Encode lessons: test-mode loopback guard, publish verification, Changeset present

[ScriptedAlchemy]

Encode this session's recurring corrections as mechanisms instead of prose.

Lesson	Mechanism	Where
A diagnostic sent a literal hi to the live General thread from a test run	assertAllowedCredentialUrl (the one chokepoint every gateway/backend call already passes through) refuses any non-loopback host when GROK_BOT_TEST=1 or NODE_ENV=test, ignoring GROK_BOT_ALLOW_ANY_GATEWAY. Both test runners set GROK_BOT_TEST=1; the route-unit suite asserts the env propagates; a unit test proves sendPrompt against https://box.cursor.sh throws before fetch is called. Fixture sessions moved to loopback URLs.	src/core/url-policy.js, scripts/run-unit-tests.mjs, rstest.route-unit.config.ts, test/*
Release workflow can be green without the package reaching npm	After changesets/action, whenever no changesets are pending, npm view <name>@<package.json version> version must resolve (8 × 15 s window for registry lag) or the job fails. Not gated on the action's published output, which is what made silence look green.	.github/workflows/release.yml
No Changeset present gate	New Changeset workflow mirroring agent-bundle: changeset status --since=origin/main, honours the skip-changeset label (created) and the machine-owned changeset-release/main branch. changedFilePatterns scoped to shipped inputs (src/**, package.json, build/ts config, README, LICENSE) so CI-, test-, and lockfile-only PRs need nothing.	.github/workflows/changeset.yml, .changeset/config.json

Why not stronger: an unrepresentable state (a URL type that cannot hold a live host in tests) would need every caller retyped; the runtime refusal sits on the single existing policy function, so no caller can bypass it.

Verification

• npm run check (validate, build, validate:artifact, typecheck, 202 unit + 14 route-unit tests): pass
• With src/core/url-policy.js reverted, the new tests fail, so they exercise the guard

Behavior-test check (would the test pass if every import returned undefined? no)

• test/gateway-send.test.js: real loopback HTTP server; asserts the literal sendPrompt result object for a loopback session, then, with GROK_BOT_ALLOW_ANY_GATEWAY=1 switched on, the literal refusal message for the non-routable https://gateway.invalid (production policy would let it through; test mode must not) and that the server saw exactly the two loopback requests. No mocks asserted.
• test/url-policy.test.js: asserts the literal normalized URL for loopback (gateway and backend) and the literal Rejected … test mode … messages for live hosts, under both GROK_BOT_TEST=1 and NODE_ENV=test; production-policy cases opt out of test mode explicitly.
• tests/route-unit/tools.test.ts: invokes the gbot_send MCP tool with https://gateway.invalid + GROK_BOT_ALLOW_ANY_GATEWAY=1 and asserts the literal tool error text and an empty fake-gateway call log, then invokes it against the loopback fake and asserts the literal structuredContent. Replaces an env-var pin.
• npx changeset status --since=origin/main: grok-bot-cli -> 0.4.5 via .changeset/test-mode-loopback-only.md

Review

Independent change-risk-reviewer (Sol) pass: one Medium — changedFilePatterns omitted CHANGELOG.md, which package.json#files ships. Added in the follow-up commit (a hand-edit to the changelog now needs a changeset or the label, which is also the rule). Re-review of the behavior-test rewrite: one Medium — a guard regression would have contacted the real box.cursor.sh; the tests now target the non-routable gateway.invalid with the production escape hatch on, so a regression proves itself without leaving the machine. Nothing else remains. No other concrete merge risks: test mode is fail-closed and leaves production policy unchanged; rstest 0.11 propagates config-loaded env to workers; has-changesets, fetch-depth: 0, and bash on windows-latest confirmed.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[changeset-bot]

🦋 Changeset detected

Latest commit: abba9ad

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
grok-bot-cli	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR