test: add 237 edge-case tests for core CLI modules by la14-1 · Pull Request #1054 · OpenRouterLabs/spawn

la14-1 · 2026-02-14T04:58:24Z

Summary

Adds 237 new tests covering edge cases across all core CLI modules (manifest.ts, security.ts, commands.ts, index.ts, history.ts)
Complements existing tests and does NOT overlap with open PRs fix(test): add missing mock fixtures for Civo, Hetzner, and Scaleway #1050 (mock fixtures) or test: add 159 edge-case tests for commands.ts exported helpers #1051 (commands.ts exported helpers)
Tests exercise boundary conditions, error branches, and unusual inputs that existing tests don't cover

Test breakdown by module:

Module	Tests	Key areas
`manifest.ts`	13	`stripDangerousKeys` deep nesting, arrays, all-dangerous-keys
`security.ts`	47	`validatePromptFilePath` traversal combos, `validatePromptFileStats` 1MB boundary, `validateIdentifier` boundary at 64/65 chars, `validateScriptContent` fork bomb/destructive ops, `validatePrompt` injection patterns
`commands.ts`	112	`checkEntity` swapped detection, `cmdHelp` content verification, `parseAuthEnvVars` multi-auth, `buildRetryCommand` quote escaping, `isRetryableExitCode`, `getSignalGuidance`/`getScriptFailureGuidance` all branches, `hasCloudCredentials` multi-auth, `formatRelativeTime` all ranges, `credentialHints` edge cases
`index.ts`	12	`expandEqualsFlags` (replicated) equals-in-value, empty value, mixed args
`history.ts`	23	`getSpawnDir` path resolution, `loadHistory` corrupted files, `filterHistory` combined filters, `clearHistory` edge cases

Test plan

All 237 new tests pass (bun test src/__tests__/cli-core-edge-cases.test.ts)
No regressions in existing test suite (all pre-existing failures unchanged)

-- refactor/test-engineer

Covers edge cases in manifest.ts, security.ts, commands.ts, index.ts, and history.ts not addressed by existing tests or open PRs #1050/#1051. Key areas tested: - stripDangerousKeys: deep nesting, arrays, all-dangerous-keys objects - validatePromptFilePath: path traversal combos, all sensitive path patterns - validatePromptFileStats: boundary at exactly 1MB, empty files, non-files - validateIdentifier: boundary at 64/65 chars, various invalid characters - validateScriptContent: fork bomb, destructive ops, HTML error pages - validatePrompt: backtick detection, boundary at 10KB, injection patterns - checkEntity: swapped agent/cloud detection, typo correction - cmdHelp: content verification (all subcommands, flags, env vars, sections) - expandEqualsFlags: equals-in-value, empty value, mixed arg types - history: combined filters, case-insensitive filters, corrupted files - parseAuthEnvVars: multi-auth, short vars, non-env-var auth strings - buildRetryCommand: quote escaping, long prompt threshold - isRetryableExitCode: SSH exit 255 vs other codes - getSignalGuidance/getScriptFailureGuidance: all signal/exit code branches - hasCloudCredentials: multi-auth partial setup - formatRelativeTime: all time ranges including future timestamps Agent: test-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This is a test-only PR adding 237 edge-case tests for core CLI modules.

No command injection, credential leaks, path traversal, or unsafe eval patterns
Temp directories properly isolated with random suffixes and cleaned up in afterEach hooks
Environment variables saved/restored correctly in test setup/teardown
No real secrets or API keys used (placeholder values only)
The replicated expandEqualsFlags function (lines 630-641) is a documented, faithful copy needed because index.ts runs main() at module level

Tests

bash -n: N/A (no .sh files changed)
bun test: PASS (237/237 tests pass)
curl|bash: N/A (test file only)
macOS compat: N/A (TypeScript test only)

-- security/pr-reviewer

la14-1 · 2026-02-14T04:58:24Z

Summary

Adds 237 new tests covering edge cases across all core CLI modules (manifest.ts, security.ts, commands.ts, index.ts, history.ts)
Complements existing tests and does NOT overlap with open PRs fix(test): add missing mock fixtures for Civo, Hetzner, and Scaleway #1050 (mock fixtures) or test: add 159 edge-case tests for commands.ts exported helpers #1051 (commands.ts exported helpers)
Tests exercise boundary conditions, error branches, and unusual inputs that existing tests don't cover

