Merge remote-tracking branch 'origin/main' into fix/tricks-double-source-and-paru-wrapper-dedup

This commit is contained in:
2026-09-08 01:30:43 -04:00
21 changed files with 700 additions and 214 deletions
@@ -228,16 +228,15 @@ function __tailscale_prepare_completions
return 0
end
# Since Fish completions are only loaded once the user triggers them, we trigger them ourselves
# so we can properly delete any completions provided by another script.
# Only do this if the program can be found, or else fish may print some errors; besides,
# the existing completions will only be loaded if the program can be found.
if type -q "tailscale"
# The space after the program name is essential to trigger completion for the program
# and not completion of the program name itself.
# Also, we use '> /dev/null 2>&1' since '&>' is not supported in older versions of fish.
complete --do-complete "tailscale " > /dev/null 2>&1
end
# REMOVED (2026-09-07): Cobra's self-priming block —
# if type -q "tailscale"; complete --do-complete "tailscale " >/dev/null 2>&1; end
# It existed to force any pre-existing tailscale completions to load so the
# `complete -c tailscale -e` below could erase them. From completions/ it has
# no job: fish autoloads only the FIRST match on $fish_complete_path, and
# $__fish_config_dir/completions precedes /usr/share/fish/vendor_completions.d,
# so the vendor file is never sourced and there is nothing to erase. It also
# executed the tailscale binary at startup. Verified: completion output is
# byte-identical with and without it. See AGENTS/specs/2026-09-07-startup-latency-design.md D2.
# Remove any pre-existing completions for the program since we will be handling all of them.
complete -c tailscale -e
+3
View File
@@ -12,6 +12,9 @@
# site abbr-integrations: integrations/terminal-abbrs
# site abbr-overrides: overrides/key-bindings
# Abbreviations only expand in the line editor; a script can never use one.
status is-interactive; or return
# Neovim
# @category Editors
# @desc nvim
+5
View File
@@ -13,6 +13,11 @@
#
# Manage the registry with: auto-pull add / remove / list / status
# Registers an --on-variable PWD handler that backgrounds a git fetch. In a
# script that cd's, that is both wasted work and AGENTS.md Task #4's
# credential-prompt hazard fired from a background job.
status is-interactive; or return
# C2 guard: when auto-execution is disabled, do not register the handler.
__fish_config_op_enabled (status basename); or exit
+4
View File
@@ -7,6 +7,10 @@
# Provides bash-style history expansion functions for abbreviations.
# These functions are gated by the C3 overrides switch.
# The six expand_* functions are reachable only through abbr --function
# (conf.d/abbr.fish:677-697), i.e. only during interactive expansion.
status is-interactive; or return
# Execute expand_bang_all
function expand_bang_all --description 'Execute expand_bang_all'
# Opinionated guard (C3): no expansion when overrides are disabled.
+4
View File
@@ -47,6 +47,10 @@
# This allows for rapid-fire math without leaving the current shell.
# ──────────────────────────────────────────────────────────────────────
# Defines only fish_user_key_bindings, which fish calls from the interactive
# reader and nowhere else.
status is-interactive; or return
function fish_user_key_bindings
# Custom key chords are opinionated (C3 overrides); skip them entirely
+6
View File
@@ -13,6 +13,12 @@
# solely in functions/ are never registered and their --on-variable triggers
# never fire.
# Calls __fish_config_sync_logging at every shell start, which mkdir+touches
# the C5 sentinel on disk. Its only consumers — the Kitty watcher and the
# paru/yay wrappers — are interactive-context; every interactive shell still
# refreshes it.
status is-interactive; or return
function __fish_config_logging_changed --on-variable __fish_config_op_logging \
--description 'C5 event handler: sync logging state when __fish_config_op_logging changes'
__fish_config_sync_logging
+4
View File
@@ -10,6 +10,10 @@
# site paru-autoexec: autoexec/pkg-wrappers
# site paru-logging: logging/pkg-logs
# Defines nothing; its only effect is generating ~/.local/bin/paru, an
# idempotent write every interactive session already performs.
status is-interactive; or return
# Auto-generating a wrapper in ~/.local/bin is opinionated (C2 auto-exec).
# Wrapper generation is also gated by C5 (Logging & Capture).
__fish_config_op_enabled (status basename) paru-autoexec; or return
+4
View File
@@ -9,6 +9,10 @@
# Without starship, fish's built-in prompt already emits OSC 133;A
# on the prompt line itself, so no wrapper is needed.
# Defines fish_prompt; no script renders a prompt. Checked before the
# op-guard so the builtin short-circuits ahead of three function autoloads.
status is-interactive; or return
# Replacing the prompt is opinionated (C3 overrides)
__fish_config_op_enabled (status basename); or return
+5
View File
@@ -20,6 +20,11 @@ if not __fish_config_op_enabled (status basename)
return
end
# Below the cleanup block on purpose: that branch erases a stale universal
# FZF_DEFAULT_OPTS and must keep running wherever it runs today. Everything
# past here is fish_color_* for the syntax highlighter, interactive-only.
status is-interactive; or return
# ────────────────────── Syntax highlighting colors ──────────────────────
set --global fish_color_autosuggestion 6c7086
set --global fish_color_cancel f38ba8
+4
View File
@@ -9,6 +9,10 @@
# site wakatime-autoexec: autoexec/telemetry
# site wakatime-hook: integrations/notifications
# Registers a fish_postexec handler; that event is emitted only by the
# interactive reader, so the handler is dead weight in a script.
status is-interactive; or return
# Local modification: opinionated guard (AGENTS.md Task #3). WakaTime
# reporting is classified under both C2 auto-execution and C4 integrations;
# disabling either category skips registering the hook.
+4
View File
@@ -10,6 +10,10 @@
# site yay-autoexec: autoexec/pkg-wrappers
# site yay-logging: logging/pkg-logs
# Defines nothing; its only effect is generating ~/.local/bin/yay, an
# idempotent write every interactive session already performs.
status is-interactive; or return
# Auto-generating a wrapper in ~/.local/bin is opinionated (C2 auto-exec).
# Wrapper generation is also gated by C5 (Logging & Capture).
__fish_config_op_enabled (status basename) yay-autoexec; or return
+3 -4
View File
@@ -46,7 +46,6 @@ The configuration uses a structured file tree:
├── conf.d/
│ ├── abbr.fish All abbreviations
│ ├── autopair.fish Auto-pair brackets and quotes
│ ├── cheat.fish cheat.sh tab completions
│ ├── done.fish Desktop notifications for long commands
│ ├── first_run.fish One-time init: Fisher bootstrap, theme
│ ├── key_bindings.fish Custom key bindings and Vi mode
@@ -58,14 +57,13 @@ The configuration uses a structured file tree:
│ ├── zellij-logging.fish C5 fish_exit handler for zellij
│ ├── sponge_privacy.fish Sponge privacy patterns
│ ├── starship.fish fish_prompt shell-integration markers
│ ├── tailscale.fish Tailscale CLI tab completions
│ ├── theme.fish Catppuccin syntax highlight colors
│ ├── tricks.fish PATH, bang-bang helpers, bat man pages
│ ├── wakatime.fish WakaTime shell hook
│ ├── yay-wrapper.fish Auto-generates yay logging wrapper
│ └── zoxide.fish Zoxide z/zi integration; overrides cd
├── functions/ Custom functions, one per file
├── completions/ Tab completion scripts
├── completions/ Tab completion scripts, autoloaded on demand
├── integrations/
│ └── fzf.fish FZF Catppuccin theme and key bindings
├── scripts/
@@ -245,7 +243,8 @@ Every shell command is reported to WakaTime for time-tracking. Set
### Tailscale
Full tab completion for the `tailscale` CLI is provided via `conf.d/tailscale.fish`.
Full tab completion for the `tailscale` CLI is provided via
`completions/tailscale.fish`, autoloaded on the first `tailscale<TAB>`.
### Done Notifications
+2 -1
View File
@@ -118,7 +118,8 @@ Every shell command is reported to WakaTime for time-tracking. Set
### Tailscale
Full tab completion for the `tailscale` CLI is provided via `conf.d/tailscale.fish`.
Full tab completion for the `tailscale` CLI is provided via
`completions/tailscale.fish`, autoloaded on the first `tailscale<TAB>`.
### Done Notifications
+1 -3
View File
@@ -35,7 +35,6 @@ The configuration uses a structured file tree:
├── conf.d/
│ ├── abbr.fish All abbreviations
│ ├── autopair.fish Auto-pair brackets and quotes
│ ├── cheat.fish cheat.sh tab completions
│ ├── done.fish Desktop notifications for long commands
│ ├── first_run.fish One-time init: Fisher bootstrap, theme
│ ├── key_bindings.fish Custom key bindings and Vi mode
@@ -47,14 +46,13 @@ The configuration uses a structured file tree:
│ ├── zellij-logging.fish C5 fish_exit handler for zellij
│ ├── sponge_privacy.fish Sponge privacy patterns
│ ├── starship.fish fish_prompt shell-integration markers
│ ├── tailscale.fish Tailscale CLI tab completions
│ ├── theme.fish Catppuccin syntax highlight colors
│ ├── tricks.fish PATH, bang-bang helpers, bat man pages
│ ├── wakatime.fish WakaTime shell hook
│ ├── yay-wrapper.fish Auto-generates yay logging wrapper
│ └── zoxide.fish Zoxide z/zi integration; overrides cd
├── functions/ Custom functions, one per file
├── completions/ Tab completion scripts
├── completions/ Tab completion scripts, autoloaded on demand
├── integrations/
│ └── fzf.fish FZF Catppuccin theme and key bindings
├── scripts/
-114
View File
@@ -1,114 +0,0 @@
# Copyright (C) 2026 Rootiest
# SPDX-License-Identifier: AGPL-3.0-or-later
#
# Functional checks for foundational config behavior. Sourced inside a
# fully-loaded, sandboxed interactive fish session by tests/run-tests.fish
# -- see that file for the sandbox setup. Each test_* function returns 0
# on pass, non-zero on fail; functional_test_main collects and runs them.
function test_xdg_defaults
test -n "$XDG_CONFIG_HOME" -a -n "$XDG_CACHE_HOME" \
-a -n "$XDG_DATA_HOME" -a -n "$XDG_STATE_HOME"
end
function test_path_additions
contains -- "$HOME/.local/bin" $PATH
end
function test_cdpath
contains -- "$HOME/projects" $CDPATH
end
function test_vi_key_bindings
test "$fish_key_bindings" = fish_vi_key_bindings
end
function test_abbreviations_loaded
abbr -q n
end
function test_core_functions_defined
for f in cat logs config-help fish-deps check_fish_deps config-settings
if not functions -q $f
echo " missing function: $f"
return 1
end
end
end
function test_exit_rewired
functions -q exit
and functions exit | string match -q '*smart_exit*'
end
function test_op_registry_lookup
functions -q __fish_config_op_registry_lookup
or return 1
set -l tags (__fish_config_op_registry_lookup config cdpath)
test $status -eq 0 -a (count $tags) -gt 0
end
function test_privacy_variables
test "$DO_NOT_TRACK" = "1" -a "$DISABLE_TELEMETRY" = "1"
end
function test_privacy_op_registry_lookup
functions -q __fish_config_op_registry_lookup
or return 1
set -l tags (__fish_config_op_registry_lookup config privacy)
test $status -eq 0 -a "$tags" = "overrides/privacy"
