Files
fusion/packages/engine/vitest.config.ts
gsxdsm 8bc3d7b0a5 FN-6042: raise dependency security floors
Harden dependency floors and update the Vitest toolchain to patched releases.

- upgrade workspace vitest and @vitest/coverage-v8 dependencies to the 4.1 line across packages and plugins
- pin transitive protobufjs via pnpm overrides and lockfile updates to patched versions
- adapt Vitest configs, engine test helpers, and security-floor coverage for the new dependency baselines
- add the published CLI changeset and related workspace/package metadata updates included in the task branch

Files changed:
 .changeset/fn-6042-security-dependencies.md        |   5 +
 AGENTS.md                                          |   4 +
 Dockerfile                                         |   3 +
 docs/PLUGIN_AUTHORING.md                           |   2 -
 package.json                                       |   3 +-
 packages/cli/package.json                          |   4 +-
 packages/cli/vitest.config.ts                      |   2 +-
 packages/core/package.json                         |   4 +-
 packages/core/vitest.config.ts                     |   2 +-
 packages/dashboard/app/test/mockApi.ts             |   4 +-
 packages/dashboard/package.json                    |   4 +-
 packages/dashboard/vitest.config.ts                |   2 +-
 packages/desktop/package.json                      |   4 +-
 packages/desktop/vitest.config.ts                  |   2 +-
 packages/droid-cli/package.json                    |   2 +-
 packages/droid-cli/vitest.config.ts                |   2 +-
 packages/engine/package.json                       |   4 +-
 .../engine/src/__tests__/executor-test-helpers.ts  |  29 +-
 .../engine/src/__tests__/gridlock-detector.test.ts |   5 +-
 .../src/__tests__/heartbeat-scheduler.test.ts      |   3 +-
 packages/engine/src/__tests__/scheduler.test.ts    |  24 +-
 packages/engine/src/__tests__/self-healing.test.ts |   5 +
 packages/engine/tsconfig.json                      |   3 +-
 packages/engine/vitest.config.ts                   |  10 +-
 packages/i18n/package.json                         |   2 +-
 packages/i18n/vitest.config.ts                     |   7 +
 packages/mobile/package.json                       |   2 +-
 packages/mobile/vitest.config.ts                   |   2 +-
 packages/pi-claude-cli/package.json                |   2 +-
 packages/pi-claude-cli/vitest.config.ts            |   2 +-
 packages/pi-llama-cpp/package.json                 |   2 +-
 packages/pi-llama-cpp/vitest.config.ts             |   2 +-
 packages/plugin-sdk/package.json                   |   2 +-
 packages/plugin-sdk/vitest.config.ts               |   2 +-
 .../examples/fusion-plugin-auto-label/package.json |   2 +-
 .../fusion-plugin-auto-label/vitest.config.ts      |   2 +-
 .../examples/fusion-plugin-ci-status/package.json  |   2 +-
 .../fusion-plugin-ci-status/vitest.config.ts       |   2 +-
 .../fusion-plugin-notification/package.json        |   2 +-
 .../fusion-plugin-notification/vitest.config.ts    |   2 +-
 .../fusion-plugin-settings-demo/package.json       |   2 +-
 .../fusion-plugin-settings-demo/vitest.config.ts   |   2 +-
 plugins/fusion-plugin-acp-runtime/package.json     |   2 +-
 plugins/fusion-plugin-acp-runtime/vitest.config.ts |   2 +-
 plugins/fusion-plugin-agent-browser/package.json   |   2 +-
 .../fusion-plugin-agent-browser/vitest.config.ts   |   2 +-
 .../fusion-plugin-cli-printing-press/package.json  |   2 +-
 .../vitest.config.ts                               |   2 +-
 .../package.json                                   |   2 +-
 .../src/__tests__/orchestrator-live-output.test.ts |   4 +-
 .../vitest.config.ts                               |   2 +-
 plugins/fusion-plugin-cursor-runtime/package.json  |   4 +-
 .../fusion-plugin-dependency-graph/package.json    |   4 +-
 .../vitest.config.ts                               |   2 +-
 plugins/fusion-plugin-droid-runtime/package.json   |   2 +-
 .../fusion-plugin-droid-runtime/vitest.config.ts   |   2 +-
 plugins/fusion-plugin-even-cards/package.json      |   2 +-
 plugins/fusion-plugin-even-cards/vitest.config.ts  |   2 +-
 .../package.json                                   |   2 +-
 .../vitest.config.ts                               |   2 +-
 plugins/fusion-plugin-hermes-runtime/package.json  |   2 +-
 .../fusion-plugin-hermes-runtime/vitest.config.ts  |   2 +-
 .../fusion-plugin-openclaw-runtime/package.json    |   2 +-
 .../vitest.config.ts                               |   2 +-
 .../fusion-plugin-paperclip-runtime/package.json   |   2 +-
 .../vitest.config.ts                               |   2 +-
 plugins/fusion-plugin-reports/package.json         |   2 +-
 .../src/__tests__/review-panel.test.ts             |   6 +-
 plugins/fusion-plugin-reports/vitest.config.ts     |   2 +-
 plugins/fusion-plugin-roadmap/package.json         |   2 +-
 plugins/fusion-plugin-roadmap/vitest.config.ts     |   2 +-
 plugins/fusion-plugin-whatsapp-chat/package.json   |   2 +-
 .../fusion-plugin-whatsapp-chat/vitest.config.ts   |   2 +-
 pnpm-lock.yaml                                     | 626 ++++++++-------------
 .../__tests__/dependency-security-floor.test.mjs   |  95 ++++
 75 files changed, 475 insertions(+), 491 deletions(-)