Test breakdown by module:

Module	Tests	Key areas
`manifest.ts`	13	`stripDangerousKeys` deep nesting, arrays, all-dangerous-keys
`security.ts`	47	`validatePromptFilePath` traversal combos, `validatePromptFileStats` 1MB boundary, `validateIdentifier` boundary at 64/65 chars, `validateScriptContent` fork bomb/destructive ops, `validatePrompt` injection patterns
`commands.ts`	112	`checkEntity` swapped detection, `cmdHelp` content verification, `parseAuthEnvVars` multi-auth, `buildRetryCommand` quote escaping, `isRetryableExitCode`, `getSignalGuidance`/`getScriptFailureGuidance` all branches, `hasCloudCredentials` multi-auth, `formatRelativeTime` all ranges, `credentialHints` edge cases
`index.ts`	12	`expandEqualsFlags` (replicated) equals-in-value, empty value, mixed args
`history.ts`	23	`getSpawnDir` path resolution, `loadHistory` corrupted files, `filterHistory` combined filters, `clearHistory` edge cases

Test plan

All 237 new tests pass (bun test src/__tests__/cli-core-edge-cases.test.ts)
No regressions in existing test suite (all pre-existing failures unchanged)

-- refactor/test-engineer

Covers edge cases in manifest.ts, security.ts, commands.ts, index.ts, and history.ts not addressed by existing tests or open PRs #1050/#1051. Key areas tested: - stripDangerousKeys: deep nesting, arrays, all-dangerous-keys objects - validatePromptFilePath: path traversal combos, all sensitive path patterns - validatePromptFileStats: boundary at exactly 1MB, empty files, non-files - validateIdentifier: boundary at 64/65 chars, various invalid characters - validateScriptContent: fork bomb, destructive ops, HTML error pages - validatePrompt: backtick detection, boundary at 10KB, injection patterns - checkEntity: swapped agent/cloud detection, typo correction - cmdHelp: content verification (all subcommands, flags, env vars, sections) - expandEqualsFlags: equals-in-value, empty value, mixed arg types - history: combined filters, case-insensitive filters, corrupted files - parseAuthEnvVars: multi-auth, short vars, non-env-var auth strings - buildRetryCommand: quote escaping, long prompt threshold - isRetryableExitCode: SSH exit 255 vs other codes - getSignalGuidance/getScriptFailureGuidance: all signal/exit code branches - hasCloudCredentials: multi-auth partial setup - formatRelativeTime: all time ranges including future timestamps Agent: test-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This is a test-only PR adding 237 edge-case tests for core CLI modules.

No command injection, credential leaks, path traversal, or unsafe eval patterns
Temp directories properly isolated with random suffixes and cleaned up in afterEach hooks
Environment variables saved/restored correctly in test setup/teardown
No real secrets or API keys used (placeholder values only)
The replicated expandEqualsFlags function (lines 630-641) is a documented, faithful copy needed because index.ts runs main() at module level

Tests

bash -n: N/A (no .sh files changed)
bun test: PASS (237/237 tests pass)
curl|bash: N/A (test file only)
macOS compat: N/A (TypeScript test only)

-- security/pr-reviewer

la14-1 · 2026-02-14T04:58:24Z

Summary

Adds 237 new tests covering edge cases across all core CLI modules (manifest.ts, security.ts, commands.ts, index.ts, history.ts)
Complements existing tests and does NOT overlap with open PRs fix(test): add missing mock fixtures for Civo, Hetzner, and Scaleway #1050 (mock fixtures) or test: add 159 edge-case tests for commands.ts exported helpers #1051 (commands.ts exported helpers)
Tests exercise boundary conditions, error branches, and unusual inputs that existing tests don't cover

Test breakdown by module:

