TestBootstrapRejectsNilProfile: `models: { local: ~ }` decodes to a nil *Profile the ContextSize coercion loop would deref-panic on. Bootstrap must reject it with a readable error instead.
(t *testing.T)
| 580 | // *Profile the ContextSize coercion loop would deref-panic on. Bootstrap must |
| 581 | // reject it with a readable error instead. |
| 582 | func TestBootstrapRejectsNilProfile(t *testing.T) { |
| 583 | dir := t.TempDir() |
| 584 | cdir := filepath.Join(dir, DirName) |
| 585 | if err := os.MkdirAll(cdir, 0o755); err != nil { |
| 586 | t.Fatal(err) |
| 587 | } |
| 588 | yaml := []byte("active: local\nmodels:\n local: ~\n") |
| 589 | if err := os.WriteFile(filepath.Join(cdir, "config.yaml"), yaml, 0o644); err != nil { |
| 590 | t.Fatal(err) |
| 591 | } |
| 592 | _, _, err := Bootstrap(dir) |
| 593 | if err == nil { |
| 594 | t.Fatal("nil YAML profile must be rejected (not panic on deref)") |
| 595 | } |
| 596 | if !strings.Contains(err.Error(), "local") { |
| 597 | t.Fatalf("error should name the offending profile, got: %v", err) |
| 598 | } |
| 599 | } |
| 600 | |
| 601 | // TestBootstrapRefusesSymlinkedDir: a co-tenant could plant .codehamr → an |
| 602 | // attacker-controlled dir before first run. Bootstrap must Lstat (not Stat) and |