From 680e25867014164891ec1f132391f6254cfe0968 Mon Sep 17 00:00:00 2001 From: appdevelopsk Date: Fri, 30 Oct 2026 09:53:21 +0900 Subject: [PATCH 1/4] test: validate current safe policy rsync invocation rather than obsolete literal --- tests/catalog-positioning-regression.test.mjs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/tests/catalog-positioning-regression.test.mjs b/tests/catalog-positioning-regression.test.mjs index cd02b6f..63746f6 100644 --- a/tests/catalog-positioning-regression.test.mjs +++ b/tests/catalog-positioning-regression.test.mjs @@ -51,7 +51,12 @@ test('privacy-policy recovery is constrained to 17 observed stale public routes' assert.match(script,/--dry-run/); assert.match(script,/--check-live/); assert.match(script,/--apply/); - assert.match(script,/rsync -avR --itemize-changes/); + // Production runner overrides flags for its low-privilege account. Require the + // safe default and actual rsync invocation instead of a hardcoded literal. + assert.match(script,/rsync_flags="\\$\\{APP_SITE_RSYNC_FLAGS:--avR --itemize-changes\\}"/); + assert.match(script,/rsync \\$rsync_flags \\$\\{flags\\[@\\]/); + assert.match(script,/flags=\\(--dry-run\\)/); + assert.match(script,/\\[\\[ "\\$mode" == '--apply' \\]\\] && flags=\\(\\)/); assert.match(script,/python3 - "\$file" "\$tmp"/); assert.doesNotMatch(script,/rsync[^\n]*--delete/); assert.doesNotMatch(script,/rsync[^\n]*-e\s+sh/); From d141c3da06530edee6a43d9c5d7a371d01898eaa Mon Sep 17 00:00:00 2001 From: appdevelopsk Date: Fri, 30 Oct 2026 09:53:31 +0900 Subject: [PATCH 2/4] test: accept safe rsync flag override used by restricted VPS runner --- tests/search-landing-growth.test.mjs | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tests/search-landing-growth.test.mjs b/tests/search-landing-growth.test.mjs index 165c63d..9e07de4 100644 --- a/tests/search-landing-growth.test.mjs +++ b/tests/search-landing-growth.test.mjs @@ -58,7 +58,11 @@ test('public catalog icons are crawlable and explicit VPS release is non-destruc assert.match(pub,/support\/snaplingo\/index\.html/); assert.match(pub,/support\/face-reaction-battle\/index\.html/); assert.match(pub,/robots\.txt/); - assert.match(pub,/rsync -avR --itemize-changes/); + assert.match(pub,/rsync_flags="\\$\\{APP_SITE_RSYNC_FLAGS:--avR --itemize-changes\\}"/); + assert.match(pub,/rsync \\$rsync_flags \\$\\{flags\\[@\\]/); + assert.match(pub,/--dry-run\\) flags=\\(--dry-run\\)/); + assert.match(pub,/--apply\\) flags=\\(\\)/); + assert.doesNotMatch(pub,/^rsync[^\\n]*--delete/m); const live=read('scripts/check_app_discovery_live.sh'); assert.match(live,/data-position="hero"/); assert.match(live,/Allow: \/icons\/apps\//); From 2a6171767b0926d64a3b5d4cc88f698b199c1be3 Mon Sep 17 00:00:00 2001 From: appdevelopsk Date: Fri, 30 Oct 2026 09:54:39 +0900 Subject: [PATCH 3/4] test: use literal checks for safe shell flag defaults without fragile regex --- tests/catalog-positioning-regression.test.mjs | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/catalog-positioning-regression.test.mjs b/tests/catalog-positioning-regression.test.mjs index 63746f6..e6266a6 100644 --- a/tests/catalog-positioning-regression.test.mjs +++ b/tests/catalog-positioning-regression.test.mjs @@ -53,10 +53,10 @@ test('privacy-policy recovery is constrained to 17 observed stale public routes' assert.match(script,/--apply/); // Production runner overrides flags for its low-privilege account. Require the // safe default and actual rsync invocation instead of a hardcoded literal. - assert.match(script,/rsync_flags="\\$\\{APP_SITE_RSYNC_FLAGS:--avR --itemize-changes\\}"/); - assert.match(script,/rsync \\$rsync_flags \\$\\{flags\\[@\\]/); - assert.match(script,/flags=\\(--dry-run\\)/); - assert.match(script,/\\[\\[ "\\$mode" == '--apply' \\]\\] && flags=\\(\\)/); + assert.ok(script.includes('rsync_flags="${APP_SITE_RSYNC_FLAGS:--avR --itemize-changes}"')); + assert.ok(script.includes('rsync $rsync_flags ')); + assert.ok(script.includes('flags=(--dry-run)')); + assert.ok(script.includes('[[ "$mode" == \'--apply\' ]] && flags=()')); assert.match(script,/python3 - "\$file" "\$tmp"/); assert.doesNotMatch(script,/rsync[^\n]*--delete/); assert.doesNotMatch(script,/rsync[^\n]*-e\s+sh/); From f0fa51d4f289fddce8eb248b3630b61b1ecef804 Mon Sep 17 00:00:00 2001 From: appdevelopsk Date: Fri, 30 Oct 2026 09:54:56 +0900 Subject: [PATCH 4/4] test: use literal shell assertions for explicit safe deployment modes --- tests/search-landing-growth.test.mjs | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/search-landing-growth.test.mjs b/tests/search-landing-growth.test.mjs index 9e07de4..6597dc3 100644 --- a/tests/search-landing-growth.test.mjs +++ b/tests/search-landing-growth.test.mjs @@ -58,11 +58,11 @@ test('public catalog icons are crawlable and explicit VPS release is non-destruc assert.match(pub,/support\/snaplingo\/index\.html/); assert.match(pub,/support\/face-reaction-battle\/index\.html/); assert.match(pub,/robots\.txt/); - assert.match(pub,/rsync_flags="\\$\\{APP_SITE_RSYNC_FLAGS:--avR --itemize-changes\\}"/); - assert.match(pub,/rsync \\$rsync_flags \\$\\{flags\\[@\\]/); - assert.match(pub,/--dry-run\\) flags=\\(--dry-run\\)/); - assert.match(pub,/--apply\\) flags=\\(\\)/); - assert.doesNotMatch(pub,/^rsync[^\\n]*--delete/m); + assert.ok(pub.includes('rsync_flags="${APP_SITE_RSYNC_FLAGS:--avR --itemize-changes}"')); + assert.ok(pub.includes('rsync $rsync_flags ')); + assert.ok(pub.includes('--dry-run) flags=(--dry-run)')); + assert.ok(pub.includes('--apply) flags=()')); + assert.doesNotMatch(pub,/^rsync[^\n]*--delete/m); const live=read('scripts/check_app_discovery_live.sh'); assert.match(live,/data-position="hero"/); assert.match(live,/Allow: \/icons\/apps\//);