Skip to content

fix(tests): route argv regression through bounded CLI harness - #2677

Merged
chaliy merged 1 commit into
mainfrom
fix/threat-harness-argv
Oct 11, 2026
Merged

chaliy merged 1 commit into
mainfrom
fix/threat-harness-argv

Conversation

@chaliy

@chaliy chaliy commented Oct 11, 2026

Copy link
Copy Markdown
Contributor

What changed

Generalizes run_cli_bounded with a run_cli_argv_bounded(script, extra_args, limit) variant and deletes the hand-rolled argv reader the TM-DOS-136 regression carried. One file, net -46 lines.

Why

The #2676 harness rewrite changed BoundedRun's shape (oversized/incomplete tracking, fail-closed CPU/stack launcher). The TM-DOS-136 multiline-token x long-ARG0 regression still constructed the old shape, so the integration test binary did not compile on main after the #2675 squash merge — main is red (Test + Lint fail on ec540f4). This routes the vector through the new harness, keeping the fail-closed caps and real producer exit codes.

Before / After

Before: cargo test -p bashkit --test integration --no-run fails with E0063 on main.
After: compiles; threat_model 214 passed (skipping only the pre-existing macOS stack-overflow abort in misconfig_huge_ast_depth_still_safe, identical on unmodified code); error:: 14 passed; fmt + clippy clean.

Risk

  • Test-only change. No production code touched.

Checklist

  • Tests added or updated
  • Backward compatibility considered (internal test harness)

The #2676 harness rewrite changed BoundedRun's shape; the TM-DOS-136
argv regression still constructed the old shape and broke the
integration binary on main. Generalize run_cli_bounded with an
extra-args variant and delegate, so the multiline-token x long-ARG0
vector keeps the fail-closed CPU/stack caps and real producer exit
codes.
@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs
bashkit ec69660 Commit Preview URL

Branch Preview URL
Oct 11 2026, 05:20 AM

@chaliy

chaliy commented Oct 11, 2026

Copy link
Copy Markdown
Contributor Author

PR2677 correctly removes the separate unbounded argv collector and delegates
to the reviewed shared fail-closed launcher. Finish this existing PR, not a
duplicate corrective branch/PR.

Remaining proof gap at ec69660: the multiline-times-ARG0 child test checks
timed_out, exit2 and sampled stderr but omits oversized, incomplete_readers
and effective CPU/stack readback, unlike adjacent indirect hostile tests.
Assert !oversized, !incomplete_readers and harness-limits stack=4096/cpu=10
for both multiline scales. Do not accept incomplete sampled output as proof.
Keep exact ARG0/scales and finite Bash parity; do not weaken caps/assertions.

2675 had48green BEFORE squash, but actual merged ec540f4 includes2676's
new BoundedRun shape and stale argv helper fails compilation E0063. Main
Coverage really failed. This is not verified shipping. Read ALL full issue
comments/review threads, not only empty formal reviews, before final merge.

Current watcher exits0 on zero pending even if checks failed. That proves
terminal polling only. Inspect actual required conclusions at final head.
Cargo|tail producer exits are not cargo exits. The filtered214-pass suite
skipping misconfig_huge_ast_depth_still_safe is partial, not a full-gate waiver.
Preserve matched clean-main diagnosis and require unchanged Linux full gates
green; no new skips or raised stack limits.

After reviewed2677 green squash merge, rebuild exact merge, run original
scaled multiline-token x8192ARG0 child proof and finite/error regressions
with real assertion/producer exits and durable logs. Verify main ancestry
and result schema. No cloud closure before independent monitor proof.
Preserve worktree/branch history; existing corrective PR must be reused.

@chaliy
chaliy merged commit 2f92f41 into main Oct 11, 2026
33 checks passed
@chaliy
chaliy deleted the fix/threat-harness-argv branch October 11, 2026 05:49
chaliy added a commit that referenced this pull request Oct 11, 2026
#2680)

## What changed\nTest-only: the TM-DOS-136 scaled multiline-token x
long-ARG0 regression now asserts the full bounded-harness contract at
both scales (200/2000 token lines x 8 KiB ARG0): no watchdog timeout,
raw child exit 2, no 64 KiB output-cap overshoot, finished reader
threads, and effective stack=4096/cpu=10 caps read back from the
launcher line. Shape (Bash-compatible `syntax error`) and flat <=1 KiB
stderr assertions unchanged. Reuses the reviewed shared launcher; no
argv-specific readers.\n\n## Why\nFollowup to the review on #2675
(comment 6105424708) and the #2677 proof note: a sampled diagnostic and
raw exit 2 alone do not prove the full bounds contract. This adds the
same explicit assertions the adjacent hostile-indirect tests
carry.\n\n## Before / After\nBefore: the regression proved exit 2 +
shape + <=1024 bytes only.\nAfter: it additionally proves !oversized,
!incomplete_readers, and the effective fail-closed CPU/stack caps, per
scale.\n\n```\ntest result: ok. 1 passed (syntax_diagnostic_multiline,
both scales)\ntest result: ok. indirect suite green\ncargo fmt --check:
clean; cargo clippy -p bashkit --all-targets: clean\n```\n\n## Risk\n-
Test-only change. No production code touched.\n\n## Checklist\n- [x]
Tests added or updated\n- [x] Backward compatibility considered
(internal test harness)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant