Robustness/test debt batch for a package whose entire job is mutating developer machines (git config, credentials, shell tools, ~/.claude/~/.gemini/~/.codex):
- Zero tests. No test script, no test files ever committed; CI is eslint + prettier only (
.github/workflows/npm.yml).
runFullSetup ignores every step's return value (bin/cli.js:62-108) — failed steps still end in the "Setup Complete!" banner. Similarly configureGrafanaCli returns success when context verification fails (grafanactl.js:348-355).- Two parallel orchestrators maintain the same tool list twice:
bin/cli.js:57-112 (hardcoded [1/12] labels) vs. lib/index.js:127-253 (CLI_TOOLS) — drift by design.
- Half-finished exec hardening: newer installers use spawnSync + arg arrays + input validation (esq, discord, logcli); older ones interpolate into
execSync shell strings — ${binary} breaks on spaced paths (atl.js:64,267,303, n8n.js:50,260), hcloud context create ${name} interpolates user input into a shell (hcloud.js:83), grafanactl uses a fixed /tmp dir + unvalidated tag_name in a pipeline (grafanactl.js:189-192) while logcli does it right (logcli.js:69,81-84). Finish the migration in one pass.
- Slow status probes:
isPlaywrightConfigured launches a real headless-Chromium screenshot (up to 15 s) and is called twice per menu render (playwright.js:29-49; lib/index.js:229-234,301-305).
- Dead code:
writeFileSecure, ensureSourceLine/removeSourceLine (both summaries still tell users to source a profile nothing edits — bin/cli.js:219-221, lib/index.js:340-342), removeBlock, execCommand, detectExistingConfig, SUPPORTED_TOOLS duplication.
Suggested first step: a smoke-test suite around the pure logic (block splice, asset-name construction, config detection) — the grafanactl asset-name bug (sibling issue) would have been caught by a 5-line test.
Robustness/test debt batch for a package whose entire job is mutating developer machines (git config, credentials, shell tools,
~/.claude/~/.gemini/~/.codex):.github/workflows/npm.yml).runFullSetupignores every step's return value (bin/cli.js:62-108) — failed steps still end in the "Setup Complete!" banner. SimilarlyconfigureGrafanaClireturns success when context verification fails (grafanactl.js:348-355).bin/cli.js:57-112(hardcoded[1/12]labels) vs.lib/index.js:127-253(CLI_TOOLS) — drift by design.execSyncshell strings —${binary}breaks on spaced paths (atl.js:64,267,303,n8n.js:50,260),hcloud context create ${name}interpolates user input into a shell (hcloud.js:83), grafanactl uses a fixed/tmpdir + unvalidatedtag_namein a pipeline (grafanactl.js:189-192) while logcli does it right (logcli.js:69,81-84). Finish the migration in one pass.isPlaywrightConfiguredlaunches a real headless-Chromium screenshot (up to 15 s) and is called twice per menu render (playwright.js:29-49;lib/index.js:229-234,301-305).writeFileSecure,ensureSourceLine/removeSourceLine(both summaries still tell users tosourcea profile nothing edits —bin/cli.js:219-221,lib/index.js:340-342),removeBlock,execCommand,detectExistingConfig,SUPPORTED_TOOLSduplication.Suggested first step: a smoke-test suite around the pure logic (block splice, asset-name construction, config detection) — the grafanactl asset-name bug (sibling issue) would have been caught by a 5-line test.