#typescript/src/hygiene

#typescript/src/hygiene

The composite entry point and the closed preserve enum.

#No socket guard

Unlike the Python plugin, this package ships no network guard, for the same reason the Go module ships none: there is no honest in-process interception point. Python has sys.addaudithook, a hook the interpreter itself calls on every socket operation and which cannot be removed once installed. Node has no equivalent. The nearest thing is monkey-patching net.Socket.prototype .connect, which misses dgram, misses anything reaching the syscall through a native addon, and is undone by any code that re-imports node:net through a fresh module loader. A partial guard reads as a guarantee and is worse than none, so this package does not ship one.

Network isolation for Node suites is owned by the sandbox runner -- the bubblewrap wrapper that runs the suite with no network namespace -- and {@link requireSandbox} is what makes sure the suite actually goes through it.

#No push guard

The Python plugin intercepts subprocess.Popen to refuse a real git push to a non-local remote. The equivalent here would be patching node:child_process, and it fails the same honesty test: spawn, exec, execFile, fork and their sync twins all reach the same binding, native addons bypass the module entirely, and a fresh loader restores the original. {@link lockdownTransports} already closes the outcome that guard exists to prevent -- a push over ssh:// or https:// dies at the protocol check with the ssh and proxy helpers pinned to a command that only fails.

#KnownVar

export type KnownVar = keyof typeof KNOWN_VARS

One toolchain cache variable a suite may opt into preserving across the HOME repoint. The type is a closed union of the names below, so a credential vector can never become preservable by typo.

#KNOWN_VARS

export const KNOWN_VARS =

The closed preserve enum. Every entry names a cache or package location that holds build artifacts, not secrets, and that would otherwise send a toolchain into a cold rebuild (or hide an already-installed module) once HOME moves.

The table mirrors the Go module's knownVars and the Python plugin's PRESERVE_VARS one-for-one, so a polyglot repo declares the same set on all three sides. {home} in a default stands for the real home directory and {gopath} for the resolved GOPATH.

#IsolateOptions

export interface IsolateOptions

Options for {@link isolate}. There is deliberately no option that turns a floor piece off.

#isolate

export function isolate(

Bind the full environment floor for the duration of this test: the preserved toolchain caches (if any) are pinned first, then HOME and the four XDG base directories are repointed at a throwaway directory, git's global and system config are emptied, the git identity is replaced, transports are locked down to file:// with git's ssh and proxy helpers pinned to a command that always fails, and every ambient credential variable is removed.

import { test } from "node:test";
import { isolate } from "stricttest";

test("something", (t) => {
  isolate(t);
  // HOME is a throwaway dir, git reads an empty global config with a
  // throwaway identity, only the file:// transport is allowed, and every
  // ambient credential variable is gone.
});

The throwaway home is not returned; call {@link throwawayHome} (which is memoized per test and returns the same directory isolate created) when the path is needed.

#preserveVars

export function preserveVars(

Pin the named toolchain caches so they survive the HOME repoint. Each one is pinned to its current value, or to its default location under the real home when it is unset. Call it BEFORE anything moves HOME; {@link isolate} does.

Unknown names are rejected at runtime as well as at compile time, so plain JavaScript callers get the same closed enum TypeScript callers do.