mirror of
https://github.com/garrytan/gbrain.git
synced 2026-07-30 03:12:32 +00:00
42c4ea929f
The content-sanity gate's audit logger (logContentSanityAssessment)
defaults, via audit-writer.ts::resolveAuditDir(), to writing
~/.gbrain/audit/content-sanity-YYYY-Www.jsonl on disk. A GBRAIN_AUDIT_DIR
env override exists, but nothing in the shared test bootstrap ever set
it, so any test that exercised an audit-emitting code path without
wrapping the call in its own withEnv() fell through to the operator's
real audit trail. test/import-file.test.ts's oversize-boundary fixture
('borderline-slug', content just under MAX_FILE_SIZE but over
DEFAULT_BYTES_BLOCK) fired a real soft_block event into the developer's
live ~/.gbrain/audit on every run — which doctor's
content_sanity_audit_recent check then reported as production signal.
Fix: add a bootstrap preload (test/helpers/audit-dir-preload.ts, wired
via bunfig.toml) that points GBRAIN_AUDIT_DIR at a fresh per-process
mkdtemp dir before any test file loads. Each run-unit-shard.sh shard is
its own bun process, so each shard gets its own scratch dir with no
cross-shard collision. This closes the leak for every audit-emitting
test, not just this fixture. It respects a developer-exported override
(only sets the var when unset), and files that manage their own
per-test GBRAIN_AUDIT_DIR via withEnv() are unaffected.
Also fix a latent isolation bug this surfaced: gbrain-home-isolation.test.ts
unconditionally deleted GBRAIN_AUDIT_DIR in a finally block instead of
restoring the prior value, which clobbered the bootstrap's scratch dir
for every test file that ran after it in the same shard process.
Adds test/audit/audit-dir-preload.test.ts to pin the behavior: it
reproduces the exact soft_block event shape and asserts it lands in the
scratch dir, never in ~/.gbrain/audit.
Reported by @paul-0320.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
52 lines
2.5 KiB
TypeScript
52 lines
2.5 KiB
TypeScript
/**
|
|
* Pre-test setup: redirect audit-writer output (content-sanity,
|
|
* shell-audit, supervisor-audit, slug-fallback, etc. — every module built
|
|
* on `src/core/audit/audit-writer.ts`) to a per-run scratch directory
|
|
* instead of the operator's real `~/.gbrain/audit/`.
|
|
*
|
|
* Why this exists (#2823): `audit-writer.ts::resolveAuditDir()` honors a
|
|
* `GBRAIN_AUDIT_DIR` env override, but nothing in the shared test bootstrap
|
|
* ever set it. Any test that exercises an audit-emitting code path without
|
|
* wrapping the call in its own `withEnv({ GBRAIN_AUDIT_DIR: ... })` (most
|
|
* don't — only the content-sanity-focused suites did) fell through to the
|
|
* real default and appended fixture rows into the operator's live audit
|
|
* trail. `test/import-file.test.ts`'s oversize-content boundary fixture
|
|
* (`'borderline-slug'`, content just under `MAX_FILE_SIZE` but over
|
|
* `DEFAULT_BYTES_BLOCK`) is the concrete offender named in the issue: it
|
|
* fires a real `soft_block` content-sanity event on every run, landing in
|
|
* `~/.gbrain/audit/content-sanity-YYYY-Www.jsonl` right alongside real
|
|
* production signal that doctor's `content_sanity_audit_recent` check
|
|
* reads.
|
|
*
|
|
* Fix: set `GBRAIN_AUDIT_DIR` once, globally, before any test file loads,
|
|
* to a fresh `mkdtemp` directory unique to THIS process. Each
|
|
* `scripts/run-unit-shard.sh` shard is its own `bun test` process, so each
|
|
* shard gets its own scratch dir automatically — no cross-shard collision,
|
|
* no manual cleanup needed (short-lived test process; OS reaps tmp, same
|
|
* tradeoff `test/helpers/with-env.ts`'s `emptyHome()` documents).
|
|
*
|
|
* Individual test files that already manage their own isolated
|
|
* `GBRAIN_AUDIT_DIR` per-test via `withEnv` (e.g.
|
|
* `test/import-file-content-sanity.test.ts`, `test/audit/content-sanity-audit.test.ts`)
|
|
* are unaffected — `withEnv` saves/restores around whatever this preload
|
|
* set as the process-global default, same as any other env var.
|
|
*
|
|
* Only sets the var if it isn't already set, so a developer who exports
|
|
* `GBRAIN_AUDIT_DIR` themselves (e.g. to inspect audit output after a
|
|
* local run) keeps their override.
|
|
*
|
|
* Imported by `bunfig.toml` via
|
|
* `preload = [..., "./test/helpers/audit-dir-preload.ts"]`.
|
|
*/
|
|
import { mkdtempSync } from 'node:fs';
|
|
import { tmpdir } from 'node:os';
|
|
import { join } from 'node:path';
|
|
|
|
if (!process.env.GBRAIN_AUDIT_DIR) {
|
|
const dir = mkdtempSync(join(tmpdir(), 'gbrain-test-audit-'));
|
|
process.env.GBRAIN_AUDIT_DIR = dir;
|
|
if (process.env.GBRAIN_DEBUG_PRELOAD === '1') {
|
|
console.error(`[audit-dir-preload] GBRAIN_AUDIT_DIR=${dir}`);
|
|
}
|
|
}
|