ *   after preflight (signer + mapping + balance) has succeeded. Asserting on
+ *   it is a real checkpoint — a deploy that crashes earlier won't print it.
+ * - Avoid loose regexes like `/deploy/i`: the literal word "deploy" appears
+ *   in the command banner, error-help text, and stack traces, so it matches
+ *   even when nothing meaningful happened.
+ * - For tests that expect failure, assert `exitCode !== 0` so an early crash
+ *   that prints something tangentially matching the regex can't slip through.
+ */
+
 describe("dot deploy — preflight and validation", () => {
 	test("reports mainnet not yet supported", async () => {
 		const result = await dot([
@@ -43,8 +55,15 @@ describe("dot deploy — preflight and validation", () => {
 			"--dir", frontendOnly,
 		], { timeout: 400_000 });
 		const output = result.stdout + result.stderr;
-		expect(output).toMatch(/mainnet/i);
-		expect(output).toMatch(/not.*supported/i);
+		expect(
+			result.exitCode,
+			`expected non-zero exit for --env mainnet, got 0\n${output}`,
+		).not.toBe(0);
+		// Exact wording from src/commands/deploy/index.ts: "`--env mainnet` is
+		// not yet supported. Use `--env testnet` (default) while mainnet launch
+		// is pending."
+		expect(output).toContain("not yet supported");
+		expect(output).toContain("--env testnet");
 	});
 
 	test("detects foundry contracts type in project", async () => {
@@ -62,8 +81,11 @@ describe("dot deploy — preflight and validation", () => {
 		const output = result.stdout + result.stderr;
 		// foundry.toml present → should not complain about missing contract project
 		expect(output).not.toContain("no foundry/hardhat/cdm project was detected");
-		// Should proceed to at least the availability check
-		expect(output).toMatch(/checking availability|deploy/i);
+		// Real checkpoint: only printed after preflight succeeds.
+		expect(
+			output,
+			`expected to reach availability check\n${output}`,
+		).toContain("Checking availability");
 	});
 
 	test("detects hardhat contracts type in project", async () => {
@@ -80,7 +102,10 @@ describe("dot deploy — preflight and validation", () => {
 		]);
 		const output = result.stdout + result.stderr;
 		expect(output).not.toContain("no foundry/hardhat/cdm project was detected");
-		expect(output).toMatch(/checking availability|deploy/i);
+		expect(
+			output,
+			`expected to reach availability check\n${output}`,
+		).toContain("Checking availability");
 	});
 
 	test("detects CDM/Rust contracts type in project", async () => {
@@ -97,7 +122,10 @@ describe("dot deploy — preflight and validation", () => {
 		]);
 		const output = result.stdout + result.stderr;
 		expect(output).not.toContain("no foundry/hardhat/cdm project was detected");
-		expect(output).toMatch(/checking availability|deploy/i);
+		expect(
+			output,
+			`expected to reach availability check\n${output}`,
+		).toContain("Checking availability");
 	});
 
 	test("detects multiple contracts in multi-contract project", async () => {
@@ -114,7 +142,10 @@ describe("dot deploy — preflight and validation", () => {
 		]);
 		const output = result.stdout + result.stderr;
 		expect(output).not.toContain("no foundry/hardhat/cdm project was detected");
-		expect(output).toMatch(/checking availability|deploy/i);
+		expect(
+			output,
+			`expected to reach availability check\n${output}`,
+		).toContain("Checking availability");
 	});
 
 	test("--contracts reports error when no contract project detected", async () => {
@@ -130,6 +161,10 @@ describe("dot deploy — preflight and validation", () => {
 			"--dir", frontendOnly,
 		], { timeout: 400_000 });
 		const output = result.stdout + result.stderr;
+		expect(
+			result.exitCode,
+			`expected non-zero exit when --contracts has no project\n${output}`,
+		).not.toBe(0);
 		expect(output).toContain("no foundry/hardhat/cdm project was detected");
 	});
 
@@ -145,8 +180,10 @@ describe("dot deploy — preflight and validation", () => {
 			"--dir", frontendOnly,
 		], { timeout: 400_000 });
 		const output = result.stdout + result.stderr;
-		expect(output).toContain("Checking availability");
-		expect(output).toContain(domain);
+		// Availability banner names the domain; this is the strongest signal we
+		// have that the availability check actually executed against this run's
+		// domain (rather than echoing the arg in a usage/error string).
+		expect(output).toContain(`Checking availability of ${domain}.dot`);
 	});
 });
 
@@ -234,6 +271,15 @@ describe("dot deploy --playground — full pipeline (requires Paseo + IPFS)", ()
 			bobDeploy.exitCode,
 			`bob deploy unexpectedly succeeded: ${bobDeploy.stdout}\n${bobDeploy.stderr}`,
 		).not.toBe(0);
-		expect(output.toLowerCase()).toMatch(/revert|taken|registered|owned|unavailable|already/);
+		// Exact wording from src/utils/deploy/availability.ts:
+		//   "{domain}.dot is already registered by {owner} — transfer it or use
+		//    a different name"
+		// The previous /revert|taken|registered|owned|unavailable|already/
+		// regex matched any of those words anywhere — including transient
+		// network errors and unrelated runtime stack traces — so it could not
+		// distinguish "Bob hit the right ownership conflict" from "Bob hit
+		// some other failure that happened to mention 'registered'".
+		expect(output).toContain("already registered");
+		expect(output).toContain(domain);
 	});
 });

e2e/cli/diagnostic.test.ts

@@ -6,31 +6,40 @@
  */
 
 import { describe, test, expect } from "vitest";
+import { resolve } from "node:path";
 import { dot } from "./helpers/dot.js";
-import { ALICE } from "./fixtures/accounts.js";
+import { SIGNER, E2E_DOMAINS } from "./fixtures/accounts.js";
 import { fixturePath } from "./fixtures/templates.js";
 
 const frontendOnly = fixturePath("frontend-only");
 
 describe("diagnostic mode", () => {
 	test("DOT_DEPLOY_VERBOSE=1 does not break deploy preflight", async () => {
-		// Run a deploy that will reach preflight with verbose enabled.
-		// We don't need it to succeed — just verify verbose doesn't crash anything.
+		// Use SIGNER (funded by globalSetup) so preflight reaches the
+		// availability check; ALICE's balance is too low and the run would
+		// abort before producing any verbose-eligible output.
 		const result = await dot([
 			"deploy",
 			"--signer", "dev",
-			"--domain", "diag-verbose-test",
-			"--buildDir", "dist",
+			"--domain", E2E_DOMAINS.preflight,
+			"--buildDir", resolve(frontendOnly, "dist"),
+			"--no-build",
 			"--playground",
-			"--suri", ALICE.suri,
+			"--suri", SIGNER.suri,
 			"--dir", frontendOnly,
 		], {
 			env: { DOT_DEPLOY_VERBOSE: "1" },
-			timeout: 30_000,
+			timeout: 120_000,
 		});
 		const output = result.stdout + result.stderr;
-		// Should reach the availability check even with verbose on
-		expect(output).toMatch(/checking availability|deploy|mainnet/i);
+		// Reaching this banner is the real signal that preflight survived.
+		// Earlier this asserted /checking availability|deploy|mainnet/i — the
+		// `deploy` alternative matched the command name itself, so the test
+		// passed even when nothing of substance ran.
+		expect(
+			output,
+			`expected to reach availability check with verbose on\n${output}`,
+		).toContain("Checking availability");
 	});
 
 	test("DOT_MEMORY_TRACE=1 does not prevent normal operation", async () => {
@@ -39,6 +48,10 @@ describe("diagnostic mode", () => {
 			timeout: 15_000,
 		});
 		expect(result.exitCode).toBe(0);
+		// `deploy` appears in the subcommand list — that's the meaningful
+		// signal here. Pair with another known help string to make sure
+		// we got real `--help` output, not a stray match.
 		expect(result.stdout).toContain("deploy");
+		expect(result.stdout).toContain("Usage:");
 	});
 });

e2e/cli/init.test.ts

@@ -6,6 +6,16 @@
  * - Behavior when no session exists (prompts for QR, times out)
  * - Corrupted session file handling
  * - Dev signer (--suri) bypasses session requirement
+ *
+ * KNOWN GAP — toolchain install paths (rustup, IPFS, foundry, cdm) are NOT
+ * exercised in CI because the runner image already has those tools on PATH
+ * before tests run. As a result, regressions in the install / post-install
+ * path-config logic (e.g. paritytech/playground-app#118 — newly-installed
+ * rustup not reachable from the same init process) will pass these tests
+ * silently. To catch that class of bug, init has to be exercised in a fresh
+ * sandbox (Docker / VM with no Rust toolchain). The test below at least
+ * pins the toolchain *detection* output so the dependency table can't be
+ * silently dropped, but it does NOT validate the install-then-use flow.
  */
 
 import { describe, test, expect, beforeEach, afterEach } from "vitest";
@@ -14,6 +24,20 @@ import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { dot } from "./helpers/dot.js";
 
