Skip to content

test(tui): stop /prd's healthy-cwd control from launching a real engine - #273

Merged
ralyodio merged 1 commit into
mainfrom
fix/prd-test-no-engine
Aug 3, 2026
Merged

test(tui): stop /prd's healthy-cwd control from launching a real engine#273
ralyodio merged 1 commit into
mainfrom
fix/prd-test-no-engine

Conversation

@ralyodio

@ralyodio ralyodio commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

The problem

One test was 420s of the suite's 479s.

/prd hands the published PRD to an installed engine to author, and engineStatus() decides "installed" purely by walking PATH:

const eng = pickEngine();
if (!eng) { /* "open an engine to fill it in" */ continue; }
await openEngine(key, {...}, [authoringPrompt({ path: file, idea })]);

TUI /prd still publishes a PRD in a healthy cwd is the only test in the file that gets that far — every sibling uses a cwd where createPrd() throws first. So on a machine with claude on PATH it launched Claude for real and blocked until it finished authoring a PRD.

That means the test:

  • burned ~7 minutes per run,
  • spent real tokens every time,
  • and produced a different result depending on who ran it — under a second on CI (no engine installed), seven minutes locally.

A test whose behaviour flips on whether the person running it happens to have Claude installed isn't testing anything.

The fix

Hand the child an empty directory as its whole PATH, so no engine resolves. node is spawned via process.execPath (absolute), so nothing else in the child cares.

Every existing assertion is about publishing, which completes before the handoff — none of them move.

Guarding the regression

Added two assertions pinning the no-engine branch. Verified they bite: with a stub claude on PATH, the test fails with

The input did not match the regular expression /open an engine to fill it in/
actual: '... · handing 0001 to claude to author…'

Result

before after
that test 420.7s 0.5s
whole suite 479s 70s

1306 tests, 1303 pass, 0 fail, 3 skipped — same 3 skips as main.

One correction

I earlier reported that npm test hangs unless stdin is redirected. That was wrong. npm test now completes in 85s with no redirect; the only issue was ever this test pushing the run past my timeout.

🤖 Generated with Claude Code

`/prd` hands the published PRD to an installed engine to author, and
engineStatus() decides "installed" purely by walking PATH. The healthy-cwd
control was the only test in the file that got far enough to reach that
handoff — its siblings all use a cwd where createPrd() throws first — so on
a machine with `claude` on PATH it really did launch Claude and block until
it finished authoring.

That cost 420s of the suite's 479s, spent real tokens on every run, and gave
a different result depending on who ran it: under a second on CI, where no
engine is installed, seven minutes on a developer's machine.

Give the child an empty directory as its whole PATH so no engine resolves.
node is spawned via process.execPath, so nothing else in the child cares.
The test's existing assertions are all about publishing, which happens
before the handoff, so none of them move.

Also assert the no-engine branch is the one taken, so this cannot quietly
regress: with a stub `claude` on PATH the test fails on that assertion.

Suite: 479s -> 70s. 1306 tests, 1303 pass, 0 fail, 3 skipped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

87 finding(s)

