# Files changed · PR \#9566 · pingdotgg/t3code [View on GitCafe](https://git.cafe/pingdotgg/t3code/pull/9566/diffs) Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code) Visibility: public [test: skip symlink fixtures where the host cannot create symlinks](https://git.cafe/pingdotgg/t3code/pull/9566.md) Version: 5 Head commit: 00bf96a629144b9d6e92112ade8c6ce35e6f7f3e Base commit: ebe89b26382b49528fe5db4e4843d3c2d4b6e5df Comparison base: ebe89b26382b49528fe5db4e4843d3c2d4b6e5df Showing up to 20 entries from this revision. If the pull request changes, reopen the first page before continuing. ## apps/desktop/src/preview/BrowserImport/BrowserImport.test.ts Status: modified; +23; −20 ```diff @@ -14,6 +14,7 @@ import * as BrowserSession from "../BrowserSession.ts"; import * as BrowserImport from "./BrowserImport.ts"; import { BROWSER_IMPORT_SOURCES, sourcePathContext } from "./Sources.ts"; +import { symlinksSupported } from "@t3tools/shared/testing/symlinks"; const helium = BROWSER_IMPORT_SOURCES.find((source) => source.id === "helium")!; @@ -105,28 +106,30 @@ }).pipe(Effect.provide(NodeServices.layer), Effect.scoped), ); - it.effect("refuses to import while the source browser holds its profile", () => - Effect.gen(function* () { + it.effect.skipIf(!symlinksSupported)( + "refuses to import while the source browser holds its profile", + () => - const fileSystem = yield* FileSystem.FileSystem; - const { importer, root } = yield* withImporter(); - // The lock Chromium leaves while it is running, dangling target and - // all. This must stop the import before it ever asks the keychain. - yield* fileSystem.symlink("host-that-does-not-exist-1234", `${root}/SingletonLock`); + Effect.gen(function* () { + const fileSystem = yield* FileSystem.FileSystem; + const { importer, root } = yield* withImporter(); + // The lock Chromium leaves while it is running, dangling target and + // all. This must stop the import before it ever asks the keychain. + yield* fileSystem.symlink("host-that-does-not-exist-1234", `${root}/SingletonLock`); + const error = yield* importer + .importCookies({ + input: { + sourceId: "helium", + sourceProfileDirectory: "Default", + targetProfileId: "default", + }, + scope: "persist:t3code-preview-test", + persistent: true, + }) + .pipe(Effect.flip); - const error = yield* importer - .importCookies({ - input: { - sourceId: "helium", - sourceProfileDirectory: "Default", - targetProfileId: "default", - }, - scope: "persist:t3code-preview-test", - persistent: true, - }) - .pipe(Effect.flip); + assert.equal(error.reason, "browserRunning"); + }).pipe(Effect.provide(NodeServices.layer), Effect.scoped), - assert.equal(error.reason, "browserRunning"); - }).pipe(Effect.provide(NodeServices.layer), Effect.scoped), ); }); ``` ## apps/desktop/src/preview/BrowserImport/Sources.test.ts Status: modified; +103; −92 ```diff @@ -32,6 +32,7 @@ sourcePathContext, windowsChromiumCookiesAreHeld, } from "./Sources.ts"; +import { symlinksSupported } from "@t3tools/shared/testing/symlinks"; const helium = BROWSER_IMPORT_SOURCES.find((source) => source.id === "helium")!; @@ -125,7 +126,7 @@ }); describe("Helium on Linux", () => { - it.effect("discovers its profiles and checks the user-data lock", () => + it.effect.skipIf(!symlinksSupported)("discovers its profiles and checks the user-data lock", () => run( Effect.gen(function* () { const fileSystem = yield* FileSystem.FileSystem; @@ -221,48 +222,52 @@ ), ); + it.effect.skipIf(!symlinksSupported)( + "reads Chromium's dangling SingletonLock symlink as a running browser", + () => + run( - it.effect("reads Chromium's dangling SingletonLock symlink as a running browser", () => + Effect.gen(function* () { - run( + const fileSystem = yield* FileSystem.FileSystem; + const context = yield* withSourceHome(); + assert.isFalse(yield* isSourceRunning(helium, context)); - Effect.gen(function* () { - const fileSystem = yield* FileSystem.FileSystem; - const context = yield* withSourceHome(); - assert.isFalse(yield* isSourceRunning(helium, context)); + // Chromium points the lock at `-`, a target that never - // Chromium points the lock at `-`, a target that never + // exists on disk. A check that follows the link reports a running + // browser as closed, letting an import read a live, mid-write database. + yield* fileSystem.symlink( + "host-that-does-not-exist-1234", + `${userDataDirectory(context)}/SingletonLock`, + ); - // exists on disk. A check that follows the link reports a running - // browser as closed, letting an import read a live, mid-write database. - yield* fileSystem.symlink( - "host-that-does-not-exist-1234", - `${userDataDirectory(context)}/SingletonLock`, - ); - assert.isTrue(yield* isSourceRunning(helium, context)); - }), - ), + assert.isTrue(yield* isSourceRunning(helium, context)); + }), + ), ); - it.effect("uses the provided hostname to classify Chromium locks", () => - run( - Effect.gen(function* () { - const fileSystem = yield* FileSystem.FileSystem; - const paths = yield* withSourceHome(); - yield* fileSystem.symlink( - "lock-owner-99999999", - `${helium.userDataDirectory(paths)}/SingletonLock`, - ); + it.effect.skipIf(!symlinksSupported)( + "uses the provided hostname to classify Chromium locks", + () => + run( + Effect.gen(function* () { + const fileSystem = yield* FileSystem.FileSystem; + const paths = yield* withSourceHome(); + yield* fileSystem.symlink( + "lock-owner-99999999", + `${helium.userDataDirectory(paths)}/SingletonLock`, + ); + assert.isTrue( + yield* isSourceRunning(helium, paths).pipe( + Effect.provideService(HostProcessHostname, "another-host"), + ), + ); - assert.isTrue( - yield* isSourceRunning(helium, paths).pipe( - Effect.provideService(HostProcessHostname, "another-host"), - ), + assert.isFalse( - ); + yield* isSourceRunning(helium, paths).pipe( + Effect.provideService(HostProcessHostname, "lock-owner"), + ), + ); + }), + ), - assert.isFalse( - yield* isSourceRunning(helium, paths).pipe( - Effect.provideService(HostProcessHostname, "lock-owner"), - ), - ); - }), - ), ); }); @@ -385,25 +390,27 @@ ), ); - it.effect("follows cookie database symlinks when detecting profiles", () => - run( - Effect.gen(function* () { - const fileSystem = yield* FileSystem.FileSystem; - const context = yield* withSourceHome(); - const root = userDataDirectory(context); + it.effect.skipIf(!symlinksSupported)( - yield* fileSystem.makeDirectory(`${root}/Default`, { recursive: true }); + "follows cookie database symlinks when detecting profiles", + () => + run( + Effect.gen(function* () { + const fileSystem = yield* FileSystem.FileSystem; + const context = yield* withSourceHome(); + const root = userDataDirectory(context); + yield* fileSystem.makeDirectory(`${root}/Default`, { recursive: true }); + yield* fileSystem.symlink("missing-cookies", `${root}/Default/Cookies`); - yield* fileSystem.symlink("missing-cookies", `${root}/Default/Cookies`); - assert.deepEqual(yield* listSourceProfiles(helium, context), []); + assert.deepEqual(yield* listSourceProfiles(helium, context), []); + assert.isFalse(yield* isSourceInstalled(helium, context)); - assert.isFalse(yield* isSourceInstalled(helium, context)); + yield* fileSystem.writeFileString(`${root}/Default/missing-cookies`, "db"); + assert.deepEqual(yield* listSourceProfiles(helium, context), [ + { directory: "Default", name: "Default" }, + ]); - yield* fileSystem.writeFileString(`${root}/Default/missing-cookies`, "db"); + assert.isTrue(yield* isSourceInstalled(helium, context)); + }), + ), - assert.deepEqual(yield* listSourceProfiles(helium, context), [ - { directory: "Default", name: "Default" }, - ]); - assert.isTrue(yield* isSourceInstalled(helium, context)); - }), - ), ); }); @@ -660,44 +667,48 @@ const firefox = BROWSER_IMPORT_SOURCES.find((source) => source.id === "firefox")!; describe("Firefox Snap profiles", () => { + it.effect.skipIf(!symlinksSupported)( + "finds Snap profiles with or without profiles.ini and checks their locks", + () => + run( + Effect.gen(function* () { + const fileSystem = yield* FileSystem.FileSystem; - it.effect("finds Snap profiles with or without profiles.ini and checks their locks", () => - run( - Effect.gen(function* () { - const fileSystem = yield* FileSystem.FileSystem; - const home = yield* fileSystem.makeTempDirectoryScoped({ prefix: "t3code-firefox-snap-" }); - const context = yield* sourcePathContext.pipe( - Effect.provideService(HostProcessEnvironment, { HOME: home }), - Effect.provideService(HostProcessPlatform, "linux"), - ); + const home = yield* fileSystem.makeTempDirectoryScoped({ + prefix: "t3code-firefox-snap-", + }); + const context = yield* sourcePathContext.pipe( + Effect.provideService(HostProcessEnvironment, { HOME: home }), + Effect.provideService(HostProcessPlatform, "linux"), + ); + const root = `${home}/snap/firefox/common/.mozilla/firefox`; + const directory = `${root}/abcd.default`; + yield* fileSystem.makeDirectory(directory, { recursive: true }); + yield* writeFirefoxCookieDatabase(`${directory}/cookies.sqlite`, 2, 1); + yield* fileSystem.writeFileString( + `${root}/profiles.ini`, + "[Profile0]\nName=Personal\nIsRelative=1\nPath=abcd.default\n", + ); - const root = `${home}/snap/firefox/common/.mozilla/firefox`; - const directory = `${root}/abcd.default`; - yield* fileSystem.makeDirectory(directory, { recursive: true }); - yield* writeFirefoxCookieDatabase(`${directory}/cookies.sqlite`, 2, 1); - yield* fileSystem.writeFileString( - `${root}/profiles.ini`, - "[Profile0]\nName=Personal\nIsRelative=1\nPath=abcd.default\n", - ); - assert.isTrue(yield* isSourceInstalled(firefox, context)); - assert.deepEqual(yield* listSourceProfiles(firefox, context), [ - { directory, name: "Personal", cookieCount: 2 }, - ]); - assert.equal( - yield* resolveCookieDatabase(firefox, context, directory), - `${directory}/cookies.sqlite`, - ); - assert.isFalse(yield* isSourceRunning(firefox, context)); - yield* fileSystem.symlink("foreign-host:+4242", `${directory}/lock`); - assert.isTrue(yield* isSourceRunning(firefox, context)); - yield* fileSystem.remove(`${directory}/lock`); - assert.isFalse(yield* isSourceRunning(firefox, context)); + assert.isTrue(yield* isSourceInstalled(firefox, context)); + assert.deepEqual(yield* listSourceProfiles(firefox, context), [ + { directory, name: "Personal", cookieCount: 2 }, + ]); + assert.equal( + yield* resolveCookieDatabase(firefox, context, directory), + `${directory}/cookies.sqlite`, + ); + assert.isFalse(yield* isSourceRunning(firefox, context)); + yield* fileSystem.symlink("foreign-host:+4242", `${directory}/lock`); + assert.isTrue(yield* isSourceRunning(firefox, context)); + yield* fileSystem.remove(`${directory}/lock`); + assert.isFalse(yield* isSourceRunning(firefox, context)); - yield* fileSystem.remove(`${root}/profiles.ini`); - assert.deepEqual(yield* listSourceProfiles(firefox, context), [ - { directory, name: "abcd.default", cookieCount: 2 }, - ]); - }), + yield* fileSystem.remove(`${root}/profiles.ini`); + assert.deepEqual(yield* listSourceProfiles(firefox, context), [ - ), + { directory, name: "abcd.default", cookieCount: 2 }, + ]); + }), + ), ); it.effect("keeps matching profile names in native and Snap installs distinct", () => @@ -862,7 +873,7 @@ }); describe("isSourceRunning for Firefox", () => { + it.effect.skipIf(!symlinksSupported)("finds the lock inside the profile, not at the root", () => - it.effect("finds the lock inside the profile, not at the root", () => run( Effect.gen(function* () { const fileSystem = yield* FileSystem.FileSystem; ``` ## apps/server/scripts/t3-sqlite-state.test.ts Status: modified; +41; −38 ```diff @@ -7,6 +7,7 @@ import * as NodeSqliteClient from "@t3tools/shared/nodeSqliteClient"; import { runSqliteState } from "./t3-sqlite-state.ts"; +import { symlinksSupported } from "@t3tools/shared/testing/symlinks"; const createFixtureDatabase = Effect.fn("createSqliteStateFixtureDatabase")(function* ( baseDir: string, @@ -73,47 +74,49 @@ }), ); - it.effect("backs up isolated state before writes and refuses the shared home", () => - Effect.gen(function* () { - const fs = yield* FileSystem.FileSystem; - const path = yield* Path.Path; - const baseDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-sqlite-state-exec-" }); - yield* createFixtureDatabase(baseDir); - - const mutation = yield* runSqliteState({ - operation: "exec", - baseDir, - sql: "INSERT INTO fixtures (id, label) VALUES (2, 'seeded')", - }); - assert.equal(mutation.operation, "exec"); - if (mutation.operation === "exec") { + it.effect.skipIf(!symlinksSupported)( + "backs up isolated state before writes and refuses the shared home", + () => - assert.equal((yield* fs.stat(mutation.backup)).mode & 0o777, 0o600); - } + Effect.gen(function* () { + const fs = yield* FileSystem.FileSystem; + const path = yield* Path.Path; + const baseDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-sqlite-state-exec-" }); + yield* createFixtureDatabase(baseDir); - const error = yield* runSqliteState( + const mutation = yield* runSqliteState({ - { operation: "exec", baseDir, + sql: "INSERT INTO fixtures (id, label) VALUES (2, 'seeded')", + }); + assert.equal(mutation.operation, "exec"); + if (mutation.operation === "exec") { + assert.equal((yield* fs.stat(mutation.backup)).mode & 0o777, 0o600); + } + + const error = yield* runSqliteState( + { + operation: "exec", + baseDir, + sql: "DELETE FROM fixtures", - sql: "DELETE FROM fixtures", - }, - { sharedHome: baseDir }, - ).pipe(Effect.flip); - assert.equal(error._tag, "SqliteStateSharedHomeMutationError"); + }, + { sharedHome: baseDir }, + ).pipe(Effect.flip); + assert.equal(error._tag, "SqliteStateSharedHomeMutationError"); + const aliasParent = yield* fs.makeTempDirectoryScoped({ + prefix: "t3-sqlite-state-alias-", + }); + const aliasBaseDir = path.join(aliasParent, "shared-home-alias"); + yield* fs.symlink(baseDir, aliasBaseDir); + const aliasError = yield* runSqliteState( + { + operation: "exec", + baseDir: aliasBaseDir, + sql: "DELETE FROM fixtures", + }, - const aliasParent = yield* fs.makeTempDirectoryScoped({ - prefix: "t3-sqlite-state-alias-", - }); - const aliasBaseDir = path.join(aliasParent, "shared-home-alias"); - yield* fs.symlink(baseDir, aliasBaseDir); + { sharedHome: baseDir }, + ).pipe(Effect.flip); + assert.equal(aliasError._tag, "SqliteStateSharedHomeMutationError"); - const aliasError = yield* runSqliteState( + }), - { - operation: "exec", - baseDir: aliasBaseDir, - sql: "DELETE FROM fixtures", - }, - { sharedHome: baseDir }, - ).pipe(Effect.flip); - assert.equal(aliasError._tag, "SqliteStateSharedHomeMutationError"); - }), ); }); ``` ## apps/server/src/assets/AssetAccess.test.ts Status: modified; +223; −197 ```diff @@ -24,6 +24,7 @@ import { ASSET_ROUTE_PREFIX, issueAssetUrl, resolveAsset } from "./AssetAccess.ts"; import * as NativeAppIconResolver from "./NativeAppIconResolver.ts"; import { openMediaFile } from "./MediaFile.ts"; +import { symlinksSupported } from "@t3tools/shared/testing/symlinks"; vi.mock("node:fs/promises", async (importOriginal) => { const actual = await importOriginal(); @@ -108,216 +109,241 @@ }).pipe(Effect.provide(testLayer)), ); + it.effect.skipIf(!symlinksSupported)( + "rejects non-previewable files, disguised targets, and directories", + () => + Effect.gen(function* () { + const fs = yield* FileSystem.FileSystem; + const path = yield* Path.Path; + const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-media-validation-" }); + for (const name of ["report.md", "secret.txt", "secret.%70ng", "secret.png#private.txt"]) { + const filePath = path.join(root, name); + yield* fs.writeFileString(filePath, "not media"); + const error = yield* issueAssetUrl({ + resource: { _tag: "media-file", threadId: ThreadId.make("thread-1"), path: filePath }, + }).pipe(Effect.flip); + expect(error).toBeInstanceOf(AssetPreviewTypeValidationError); + } + const disguisedPath = path.join(root, "disguised.png"); + yield* fs.symlink(path.join(root, "secret.txt"), disguisedPath); + const disguisedError = yield* issueAssetUrl({ + resource: { + _tag: "media-file", + threadId: ThreadId.make("thread-1"), + path: disguisedPath, + }, + }).pipe(Effect.flip); + expect(disguisedError).toBeInstanceOf(AssetPreviewTypeValidationError); + const directoryPath = path.join(root, "directory.png"); - it.effect("rejects non-previewable files, disguised targets, and directories", () => + yield* fs.makeDirectory(directoryPath); + const directoryError = yield* issueAssetUrl({ + resource: { - Effect.gen(function* () { - const fs = yield* FileSystem.FileSystem; - const path = yield* Path.Path; - const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-media-validation-" }); - for (const name of ["report.md", "secret.txt", "secret.%70ng", "secret.png#private.txt"]) { - const filePath = path.join(root, name); - yield* fs.writeFileString(filePath, "not media"); - const error = yield* issueAssetUrl({ - resource: { _tag: "media-file", threadId: ThreadId.make("thread-1"), path: filePath }, + _tag: "media-file", + threadId: ThreadId.make("thread-1"), + path: directoryPath, + }, }).pipe(Effect.flip); + expect(directoryError._tag).toBe("AssetWorkspaceAssetNotFoundError"); + }).pipe(Effect.provide(testLayer)), - expect(error).toBeInstanceOf(AssetPreviewTypeValidationError); - } - const disguisedPath = path.join(root, "disguised.png"); - yield* fs.symlink(path.join(root, "secret.txt"), disguisedPath); - const disguisedError = yield* issueAssetUrl({ - resource: { _tag: "media-file", threadId: ThreadId.make("thread-1"), path: disguisedPath }, - }).pipe(Effect.flip); - expect(disguisedError).toBeInstanceOf(AssetPreviewTypeValidationError); - const directoryPath = path.join(root, "directory.png"); - yield* fs.makeDirectory(directoryPath); - const directoryError = yield* issueAssetUrl({ - resource: { _tag: "media-file", threadId: ThreadId.make("thread-1"), path: directoryPath }, - }).pipe(Effect.flip); - expect(directoryError._tag).toBe("AssetWorkspaceAssetNotFoundError"); - }).pipe(Effect.provide(testLayer)), ); - it.effect("binds media URLs to the canonical target and rejects symlink substitution", () => - Effect.gen(function* () { - const fs = yield* FileSystem.FileSystem; - const path = yield* Path.Path; - const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-media-symlink-" }); - const filePath = path.join(root, "actual.svg"); - const aliasPath = path.join(root, "alias.png"); - const replacementPath = path.join(root, "other.svg"); - yield* fs.writeFileString(filePath, ""); - yield* fs.writeFileString(replacementPath, "private"); - yield* fs.symlink(filePath, aliasPath); - const canonicalFile = yield* fs.realPath(filePath); - const result = yield* issueAssetUrl({ - resource: { _tag: "media-file", threadId: ThreadId.make("thread-1"), path: aliasPath }, - }); - const suffix = result.relativeUrl.slice(`${ASSET_ROUTE_PREFIX}/`.length); - const separator = suffix.indexOf("/"); - const token = suffix.slice(0, separator); - const name = suffix.slice(separator + 1); + it.effect.skipIf(!symlinksSupported)( + "binds media URLs to the canonical target and rejects symlink substitution", + () => - const expected = { kind: "file", path: canonicalFile, mimeType: "image/svg+xml" }; - expect(yield* resolveAsset(token, name)).toMatchObject(expected); - yield* fs.remove(aliasPath); - yield* fs.symlink(replacementPath, aliasPath); - expect(yield* resolveAsset(token, name)).toMatchObject(expected); - yield* fs.remove(filePath); - yield* fs.symlink(replacementPath, filePath); - expect(yield* resolveAsset(token, name)).toBeNull(); - }).pipe(Effect.provide(testLayer)), + Effect.gen(function* () { + const fs = yield* FileSystem.FileSystem; + const path = yield* Path.Path; + const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-media-symlink-" }); + const filePath = path.join(root, "actual.svg"); + const aliasPath = path.join(root, "alias.png"); + const replacementPath = path.join(root, "other.svg"); + yield* fs.writeFileString(filePath, ""); + yield* fs.writeFileString(replacementPath, "private"); + yield* fs.symlink(filePath, aliasPath); + const canonicalFile = yield* fs.realPath(filePath); + const result = yield* issueAssetUrl({ + resource: { _tag: "media-file", threadId: ThreadId.make("thread-1"), path: aliasPath }, + }); + const suffix = result.relativeUrl.slice(`${ASSET_ROUTE_PREFIX}/`.length); + const separator = suffix.indexOf("/"); + const token = suffix.slice(0, separator); + const name = suffix.slice(separator + 1); + const expected = { kind: "file", path: canonicalFile, mimeType: "image/svg+xml" }; + expect(yield* resolveAsset(token, name)).toMatchObject(expected); + yield* fs.remove(aliasPath); + yield* fs.symlink(replacementPath, aliasPath); + expect(yield* resolveAsset(token, name)).toMatchObject(expected); + yield* fs.remove(filePath); + yield* fs.symlink(replacementPath, filePath); + expect(yield* resolveAsset(token, name)).toBeNull(); + }).pipe(Effect.provide(testLayer)), ); + it.effect.skipIf(!symlinksSupported)( + "keeps full and partial responses bound to the file opened during resolution", + () => + Effect.gen(function* () { + const fs = yield* FileSystem.FileSystem; + const path = yield* Path.Path; + const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-media-open-file-" }); + const filePath = path.join(root, "recording.mp4"); + const savedPath = path.join(root, "saved.mp4"); + const secretPath = path.join(root, "secret.txt"); + yield* fs.writeFileString(filePath, "0123456789"); + yield* fs.writeFileString(secretPath, "private information"); + const result = yield* issueAssetUrl({ - it.effect("keeps full and partial responses bound to the file opened during resolution", () => - Effect.gen(function* () { - const fs = yield* FileSystem.FileSystem; - const path = yield* Path.Path; - const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-media-open-file-" }); - const filePath = path.join(root, "recording.mp4"); - const savedPath = path.join(root, "saved.mp4"); - const secretPath = path.join(root, "secret.txt"); - yield* fs.writeFileString(filePath, "0123456789"); - yield* fs.writeFileString(secretPath, "private information"); - const result = yield* issueAssetUrl({ - resource: { _tag: "media-file", threadId: ThreadId.make("thread-1"), path: filePath }, - }); + resource: { _tag: "media-file", threadId: ThreadId.make("thread-1"), path: filePath }, + }); + const suffix = result.relativeUrl.slice(`${ASSET_ROUTE_PREFIX}/`.length); + const separator = suffix.indexOf("/"); + for (const [range, expected, status] of [ + [undefined, "0123456789", 200], + ["bytes=2-5", "2345", 206], + ] as const) { + const asset = yield* resolveAsset( + suffix.slice(0, separator), + suffix.slice(separator + 1), + ); + if (!asset) throw new Error("Expected a resolved media file"); - const suffix = result.relativeUrl.slice(`${ASSET_ROUTE_PREFIX}/`.length); - const separator = suffix.indexOf("/"); - for (const [range, expected, status] of [ - [undefined, "0123456789", 200], - ["bytes=2-5", "2345", 206], - ] as const) { - const asset = yield* resolveAsset(suffix.slice(0, separator), suffix.slice(separator + 1)); - if (!asset) throw new Error("Expected a resolved media file"); - yield* fs.rename(filePath, savedPath); - yield* fs.symlink(secretPath, filePath); - const response = HttpServerResponse.toWeb(yield* assetFileResponse(asset, range)); - expect(response.status).toBe(status); - expect(response.headers.get("content-length")).toBe(String(expected.length)); + yield* fs.rename(filePath, savedPath); + yield* fs.symlink(secretPath, filePath); + const response = HttpServerResponse.toWeb(yield* assetFileResponse(asset, range)); + expect(response.status).toBe(status); + expect(response.headers.get("content-length")).toBe(String(expected.length)); + expect(yield* Effect.promise(() => response.text())).toBe(expected); + yield* fs.remove(filePath); - expect(yield* Effect.promise(() => response.text())).toBe(expected); - yield* fs.remove(filePath); - yield* fs.rename(savedPath, filePath); - } + yield* fs.rename(savedPath, filePath); - }).pipe(Effect.provide(testLayer)), + } + }).pipe(Effect.provide(testLayer)), ); - it.effect("rejects a symlink swapped in after canonical validation but before open", () => - Effect.gen(function* () { - const fs = yield* FileSystem.FileSystem; - const path = yield* Path.Path; - const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-media-open-race-" }); - const filePath = path.join(root, "recording.mp4"); - const secretPath = path.join(root, "secret.txt"); - yield* fs.writeFileString(filePath, "video"); - yield* fs.writeFileString(secretPath, "secret"); - const canonicalPath = yield* fs.realPath(filePath); - const result = yield* issueAssetUrl({ - resource: { _tag: "media-file", threadId: ThreadId.make("thread-1"), path: filePath }, - }); - const suffix = result.relativeUrl.slice(`${ASSET_ROUTE_PREFIX}/`.length); - const separator = suffix.indexOf("/"); - const swappingFileSystem = FileSystem.FileSystem.of({ - ...fs, - stat: Effect.fn(function* (requestedPath) { - const info = yield* fs.stat(requestedPath); - if (requestedPath === canonicalPath) { - yield* fs.remove(filePath); - yield* fs.symlink(secretPath, filePath); - } - return info; + it.effect.skipIf(!symlinksSupported)( + "rejects a symlink swapped in after canonical validation but before open", + () => + Effect.gen(function* () { + const fs = yield* FileSystem.FileSystem; + const path = yield* Path.Path; + const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-media-open-race-" }); + const filePath = path.join(root, "recording.mp4"); + const secretPath = path.join(root, "secret.txt"); + yield* fs.writeFileString(filePath, "video"); + yield* fs.writeFileString(secretPath, "secret"); + const canonicalPath = yield* fs.realPath(filePath); + const result = yield* issueAssetUrl({ + resource: { _tag: "media-file", threadId: ThreadId.make("thread-1"), path: filePath }, + }); + const suffix = result.relativeUrl.slice(`${ASSET_ROUTE_PREFIX}/`.length); + const separator = suffix.indexOf("/"); + const swappingFileSystem = FileSystem.FileSystem.of({ + ...fs, + stat: Effect.fn(function* (requestedPath) { + const info = yield* fs.stat(requestedPath); + if (requestedPath === canonicalPath) { + yield* fs.remove(filePath); + yield* fs.symlink(secretPath, filePath); + } + return info; + }), + }); + expect( + yield* resolveAsset(suffix.slice(0, separator), suffix.slice(separator + 1)).pipe( + Effect.provideService(FileSystem.FileSystem, swappingFileSystem), - }), + ), - }); - expect( - yield* resolveAsset(suffix.slice(0, separator), suffix.slice(separator + 1)).pipe( - Effect.provideService(FileSystem.FileSystem, swappingFileSystem), - ), - ).toBeNull(); - }).pipe(Effect.provide(testLayer)), + ).toBeNull(); + }).pipe(Effect.provide(testLayer)), ); + it.effect.skipIf(!symlinksSupported)( + "closes a descriptor rejected when its path changes during open", + () => + Effect.gen(function* () { + const fs = yield* FileSystem.FileSystem; + const path = yield* Path.Path; + const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-media-open-rejected-" }); + const filePath = path.join(root, "recording.mp4"); + const secretPath = path.join(root, "secret.txt"); + yield* fs.writeFileString(filePath, "video"); + yield* fs.writeFileString(secretPath, "secret"); - it.effect("closes a descriptor rejected when its path changes during open", () => - Effect.gen(function* () { - const fs = yield* FileSystem.FileSystem; - const path = yield* Path.Path; - const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-media-open-rejected-" }); - const filePath = path.join(root, "recording.mp4"); - const secretPath = path.join(root, "secret.txt"); - yield* fs.writeFileString(filePath, "video"); - yield* fs.writeFileString(secretPath, "secret"); - const canonicalPath = yield* fs.realPath(filePath); - const originalOpen = (yield* Effect.promise(() => - vi.importActual("node:fs/promises"), - )).open; - let opened: NodeFSP.FileHandle | undefined; - const openSpy = vi.mocked(NodeFSP.open).mockImplementation(async (target, flags, mode) => { - const handle = await originalOpen(target, flags, mode); - if (target === canonicalPath) { - opened = handle; - await NodeFSP.unlink(filePath); - await NodeFSP.symlink(secretPath, filePath); - } - return handle; - }); - yield* Effect.addFinalizer(() => Effect.sync(() => openSpy.mockImplementation(originalOpen))); - expect(yield* openMediaFile(canonicalPath)).toBeNull(); - expect(opened).toBeDefined(); + const canonicalPath = yield* fs.realPath(filePath); + const originalOpen = (yield* Effect.promise(() => + vi.importActual("node:fs/promises"), + )).open; + let opened: NodeFSP.FileHandle | undefined; + const openSpy = vi.mocked(NodeFSP.open).mockImplementation(async (target, flags, mode) => { + const handle = await originalOpen(target, flags, mode); - expect(opened?.fd).toBe(-1); + if (target === canonicalPath) { - }).pipe(Effect.provide(testLayer)), + opened = handle; + await NodeFSP.unlink(filePath); + await NodeFSP.symlink(secretPath, filePath); + } + return handle; + }); + yield* Effect.addFinalizer(() => + Effect.sync(() => openSpy.mockImplementation(originalOpen)), + ); + expect(yield* openMediaFile(canonicalPath)).toBeNull(); + expect(opened).toBeDefined(); + expect(opened?.fd).toBe(-1); + }).pipe(Effect.provide(testLayer)), ); - it.effect("rejects an ancestor symlink race even when canonical path rechecks would pass", () => - Effect.gen(function* () { - const fs = yield* FileSystem.FileSystem; + it.effect.skipIf(!symlinksSupported)( + "rejects an ancestor symlink race even when canonical path rechecks would pass", + () => + Effect.gen(function* () { + const fs = yield* FileSystem.FileSystem; + const path = yield* Path.Path; + const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-media-parent-race-" }); + const publicDirectory = path.join(root, "public"); + const privateDirectory = path.join(root, "private"); + yield* fs.makeDirectory(publicDirectory); + yield* fs.makeDirectory(privateDirectory); + const filePath = path.join(publicDirectory, "recording.mp4"); + yield* fs.writeFileString(filePath, "public video"); + yield* fs.writeFileString(path.join(privateDirectory, "recording.mp4"), "private video"); + const canonicalPath = yield* fs.realPath(filePath); + const result = yield* issueAssetUrl({ + resource: { _tag: "media-file", threadId: ThreadId.make("thread-1"), path: filePath }, + }); + const suffix = result.relativeUrl.slice(`${ASSET_ROUTE_PREFIX}/`.length); + const separator = suffix.indexOf("/"); + const native = yield* Effect.promise(() => + vi.importActual("node:fs/promises"), + ); + const