Fusion-Task-Id: FN-6042

Fusion-Task-Lineage: fff6a1cb-8937-435c-9a91-b7c7a59cc80e
2026-06-08 15:19:27 -07:00

150 lines
6.6 KiB
TypeScript

import { defineConfig } from "vitest/config";
import { resolve } from "node:path";
import { computeMaxWorkers } from "../core/src/__test-utils__/vitest-workers";
const maxWorkers = computeMaxWorkers();
export default defineConfig({
resolve: {
alias: {
"@fusion/core": resolve(__dirname, "../core/src/index.ts"),
"@fusion/test-utils": resolve(__dirname, "../core/src/__test-utils__/workspace.ts"),
"@fusion/engine": resolve(__dirname, "./src/index.ts"),
"@fusion/plugin-sdk": resolve(__dirname, "../plugin-sdk/src/index.ts"),
"@fusion/dashboard": resolve(__dirname, "../dashboard/src/index.ts"),
},
},
test: {
setupFiles: [
resolve(__dirname, "../core/src/__test-utils__/vitest-setup.ts"),
],
globalSetup: [resolve(__dirname, "../core/src/__test-utils__/vitest-teardown.ts")],
pool: "threads",
maxWorkers,
minWorkers: 1,
fileParallelism: true,
// Enable isolate to allow parallel execution of tests with conflicting mocks
isolate: true,
// Engine real-git tests spawn many subprocesses; under full-suite concurrent
// load even 60 s can fire prematurely. Bump to 120 s — the guard only fires
// on hangs, so healthy tests pay nothing.
env: {
FUSION_TEST_SUBPROCESS_TIMEOUT_MS: "120000",
},
// Real-git integration tests need more than the default 5 s under concurrent
// load (other packages run tests at the same time via pnpm recursive).
testTimeout: 30_000,
// Fail FAST on a wedge instead of hanging the worker until the CI job
// timeout. A real-git test can leave a promise (e.g. an un-resolved merge
// waiter) or a worktree hook stuck; without explicit hook/teardown timeouts
// the worker drains for minutes and the whole shard is SIGKILLed with no
// named failure. These bound setup/teardown so the culprit test is reported.
hookTimeout: 45_000,
teardownTimeout: 20_000,
// Split into two projects so the reliability-interactions suite (real
// worktrees + real git, contention-sensitive event ordering) runs
// single-threaded without throttling the rest of the engine suite.
// Keep include globs project-scoped (not at root) so engine-reliability
// does not inherit full-suite include and rerun everything single-threaded
// (FN-5537: this caused long runs and external SIGTERM 143 kills).
projects: [
{
extends: true,
test: {
name: "engine-core",
// The curated merge-gate suite (see docs/testing.md "Merge gate").
// Membership is an explicit allow-list, NOT a glob: tests earn their
// way in with evidence of value, and a flaky gate test is evicted by
// deleting its line here (no need for the flaky test to pass).
// Selection criteria: deterministic (no real git subprocesses, no
// real timers/network), fast (<~3s/file per scripts/test-timings.json),
// covering regression-prone core invariants: merge lifecycle and
