fix(test): prevent agent CLI execution in default tests (#5789)

scripts/agent-cli-command-names.txt

@@ -0,0 +1,17 @@
+agy
+claude
+codebuddy
+codex
+copilot
+cursor-agent
+deveco
+grok
+hermes
+kimi
+kiro-cli
+openclaw
+opencode
+pi
+qwen
+qodercli
+traecli

scripts/check.sh

@@ -97,7 +97,7 @@ echo ""
 echo "==> [3/5] Go tests..."
 echo "==> Running database migrations..."
 (cd server && go run ./cmd/migrate up) || { EXIT_CODE=1; exit 1; }
-(cd server && go test ./...) || { EXIT_CODE=1; exit 1; }
+bash scripts/test-go.sh || { EXIT_CODE=1; exit 1; }
 
 # --------------------------------------------------------------------------
 # Step 4: Start services for E2E (only if not already running)

scripts/go-test-with-agent-cli-guard.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+set -eu
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+NAMES_FILE="$SCRIPT_DIR/agent-cli-command-names.txt"
+GUARD_DIR=$(mktemp -d "${TMPDIR:-/tmp}/multica-agent-cli-guard.XXXXXX")
+BIN_DIR="$GUARD_DIR/bin"
+MARKER_FILE="$GUARD_DIR/invocations.log"
+
+cleanup() {
+  rm -rf "$GUARD_DIR"
+}
+trap cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+mkdir -p "$BIN_DIR"
+
+while IFS= read -r name || [ -n "$name" ]; do
+  case "$name" in
+    ""|'#'*) continue ;;
+    *[!A-Za-z0-9._-]*)
+      echo "invalid agent CLI command name in $NAMES_FILE: $name" >&2
+      exit 2
+      ;;
+  esac
+  sentinel="$BIN_DIR/$name"
+  cat >"$sentinel" <<'EOF'
+#!/bin/sh
+line=$(basename "$0")
+if [ "$#" -gt 0 ]; then
+  line="$line [arguments redacted]"
+fi
+printf '%s\n' "$line" >>"$MULTICA_AGENT_CLI_GUARD_MARKER"
+exit 126
+EOF
+  chmod 755 "$sentinel"
+done <"$NAMES_FILE"
+
+if [ "${1:-}" = "--" ]; then
+  shift
+fi
+if [ "$#" -eq 0 ]; then
+  echo "usage: $0 [--] command [args...]" >&2
+  exit 2
+fi
+
+set +e
+PATH="$BIN_DIR:$PATH" MULTICA_AGENT_CLI_GUARD_MARKER="$MARKER_FILE" "$@"
+command_status=$?
+set -e
+
+if [ -s "$MARKER_FILE" ]; then
+  while IFS= read -r invocation; do
+    echo "unexpected agent CLI invocation: $invocation" >&2
+  done <"$MARKER_FILE"
+  exit 1
+fi
+
+exit "$command_status"

scripts/test-go.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -eu
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+REPO_ROOT=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
+GUARD_SCRIPT="$SCRIPT_DIR/go-test-with-agent-cli-guard.sh"
+
+usage() {
+  echo "usage: $0 [--race]" >&2
+}
+
+go_test_args=(test)
+case "$#" in
+  0) ;;
+  1)
+    if [ "$1" != "--race" ]; then
+      usage
+      exit 2
+    fi
+    go_test_args+=(-race)
+    ;;
+  *)
+    usage
+    exit 2
+    ;;
+esac
+
+cd "$REPO_ROOT/server"
+packages=$(go list ./...)
+regular_packages=()
+for package in $packages; do
+  case "$package" in
+    */pkg/agent|*/pkg/agent/*) ;;
+    *) regular_packages+=("$package") ;;
+  esac
+done
+
+"$GUARD_SCRIPT" -- go "${go_test_args[@]}" "${regular_packages[@]}"
+# Subprocess-backed agent tests have hard deadlines. Limit both package and
+# within-package parallelism so race builds do not starve their parent loops.
+"$GUARD_SCRIPT" -- go "${go_test_args[@]}" -p 2 -parallel 2 ./pkg/agent/...

scripts/test-go.test.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -eu
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+TEST_DIR=$(mktemp -d "${TMPDIR:-/tmp}/multica-test-go.XXXXXX")
+BIN_DIR="$TEST_DIR/bin"
+CALLS_FILE="$TEST_DIR/go-calls.log"
+OUTPUT_FILE="$TEST_DIR/output.log"
+
+cleanup() {
+  rm -rf "$TEST_DIR"
+}
+trap cleanup EXIT
+
+mkdir -p "$BIN_DIR"
+export MULTICA_TEST_GO_CALLS="$CALLS_FILE"
+
+cat >"$BIN_DIR/go" <<'EOF'
+#!/usr/bin/env bash
+set -eu
+
+case "${1:-}" in
+  list)
+    if [ "$#" -ne 2 ] || [ "$2" != "./..." ]; then
+      echo "unexpected go list arguments: $*" >&2
+      exit 2
+    fi
+    printf '%s\n' \
+      github.com/multica-ai/multica/server \
+      github.com/multica-ai/multica/server/internal/daemon \
+      github.com/multica-ai/multica/server/pkg/agent \
+      github.com/multica-ai/multica/server/pkg/agent/internal/testutil
+    ;;
+  test)
+    printf '%s\n' "$*" >>"$MULTICA_TEST_GO_CALLS"
+    ;;
+  *)
+    echo "unexpected go command: $*" >&2
+    exit 2
+    ;;
+esac
+EOF
+chmod 755 "$BIN_DIR/go"
+
+PATH="$BIN_DIR:$PATH" bash "$SCRIPT_DIR/test-go.sh" --race
+
+expected_calls='test -race github.com/multica-ai/multica/server github.com/multica-ai/multica/server/internal/daemon
+test -race -p 2 -parallel 2 ./pkg/agent/...'
+actual_calls=$(cat "$CALLS_FILE")
+if [ "$actual_calls" != "$expected_calls" ]; then
+  echo "unexpected go test calls:" >&2
+  printf '%s\n' "$actual_calls" >&2
+  exit 1
+fi
+
+: >"$CALLS_FILE"
+set +e
+PATH="$BIN_DIR:$PATH" bash "$SCRIPT_DIR/test-go.sh" --unknown >"$OUTPUT_FILE" 2>&1
+status=$?
+set -e
+
+if [ "$status" -ne 2 ]; then
+  echo "unknown option returned status $status, want 2" >&2
+  cat "$OUTPUT_FILE" >&2
+  exit 1
+fi
+if [ -s "$CALLS_FILE" ]; then
+  echo "unknown option invoked go:" >&2
+  cat "$CALLS_FILE" >&2
+  exit 1
+fi
+if ! grep -q '^usage: .*test-go.sh \[--race\]$' "$OUTPUT_FILE"; then
+  echo "unknown option did not print usage" >&2
+  cat "$OUTPUT_FILE" >&2
+  exit 1
+fi
+
+echo "test-go.test.sh: PASS"