savedDirectory = path.join(root, "saved"); + const realpathSpy = vi.mocked(NodeFSP.realpath).mockImplementationOnce(async () => { + // A pathname-only guard can see the original parents during realpath, + // but the private file during both lstat calls and open. - const path = yield* Path.Path; - const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-media-parent-race-" }); - const publicDirectory = path.join(root, "public"); - const privateDirectory = path.join(root, "private"); - yield* fs.makeDirectory(publicDirectory); - yield* fs.makeDirectory(privateDirectory); - const filePath = path.join(publicDirectory, "recording.mp4"); - yield* fs.writeFileString(filePath, "public video"); - yield* fs.writeFileString(path.join(privateDirectory, "recording.mp4"), "private video"); - const canonicalPath = yield* fs.realPath(filePath); - const result = yield* issueAssetUrl({ - resource: { _tag: "media-file", threadId: ThreadId.make("thread-1"), path: filePath }, - }); + await native.unlink(publicDirectory); + await native.rename(savedDirectory, publicDirectory); + const canonical = await native.realpath(canonicalPath); + await native.rename(publicDirectory, savedDirectory); - const suffix = result.relativeUrl.slice(`${ASSET_ROUTE_PREFIX}/`.length); + await native.symlink(privateDirectory, publicDirectory, "junction"); - const separator = suffix.indexOf("/"); - const native = yield* Effect.promise(() => - vi.importActual("node:fs/promises"), - ); - const savedDirectory = path.join(root, "saved"); - const realpathSpy = vi.mocked(NodeFSP.realpath).mockImplementationOnce(async () => { - // A pathname-only guard can see the original parents during realpath, - // but the private file during both lstat calls and open. - await native.unlink(publicDirectory); - await native.rename(savedDirectory, publicDirectory); - const canonical = await native.realpath(canonicalPath); - await native.rename(publicDirectory, savedDirectory); - await native.symlink(privateDirectory, publicDirectory, "junction"); - return canonical; - }); - yield* Effect.addFinalizer(() => - Effect.sync(() => realpathSpy.mockReset().mockImplementation(native.realpath)), - ); - const swappingFileSystem = FileSystem.FileSystem.of({ - ...fs, - realPath: Effect.fn(function* (requestedPath) { - const canonical = yield* fs.realPath(requestedPath); - if (requestedPath === canonicalPath) { - yield* fs.rename(publicDirectory, savedDirectory); - yield* Effect.promise(() => - NodeFSP.symlink(privateDirectory, publicDirectory, "junction"), - ); - } return canonical; - }), - }); - expect( - yield* resolveAsset(suffix.slice(0, separator), suffix.slice(separator + 1)).pipe( - Effect.provideService(FileSystem.FileSystem, swappingFileSystem), + }); + yield* Effect.addFinalizer(() => + Effect.sync(() => realpathSpy.mockReset().mockImplementation(native.realpath)), + ); + const swappingFileSystem = FileSystem.FileSystem.of({ + ...fs, + realPath: Effect.fn(function* (requestedPath) { - ), - ).toBeNull(); - }).pipe(Effect.provide(testLayer)), + const canonical = yield* fs.realPath(requestedPath); + if (requestedPath === canonicalPath) { + yield* fs.rename(publicDirectory, savedDirectory); + yield* Effect.promise(() => + NodeFSP.symlink(privateDirectory, publicDirectory, "junction"), + ); + } + return canonical; + }), + }); + expect( + yield* resolveAsset(suffix.slice(0, separator), suffix.slice(separator + 1)).pipe( + Effect.provideService(FileSystem.FileSystem, swappingFileSystem), + ), + ).toBeNull(); + }).pipe(Effect.provide(testLayer)), ); it.effect("keeps in-place edits readable but requires a new URL after atomic replacement", () => ``` ## apps/server/src/cli/theme.test.ts Status: modified; +41; −36 ```diff @@ -13,6 +13,7 @@ import { Command } from "effect/unstable/cli"; import { cli } from "../bin.ts"; +import { symlinksSupported } from "@t3tools/shared/testing/symlinks"; const runCli = (args: ReadonlyArray) => Command.runWith(cli, { version: "0.0.0" })(args).pipe( @@ -185,27 +186,29 @@ // A symlink is a normal way to hand this command a theme -- desktop hooks // symlink the current palette -- so the source is resolved, not refused. - it.effect("publishes a theme file through a symlinked source path", () => - Effect.gen(function* () { - const baseDir = makeBaseDir(); - const realFile = NodePath.join(baseDir, "real-nightfall.json"); + it.effect.skipIf(!symlinksSupported)( + "publishes a theme file through a symlinked source path", - NodeFS.writeFileSync(realFile, NIGHTFALL_THEME_JSON); - const linkPath = NodePath.join(baseDir, "nightfall.json"); - NodeFS.symlinkSync(realFile, linkPath); + () => + Effect.gen(function* () { + const baseDir = makeBaseDir(); + const realFile = NodePath.join(baseDir, "real-nightfall.json"); + NodeFS.writeFileSync(realFile, NIGHTFALL_THEME_JSON); + const linkPath = NodePath.join(baseDir, "nightfall.json"); + NodeFS.symlinkSync(realFile, linkPath); + yield* runCli(["theme", "set", linkPath, "--base-dir", baseDir]); - yield* runCli(["theme", "set", linkPath, "--base-dir", baseDir]); + assert.equal( - assert.equal( - NodeFS.existsSync(NodePath.join(baseDir, "userdata", "themes", "nightfall.json")), - true, - ); - assert.equal(readSettings(baseDir).defaultTheme, "nightfall"); + NodeFS.existsSync(NodePath.join(baseDir, "userdata", "themes", "nightfall.json")), + true, + ); + assert.equal(readSettings(baseDir).defaultTheme, "nightfall"); + }), - }), ); // The staging entry is created fresh with O_EXCL, so a symlink planted at // its predictable name is cleared, never followed and written through. + it.effect.skipIf(!symlinksSupported)("never writes through a symlink at the staging path", () => - it.effect("never writes through a symlink at the staging path", () => Effect.gen(function* () { const baseDir = makeBaseDir(); const themesDir = NodePath.join(baseDir, "userdata", "themes"); @@ -226,28 +229,30 @@ // Rollback moves the previous directory entry aside and back, so even an // entry the watcher would never publish -- here a symlink -- comes back // exactly as it was when the set fails. + it.effect.skipIf(!symlinksSupported)( + "restores a non-theme destination entry when the set fails", + () => + Effect.gen(function* () { + const baseDir = makeBaseDir(); + writeSettings(baseDir, {}); - it.effect("restores a non-theme destination entry when the set fails", () => + const userdataDir = NodePath.dirname(settingsPathFor(baseDir)); - Effect.gen(function* () { - const baseDir = makeBaseDir(); - writeSettings(baseDir, {}); + const themesDir = NodePath.join(userdataDir, "themes"); + NodeFS.mkdirSync(themesDir, { recursive: true }); + const outside = NodePath.join(baseDir, "outside.json"); + NodeFS.writeFileSync(outside, NIGHTFALL_THEME_JSON); + const destination = NodePath.join(themesDir, "nightfall.json"); - const userdataDir = NodePath.dirname(settingsPathFor(baseDir)); - const themesDir = NodePath.join(userdataDir, "themes"); - NodeFS.mkdirSync(themesDir, { recursive: true }); - const outside = NodePath.join(baseDir, "outside.json"); - NodeFS.writeFileSync(outside, NIGHTFALL_THEME_JSON); - const destination = NodePath.join(themesDir, "nightfall.json"); - NodeFS.symlinkSync(outside, destination); - const themeFile = NodePath.join(baseDir, "nightfall.json"); - NodeFS.writeFileSync(themeFile, NIGHTFALL_THEME_JSON); + NodeFS.symlinkSync(outside, destination); + const themeFile = NodePath.join(baseDir, "nightfall.json"); + NodeFS.writeFileSync(themeFile, NIGHTFALL_THEME_JSON); + NodeFS.chmodSync(userdataDir, 0o555); + try { + yield* runCli(["theme", "set", themeFile, "--base-dir", baseDir]).pipe(Effect.flip); + assert.equal(NodeFS.lstatSync(destination).isSymbolicLink(), true); + } finally { + NodeFS.chmodSync(userdataDir, 0o755); + } - NodeFS.chmodSync(userdataDir, 0o555); + }), - try { - yield* runCli(["theme", "set", themeFile, "--base-dir", baseDir]).pipe(Effect.flip); - assert.equal(NodeFS.lstatSync(destination).isSymbolicLink(), true); - } finally { - NodeFS.chmodSync(userdataDir, 0o755); - } - }), ); it.effect("restores the previous theme when a re-publish fails to set", () => ``` ## apps/server/src/entrypoint.test.ts Status: modified; +18; −14 ```diff @@ -7,6 +7,7 @@ import { describe, expect, it } from "vite-plus/test"; import { isEntrypoint } from "./entrypoint.ts"; +import { symlinksSupported } from "@t3tools/shared/testing/symlinks"; const makeTempDir = () => NodeFS.mkdtempSync(NodePath.join(NodeOS.tmpdir(), "t3-entrypoint-test-")); @@ -44,21 +45,24 @@ ).toBe(true); }); - it("matches through a symlinked entrypoint, as npm and npx install it", () => { - const dir = makeTempDir(); - const real = NodePath.join(dir, "bin.mjs"); - const link = NodePath.join(dir, "t3"); - NodeFS.writeFileSync(real, ""); - NodeFS.symlinkSync(real, link); + it.skipIf(!symlinksSupported)( + "matches through a symlinked entrypoint, as npm and npx install it", + () => { + const dir = makeTempDir(); + const real = NodePath.join(dir, "bin.mjs"); + const link = NodePath.join(dir, "t3"); + NodeFS.writeFileSync(real, ""); + NodeFS.symlinkSync(real, link); - expect( - isEntrypoint({ - moduleUrl: NodeURL.pathToFileURL(real).href, - entryPath: link, - runtimeMain: undefined, - }), - ).toBe(true); - }); + expect( + isEntrypoint({ + moduleUrl: NodeURL.pathToFileURL(real).href, + entryPath: link, + runtimeMain: undefined, + }), + ).toBe(true); + }, + ); it("stays false for an imported module that is not the entrypoint", () => { // This is what keeps `bin.test.ts` from launching the CLI on import. ``` ## apps/server/src/environmentTheme.test.ts Status: modified; +2; −1 ```diff @@ -13,6 +13,7 @@ import * as ServerConfig from "./config.ts"; import * as EnvironmentTheme from "./environmentTheme.ts"; +import { symlinksSupported } from "@t3tools/shared/testing/symlinks"; const encodeThemeFile = Schema.encodeSync(Schema.fromJsonString(EnvironmentThemeFile)); @@ -188,7 +189,7 @@ // A symlinked themes directory stays usable, but a symlinked file inside it // must not publish whatever it points at. + it.effect.skipIf(!symlinksSupported)("ignores a symlinked theme file", () => - it.effect("ignores a symlinked theme file", () => withEnvironmentThemes( {}, Effect.gen(function* () { ``` ## apps/server/src/orchestration/workflowScriptQuery.test.ts Status: modified; +27; −28 ```diff @@ -5,6 +5,7 @@ import { it as effectIt } from "@effect/vitest"; import * as Effect from "effect/Effect"; import { afterAll, assert, describe } from "vite-plus/test"; +import { symlinksSupported } from "@t3tools/shared/testing/symlinks"; import { readWorkflowScript } from "./workflowScriptQuery.ts"; const root = NodePath.join(NodeOS.homedir(), ".claude", "projects", "__wf_script_test__"); @@ -14,19 +15,15 @@ const outside = NodePath.join(NodeOS.tmpdir(), "wf-outside.js"); NodeFS.writeFileSync(outside, "evil\n"); const link = NodePath.join(root, "sneaky.js"); +// Planted only where the host allows it; the escape test is skipped +// otherwise rather than passing vacuously on "not-found". +if (symlinksSupported) { -try { + NodeFS.rmSync(link, { force: true }); NodeFS.symlinkSync(outside, link); -} catch (error) { - // Tolerate only "already exists" from a prior run — any other failure - // (EPERM etc.) must fail setup, or the escape test below would pass + if (!NodeFS.lstatSync(link).isSymbolicLink()) { + throw new Error("test setup: sneaky.js must be a symlink"); - // vacuously on "not-found" without testing containment. - if ((error as NodeJS.ErrnoException).code !