test(cli): pin the client list --plain namespace= contract the installer greps (#141)#242
Merged
Merged
Conversation
`client list` is Hidden (RFC-0001 §7.10), but the client installer's #303 one-client-per-machine pre-flight still shells out to it: `scripts/lib/provision.sh` `_account_owns_namespace` runs `tracebloc client list --plain` and greps the output for `namespace=<ns>([[:space:]]|$)` to refuse a cross-account re-provision. Hidden ≠ disabled, so the command still runs — but nothing pinned that `--plain` stays a valid flag or that the output keeps emitting the `namespace=<ns>` field in a form the installer's grep matches. If either drifts, the grep silently fails and #303 stops firing in the field with no error. Add a cli-side guard that drives the REAL root (`NewRootCmd` → Execute, as the installer invokes it, not `runClientList` directly) and asserts: - `client list --plain` still dispatches + exits 0 while Hidden; - the output contains the literal `namespace=<ns> location=<loc>` field (canary for any format drift); - the installer's exact regex matches the live output (the real break condition), and is prefix-anchored (no false-accept on a strict prefix or an absent namespace). Mutation-verified: renaming the `namespace=`/`location=` fields fails this test. A format change now breaks CI here instead of silently disabling the installer's #303 refusal. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
aptracebloc
approved these changes
Jul 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Closes #141. Pins the fragile contract the installer's #303 pre-flight depends on: it shellstracebloc client list --plainand greps the output fornamespace=<ns>— andclient listis now a Hidden command, so nothing guaranteed the output format still holds.internal/cli/client_list_contract_test.godrives the real command the way the installer does (client list --plainthrough the root command) over the existing fake backend and asserts:client listis still Hidden and still dispatches / exits 0 while Hidden (Hidden only removes it from help);namespace=<ns>field, and the installer's exact regexnamespace=<ns>([[:space:]]|$)matches;acme-prod-0) do not match — pinning the whitespace/EOL anchor.Mutation-proven: renaming
namespace=/location=inclient.gofails the test. Test-only;make cigreen (internal/cli74.1%). Pairs with a client-repo test of the consumer half (_account_owns_namespace) — see that PR.Closes #141.🤖 Generated with Claude Code
Note
Low Risk
Test-only addition with no production code changes; low risk aside from future CI breakage if list output format changes without updating the installer.
Overview
Adds
internal/cli/client_list_contract_test.goto lock the cross-repo contract used by the tracebloc installer’s #303 pre-flight (provision.sh→tracebloc client list --plain+greponnamespace=<ns>).The test runs
client list --plainthroughNewRootCmd→Execute(not the handler directly) against the existingwithClientBackendfake API. It checks thatclient liststays Hidden yet still exits 0, that plain output includesnamespace=<ns>and a stablenamespace=… location=…fragment, that the installer’s regexnamespace=<ns>([[:space:]]|$)matches, and that absent namespaces and strict prefixes do not match.Test-only — no runtime behavior changes.
Reviewed by Cursor Bugbot for commit f860d6d. Bugbot is set up for automated code reviews on this repo. Configure here.