end
function test_op_enabled_fail_open
# An identity/site pair with no registry entry must resolve to
# enabled -- the documented fail-open default.
__fish_config_op_enabled __fish_config_test_never_registered somesite
end
function test_greeting_function_defined
functions -q fish_greeting
end
function test_agents_vault_defined
for f in agents-vault _agents_vault_dir _agents_repo_slug \
_agents_repo_ensure_symlink _agents_repo_sync \
_agents_repo_install_tools
if not functions -q $f
echo " missing function: $f"
return 1
end
end
end
function test_wrappers_call_agents_vault
functions -q claude; or return 1
functions claude | string match -q '*agents-vault*'; or return 1
functions -q agy; or return 1
functions agy | string match -q '*agents-vault*'
end
function test_vault_dir_honors_override
set -l saved
set -q __fish_agent_vault_dir; and set saved $__fish_agent_vault_dir
set -g __fish_agent_vault_dir /tmp/vault-override-check
set -l got (_agents_vault_dir)
set -e __fish_agent_vault_dir
test (count $saved) -gt 0; and set -g __fish_agent_vault_dir $saved
test "$got" = /tmp/vault-override-check
end
function functional_test_main
set -l names (functions -a | string match 'test_*' | sort)
set -l failed 0
for name in $names
if $name
echo " PASS $name"
else
echo " FAIL $name"
set failed (math $failed + 1)
end
end
echo ""
echo (math (count $names) - $failed)"/"(count $names)" passed"
return $failed
end
+62
View File
@@ -0,0 +1,62 @@
#!/usr/bin/env fish
# Copyright (C) 2026 Rootiest
# SPDX-License-Identifier: AGPL-3.0-or-later
#
# Shared assertion and reporting core for tests/test-*.fish.
#
# One assertion: `check <label> <want> <got>`, string equality. Status
# assertions use the two-line form, which is the point -- it can say "I
# expected exactly 1", where a pass/fail predicate can only say "non-zero":
#
# __fish_config_op_cascade __probe_cat
# check "all unset -> enabled" 0 $status
#
# That distinction matters here: __fish_variable_check returns four distinct
# codes (0 truthy, 1 falsy, 2 unset/empty, 3 unrecognized) and the cascade's
# behavior depends on telling 2 and 3 apart from 1.
#
# Boolean assertions use the idiom the vault suite already uses throughout:
#
# check "label" true (some-test; and echo true; or echo false)
set -g TESTS_RUN 0
set -g TESTS_FAILED 0
# The driver always sets this; the fallback is for running a suite by hand.
if set -q FISH_CONFIG_TEST_ROOT
set -g repo_root $FISH_CONFIG_TEST_ROOT
else
set -g repo_root (realpath (dirname (status filename))/..)
end
function section
echo ""
echo "== $argv[1] =="
end
function check --argument-names label want got
set -g TESTS_RUN (math $TESTS_RUN + 1)
if test "$want" = "$got"
echo " PASS $label"
else
echo " FAIL $label"
echo " want: $want"
echo " got: $got"
set -g TESTS_FAILED (math $TESTS_FAILED + 1)
end
end
function report
echo ""
echo (math $TESTS_RUN - $TESTS_FAILED)"/$TESTS_RUN passed"