== "EEXIST") { - throw error; } } -if (!NodeFS.lstatSync(link).isSymbolicLink()) { - throw new Error("test setup: sneaky.js must be a symlink"); -} afterAll(() => { NodeFS.rmSync(root, { recursive: true, force: true }); @@ -53,23 +50,25 @@ }), ); + effectIt.effect.skipIf(!symlinksSupported)( + "rejects paths outside the root and symlink escapes", + () => + Effect.gen(function* () { + const escaped = yield* Effect.exit(readWorkflowScript({ scriptPath: outside })); + assert.equal(escaped._tag, "Failure"); + // A symlink INSIDE the root pointing outside must fail specifically on + // realpath re-containment — a "not-found" would mean the link was + // never exercised and the assertion proves nothing. + const sneaky = yield* Effect.exit( + readWorkflowScript({ scriptPath: link }).pipe( - effectIt.effect("rejects paths outside the root and symlink escapes", () => - Effect.gen(function* () { + Effect.flip, + Effect.map((error) => error.reason), - const escaped = yield* Effect.exit(readWorkflowScript({ scriptPath: outside })); - assert.equal(escaped._tag, "Failure"); - // A symlink INSIDE the root pointing outside must fail specifically on + ), + ); + assert.equal(sneaky._tag, "Success"); + if (sneaky._tag === "Success") { + assert.equal(sneaky.value, "outside-root"); + } + }), - // realpath re-containment — a "not-found" would mean the link was - // never exercised and the assertion proves nothing. - const sneaky = yield* Effect.exit( - readWorkflowScript({ scriptPath: link }).pipe( - Effect.flip, - Effect.map((error) => error.reason), - ), - ); - assert.equal(sneaky._tag, "Success"); - if (sneaky._tag === "Success") { - assert.equal(sneaky.value, "outside-root"); - } - }), ); }); ``` ## apps/server/src/provider/Drivers/AntigravitySkills.test.ts Status: modified; +23; −20 ```diff @@ -5,6 +5,7 @@ import * as Path from "effect/Path"; import { discoverAntigravitySkills } from "./AntigravitySkills.ts"; +import { symlinksSupported } from "@t3tools/shared/testing/symlinks"; const writeSkill = Effect.fn("writeSkill")(function* (directory: string, contents: string) { const fileSystem = yield* FileSystem.FileSystem; @@ -239,27 +240,29 @@ }), ); - it.effect("follows directory symlinks used to install shared skills", () => - Effect.gen(function* () { + it.effect.skipIf(!symlinksSupported)( + "follows directory symlinks used to install shared skills", - const fileSystem = yield* FileSystem.FileSystem; - const path = yield* Path.Path; - const input = yield* makeWorkspace(); - const sourceDirectory = path.join(input.profileDirectory, "shared-review"); - yield* writeSkill(sourceDirectory, "---\nname: review\n---\n"); - const root = path.join(input.cwd, ".agents", "skills"); + () => + Effect.gen(function* () { + const fileSystem = yield* FileSystem.FileSystem; + const path = yield* Path.Path; + const input = yield* makeWorkspace(); + const sourceDirectory = path.join(input.profileDirectory, "shared-review"); + yield* writeSkill(sourceDirectory, "---\nname: review\n---\n"); + const root = path.join(input.cwd, ".agents", "skills"); + const linkedDirectory = path.join(root, "review"); + yield* fileSystem.makeDirectory(root, { recursive: true }); + yield* fileSystem.symlink(sourceDirectory, linkedDirectory); - const linkedDirectory = path.join(root, "review"); - yield* fileSystem.makeDirectory(root, { recursive: true }); - yield* fileSystem.symlink(sourceDirectory, linkedDirectory); + assert.deepEqual(yield* discoverAntigravitySkills(input), [ + { + name: "review", + path: path.join(linkedDirectory, "SKILL.md"), + scope: "project", + enabled: true, + }, + ]); - assert.deepEqual(yield* discoverAntigravitySkills(input), [ - { - name: "review", - path: path.join(linkedDirectory, "SKILL.md"), - scope: "project", - enabled: true, + }), - }, - ]); - }), ); it.effect("rejects an oversized skill instead of returning an incomplete catalog", () => ``` ## apps/server/src/provider/Drivers/CodexHomeLayout.test.ts Status: modified; +144; −132 ```diff @@ -13,6 +13,7 @@ materializeCodexShadowHome, resolveCodexHomeLayout, } from "./CodexHomeLayout.ts"; +import { symlinksSupported } from "@t3tools/shared/testing/symlinks"; const decodeCodexSettingsValue = Schema.decodeSync(CodexSettings); const decodeCodexSettings = (input: { @@ -84,130 +85,139 @@ }); describe("materializeCodexShadowHome", () => { + it.effect.skipIf(!symlinksSupported)( - it.effect("materializes a shadow home with shared state links and private auth", () => - Effect.gen(function* () { - const fileSystem = yield* FileSystem.FileSystem; - const path = yield* Path.Path; - const sharedHome = yield* makeTempDir("t3code-codex-shared-"); - const shadowRoot = yield* makeTempDir("t3code-codex-shadow-root-"); - const shadowHome = path.join(shadowRoot, "shadow"); + "materializes a shadow home with shared state links and private auth", + () => + Effect.gen(function* () { + const fileSystem = yield* FileSystem.FileSystem; + const path = yield* Path.Path; + const sharedHome = yield* makeTempDir("t3code-codex-shared-"); + const shadowRoot = yield* makeTempDir("t3code-codex-shadow-root-"); + const shadowHome = path.join(shadowRoot, "shadow"); + yield* fileSystem.makeDirectory(path.join(sharedHome, "sessions")); + yield* writeTextFile(path.join(sharedHome, "config.toml"), 'model = "gpt-5-codex"\n'); + yield* writeTextFile( + path.join(sharedHome, "models_cache.json"), + '{"models":["shared"]}\n', + ); + yield* writeTextFile(path.join(sharedHome, "auth.json"), '{"shared":true}\n'); + yield* fileSystem.makeDirectory(shadowHome, { recursive: true }); + yield* writeTextFile(path.join(shadowHome, "auth.json"), '{"shadow":true}\n'); + yield* fileSystem.symlink( - yield* fileSystem.makeDirectory(path.join(sharedHome, "sessions")); - yield* writeTextFile(path.join(sharedHome, "config.toml"), 'model = "gpt-5-codex"\n'); - yield* writeTextFile(path.join(sharedHome, "models_cache.json"), '{"models":["shared"]}\n'); - yield* writeTextFile(path.join(sharedHome, "auth.json"), '{"shared":true}\n'); - yield* fileSystem.makeDirectory(shadowHome, { recursive: true }); + path.join(sharedHome, "models_cache.json"), + path.join(shadowHome, "models_cache.json"), + ); - yield* writeTextFile(path.join(shadowHome, "auth.json"), '{"shadow":true}\n'); - yield* fileSystem.symlink( - path.join(sharedHome, "models_cache.json"), - path.join(shadowHome, "models_cache.json"), - ); + const layout = yield* resolveCodexHomeLayout( + decodeCodexSettings({ + homePath: sharedHome, + shadowHomePath: shadowHome, - const layout = yield* resolveCodexHomeLayout( - decodeCodexSettings({ - homePath: sharedHome, - shadowHomePath: shadowHome, - }), - ); + }), + ); - yield* materializeCodexShadowHome(layout); + yield* materializeCodexShadowHome(layout); + const sessionsTarget = yield* fileSystem.readLink(path.join(shadowHome, "sessions")); + const configTarget = yield* fileSystem.readLink(path.join(shadowHome, "config.toml")); + const mcpOauthLocksTarget = yield* fileSystem.readLink( - const sessionsTarget = yield* fileSystem.readLink(path.join(shadowHome, "sessions")); - const configTarget = yield* fileSystem.readLink(path.join(shadowHome, "config.toml")); - const mcpOauthLocksTarget = yield* fileSystem.readLink( - path.join(shadowHome, "mcp-oauth-locks"), - ); - const modelsCacheExists = yield* fileSystem.exists( - path.join(shadowHome, "models_cache.json"), - ); - const authLinkResult = yield* fileSystem - .readLink(path.join(shadowHome, "auth.json")) - .pipe(Effect.result); - const authContents = yield* fileSystem.readFileString(path.join(shadowHome, "auth.json")); + path.join(shadowHome, "mcp-oauth-locks"), + ); + const modelsCacheExists = yield* fileSystem.exists( + path.join(shadowHome, "models_cache.json"), + ); + const authLinkResult = yield* fileSystem + .readLink(path.join(shadowHome, "auth.json")) + .pipe(Effect.result); + const authContents = yield* fileSystem.readFileString(path.join(shadowHome, "auth.json")); + expect(sessionsTarget).toBe(path.join(sharedHome, "sessions")); + expect(configTarget).toBe(path.join(sharedHome, "config.toml")); + expect(mcpOauthLocksTarget).toBe(path.join(sharedHome, "mcp-oauth-locks")); + expect(modelsCacheExists).toBe(false); + expect(authLinkResult._tag).toBe("Failure"); - expect(sessionsTarget).toBe(path.join(sharedHome, "sessions")); - expect(configTarget).toBe(path.join(sharedHome, "config.toml")); + expect(authContents).toContain("shadow"); + }), - expect(mcpOauthLocksTarget).toBe(path.join(sharedHome, "mcp-oauth-locks")); - expect(modelsCacheExists).toBe(false); - expect(authLinkResult._tag).toBe("Failure"); - expect(authContents).toContain("shadow"); - }), ); + it.effect.skipIf(!symlinksSupported)( + "replaces Codex-created local MCP OAuth locks with the shared lock directory", + () => + Effect.gen(function* () { - it.effect("replaces Codex-created local MCP OAuth locks with the shared lock directory", () => + const fileSystem = yield* FileSystem.FileSystem; + const path = yield* Path.Path; + const sharedHome = yield* makeTempDir("t3code-codex-shared-"); + const shadowRoot = yield* makeTempDir("t3code-codex-shadow-root-"); + const shadowHome = path.join(shadowRoot, "shadow"); + const sharedLocks = path.join(sharedHome, "mcp-oauth-locks"); + const shadowLocks = path.join(shadowHome, "mcp-oauth-locks"); - Effect.gen(function* () { - const fileSystem = yield* FileSystem.FileSystem; - const path = yield* Path.Path; - const sharedHome = yield* makeTempDir("t3code-codex-shared-"); - const shadowRoot = yield* makeTempDir("t3code-codex-shadow-root-"); - const shadowHome = path.join(shadowRoot, "shadow"); - const sharedLocks = path.join(sharedHome, "mcp-oauth-locks"); - const shadowLocks = path.join(shadowHome, "mcp-oauth-locks"); + yield* writeTextFile(path.join(sharedLocks, "file-store.lock"), ""); - yield* writeTextFile(path.join(sharedLocks, "file-store.lock"), ""); - yield* writeTextFile(path.join(shadowLocks, "file-store.lock"), ""); + yield* writeTextFile(path.join(shadowLocks, "file-store.lock"), ""); - const layout = yield* resolveCodexHomeLayout( - decodeCodexSettings({ - homePath: sharedHome, - shadowHomePath: shadowHome, - }), + const layout = yield* resolveCodexHomeLayout( + decodeCodexSettings({ + homePath: sharedHome, + shadowHomePath: shadowHome, + }), - ); + ); - yield* materializeCodexShadowHome(layout); + yield* materializeCodexShadowHome(layout); - const locksTarget = yield* fileSystem.readLink(shadowLocks); - const sharedLockExists = yield* fileSystem.exists( - path.join(sharedLocks, "file-store.lock"), - ); + const locksTarget = yield* fileSystem.readLink(shadowLocks); + const sharedLockExists = yield* fileSystem.exists( + path.join(sharedLocks, "file-store.lock"), + ); + expect(locksTarget).toBe(sharedLocks); + expect(sharedLockExists).toBe(true); + }), - expect(locksTarget).toBe(sharedLocks); - expect(sharedLockExists).toBe(true); - }), ); - it.effect("accepts Codex-created shadow-local runtime directories", () => - Effect.gen(function* () { - const fileSystem = yield* FileSystem.FileSystem; + it.effect.skipIf(!symlinksSupported)( + "accepts Codex-created shadow-local runtime directories", + () => + Effect.gen(function* () { + const fileSystem = yield* FileSystem.FileSystem; + const path = yield* Path.Path; + const sharedHome = yield* makeTempDir("t3code-codex-shared-"); + const shadowRoot = yield* makeTempDir("t3code-codex-shadow-root-"); + const shadowHome = path.join(shadowRoot, "shadow"); - const path = yield* Path.Path; - const sharedHome = yield* makeTempDir("t3code-codex-shared-"); - const shadowRoot = yield* makeTempDir("t3code-codex-shadow-root-"); - const shadowHome = path.join(shadowRoot, "shadow"); + yield* fileSystem.makeDirectory(path.join(sharedHome, "log")); + yield* fileSystem.makeDirectory(path.join(sharedHome, "memories")); + yield* fileSystem.makeDirectory(path.join(sharedHome, "tmp")); + yield* writeTextFile(path.join(sharedHome, "config.toml"), 'model = "gpt-5-codex"\n'); + yield* writeTextFile(path.join(shadowHome, "auth.json"), '{"shadow":true}\n'); - yield* fileSystem.makeDirectory(path.join(sharedHome, "log")); - yield* fileSystem.makeDirectory(path.join(sharedHome, "memories")); - yield* fileSystem.makeDirectory(path.join(sharedHome, "tmp")); - yield* writeTextFile(path.join(sharedHome, "config.toml"), 'model = "gpt-5-codex"\n'); - yield* writeTextFile(path.join(shadowHome, "auth.json"), '{"shadow":true}\n'); + yield* fileSystem.makeDirectory(path.join(shadowHome, "log"), { recursive: true }); + yield* fileSystem.makeDirectory(path.join(shadowHome, "memories"), { recursive: true }); + yield* fileSystem.makeDirectory(path.join(shadowHome, "tmp"), { recursive: true }); - yield* fileSystem.makeDirectory(path.join(shadowHome, "log"), { recursive: true }); - yield* fileSystem.makeDirectory(path.join(shadowHome, "memories"), { recursive: true }); - yield* fileSystem.makeDirectory(path.join(shadowHome, "tmp"), { recursive: true }); + const layout = yield* resolveCodexHomeLayout( + decodeCodexSettings({ + homePath: sharedHome, + shadowHomePath: shadowHome, + }), + ); - const layout = yield* resolveCodexHomeLayout( - decodeCodexSettings({ - homePath: sharedHome, - shadowHomePath: shadowHome, - }), - ); - yield* materializeCodexShadowHome(layout); + yield* materializeCodexShadowHome(layout); + const configTarget = yield* fileSystem.readLink(path.join(shadowHome, "config.toml")); + const logLinkResult = yield* fileSystem + .readLink(path.join(shadowHome, "log")) + .pipe(Effect.result); + const memoriesLinkResult = yield* fileSystem - const configTarget = yield* fileSystem.readLink(path.join(shadowHome, "config.toml")); - const logLinkResult = yield* fileSystem + .readLink(path.join(shadowHome, "memories")) + .pipe(Effect.result); - .readLink(path.join(shadowHome, "log")) - .pipe(Effect.result); - const memoriesLinkResult = yield* fileSystem - .readLink(path.join(shadowHome, "memories")) - .pipe(Effect.result); - const tmpLinkResult = yield* fileSystem - .readLink(path.join(shadowHome, "tmp")) - .pipe(Effect.result); + const tmpLinkResult = yield* fileSystem + .readLink(path.join(shadowHome, "tmp")) + .pipe(Effect.result); - expect(configTarget).toBe(path.join(sharedHome, "config.toml")); + expect(configTarget).toBe(path.join(sharedHome, "config.toml")); - expect(logLinkResult._tag).toBe("Failure"); - expect(memoriesLinkResult._tag).toBe("Failure"); - expect(tmpLinkResult._tag).toBe("Failure"); - }), + expect(logLinkResult._tag).toBe("Failure"); + expect(memoriesLinkResult._tag).toBe("Failure"); + expect(tmpLinkResult._tag).toBe("Failure"); + }), ); it.effect("rejects shadow homes that point at the shared home", () => @@ -233,36 +243,38 @@ }), ); + it.effect.skipIf(!symlinksSupported)( + "rejects shared entries that already exist in the shadow home as real files", + () => + Effect.gen(function* () { + const path = yield* Path.Path; + const sharedHome = yield* makeTempDir("t3code-codex-shared-"); + const shadowRoot = yield* makeTempDir("t3code-codex-shadow-root-"); + const shadowHome = path.join(shadowRoot, "shadow"); + yield* writeTextFile(path.join(sharedHome, "config.toml"), 'model = "gpt-5-codex"\n'); + yield* writeTextFile(path.join(shadowHome, "config.toml"), 'model = "local"\n'); - it.effect("rejects shared entries that already exist in the shadow home as real files", () => - Effect.gen(function* () { - const path = yield* Path.Path; - const sharedHome = yield* makeTempDir("t3code-codex-shared-"); - const shadowRoot = yield* makeTempDir("t3code-codex-shadow-root-"); - const shadowHome = path.join(shadowRoot, "shadow"); - yield* writeTextFile(path.join(sharedHome, "config.toml"), 'model = "gpt-5-codex"\n'); - yield* writeTextFile(path.join(shadowHome, "config.toml"), 'model = "local"\n'); + const layout = yield* resolveCodexHomeLayout( + decodeCodexSettings({ + homePath: sharedHome, + shadowHomePath: shadowHome, + }), + ); - const layout = yield* resolveCodexHomeLayout( - decodeCodexSettings({ - homePath: sharedHome, - shadowHomePath: shadowHome, - }), - ); + const error = yield* materializeCodexShadowHome(layout).pipe(Effect.flip); - const error = yield* materializeCodexShadowHome(layout).pipe(Effect.flip); - expect(error).toBeInstanceOf(CodexShadowHomeEntryConflictError); - expect(error).toMatchObject({ - sharedHomePath: sharedHome, - effectiveHomePath: shadowHome, - entryName: "config.toml", - linkPath: path.join(shadowHome, "config.toml"), - targetPath: path.join(sharedHome, "config.toml"), + expect(error).toBeInstanceOf(CodexShadowHomeEntryConflictError); + expect(error).toMatchObject({ + sharedHomePath: sharedHome, + effectiveHomePath: shadowHome, + entryName: "config.toml", + linkPath: path.join(shadowHome, "config.toml"), + targetPath: path.join(sharedHome, "config.toml"), + }); + expect(error.message).toBe( - }); - expect(error.message).toBe( - `Cannot create Codex shadow home entry 'config.toml' because '${path.join(shadowHome, "config.toml")}' already exists and is not a symlink.`, - ); - }), + `Cannot create Codex shadow home entry 'config.toml' because '${path.join(shadowHome, "config.toml")}' already exists and is not a symlink.`, + ); + }), ); it.effect("preserves filesystem operation, paths, and cause", () => ``` ## apps/server/src/provider/Layers/OpenCodeAdapter.test.ts Status: modified; +25; −22 ```diff @@ -49,6 +49,7 @@ makeOpenCodeAdapter, mergeOpenCodeAssistantText, } from "./OpenCodeAdapter.ts"; +import { symlinksSupported } from "@t3tools/shared/testing/symlinks"; // Test-local service tag so the rest of the file can keep using `yield* OpenCodeAdapter`. class OpenCodeAdapter extends Context.Service()( @@ -6401,30 +6402,32 @@ }), ); - it.effect("treats lexically or physically identical directories as the same", () => - Effect.gen(function* () { - const fileSystem = yield* FileSystem.FileSystem; - const path = yield* Path.Path; - const sameDirectory = (left: string, right: string) => + it.effect.skipIf(!symlinksSupported)( + "treats lexically or physically identical directories as the same", - isSameOpenCodeDirectory(fileSystem, path, left, right); + () => + Effect.gen(function* () { + const fileSystem = yield* FileSystem.FileSystem; + const path = yield* Path.Path; + const sameDirectory = (left: string, right: string) => + isSameOpenCodeDirectory(fileSystem, path, left, right); - // Lexical-only differences (trailing slash, dot segments) short-circuit - // without touching the filesystem — the paths need not exist. - NodeAssert.equal(yield* sameDirectory("/repo/project/", "/repo/project"), true); + // Lexical-only differences (trailing slash, dot segments) short-circuit + // without touching the filesystem — the paths need not exist. + NodeAssert.equal(yield* sameDirectory("/repo/project/", "/repo/project"), true); + NodeAssert.equal(yield* sameDirectory("/repo/nested/../project", "/repo/project"), true); + // Nonexistent paths degrade to the lexical comparison instead of failing. + NodeAssert.equal(yield* sameDirectory("/repo/project", "/repo/other"), false); - NodeAssert.equal(yield* sameDirectory("/repo/nested/../project", "/repo/project"), true); - // Nonexistent paths