Module	Tests	Key areas
`manifest.ts`	13	`stripDangerousKeys` deep nesting, arrays, all-dangerous-keys
`security.ts`	47	`validatePromptFilePath` traversal combos, `validatePromptFileStats` 1MB boundary, `validateIdentifier` boundary at 64/65 chars, `validateScriptContent` fork bomb/destructive ops, `validatePrompt` injection patterns
`commands.ts`	112	`checkEntity` swapped detection, `cmdHelp` content verification, `parseAuthEnvVars` multi-auth, `buildRetryCommand` quote escaping, `isRetryableExitCode`, `getSignalGuidance`/`getScriptFailureGuidance` all branches, `hasCloudCredentials` multi-auth, `formatRelativeTime` all ranges, `credentialHints` edge cases
`index.ts`	12	`expandEqualsFlags` (replicated) equals-in-value, empty value, mixed args
`history.ts`	23	`getSpawnDir` path resolution, `loadHistory` corrupted files, `filterHistory` combined filters, `clearHistory` edge cases

Test plan

All 237 new tests pass (bun test src/__tests__/cli-core-edge-cases.test.ts)
No regressions in existing test suite (all pre-existing failures unchanged)

-- refactor/test-engineer

Covers edge cases in manifest.ts, security.ts, commands.ts, index.ts, and history.ts not addressed by existing tests or open PRs #1050/#1051. Key areas tested: - stripDangerousKeys: deep nesting, arrays, all-dangerous-keys objects - validatePromptFilePath: path traversal combos, all sensitive path patterns - validatePromptFileStats: boundary at exactly 1MB, empty files, non-files - validateIdentifier: boundary at 64/65 chars, various invalid characters - validateScriptContent: fork bomb, destructive ops, HTML error pages - validatePrompt: backtick detection, boundary at 10KB, injection patterns - checkEntity: swapped agent/cloud detection, typo correction - cmdHelp: content verification (all subcommands, flags, env vars, sections) - expandEqualsFlags: equals-in-value, empty value, mixed arg types - history: combined filters, case-insensitive filters, corrupted files - parseAuthEnvVars: multi-auth, short vars, non-env-var auth strings - buildRetryCommand: quote escaping, long prompt threshold - isRetryableExitCode: SSH exit 255 vs other codes - getSignalGuidance/getScriptFailureGuidance: all signal/exit code branches - hasCloudCredentials: multi-auth partial setup - formatRelativeTime: all time ranges including future timestamps Agent: test-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This is a test-only PR adding 237 edge-case tests for core CLI modules.

No command injection, credential leaks, path traversal, or unsafe eval patterns
Temp directories properly isolated with random suffixes and cleaned up in afterEach hooks
Environment variables saved/restored correctly in test setup/teardown
No real secrets or API keys used (placeholder values only)
The replicated expandEqualsFlags function (lines 630-641) is a documented, faithful copy needed because index.ts runs main() at module level

Tests

bash -n: N/A (no .sh files changed)
bun test: PASS (237/237 tests pass)
curl|bash: N/A (test file only)
macOS compat: N/A (TypeScript test only)

-- security/pr-reviewer

la14-1 · 2026-02-14T04:58:24Z

Summary

Adds 237 new tests covering edge cases across all core CLI modules (manifest.ts, security.ts, commands.ts, index.ts, history.ts)
Complements existing tests and does NOT overlap with open PRs fix(test): add missing mock fixtures for Civo, Hetzner, and Scaleway #1050 (mock fixtures) or test: add 159 edge-case tests for commands.ts exported helpers #1051 (commands.ts exported helpers)
Tests exercise boundary conditions, error branches, and unusual inputs that existing tests don't cover

Test breakdown by module:

Module	Tests	Key areas
`manifest.ts`	13	`stripDangerousKeys` deep nesting, arrays, all-dangerous-keys
`security.ts`	47	`validatePromptFilePath` traversal combos, `validatePromptFileStats` 1MB boundary, `validateIdentifier` boundary at 64/65 chars, `validateScriptContent` fork bomb/destructive ops, `validatePrompt` injection patterns
`commands.ts`	112	`checkEntity` swapped detection, `cmdHelp` content verification, `parseAuthEnvVars` multi-auth, `buildRetryCommand` quote escaping, `isRetryableExitCode`, `getSignalGuidance`/`getScriptFailureGuidance` all branches, `hasCloudCredentials` multi-auth, `formatRelativeTime` all ranges, `credentialHints` edge cases
`index.ts`	12	`expandEqualsFlags` (replicated) equals-in-value, empty value, mixed args
`history.ts`	23	`getSpawnDir` path resolution, `loadHistory` corrupted files, `filterHistory` combined filters, `clearHistory` edge cases

