|
| 1 | +# SPDX-License-Identifier: AGPL-3.0-or-later |
| 2 | +# Copyright (c) 2026 Hal Hildebrand. All rights reserved. |
| 3 | +"""``scripts/reinstall-tool.sh`` downgrade guard — resolve from the TARGET |
| 4 | +venv, not the ambient PATH (nexus-zfutt). |
| 5 | +
|
| 6 | +Root cause: the guard read the "installed" version via a bare ``nx --version`` |
| 7 | +lookup on ``$PATH``. ``tests/e2e/release-sandbox.sh`` activates an isolated |
| 8 | +sandbox ``$HOME`` and PREPENDS ``$SANDBOX/.local/bin`` to ``$PATH`` before |
| 9 | +calling this script — but on a fresh (or not-yet-populated) sandbox no ``nx`` |
| 10 | +exists there yet, so ``command -v nx`` falls through to the REST of ``$PATH`` |
| 11 | +and resolves the live global install instead. A develop checkout's |
| 12 | +``pyproject.toml`` version (which lags the last released version between |
| 13 | +releases) then reads as a "downgrade" against the live global version, and the |
| 14 | +guard refuses a perfectly legitimate isolated sandbox install. |
| 15 | +
|
| 16 | +These tests never touch the real global ``uv`` tool environment: a stub |
| 17 | +``uv`` (handling only ``tool dir``, no-op otherwise) and stub ``nx`` binaries |
| 18 | +are placed on ``$PATH`` ahead of everything else, and ``$HOME`` points at a |
| 19 | +throwaway ``tmp_path``. |
| 20 | +""" |
| 21 | +from __future__ import annotations |
| 22 | + |
| 23 | +import os |
| 24 | +import stat |
| 25 | +import subprocess |
| 26 | +from pathlib import Path |
| 27 | + |
| 28 | +import pytest |
| 29 | + |
| 30 | +_SCRIPT = Path(__file__).resolve().parents[2] / "scripts" / "reinstall-tool.sh" |
| 31 | + |
| 32 | +# A curated base PATH for these subprocess runs — deliberately EXCLUDES |
| 33 | +# ~/.local/bin (and any other uv-tool-managed bin dir), which is where the |
| 34 | +# REAL `nx` / `uv` live on a dev box. These tests must never be able to reach |
| 35 | +# the real global install (fewer-permission-prompts / "don't break the live |
| 36 | +# nexus install"); only the stub `uv`/`nx` binaries these tests place on |
| 37 | +# PATH may be found. Includes just enough of the real system PATH for |
| 38 | +# bash/git/python3/sed/grep/ps to resolve. |
| 39 | +_SAFE_BASE_PATH = ":".join( |
| 40 | + p for p in ( |
| 41 | + "/opt/homebrew/bin", |
| 42 | + "/opt/homebrew/opt/python@3.13/libexec/bin", |
| 43 | + "/usr/local/bin", |
| 44 | + "/usr/bin", |
| 45 | + "/bin", |
| 46 | + "/usr/sbin", |
| 47 | + "/sbin", |
| 48 | + ) |
| 49 | + if Path(p).is_dir() |
| 50 | +) |
| 51 | + |
| 52 | + |
| 53 | +def _make_executable(path: Path, content: str) -> None: |
| 54 | + path.write_text(content) |
| 55 | + path.chmod(path.stat().st_mode | stat.S_IEXEC | stat.S_IXGRP | stat.S_IXOTH) |
| 56 | + |
| 57 | + |
| 58 | +def _stub_uv(bin_dir: Path, *, tool_dir: Path, marker: Path) -> None: |
| 59 | + """A stub ``uv`` that answers ``tool dir`` and, for anything else |
| 60 | + (notably ``tool install``), just drops a marker file so tests can |
| 61 | + assert whether the real install step was ever reached.""" |
| 62 | + _make_executable( |
| 63 | + bin_dir / "uv", |
| 64 | + f"""#!/bin/bash |
| 65 | +if [[ "$1" == "tool" && "$2" == "dir" ]]; then |
| 66 | + echo "{tool_dir}" |
| 67 | + exit 0 |
| 68 | +fi |
| 69 | +if [[ "$1" == "tool" && "$2" == "install" ]]; then |
| 70 | + touch "{marker}" |
| 71 | + exit 0 |
| 72 | +fi |
| 73 | +exit 0 |
| 74 | +""", |
| 75 | + ) |
| 76 | + |
| 77 | + |
