CodeVetter · Repo Unpack · Testing signals
npm/cli
Tests and CI were inspected, not executed; test existence and configured coverage thresholds are not passing results. The inspected manifests and tests use TAP, correcting the inventory's Vitest tag for these surfaces. Coverage combines temporary-project integration tests, mocked registries and scripts, output assertions, and smoke tests. Inventory and test inspection were bounded, with explicit platform and live-integration limits.
- Root tests use tap ^16.3.9 and the test script is tap; docs and mock-globals also use TAP. CONTRIBUTING expects regression tests and describes a 100% coverage requirement, without establishing achieved coverage.
- Root TAP excludes docs, smoke-tests, mock-globals, mock-registry, and workspaces from root coverage/test discovery; workspace suites therefore require separate execution rather than relying on root tests.
- mock-npm breaks configuration-definition singleton caching, subclasses Npm, awaits background log cleanup, and reconstructs config.argv for direct exec calls; these deliberate test/runtime differences matter when reproducing dispatch bugs.
- CLI entry tests assert process-title sanitization and redaction of registry URL passwords in both separate-value and equals-style arguments; these assertions cover specified examples rather than arbitrary secrets.
- Install regression tests check preinstall before dependency presence, postinstall afterward, ignore-scripts suppression, and preinstall failure preventing dependency installation; the script runner is mocked rather than executing a real bootstrap command.
- ci tests inspect real temporary node_modules changes with mocked tarball/advisory responses, verify dry-run preservation and repeated cleanup, reject stale packageExtensions state, and assert lifecycle ordering and failure behavior.
- Login tests use mock globals and MockRegistry, then inspect persisted INI state for token replacement, preserved scoped email, and scoped registry selection; they do not demonstrate successful authentication against a live registry.
- CI configures Linux, macOS, and Windows tests across Node 22/24/26, with Intel macOS combinations excluded; smoke/publish-dryrun jobs run on Linux, and the exec smoke case explicitly skips Windows. These workflow definitions were inspected, not run.