+/** PATH stripped of rustup/cargo/foundry locations. The init process must
+ *  still be able to find `node`/`bun`/`pnpm`/`curl`/`bash`, so we keep the
+ *  rest of PATH intact. Patterns are deliberately broad (cargo/rustup/
+ *  foundry anywhere in the segment) so we strip both `~/.cargo/bin` style
+ *  paths and `/opt/cargo/bin` / `/usr/local/cargo/bin` style ones. */
+function pathWithoutToolchains(): string {
+	const original = process.env.PATH ?? "/usr/bin:/bin";
+	const stripPatterns = [/cargo/i, /rustup/i, /foundry/i];
+	return original
+		.split(":")
+		.filter((p) => p.length > 0 && !stripPatterns.some((re) => re.test(p)))
+		.join(":");
+}
+
 function makeTempHome(): string {
 	const dir = mkdtempSync(join(tmpdir(), "dot-e2e-init-"));
 	mkdirSync(join(dir, ".polkadot-apps"), { recursive: true });
@@ -36,28 +60,46 @@ describe("dot init — session detection", () => {
 		} catch { /* best-effort */ }
 	});
 
-	test("init with no session times out waiting for QR scan", async () => {
-		const result = await dot(["init", "-y"], {
+	test("init with no session prompts for QR scan", async () => {
+		// IMPORTANT: do NOT pass `-y` here. With `-y`, init skips the
+		// connect()/login block entirely — there's no session probe and no
+		// QR. The previous version of this test used `-y` and only asserted
+		// `exitCode !== 0`, which simply verified that toolchain installation
+		// in a fresh tempHome takes longer than 15s — nothing about sessions.
+		const result = await dot(["init"], {
 			home: tempHome,
 			timeout: 15_000,
 		});
-		// With no session files and no phone to scan, the CLI should either:
-		// - time out waiting for the statement store QR
-		// - exit non-zero because -y can't complete without a session
-		// Either way it should not succeed silently.
-		expect(result.exitCode).not.toBe(0);
+		const output = result.stdout + result.stderr;
+		expect(
+			result.exitCode,
+			`expected non-zero exit while waiting for QR\n${output}`,
+		).not.toBe(0);
+		// Exact string from src/commands/init/index.ts when no existing session
+		// is found. Either we see the QR prompt, or the login service was
+		// unreachable and the CLI logs "Login skipped".
+		expect(output).toMatch(
+			/Scan with the Polkadot mobile app to log in|Login skipped/,
+		);
 	});
 
-	test("init with corrupted session file does not succeed", async () => {
+	test("init with corrupted session file does not silently succeed", async () => {
 		const sessionFile = join(tempHome, ".polkadot-apps", "dot-cli_SsoSessions.json");
 		writeFileSync(sessionFile, "{{{{not valid json!!");
 
-		const result = await dot(["init", "-y"], {
+		const result = await dot(["init"], {
 			home: tempHome,
 			timeout: 15_000,
 		});
-		// Corrupted session should cause a parse error or fall through to QR timeout
+		const output = result.stdout + result.stderr;
 		expect(result.exitCode).not.toBe(0);
+		// A corrupted session file must NOT lead to an "existing session"
+		// branch — that would be a security-relevant failure. We accept either
+		// the fresh-login QR prompt or a login-skipped notice; both prove the
+		// corrupt file was rejected rather than trusted.
+		expect(output).toMatch(
+			/Scan with the Polkadot mobile app to log in|Login skipped/,
+		);
 	});
 });
 
