From 6fbf7a3f644e8d56c3b49386acddaeadd0efbd0c Mon Sep 17 00:00:00 2001 From: stream Date: Sat, 6 Jun 2026 08:33:44 +0000 Subject: [PATCH] test(preflight): isolate ORCH-044 auth-gate in TestPreflight (fix CI on credless runner) TestPreflight asserts version-branch ok; new token-free auth gate reads /home/slin/.claude/.credentials.json regardless of HOME, so a clean CI runner without creds made check() return ok=False -> assert False is True. Add class-scoped autouse fixture stubbing _check_auth green. Auth itself stays covered by tests/test_preflight_auth.py; preflight_check_auth default True unchanged. --- tests/test_resilience.py | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/tests/test_resilience.py b/tests/test_resilience.py index 1d72117..5ed28a1 100644 --- a/tests/test_resilience.py +++ b/tests/test_resilience.py @@ -37,6 +37,17 @@ def fresh_db(tmp_path, monkeypatch): # A. Preflight # --------------------------------------------------------------------------- class TestPreflight: + @pytest.fixture(autouse=True) + def _isolate_auth_gate(self, monkeypatch): + # ORCH-044: preflight.check() also runs a token-free auth gate reading + # /.claude/.credentials.json (AgentLauncher.AGENT_HOME, not the + # process HOME). In a clean CI runner those creds are absent, so the gate + # returns (False, ...) and version-branch assertions would fail for purely + # environmental reasons. Stub the gate green; auth is covered by + # tests/test_preflight_auth.py. Production default (preflight_check_auth=True) + # is unchanged. + monkeypatch.setattr(preflight, "_check_auth", lambda: (True, "auth ok (test stub)")) + def test_fail_when_bin_missing(self, monkeypatch): monkeypatch.setattr(preflight, "_claude_bin", lambda: "/no/such/claude") ok, reason = preflight.check(force=True)