test(ci): run the unit suite in CI + frontend-syntax gate; green pre-existing test debt

- CI: add a 'test' job running the unit suite via config/vitest.ci.config.ts. Excludes browser (Playwright/chromium) and perf tests (timing-flaky), like the existing test/mobile suite. Safe in CI: TmuxManager no-ops shell commands under VITEST (test/setup.ts).
- Add scripts/check-frontend-syntax.mjs (node --check on src/web/public/*.js), wired into the lint job — catches a class of frontend SyntaxError that passes lint today (lint globs only TS).
- Add test/security-regression.test.ts (wired Host/Origin guard, self-update CSRF, CSP/security headers, text/plain raw body, WS anti-CSWSH) + test/sse-registry-parity.test.ts (backend<->frontend SSE registry parity).
- Green pre-existing test debt surfaced by the new gate: stale 'Session not found' asserts -> 'not found' substring; drop tests for removed helpers (isError now internal; createSuccessResponse deleted); file-stream-manager: mock realpathSync + fix stale /tmp assertion; sse-subscription-filter: lifecycle events broadcast to all clients (only terminal stream filtered); session.test.ts: mkdir /tmp/test; skip one interactive-respawn test needing a real PTY (covered by respawn-controller.test.ts).
- Full non-mobile suite verified green locally (2680 passed, 12 skipped).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
arkon
2026-06-09 20:02:15 +02:00
co-authored by Claude Opus 4.8
parent 36bc22a3d5
commit d5f91e4cd7
14 changed files with 428 additions and 121 deletions
+10 -5
View File
@@ -186,10 +186,13 @@ describe('SSE Subscription Filtering', () => {
expect(unfilteredCreated).toBeDefined();
expect((unfilteredCreated?.data as any).id).toBe(sessionId);
// Filtered client (subscribed to nonexistent-session) should NOT receive session:created
// because session:created has an `id` field that doesn't match the filter
// Lifecycle/metadata events (session:created/updated/deleted, ralph:*, etc.) are
// intentionally broadcast to ALL clients regardless of the ?sessions= filter — only
// the high-volume terminal stream is filtered per-session (see sse-stream-manager
// broadcast(): "Subscription filtering is intentionally NOT applied here"). So the
// filtered client still receives session:created.
const filteredCreated = filteredEvents.find((e) => e.event === 'session:created');
expect(filteredCreated).toBeUndefined();
expect(filteredCreated).toBeDefined();
// Both should have received the init event (it has no sessionId)
expect(unfilteredEvents.find((e) => e.event === 'init')).toBeDefined();
@@ -314,9 +317,11 @@ describe('SSE Subscription Filtering', () => {
const deleted1 = events.find((e) => e.event === 'session:deleted' && (e.data as any).id === session1.id);
expect(deleted1).toBeDefined();
// Should NOT receive session:deleted for session2
// Lifecycle events are broadcast to all clients regardless of filter, so a client
// subscribed to session1 still receives session2's session:deleted (only terminal
// output is filtered per-session).
const deleted2 = events.find((e) => e.event === 'session:deleted' && (e.data as any).id === session2.id);
expect(deleted2).toBeUndefined();
expect(deleted2).toBeDefined();
});
it('should support subscribing to multiple sessions', async () => {