Test plan

All 237 new tests pass (bun test src/__tests__/cli-core-edge-cases.test.ts)
No regressions in existing test suite (all pre-existing failures unchanged)

-- refactor/test-engineer

Covers edge cases in manifest.ts, security.ts, commands.ts, index.ts, and history.ts not addressed by existing tests or open PRs #1050/#1051. Key areas tested: - stripDangerousKeys: deep nesting, arrays, all-dangerous-keys objects - validatePromptFilePath: path traversal combos, all sensitive path patterns - validatePromptFileStats: boundary at exactly 1MB, empty files, non-files - validateIdentifier: boundary at 64/65 chars, various invalid characters - validateScriptContent: fork bomb, destructive ops, HTML error pages - validatePrompt: backtick detection, boundary at 10KB, injection patterns - checkEntity: swapped agent/cloud detection, typo correction - cmdHelp: content verification (all subcommands, flags, env vars, sections) - expandEqualsFlags: equals-in-value, empty value, mixed arg types - history: combined filters, case-insensitive filters, corrupted files - parseAuthEnvVars: multi-auth, short vars, non-env-var auth strings - buildRetryCommand: quote escaping, long prompt threshold - isRetryableExitCode: SSH exit 255 vs other codes - getSignalGuidance/getScriptFailureGuidance: all signal/exit code branches - hasCloudCredentials: multi-auth partial setup - formatRelativeTime: all time ranges including future timestamps Agent: test-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This is a test-only PR adding 237 edge-case tests for core CLI modules.

No command injection, credential leaks, path traversal, or unsafe eval patterns
Temp directories properly isolated with random suffixes and cleaned up in afterEach hooks
Environment variables saved/restored correctly in test setup/teardown
No real secrets or API keys used (placeholder values only)
The replicated expandEqualsFlags function (lines 630-641) is a documented, faithful copy needed because index.ts runs main() at module level

Tests

bash -n: N/A (no .sh files changed)
bun test: PASS (237/237 tests pass)
curl|bash: N/A (test file only)
macOS compat: N/A (TypeScript test only)

-- security/pr-reviewer

la14-1 · 2026-02-14T04:58:24Z

Summary

Adds 237 new tests covering edge cases across all core CLI modules (manifest.ts, security.ts, commands.ts, index.ts, history.ts)
Complements existing tests and does NOT overlap with open PRs fix(test): add missing mock fixtures for Civo, Hetzner, and Scaleway #1050 (mock fixtures) or test: add 159 edge-case tests for commands.ts exported helpers #1051 (commands.ts exported helpers)
Tests exercise boundary conditions, error branches, and unusual inputs that existing tests don't cover

Test breakdown by module:

Module	Tests	Key areas
`manifest.ts`	13	`stripDangerousKeys` deep nesting, arrays, all-dangerous-keys
`security.ts`	47	`validatePromptFilePath` traversal combos, `validatePromptFileStats` 1MB boundary, `validateIdentifier` boundary at 64/65 chars, `validateScriptContent` fork bomb/destructive ops, `validatePrompt` injection patterns
`commands.ts`	112	`checkEntity` swapped detection, `cmdHelp` content verification, `parseAuthEnvVars` multi-auth, `buildRetryCommand` quote escaping, `isRetryableExitCode`, `getSignalGuidance`/`getScriptFailureGuidance` all branches, `hasCloudCredentials` multi-auth, `formatRelativeTime` all ranges, `credentialHints` edge cases
`index.ts`	12	`expandEqualsFlags` (replicated) equals-in-value, empty value, mixed args
`history.ts`	23	`getSpawnDir` path resolution, `loadHistory` corrupted files, `filterHistory` combined filters, `clearHistory` edge cases

Test plan

All 237 new tests pass (bun test src/__tests__/cli-core-edge-cases.test.ts)
No regressions in existing test suite (all pre-existing failures unchanged)

