From 74fbfe52bb8b36486ec7c20722aa03104d89285a Mon Sep 17 00:00:00 2001
From: Bret Mogilefsky <bret.mogilefsky@gsa.gov>
Date: Tue, 25 Aug 2026 21:42:30 +0000
Subject: [PATCH] test(bats): filter _acq_coreutils_path to absolute dirs,
 assert absence premise
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

_acq_coreutils_path unioned dirname of `command -v <tool>` for 12 tools without
filtering non-absolute results. `command -v printf` resolves to the shell
builtin (a bare name), so `dirname` yielded "." — putting the current directory
on the narrowed "just coreutils" PATH. A stray file in the CWD then became
callable, and on a Homebrew-coreutils host the union also pulled in
/opt/homebrew/bin (the same dir as msb/sbx), so the "backend provably absent"
test could silently have the backend present.

- Skip any `command -v` result that is not absolute (/-prefixed) before taking
  its dirname, so builtins never contribute "." to PATH.
- Assert the premise in the self-repair test: `run command -v msb;
  assert_failure` so it fails loudly if the narrowed PATH ever exposes the
  backend, rather than passing hollowly.
---
 test/bats/20-backend-resolution.bats | 4 ++++
 test/bats/helper.bash                | 7 +++++++
 2 files changed, 11 insertions(+)

diff --git a/test/bats/20-backend-resolution.bats b/test/bats/20-backend-resolution.bats
index 51c08bd..415b212 100644
--- a/test/bats/20-backend-resolution.bats
+++ b/test/bats/20-backend-resolution.bats
@@ -133,6 +133,10 @@ _resolve() { # ADAPTER EXPLICIT  -> prints "<resolved>|<stderr-note>"
   coreutils_path="$(_acq_coreutils_path)"
   export HOME="$fake_home"
   export PATH="$coreutils_path"
+  # Premise: with PATH narrowed to coreutils, the backend MUST be absent —
+  # otherwise the self-repair path never exercises and the test is vacuous.
+  run command -v msb
+  assert_failure
   # shellcheck source=acq
   ACQ_SOURCE_ONLY=1 . "$ACQ"
   # shellcheck source=acq.backends/msb.sh
diff --git a/test/bats/helper.bash b/test/bats/helper.bash
index 67f573f..84d717d 100644
--- a/test/bats/helper.bash
+++ b/test/bats/helper.bash
@@ -51,11 +51,18 @@ acq_teardown_stubs() {
 # the test AND `rm` in bats-exec-test's own teardown. Union the dirs of every
 # tool we actually rely on so the narrowed PATH is complete regardless of layout.
 # De-dupes while preserving first-seen order. bash 3.2 safe.
+#
+# Only absolute paths are unioned: `command -v` resolves shell builtins (e.g.
+# printf) to a bare name with no directory, and `dirname` of a bare name yields
+# ".", which would silently put the *current directory* on the narrowed PATH —
+# a stray file in the CWD would then become callable and defeat the "backend
+# provably absent" premise. Skipping non-/-prefixed results keeps PATH clean.
 _acq_coreutils_path() {
   local _tools="env rm cat mkdir mv chmod dirname sh grep sed awk printf"
   local _t _d _seen="" _out=""
   for _t in $_tools; do
     _d=$(command -v "$_t" 2>/dev/null) || continue
+    case "$_d" in /*) ;; *) continue ;; esac
     _d=$(dirname "$_d")
     case ":$_seen:" in *":$_d:"*) continue ;; esac
     _seen="${_seen:+$_seen:}$_d"