fix: debt batch j01 (D-0841..)

cmd/commands/canon_engine_test.go

@@ -776,7 +776,8 @@ func TestCanonEnginePrepare(t *testing.T) {
 		t.Helper()
 		compattest.Set(t, v15)
 		savedArgs, savedMount := os.Args, mountInstalledPlugins
-		t.Cleanup(func() { os.Args, mountInstalledPlugins = savedArgs, savedMount })
+		defer func() { os.Args, mountInstalledPlugins = savedArgs, savedMount }()
+		mountInstalledPlugins = func(*cobra.Command) {}
 		if mount {
 			mountInstalledPlugins = func(r *cobra.Command) {
 				ci := fxCmd("ci", nil, fxCmd("nodes", fxRun))

cmd/commands/ci_bootstrap.go

@@ -141,7 +141,7 @@ func retireLegacyCICache() {
 				_ = os.Remove(legacy)
 			}
 		}
-		fmt.Fprintln(ciNoticeOut, "notice: ~/.nself/bin/nself-ci is no longer used (unverified); nself now installs the signed ci plugin")
+		_, _ = fmt.Fprintln(ciNoticeOut, "notice: ~/.nself/bin/nself-ci is no longer used (unverified); nself now installs the signed ci plugin")
 	})
 }
 

cmd/commands/dev_test.go

@@ -78,7 +78,7 @@ func TestDevComposeCallsCarryEnvFiles(t *testing.T) {
 		t.Fatal(err)
 	}
 	flags := "compose --env-file " + filepath.Join(dir, ".env") + " --env-file " + filepath.Join(dir, ".nself", "compose.env")
-	want := []string{flags + " up -d", flags + " up -d --no-deps --build -- notify"}
+	want := []string{flags + " up -d --build", flags + " up -d --no-deps --build -- notify"}
 	if got := strings.Split(strings.TrimRight(string(b), "\n"), "\n"); !reflect.DeepEqual(got, want) {
 		t.Errorf("compose calls =\n%q\nwant\n%q", got, want)
 	}

internal/build/plugins_entitlement_mount_test.go

@@ -8,6 +8,7 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
+	"strconv"
 	"strings"
 	"testing"
 
@@ -91,6 +92,13 @@ func TestMountIgnoresOverride(t *testing.T) {
 func TestMountEmptyFileE125(t *testing.T) {
 	compattest.Set(t, true)
 	t.Setenv("LICENSE_CACHE_PATH", filepath.Join(t.TempDir(), "missing"))
+	// Missing-token tests must not renew a licence configured on the CI host.
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("USERPROFILE", t.TempDir())
+	t.Setenv("NSELF_PLUGIN_LICENSE_KEY", "")
+	for i := 1; i <= 10; i++ {
+		t.Setenv("NSELF_LICENSE_KEY_"+strconv.Itoa(i), "")
+	}
 	t.Setenv("LICENSE_PUBLIC_KEY_OVERRIDE", "")
 	dir, in := entitlementFixture(t, "licensed")
 	path := filepath.Join(dir, "fixture", pluginComposeFilename)

internal/docker/compose.go

@@ -65,10 +65,12 @@ func withServices(args []string, services ...string) []string {
 	return append(append(args, "--"), services...)
 }
 
-// ComposeUp runs `docker compose up -d [services...]` in the given workdir.
+// ComposeUp runs `docker compose up -d --build [services...]` in the given workdir.
+// Rebuild services with a build context even when their image tag exists: a
+// plugin upgrade can change the source without changing its local image tag.
 func (c *Compose) ComposeUp(ctx context.Context, workdir string, services ...string) error {
 	args := c.buildBaseArgs()
-	args = withServices(append(args, "up", "-d"), services...)
+	args = withServices(append(args, "up", "-d", "--build"), services...)
 	return c.Run(ctx, workdir, args...)
 }
 

