From 00f14a0018df99366069ed807760f9a7754986f9 Mon Sep 17 00:00:00 2001
From: wenshao <shaojin.wensj@alibaba-inc.com>
Date: Sun, 2 Aug 2026 14:40:37 +0800
Subject: [PATCH] test(review): pin drive's capped-stream case to its
 invariant, not to bash 5.2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The SIGPIPE fabricated-exit-code test asserted the one wrong answer CI's
bash 5.2 produces (the EXIT trap firing with rc=0), and failed on every
other shell. Measured, per version, same script, same pipe:

  - bash 5.2 (CI ubuntu):     rc=0    — fabricated clean pass
  - bash 5.3 (homebrew macOS): empty  — sentinel file created, write lost
  - bash 3.2 (stock macOS):   rc=1    — the echo's EPIPE error recorded,
                                        plus a stray padding line leaked
                                        into the sentinel file

Three shells, three different wrong answers. The assertion now pins the
one invariant they share — the script's real `exit 5` never survives the
cap — which is the design point the test exists to defend, and holds on
every bash instead of one. (A first draft enumerated the wrong answers as
an allowed set and was immediately falsified by the third shell; the
enumeration is a moving target, the invariant is not.)

Also reads the sentinel through existsSync like the suite's own realExit
helper, so a shell that never creates the file reports null instead of
throwing ENOENT.
---
 .../cli/src/commands/review/drive.test.ts     | 29 ++++++++++++++-----
 1 file changed, 22 insertions(+), 7 deletions(-)

diff --git a/packages/cli/src/commands/review/drive.test.ts b/packages/cli/src/commands/review/drive.test.ts
index 2fedd43a665..15793b97a0a 100644
--- a/packages/cli/src/commands/review/drive.test.ts
+++ b/packages/cli/src/commands/review/drive.test.ts
@@ -126,14 +126,23 @@ describe('the wrapper, driven for real', () => {
     expect(sentinelExitCode(readFileSync(rc, 'utf8'))).toBe(0);
   });
 
-  it('capping the STREAM would FABRICATE an exit code — measured, not assumed', () => {
+  it('capping the STREAM never yields the true exit code — measured, not assumed', () => {
     // Why the log is bounded by watching its size rather than by `head -c`.
     // Piping the drive through `head` kills the writer with SIGPIPE mid-loop,
-    // and the EXIT trap then fires with `$?` from the last successful echo: a
-    // script whose final statement is `exit 5` reports rc=0. Not a lost
-    // verdict — a fabricated one, a failing run presented as a clean pass.
-    // Pinned so the shortcut is not reintroduced by someone who reasons about
-    // it instead of running it.
+    // and what survives is bash-version-dependent — measured, per version:
+    //   - bash 5.2 (CI's ubuntu): the EXIT trap fires with `$?` from the last
+    //     successful echo — rc=0, a FABRICATED clean pass;
+    //   - bash 5.3 (homebrew macOS): the trap's redirect creates the sentinel
+    //     file but the write is LOST — an empty file, no verdict;
+    //   - bash 3.2 (stock macOS): the trap records the echo's EPIPE write
+    //     error — rc=1, a fabricated FAILURE code, with a stray padding line
+    //     leaked into the sentinel file for good measure.
+    // Three shells, three different wrong answers — which is why the
+    // assertion pins the one invariant they share instead of any version's
+    // flavor of wrong: the script's real `exit 5` NEVER survives the cap.
+    // (The first draft of this fix enumerated the wrong answers and was
+    // immediately falsified by running it on a fourth shell; the enumeration
+    // is a moving target, the invariant is not.)
     const dir = mkdtempSync(join(tmpdir(), 'drv-'));
     const rc = join(dir, 'drive.rc');
     const sh = join(dir, 's.sh');
@@ -149,7 +158,13 @@ describe('the wrapper, driven for real', () => {
       ['-c', `bash ${sh} 2>&1 | head -c 4096 > ${join(dir, 'log')}`],
       { encoding: 'utf8' },
     );
-    expect(sentinelExitCode(readFileSync(rc, 'utf8'))).toBe(0); // NOT 5
+    const reported = existsSync(rc)
+      ? sentinelExitCode(readFileSync(rc, 'utf8'))
+      : null;
+    // Fabricated (0, 1, …) or lost (null) — any of them is an untrustworthy
+    // verdict, and all prove the design point. What must never appear is the
+    // truth.
+    expect(reported).not.toBe(5);
   });
 });