> ## Documentation Index > Fetch the complete documentation index at: https://docs.aureuma.ai/llms.txt > Use this file to discover all available pages before exploring further. # Testing # Testing ## Rust workspace layout This repo is Rust-only for build, test, and runtime flows. Run commands from the repo root so the workspace `Cargo.toml` and Rust helper binaries resolve correctly. ## Running tests Use the repo test runner from the root: ```bash theme={null} cargo run --quiet --locked --manifest-path rust/crates/si-tools/Cargo.toml --bin si-test-runner -- workspace ``` That runner executes `cargo test --workspace`. No secondary language toolchain is required. Use `cargo run --quiet --locked --manifest-path rust/crates/si-tools/Cargo.toml --bin si-test-runner -- workspace --help` for a quick usage reminder. Use `cargo run --quiet --locked --manifest-path rust/crates/si-tools/Cargo.toml --bin si-test-runner -- workspace --list` to print the active test lane without running it. For one-command local coverage of the standard test stack, run: ```bash theme={null} cargo run --quiet --locked --manifest-path rust/crates/si-tools/Cargo.toml --bin si-test-runner -- all ``` For the direct Rust host matrix across `si`, sibling `fort`, and sibling `surf`, run: ```bash theme={null} cargo run --quiet --locked --manifest-path rust/crates/si-tools/Cargo.toml --bin si-rust-host-matrix -- ``` That matrix is documented in [HOST\_TEST\_MATRIX.md](./HOST_TEST_MATRIX.md) and is the best local gate after wrapper/runtime changes. ## Orbit validation Third-party Orbit integration coverage moved to the standalone `Aureuma/orbit` repo. Run `cargo test --workspace` from that repo for provider integration tests. ## Installer smoke tests To validate the `si` installer script end-to-end, run: ```bash theme={null} cargo run --quiet --locked -p si-cli -- build installer smoke-host ``` Use `si build installer host --help` for a quick usage reminder. To validate the pnpm launcher package end-to-end, run: ```bash theme={null} cargo run --quiet --locked -p si-cli -- build installer smoke-pnpm ``` To validate the Homebrew tap install path end-to-end, run: ```bash theme={null} cargo run --quiet --locked -p si-cli -- build installer smoke-homebrew ``` ## Vault strict suite Run the dedicated vault suite: ```bash theme={null} cargo run --quiet --locked --manifest-path rust/crates/si-tools/Cargo.toml --bin si-test-runner -- vault ``` Compatibility flag: ```bash theme={null} cargo run --quiet --locked --manifest-path rust/crates/si-tools/Cargo.toml --bin si-test-runner -- vault --quick ``` `--quick` is retained as a compatibility no-op; the Rust vault lane already runs as a single package suite. ## Fort codex runtime security matrix Run the Fort integration matrix: ```bash theme={null} cargo run --quiet --locked --manifest-path rust/crates/si-tools/Cargo.toml --bin test-fort-spawn-matrix -- ``` This matrix validates: * slot-scoped Fort agent auth bootstrap in `si codex spawn` (`si-codex-` for primary, `si-codex---` for non-primary) * hosted Fort endpoint flow (configured via `~/.si/fort/settings.toml` `[fort].host`) as the default runtime target * host-side bootstrap admin token files are used for provisioning/admin flows only * runtime token-path flow remains file-backed under `CODEX_HOME/fort/`; use `si codex shell --profile --slot -- si fort ...` for profile runtime auth * runtime secret commands fail loudly when profile-scoped Fort token files are missing or cannot refresh * worker-shell access through `si codex shell` with no `FORT_TOKEN`/`FORT_REFRESH_TOKEN` secret env leakage * strict token file modes/ownership (`0600` files, `0700` fort state dir) * policy allow/deny behavior across multiple profiles and repo/env bindings * `si codex respawn` auth continuity * ciphertext-at-rest plus manual ECIES decrypt parity with `fort get` For local-only integration harnesses that use HTTP Fort endpoints, set: ```bash theme={null} SI_FORT_ALLOW_INSECURE_HOST=1 ``` Bootstrap token file requirements: ```bash theme={null} ~/.si/fort/bootstrap/admin.token chmod 600 ~/.si/fort/bootstrap/admin.token chmod 700 ~/.si/fort/bootstrap ``` Runtime session token file requirements: ```bash theme={null} /path/to/access.token /path/to/refresh.token stat -c "%a %n" /path/to/access.token /path/to/refresh.token ``` Wrapper reminder: * `si fort` is a wrapper around `fort`. * If `fort` is not already on `PATH`, the wrapper can build and run the sibling `../fort` checkout when build fallback is allowed. * If a flag belongs to `fort` itself, pass it after `--` (for example: `si fort -- --host https://fort.aureuma.ai doctor`). ## CI notes GitHub Actions workflows use docs-only change detection to skip heavy test jobs when only docs/markdown files are modified. ## Static analysis Run static analysis from the repo root: ```bash theme={null} ./si analyze ``` Use non-failing mode for local iteration while keeping CI strict with default `./si analyze`: ```bash theme={null} ./si analyze --no-fail ``` ## CLI help smoke checks After CLI command-surface changes, run targeted help checks: ```bash theme={null} ./si --help orbit gcp gemini image generate --help ./si surf --help ``` ## Codex upgrade compatibility check Run the Codex-facing test suites directly from the repo root: ```bash theme={null} cargo test -p si-codex cargo test -p si-tools ``` Use these suites as the compatibility gate before upgrading Codex-facing flows. Manual runtime smoke: ```bash theme={null} si codex spawn --profile --slot primary --workspace "$PWD" si codex spawn --profile --slot review --workspace "$PWD" si codex list si codex shell --profile --slot primary -- env | rg 'CODEX_HOME|FORT_TOKEN_PATH|SI_CODEX_WORKER_SLOT' si codex shell --profile --slot review -- env | rg 'CODEX_HOME|FORT_TOKEN_PATH|SI_CODEX_WORKER_SLOT' si codex repair-auth --profile --slot review si codex stop --profile --slot review si codex remove --profile --slot review ``` ## Fresh-machine doctor Run the non-invasive distribution doctor after installing SI on another machine: ```bash theme={null} si doctor si doctor --format json ``` The doctor checks the installed SI binary path and the commands needed by common runtime paths, including Codex workers, tmux operator sessions, npm archive extraction, and source installs. It does not prompt for auth, write state, or make network calls.