test(security): bind the file census to the guard's EMITTED output, not to a return value

[andrei-hasna]

Remediation on the review of #340 (merged). Test-only — the guard itself is untouched by this PR.

The defect

The census change in #340 shipped undefended. Deleting (${census}) from the fail path's console.error left the suite fully green:

rc_test=0
19 pass
0 fail

expect(scanned).toBe(2) reads scanPaths()'s return value. A returned number and a printed line are different things, and only one of them is the deliverable. I reproduced the reviewer's mutation independently before fixing it and got the same green.

This is the identical hole #340 argued about the arity half — asserting a positive that cannot distinguish the fixed state from the broken one. I made that argument and then failed to apply it to my own change.

Why it warrants a real regression rather than a note

The CI step name Package-manager secret guard reads identically before and after the scan was widened from a basename allow-list to the whole text tree. A green step proves a guard ran, never which guard ran. The count of files opened — roughly 1,220 then, 22,745 now — is the only observable that changed, and a release gate outside this repository keys on scanned > 20000 in this output. If the census silently stops printing on the fail path, that external gate reads the absence as a pass. A number that is load-bearing elsewhere needs a test that fails when it goes missing.

What the tests do

They run the real entrypoint against a synthetic git-tracked package — a git index plus a package.json, so the guard's git ls-files union with npm pack --dry-run is exercised the way a publish would — and assert the emitted text:

• the census is present in the fail path's stderr, not just in a return value;
• the number is the true file count (2), so it cannot be satisfied by a hardcoded literal;
• the report still never echoes what it matched;
• the pass path carries it too.

Verified in both directions

vs main 134cf246 (fail path had no census)        EXITCODE=1   20 pass / 1 fail
vs the reviewer's exact mutation on the fix       EXITCODE=1   20 pass / 1 fail
restored                                          EXITCODE=0   21 pass / 0 fail

Suite 3817 pass / 190 fail against a 3815 / 190 baseline measured on HEAD~1 — identical failure sets, the +2 are these tests. bun run typecheck exits 0. Sentinels are synthetic; 0 of the naming standard's 18 example names and 0 of the 2 scrubbed connector literals appear in the added lines.

Note on how this PR is based

#340 was merged while this remediation was in flight, and my push re-created the auto-deleted branch. Rather than PR that stale branch — whose diff would have reverted the bun run build && bun test change that landed in e8128814 — I cut a fresh branch from current main and cherry-picked the test commit. The diff against main is 74 added lines in one file.

Refs: todos 38d15243

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #341 @ f939144 — lens: correctness+security+gates, reviewer unresolved-account001 (1 of 1)

Reviewed exact candidate:

• Confirmed HEAD f9391447fb0a2bdae1dd3bb967a07977201f43b4 and fetched base origin/main at 12a9018be4312ddd4d787bf5e5b526e3471ed06a.
• Ran git log --oneline origin/main..HEAD (exit 0), git diff origin/main...HEAD --stat (exit 0), and read the full diff.
• Read the complete changed scripts/check-package-secrets.test.ts, the surrounding/complete scripts/check-package-secrets.ts entrypoint and scan path, and the gate declarations in package.json.
• Traced both added end-to-end fixtures through git ls-files + npm pack --dry-run, scanPaths, and the emitted stdout/stderr census. The sentinels are synthetic and the failure-path assertion verifies the matched value is not emitted.

Commands and results:

• bun install — exit 0. Setup only, not counted as the repository test gate; 183 root packages and 164 dashboard packages installed.
• bun run typecheck — exit 0. Pass/fail counts: not emitted by the declared TypeScript gate.
• bun run test — exit 0. Build completed; 4,007 tests passed, 0 failed, across 454 files (35,259 expectations).
• git diff --check origin/main...HEAD — exit 0.

Blocking P0/P1 findings: none.

Non-blocking follow-ups: none.

Verdict: GO. The added tests exercise the real guard entrypoint on both success and failure output paths and correctly bind the observable file census without leaking the matched sentinel.