if set -q FISH_CONFIG_TEST_COUNTS
echo "$TESTS_RUN $TESTS_FAILED" >>$FISH_CONFIG_TEST_COUNTS
end
# Explicit terminal status, never a trailing `if` (AGENTS.md item 5).
# This is form, not a bug fix: fish clamps `exit`/`return` to 255 rather
# than wrapping mod 256, so `exit $TESTS_FAILED` could not have produced
# a false green. Verified: `fish -c 'exit 256'` -> 255, while
# `sh -c 'exit 256'` -> 0. A boolean is still the right shape -- it
# composes with `and`/`or`, which a raw count does not.
test $TESTS_FAILED -eq 0
end
+160 -63
View File
@@ -4,15 +4,19 @@
#
# CI test runner for this fish configuration.
# 1. Syntax-lints every tracked .fish file (fish -n).
# 2. Copies the config-relevant files into a throwaway sandbox (never
# the live checkout -- this repo doubles as a real ~/.config/fish,
# so a symlinked sandbox would let universal-variable writes like
# first-run's escape into the real, gitignored fish_variables file)
# and loads it as an isolated interactive session.
# 3. Runs the functional checks in tests/functional.fish inside that
# loaded session.
# 4. Runs tests/test-agents-vault.fish as its own process; that suite
# builds its own throwaway repos and needs no loaded config.
# 2. Discovers tests/test-*.fish and reads the mode each suite declares
# in its own header (`# MODE: isolated` or `# MODE: in-session`).
# 3. Runs each isolated suite as its own --no-config fish process with
# throwaway XDG dirs.
# 4. Sources every in-session suite into ONE sandboxed interactive fish
# session built from a copy of this config (never the live checkout
# -- this repo doubles as a real ~/.config/fish, so a symlinked
# sandbox would let universal-variable writes like first-run's escape
# into the real, gitignored fish_variables file).
# 5. Sums the per-suite assertion counts and reports a total.
#
# Assertions come from tests/lib.fish (section/check/report); suites are
# never special-cased here by name.
#
# Usage: fish tests/run-tests.fish
@@ -42,61 +46,154 @@ if test $lint_failed -ne 0
set overall_failed 1
end
# ---- Phase 2: isolated load + functional checks --------------------------
# ---- Phase 2: discover suites --------------------------------------------
# Mode is declared by the suite, not by this driver. Detection is
# case-insensitive so a near-miss like "# Mode: in-session" is caught rather
# than silently read as "no marker"; the comparison is exact so only the two
# real spellings are accepted. Absence means isolated, the safe default -- a
# suite that forgets the marker gets its own clean process instead of being
# injected into a loaded session, and no typo can ever promote a suite into
# in-session. Duplicate markers resolve first-match-wins.
set -l isolated_suites
set -l session_suites
for f in (find $script_dir -name 'test-*.fish' | sort)
set -l decl (grep -im1 '^# *mode:' $f)
if test -z "$decl"
set -a isolated_suites $f
else if test "$decl" = "# MODE: in-session"
set -a session_suites $f
else if test "$decl" = "# MODE: isolated"
set -a isolated_suites $f
else
echo " FAIL "(basename $f)": unrecognized mode declaration: $decl" >&2
set overall_failed 1
end
end
set -l counts (mktemp)
# ---- Phase 3: isolated suites --------------------------------------------
# HOME is deliberately NOT overridden here. Read this before "improving" it.
#
# Overriding XDG_CONFIG_HOME/XDG_DATA_HOME plus --no-config is what makes these
# runs isolated: the universal-variable file fish can reach is a fresh empty
# one, and no config.fish/conf.d is loaded. Without that, an "isolated" suite
# runs against the user's LIVE config and real universal variables -- this repo
# doubles as a real ~/.config/fish -- so a guard test doing
# `set -e __fish_config_op_logging` would erase a real universal variable out of
# the running shell. Measured: $__fish_config_op_registry_keys has 65 entries
# under a plain `fish`, 0 under `fish --no-config`.
#
# `env -i HOME=$sandbox` was tried and REJECTED. It looks strictly more
# hermetic, but test-agents-vault.fish's hermeticity floor snapshots the real
# $HOME/.claude/memory and $HOME/.gemini/antigravity-cli and asserts them
# unchanged at the end. Point HOME at a sandbox and both snapshots read "absent"
# before and after: the assertions still pass while asserting nothing. A change
# that turns a real assertion into a tautology without turning anything red is
# the worst failure mode a test harness has. Keeping HOME real is what keeps
# those two assertions biting.
#
# Overriding XDG_DATA_HOME is a hermeticity gain on top of the isolation:
# _agents_vault_dir falls back to
# ${XDG_DATA_HOME:-$HOME/.local/share}/agent-vault, so a vault path that no test
# overrode lands in a temp dir instead of the user's real ~/.local/share.
for suite in $isolated_suites
echo ""
echo "== "(string replace $repo_root/ '' $suite)" =="
set -l xdg (mktemp -d)
env XDG_CONFIG_HOME=$xdg/cfg XDG_DATA_HOME=$xdg/data \
FISH_CONFIG_TEST_ROOT=$repo_root FISH_CONFIG_TEST_COUNTS=$counts \
fish --no-config $suite
if test $status -ne 0
set overall_failed 1
end
command rm -rf $xdg
end
# ---- Phase 4: in-session suites ------------------------------------------
# All in-session suites share ONE sandboxed interactive session: building it
# (copying the config, starting fish -i) is the expensive part.
#
# The config is COPIED, never symlinked. This repo doubles as a real
# ~/.config/fish, so a symlinked sandbox would let universal-variable writes
# like first-run's escape into the real, gitignored fish_variables file.
if test (count $session_suites) -gt 0
echo ""
echo "== Sandboxed load + session checks =="
set -l sandbox (mktemp -d)