| 78 | +def _stub_nx(path: Path, version: str) -> None: |
| 79 | + _make_executable( |
| 80 | + path, |
| 81 | + f"""#!/bin/bash |
| 82 | +if [[ "$1" == "--version" ]]; then |
| 83 | + echo "nx, version {version}" |
| 84 | + exit 0 |
| 85 | +fi |
| 86 | +exit 0 |
| 87 | +""", |
| 88 | + ) |
| 89 | + |
| 90 | + |
| 91 | +def _write_pyproject(source_dir: Path, version: str) -> None: |
| 92 | + source_dir.mkdir(parents=True, exist_ok=True) |
| 93 | + (source_dir / "pyproject.toml").write_text( |
| 94 | + f'[project]\nname = "conexus"\nversion = "{version}"\n' |
| 95 | + ) |
| 96 | + |
| 97 | + |
| 98 | +def _run(env_path: str, home: Path, source: Path) -> subprocess.CompletedProcess: |
| 99 | + env = dict(os.environ) |
| 100 | + env["PATH"] = env_path |
| 101 | + env["HOME"] = str(home) |
| 102 | + return subprocess.run( |
| 103 | + ["bash", str(_SCRIPT), str(source)], |
| 104 | + env=env, |
| 105 | + capture_output=True, |
| 106 | + text=True, |
| 107 | + timeout=30, |
| 108 | + ) |
| 109 | + |
| 110 | + |
| 111 | +class TestDowngradeGuardResolvesFromTargetVenv: |
| 112 | + def test_does_not_falsely_refuse_when_only_ambient_path_nx_is_newer( |
| 113 | + self, tmp_path: Path |
| 114 | + ) -> None: |
| 115 | + """The bug: a fresh/isolated target venv has no ``nx`` of its own |
| 116 | + yet, but the REST of ``$PATH`` (the live global install) still |
| 117 | + resolves to a much newer ``nx``. That must NOT read as a downgrade — |
| 118 | + there is nothing installed in the target venv to downgrade.""" |
| 119 | + home = tmp_path / "sandbox-home" |
| 120 | + home.mkdir() |
| 121 | + tool_dir = home / "tools" # VENV_DIR = tool_dir/conexus — deliberately NOT populated |
| 122 | + marker = tmp_path / "install-ran.marker" |
| 123 | + |
| 124 | + stub_bin = tmp_path / "stubbin" |
| 125 | + stub_bin.mkdir() |
| 126 | + _stub_uv(stub_bin, tool_dir=tool_dir, marker=marker) |
| 127 | + |
| 128 | + # The "ambient" live global install: a DIFFERENT, later-in-PATH nx |
| 129 | + # reporting a much newer version than the source checkout. |
| 130 | + global_bin = tmp_path / "globalbin" |
| 131 | + global_bin.mkdir() |
| 132 | + _stub_nx(global_bin / "nx", "6.16.0") |
| 133 | + |
| 134 | + source = tmp_path / "checkout" |
| 135 | + _write_pyproject(source, "6.11.0") |
| 136 | + |
| 137 | + env_path = f"{stub_bin}:{global_bin}:{_SAFE_BASE_PATH}" |
| 138 | + result = _run(env_path, home, source) |
| 139 | + |
| 140 | + assert result.returncode == 0, result.stdout + result.stderr |
| 141 | + assert "REFUSING" not in result.stdout |
| 142 | + assert marker.exists() # the (stubbed) install actually ran |
| 143 | + |
| 144 | + def test_still_refuses_a_real_downgrade_of_the_target_venv( |
| 145 | + self, tmp_path: Path |
| 146 | + ) -> None: |
| 147 | + """The guard's real purpose must survive: when the TARGET venv's own |
| 148 | + ``nx`` (the one about to be overwritten) is genuinely ahead of the |
| 149 | + source checkout, refuse without ``--force``.""" |
| 150 | + home = tmp_path / "real-home" |
| 151 | + home.mkdir() |
| 152 | + tool_dir = home / "tools" |
| 153 | + venv_bin = tool_dir / "conexus" / "bin" |
| 154 | + venv_bin.mkdir(parents=True) |
| 155 | + marker = tmp_path / "install-ran.marker" |
| 156 | + |
| 157 | + stub_bin = tmp_path / "stubbin" |
| 158 | + stub_bin.mkdir() |
| 159 | + _stub_uv(stub_bin, tool_dir=tool_dir, marker=marker) |
| 160 | + |
| 161 | + # The nx actually installed in the target venv — this is the one |
