86 lines
3.5 KiB
TypeScript
86 lines
3.5 KiB
TypeScript
import { mergeConfig, defineConfig, type UserConfig } from 'vitest/config';
|
|
import rootConfig from './vitest.config';
|
|
|
|
/**
|
|
* Critical-coverage gate (router-arc P0-C / SPEC C1).
|
|
*
|
|
* A separate vitest project that runs ONLY the security-boundary test suites and
|
|
* enforces hard per-project coverage thresholds over ONLY the security-boundary
|
|
* source files (injection scanning, vault, erasure/suppression, the confirmation
|
|
* gate + permissions, secret redaction, and the approval / held-action route
|
|
* surface). It locks those files against coverage regression without imposing a
|
|
* repo-wide threshold.
|
|
*
|
|
* It reuses the root config's `@waggle/*` src aliases + setup/pool so the
|
|
* critical suites resolve exactly as they do under `npm test`. `mergeConfig`
|
|
* concatenates arrays, so the root `test.include` and `test.coverage` are
|
|
* stripped from the base first — otherwise the whole suite (and whole-repo
|
|
* coverage) would leak back in.
|
|
*/
|
|
const base: UserConfig = {
|
|
...rootConfig,
|
|
test: { ...(rootConfig.test ?? {}) },
|
|
};
|
|
delete (base.test as Record<string, unknown>).include;
|
|
delete (base.test as Record<string, unknown>).coverage;
|
|
|
|
export default mergeConfig(
|
|
base,
|
|
defineConfig({
|
|
test: {
|
|
include: [
|
|
// Injection scanning (canonical scanForInjection lives in hive-mind-core).
|
|
'packages/agent/tests/injection-scanner.test.ts',
|
|
// Vault (secret storage) — core + sidecar route.
|
|
'packages/core/tests/vault.test.ts',
|
|
'packages/core/tests/vault-concurrency.test.ts',
|
|
'packages/core/tests/vault-edge-cases.test.ts',
|
|
'packages/server/tests/local/vault-routes.test.ts',
|
|
// Erasure / suppression (GDPR).
|
|
'packages/hive-mind-core/tests/mind/erasure.test.ts',
|
|
'packages/hive-mind-core/tests/mind/suppression.test.ts',
|
|
'packages/server/tests/local/suppression-endpoint.test.ts',
|
|
// Confirmation gate + autonomy, permissions sandbox.
|
|
'packages/agent/tests/confirmation.test.ts',
|
|
'packages/agent/tests/permissions.test.ts',
|
|
// Channels / middleware exfil surface.
|
|
'packages/server/tests/local/security-middleware.test.ts',
|
|
// Approval + durable held-action executor.
|
|
'packages/server/tests/routes/approval-flow.test.ts',
|
|
'packages/server/tests/local/approval-held.test.ts',
|
|
'packages/server/tests/local/held-action-executor.test.ts',
|
|
// Secret / home-path redaction.
|
|
'packages/agent/tests/eval-dataset.test.ts',
|
|
'packages/agent/tests/skill-redaction.test.ts',
|
|
],
|
|
coverage: {
|
|
provider: 'v8',
|
|
all: true,
|
|
include: [
|
|
'packages/hive-mind-core/src/injection-scanner.ts',
|
|
'packages/core/src/vault.ts',
|
|
'packages/hive-mind-core/src/mind/erasure.ts',
|
|
'packages/hive-mind-core/src/mind/suppression.ts',
|
|
'packages/agent/src/confirmation.ts',
|
|
'packages/agent/src/permissions.ts',
|
|
'packages/agent/src/eval-dataset.ts',
|
|
'packages/agent/src/skill-redaction.ts',
|
|
'packages/server/src/local/routes/approval.ts',
|
|
'packages/server/src/local/held-action-executor.ts',
|
|
'packages/server/src/local/routes/vault.ts',
|
|
],
|
|
exclude: ['**/*.d.ts'],
|
|
// Calibrated ~5pt below current reality (2026-07-15 pass: stmts/lines
|
|
// 94.55, branches 85.08, funcs 100) so the gate locks against
|
|
// regression, not aspiration.
|
|
thresholds: {
|
|
lines: 89,
|
|
functions: 95,
|
|
branches: 80,
|
|
statements: 89,
|
|
},
|
|
},
|
|
},
|
|
}),
|
|
);
|