Testing Framework & QA Standards

To protect live capital and ensure robust order routing, Hoox mandates a rigorous testing pipeline. With money on the line, we verify every contract calculation, rate-limiting gate, and database query.

Our test suite is powered natively by Bun's high-speed test runner, comprising ~250 test files and ~9,300 expect() assertions (~4,600+ unit/package tests) split across five diagnostic layers.

As of 2026-08 (line coverage, package-scoped bun test --coverage):

---

🎚️ The 5 QA Testing Layers

Rendering…

---

⚡ Running Tests: CLI Commands

A. Core Platform Verification (Excluding Live)

# 1. Run all unit, integration, and E2E smoke tests in parallel
bun test

# 2. Run the suite and output a detailed V8 coverage report
bun test --coverage

B. Workspace-Specific Targeted Runs

To optimize developer feedback loops, you can target specific workspaces or workers:

# Run CLI commands tests only (packages/cli/)
bun run test:cli

# Run Terminal UI tests only (packages/tui/)
bun run test:tui

# Run shared helper tests only (packages/shared/)
bun run test:shared

# Run all edge workers unit tests (workers/*)
bun run test:workers

# Run a single specific test file with hot-reload watch mode
bun test workers/agent-worker/src/index.test.ts --watch

C. Security & Fuzz Testing

# Run all security tests (auth bypass, security headers, fuzz)
bun run test:security

# Run specific security test files
bun test tests/security/auth-bypass.test.ts
bun test tests/security/security-headers.test.ts
bun test tests/security/fuzz.test.ts

D. Advanced Integration & Live Runs

# Run Miniflare 3 gateway integration tests
bun run test:integration

# Run E2E CLI lifecycle smoke tests
bun run test:e2e

# Run live Cloudflare API integration tests (requires tests/live/.env credentials)
bun run test:live --jobs 1

# Run k6 performance/load tests (requires k6 CLI)
bun run test:load

---

🔒 Type-Safe Mocking Specifications (No as any)

To enforce strict TypeScript compiler safety, test files must never utilize as any to bypass types when mock-binding resources. Always cast stubs using as unknown as Env:

import { describe, it, expect } from "bun:test";
import type { Env } from "../src/index";

describe("trade-worker Gateway Router Mocking", () => {
  it("should securely mock internal service binding fetchers", async () => {
    // 1. Construct a type-safe mock environment structure
    const mockEnv = {
      INTERNAL_KEY_BINDING: "local_secret_token_183",
      TELEGRAM_SERVICE: {
        fetch: async (url: string, init?: RequestInit) => {
          // Verify auth headers exist
          const headers = init?.headers as Record<string, string>;
          if (headers["X-Internal-Auth-Key"] !== "local_secret_token_183") {
            return new Response(JSON.stringify({ success: false }), {
              status: 401,
            });
          }

          return new Response(
            JSON.stringify({
              success: true,
              messageId: 4829,
            }),
            { status: 200 }
          );
        },
      } as Fetcher,
    } as unknown as Env;

    // 2. Execute assertions
    const res = await mockEnv.TELEGRAM_SERVICE.fetch(
      "https://telegram-worker/alert",
      {
        method: "POST",
        headers: {
          "X-Internal-Auth-Key": "local_secret_token_183",
        },
      }
    );

    const data = await res.json();
    expect(res.status).toBe(200);
    expect(data.success).toBe(true);
    expect(data.messageId).toBe(4829);
  });
});

---

🚢 Continuous Integration Gates & Coverage Targets

Our GitHub Actions workflows enforce the following quality gates:

1. TypeScript Type Safety: All workspaces must compile without errors using tsc --noEmit.
2. Coverage Thresholds: CI and contributor standards target ≥80% line coverage on core execution paths (packages/cli, packages/shared, gateway/trade workers), with aspirational 90% line / 95% function floors in .opencode/context/core/standards/test-coverage.md. Shared is already ~98%; CLI src/ averages ~95%. Per-file CLI floor: bun run coverage:check (50% hard floor on packages/cli/src/**, ratcheting upward).
3. Dependency Audit: bun audit runs after tests to detect known vulnerabilities (informational, doesn't block CI).
4. Secret Scanning: gitleaks scans all commits for hardcoded secrets on every push/PR (informational).
5. CodeQL: Weekly security-and-quality analysis for JavaScript/TypeScript.

# Check your local workspace coverage statistics
bun test packages/cli/ --coverage
bun test packages/shared/ --coverage
bun run coverage:check   # CLI per-file floor (needs lcov from a coverage run)

🔗 Next Steps

• Security Testing & Hardening — Auth hardening, security tests, and CI/CD scanning.
• Debugging Telemetry Runbook — Learn how to trace active V8 memory, tail logs, and audit SQL execution.
• Local Development Setup — Configure Wrangler and Docker compose to run testbeds.