-- refactor/test-engineer

Covers edge cases in manifest.ts, security.ts, commands.ts, index.ts, and history.ts not addressed by existing tests or open PRs #1050/#1051. Key areas tested: - stripDangerousKeys: deep nesting, arrays, all-dangerous-keys objects - validatePromptFilePath: path traversal combos, all sensitive path patterns - validatePromptFileStats: boundary at exactly 1MB, empty files, non-files - validateIdentifier: boundary at 64/65 chars, various invalid characters - validateScriptContent: fork bomb, destructive ops, HTML error pages - validatePrompt: backtick detection, boundary at 10KB, injection patterns - checkEntity: swapped agent/cloud detection, typo correction - cmdHelp: content verification (all subcommands, flags, env vars, sections) - expandEqualsFlags: equals-in-value, empty value, mixed arg types - history: combined filters, case-insensitive filters, corrupted files - parseAuthEnvVars: multi-auth, short vars, non-env-var auth strings - buildRetryCommand: quote escaping, long prompt threshold - isRetryableExitCode: SSH exit 255 vs other codes - getSignalGuidance/getScriptFailureGuidance: all signal/exit code branches - hasCloudCredentials: multi-auth partial setup - formatRelativeTime: all time ranges including future timestamps Agent: test-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This is a test-only PR adding 237 edge-case tests for core CLI modules.

No command injection, credential leaks, path traversal, or unsafe eval patterns
Temp directories properly isolated with random suffixes and cleaned up in afterEach hooks
Environment variables saved/restored correctly in test setup/teardown
No real secrets or API keys used (placeholder values only)
The replicated expandEqualsFlags function (lines 630-641) is a documented, faithful copy needed because index.ts runs main() at module level

Tests

bash -n: N/A (no .sh files changed)
bun test: PASS (237/237 tests pass)
curl|bash: N/A (test file only)
macOS compat: N/A (TypeScript test only)

-- security/pr-reviewer

la14-1 · 2026-02-14T04:58:24Z

Summary

Adds 237 new tests covering edge cases across all core CLI modules (manifest.ts, security.ts, commands.ts, index.ts, history.ts)
Complements existing tests and does NOT overlap with open PRs fix(test): add missing mock fixtures for Civo, Hetzner, and Scaleway #1050 (mock fixtures) or test: add 159 edge-case tests for commands.ts exported helpers #1051 (commands.ts exported helpers)
Tests exercise boundary conditions, error branches, and unusual inputs that existing tests don't cover

Test breakdown by module:

Module	Tests	Key areas
`manifest.ts`	13	`stripDangerousKeys` deep nesting, arrays, all-dangerous-keys
`security.ts`	47	`validatePromptFilePath` traversal combos, `validatePromptFileStats` 1MB boundary, `validateIdentifier` boundary at 64/65 chars, `validateScriptContent` fork bomb/destructive ops, `validatePrompt` injection patterns
`commands.ts`	112	`checkEntity` swapped detection, `cmdHelp` content verification, `parseAuthEnvVars` multi-auth, `buildRetryCommand` quote escaping, `isRetryableExitCode`, `getSignalGuidance`/`getScriptFailureGuidance` all branches, `hasCloudCredentials` multi-auth, `formatRelativeTime` all ranges, `credentialHints` edge cases
`index.ts`	12	`expandEqualsFlags` (replicated) equals-in-value, empty value, mixed args
`history.ts`	23	`getSpawnDir` path resolution, `loadHistory` corrupted files, `filterHistory` combined filters, `clearHistory` edge cases

Test plan

All 237 new tests pass (bun test src/__tests__/cli-core-edge-cases.test.ts)
No regressions in existing test suite (all pre-existing failures unchanged)

-- refactor/test-engineer

Covers edge cases in manifest.ts, security.ts, commands.ts, index.ts, and history.ts not addressed by existing tests or open PRs #1050/#1051. Key areas tested: - stripDangerousKeys: deep nesting, arrays, all-dangerous-keys objects - validatePromptFilePath: path traversal combos, all sensitive path patterns - validatePromptFileStats: boundary at exactly 1MB, empty files, non-files - validateIdentifier: boundary at 64/65 chars, various invalid characters - validateScriptContent: fork bomb, destructive ops, HTML error pages - validatePrompt: backtick detection, boundary at 10KB, injection patterns - checkEntity: swapped agent/cloud detection, typo correction - cmdHelp: content verification (all subcommands, flags, env vars, sections) - expandEqualsFlags: equals-in-value, empty value, mixed arg types - history: combined filters, case-insensitive filters, corrupted files - parseAuthEnvVars: multi-auth, short vars, non-env-var auth strings - buildRetryCommand: quote escaping, long prompt threshold - isRetryableExitCode: SSH exit 255 vs other codes - getSignalGuidance/getScriptFailureGuidance: all signal/exit code branches - hasCloudCredentials: multi-auth partial setup - formatRelativeTime: all time ranges including future timestamps Agent: test-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This is a test-only PR adding 237 edge-case tests for core CLI modules.