internal/docker/compose_test.go

@@ -43,7 +43,7 @@ func TestComposeServicesAfterDoubleDash(t *testing.T) {
 		tail func(svc string) []string // argv after "compose -f /m/base.yml"
 	}{
 		{"up", func(c *Compose, s string) error { return c.ComposeUp(ctx, ".", s) },
-			func(s string) []string { return []string{"up", "-d", "--", s} }},
+			func(s string) []string { return []string{"up", "-d", "--build", "--", s} }},
 		{"up --no-deps", func(c *Compose, s string) error { return c.ComposeUpNoDeps(ctx, ".", s) },
 			func(s string) []string { return []string{"up", "-d", "--no-deps", "--", s} }},
 		{"restart", func(c *Compose, s string) error { return c.ComposeRestart(ctx, ".", s) },

internal/docker/compose_upgrade_test.go

@@ -0,0 +1,46 @@
+package docker
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// Model Compose's image reuse contract: a tagged image survives an up unless
+// --build is supplied. The installed plugin context has already been upgraded.
+func TestComposeUpRebuildsInstalledPlugin(t *testing.T) {
+	for _, services := range [][]string{nil, {"plugin"}} {
+		name := "all services"
+		if len(services) > 0 {
+			name = "named service"
+		}
+		t.Run(name, func(t *testing.T) {
+			dir := t.TempDir()
+			writeFile(t, filepath.Join(dir, "project-plugin-latest"), "1.0.0")
+			writeFile(t, filepath.Join(dir, "plugin-version"), "2.0.0")
+			bin := filepath.Join(dir, "docker")
+			writeExec(t, bin, `#!/bin/sh
+for arg do
+ if [ "$arg" = "--build" ]; then
+  cp plugin-version project-plugin-latest || exit 1
+ fi
+done
+cp project-plugin-latest served-version
+`)
+			c := NewCompose("docker-compose.yml")
+			c.DockerPath = bin
+			if err := c.ComposeUp(context.Background(), dir, services...); err != nil {
+				t.Fatal(err)
+			}
+			got, err := os.ReadFile(filepath.Join(dir, "served-version"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if strings.TrimSpace(string(got)) != "2.0.0" {
+				t.Fatalf("served plugin version %s, want upgraded 2.0.0", got)
+			}
+		})
+	}
+}

internal/license/entitlement/write_test.go

@@ -104,6 +104,13 @@ func TestEntitlementRefreshWrites(t *testing.T) {
 func TestBuildE125UnderV15(t *testing.T) {
 	compattest.Both(t, func(t *testing.T) {
 		t.Setenv("LICENSE_CACHE_PATH", filepath.Join(t.TempDir(), "missing.json"))
+		// Missing-token tests must not renew a licence configured on the CI host.
+		t.Setenv("HOME", t.TempDir())
+		t.Setenv("USERPROFILE", t.TempDir())
+		t.Setenv("NSELF_PLUGIN_LICENSE_KEY", "")
+		for i := 1; i <= 10; i++ {
+			t.Setenv("NSELF_LICENSE_KEY_"+strconv.Itoa(i), "")
+		}
 		dir, plugins := t.TempDir(), t.TempDir()
 		installed := filepath.Join(plugins, "fixture-licensed")
 		if err := os.MkdirAll(installed, 0700); err != nil {

internal/service/compose_manifest_test.go

@@ -149,7 +149,7 @@ func TestComposeForFollowsBuildManifests(t *testing.T) {
 			t.Fatal(err)
 		}
 		got := strings.Join(strings.Fields(string(raw)), " ")
-		want := strings.Join([]string{"compose", "-f", base, "-f", frag, "--env-file", dotenv, "--env-file", computed, "up", "-d", "--", "minio"}, " ")
+		want := strings.Join([]string{"compose", "-f", base, "-f", frag, "--env-file", dotenv, "--env-file", computed, "up", "-d", "--build", "--", "minio"}, " ")
 		if got != want {
 			t.Fatalf("docker argv\n got: %s\nwant: %s", got, want)
 		}