Security

tests/network.test.ts

@@ -85,3 +85,25 @@ test('mainnet ledger and market files use isolated folders; testnet backup heade
     assert.deepEqual(result, { ledger: true, market: true, testnet: false, rejected: true });
   } finally { await rm(dir, { recursive: true, force: true }); }
 });
+
+test('operator preflight is read-only, fails closed, and does not disclose credentials', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'wikideck-preflight-'));
+  try {
+    const { existsSync } = await import('node:fs');
+    const dataDir = join(dir, 'must-not-be-created');
+    const secret = 'test-only-sensitive-value-must-not-appear';
+    const result = spawnSync(process.execPath, ['--experimental-strip-types', 'server/index.ts', '--launch-preflight'], {
+      env: { ...process.env, WIKIDECK_NETWORK: 'mainnet', WIKIDECK_DATA_DIR: dataDir,
+        WIKIDECK_MAINNET_LAUNCH: '', WIKIDECK_MAINNET_REVIEW_ACK: '', SHKEEPER_API_KEY: secret },
+      encoding: 'utf8', timeout: 30000,
+    });
+    assert.equal(result.status, 1);
+    const report = JSON.parse(result.stdout);
+    assert.equal(report.productionReady, false);
+    assert.equal(report.decision, 'NO-GO');
+    assert.equal(report.paymentMode, 'mock');
+    assert.ok(report.checks.some((c: { id: string; status: string }) => c.id === 'consensus-launch-calibration' && c.status === 'blocked'));
+    assert.equal(result.stdout.includes(secret), false);
+    assert.equal(existsSync(dataDir), false);
+  } finally { await rm(dir, { recursive: true, force: true }); }
+});