degrade to the lexical comparison instead of failing. - NodeAssert.equal(yield* sameDirectory("/repo/project", "/repo/other"), false); + // A symlinked cwd (the macOS `/tmp` → `/private/tmp` shape) resolves to + // the directory it points at, so the two spellings compare equal. + const base = yield* fileSystem.makeTempDirectoryScoped({ prefix: "t3-opencode-dir-" }); + const real = path.join(base, "real"); + const link = path.join(base, "link"); + yield* fileSystem.makeDirectory(real); + yield* fileSystem.symlink(real, link); + NodeAssert.equal(yield* sameDirectory(link, real), true); + NodeAssert.equal(yield* sameDirectory(link, path.join(base, "other")), false); - // A symlinked cwd (the macOS `/tmp` → `/private/tmp` shape) resolves to - // the directory it points at, so the two spellings compare equal. - const base = yield* fileSystem.makeTempDirectoryScoped({ prefix: "t3-opencode-dir-" }); - const real = path.join(base, "real"); + }).pipe(Effect.scoped), - const link = path.join(base, "link"); - yield* fileSystem.makeDirectory(real); - yield* fileSystem.symlink(real, link); - NodeAssert.equal(yield* sameDirectory(link, real), true); - NodeAssert.equal(yield* sameDirectory(link, path.join(base, "other")), false); - }).pipe(Effect.scoped), ); it.effect("appends raw assistant text deltas and reconciles part update snapshots", () => ``` ## apps/server/src/provider/providerMaintenance.test.ts Status: modified; +93; −82 ```diff @@ -20,6 +20,7 @@ resolveLatestProviderVersion, resolveProviderMaintenanceCapabilitiesEffect, } from "./providerMaintenance.ts"; +import { symlinksSupported } from "@t3tools/shared/testing/symlinks"; const driver = (value: string) => ProviderDriverKind.make(value); // These write `#!/bin/sh` stubs and resolve them through a darwin-mocked @@ -456,100 +457,110 @@ }); }); - it.effect("keeps npm updates for binaries symlinked into npm's global node_modules tree", () => - Effect.gen(function* () { - const tempDir = yield* makeTempDir("t3-npm-capabilities"); - const binDir = NodePath.join(tempDir, "bin"); - const packageBinDir = NodePath.join( - tempDir, - "lib", - "node_modules", - "@example", - "package-tool", - "bin", - ); - NodeFS.mkdirSync(binDir, { recursive: true }); + it.effect.skipIf(!symlinksSupported)( + "keeps npm updates for binaries symlinked into npm's global node_modules tree", - NodeFS.mkdirSync(packageBinDir, { recursive: true }); - const packageBinPath = NodePath.join(packageBinDir, "package-tool.js"); - const symlinkPath = NodePath.join(binDir, "package-tool"); - NodeFS.writeFileSync(packageBinPath, "#!/usr/bin/env node\n"); - NodeFS.chmodSync(packageBinPath, 0o755); - NodeFS.symlinkSync(packageBinPath, symlinkPath); + () => + Effect.gen(function* () { + const tempDir = yield* makeTempDir("t3-npm-capabilities"); + const binDir = NodePath.join(tempDir, "bin"); + const packageBinDir = NodePath.join( + tempDir, + "lib", + "node_modules", + "@example", + "package-tool", + "bin", + ); + NodeFS.mkdirSync(binDir, { recursive: true }); + NodeFS.mkdirSync(packageBinDir, { recursive: true }); + const packageBinPath = NodePath.join(packageBinDir, "package-tool.js"); + const symlinkPath = NodePath.join(binDir, "package-tool"); + NodeFS.writeFileSync(packageBinPath, "#!/usr/bin/env node\n"); + NodeFS.chmodSync(packageBinPath, 0o755); + NodeFS.symlinkSync(packageBinPath, symlinkPath); - const capabilities = yield* resolveProviderMaintenanceCapabilitiesEffect(packageToolUpdate, { - binaryPath: symlinkPath, - env: { + const capabilities = yield* resolveProviderMaintenanceCapabilitiesEffect( + packageToolUpdate, + { + binaryPath: symlinkPath, + env: { + PATH: "", + }, + }, - PATH: "", - }, - }); + ); + expect(capabilities).toEqual({ - expect(capabilities).toEqual({ + provider: driver("packageTool"), + packageName: "@example/package-tool", + update: { - provider: driver("packageTool"), - packageName: "@example/package-tool", - update: { - command: - "npm install -g --allow-scripts=@example/package-tool @example/package-tool@latest", + command: + "npm install -g --allow-scripts=@example/package-tool @example/package-tool@latest", - executable: "npm", + executable: "npm", + args: [ - args: [ - "install", - "-g", - "--allow-scripts=@example/package-tool", - "@example/package-tool@latest", - ], + "install", + "-g", + "--allow-scripts=@example/package-tool", + "@example/package-tool@latest", + ], + lockKey: "npm-global", + }, + }); + }), - lockKey: "npm-global", - }, - }); - }), ); - it.effect("uses Effect FileSystem realPath when detecting pnpm global symlinks", () => - Effect.gen(function* () { - const tempDir = yield* makeTempDir("t3-pnpm-realpath-capabilities"); - const binDir = NodePath.join(tempDir, "bin"); - const packageBinDir = NodePath.join( - tempDir, - ".local", - "share", - "pnpm", - "global", - "5", - "node_modules", + it.effect.skipIf(!symlinksSupported)( + "uses Effect FileSystem realPath when detecting pnpm global symlinks", + () => - "@example", - "package-tool", - "bin", - ); - NodeFS.mkdirSync(binDir, { recursive: true }); + Effect.gen(function* () { + const tempDir = yield* makeTempDir("t3-pnpm-realpath-capabilities"); + const binDir = NodePath.join(tempDir, "bin"); + const packageBinDir = NodePath.join( + tempDir, + ".local", + "share", + "pnpm", + "global", + "5", + "node_modules", + "@example", + "package-tool", + "bin", + ); + NodeFS.mkdirSync(binDir, { recursive: true }); + NodeFS.mkdirSync(packageBinDir, { recursive: true }); + const packageBinPath = NodePath.join(packageBinDir, "package-tool.js"); + const symlinkPath = NodePath.join(binDir, "package-tool"); + NodeFS.writeFileSync(packageBinPath, "#!/usr/bin/env node\n"); + NodeFS.chmodSync(packageBinPath, 0o755); + NodeFS.symlinkSync(packageBinPath, symlinkPath); - NodeFS.mkdirSync(packageBinDir, { recursive: true }); - const packageBinPath = NodePath.join(packageBinDir, "package-tool.js"); - const symlinkPath = NodePath.join(binDir, "package-tool"); - NodeFS.writeFileSync(packageBinPath, "#!/usr/bin/env node\n"); - NodeFS.chmodSync(packageBinPath, 0o755); - NodeFS.symlinkSync(packageBinPath, symlinkPath); - const capabilities = yield* resolveProviderMaintenanceCapabilitiesEffect(packageToolUpdate, { - binaryPath: symlinkPath, - env: { - PATH: "", - }, + const capabilities = yield* resolveProviderMaintenanceCapabilitiesEffect( + packageToolUpdate, + { + binaryPath: symlinkPath, + env: { + PATH: "", + }, + }, + ); - }); + expect(capabilities).toEqual({ - expect(capabilities).toEqual({ + provider: driver("packageTool"), - provider: driver("packageTool"), + packageName: "@example/package-tool", + update: { + command: "pnpm add -g @example/package-tool@latest", - packageName: "@example/package-tool", - update: { - command: "pnpm add -g @example/package-tool@latest", - executable: "pnpm", + executable: "pnpm", - args: ["add", "-g", "@example/package-tool@latest"], + args: ["add", "-g", "@example/package-tool@latest"], - lockKey: "pnpm-global", - }, - }); + lockKey: "pnpm-global", + }, + }); - }), + }), ); it("allows the package's own install scripts in npm global updates", () => { ``` ## apps/server/src/server.test.ts Status: modified; +2; −1 ```diff @@ -199,6 +199,7 @@ type TransferBudgetRun, transferBudgetViolations, } from "../integration/TransferBudgetReport.integration.ts"; +import { symlinksSupported } from "@t3tools/shared/testing/symlinks"; const defaultProjectId = ProjectId.make("project-default"); const defaultThreadId = ThreadId.make("thread-default"); @@ -6311,7 +6312,7 @@ }).pipe(Effect.provide(NodeHttpServer.layerTest), TestClock.withLive), ); + it.effect.skipIf(!symlinksSupported)("preserves structured workspace rpc failures", () => - it.effect("preserves structured workspace rpc failures", () => Effect.gen(function* () { const fs = yield* FileSystem.FileSystem; const path = yield* Path.Path; ``` ## apps/server/src/sourceControl/PrTemplateDetection.test.ts Status: modified; +76; −69 ```diff @@ -10,6 +10,7 @@ import * as GitVcsDriver from "../vcs/GitVcsDriver.ts"; import * as VcsProcess from "../vcs/VcsProcess.ts"; import { detectPrTemplate } from "./PrTemplateDetection.ts"; +import { symlinksSupported } from "@t3tools/shared/testing/symlinks"; const SINGLE_TEMPLATE_PATHS = [ ".github/pull_request_template.md", @@ -139,27 +140,29 @@ ), ); +it.effect.skipIf(!symlinksSupported)( + "skips unusable directory entries and uses the one valid template", + () => + runWithTempDirectory((cwd) => + Effect.gen(function* () { + const fileSystem = yield* FileSystem.FileSystem; + const path = yield* Path.Path; + const templateDirectory = path.join(cwd, ".github", "PULL_REQUEST_TEMPLATE"); + yield* fileSystem.makeDirectory(path.join(templateDirectory, "b-directory.md"), { + recursive: true, + }); + yield* fileSystem.writeFileString(path.join(templateDirectory, "a-empty.md"), " \n"); + yield* fileSystem.symlink( + path.join(templateDirectory, "missing.md"), + path.join(templateDirectory, "c-broken.md"), + ); + yield* fileSystem.writeFileString(path.join(templateDirectory, "z-valid.md"), "valid"); + yield* commitTemplates(cwd); -it.effect("skips unusable directory entries and uses the one valid template", () => - runWithTempDirectory((cwd) => - Effect.gen(function* () { - const fileSystem = yield* FileSystem.FileSystem; - const path = yield* Path.Path; - const templateDirectory = path.join(cwd, ".github", "PULL_REQUEST_TEMPLATE"); - yield* fileSystem.makeDirectory(path.join(templateDirectory, "b-directory.md"), { - recursive: true, - }); - yield* fileSystem.writeFileString(path.join(templateDirectory, "a-empty.md"), " \n"); - yield* fileSystem.symlink( - path.join(templateDirectory, "missing.md"), - path.join(templateDirectory, "c-broken.md"), - ); - yield* fileSystem.writeFileString(path.join(templateDirectory, "z-valid.md"), "valid"); - yield* commitTemplates(cwd); + const template = yield* detectTemplate(cwd); + assert.strictEqual(Option.getOrUndefined(template), "valid"); + }), + ), - const template = yield* detectTemplate(cwd); - assert.strictEqual(Option.getOrUndefined(template), "valid"); - }), - ), ); it.effect("does not guess between multiple directory templates", () => @@ -176,60 +179,64 @@ ), ); -it.effect("rejects a