[axisrow]

Batch 4: reproduce upstream settings-privacy fixes on macOS + isolate the mutation sandbox

TDD verification per the /fix pipeline: red on the pre-fix tree → green on main under both runners (bun test + vitest/Node) → mutation check (StrykerJS) → lint. Follows the merged #55/#56/#57 wave; branched from current main.

Upstream CI only runs Linux; all three fixes protect user data (private settings permissions, an unreadable settings file, a shared-/tmp race), so the wave proves them on macOS.

Fix	Red fact (pre-fix tree)	Green bun	Green vitest	Mutation	Commit
4c62e31 — private settings stay private on save/backup	a 0600 ccstatusline settings comes back 0644 after a save; the .orig backup of a 0600 Claude settings is 0644 @ 75f07d6	4/4	8/8	backup-mode survivors killed (see below)	afa0d45
475e401 — unreadable Claude settings are not overwritten (sirmalloc#627)	the install promise resolves (overwrite happens) where the fixed code rejects @ baf37e1	3/3	8/8	abort-path survivors killed	2545f27
6aefa6b — fonts download into a private temp folder	the observed download folder is the predictable ccstatusline-powerline-fonts-<timestamp> @ 9246095	1/1	8/8	powerline.ts:19x — 0 survivors	839d3d2

Incident found by this batch, fixed here

Running the mutation scope over config.ts/claude-settings.ts executed upstream's claude-settings.test.ts, whose install tests operate on the real home directory (one test resets the ccstatusline config path to ~/.config, another deletes CLAUDE_CONFIG_DIR without restoring it). A mutant breaking config validation materialised default settings over the live statusline config, and an install test pointed statusLine at a client inside .stryker-tmp — which Stryker then deletes, so the live Claude Code status line went empty. Reported upstream as sirmalloc#716.

Fix in 5cbc156: vitest.stryker.global-setup.ts redirects HOME/CLAUDE_CONFIG_DIR to a fresh temp directory for every sandboxed run. Verified by rerunning the full mutation scope with mtime guards on both real config files: stryker exit 0, BOTH-REAL-CONFIGS-UNTOUCHED.

Survivors triage (fix lines)

• Killed by this batch's cases: the backup .mode write (via .bak existence + recreating a loose-permission .orig — writeFile alone keeps 0777), the install abort reason (/left unchanged/), both keepExisting branches (unreadable file, valid existing statusLine), the predictable mkdtemp folder.
• Equivalent: writeFile(..., { encoding: '' }) writes the same utf-8 bytes; readFile with '' returns a Buffer that round-trips identically.
• Triage (error-visibility only): removeIfExists never rethrowing a non-ENOENT unlink error, logErrors: false → true (console noise), a truncated message tail. Happy-path behavior identical in all three.
• powerline.ts broader low score comes from font-directory selection and install-script variants this fix does not touch — outside the fix-line criterion.

Notes

• Full suite on this branch: bun 3578 tests, 1 fail — the known macOS-only git-hardening-exec LFS case (pre-existing, see verify(tooling): Stryker mutation tooling + upstream 9246095 pilot (batch 1) #55); one transient ItemsEditor flake observed in a single full run, green in isolation.
• Red tests target only pre-fix public API (saveSettings via initConfigPath, installStatusLine, installPowerlineFonts), so each red run fails on content, not on a missing module.

Commits

1. 5cbc156 — fix(verify): isolate the mutation sandbox from the real home directory
2. afa0d45 — test(settings): reproduce upstream 4c62e31 on macOS
3. 2545f27 — test(install): reproduce upstream 475e401 on macOS
4. 839d3d2 — test(powerline): reproduce upstream 6aefa6b on macOS

🤖 Generated with Claude Code

---

Batch 5 (added to this PR): usage-network fixes — e8ef3cb, 0bcc7eb, 610dcc9

Fix	Red fact (pre-fix tree)	Green bun	Green vitest	Mutation	Commit
e8ef3cb — NO_PROXY keeps usage request off the proxy	probe observes a proxy agent configured despite NO_PROXY @ 4c62e31	3/3	5/5	no-proxy.ts 94.23%, 3 equivalent survivors (empty-domain entries already rejected by domain !== '')	6d6f1d2
0bcc7eb — only clear the in-flight lock this render wrote	a rate-limit lock written mid-request is gone after the observed success @ 475e401	1/1	5/5	subprocess-invisible (see below)	e9b4f0c
610dcc9 — absolute deadline bounds a stalled proxy	probe against a local accept-and-never-answer proxy never finishes (20s budget kills it) @ ae9721e	1/1	5/5	subprocess-invisible (see below)	ab73b23

