135 lines
6.0 KiB
Bash
135 lines
6.0 KiB
Bash
#!/usr/bin/env bash
|
|
# CHECK-q149 -- the beam lane's gate, and the eight cells it was not grading.
|
|
#
|
|
# Q149 (2026-11-01): `wizard-work/beam/test_pathguard.py` imported `pytest` for
|
|
# `pytest.raises` alone, on an interpreter with no pytest. The import failed,
|
|
# `run_lane_tests.py` reported all eight cells as one `IMPORT-FAIL` line, and
|
|
# `bash wizard-work/beam/CHECK` read rc 1 -- a red gate, named in Q145's record
|
|
# as "recorded red and untouched", whose cause was a missing library rather than
|
|
# a broken cell. The cells now use the lane's own `beam_assert.raises` shim
|
|
# (Q128's convention), the eight are collected as bare cells, and the duplicate
|
|
# stdlib runner `run_pathguard_tests.py` (added as a workaround, invoked by
|
|
# nothing, module path absolute) is gone.
|
|
#
|
|
# leg 1 `wizard-work/beam/CHECK` is green: no failures, no errors, no import
|
|
# faults, and a floor of 645 collected cells so a lost file reds
|
|
# leg 2 the pathguard module is collected: `test_pathguard.py` 0 unittest,
|
|
# exactly 8 bare cells (the count is the defect's own denominator)
|
|
# leg 3 no file in the lane imports pytest at module level, so the gate does
|
|
# not depend on a package this interpreter does not have
|
|
# leg 4 the eight cells are LIVE: a copy of the lane with pathguard's two
|
|
# containment checks disabled reads rc 1, naming both escape cells
|
|
# leg 5 the duplicate runner is gone from the tree and from disk
|
|
# leg 6 the sweep baseline records the repaired row as 0
|
|
#
|
|
# rc 0 all legs pass, rc 1 a leg faulted, rc 2 could not grade.
|
|
set -u
|
|
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" || { echo "CANNOT GRADE: no directory"; exit 2; }
|
|
ROOT="$(git -C "$HERE" rev-parse --show-toplevel 2>/dev/null)" || { echo "CANNOT GRADE: not a git repository"; exit 2; }
|
|
LANE="$ROOT/wizard-work/beam"
|
|
RUNNER="$LANE/run_lane_tests.py"
|
|
BASE="$ROOT/wizard-work/volt/q143-check-sweep/check_entry_baseline.tsv"
|
|
for f in "$LANE/CHECK" "$RUNNER" "$LANE/test_pathguard.py" "$LANE/pathguard.py" "$BASE"; do
|
|
[ -f "$f" ] || { echo "CANNOT GRADE: missing $f"; exit 2; }
|
|
done
|
|
PY="${PYTHON:-python3}"
|
|
WORK="$(mktemp -d "${TMPDIR:-/tmp}/q149.XXXXXX")" || exit 2
|
|
trap 'rm -rf "$WORK"' EXIT
|
|
|
|
faults=0
|
|
pass() { echo "PASS $1"; }
|
|
fail() { echo "FAIL $1"; faults=$((faults+1)); }
|
|
|
|
# leg 1 -- the lane gate itself
|
|
if out="$(bash "$LANE/CHECK" 2>&1)"; then
|
|
summary="$(printf '%s\n' "$out" | grep '^lane: .*test(s)' | tail -1)"
|
|
total="$(printf '%s' "$summary" | sed -n 's/.*, \([0-9]\{1,\}\) test(s),.*/\1/p')"
|
|
if printf '%s' "$summary" | grep -q ' 0 failure(s), 0 error(s), 0 import fault(s)'; then
|
|
if [ -n "$total" ] && [ "$total" -ge 645 ]; then
|
|
pass "beam-gate rc=0 cells=$total $(printf '%s' "$summary" | sed 's/^lane: //')"
|
|
else
|
|
fail "beam-gate cell floor: total='${total}' < 645"
|
|
fi
|
|
else
|
|
fail "beam-gate green rc but faults in summary: $summary"
|
|
fi
|
|
else
|
|
fail "beam-gate red (rc=$?)"
