codeburn/packages/cli
iamtoruk 895639ee1f test(cli): pin the privacy-key rotation end to end; harden the key guard
Three review follow-ups.

1. The rotation guarantee is now pinned by a real parse, not by two unit
tests that both stub the fingerprint. The original defect was a wiring
bug — right value, wrong selector — and a stubbed fingerprint cannot see
a wiring bug. The new case warms the cache under key K1 (one JetBrains
turn, one call), rotates the key file to K2, appends a second turn, and
re-parses in a fresh module registry: exactly two calls, no K1-era dedup
key anywhere, on disk or in the result. Restore the substring-sniff
selector and it reports three calls for two turns — the user-visible
shape of the bug.

2. The test-helper guard compared UNRESOLVED paths, so a symlink at a
sandbox-shaped location (HOME=$TMPDIR/codeburn-test-env-x -> /Users/me)
passed the prefix test and the write landed in the real home anyway. Both
sides are realpath'd before comparing, which also stops a sibling
directory sharing the tmpdir prefix from matching. Same refusal message.

3. CHANGELOG records the two API breaks that were missing: decodeCopilot
throws on an empty privacyKey for JetBrains records, and
SOURCE_REF_KEYED_PARSE_VERSION is no longer exported (KEY_DERIVED_PROVIDERS
replaces it).
2026-08-21 10:59:50 -07:00
..
src fix(cli): select the privacy-key fold set explicitly, not by substring 2026-08-21 10:48:21 -07:00
tests test(cli): pin the privacy-key rotation end to end; harden the key guard 2026-08-21 10:59:50 -07:00
package.json chore: hold workspace versions at 0.9.20, defer the bump to release 2026-08-21 10:38:17 -07:00
tsconfig.json chore(workspace): move CLI to packages/cli, add @codeburn/core skeleton (phase 1) 2026-07-26 10:19:33 -07:00
tsup.config.ts chore(workspace): move CLI to packages/cli, add @codeburn/core skeleton (phase 1) 2026-07-26 10:19:33 -07:00
vitest.config.ts test(cli): restore CI timeout headroom and lock-suite quarantine lost in packages/cli split 2026-08-21 08:28:55 -07:00