set -l sandbox_cfg $sandbox/xdgcfg/fish
mkdir -p $sandbox_cfg
# path-setup only adds directories that already exist (fish_add_path is a
# no-op on missing paths), so give it $HOME/.local/bin to find.
mkdir -p $sandbox/home/.local/bin
# Every utility below goes through `command`. This driver runs under the
# very config it tests, which shadows these: `cp` is an alias for `cp -i`,
# `rm` is a trash wrapper, `cat` resolves to bat. Only `cp` is an actual
# hazard today -- `-i` on a non-empty destination reads EOF in a
# non-interactive runner and SILENTLY SKIPS the copy while exiting 0,
# which would leave the sandbox missing config files and report success.
# `rm -rf` and `cat` were measured and behave correctly as-is (the rm
# wrapper bails to `command rm` on any non-recursive flag, so -rf really
# deletes and does not trash). Prefixed anyway: a test runner must not
# depend on the configuration under test.
command cp $repo_root/config.fish $sandbox_cfg/
test -f $repo_root/fish_plugins
and command cp $repo_root/fish_plugins $sandbox_cfg/
for d in functions conf.d completions integrations themes data
test -d $repo_root/$d
and command cp -r $repo_root/$d $sandbox_cfg/
end
set -l srcs
for s in $session_suites
set -a srcs "source $s;"
end
set -l err_file (mktemp)
env -i \
HOME=$sandbox/home \
XDG_CONFIG_HOME=$sandbox/xdgcfg \
PATH="$PATH" \
TERM=xterm \
__fish_config_op_autoexec=off \
FISH_CONFIG_TEST_ROOT=$repo_root \
FISH_CONFIG_TEST_COUNTS=$counts \
fish -i -c "source $repo_root/tests/lib.fish; $srcs report" \
2>$err_file
set -l session_status $status
set -l stderr_out (command cat $err_file)
command rm -rf $sandbox $err_file
if test -n "$stderr_out"
# Diagnostic only, not a gate: on machines with vendor fish configs
# (e.g. CachyOS's cachyos-fish-config, which this repo's config.fish
# sources when present) unrelated vendor warnings can land here. Real
# breakage in this repo's own code is caught by the assertions.
echo " Session stderr output (informational):"
printf '%s\n' $stderr_out
end
if test $session_status -ne 0
set overall_failed 1
end
end
# ---- Phase 5: totals -----------------------------------------------------
set -l total_run 0
set -l total_failed 0
for line in (command cat $counts)
set -l parts (string split ' ' -- $line)
set total_run (math $total_run + $parts[1])
set total_failed (math $total_failed + $parts[2])
end
command rm -f $counts
echo ""
echo "== Sandboxed load + functional checks =="
set -l sandbox (mktemp -d)
set -l sandbox_cfg $sandbox/xdgcfg/fish
mkdir -p $sandbox_cfg
# path-setup only adds directories that already exist (fish_add_path is a
# no-op on missing paths), so give it $HOME/.local/bin to find.
mkdir -p $sandbox/home/.local/bin
cp $repo_root/config.fish $sandbox_cfg/
test -f $repo_root/fish_plugins
and cp $repo_root/fish_plugins $sandbox_cfg/
for d in functions conf.d completions integrations themes data
test -d $repo_root/$d
and cp -r $repo_root/$d $sandbox_cfg/
end
set -l err_file (mktemp)
env -i \
HOME=$sandbox/home \
XDG_CONFIG_HOME=$sandbox/xdgcfg \
PATH="$PATH" \
TERM=xterm \
__fish_config_op_autoexec=off \
fish -i -c "source $repo_root/tests/functional.fish; functional_test_main" \
2>$err_file
set -l functional_status $status
set -l stderr_out (cat $err_file)
rm -rf $sandbox $err_file
if test -n "$stderr_out"
# Diagnostic only, not a gate: on machines with vendor fish configs
# (e.g. CachyOS's cachyos-fish-config, which this repo's config.fish
# sources when present) unrelated vendor warnings can land here. Real
# breakage in this repo's own code is caught by the assertions below.
echo " Session stderr output (informational):"
printf '%s\n' $stderr_out
end
if test $functional_status -ne 0
set overall_failed 1
end
# ---- Phase 3: hermetic vault helper tests --------------------------------
# Run as its own fish process rather than inside the sandboxed session:
# the suite builds its own throwaway git repos and binds the vault, claude
# and agy roots to them, so it needs no loaded config and must never see
# the real ~/.claude.
echo ""
echo "== Vault helper tests =="
fish $repo_root/tests/test-agents-vault.fish
if test $status -ne 0
echo "TOTAL: "(math $total_run - $total_failed)"/$total_run assertions passed"
if test $total_failed -ne 0
set overall_failed 1
end
+2 -19
View File
@@ -8,12 +8,9 @@
#
# Usage: fish tests/test-agents-vault.fish
set -l here (realpath (dirname (status filename)))
set -g repo_root (realpath $here/..)
source (realpath (dirname (status filename)))/lib.fish
set -p fish_function_path $repo_root/functions
set -g TESTS_RUN 0
set -g TESTS_FAILED 0
set -g TMPDIRS
# The suite is hermetic against $HOME and ~/.claude, but it was not
@@ -50,18 +47,6 @@ set -gx GIT_CONFIG_VALUE_0 false
set -gx GIT_CONFIG_KEY_1 init.defaultBranch
set -gx GIT_CONFIG_VALUE_1 main
function check --argument-names label want got
set -g TESTS_RUN (math $TESTS_RUN + 1)
if test "$want" = "$got"
echo " PASS $label"
else
echo " FAIL $label"
echo " want: $want"
echo " got: $got"
set -g TESTS_FAILED (math $TESTS_FAILED + 1)
end
end
# Failure injection that survives uid 0.
#
# These fixtures used to force a failure with `chmod 500` on a parent
@@ -1995,6 +1980,4 @@ set -e __fish_agent_vault_claude_home
set -e __fish_agent_vault_agy_root
cleanup
echo ""
echo (math $TESTS_RUN - $TESTS_FAILED)"/$TESTS_RUN passed"
