skills/charleswiltgen__axiom
1
0
Fork 0
mirror of https://github.com/CharlesWiltgen/Axiom.git synced 2026-09-20 19:58:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(tools): replace captured identifiers in test fixtures with synthetic ones

Browse Source 
The warn tier's last 8 findings were all real values sitting in fixtures: three
Apple OS binary UUIDs (libsystem_kernel.dylib, /usr/bin/yes, dyld) from a real
cpuprofile trace, and a display UUID captured from `devicectl device appResize
set`. None was sensitive, and the obvious response was to exempt them — which
would have been the wrong one. An exemption is permanent: it lives in the scanner
forever, and each one narrows what the gate can still catch.

The values were also inert. cmd_resize_test.go asserts the parsed "Actual size"
field and never reads the display id; the cpuprofile assertions need only the
fixture and the expectation to agree.

So the fixtures carry synthetic UUIDs now, and the scanner's own test assembles
its unpatterned control values from parts rather than writing literals. That last
part matters because the test file is shipped content like any other — a literal
there is a value the gate has to carry forever. Same move e6f267ce made for the
deny-list values: build it, don't ship it.

The tier is therefore empty with no exemptions, so the next warning is real.
Measured with `node scripts/leak-scan.ts` over 1978 shipped files: 16 -> 8 -> 0.
The 8 in the middle were real but not identifying — one OS-binary UUID per
architecture, plus a display id that devicectl regenerates on every boot
(measured across three boots of one simulator).

cmd_resize_test.go's comment claimed a verbatim capture above a value that is
now synthetic; corrected.

Verified: 518/518 unit tests, xcprof/xcsym/xcui go suites, leak scan 0/0.
This commit is contained in:
Charles Wiltgen
2026-09-16 11:45:56 -07:00
parent 180000ce24
commit 93f793709f
6 changed files with 34 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/leak-scan.test.ts
+18 -5
View File
@@ -69,6 +69,17 @@ function fixture(rel: string, content: string): { root: string; file: string } {
const SKILL = ".claude-plugin/plugins/axiom/skills/axiom-example/SKILL.md";
const scan = (root: string) => scanRepo(root, TEST_RULES);
/**
* A well-formed UUID the suppressor must NOT recognize, assembled from parts.
*
* No unpatterned UUID literal belongs in this file: it is shipped content and the
* scanner reads it like any other, so a literal here becomes a value the gate has
* to carry — and a real one from a fixture becomes a value it has to exempt. The
* test only needs the SHAPE to be well-formed; a captured value buys nothing the
* shape does not.
*/
const unpatternedUuid = (...parts: string[]): string => parts.join("-");
test("flags an owner's project name in shipped content, with its line", () => {
const { root } = fixture(SKILL, "---\nname: x\n---\nScreenshotted from the ZetaGadget build.\n");
const findings = scan(root);
@@ -108,7 +119,8 @@ test("flags session temp paths and timestamp-shaped build stamps", () => {
});
test("warns on UUID shapes without failing the gate", () => {
const { root } = fixture(SKILL, "---\nname: x\n---\n--device 6C640744-3686-474B-9643-08FCF719DEC1\n");
const uuid = unpatternedUuid("0f3a1c9e", "5b2d", "4e77", "9a10", "c4b8e6d21f03");
const { root } = fixture(SKILL, `---\nname: x\n---\n--device ${uuid}\n`);
const findings = scan(root);
assert.equal(findings.length, 1);
assert.equal(findings[0]!.severity, "warn");
@@ -219,10 +231,11 @@ test("placeholder UUID shapes are suppressed and real ones are not", () => {
"4c4c44ef55553144a1b50562264d518f", // same value, unpunctuated and lowercased
];
const real = [
"CC1CF985-BC65-3725-809F-4C1E36B8F4BA", // v3, a dylib identifier from a real trace
"6C640744-3686-474B-9643-08FCF719DEC1", // v4, random — the shape a device UDID has
"A0E2EAD5-4E82-3E1C-AC6C-1EDC646A6C4D", // v3, /usr/bin/yes from the same trace
"A237EF81-B68B-37BA-A165-92C965529534", // v3, dyld from the same trace
// Built from parts — see unpatternedUuid. These must stay unpatterned so the
// assertion below keeps testing the suppressor rather than a spelling.
