test_cli_contract.py

"""Subprocess-level privacy and CLI regression checks (no network)."""
import os
from pathlib import Path
import subprocess
import sys
import tempfile
import unittest

SCRIPT = Path(__file__).with_name('opencode_usage_monitor.py')


class CLIContract(unittest.TestCase):
    def run_cli(self, *args, env=None):
        return subprocess.run([sys.executable, str(SCRIPT), *args], env=env,
                              text=True, capture_output=True, timeout=10)

    def test_help_is_offline(self):
        p = self.run_cli('--help')
        self.assertEqual(p.returncode, 0)
        self.assertIn('--keys-file', p.stdout)
        self.assertIn('--json', p.stdout)

    def test_invalid_workers(self):
        for workers in ('0', '17', '-1', 'abc'):
            with self.subTest(workers=workers):
                self.assertEqual(self.run_cli('--workers', workers).returncode, 2)

    def test_bad_explicit_config_does_not_fall_back_or_echo(self):
        secret = 'sk-fixture-private-DO-NOT-PRINT'
        with tempfile.TemporaryDirectory() as temp:
            config = Path(temp) / 'keys.json'
            config.write_text('{"broken": "' + secret)
            env = dict(os.environ, OPENCODE_GO_API_KEY=secret, HERMES_HOME=temp)
            p = self.run_cli('--keys-file', str(config), '--once', '--json', env=env)
            self.assertEqual(p.returncode, 1)
            self.assertNotIn(secret, p.stdout + p.stderr)
            self.assertNotIn('Traceback', p.stdout + p.stderr)
            self.assertEqual([x.name for x in Path(temp).iterdir()], ['keys.json'])

    def test_empty_explicit_config_is_error(self):
        with tempfile.TemporaryDirectory() as temp:
            config = Path(temp) / 'keys.json'
            config.write_text('[]')
            p = self.run_cli('--keys-file', str(config), '--once')
            self.assertEqual(p.returncode, 1)


if __name__ == '__main__':
    unittest.main()