From 5489f894460fb1329d54073cbd134b71e7332e5d Mon Sep 17 00:00:00 2001
From: Brian Majewski <brian.majewski@gmail.com>
Date: Sun, 7 Jun 2026 10:17:07 -0700
Subject: [PATCH] =?UTF-8?q?test:=20coverage=20backfill=20=E2=80=94=20which?=
 =?UTF-8?q?=20UNSAFE=20marker,=20malformed-manifest=20add,=20dry-run=20dec?=
 =?UTF-8?q?lared=20list,=20frozen=20absorb=20suppression,=20file-type=20ab?=
 =?UTF-8?q?sorb=20round-trip,=20external=20dedup?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 test/manifest.bats | 76 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)

diff --git a/test/manifest.bats b/test/manifest.bats
index c4d7314..e273479 100644
--- a/test/manifest.bats
+++ b/test/manifest.bats
@@ -622,3 +622,79 @@ m_nojq_path() {
   [[ "$output" == *"gradle.properties"* ]] || false
   [[ "$output" == *"k1"* ]] || false
 }
+
+# ─── F: ship Step 7 coverage backfill (audit gaps) ─────────────────────
+
+@test "which flags an unsafe dotenv entry with the UNSAFE marker" {
+  create_project_dir whichunsafe
+  printf '{"version":2,"dotenv":[".env","../escape/.env"]}\n' > .secrets.json
+  run "$SECRETS_BIN" which
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"UNSAFE"* ]] || false
+  [[ "$output" == *"will be refused"* ]] || false
+}
+
+@test "add to a malformed existing manifest dies with a directed error" {
+  create_project_dir addmalformed
+  echo '{ not json' > .secrets.json
+  run "$SECRETS_BIN" add .env
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"invalid"* ]] || false
+}
+
+@test "push --dry-run lists declared entries under 'Would sync'" {
+  init_with_remote
+  create_project_dir drysync
+  "$SECRETS_BIN" add .env >/dev/null
+  run "$SECRETS_BIN" push --dry-run
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"Would sync (declared)"* ]] || false
+  [[ "$output" == *".env"* ]] || false
+}
+
+@test "push --frozen does not absorb a legacy .secrets-files" {
+  init_with_remote
+  m_gradle_src $'beaconClerkPkTest=pk_test_abc\n'
+  local dir="$WORK_DIR/frozenabsorb"; mkdir -p "$dir"
+  echo "K=v" > "$dir/.env"
+  printf '{"version":2,"dotenv":[".env"]}\n' > "$dir/.secrets.json"
+  printf 'gradle-properties ~/.gradle/gradle.properties beaconClerkPkTest\n' > "$dir/.secrets-files"
+  cd "$dir"
+  run "$SECRETS_BIN" push --frozen frozenabsorb
+  [ "$status" -eq 0 ]
+  [[ "$output" != *"Absorbed"* ]] || false
+  run jq -r '.external // [] | length' .secrets.json
+  [ "$output" = "0" ]
+}
+
+@test "file entry absorbed from legacy round-trips on pull" {
+  init_with_remote
+  m_file_src
+  local dir="$WORK_DIR/fileabsorb"; mkdir -p "$dir"
+  echo "K=v" > "$dir/.env"
+  printf 'file ~/keystores/upload.keystore\n' > "$dir/.secrets-files"
+  cd "$dir"
+  "$SECRETS_BIN" push fileabsorb >/dev/null 2>&1
+  run jq -r '.external[] | select(.type=="file") | .path' .secrets.json
+  [ "$output" = "~/keystores/upload.keystore" ]
+  cp "$HOME/keystores/upload.keystore" "$TEST_TMPDIR/orig.ks"
+  rm "$HOME/keystores/upload.keystore"
+  rm -f .secrets-files
+  run "$SECRETS_BIN" pull fileabsorb
+  [ "$status" -eq 0 ]
+  cmp -s "$HOME/keystores/upload.keystore" "$TEST_TMPDIR/orig.ks"
+}
+
+@test "push dedups a legacy entry already present in the manifest external[]" {
+  init_with_remote
+  m_gradle_src $'beaconClerkPkTest=pk_test_abc\n'
+  local dir="$WORK_DIR/dedupext"; mkdir -p "$dir"
+  echo "K=v" > "$dir/.env"
+  printf '{"version":2,"dotenv":[".env"],"external":[{"type":"properties","path":"~/.gradle/gradle.properties","keys":["beaconClerkPkTest"]}]}\n' > "$dir/.secrets.json"
+  printf 'gradle-properties ~/.gradle/gradle.properties beaconClerkPkTest\n' > "$dir/.secrets-files"
+  cd "$dir"
+  run "$SECRETS_BIN" push dedupext
+  [ "$status" -eq 0 ]
+  run jq -r '.external | length' .secrets.json
+  [ "$output" = "1" ]
+}