unpatternedUuid("0f3a1c9e", "5b2d", "4e77", "9a10", "c4b8e6d21f03"),
unpatternedUuid("7d5e2b94", "a1c3", "3f88", "b2d4", "0e6f9a1c3b57"),
unpatternedUuid("b91f4d02", "6c58", "3a1e", "8f27", "d5c0e39b7a46"),
];
for (const uuid of placeholder) {
assert.ok(isObviousPlaceholderUuid(uuid), `${uuid} is a typed-placeholder shape`);
tools/xcprof/cpuprofile_test.go
+3 -3
View File
@@ -42,9 +42,9 @@ func TestParseCPUProfileFirstStack(t *testing.T) {
samples, _ := parseCPUProfile(loadFixture(t, "cpu-profile.xml"))
got := samples[0].Frames
want := []Frame{
{Name: "write", Addr: "0x181c05835", BinaryName: "libsystem_kernel.dylib", BinaryPath: "/usr/lib/system/libsystem_kernel.dylib", UUID: "CC1CF985-BC65-3725-809F-4C1E36B8F4BA", Arch: "arm64e", LoadAddr: "0x181c01000"},
{Name: "0x1024044f0", Addr: "0x1024045d8", BinaryName: "yes", BinaryPath: "/usr/bin/yes", UUID: "A0E2EAD5-4E82-3E1C-AC6C-1EDC646A6C4D", Arch: "arm64e", LoadAddr: "0x102404000"},
{Name: "start", Addr: "0x181887e00", BinaryName: "dyld", BinaryPath: "/usr/lib/dyld", UUID: "A237EF81-B68B-37BA-A165-92C965529534", Arch: "arm64e", LoadAddr: "0x181868000"},
{Name: "write", Addr: "0x181c05835", BinaryName: "libsystem_kernel.dylib", BinaryPath: "/usr/lib/system/libsystem_kernel.dylib", UUID: "AAAAAAAA-0000-0000-0000-000000000001", Arch: "arm64e", LoadAddr: "0x181c01000"},
{Name: "0x1024044f0", Addr: "0x1024045d8", BinaryName: "yes", BinaryPath: "/usr/bin/yes", UUID: "AAAAAAAA-0000-0000-0000-000000000002", Arch: "arm64e", LoadAddr: "0x102404000"},
{Name: "start", Addr: "0x181887e00", BinaryName: "dyld", BinaryPath: "/usr/lib/dyld", UUID: "AAAAAAAA-0000-0000-0000-000000000003", Arch: "arm64e", LoadAddr: "0x181868000"},
}
if len(got) != len(want) {
t.Fatalf("got %d frames, want %d", len(got), len(want))
tools/xcprof/symbolicate_test.go
+1 -1
View File
@@ -163,7 +163,7 @@ func TestParseCPUProfileCapturesBinaryIdentity(t *testing.T) {
continue
}
found = true
if f.UUID != "CC1CF985-BC65-3725-809F-4C1E36B8F4BA" {
if f.UUID != "AAAAAAAA-0000-0000-0000-000000000001" {
t.Errorf("UUID = %q, want the fixture's libsystem_kernel UUID", f.UUID)
}
if f.Arch != "arm64e" {
tools/xcprof/testdata/cpu-profile.xml
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
<?xml version="1.0"?>
<trace-query-result>
<node xpath='//trace-toc[1]/run[1]/data[1]/table[14]'><schema name="cpu-profile" documentation="When combined with other cpu-profile samples, creates a statistical picture of where your application is spending its time."><col><mnemonic>time</mnemonic><name>Sample Time</name><engineering-type>sample-time</engineering-type></col><col><mnemonic>thread</mnemonic><name>Thread</name><engineering-type>thread</engineering-type></col><col><mnemonic>process</mnemonic><name>Process</name><engineering-type>process</engineering-type></col><col><mnemonic>core</mnemonic><name>Core</name><engineering-type>core</engineering-type></col><col><mnemonic>thread-state</mnemonic><name>State</name><engineering-type>thread-state</engineering-type></col><col><mnemonic>weight</mnemonic><name>Cycles</name><engineering-type>cycle-weight</engineering-type></col><col><mnemonic>stack</mnemonic><name>Backtrace</name><engineering-type>tagged-backtrace</engineering-type></col></schema><row><sample-time