# Testing signals — npm/cli

> Canonical page: https://codevetter.com/unpack/cli/testing-signals

# Testing signals — npm/cli

Scanned commit b317f16c80df02ea3628cfa77170d5ae9b59720c (2026-10-01). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

Tests and CI were inspected, not executed; test existence and configured coverage thresholds are not passing results. The inspected manifests and tests use TAP, correcting the inventory's Vitest tag for these surfaces. Coverage combines temporary-project integration tests, mocked registries and scripts, output assertions, and smoke tests. Inventory and test inspection were bounded, with explicit platform and live-integration limits.
- Root tests use tap ^16.3.9 and the test script is tap; docs and mock-globals also use TAP. CONTRIBUTING expects regression tests and describes a 100% coverage requirement, without establishing achieved coverage. — [package.json#L189-217](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/package.json#L189-L217) [docs/package.json#L7-16](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/docs/package.json#L7-L16) [mock-globals/package.json#L7-15](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/mock-globals/package.json#L7-L15) [CONTRIBUTING.md#L47-49](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/CONTRIBUTING.md#L47-L49)
- Root TAP excludes docs, smoke-tests, mock-globals, mock-registry, and workspaces from root coverage/test discovery; workspace suites therefore require separate execution rather than relying on root tests. — [package.json#L240-255](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/package.json#L240-L255) [.github/workflows/ci-npmcli-arborist.yml#L111-120](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/.github/workflows/ci-npmcli-arborist.yml#L111-L120)
- mock-npm breaks configuration-definition singleton caching, subclasses Npm, awaits background log cleanup, and reconstructs config.argv for direct exec calls; these deliberate test/runtime differences matter when reproducing dispatch bugs. — [test/fixtures/mock-npm.js#L51-94](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/test/fixtures/mock-npm.js#L51-L94)
- CLI entry tests assert process-title sanitization and redaction of registry URL passwords in both separate-value and equals-style arguments; these assertions cover specified examples rather than arbitrary secrets. — [test/lib/cli/entry.js#L71-105](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/test/lib/cli/entry.js#L71-L105)
- Install regression tests check preinstall before dependency presence, postinstall afterward, ignore-scripts suppression, and preinstall failure preventing dependency installation; the script runner is mocked rather than executing a real bootstrap command. — [test/lib/commands/install.js#L120-144](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/test/lib/commands/install.js#L120-L144) [test/lib/commands/install.js#L147-177](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/test/lib/commands/install.js#L147-L177) [test/lib/commands/install.js#L181-213](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/test/lib/commands/install.js#L181-L213)
- ci tests inspect real temporary node_modules changes with mocked tarball/advisory responses, verify dry-run preservation and repeated cleanup, reject stale packageExtensions state, and assert lifecycle ordering and failure behavior. — [test/lib/commands/ci.js#L52-92](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/test/lib/commands/ci.js#L52-L92) [test/lib/commands/ci.js#L95-139](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/test/lib/commands/ci.js#L95-L139) [test/lib/commands/ci.js#L251-288](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/test/lib/commands/ci.js#L251-L288) [test/lib/commands/ci.js#L324-356](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/test/lib/commands/ci.js#L324-L356)
- Login tests use mock globals and MockRegistry, then inspect persisted INI state for token replacement, preserved scoped email, and scoped registry selection; they do not demonstrate successful authentication against a live registry. — [test/lib/commands/login.js#L7-21](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/test/lib/commands/login.js#L7-L21) [test/lib/commands/login.js#L44-66](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/test/lib/commands/login.js#L44-L66) [test/lib/commands/login.js#L69-114](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/test/lib/commands/login.js#L69-L114)
- CI configures Linux, macOS, and Windows tests across Node 22/24/26, with Intel macOS combinations excluded; smoke/publish-dryrun jobs run on Linux, and the exec smoke case explicitly skips Windows. These workflow definitions were inspected, not run. — [.github/workflows/ci.yml#L62-100](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/.github/workflows/ci.yml#L62-L100) [.github/workflows/ci.yml#L158-198](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/.github/workflows/ci.yml#L158-L198) [.github/workflows/ci.yml#L207-247](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/.github/workflows/ci.yml#L207-L247) [smoke-tests/test/index.js#L368-388](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/smoke-tests/test/index.js#L368-L388)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)