@@ -75,3 +117,62 @@ describe("dot init — dev signer bypass", () => {
 		}
 	});
 });
+
+describe("dot init — toolchain detection", () => {
+	let tempHome: string;
+
+	beforeEach(() => {
+		tempHome = makeTempHome();
+	});
+
+	afterEach(() => {
+		try {
+			rmSync(tempHome, { recursive: true, force: true });
+		} catch { /* best-effort */ }
+	});
+
+	test(
+		"detects rustup as missing when not on PATH",
+		{ timeout: 30_000 },
+		async () => {
+			// Strip rustup/cargo from PATH and verify init reports rustup as
+			// a missing dependency rather than skipping straight to "✓ rustup".
+			//
+			// Why this matters: CI runners pre-install rustup, so the regular
+			// init tests never exercise the missing-tool detection or the
+			// post-install path-config logic. This test forces init to hit
+			// the "rustup not found" branch by removing it from PATH.
+			//
+			// We use a 5s timeout — long enough for init's TUI to render the
+			// dependency table (and start a curl install attempt), short
+			// enough that we don't actually finish a real rustup install.
+			// We do NOT assert exitCode here; execa terminates the process at
+			// the timeout, so exitCode is the kill signal, not a real result.
+			const result = await dot(["init"], {
+				home: tempHome,
+				env: { PATH: pathWithoutToolchains() },
+				timeout: 5_000,
+			});
+			const output = result.stdout + result.stderr;
+			// The TUI prints each dependency on its own row. Seeing "rustup"
+			// proves the detection table rendered. Pair with one of the later
+			// rows so a single-line corruption can't pass.
+			expect(
+				output,
+				`expected dependency table to render\n${output}`,
+			).toContain("rustup");
+			expect(
+				output,
+				`expected later toolchain rows in dependency table\n${output}`,
+			).toMatch(/Rust nightly|cdm|foundry|IPFS/);
+			// A "✓ rustup" with this PATH would mean init falsely concluded
+			// rustup is installed — exactly the class of bug that lets fresh
+			// users hit broken installs in production. (Fresh installs render
+			// the row as "· rustup" or "⠋ rustup", not "✓".)
+			expect(
+				output,
+				`init reported rustup as installed despite stripped PATH:\n${output}`,
+			).not.toMatch(/✓\s+rustup\b/);
+		},
+	);
+});

e2e/cli/mod.test.ts

@@ -59,15 +59,24 @@ describe("dot mod", () => {
 		},
 	);
 
-	test("reports a registry-miss for an unknown domain", async () => {
+	test("reports a registry-miss for an unknown domain", { timeout: 120_000 }, async () => {
 		const cwd = makeTempDir("dot-e2e-mod-unknown-");
+		const domain = "nonexistent-domain-xyz-12345.dot";
 		const result = await dot(
-			["mod", "nonexistent-domain-xyz-12345.dot", "--suri", ALICE.suri],
-			{ cwd },
+			["mod", domain, "--suri", ALICE.suri],
+			{ cwd, timeout: 120_000 },
 		);
 		const output = result.stdout + result.stderr;
-		expect(result.exitCode).not.toBe(0);
-		expect(output).toMatch(/not found/i);
+		expect(
+			result.exitCode,
+			`expected non-zero exit for unknown domain\n${output}`,
+		).not.toBe(0);
+		// Exact wording from src/commands/mod/SetupScreen.tsx:
+		//   throw new Error(`App "${domain}" not found in registry`);
+		// Matching both fragments rules out an unrelated "not found" landing
+		// in output (e.g., a transient 404 from an IPFS gateway probe).
+		expect(output).toContain(domain);
+		expect(output).toContain("not found in registry");
 	});
 
 	test("exits non-zero with signer suggestion when no signer available", async () => {
@@ -76,6 +85,12 @@ describe("dot mod", () => {
 		const result = await dot(["mod", "some-app.dot"], { home: tempHome, cwd });
 		expect(result.exitCode).not.toBe(0);
 		const output = result.stdout + result.stderr;
-		expect(output).toMatch(/signer|init|log.?in/i);
+		// Exact wording from src/utils/signer.ts SignerNotAvailableError:
+		//   `No signer available. Run "dot init" to log in, or pass --suri //Alice for dev.`
+		// The previous regex /signer|init|log.?in/i matched any of those words
+		// anywhere — including help text — so it passed even on early crashes
+		// that never reached the signer-resolution path.
+		expect(output).toContain("No signer available");
+		expect(output).toContain("dot init");
 	});
 });