bot-agents/.agents/memory/bot-agents-tests-root-only.md

description

description
Isolation and credential tests need root and use test.skipIf(!IS_ROOT); locally 5 skip, CI runs as root so all 66 run; verify isolation changes in node:24-bookworm as root

Some tests exercise real UID isolation, process cleanup, and the prepare phase's credential cleanup. They need root and are written as test.skipIf(!IS_ROOT)(...) (IS_ROOT from #testing), so they show as skipped instead of silently passing.

• As a normal user vp test passes 61 and skips 5. In CI (self-hosted runner, root) all 66 run.
• When changing isolation.ts, runtime.ts, credentials.ts, prepare/index.ts, or child.ts, run the suite as root in node:24-bookworm (e.g. a container with the repo mounted) before pushing; a green non-root run proves nothing about those paths.
• The migration also ran an end-to-end smoke as root with fake codex/claude/npx binaries and a fake Gitea through protect-source.sh -> prepare/index.ts -> run/index.ts -> post/index.ts; repeat that for changes to the phase flow (bot-agents-runtime-no-build).
• src/testing/index.ts holds the shared test helpers (user IDs, temp dirs, runCommand) behind the #testing alias. Every test imports it as #testing. It imports no source module, so tests/ (which may not use ../) never reaches internals. Tests follow tests-layout-vitest (unit tests next to their code in src/, repo-level ones in tests/).