exit $TESTS_FAILED
report
+331
View File
@@ -0,0 +1,331 @@
#!/usr/bin/env fish
# Copyright (C) 2026 Rootiest
# SPDX-License-Identifier: AGPL-3.0-or-later
#
# Table-driven coverage of the opinionated-component guard system:
# __fish_variable_check, __fish_config_op_cascade,
# __fish_config_op_registry_lookup and __fish_config_op_enabled.
#
# Runs isolated (no `# MODE:` marker, which means isolated): the driver gives
# this process temp XDG dirs and --no-config, so there is no loaded config and
# no universal variables. That is load-bearing in both directions --
#
# * these cases `set -e` real guard variable names, including
# __fish_config_op_logging and __fish_config_opinionated. Under a plain
# `fish` those erase from the innermost scope holding the variable, which
# for a user with the variable set universally means destroying a real
# universal variable. The temp XDG_CONFIG_HOME is what makes that
# impossible.
# * the two `set -p` / `source` lines below are what make the FORK's code the
# code under test. Their failure modes differ and the difference matters:
# forgetting the fish_function_path prepend fails LOUDLY (the guard
# functions are unresolvable under --no-config and a call exits 127, which
# can never equal an expected 0/1/2/3, so every case turns red), while
# forgetting the registry source fails SILENTLY (__fish_config_op_enabled
# fail-opens on a missing entry, so a third of the table would pass for
# entirely the wrong reason). Hence the explicit precondition below.
source (realpath (dirname (status filename)))/lib.fish
set -p fish_function_path $repo_root/functions
source $repo_root/conf.d/__fish_config_op_registry.fish
section "guards: preconditions"
check "the fork's registry is loaded" 65 (count $__fish_config_op_registry_keys)
section "__fish_variable_check: truthy"
for v in 1 true yes on y Y TRUE ON
set -g __probe_v $v
__fish_variable_check __probe_v
check "truthy '$v' -> 0" 0 $status
end
section "__fish_variable_check: falsy"
for v in 0 false no off n OFF FALSE
set -g __probe_v $v
__fish_variable_check __probe_v
check "falsy '$v' -> 1" 1 $status
end
section "__fish_variable_check: neither"
set -e __probe_v
__fish_variable_check __probe_v
check "unset -> 2" 2 $status
set -g __probe_v ""
__fish_variable_check __probe_v
check "empty string -> 2" 2 $status
set -g __probe_v banana
__fish_variable_check __probe_v
check "unrecognized -> 3" 3 $status
__fish_variable_check
check "no argument -> 2" 2 $status
set -g __probe_v a b
__fish_variable_check __probe_v
check "multi-element list -> 3" 3 $status
set -e __probe_v
section "cascade: category only"
# Invented variable names the real config can never set, so nothing ambient can
# perturb these -- only the C5 and master cases below need real names.
set -e __fish_config_opinionated __probe_cat __probe_cat_sub
__fish_config_op_cascade __probe_cat
check "all unset -> enabled" 0 $status
set -g __probe_cat 0
__fish_config_op_cascade __probe_cat
check "category falsy -> disabled" 1 $status
set -g __probe_cat 1
__fish_config_op_cascade __probe_cat
check "category truthy -> enabled" 0 $status
set -g __probe_cat garbage
__fish_config_op_cascade __probe_cat
check "category unrecognized defers to master -> enabled" 0 $status
set -e __probe_cat
section "cascade: subcategory beats category"
set -g __probe_cat 0
set -g __probe_cat_sub 1
__fish_config_op_cascade __probe_cat __probe_cat_sub
check "sub on, category off -> enabled" 0 $status
set -g __probe_cat 1
set -g __probe_cat_sub 0
__fish_config_op_cascade __probe_cat __probe_cat_sub
check "sub off, category on -> disabled" 1 $status
set -e __probe_cat_sub
set -g __probe_cat 0
__fish_config_op_cascade __probe_cat __probe_cat_sub
check "sub unset, category off -> disabled" 1 $status
set -g __probe_cat_sub garbage
__fish_config_op_cascade __probe_cat __probe_cat_sub
check "sub unrecognized defers, category off -> disabled" 1 $status
set -e __probe_cat __probe_cat_sub
__fish_config_op_cascade __probe_cat ""
check "empty subcategory argument -> category-only chain" 0 $status
section "cascade: the master is an off switch only"
set -g __fish_config_opinionated 0
__fish_config_op_cascade __probe_cat
check "master off, category unset -> disabled" 1 $status
set -g __probe_cat 1
__fish_config_op_cascade __probe_cat
check "master off, category on -> enabled" 0 $status
set -e __probe_cat
set -g __fish_config_opinionated 1
__fish_config_op_cascade __probe_cat
check "master on, category unset -> enabled" 0 $status
set -g __fish_config_opinionated garbage
__fish_config_op_cascade __probe_cat
check "master unrecognized, category unset -> enabled" 0 $status
set -e __fish_config_opinionated
section "cascade: C5 logging is opt-in"
# Uses the REAL __fish_config_op_logging name because the opt-in list lives
# inside the cascade keyed on it. AGENTS.md: "C5 is opt-in (do not 'fix' this)"
# -- unset or unrecognized means off, and the master switch cannot enable it.
# If any of these three fail, that is a real defect: record it in
# JOB-BRIEF-FINDINGS.md, do not repair the guard.
set -e __fish_config_op_logging __fish_config_opinionated
__fish_config_op_cascade __fish_config_op_logging
check "C5 unset -> disabled" 1 $status
set -g __fish_config_opinionated 1
__fish_config_op_cascade __fish_config_op_logging
check "C5 unset + master truthy -> still disabled" 1 $status
set -e __fish_config_opinionated
set -g __fish_config_op_logging garbage
__fish_config_op_cascade __fish_config_op_logging
check "C5 unrecognized is not consent -> disabled" 1 $status
set -g __fish_config_op_logging on
__fish_config_op_cascade __fish_config_op_logging
check "C5 explicit truthy -> enabled" 0 $status
set -g __fish_config_op_logging off
__fish_config_op_cascade __fish_config_op_logging
check "C5 explicit falsy -> disabled" 1 $status
set -e __fish_config_op_logging
section "cascade: C5 subcategories inherit opt-in"
# The opt-in check reads chain[-1], which is always the CATEGORY variable, so
# nesting inherits "off unless explicit" with no per-subcategory special case.
set -e __fish_config_op_logging_terminal_capture
__fish_config_op_cascade __fish_config_op_logging __fish_config_op_logging_terminal_capture
check "C5 sub unset, C5 unset -> disabled" 1 $status
set -g __fish_config_op_logging_terminal_capture 1
__fish_config_op_cascade __fish_config_op_logging __fish_config_op_logging_terminal_capture
check "C5 sub explicit truthy -> enabled" 0 $status
set -g __fish_config_op_logging_terminal_capture 0
set -g __fish_config_op_logging on
__fish_config_op_cascade __fish_config_op_logging __fish_config_op_logging_terminal_capture
check "C5 sub falsy, C5 truthy -> disabled" 1 $status
set -e __fish_config_op_logging_terminal_capture __fish_config_op_logging
section "registry lookup"
__fish_config_op_registry_lookup cat "" >/dev/null
check "known unsited key found" 0 $status
set -l t (__fish_config_op_registry_lookup cat "")
check "cat's tags" aliases/filesystem "$t"
__fish_config_op_registry_lookup nosuchthing "" >/dev/null
check "unknown identity -> not found" 1 $status
set -l t2 (__fish_config_op_registry_lookup config cdpath)
check "sited key config:cdpath" overrides/environment "$t2"
# The key is the identity:site PAIR, not the identity alone.
__fish_config_op_registry_lookup cat wrongsite >/dev/null
check "known identity, wrong site -> not found" 1 $status
section "op_enabled: against the real registry"
set -e __fish_config_op_aliases __fish_config_op_aliases_filesystem
set -e __fish_config_opinionated
__fish_config_op_enabled cat
check "cat, nothing set -> enabled" 0 $status
__fish_config_op_enabled cat.fish
check "a .fish suffix is stripped" 0 $status
set -g __fish_config_op_aliases 0
__fish_config_op_enabled cat
check "cat, aliases off -> disabled" 1 $status
set -g __fish_config_op_aliases_filesystem 1
__fish_config_op_enabled cat
check "cat, aliases off but its subcategory on -> enabled" 0 $status
set -e __fish_config_op_aliases __fish_config_op_aliases_filesystem
# Fail-open: an unclassified identity, or one whose doc header has no
# # COMPONENT section, resolves to enabled. This is what keeps user-authored
# and third-party functions unaffected.
__fish_config_op_enabled __totally_unregistered somesite
check "no registry entry -> fail open" 0 $status
section "op_enabled: always/* and AND, via a synthetic registry"
# Why this fixture exists, so nobody deletes it as redundant:
#
# The generated registry has 65 entries, EVERY ONE carrying exactly one tag,
# and contains no always/on or always/off anywhere (measured 2026-09-07
# against conf.d/__fish_config_op_registry.fish). So three documented
# semantics -- always/off, always/on, and AND-across-tags -- have no reachable
# case in production data and would otherwise go completely untested.
#
# The registry is just two global lists, and in isolated mode nothing else in
# this process reads them, so overriding them is free.
set -g __fish_config_op_registry_keys "syn_on:" "syn_off:" "syn_and:" "syn_bare:" "syn_multi:"
set -g __fish_config_op_registry_values \
"always/on" \
"always/off" \
"aliases/filesystem integrations/notifications" \
"aliases" \
"always/off always/on"
set -e __fish_config_op_aliases __fish_config_op_integrations __fish_config_opinionated
__fish_config_op_enabled syn_off
check "always/off -> disabled" 1 $status
set -g __fish_config_op_aliases 1
__fish_config_op_enabled syn_off
check "always/off ignores an enabled category" 1 $status
set -e __fish_config_op_aliases
__fish_config_op_enabled syn_on
check "always/on -> enabled" 0 $status
set -g __fish_config_op_aliases 0
__fish_config_op_enabled syn_on
check "always/on short-circuits a disabled category" 0 $status
set -e __fish_config_op_aliases
__fish_config_op_enabled syn_multi
check "always/off beats always/on" 1 $status
section "op_enabled: AND across tagged sub-categories"
__fish_config_op_enabled syn_and
check "both categories default -> enabled" 0 $status
set -g __fish_config_op_aliases 0
__fish_config_op_enabled syn_and
check "first tag's category off -> disabled" 1 $status
set -e __fish_config_op_aliases
set -g __fish_config_op_integrations 0
__fish_config_op_enabled syn_and
check "second tag's category off -> disabled" 1 $status
set -e __fish_config_op_integrations
set -g __fish_config_op_aliases 1
set -g __fish_config_op_integrations 1
__fish_config_op_enabled syn_and
check "both explicitly on -> enabled" 0 $status
set -e __fish_config_op_aliases __fish_config_op_integrations
section "op_enabled: a tag with no slash"