id="1" fmt="00:00.497.399">497399291</sample-time><thread id="2" fmt="Main Thread (0x64dcced) (yes, pid: 37476)"><tid id="3" fmt="0x64dcced">105762029</tid><process id="4" fmt="yes (37476)"><pid id="5" fmt="37476">37476</pid><device-session id="6" fmt="TODO">TODO</device-session></process></thread><process ref="4"/><core id="7" fmt="CPU 4 (P Core)">4</core><thread-state id="8" fmt="Running">Running</thread-state><cycle-weight id="9" fmt="22">22</cycle-weight><tagged-backtrace id="10" fmt="write ← (2 other frames)"><backtrace id="11"><frame id="12" name="write" addr="0x181c05835"><binary id="13" name="libsystem_kernel.dylib" UUID="CC1CF985-BC65-3725-809F-4C1E36B8F4BA" arch="arm64e" load-addr="0x181c01000" path="/usr/lib/system/libsystem_kernel.dylib"/></frame><frame id="14" name="0x1024044f0" addr="0x1024045d8"><binary id="15" name="yes" UUID="A0E2EAD5-4E82-3E1C-AC6C-1EDC646A6C4D" arch="arm64e" load-addr="0x102404000" path="/usr/bin/yes"/></frame><frame id="16" name="start" addr="0x181887e00"><binary id="17" name="dyld" UUID="A237EF81-B68B-37BA-A165-92C965529534" arch="arm64e" load-addr="0x181868000" path="/usr/lib/dyld"/></frame></backtrace><uint64 id="18" fmt="0">0</uint64></tagged-backtrace></row>
<node xpath='//trace-toc[1]/run[1]/data[1]/table[14]'><schema name="cpu-profile" documentation="When combined with other cpu-profile samples, creates a statistical picture of where your application is spending its time."><col><mnemonic>time</mnemonic><name>Sample Time</name><engineering-type>sample-time</engineering-type></col><col><mnemonic>thread</mnemonic><name>Thread</name><engineering-type>thread</engineering-type></col><col><mnemonic>process</mnemonic><name>Process</name><engineering-type>process</engineering-type></col><col><mnemonic>core</mnemonic><name>Core</name><engineering-type>core</engineering-type></col><col><mnemonic>thread-state</mnemonic><name>State</name><engineering-type>thread-state</engineering-type></col><col><mnemonic>weight</mnemonic><name>Cycles</name><engineering-type>cycle-weight</engineering-type></col><col><mnemonic>stack</mnemonic><name>Backtrace</name><engineering-type>tagged-backtrace</engineering-type></col></schema><row><sample-time id="1" fmt="00:00.497.399">497399291</sample-time><thread id="2" fmt="Main Thread (0x64dcced) (yes, pid: 37476)"><tid id="3" fmt="0x64dcced">105762029</tid><process id="4" fmt="yes (37476)"><pid id="5" fmt="37476">37476</pid><device-session id="6" fmt="TODO">TODO</device-session></process></thread><process ref="4"/><core id="7" fmt="CPU 4 (P Core)">4</core><thread-state id="8" fmt="Running">Running</thread-state><cycle-weight id="9" fmt="22">22</cycle-weight><tagged-backtrace id="10" fmt="write ← (2 other frames)"><backtrace id="11"><frame id="12" name="write" addr="0x181c05835"><binary id="13" name="libsystem_kernel.dylib" UUID="AAAAAAAA-0000-0000-0000-000000000001" arch="arm64e" load-addr="0x181c01000" path="/usr/lib/system/libsystem_kernel.dylib"/></frame><frame id="14" name="0x1024044f0" addr="0x1024045d8"><binary id="15" name="yes" UUID="AAAAAAAA-0000-0000-0000-000000000002" arch="arm64e" load-addr="0x102404000" path="/usr/bin/yes"/></frame><frame id="16" name="start" addr="0x181887e00"><binary id="17" name="dyld" UUID="AAAAAAAA-0000-0000-0000-000000000003" arch="arm64e" load-addr="0x181868000" path="/usr/lib/dyld"/></frame></backtrace><uint64 id="18" fmt="0">0</uint64></tagged-backtrace></row>