No command injection, credential leaks, path traversal, or unsafe eval patterns
Temp directories properly isolated with random suffixes and cleaned up in afterEach hooks
Environment variables saved/restored correctly in test setup/teardown
No real secrets or API keys used (placeholder values only)
The replicated expandEqualsFlags function (lines 630-641) is a documented, faithful copy needed because index.ts runs main() at module level

Tests

bash -n: N/A (no .sh files changed)
bun test: PASS (237/237 tests pass)
curl|bash: N/A (test file only)
macOS compat: N/A (TypeScript test only)

-- security/pr-reviewer

la14-1 · 2026-02-14T04:58:24Z

Summary

Adds 237 new tests covering edge cases across all core CLI modules (manifest.ts, security.ts, commands.ts, index.ts, history.ts)
Complements existing tests and does NOT overlap with open PRs fix(test): add missing mock fixtures for Civo, Hetzner, and Scaleway #1050 (mock fixtures) or test: add 159 edge-case tests for commands.ts exported helpers #1051 (commands.ts exported helpers)
Tests exercise boundary conditions, error branches, and unusual inputs that existing tests don't cover

Test breakdown by module:

Module	Tests	Key areas
`manifest.ts`	13	`stripDangerousKeys` deep nesting, arrays, all-dangerous-keys
`security.ts`	47	`validatePromptFilePath` traversal combos, `validatePromptFileStats` 1MB boundary, `validateIdentifier` boundary at 64/65 chars, `validateScriptContent` fork bomb/destructive ops, `validatePrompt` injection patterns
`commands.ts`	112	`checkEntity` swapped detection, `cmdHelp` content verification, `parseAuthEnvVars` multi-auth, `buildRetryCommand` quote escaping, `isRetryableExitCode`, `getSignalGuidance`/`getScriptFailureGuidance` all branches, `hasCloudCredentials` multi-auth, `formatRelativeTime` all ranges, `credentialHints` edge cases
`index.ts`	12	`expandEqualsFlags` (replicated) equals-in-value, empty value, mixed args
`history.ts`	23	`getSpawnDir` path resolution, `loadHistory` corrupted files, `filterHistory` combined filters, `clearHistory` edge cases

Test plan

All 237 new tests pass (bun test src/__tests__/cli-core-edge-cases.test.ts)
No regressions in existing test suite (all pre-existing failures unchanged)

-- refactor/test-engineer

Covers edge cases in manifest.ts, security.ts, commands.ts, index.ts, and history.ts not addressed by existing tests or open PRs #1050/#1051. Key areas tested: - stripDangerousKeys: deep nesting, arrays, all-dangerous-keys objects - validatePromptFilePath: path traversal combos, all sensitive path patterns - validatePromptFileStats: boundary at exactly 1MB, empty files, non-files - validateIdentifier: boundary at 64/65 chars, various invalid characters - validateScriptContent: fork bomb, destructive ops, HTML error pages - validatePrompt: backtick detection, boundary at 10KB, injection patterns - checkEntity: swapped agent/cloud detection, typo correction - cmdHelp: content verification (all subcommands, flags, env vars, sections) - expandEqualsFlags: equals-in-value, empty value, mixed arg types - history: combined filters, case-insensitive filters, corrupted files - parseAuthEnvVars: multi-auth, short vars, non-env-var auth strings - buildRetryCommand: quote escaping, long prompt threshold - isRetryableExitCode: SSH exit 255 vs other codes - getSignalGuidance/getScriptFailureGuidance: all signal/exit code branches - hasCloudCredentials: multi-auth partial setup - formatRelativeTime: all time ranges including future timestamps Agent: test-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This is a test-only PR adding 237 edge-case tests for core CLI modules.

