TestClaudeCodeIsNeverSentToANonDefaultEndpoint only checked that the returned source was nil, which would still pass if resolveClaudeCode loaded the credential and discarded it. Swap the fixture for malformed JSON: if the file is ever read before the endpoint check runs, Load's parse error surfaces and the test fails loudly instead of passing on an assumption nothing was verifying. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Showing 1 changed file with 26 additions and 3 deletions.
| @@ -49,6 +49,25 @@ func TestClaudeCodeFillsInAMissingCredential(t *testing.T) { | ||
| 49 | 49 | } |
| 50 | 50 | } |
| 51 | 51 | |
| 52 | + // tripwireHome writes a credentials file that is malformed JSON: a | |
| 53 | + // deliberate landmine, not a fixture. If resolveClaudeCode ever reads it | |
| 54 | + // before deciding the endpoint disqualifies discovery, claudecode.Load | |
| 55 | + // returns a parse error and the test surfaces that loudly, rather than | |
| 56 | + // passing on the unobservable (and here false) assumption that the file | |
| 57 | + // went untouched. | |
| 58 | + func tripwireHome(t *testing.T) string { | |
| 59 | + t.Helper() | |
| 60 | + home := t.TempDir() | |
| 61 | + dir := filepath.Join(home, ".claude") | |
| 62 | + if err := os.MkdirAll(dir, 0o700); err != nil { | |
| 63 | + t.Fatal(err) | |
| 64 | + } | |
| 65 | + if err := os.WriteFile(filepath.Join(dir, ".credentials.json"), []byte("{not json"), 0o600); err != nil { | |
| 66 | + t.Fatal(err) | |
| 67 | + } | |
| 68 | + return home | |
| 69 | + } | |
| 70 | + | |
| 52 | 71 | // An explicit credential wins. We never override what the user typed. |
| 53 | 72 | func TestClaudeCodeIsSkippedWhenACredentialExists(t *testing.T) { |
| 54 | 73 | c := llm.New(llm.WithBaseURL(llm.DefaultBaseURL), llm.WithAPIKey("sk-ant-explicit")) |
| @@ -63,13 +82,17 @@ func TestClaudeCodeIsSkippedWhenACredentialExists(t *testing.T) { | ||
| 63 | 82 | |
| 64 | 83 | // The security property: a credential we found is never sent to an endpoint |
| 65 | 84 | // the user pointed us at. "We did not send it" is not observable from outside, |
| 66 | - // so it is a test rather than a comment. | |
| 85 | + // so it is a test rather than a comment. The home directory here contains | |
| 86 | + // malformed JSON rather than a valid credential: if resolveClaudeCode ever | |
| 87 | + // reads the file before rejecting the non-default endpoint, claudecode.Load | |
| 88 | + // fails to parse it and err comes back non-nil, which the assertion below | |
| 89 | + // catches. A nil err is what proves the file was never opened. | |
| 67 | 90 | func TestClaudeCodeIsNeverSentToANonDefaultEndpoint(t *testing.T) { |
| 68 | 91 | c := llm.New(llm.WithBaseURL("http://gateway.example")) |
| 69 | 92 | c.ClearCredentialsForTest() |
| 70 | - src, _, err := resolveClaudeCode(c, fakeHome(t), false) | |
| 93 | + src, _, err := resolveClaudeCode(c, tripwireHome(t), false) | |
| 71 | 94 | if err != nil { |
| 72 | - t.Fatalf("resolveClaudeCode: %v", err) | |
| 95 | + t.Fatalf("resolveClaudeCode read the credentials file (err = %v); it must not touch disk once the endpoint disqualifies discovery", err) | |
| 73 | 96 | } |
| 74 | 97 | if src != nil { |
| 75 | 98 | t.Fatal("a discovered credential must never go to a non-default endpoint") |