Borrowing it
Nothing to install: this file belongs to alexjbarnes/cockpit. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/alexjbarnes/cockpit/main/.claude/skills/integration-test/SKILL.mdgit clone --depth 1 https://github.com/alexjbarnes/cockpitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alexjbarnes/cockpit/integration-test)<a href="https://agentmods.dev/skills/alexjbarnes/cockpit/integration-test"><img src="https://agentmods.dev/badge/skills/alexjbarnes/cockpit/integration-test.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00090 | $0.01641 |
| Opus 5 | $0.00045 | $0.00821 |
| Sonnet 5 | $0.00018 | $0.00328 |
| Haiku 4.5 | $0.00009 | $0.00164 |
Grade A, and why
integration-test scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
import { execSync } from "node:child_process"; How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Integration-test a cockpit runtime path against the mock CLI
Unit tests prove a helper returns the right value. Static review proves the diff looks correct. Neither proves the feature actually works end to end. For anything whose value is runtime behaviour — the cockpit agent calling a tool, a session spawning with the right flags, a job posting to the inbox, the permission gate allowing/denying — the only honest evidence is driving the real Claude CLI and watching it happen. This harness does that with a scripted mock Anthropic API so it is deterministic and offline.
When to use
- A behavioural acceptance criterion: "the assistant calls a tool and it succeeds", "asking X returns Y", "a cockpit-agent tool is not denied".
- A spawn-time contract: the CLI receives
--system,--mcp-config, a model, a permission mode. - A regression you can only see at the wire level (what the CLI sent to the API, what came back, what rendered).
If you only need to assert a pure function's output, write a normal tests/*.test.ts vitest unit test instead. Use this harness when the proof requires a running CLI.
The harness (tests/integration/)
startHarness() (in tests/integration/harness.ts) boots three things in isolated tmpdirs: a mock Anthropic API on a random port that replays scripted SSE, a seeded COCKPIT_CONFIG_DIR + CLAUDE_CONFIG_DIR (password, a mock provider pointing the CLI at the mock, default model), and a cockpit server (node dist/server.js) on a random port. The Playwright fixture in tests/integration/fixtures.ts exposes a per-test harness and an already-authenticated page (it injects the cockpit_session cookie), so you navigate straight to authenticated routes.
Write a test
Model on tests/integration/hello.spec.ts. Import the fixture, skip when no CLI is present, script the mock, create a session, drive the UI, assert both the rendered output and what the CLI sent.
import { execSync } from "node:child_process";
import { textResponse, toolUseResponse } from "../mock-api/builder";
import { expect, test } from "./fixtures";
const CLAUDE_BIN = process.env.CLAUDE_BIN ?? "claude";
const CLAUDE_AVAILABLE = (() => {
try { execSync(`${CLAUDE_BIN} --version`, { stdio: "ignore" }); return true; } catch { return false; }
})();
test.skip(!CLAUDE_AVAILABLE, `claude binary not found at ${CLAUDE_BIN} (set CLAUDE_BIN env)`);
test("the cockpit agent calls a config tool and it is not denied", async ({ page, harness }) => {
// Script the mock: turn 1 emits a tool_use, turn 2 a final text answer.
harness.mock.setScript([
{ events: toolUseResponse("list_jobs", {}) },
{ events: textResponse("You have 2 scheduled jobs.") },
]);
const res = await page.request.post(`${harness.cockpitUrl}/api/sessions`, {
data: { cwd: harness.configDir, cockpitAgent: true, runtime: "pty" },
});
const { sessionId } = await res.json();
await page.goto(`${harness.cockpitUrl}/sessions/${sessionId}?cwd=${encodeURIComponent(harness.configDir)}`);
const input = page.getByTestId("message-input");
await expect(input).toBeVisible();
await page.waitForTimeout(5000); // let the eager PTY spawn settle before sending
await input.fill("list my jobs");
await page.getByTestId("btn-send").click();
await expect(page.getByText("You have 2 scheduled jobs.")).toBeVisible({ timeout: 30_000 });
// Assert what reached the API: the system prompt and the tool result round-tripped,
// so the tool was NOT denied. getRequests() returns { url, body } for each call.
const calls = harness.mock.getRequests().filter((r) => r.url.split("?")[0] === "/v1/messages");
expect(calls.length).toBeGreaterThanOrEqual(2); // tool turn + follow-up turn
expect(calls[0].body).toContain("Cockpit Assistant"); // --system prompt arrived
});
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 85 lines · 90 tokens per session scan A 3c6808898644
integration-test is a skill published in the GitHub repository alexjbarnes/cockpit (14 stars, last pushed yesterday), licensed Apache-2.0. It adds 90 tokens to every session and 1,641 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
tdd-workflow
Use this skill when writing new features, fixing bugs, or refactoring code. Enforces test-driven development with 80%+ coverage including unit, integration, and E2E tests.
e2e-testing
Playwright E2E testing patterns, Page Object Model, configuration, CI/CD integration, artifact management, and flaky test strategies. Use when writing Playwright tests, structuring page objects, or fixing flaky E2E runs in CI.
memstack-development-test-writer
Use this skill when the user says 'write tests', 'add tests', 'test coverage', 'unit tests', 'integration tests', 'component tests', 'mocking', 'edge cases', or needs to generate tests with proper mocking and edge case coverage. Do NOT use for refactoring plans or database migrations.
memstack-development-webapp-testing
Use when the user says 'write browser tests', 'test this page', 'playwright test', 'e2e test', 'end to end test', 'browser test', 'test the UI', or needs Playwright-based browser testing for a web application. Do NOT use for unit tests, API tests, or non-browser testing.
verify
Verify-before-done — exercise the current change end-to-end against its acceptance criteria (the SDD plan's, or the ticket's) and report a per-criterion PASS/FAIL verdict, then record the outcome to memory. This is the concrete action that satisfies moflo's verify-before-done gate (gates.verifybeforedone / /flo -v /…
human-pass
Guide real-build acceptance: literal taps, real inputs, expected outcomes, worst case first, one sitting. Triggers: testflight, human pass, acceptance test, before we ship, hand it to the user, what should I test, release checklist, device test.