| 162 | + # about to be overwritten, and the one the guard must protect. |
| 163 | + _stub_nx(venv_bin / "nx", "6.16.0") |
| 164 | + |
| 165 | + source = tmp_path / "checkout" |
| 166 | + _write_pyproject(source, "6.11.0") |
| 167 | + |
| 168 | + env_path = f"{stub_bin}:{_SAFE_BASE_PATH}" |
| 169 | + result = _run(env_path, home, source) |
| 170 | + |
| 171 | + assert result.returncode == 1, result.stdout + result.stderr |
| 172 | + assert "REFUSING" in result.stdout |
| 173 | + assert "DOWNGRADE" in result.stdout |
| 174 | + assert not marker.exists() # never reached the install step |
| 175 | + |
| 176 | + def test_force_bypasses_a_real_downgrade(self, tmp_path: Path) -> None: |
| 177 | + home = tmp_path / "real-home" |
| 178 | + home.mkdir() |
| 179 | + tool_dir = home / "tools" |
| 180 | + venv_bin = tool_dir / "conexus" / "bin" |
| 181 | + venv_bin.mkdir(parents=True) |
| 182 | + marker = tmp_path / "install-ran.marker" |
| 183 | + |
| 184 | + stub_bin = tmp_path / "stubbin" |
| 185 | + stub_bin.mkdir() |
| 186 | + _stub_uv(stub_bin, tool_dir=tool_dir, marker=marker) |
| 187 | + _stub_nx(venv_bin / "nx", "6.16.0") |
| 188 | + |
| 189 | + # A PATH-reachable nx too — needed for the script's own post-install |
| 190 | + # `nx --version` echo (unrelated to the guard under test here; the |
| 191 | + # guard itself no longer needs anything on PATH). |
| 192 | + global_bin = tmp_path / "globalbin" |
| 193 | + global_bin.mkdir() |
| 194 | + _stub_nx(global_bin / "nx", "6.16.0") |
| 195 | + |
| 196 | + source = tmp_path / "checkout" |
| 197 | + _write_pyproject(source, "6.11.0") |
| 198 | + |
| 199 | + env = dict(os.environ) |
| 200 | + env["PATH"] = f"{stub_bin}:{global_bin}:{_SAFE_BASE_PATH}" |
| 201 | + env["HOME"] = str(home) |
| 202 | + result = subprocess.run( |
| 203 | + ["bash", str(_SCRIPT), str(source), "--force"], |
| 204 | + env=env, capture_output=True, text=True, timeout=30, |
| 205 | + ) |
| 206 | + |
| 207 | + assert result.returncode == 0, result.stdout + result.stderr |
| 208 | + assert marker.exists() |
| 209 | + |
| 210 | + @pytest.mark.parametrize("global_version", ["6.16.0", "6.10.0"]) |
| 211 | + def test_fresh_target_venv_never_compares_against_ambient_path( |
| 212 | + self, tmp_path: Path, global_version: str |
| 213 | + ) -> None: |
| 214 | + """Regardless of whether the stray ambient ``nx`` happens to look |
| 215 | + newer or older than the source checkout, a genuinely empty target |
| 216 | + venv must never trigger the guard at all — there is nothing there to |
| 217 | + compare against.""" |
| 218 | + home = tmp_path / "sandbox-home" |
| 219 | + home.mkdir() |
| 220 | + tool_dir = home / "tools" |
| 221 | + marker = tmp_path / "install-ran.marker" |
| 222 | + |
| 223 | + stub_bin = tmp_path / "stubbin" |
| 224 | + stub_bin.mkdir() |
| 225 | + _stub_uv(stub_bin, tool_dir=tool_dir, marker=marker) |
| 226 | + |
| 227 | + global_bin = tmp_path / "globalbin" |
| 228 | + global_bin.mkdir() |
| 229 | + _stub_nx(global_bin / "nx", global_version) |
| 230 | + |
| 231 | + source = tmp_path / "checkout" |
| 232 | + _write_pyproject(source, "6.11.0") |
| 233 | + |
| 234 | + env_path = f"{stub_bin}:{global_bin}:{_SAFE_BASE_PATH}" |
| 235 | + result = _run(env_path, home, source) |
| 236 | + |
| 237 | + assert result.returncode == 0, result.stdout + result.stderr |
| 238 | + assert "REFUSING" not in result.stdout |
| 239 | + assert marker.exists() |
0 commit comments