On Windows, configDir() reads APPDATA, not XDG_CONFIG_HOME. Tests that
only redirected XDG_CONFIG_HOME leaked config state across test files,
causing failures on windows-latest CI. Extract redirectConfigDir/
restoreConfigDir helper that sets both env vars, apply across all 10
test files.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Implement v1 signing verification (v1:<keyId>:<hash> canonical string) and
add loadEffectiveKeyset() with localhost-gated env var override for e2e testing.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Implement client-side Ed25519 signature verification (Phase 5B) to ensure
lesson bundles haven't been tampered with between the API and CLI.
REQUIRE_SIGNATURES is set to true (fail-closed). The ApiResult type now
exposes responseHeaders so fetchLesson can extract X-Bundle-Signature
and X-Bundle-Key-Id headers for verification.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Wrap the auth-guard refresh path in a proper-lockfile lock that re-reads
auth.json inside the critical section, so cooperating CLI processes (and
parallel in-process callers) racing on a near-expiry token can no longer
double-refresh — the late caller observes the rotated token and short-
circuits. Lock policy: 5 retries with 100–1000ms exponential backoff and
a 10s stale threshold, with auth_lock_timeout surfaced as a clean error
envelope on contention.
Add three test suites locking in invariants previously enforced only by
convention:
- auth-guard-concurrency: in-process race, cross-process race via
child_process.fork, stale-lock recovery, contention timeout
- exit-codes: per-command exit-code matrix for auth login/--status
/--logout, including the F1 fix (expired token in JSON mode → exit 3)
- json-envelope: stdout envelope contract + leakage guard catching
stray verbose markers, ANSI escapes, clack glyphs, multi-line output,
and accidental email echo
Share auth-flow and @clack/prompts module mocks via tests/helpers/* so
mock.module registrations don't leak across test files in the same
bun test process; the mocks fall through to the real implementations
when no test state is configured, leaving auth-flow.test.ts untouched.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
“mkczarkowski”