test: isolate accounting fixtures and include all adapter suites (#14989)

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/src/__tests__/cli-invocation-safety.test.ts

@@ -1,3 +1,4 @@
+import { execFileSync } from "node:child_process";
 import { mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -367,6 +368,13 @@ function isTestFile(relPath: string): boolean {
 
 function listGuidanceFiles(rootDir = repoRoot): string[] {
   const found: string[] = [];
+  // Include tracked files and new authored files, while respecting gitignored
+  // local settings. A tracked file remains scanned even if an ignore matches.
+  const authored = new Set(execFileSync(
+    "git",
+    ["ls-files", "--cached", "--others", "--exclude-standard", "-z"],
+    { cwd: rootDir, encoding: "utf8" },
+  ).split("\0"));
 
   function walk(absDir: string, relDir: string): void {
     for (const entry of readdirSync(absDir, { withFileTypes: true })) {
@@ -382,7 +390,7 @@ function listGuidanceFiles(rootDir = repoRoot): string[] {
       if (!SCAN_EXTENSIONS.has(path.extname(entry.name))) continue;
       if (isTestFile(relPath)) continue;
       if (SKIP_PATH_PREFIXES.some((prefix) => relPath.startsWith(prefix))) continue;
-      found.push(relPath);
+      if (authored.has(relPath)) found.push(relPath);
     }
   }
 
@@ -486,6 +494,7 @@ describe("paperclipai CLI invocation safety", () => {
       "tests/runner-e2e/catalog.ts",
     ];
     try {
+      execFileSync("git", ["init", "--quiet"], { cwd: root });
       for (const relPath of [
         ...sourcePaths,
         "tests/runner-e2e/results/campaign/attempt-1/snapshots/api-state.json",
@@ -503,6 +512,7 @@ describe("paperclipai CLI invocation safety", () => {
   it("excludes root runtime recordings but still scans unsafe docs and source guidance", () => {
     const fixtureRoot = mkdtempSync(path.join(os.tmpdir(), "paperclip-cli-guidance-"));
     try {
+      execFileSync("git", ["init", "--quiet"], { cwd: fixtureRoot });
       const fixtures = [
         "doc/CLI.md",
         "src/guidance.ts",
@@ -528,6 +538,26 @@ describe("paperclipai CLI invocation safety", () => {
     }
   });
 
+  it("scans tracked and ordinary untracked guidance but excludes ignored untracked files", () => {
+    const root = mkdtempSync(path.join(os.tmpdir(), "paperclip-cli-guidance-"));
+    try {
+      execFileSync("git", ["init", "--quiet"], { cwd: root });
+      writeFileSync(path.join(root, ".gitignore"), "ignored.md\ntracked.md\n");
+      for (const name of ["ignored.md", "untracked.md", "tracked.md"]) {
+        writeFileSync(path.join(root, name), "pnpm paperclipai issue get issue-1\n");
+      }
+      execFileSync("git", ["add", "--force", "tracked.md"], { cwd: root });
+
+      const files = listGuidanceFiles(root).sort();
+      expect(files).toEqual(["tracked.md", "untracked.md"]);
+      for (const name of files) {
+        expect(scanText(name, readFileSync(path.join(root, name), "utf8"))).toHaveLength(1);
+      }
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
   it("allows only exact-allowlist pnpm paperclipai commands on every guidance surface", () => {
     const offenders = scanForOffenders();
     expect(