HIGH/CRITICAL: 50 | MEDIUM: 37

Severity Rule Location
HIGH manifest-typosquat apps/pwa/package.json:19
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:45
HIGH secret-generic-credential apps/pwa/test/apikey-bearer-scheme.test.mjs:30
HIGH secret-generic-credential apps/pwa/test/apikey-mask.test.mjs:38
HIGH secret-generic-credential apps/pwa/test/apikey-reveal.test.mjs:35
HIGH secret-generic-credential apps/pwa/test/approvals-context.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/approvals-credits.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/approvals-notify.test.mjs:26
HIGH secret-generic-credential apps/pwa/test/approvals-resolve-race.test.mjs:20
HIGH secret-generic-credential apps/pwa/test/auth-form-email.test.mjs:29
HIGH secret-generic-credential apps/pwa/test/auth-form-email.test.mjs:33
HIGH secret-generic-credential apps/pwa/test/auth-page-error.test.mjs:36
HIGH secret-generic-credential apps/pwa/test/cli-device-token.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/cli-pages-balance.test.mjs:32
HIGH secret-generic-credential apps/pwa/test/cli-token.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/credits-pack.test.mjs:51
HIGH secret-generic-credential apps/pwa/test/credits-webhook-event-match.test.mjs:35
HIGH secret-generic-credential apps/pwa/test/credits-webhook.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/csrf-input-escaping.test.mjs:31
HIGH secret-generic-credential apps/pwa/test/csrf-input-escaping.test.mjs:101
HIGH secret-generic-credential apps/pwa/test/logout-csrf.test.mjs:29
HIGH secret-generic-credential apps/pwa/test/moshpit-api-key.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/moshpit-bulk-claim.test.mjs:23
HIGH secret-generic-credential apps/pwa/test/moshpit-claim-full-name.test.mjs:29
HIGH secret-generic-credential apps/pwa/test/moshpit-crawlable.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/moshpit-ending-page.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/moshpit-pins.test.mjs:22
HIGH secret-generic-credential apps/pwa/test/moshpit-pit-page.test.mjs:33
HIGH secret-generic-credential apps/pwa/test/moshpit-records-page.test.mjs:23
HIGH secret-generic-credential apps/pwa/test/moshpit-records.test.mjs:23
HIGH secret-generic-credential apps/pwa/test/moshpit-registry.test.mjs:20
HIGH secret-generic-credential apps/pwa/test/moshpit-related-endings.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/moshpit-sales.test.mjs:16
HIGH secret-generic-credential apps/pwa/test/moshpit-search.test.mjs:74
HIGH secret-generic-credential apps/pwa/test/moshpit-terms.test.mjs:19
HIGH secret-generic-credential apps/pwa/test/moshpit-tlds-pagination.test.mjs:28
HIGH secret-generic-credential apps/pwa/test/passkey-register-duplicate.test.mjs:38
HIGH secret-generic-credential apps/pwa/test/require-auth-next.test.mjs:31
HIGH secret-generic-credential apps/pwa/test/require-auth-next.test.mjs:35
HIGH secret-generic-credential apps/pwa/test/sessions-output-seq.test.mjs:30
HIGH secret-generic-credential apps/pwa/test/sessions-paste.test.mjs:24
HIGH secret-generic-credential apps/pwa/test/sessions-stream-replay.test.mjs:34
HIGH secret-generic-credential apps/pwa/test/sessions.test.mjs:24
HIGH secret-generic-credential apps/pwa/test/signature.test.mjs:6
HIGH secret-generic-credential test/auth.test.mjs:13
HIGH secret-generic-credential test/auth.test.mjs:63
HIGH secret-generic-credential test/console-cookie-malformed.test.mjs:15
HIGH secret-generic-credential test/console.test.mjs:12
HIGH secret-generic-credential test/mirror.test.mjs:37
HIGH secret-generic-credential test/mirror.test.mjs:77

…and 37 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio marked this pull request as ready for review August 3, 2026 16:51
@ralyodio
ralyodio merged commit 3f84fc3 into main Aug 3, 2026
4 checks passed
@ralyodio
ralyodio deleted the fix/prd-test-no-engine branch August 3, 2026 16:53
@ralyodio ralyodio mentioned this pull request Aug 3, 2026
ralyodio added a commit that referenced this pull request Aug 3, 2026
Three commits have been sitting unreleased on main, two of them the same
trap seen from both ends: an install that succeeds into the wrong home.

  #272  install.sh refuses `sudo curl … | sh` up front, before the
        download, instead of writing the payload into /root/.moshcode
        where the user who typed the command cannot read it.

  #274  `dns` escalates itself per command rather than telling the
        operator to `sudo moshcode …` — advice that was right for dns
        and dangerous for `update`, which self-updates through the
        installer and so reinstalls into root's home.

  #273  the /prd healthy-cwd test no longer launches a real engine; the
        suite went from 479s to ~70s.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant