CI: scan mod tests assert codes, not sentences (#1089)

[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Refs #1089 (child 5, scan_mod slice). This is the last covgap file in child 5; with #1556 (scan_hosted, merged) child 5 is done.

What changes

• tests/covgap_commands_scan_mod.rs (3,160 lines, 58 tests, its own test binary) moves into the scan suite binary as four modules:
  • scan/scan_failure_paths.rs (24 tests): the --json contracts. They check exit code, status, error.code, event actions and errorCodes, warnings[] codes, the mock API's request log and disk state. Messages are read only for what they must name (a flag, a purl, a file). It has 0 .contains("…") asserts of 4+ words; the old file had 37.
  • New JSON twins replace human-only checks: total detail-fetch failure (patch_details_failed), partial failure (one patch_details_failed warning naming the purl, the resolved package still verified), vendor-owned purls (one skipped event coded vendored, no download), report-only --prune, --sync / --mode agent --prune apply-and-collect (pruned manifest, swept blob, gc), and hosted_wiring_retained.
  • The scan exits 1 in human output but 0 with --json when every patch query returns nothing #1062 human/JSON parity tests compare exit codes and JSON codes. The human warning line they also checked lives in the render file.
  • scan/scan_render.rs (35 tests): human output, one check per message family (17 sentence asserts), keeping each human run's disk-state checks. Duplicate checks were collapsed: the GC singular/plural/agent-prune tests are one table-driven test, and the two partial-failure warnings are one test over both shapes. The two bun.lockb human halves are also one test.
  • scan/scan_tty.rs (4 tests, unix): scan on a real terminal, moved unchanged apart from the shared fixture helpers and dropping the PTY runner's unused typeahead path.
  • scan/scan_fixture.rs: shared mocks, project writers and runners. It merges the four copies of the 500 detail mock and the one/two-patch API mounts, and removes the never-delayed _delayed variants.
• The mode_fold in-process tests are removed. cli_parse_scan.rs::mode_hosted_with_sync_errors already covers them, and they mutated process env inside the shared scan binary. That test now also requires the error to name the mode (--mode vendored cannot be used with --sync), so the cli_name() coverage stays.
• scripts/ci-test-durations.json folds the old target's 1.81 s into scan. The doc pointer in docs/testing/bun-compatibility.md is updated.
• No production change.

Observed while writing the twins (not changed here): with a paid-only catalog and no paid access, the human arm skips the by-package detail fetch, but the --json arm still makes it.

CI cost

No workflow change. A lean PR run stays at about 28 Linux jobs, ~8 min (~110 job-min) before and after. The test shards link one fewer integration-test binary (scan absorbs it).

Test evidence

• cargo fmt --all -- --check: clean.
• cargo clippy --locked --workspace --all-features -- -D warnings (the CI command): clean. cargo clippy -p socket-patch-cli --all-features --test scan -- -D warnings reports nothing in the four new files. The 19 remaining hits in that target (prebuilt_common, hosted_yarn_classic_sha1.rs, module-loaded-twice) are the same count as on main.
• cargo test -p socket-patch-cli --all-features --test scan: 204 passed. --test cli_parse_scan: 48 passed.
• python3 -m pytest scripts/tests -q: 342 passed, 6 skipped.
• The moved code includes cfg(unix) tests, so one full-scope ci.yml run was dispatched on cffeede: https://github.com/SocketDev/socket-patch/actions/runs/38675513037

/code-review high

Fixed in cffeede: duplicate mode_fold tests mutating env (removed, coverage moved into cli_parse_scan.rs). The vendored-skip twin now requires the skipped/vendored event. The retained-wiring render check reads the warning line itself. The global-scope envelope now checks invariants. The private warning helper was dropped for vlt_hosted_common::warning_detail, the PTY runner shares the fixture's api_args, and the dead typeahead parameter is gone.
Not fixed, and why:

• Moving the PTY spawn/watchdog harness into common/pty_io.rs would dedupe it across six suites (rollback_render.rs, update/covgap_commands_update.rs, update_notifier_e2e.rs, cli/interactive_prompts_e2e.rs, cli/covgap_output.rs, this file). That touches five unrelated suites, so it belongs in its own Tracking: assert stable codes instead of human sentences in CLI tests, and fold the covgap suites #1089/Spawn every CLI test child through one hermetic Command builder; 10 test files inherit ambient SOCKET_* today #823 cleanup PR, not this one.
• Other copies of "find a warnings[] entry by code" (scan_invariants.rs, scan_nested_project_e2e.rs) predate this PR. This file adds no new copy.

Merge note

#1556 merged first. Its conflicts (the scan/main.rs module list, the scan line of ci-test-durations.json, now 12.35 s, and the bun-compatibility.md sentence) are resolved in the merge of main. The merged scan binary runs 244 tests, all passing.

🤖 Generated with Claude Code

https://claude.ai/code/session_011Y5j5rYtzb1JgiDLSWLQY9

---

Note

Low Risk
Test-only reorganization and stricter assertions; runtime CLI behavior is unchanged.

Overview
Refactors the monolithic covgap_commands_scan_mod integration binary into modules under the existing scan test target, aligned with #1089’s goal of pinning envelope codes and structure instead of long English strings.

scan_fixture.rs centralizes wiremock mounts, hermetic runners, and project seeds. scan_failure_paths.rs holds --json contracts (exit codes, error.code, events, warnings, API/disk oracles). scan_render.rs (referenced in the suite) keeps human-terminal checks with fewer duplicate sentence asserts. scan_tty.rs (unix) keeps PTY behavior tests. Several former human-only scenarios gain JSON twins (detail-fetch failures, vendored skips, report-only prune, sync GC, hosted wiring retained, etc.).

Removes in-process mode_fold tests that mutated env inside the shared binary; cli_parse_scan::mode_hosted_with_sync_errors now requires errors to name the conflicting mode via cli_name(). Docs and ci-test-durations.json drop the old target and fold its time into scan. No production code changes.

^{Reviewed by Cursor Bugbot for commit 883f3e7. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 883f3e7. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review — head 883f3e7 (main merge on top of cffeede).

• CI: every run check green on 883f3e7 (lean CI + ci-ok; the rest path-skipped); no main-wide failures.
• Bugbot: reviewed 883f3e7, no findings (also clean on cffeede).
• Already approved by Tanmay Singla (@Tanmay182003) on this head; no CHANGELOG changes.
• Reviewer focus: the scan mod tests now assert envelope codes via the shared readers instead of English sentences (Tracking: assert stable codes instead of human sentences in CLI tests, and fold the covgap suites #1089).

Slack announcement not sent this run (Slack send unavailable); next run will retry.

---

Generated by Claude Code