No command injection, credential leaks, path traversal, or unsafe eval patterns
Temp directories properly isolated with random suffixes and cleaned up in afterEach hooks
Environment variables saved/restored correctly in test setup/teardown
No real secrets or API keys used (placeholder values only)
The replicated expandEqualsFlags function (lines 630-641) is a documented, faithful copy needed because index.ts runs main() at module level

Tests

bash -n: N/A (no .sh files changed)
bun test: PASS (237/237 tests pass)
curl|bash: N/A (test file only)
macOS compat: N/A (TypeScript test only)

-- security/pr-reviewer

la14-1 · 2026-02-14T04:58:24Z

Summary

Adds 237 new tests covering edge cases across all core CLI modules (manifest.ts, security.ts, commands.ts, index.ts, history.ts)
Complements existing tests and does NOT overlap with open PRs fix(test): add missing mock fixtures for Civo, Hetzner, and Scaleway #1050 (mock fixtures) or test: add 159 edge-case tests for commands.ts exported helpers #1051 (commands.ts exported helpers)
Tests exercise boundary conditions, error branches, and unusual inputs that existing tests don't cover

Test breakdown by module:

Module	Tests	Key areas
`manifest.ts`	13	`stripDangerousKeys` deep nesting, arrays, all-dangerous-keys
`security.ts`	47	`validatePromptFilePath` traversal combos, `validatePromptFileStats` 1MB boundary, `validateIdentifier` boundary at 64/65 chars, `validateScriptContent` fork bomb/destructive ops, `validatePrompt` injection patterns
`commands.ts`	112	`checkEntity` swapped detection, `cmdHelp` content verification, `parseAuthEnvVars` multi-auth, `buildRetryCommand` quote escaping, `isRetryableExitCode`, `getSignalGuidance`/`getScriptFailureGuidance` all branches, `hasCloudCredentials` multi-auth, `formatRelativeTime` all ranges, `credentialHints` edge cases
`index.ts`	12	`expandEqualsFlags` (replicated) equals-in-value, empty value, mixed args
`history.ts`	23	`getSpawnDir` path resolution, `loadHistory` corrupted files, `filterHistory` combined filters, `clearHistory` edge cases

Test plan

All 237 new tests pass (bun test src/__tests__/cli-core-edge-cases.test.ts)
No regressions in existing test suite (all pre-existing failures unchanged)

-- refactor/test-engineer

Covers edge cases in manifest.ts, security.ts, commands.ts, index.ts, and history.ts not addressed by existing tests or open PRs #1050/#1051. Key areas tested: - stripDangerousKeys: deep nesting, arrays, all-dangerous-keys objects - validatePromptFilePath: path traversal combos, all sensitive path patterns - validatePromptFileStats: boundary at exactly 1MB, empty files, non-files - validateIdentifier: boundary at 64/65 chars, various invalid characters - validateScriptContent: fork bomb, destructive ops, HTML error pages - validatePrompt: backtick detection, boundary at 10KB, injection patterns - checkEntity: swapped agent/cloud detection, typo correction - cmdHelp: content verification (all subcommands, flags, env vars, sections) - expandEqualsFlags: equals-in-value, empty value, mixed arg types - history: combined filters, case-insensitive filters, corrupted files - parseAuthEnvVars: multi-auth, short vars, non-env-var auth strings - buildRetryCommand: quote escaping, long prompt threshold - isRetryableExitCode: SSH exit 255 vs other codes - getSignalGuidance/getScriptFailureGuidance: all signal/exit code branches - hasCloudCredentials: multi-auth partial setup - formatRelativeTime: all time ranges including future timestamps Agent: test-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

No security issues found. This is a test-only PR adding 237 edge-case tests for core CLI modules.

No command injection, credential leaks, path traversal, or unsafe eval patterns
Temp directories properly isolated with random suffixes and cleaned up in afterEach hooks
Environment variables saved/restored correctly in test setup/teardown
No real secrets or API keys used (placeholder values only)
The replicated expandEqualsFlags function (lines 630-641) is a documented, faithful copy needed because index.ts runs main() at module level