test(smoke-tests): Harden CLI invocation and teardown assertions

Use execFileSync for CLI smoke invocations to avoid shell-string execution and satisfy code scanning feedback.

Require non-empty output in the --output json smoke test even when the tool exits non-zero on non-macOS.

Guard harness cleanup in doctor and scaffolding suites so setup failures do not mask root causes.

Use distinctive session defaults in clear-defaults assertions to avoid fragile substring matches.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: cameroncooke

src/smoke-tests/__tests__/cli-surface.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import { resolve } from 'path';
 
 const CLI = resolve(__dirname, '../../../build/cli.js');
@@ -11,7 +11,8 @@ const cliEnv = (() => {
   return env;
 })();
 const run = (args: string): string => {
-  return execSync(`node ${CLI} ${args}`, {
+  const argv = args.trim() ? args.trim().split(/\s+/) : [];
+  return execFileSync('node', [CLI, ...argv], {
     encoding: 'utf8',
     timeout: 15_000,
     env: cliEnv,
@@ -108,12 +109,14 @@ describe('CLI Surface (e2e)', () => {
       // list_sims is a good candidate -- it will fail to run xcrun but should
       // return structured JSON output even on error
       const result = runMayFail('simulator list-sims --output json');
-      // Even if the tool fails (no xcrun), the output format should be JSON
+      const output = result.stdout.trim();
+      expect(output.length).toBeGreaterThan(0);
+      // Even if the tool fails (no xcrun), a successful run should be JSON
       if (result.status === 0) {
-        const parsed = JSON.parse(result.stdout);
+        const parsed = JSON.parse(output);
         expect(parsed).toBeDefined();
       }
-      // If it fails, that's also acceptable on non-macOS platforms
+      // If it fails, that's acceptable on non-macOS platforms as long as output is present
     });
 
     it('missing required args produces user-friendly error', () => {

src/smoke-tests/__tests__/e2e-mcp-doctor.test.ts

@@ -13,7 +13,7 @@ beforeAll(async () => {
 }, 30_000);
 
 afterAll(async () => {
-  await harness.cleanup();
+  await harness?.cleanup();
 });
 
 describe('MCP Doctor Tool (e2e)', () => {

src/smoke-tests/__tests__/e2e-mcp-scaffolding.test.ts

@@ -11,7 +11,7 @@ beforeAll(async () => {
 }, 30_000);
 
 afterAll(async () => {
-  await harness.cleanup();
+  await harness?.cleanup();
 });
 
 describe('MCP Project Scaffolding Tools (e2e)', () => {

src/smoke-tests/__tests__/e2e-mcp-sessions.test.ts

@@ -73,7 +73,7 @@ describe('MCP Session Management (e2e)', () => {
     // Set defaults
     await harness.client.callTool({
       name: 'session_set_defaults',
-      arguments: { scheme: 'App', projectPath: '/proj' },
+      arguments: { scheme: 'ClearMeScheme', projectPath: '/clear-me-proj' },
     });
 
     // Clear all
@@ -90,8 +90,8 @@ describe('MCP Session Management (e2e)', () => {
 
     const text = extractText(result);
     // Should not contain the previously set values
-    expect(text).not.toContain('App');
-    expect(text).not.toContain('/proj');
+    expect(text).not.toContain('ClearMeScheme');
+    expect(text).not.toContain('/clear-me-proj');
   });
 
   it('session_clear_defaults clears specific keys', async () => {