From 6e12011877cf741739445c1c4a45160e5217a336 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 23 Oct 2026 03:50:33 +0000 Subject: [PATCH] fix(server): run cli.test.ts main() cases from an empty temp dir main() calls loadDwkEnv() against process.cwd(), so a developer's local .env leaked into process.env during cli.test.ts. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01CMCuDa11Qr39yxAQJNUXoH --- packages/server/CLAUDE.md | 6 +++--- packages/server/src/cli.test.ts | 13 ++++++++++++- 2 files changed, 15 insertions(+), 4 deletions(-) diff --git a/packages/server/CLAUDE.md b/packages/server/CLAUDE.md index 47114388..7ab56b64 100644 --- a/packages/server/CLAUDE.md +++ b/packages/server/CLAUDE.md @@ -108,6 +108,6 @@ for Cloudflare bindings. bindings (`secrets: { TOKEN_SIGNING_KEY, … }` in the `phase*` integration tests), and `env.test.ts` drives `loadDwkEnv({ cwd })` against temp dirs, so no secret file is needed locally or in CI. Add a new test's secrets inline - the same way. One leak: `cli.test.ts` calls `main()`, whose `loadDwkEnv()` - reads `.env`/`.env` from the working directory, so a local `.env` - there lands in `process.env` during that file. + the same way. `main()` calls `loadDwkEnv()` against `process.cwd()`, so + `cli.test.ts` runs every `main` case from an empty temp dir; keep new `main` + tests inside that `describe`. diff --git a/packages/server/src/cli.test.ts b/packages/server/src/cli.test.ts index bcc00380..6567b882 100644 --- a/packages/server/src/cli.test.ts +++ b/packages/server/src/cli.test.ts @@ -1,4 +1,4 @@ -import { describe, it, expect, afterAll } from "vitest"; +import { describe, it, expect, afterAll, beforeEach, afterEach } from "vitest"; import { mkdtempSync, rmSync, writeFileSync } from "node:fs"; import { tmpdir } from "node:os"; import { join } from "node:path"; @@ -150,6 +150,17 @@ describe("dwk-serve CLI", () => { }); describe("main", () => { + // main() calls loadDwkEnv() against process.cwd(); run every case from an + // empty temp dir so a developer's local .env never reaches these tests. + let prevCwd: string; + beforeEach(() => { + prevCwd = process.cwd(); + process.chdir(workdir()); + }); + afterEach(() => { + process.chdir(prevCwd); + }); + it("parses args, loads the config path, and starts listening", async () => { const path = configFile(pingConfig()); const cap = capture();