Open-source guardrail
Passing a test run with no tests or no coverage gate
AgentTrail Guard lets this run by default, and writes the match to its local decision log so you can see how often it happens.
- Default action
- Warn
- Severity
- Medium severity
- Pack
- Test tampering
- Library version
- 0.2.1 · Sep 29, 2026
What it does
What it catches, and what it misses
Written into the rule itself, next to what it matches, so you can judge it before you trust it.
Warns on a test run told to pass with nothing to check, or with its coverage gate off: --passWithNoTests (Jest, Vitest), pytest-cov's --no-cov and --cov-fail-under=0, --coverage=false, --collectCoverage=false, --coverage.enabled=false and --no-coverage, nyc's and c8's --check-coverage=false and --no-check-coverage, and a Vitest coverage threshold set to 0 on the command line. Each turns a check that would fail into one that reports success. A warning, not a hold: running without coverage locally is common. Deliberately NOT matched: --no-cov-on-fail, --check-coverage on its own, which makes the gate stricter, and a non-zero threshold. Misses a threshold lowered to any other number, a gate switched off in a config file (ti.test-config-edit holds the dedicated ones), and a coverage step removed from a CI workflow (fs.ci-definition holds those files). A quoted MENTION is not a use: a search, a git commit -m message, an echo or a curl --data body that only names this command is left alone. That holds only while every shell metacharacter stays inside the quotes, so git commit -m "x" && … is still caught; and the carrier must be the first word, so sudo grep … is not exempt.
Examples
Tested on every build
The rule must match every command on the left and none on the right, or the library does not build. Catching the real thing is easy; staying quiet on the near-miss is the hard part.
Catches (12)
- npx jest --passWithNoTests
- vitest run --pass-with-no-tests
- pytest --no-cov
- pytest --cov=src --cov-fail-under=0
- npx jest --coverage=false
- npx jest --collectCoverage=false
- vitest run --coverage.enabled=false
- vitest run --no-coverage
- nyc --check-coverage=false npm test
- c8 --no-check-coverage node test.js
- vitest run --coverage.thresholds.lines 0
- PowerShellnpx jest --passWithNoTests
Stays quiet on (12)
- git commit -m "docs: explain npx jest --passWithNoTests"
- grep -rn "npx jest --passWithNoTests" docs/
- echo "never run npx jest --passWithNoTests"
- curl --data "we ran npx jest --passWithNoTests" https://api.example.com/comments
- npm test
- vitest run --coverage
- pytest --cov=src --cov-fail-under=80
- pytest --no-cov-on-fail
- c8 --check-coverage npm test
- npx jest --ci
- npx jest --passWithNoTests=false
- vitest run --coverage.thresholds.lines 80
In your agent
What "warn" means in each app
The guard runs as a hook in each app, and each app gives a hook different powers. Here is what this rule's default action does in each one.
- Claude Code
- The call runs, and the match is written to the local decision log.
- Cursor
- The call runs, and Cursor shows nothing. The match is still written to the decision log.
- Codex CLI
- The call runs. Codex's terminal UI shows a hook line (a codex exec run shows nothing), and the match is written to the decision log.
Each app hands the guard a different set of calls: in a Cursor sandbox run mode, for one, some terminal commands run without reaching the guard at all. Read the notes for Cursor and for Codex CLI before you rely on a rule there.
Make it yours
Change what it does in one command
Turn it off, change its action, or silence it on one command shape. The narrow one is allow: the rule keeps catching everything else.
Run it locally
Put these guardrails in front of your agent.
AgentTrail Guard is free and open source. It checks every command and file change against the whole library before your agent runs it, on your machine, with no account.
npm i -g @agenttrail/guard