From 3855242ec9028dee28a2a809e121f9a9347bb0bf Mon Sep 17 00:00:00 2001
From: suzunn <slymnuzn@hotmail.com>
Date: Wed, 17 Jun 2026 11:03:32 +0300
Subject: [PATCH] test: add cleaner safety regression coverage

---
 test/scanner.test.js | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/test/scanner.test.js b/test/scanner.test.js
index a2cdf5a..a4e321b 100644
--- a/test/scanner.test.js
+++ b/test/scanner.test.js
@@ -94,3 +94,41 @@ test("refuses paths that do not match the cache catalog", async (t) => {
   assert.equal(result.status, "failed");
   assert.match(result.error, /no longer matches a known cache rule/);
 });
+
+test("refuses removal targets outside the scan root", async (t) => {
+  const { root } = await fixture();
+  t.after(() => rm(root, { recursive: true, force: true }));
+
+  const [result] = await removeCaches(root, [
+    {
+      path: root,
+      relativePath: ".",
+      type: "node",
+      bytes: 0,
+      files: 0,
+      modifiedAtMs: Date.now(),
+    },
+  ]);
+
+  assert.equal(result.status, "failed");
+  assert.match(result.error, /Refusing unsafe cache path/);
+});
+
+test("refuses stale scan results when the cache type changes", async (t) => {
+  const { root, paths } = await fixture();
+  t.after(() => rm(root, { recursive: true, force: true }));
+
+  const [result] = await removeCaches(root, [
+    {
+      path: paths.node,
+      relativePath: path.relative(root, paths.node),
+      type: "python",
+      bytes: 2048,
+      files: 1,
+      modifiedAtMs: Date.now(),
+    },
+  ]);
+
+  assert.equal(result.status, "failed");
+  assert.match(result.error, /Cache type changed before removal/);
+});