test: guard the remaining CLI tests behind HAS_SAFE_INPUT_OPEN

[SurefireStudios]

What happens

On Windows, node validate-findings.test.cjs reports 7 failures:

ℹ tests 34
ℹ pass 22
ℹ fail 7
ℹ skipped 5

✖ accepts a producer-shaped findings document through the CLI
✖ CLI rejects input above the byte limit without an exception trace
✖ CLI rejects invalid UTF-8 without replacement or an exception trace
✖ CLI rejects lone-surrogate prose without changing payload semantics
✖ CLI rejects Unicode format controls in source paths
✖ CLI rejects input above the nesting-depth limit without an exception trace
✖ CLI rejects an oversized array without an exception trace

Every one fails the same way — the assertion never runs:

actual:   'Failed to read findings JSON: OS no-follow and nonblocking input protection is unavailable\n'
expected: /1000 item array limit/

fs.constants.O_NOFOLLOW and O_NONBLOCK are undefined on win32, so readFileWithinLimit throws its SafeInputError before the test gets to the behaviour it is checking.

Why it is an oversight rather than a design choice

The file already has the guard, and already uses it — HAS_SAFE_INPUT_OPEN is defined at line 18 and applied to five tests. These seven were simply left without it.

validate-coverage-ledger.test.cjs defines the byte-identical constant and applies it to every CLI test, which is why it reports pass 24, fail 0 on the same machine. This change brings the findings suite in line with its sibling — same constant, same spelling, nothing new introduced.

The docs also treat non-POSIX as in scope: SKILL.md guards agent IDs against Windows device names (con, prn, aux, nul, com1–com9, lpt1–lpt9), and step 9 says to "use equivalent race-safe APIs on non-POSIX systems".

The change

Seven lines, all the same edit:

-test("CLI rejects an oversized array without an exception trace", () => {
+test("CLI rejects an oversized array without an exception trace", { skip: !HAS_SAFE_INPUT_OPEN }, () => {

After: 34 tests, 22 pass, 0 fail, 12 skip.

I left does not reflect controls from a failed CLI input path alone — it mentions the CLI but never opens a file successfully, and it passes on win32, so gating it would skip a test that works.

No coverage lost where the constants exist

The guard is false on POSIX, so all seven run exactly as before:

HAS_SAFE_INPUT_OPEN on POSIX = true  -> skip: false  (tests RUN)
HAS_SAFE_INPUT_OPEN on win32 = false -> skip: true

Two things I noticed but did not touch

The validators themselves still cannot run on win32. This PR only fixes the test suite reporting failures; validate-findings.cjs and validate-coverage-ledger.cjs both refuse the CLI path there. Refusing to read input without symlink and non-blocking protection looks deliberate for a security tool, so I have not touched it — but if Windows is meant to be supported, that is the real gap, and SKILL.md step 9 hints at wanting an equivalent. Happy to open a separate issue if useful.

There is no .github/workflows. Nothing runs these suites automatically, which is plausibly why this went unseen — anyone developing on Linux or macOS sees a green run. Glad to propose a minimal workflow separately if you want one; I did not want to bundle it here.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[rajpratham1]

I analyze it okk and perfect it need to approve