feat: release 2.7.0

tests/command/module-graph.test.ts

@@ -14,9 +14,11 @@ describe("CLI module graph", () => {
     expect(new TextDecoder().decode(probe.stdout)).toContain("USAGE");
   });
 
-  test("production build retains the passive updater's runtime environment guard", () => {
+  test("production build retains the startup updater's runtime environment guard", () => {
     const root = join(import.meta.dir, "../..");
-    const { scripts } = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+    const { scripts } = JSON.parse(
+      readFileSync(join(root, "package.json"), "utf8"),
+    );
     const args = (scripts.build as string).split(/\s+/);
     expect(args).toContain("--env");
     expect(args[args.indexOf("--env") + 1]).toBe("disable");
@@ -31,8 +33,10 @@ describe("CLI module graph", () => {
       expect(new TextDecoder().decode(build.stderr)).toBe("");
       expect(build.exitCode).toBe(0);
       const bundle = readFileSync(join(outdir, "index.js"), "utf8");
-      expect(bundle).toMatch(/process\.env\.NODE_ENV\s*===\s*["']test["']/);
-      expect(bundle).toMatch(/process\.env\.NODE_ENV\s*===\s*["']development["']/);
+      expect(bundle).toContain("NODE_ENV");
+      expect(bundle).toContain('"development"');
+      expect(bundle).toContain('"test"');
+      expect(bundle).toContain("KUBER_VERSION_REEXEC");
     } finally {
       rmSync(outdir, { recursive: true, force: true });
     }

tests/command/trust.test.ts

@@ -1,8 +1,14 @@
 import { afterEach, describe, expect, spyOn, test } from "bun:test";
 import { rm } from "node:fs/promises";
+import { runCommand } from "citty";
 import { KuberApiError, type ApiRequestInit } from "../../lib/api";
 import { getTrustPath, readTrust, updateTrust } from "../../lib/trust";
-import { grantTrust, revokeTrust, statusTrust } from "../../command/trust";
+import {
+  grantTrust,
+  revokeTrust,
+  statusTrust,
+  trust,
+} from "../../command/trust";
 
 const originalConfig = process.env.XDG_CONFIG_HOME;
 const identity = { project: "demo", fingerprint: "a".repeat(64) };
@@ -28,6 +34,31 @@ function requester(
 }
 
 describe("trust command", () => {
+  test("citty dispatch of bare trust runs the parent grant handler", async () => {
+    await expect(runCommand(trust, { rawArgs: [] })).rejects.toThrow();
+  });
+
+  test.each(["status", "revoke"])(
+    "citty dispatch of %s does not run the parent grant handler",
+    async (subcommand) => {
+      const command = {
+        ...trust,
+        subCommands: Object.fromEntries(
+          Object.entries(trust.subCommands!).map(([name, child]) => [
+            name,
+            { ...child, run: async () => {} },
+          ]),
+        ),
+      };
+
+      // Without a provided app context, a parent grant would reject in
+      // current(). Successful dispatch proves citty did not grant afterward.
+      await expect(
+        runCommand(command, { rawArgs: [subcommand] }),
+      ).resolves.toBeDefined();
+    },
+  );
+
   test("grants, reports, and revokes the current namespace fingerprint", async () => {
     process.env.XDG_CONFIG_HOME = `/tmp/kuber-trust-command-${crypto.randomUUID()}`;
     const calls: Array<{ path: string; init?: ApiRequestInit }> = [];