# Degenerate but harmless: with no '/', $parts[2] is empty and the derived
# subcategory name gets a trailing underscore. That name is simply always
# unset, so the chain falls through to the category. Pinned so a future reader
# does not mistake it for a bug.
__fish_config_op_enabled syn_bare
check "bare tag 'aliases' -> enabled by default" 0 $status
set -g __fish_config_op_aliases 0
__fish_config_op_enabled syn_bare
check "bare tag honors its category" 1 $status
set -e __fish_config_op_aliases
section "op_enabled: C5 through the guard"
# The path production code actually takes, as opposed to calling the cascade
# directly. Same rule: unset means off and the master cannot enable it.
set -g __fish_config_op_registry_keys "syn_log:"
set -g __fish_config_op_registry_values "logging/terminal-capture"
set -e __fish_config_op_logging __fish_config_op_logging_terminal_capture
__fish_config_op_enabled syn_log
check "C5-tagged component, nothing set -> disabled" 1 $status
set -g __fish_config_opinionated 1
__fish_config_op_enabled syn_log
check "C5-tagged component + master truthy -> still disabled" 1 $status
set -e __fish_config_opinionated
set -g __fish_config_op_logging 1
__fish_config_op_enabled syn_log
check "C5-tagged component + explicit C5 on -> enabled" 0 $status
set -e __fish_config_op_logging
report
+87
View File
@@ -0,0 +1,87 @@
# Copyright (C) 2026 Rootiest
# SPDX-License-Identifier: AGPL-3.0-or-later
#
# MODE: in-session
#
# Functional checks for foundational config behavior. Sourced by
# tests/run-tests.fish into a fully-loaded, sandboxed interactive fish
# session -- see that file for the sandbox setup. Assertions here are the
# ones that genuinely need a loaded config; anything testable against a
# single function belongs in an isolated suite instead.
section "session: environment"
check "XDG vars are all set" true (test -n "$XDG_CONFIG_HOME" -a -n "$XDG_CACHE_HOME" -a -n "$XDG_DATA_HOME" -a -n "$XDG_STATE_HOME"; and echo true; or echo false)
check "PATH includes ~/.local/bin" true (contains -- "$HOME/.local/bin" $PATH; and echo true; or echo false)
check "CDPATH includes ~/projects" true (contains -- "$HOME/projects" $CDPATH; and echo true; or echo false)
check "vi key bindings active" fish_vi_key_bindings "$fish_key_bindings"
check "abbreviations loaded" true (abbr -q n; and echo true; or echo false)
check "privacy variables set" true (test "$DO_NOT_TRACK" = 1 -a "$DISABLE_TELEMETRY" = 1; and echo true; or echo false)
section "session: functions"
set -l missing
for f in cat logs config-help fish-deps check_fish_deps config-settings
functions -q $f; or set -a missing $f
end
check "core functions defined" "" "$missing"
check "exit is rewired to smart_exit" true (functions -q exit; and functions exit | string match -q '*smart_exit*'; and echo true; or echo false)
check "fish_greeting defined" true (functions -q fish_greeting; and echo true; or echo false)
set -l missing_vault
for f in agents-vault _agents_vault_dir _agents_repo_slug \
_agents_repo_ensure_symlink _agents_repo_sync _agents_repo_install_tools
functions -q $f; or set -a missing_vault $f
end
check "agents-vault functions defined" "" "$missing_vault"
# One assertion, not two, so this file maps 1:1 onto the fifteen test_*
# predicates it replaces and the suite's 15/15 baseline is preserved.
check "claude and agy wrappers call agents-vault" true (functions -q claude; and functions claude | string match -q '*agents-vault*'; and functions -q agy; and functions agy | string match -q '*agents-vault*'; and echo true; or echo false)
section "session: guards in a loaded session"
set -l tags (__fish_config_op_registry_lookup config cdpath)
check "registry lookup finds config:cdpath" overrides/environment "$tags"
set -l ptags (__fish_config_op_registry_lookup config privacy)
check "registry lookup finds config:privacy" overrides/privacy "$ptags"
__fish_config_op_enabled __fish_config_test_never_registered somesite
check "unregistered component fails open" 0 $status
section "session: vault dir override"
set -l saved
set -q __fish_agent_vault_dir; and set saved $__fish_agent_vault_dir
set -g __fish_agent_vault_dir /tmp/vault-override-check
set -l got (_agents_vault_dir)
set -e __fish_agent_vault_dir
test (count $saved) -gt 0; and set -g __fish_agent_vault_dir $saved
check "vault dir honors the override" /tmp/vault-override-check "$got"
section "session: conf.d guards are lazy in non-interactive scripts"
# A non-interactive shell must not load interactive-only conf.d work. The
# child inherits XDG_CONFIG_HOME from this sandboxed session, so it loads
# the same config under test. Each exit code names one regression.
#
# Assertion 5 (tailscale) is vacuously true where tailscale is not
# installed: conf.d/tailscale.fish returned early on `type -q tailscale`
# before this change, and completions/tailscale.fish does the same, so the
# function is absent either way. The test still cannot fail wrongly there
# -- it just stops proving anything about that one file. A positive
# "completions still work" check would need the binary present and would
# make the suite machine-dependent, so it stays out.
fish -c '
abbr -q n; and exit 1
functions -q fish_user_key_bindings; and exit 2
functions -q expand_bang_all; and exit 3
functions -q __fish_config_logging_changed; and exit 4
functions -q __tailscale_perform_completion; and exit 5
exit 0'
check "conf.d guards stay out of non-interactive scripts" 0 $status
# Positive counterpart to the assertion above: the guard must not over-fire.
check "fish_user_key_bindings still defined in-session" true (functions -q fish_user_key_bindings; and echo true; or echo false)