refactor(testkit): share YamlFile and report stdout when output checks fail

Replace CliSandboxBuilder's private PolicyFile with a public testkit::YamlFile, so other CLI commands that read YAML files can reuse it. Its .yaml suffix lets the CLI recognize the format. ExecOutput::success and CliOutput::success now include stdout in their failure messages, since many commands report errors there.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

Author: matthewgrossman

tests/testkit/README.md

@@ -89,6 +89,8 @@ fails. A killed test process skips cleanup, so names are unique to the run.
 - `cx.cli([...])` to run the installed CLI against the same gateway, with
   `success()`, `failure()`, `expect_stdout()`, and `json()` on the output. `cx.cli_handle()`
   returns that CLI for code that can't borrow `cx`, such as a cleanup hook.
+  `testkit::YamlFile` writes YAML to a temporary file for commands that read
+  one, such as `profile import --file`.
 - `cx.on_cleanup(name, hook)` to remove something when the test ends.
 - `cx.client()` for SDK calls testkit does not wrap.
 - `poll_until` for waiting on other state, and `with_deadline(what, timeout,

tests/testkit/testkit/src/cli.rs

@@ -156,9 +156,10 @@ impl CliOutput {
     pub fn success(self) -> Result<Self> {
         crate::ensure!(
             self.exit_code == 0,
-            "`{}` exited with {}; stderr: {}",
+            "`{}` exited with {}; stdout: {}; stderr: {}",
             self.command,
             self.exit_code,
+            self.stdout.trim(),
             self.stderr.trim()
         );
         Ok(self)

tests/testkit/testkit/src/cli_sandbox.rs

@@ -7,7 +7,8 @@
 
 use crate::cli::CliOutput;
 use crate::context::{Context, Sandbox};
-use crate::error::{Error, Result, ResultExt};
+use crate::error::{Result, ResultExt};
+use crate::yaml_file::YamlFile;
 
 /// A sandbox to create with `openshell sandbox create`. Start one with
 /// [`Context::cli_sandbox`].
@@ -95,7 +96,7 @@ impl<'a> CliSandboxBuilder<'a> {
 
     async fn invoke(&self) -> Result<CliOutput> {
         self.cx.track(&self.name);
-        let policy = self.policy.as_deref().map(PolicyFile::new).transpose()?;
+        let policy = self.policy.as_deref().map(YamlFile::new).transpose()?;
         let mut args = vec!["sandbox", "create", "--name", &self.name, "--no-tty"];
         if let Some(policy) = &policy {
             args.extend(["--policy", policy.path()?]);
@@ -108,21 +109,3 @@ impl<'a> CliSandboxBuilder<'a> {
         self.cx.cli(args).await
     }
 }
-
-/// A policy written to a temporary file for `sandbox create --policy`.
-struct PolicyFile(tempfile::NamedTempFile);
-
-impl PolicyFile {
-    fn new(contents: &str) -> Result<Self> {
-        let file = tempfile::NamedTempFile::new().context("create policy file")?;
-        std::fs::write(file.path(), contents)
-            .context(format!("write {}", file.path().display()))?;
-        Ok(Self(file))
-    }
-
-    fn path(&self) -> Result<&str> {
-        let path = self.0.path();
-        path.to_str()
-            .ok_or_else(|| Error::msg(format!("{} is not UTF-8", path.display())))
-    }
-}

tests/testkit/testkit/src/context.rs

@@ -411,9 +411,10 @@ impl ExecOutput {
     pub fn success(self) -> Result<Self> {
         crate::ensure!(
             self.exit_code == 0,
-            "{} exited with {}; stderr: {}",
+            "{} exited with {}; stdout: {}; stderr: {}",
             self.command,
             self.exit_code,
+            self.stdout.trim(),
             self.stderr.trim()
         );
         Ok(self)

tests/testkit/testkit/src/lib.rs

@@ -38,6 +38,7 @@ pub mod program;
 mod ready;
 mod registry;
 mod run;
+mod yaml_file;
 
 pub use cleanup::CLEANUP_TIMEOUT;
 pub use cli::{CLI_TIMEOUT, Cli, CliOutput};
@@ -56,6 +57,7 @@ pub use ready::check as check_ready;
 pub use registry::Test;
 pub use run::{TestInfo, run};
 pub use testkit_macros::test;
+pub use yaml_file::YamlFile;
 
 #[doc(hidden)]
 pub mod __private {

tests/testkit/testkit/src/yaml_file.rs

@@ -0,0 +1,28 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::{Error, Result, ResultExt as _};
+
+/// YAML in a temporary file, for CLI commands that read one, such as
+/// `sandbox create --policy` or `profile import --file`. The file is removed
+/// when dropped.
+pub struct YamlFile(tempfile::NamedTempFile);
+
+impl YamlFile {
+    pub fn new(contents: &str) -> Result<Self> {
+        let file = tempfile::Builder::new()
+            .suffix(".yaml")
+            .tempfile()
+            .context("create a temporary YAML file")?;
+        std::fs::write(file.path(), contents)
+            .context(format!("write {}", file.path().display()))?;
+        Ok(Self(file))
+    }
+
+    /// The file's path, as a CLI argument.
+    pub fn path(&self) -> Result<&str> {
+        let path = self.0.path();
+        path.to_str()
+            .ok_or_else(|| Error::msg(format!("{} is not UTF-8", path.display())))
+    }
+}