New shared harness: usage-probe.ts — the probe bundles with bun and runs under node with HOME/USERPROFILE in a temp directory (bun's os.homedir() ignores HOME, so in-process tests would touch the live ~/.cache/ccstatusline; node:https is not patchable through bun's ESM namespace, so the request spy is installed by a --require patch that precedes the bundle). Subprocesses spawn through Bun.spawnSync under bun (mock-leak guard), real spawnSync under vitest/Node.

Mutation notes: no-proxy.ts (the whole file is this fix) at 94.23% with equivalent survivors; claude-service-status.ts fix line killed; usage-fetch.ts and the probe-based tests are invisible to the mutation runner (child-process coverage is not observed), so those fix lines are proven by the red/green pairs above instead — the same triage class as powerline's uncovered paths in batch 4. proxy-agent.ts survivors are AbortController-fallback equivalents.

Commits: d935d03 (harness), 6d6f1d2 (e8ef3cb), e9b4f0c (0bcc7eb), ab73b23 (610dcc9).

[axisrow]

Вердикт: запрашиваю изменения — две находки по надёжности нового тестового хозяйства; сама содержательная часть (репродукции апстрим-фиксов на macOS и изоляция мутационной песочницы) корректна и проверена.

Сверено с исходником на этой ветке: месседж left unchanged и .orig-бэкап в claude-settings.ts (464/471), mkdtemp-префикс в powerline.ts (237), сохранение режима файла в config.ts (141-143), условная очистка usage.lock в usage-fetch.ts (846), NO_PROXY/no_proxy в no-proxy.ts, абсолютный дедлайн 5с на call-site usage-fetch.ts (1113). Ассерты соответствуют реальным поверхностям фиксов. Изоляция прока корректна: временный HOME/USERPROFILE, CLAUDE_CONFIG_DIR в temp, фейковый security в PATH — живые ключи и кэш не затрагиваются; vitest.stryker.global-setup.ts закрывает инцидент sirmalloc#716 правильным способом (редирект HOME до старта воркеров).

Inline-находки, обе требуют правки: (1) usage-probe.ts — ветка Bun в runProcess теряет options.timeout, контракт kill-after-timeoutMs из RunProbeOptions не работает под bun test, red-прогон stalled-proxy на pre-fix дереве висит бесконечно; (2) powerline-тест — наблюдение и очистка по префиксу в общем tmpdir: leftover от убитого прогона отравляет observed и ломает toHaveLength(1) на последующих прогонах, слепой rmSync удаляет чужие каталоги.

Не блокирующее: комментарий в vitest.stryker.global-setup.ts обещает изоляцию на каждый тестовый файл, а globalSetup выполняется один раз на прогон (по наследованию env этого достаточно, но комментарий неточен); песочница ccstatusline-mutation-home-* не удаляется после прогона; ветка git clone внутри mockedExecSync мертва — клонирование в powerline.ts идёт через execFileSync, жив только execFileSync-мок; без observe патч не активен, поэтому stalled-proxy честно гоняет реальный https через реальный агент — правильный дизайн, фиксирую как плюс.

[axisrow]

Вердикт: утверждаю. Обе inline-находки прошлого раунда и все не блокирующие заметки закрыты в edcca2b, 1e23af7 и e69acdd: ветка Bun в runProcess пробрасывает timeout в bun.spawnSync (контракт kill-after-timeoutMs восстановлен, интерфейс BunRuntime обновлён); powerline-тест скоупит наблюдение и очистку на cloneTargets, извлечённые execFileSync-моком, — префикс-скан общего tmpdir и слепой rmSync удалены, заодно вычищена мёртвая ветка git clone в execSync-моке и неиспользуемые импорты; vitest.stryker.global-setup.ts возвращает teardown, удаляющий песочницу, комментарий исправлен на once per run. Дельта между ab73b23 и e69acdd других изменений не содержит; остальной дифф сверен с исходником в прошлом раунде (claude-settings.ts 464/471, powerline.ts 237, config.ts 141-143, usage-fetch.ts 846/1113, no-proxy.ts) и не менялся. Возражений нет.