<row><sample-time id="19" fmt="00:00.554.159">554159791</sample-time><thread ref="2"/><process ref="4"/><core id="20" fmt="CPU 8 (P Core)">8</core><thread-state ref="8"/><cycle-weight id="21" fmt="10.16 k">10165</cycle-weight><tagged-backtrace ref="10"/></row>
<row><sample-time id="22" fmt="00:00.621.129">621129958</sample-time><thread ref="2"/><process ref="4"/><core id="23" fmt="CPU 3 (P Core)">3</core><thread-state ref="8"/><cycle-weight id="24" fmt="2.15 k">2149</cycle-weight><tagged-backtrace ref="10"/></row>
<row><sample-time id="25" fmt="00:00.679.254">679254583</sample-time><thread ref="2"/><process ref="4"/><core ref="20"/><thread-state ref="8"/><cycle-weight id="26" fmt="19.49 k">19492</cycle-weight><tagged-backtrace ref="10"/></row>
tools/xcsym/dwarfdump_test.go
+6 -6
View File
@@ -7,14 +7,14 @@ import (
)
func TestReadUUIDs_ParsesOutput(t *testing.T) {
sample := `UUID: 4C4C44EF-5555-3144-A1B5-0562264D518F (arm64) /path/to/MyApp
sample := `UUID: AAAAAAAA-0000-0000-0000-000000000005 (arm64) /path/to/MyApp
UUID: ABCDEF01-2345-6789-ABCD-EF0123456789 (arm64e) /path/to/MyApp
`
got := parseDwarfdumpUUIDs([]byte(sample))
if len(got) != 2 {
t.Fatalf("expected 2 UUIDs, got %d", len(got))
}
if got[0].UUID != "4C4C44EF-5555-3144-A1B5-0562264D518F" {
if got[0].UUID != "AAAAAAAA-0000-0000-0000-000000000005" {
t.Errorf("UUID 0: got %q", got[0].UUID)
}
if got[0].Arch != "arm64" {
@@ -42,11 +42,11 @@ func TestNormalizeUUID(t *testing.T) {
cases := []struct {
in, want string
}{
{"4c4c44ef-5555-3144-a1b5-0562264d518f", "4C4C44EF-5555-3144-A1B5-0562264D518F"},
{"4C4C44EF55553144A1B50562264D518F", "4C4C44EF-5555-3144-A1B5-0562264D518F"},
{"4c4c44ef55553144a1b50562264d518f", "4C4C44EF-5555-3144-A1B5-0562264D518F"},
{"abcdef01-2345-6789-abcd-ef0123456789", "ABCDEF01-2345-6789-ABCD-EF0123456789"},
{"ABCDEF0123456789ABCDEF0123456789", "ABCDEF01-2345-6789-ABCD-EF0123456789"},
{"abcdef0123456789abcdef0123456789", "ABCDEF01-2345-6789-ABCD-EF0123456789"},
// malformed passthrough (upper-cased but otherwise untouched so callers can error on them)
{"4c4c44ef555531 44a1b50562264d518f", "4C4C44EF555531 44A1B50562264D518F"},
{"abcdef01234567 89abcdef0123456789", "ABCDEF01234567 89ABCDEF0123456789"},
{"not-a-uuid", "NOT-A-UUID"},
}
for _, c := range cases {
tools/xcui/cmd_resize_test.go
+5 -2
View File
@@ -33,9 +33,12 @@ func TestParseSizesRejectsTheWholeListOnOneBadEntry(t *testing.T) {
}
func TestParseActualSizeReadsTheLabelledField(t *testing.T) {
// Verbatim shape of `devicectl device appResize set` output, captured 2026-08-15.
// Verbatim shape of `devicectl device appResize set` output. The display
// identifier is synthetic: devicectl regenerates display UUIDs on every boot
// (measured — a simulator's Resizable display reported a different one on each
// of three boots), so the real 2026-08-15 capture carried nothing worth keeping.
out := `Adjusted resizable app session geometry.
Display: Resizable (6C640744-3686-474B-9643-08FCF719DEC1)
Display: Resizable (AAAAAAAA-0000-0000-0000-000000000004)
Requested size: 1100.0x500.0
Requested corner radius: 0.0
Actual size: 1100.0x550.0