From 024a85bafde07114de89b874fc3362cdb1b6b2b2 Mon Sep 17 00:00:00 2001
From: Chinesezjc <jczhai@deepseek.com>
Date: Fri, 7 Aug 2026 15:09:28 +0800
Subject: [PATCH] fix(web): reject override and child fixtures under
 replayProvidersOnly and fix the close JSDoc

The boot guard now fails loud when replayProvidersOnly combines with
replayOverride or replayChildFixtures, closing the bypass where callable
scripts could install with the consumption check skipped. The close()
comment states the providers-only skip, which the master merge had
reverted.
---
 apps/web/tests/scaffold.ts | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/apps/web/tests/scaffold.ts b/apps/web/tests/scaffold.ts
index eac6a3eb9f..b40a163805 100644
--- a/apps/web/tests/scaffold.ts
+++ b/apps/web/tests/scaffold.ts
@@ -398,6 +398,9 @@ export async function launchWebScaffold(options: LaunchOptions = {}): Promise<We
       }
       // The consumption check is skipped for this mode, so a fixture that
       // records model calls would silently go unconsumed: reject one here.
+      if (options.replayOverride !== undefined || options.replayChildFixtures !== undefined) {
+        throw new Error('replayProvidersOnly cannot combine with replayOverride or replayChildFixtures')
+      }
       const recorded = parseSessionLog(readFileSync(options.replayFixture, 'utf8'))
       const hasModelCall = recorded.some(event => (
         event.type === 'assistant/chunk' || event.type === 'request/header' || event.type === 'tool/call'
@@ -456,7 +459,8 @@ export async function launchWebScaffold(options: LaunchOptions = {}): Promise<We
       const failures: unknown[] = []
       // Fixture-consumption check first, while the run's binding state is
       // still authoritative — a scenario that drove fewer model calls than
-      // recorded fails here instead of drifting green.
+      // recorded fails here instead of drifting green. Skipped for
+      // replayProvidersOnly, whose fixture is validated call-free at boot.
       if (!options.replayProvidersOnly) {
         try {
           replayHandle?.assertConsumed()