test(vault-intercept): soft-dep regression tests for PR #1764

[john-the-dev]

Problem

PR #1764 (fix(vault): make detect-secrets a soft/dev-only dep) changed the behavior of intercept_vault_commands when detect-secrets is absent: unquoted values are now refused (not stored) with a self-documenting placeholder rather than silently dropped or stored. No tests were added for this new path at the time of merge.

Tests added (tests/vault-intercept-soft-dep.test.py, 17 tests)

Structural (9 tests) — source-code pattern assertions:

• secret_scanner import is NOT at module top level (lazy import, soft dep)
• Import is guarded by try/except ImportError
• REFUSED placeholder text is present in source
• Placeholder contains python3 -m pip install detect-secrets instruction
• Placeholder includes "Never echo" guard
• is_quoted flag is present to bypass the FP scan
• if not is_quoted: wraps the scanner call
• failed.append(key) is inside the ImportError handler

Functional (8 tests) — simulate absent detect-secrets via sys.modules mock:

• Unquoted value → REFUSED in result text
• REFUSED placeholder explains "detect-secrets not installed"
• Refused key in failed[]; not in stored[]
• Keychain subprocess never called on refusal
• Quoted value stores normally even without scanner (bypasses FP guard)
• Raw value never in sanitized text on refusal
• Multiple unquoted refusals accumulate in failed[]

Verification

python3 tests/vault-intercept-soft-dep.test.py
Ran 17 tests in 0.003s — OK

Closes #1764 (test gap).

[bassilkhilo-ag2]

Good regression coverage for the soft-dep refusal path added in #1764. Key invariants tested: lazy import (module-level import would crash bridges on hosts without detect-secrets), REFUSED-not-stored on unquoted values, self-documenting placeholder, quoted-value bypass, and Keychain-never-called on failure. All assertions are source-code structural checks — no live process or Keychain access needed, so the suite is safe to run in CI. Base is main.

[bassilkhilo-ag2]

The soft-dep structural tests (import inside try:, except ImportError present, etc.) are the correct technique for verifying a lazy-import design without actually uninstalling detect-secrets. The mock-based behavioral tests (refusal on missing dep, REFUSED placeholder, quoted-value bypass, Keychain never called on refusal) directly cover the four PR #1764 behavioral invariants. ✓

[bassilkhilo-ag2]

Structural source-code invariants for the soft-dep design are a clean way to guard this without needing to mock the import at runtime. 8 properties tested: lazy import position, try/except guard, REFUSED placeholder text, install instruction, never-echo instruction, is_quoted bypass. All meaningful for PR #1764's contract. LGTM.