7d070c4e1c
The titan-iac CI pod has no node binary; the gate helper and every direct node invocation in the new HUX suites now skip with an explicit reason instead of erroring, restoring the main-CI baseline. Runners with node keep full enforcement. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvMSXH8VH2tMWXanb8SJdf
72 lines
2.4 KiB
Python
72 lines
2.4 KiB
Python
"""Execute the dependency-free HUX browser foundation contract tests."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import subprocess
|
|
from pathlib import Path
|
|
|
|
from hux_node_gate import require_node
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[2]
|
|
NODE_TEST = ROOT / "testing/tests/test_hermes_hux_ui_foundation_node.js"
|
|
HUX_UI = ROOT / "dockerfiles/hermes-webui-hux"
|
|
|
|
|
|
def test_hux_ui_foundation_node_contracts():
|
|
"""The browser modules pass their functional and isolation checks."""
|
|
require_node()
|
|
|
|
result = subprocess.run(
|
|
["node", "--test", str(NODE_TEST)],
|
|
cwd=ROOT,
|
|
capture_output=True,
|
|
check=False,
|
|
text=True,
|
|
)
|
|
assert result.returncode == 0, result.stdout + result.stderr
|
|
assert "fail 0" in result.stdout
|
|
|
|
|
|
def test_hux_ui_foundation_is_inert_and_bounded():
|
|
"""The foundation stays separate from the active image patch surface."""
|
|
|
|
production = sorted(path for path in HUX_UI.iterdir() if path.suffix in {".js", ".css"})
|
|
assert {path.name for path in production} == {
|
|
"bootstrap.css",
|
|
"bootstrap.js",
|
|
"foundation.css",
|
|
"foundation.js",
|
|
"shell.js",
|
|
}
|
|
for path in production:
|
|
assert len(path.read_text(encoding="utf-8").splitlines()) < 500
|
|
|
|
dockerfile = (ROOT / "dockerfiles/Dockerfile.hermes-webui").read_text(encoding="utf-8")
|
|
# The WebUI image ships the HUX browser surface, but only from sources that
|
|
# exist in this tree, and it never bakes activated HUX flags into the image:
|
|
# the single HUX_FLAGS occurrence is the empty-flag build-time router check.
|
|
copies = [
|
|
line.split()[1]
|
|
for line in dockerfile.splitlines()
|
|
if line.startswith("COPY dockerfiles/hermes-webui-hux")
|
|
]
|
|
assert copies
|
|
for source in copies:
|
|
assert (ROOT / source).is_file(), source
|
|
assert dockerfile.count("HUX_FLAGS") == 1
|
|
assert '"HUX_FLAGS": ""' in dockerfile
|
|
|
|
|
|
def test_hux_ui_foundation_never_persists_or_renders_raw_payloads():
|
|
"""Static guardrails forbid browser storage and raw-record display paths."""
|
|
|
|
source = (HUX_UI / "foundation.js").read_text(encoding="utf-8")
|
|
assert "localStorage" not in source
|
|
assert "sessionStorage" not in source
|
|
assert "innerHTML" not in source
|
|
assert "record.detail" not in source
|
|
assert "item.uri" not in source
|
|
assert "item.hash" not in source
|
|
assert "credentials: 'same-origin'" in source
|