|
|
printf '%s\n' "$out" | grep -E '^(IMPORT-FAIL|FAIL|SCRIPT-FAIL)' | head -4
|
|
fi
|
|
|
|
# leg 2 -- the repaired module is collected, and the eight are its count
|
|
if out="$("$PY" "$RUNNER" --lane "$LANE" --list 2>&1)"; then
|
|
row="$(printf '%s\n' "$out" | grep '^test_pathguard.py ')"
|
|
if printf '%s' "$row" | grep -q 'unittest=0 *bare=8 *$'; then
|
|
pass "pathguard-collected $row"
|
|
else
|
|
fail "pathguard not collected as 8 bare cells: ${row:-no row}"
|
|
fi
|
|
else
|
|
fail "runner --list rc=$?"
|
|
fi
|
|
|
|
# leg 3 -- no module-level pytest import anywhere in the lane. Column 0 only:
|
|
# `test_interval_tree.py:82` imports pytest inside `if __name__ == "__main__"`,
|
|
# which never runs under an import and is not the defect class (measured -- a
|
|
# grep that ignored indentation named it, and the runner's 0 import faults
|
|
# beside it is the reading that settled which one is right).
|
|
third="$(grep -nE '^(import pytest|from pytest)' "$LANE"/*.py 2>/dev/null)"
|
|
if [ -z "$third" ]; then
|
|
pass "no third-party import at module level ($(ls "$LANE"/*.py | wc -l) file(s) scanned)"
|
|
else
|
|
fail "third-party import at module level: $(printf '%s' "$third" | head -2 | tr '\n' ' ')"
|
|
fi
|
|
|
|
# leg 4 -- the cells are live: disable pathguard's containment checks in a copy
|
|
cp -a "$LANE" "$WORK/lane" 2>/dev/null && [ -f "$WORK/lane/pathguard.py" ] \
|
|
|| { echo "CANNOT GRADE: cannot copy $LANE"; exit 2; }
|
|
"$PY" - "$WORK/lane/pathguard.py" <<'PY'
|
|
import sys
|
|
p = sys.argv[1]
|
|
s = open(p, encoding="utf-8").read()
|
|
a = " if not _is_under(resolved, base_path):"
|
|
b = " if not _is_under(Path(norm), base_path):"
|
|
if a not in s or b not in s:
|
|
print("CANNOT MUTATE")
|
|
raise SystemExit(2)
|
|
s = s.replace(a, " if False and not _is_under(resolved, base_path):")
|
|
s = s.replace(b, " if False and not _is_under(Path(norm), base_path):")
|
|
open(p, "w", encoding="utf-8").write(s)
|
|
PY
|
|
mrc=$?
|
|
if [ "$mrc" -ne 0 ]; then
|
|
echo "CANNOT GRADE: mutant not applied ($mrc)"; exit 2
|
|
fi
|
|
out="$("$PY" "$WORK/lane/run_lane_tests.py" --lane "$WORK/lane" 2>&1)"; rc=$?
|
|
if [ "$rc" -eq 1 ] \
|
|
&& printf '%s\n' "$out" | grep -q '^FAIL: test_pathguard.test_dotdot_escape_rejected' \
|
|
&& printf '%s\n' "$out" | grep -q '^FAIL: test_pathguard.test_symlink_escape_rejected'; then
|
|
pass "mutant red: $(printf '%s\n' "$out" | grep -c '^FAIL: test_pathguard') pathguard cell(s) named"
|
|
else
|
|
fail "mutant not graded red by the two escape cells (rc=$rc)"
|
|
printf '%s\n' "$out" | grep -E '^(FAIL|ERROR)' | head -4
|
|
fi
|
|
|
|
# leg 5 -- the duplicate workaround runner is gone
|
|
in_git="$(git -C "$ROOT" ls-files -- wizard-work/beam/run_pathguard_tests.py)"
|
|
if [ -z "$in_git" ] && [ ! -e "$ROOT/wizard-work/beam/run_pathguard_tests.py" ]; then
|
|
pass "duplicate runner absent from index and disk"
|
|
else
|
|
fail "duplicate runner still present: ${in_git:-on disk but untracked}"
|
|
fi
|
|
|
|
# leg 6 -- the sweep's row for the repaired gate reads 0
|
|
row="$(grep -P '^wizard-work/beam/CHECK\t' "$BASE" | head -1)"
|
|
code="$(printf '%s' "$row" | cut -f2)"
|
|
if [ "$code" = "0" ]; then
|
|
pass "baseline row reads 0: $(printf '%s' "$row" | cut -f3)"
|
|
else
|
|
fail "baseline row for wizard-work/beam/CHECK reads '${code:-absent}'"
|
|
fi
|
|
|
|
echo "q149: $((6-faults)) of 6 leg(s) passed"
|
|
[ "$faults" -eq 0 ] || exit 1
|
|
exit 0
|