diff --git a/tests/unit/test_strict_scope.py b/tests/unit/test_strict_scope.py index 6071c163..42c9c371 100644 --- a/tests/unit/test_strict_scope.py +++ b/tests/unit/test_strict_scope.py @@ -98,6 +98,15 @@ def test_only_a_named_word_turns_the_refusal_off( monkeypatch.setenv("CYBERAI_STRICT_SCOPE", noise) assert CyberAIConfig.from_env().strict_scope is True, noise + # Saying yes out loud is a third answer, not the absence of the other two. + # Coverage caught this branch unexecuted: every assertion above lands on + # off or on the default, so a reader that never recognised a word for yes + # would have passed them all. An operator who writes the variable to turn + # the guard back on has to be answered. + for word in ("1", "true", "yes", "on", "ON", " 1 "): + monkeypatch.setenv("CYBERAI_STRICT_SCOPE", word) + assert CyberAIConfig.from_env().strict_scope is True, word + def test_the_ordinary_flag_reader_is_left_as_it_was( monkeypatch: pytest.MonkeyPatch, @@ -113,6 +122,18 @@ def test_the_ordinary_flag_reader_is_left_as_it_was( assert _env_bool("CYBERAI_TEST_FLAG", True) is False assert _env_guard_bool("CYBERAI_TEST_FLAG", True) is True + # Asserted against a default of False, which is the only way this says + # anything. strict_scope defaults to True, so a reader that recognised no + # word for yes would answer True for "1" by falling through to the + # default and every assertion about that flag would still pass -- the + # branch was covered and unproven at once. Here the two answers differ. + for word in ("1", "true", "yes", "on"): + monkeypatch.setenv("CYBERAI_TEST_FLAG", word) + assert _env_guard_bool("CYBERAI_TEST_FLAG", False) is True, word + for word in ("0", "false", "no", "off"): + monkeypatch.setenv("CYBERAI_TEST_FLAG", word) + assert _env_guard_bool("CYBERAI_TEST_FLAG", True) is False, word + def test_the_orchestrator_hands_the_flag_to_the_validator() -> None: """The link the other tests cannot see.