// scope, files-changed/fork-point attribution, executor core paths,
// triage, scheduling, self-healing.
// Budget: the whole project must stay under ~60s wall-clock so the
// CI gate job's test run lands under ~1 minute.
include: [
"src/__tests__/merger-merge-lifecycle.test.ts",
"src/__tests__/merger-post-merge.test.ts",
"src/__tests__/merger-conflict-resolution.test.ts",
"src/__tests__/merger-diff-scope.test.ts",
"src/__tests__/merger-file-scope-invariant.test.ts",
"src/__tests__/merger-landed-files-capture.test.ts",
"src/__tests__/branch-attribution.test.ts",
"src/__tests__/executor-core.test.ts",
"src/__tests__/executor-recovery.test.ts",
"src/__tests__/executor-base-commit-capture.test.ts",
"src/__tests__/executor-capture-modified-files-attribution.test.ts",
"src/__tests__/triage.test.ts",
"src/__tests__/triage-preflight.test.ts",
"src/__tests__/scheduler.test.ts",
"src/__tests__/scheduler-node-routing.test.ts",
"src/__tests__/scheduler-overlap-requeue.test.ts",
"src/__tests__/mission-scheduler.test.ts",
"src/__tests__/self-healing.test.ts",
"src/__tests__/heartbeat-monitor.test.ts",
"src/__tests__/workflow-node-handlers.test.ts",
],
exclude: ["node_modules/**", "dist/**"],
},
},
{
extends: true,
test: {
name: "engine-default",
include: ["src/**/*.test.ts"],
exclude: [
"src/__tests__/reliability-interactions/**/*.test.ts",
// Real-git heavy files run in the engine-slow project so local
// `pnpm test` stays snappy. CI picks them up via `test:slow`
// / `test:all` invoked from the root `test:full` script.
"src/**/*.slow.test.ts",
"node_modules/**",
"dist/**",
],
},
},
{
extends: true,
test: {
name: "engine-reliability",
include: ["src/__tests__/reliability-interactions/**/*.test.ts"],
// Mirror the engine-default exclusion so reliability slow tests
// also tier into engine-slow.
exclude: ["src/**/*.slow.test.ts"],
// These tests assert event ordering across real worktrees. Parallel
// execution under merger load caused subprocess-guard timeouts and
// SQLite rowid interleaving (e.g. FN-5521 hit
// `expected 24 to be less than 19` in merge-reuse-task-worktree).
// Serialize at the file level; within-file order is already linear.
minWorkers: 1,
maxWorkers: 1,
fileParallelism: false,
},
},
{
extends: true,
test: {
name: "engine-slow",
// Files matching `*.slow.test.ts` are the long-tail real-git suites
// (`mkdtemp` + `git init` + multiple commits per test). They run
// single-threaded to avoid spawning many concurrent git processes
// and inflating wall time further. Excluded from the default
// `pnpm test` lane; run via `pnpm test:slow` / `pnpm test:all`.
include: ["src/**/*.slow.test.ts"],
minWorkers: 1,
maxWorkers: 1,
fileParallelism: false,
},
},
],
coverage: {
enabled: false,
reporter: ["text", "html", "json"],
reportsDirectory: "./coverage",
include: ["src/**/*.ts"],
exclude: ["**/*.test.ts", "**/*.d.ts", "dist/**"],
},
},
});