committed template symlink escaping the repository", () => - runWithTempDirectory((cwd) => - Effect.gen(function* () { - const fileSystem = yield* FileSystem.FileSystem; - const path = yield* Path.Path; - const outsideDirectory = yield* fileSystem.makeTempDirectoryScoped({ - prefix: "t3-pr-template-outside-", - }); - const outsideTemplate = path.join(outsideDirectory, "secret.md"); - yield* fileSystem.writeFileString(outsideTemplate, "LOCAL_SECRET_SENTINEL"); - const escapedTemplatePath = path.join(cwd, ".github", "pull_request_template.md"); - yield* fileSystem.makeDirectory(path.dirname(escapedTemplatePath), { recursive: true }); +it.effect.skipIf(!symlinksSupported)( + "rejects a committed template symlink escaping the repository", + () => + runWithTempDirectory((cwd) => + Effect.gen(function* () { - yield* fileSystem.symlink(outsideTemplate, escapedTemplatePath); + const fileSystem = yield* FileSystem.FileSystem; + const path = yield* Path.Path; + const outsideDirectory = yield* fileSystem.makeTempDirectoryScoped({ + prefix: "t3-pr-template-outside-", + }); + const outsideTemplate = path.join(outsideDirectory, "secret.md"); + yield* fileSystem.writeFileString(outsideTemplate, "LOCAL_SECRET_SENTINEL"); + const escapedTemplatePath = path.join(cwd, ".github", "pull_request_template.md"); + yield* fileSystem.makeDirectory(path.dirname(escapedTemplatePath), { recursive: true }); + yield* fileSystem.symlink(outsideTemplate, escapedTemplatePath); + yield* writeTemplate(cwd, "pull_request_template.md", "safe template"); + yield* commitTemplates(cwd); - yield* writeTemplate(cwd, "pull_request_template.md", "safe template"); - yield* commitTemplates(cwd); - const template = yield* detectTemplate(cwd); - assert.strictEqual(Option.getOrUndefined(template), "safe template"); - assert.notInclude( - Option.getOrElse(template, () => ""), - "LOCAL_SECRET_SENTINEL", - ); - }), + const template = yield* detectTemplate(cwd); + assert.strictEqual(Option.getOrUndefined(template), "safe template"); + assert.notInclude( + Option.getOrElse(template, () => ""), + "LOCAL_SECRET_SENTINEL", - ), + ); + }), + ), ); -it.effect("reads the committed template when a worktree parent is replaced", () => - runWithTempDirectory((cwd) => - Effect.gen(function* () { - const fileSystem = yield* FileSystem.FileSystem; - const path = yield* Path.Path; - const outsideDirectory = yield* fileSystem.makeTempDirectoryScoped({ - prefix: "t3-pr-template-outside-", - }); - const templatePath = yield* writeTemplate( +it.effect.skipIf(!symlinksSupported)( + "reads the committed template when a worktree parent is replaced", + () => - cwd, - ".github/pull_request_template.md", - "committed template", - ); - yield* commitTemplates(cwd); - yield* writeTemplate(outsideDirectory, "pull_request_template.md", "LOCAL_SECRET_SENTINEL"); + runWithTempDirectory((cwd) => + Effect.gen(function* () { + const fileSystem = yield* FileSystem.FileSystem; + const path = yield* Path.Path; + const outsideDirectory = yield* fileSystem.makeTempDirectoryScoped({ + prefix: "t3-pr-template-outside-", + }); + const templatePath = yield* writeTemplate( + cwd, + ".github/pull_request_template.md", + "committed template", + ); + yield* commitTemplates(cwd); + yield* writeTemplate(outsideDirectory, "pull_request_template.md", "LOCAL_SECRET_SENTINEL"); - const templateDirectory = path.dirname(templatePath); - yield* fileSystem.rename(templateDirectory, path.join(cwd, ".github-original")); - yield* fileSystem.symlink(outsideDirectory, templateDirectory); + const templateDirectory = path.dirname(templatePath); + yield* fileSystem.rename(templateDirectory, path.join(cwd, ".github-original")); + yield* fileSystem.symlink(outsideDirectory, templateDirectory); - const template = yield* detectTemplate(cwd); - assert.strictEqual(Option.getOrUndefined(template), "committed template"); - assert.notInclude( - Option.getOrElse(template, () => ""), - "LOCAL_SECRET_SENTINEL", - ); - }), + const template = yield* detectTemplate(cwd); + assert.strictEqual(Option.getOrUndefined(template), "committed template"); + assert.notInclude( + Option.getOrElse(template, () => ""), + "LOCAL_SECRET_SENTINEL", - ), + ); + }), + ), ); it.effect("bounds template reads and marks truncated content", () => ``` ## apps/server/src/vcs/VcsStatusBroadcaster.test.ts Status: modified; +63; −59 ```diff @@ -27,6 +27,7 @@ import * as VcsStatusBroadcaster from "./VcsStatusBroadcaster.ts"; import * as BackgroundPolicy from "../background/BackgroundPolicy.ts"; import * as GitWorkflowService from "../git/GitWorkflowService.ts"; +import { symlinksSupported } from "@t3tools/shared/testing/symlinks"; const TEST_EPOCH = DateTime.makeUnsafe("1970-01-01T00:00:00.000Z"); @@ -144,7 +145,7 @@ } describe("VcsStatusBroadcaster", () => { - it.effect( + it.effect.skipIf(!symlinksSupported)( "automatically pulls an enabled clean default branch when status detects it is behind", () => { let remoteStatus: VcsStatusRemoteResult = { ...baseRemoteStatus, behindCount: 2 }; @@ -522,67 +523,70 @@ }).pipe(Effect.provide(makeTestLayer(state))); }); + it.effect.skipIf(!symlinksSupported)( + "normalizes symlinked CWDs before cache lookup and workflow calls", + () => { + const seenCwds: string[] = []; + const state = { + currentLocalStatus: baseLocalStatus, + currentRemoteStatus: baseRemoteStatus, + localStatusCalls: 0, + remoteStatusCalls: 0, + localInvalidationCalls: 0, + remoteInvalidationCalls: 0, + }; + const testLayer = VcsStatusBroadcaster.layer.pipe( - it.effect("normalizes symlinked CWDs before cache lookup and workflow calls", () => { + Layer.provideMerge(NodeServices.layer), + Layer.provide(makeBackgroundPolicyLayer(() => true)), + Layer.provide( + Layer.mock(GitWorkflowService.GitWorkflowService)({ + localStatus: (input) => + Effect.sync(() => { + seenCwds.push(input.cwd); - const seenCwds: string[] = []; - const state = { - currentLocalStatus: baseLocalStatus, - currentRemoteStatus: baseRemoteStatus, - localStatusCalls: 0, - remoteStatusCalls: 0, - localInvalidationCalls: 0, - remoteInvalidationCalls: 0, - }; - const testLayer = VcsStatusBroadcaster.layer.pipe( - Layer.provideMerge(NodeServices.layer), - Layer.provide(makeBackgroundPolicyLayer(() => true)), - Layer.provide( - Layer.mock(GitWorkflowService.GitWorkflowService)({ - localStatus: (input) => - Effect.sync(() => { - seenCwds.push(input.cwd); - state.localStatusCalls += 1; - return state.currentLocalStatus; - }), - remoteStatus: (input) => - Effect.sync(() => { - seenCwds.push(input.cwd); - state.remoteStatusCalls += 1; - return state.currentRemoteStatus; - }), - invalidateLocalStatus: () => - Effect.sync(() => { - state.localInvalidationCalls += 1; - }), - invalidateRemoteStatus: () => - Effect.sync(() => { - state.remoteInvalidationCalls += 1; - }), - } satisfies Partial), - ), - ); + state.localStatusCalls += 1; + return state.currentLocalStatus; + }), + remoteStatus: (input) => + Effect.sync(() => { + seenCwds.push(input.cwd); + state.remoteStatusCalls += 1; + return state.currentRemoteStatus; + }), + invalidateLocalStatus: () => + Effect.sync(() => { + state.localInvalidationCalls += 1; + }), + invalidateRemoteStatus: () => + Effect.sync(() => { + state.remoteInvalidationCalls += 1; + }), + } satisfies Partial), + ), + ); + return Effect.gen(function* () { + const fileSystem = yield* FileSystem.FileSystem; + const path = yield* Path.Path; + const realDir = yield* fileSystem.makeTempDirectoryScoped({ + prefix: "t3-vcs-status-real-", + }); + const linkParent = yield* fileSystem.makeTempDirectoryScoped({ + prefix: "t3-vcs-status-link-", + }); + const linkDir = path.join(linkParent, "repo-link"); + yield* fileSystem.symlink(realDir, linkDir); - return Effect.gen(function* () { - const fileSystem = yield* FileSystem.FileSystem; - const path = yield* Path.Path; - const realDir = yield* fileSystem.makeTempDirectoryScoped({ - prefix: "t3-vcs-status-real-", - }); - const linkParent = yield* fileSystem.makeTempDirectoryScoped({ + const realPath = yield* fileSystem.realPath(realDir); - prefix: "t3-vcs-status-link-", - }); - const linkDir = path.join(linkParent, "repo-link"); - yield* fileSystem.symlink(realDir, linkDir); - const realPath = yield* fileSystem.realPath(realDir); - const broadcaster = yield* VcsStatusBroadcaster.VcsStatusBroadcaster; - yield* broadcaster.getStatus({ cwd: linkDir }); - yield* broadcaster.getStatus({ cwd: realDir }); + const broadcaster = yield* VcsStatusBroadcaster.VcsStatusBroadcaster; + yield* broadcaster.getStatus({ cwd: linkDir }); + yield* broadcaster.getStatus({ cwd: realDir }); + assert.deepStrictEqual(seenCwds, [realPath, realPath]); + assert.equal(state.localStatusCalls, 1); + assert.equal(state.remoteStatusCalls, 1); + }).pipe(Effect.provide(testLayer)); - assert.deepStrictEqual(seenCwds, [realPath, realPath]); - assert.equal(state.localStatusCalls, 1); + }, + ); - assert.equal(state.remoteStatusCalls, 1); - }).pipe(Effect.provide(testLayer)); - }); it.effect("streams a local snapshot first and remote updates later", () => { const state = { ``` ## apps/server/src/workspace/WorkspaceFileSystem.test.ts Status: modified; +29; −26 ```diff @@ -14,6 +14,7 @@ import * as WorkspaceEntries from "./WorkspaceEntries.ts"; import * as WorkspaceFileSystem from "./WorkspaceFileSystem.ts"; import * as WorkspacePaths from "./WorkspacePaths.ts"; +import { symlinksSupported } from "@t3tools/shared/testing/symlinks"; const ProjectLayer = WorkspaceFileSystem.layer.pipe( Layer.provide(WorkspacePaths.layer), @@ -138,34 +139,36 @@ }), ); - it.effect("rejects symlinks that resolve outside the workspace root", () => - Effect.gen(function* () { - const workspaceFileSystem = yield* WorkspaceFileSystem.WorkspaceFileSystem; - const fileSystem = yield* FileSystem.FileSystem; - const path = yield* Path.Path; - const cwd = yield* makeTempDir; - const outsideDir = yield* makeTempDir; - yield* writeTextFile(outsideDir, "secret.txt", "outside\n"); - yield* fileSystem.symlink( + it.effect.skipIf(!symlinksSupported)( - path.join(outsideDir, "secret.txt"), - path.join(cwd, "linked-secret.txt"), - ); + "rejects symlinks that resolve outside the workspace root", + () => + Effect.gen(function* () { + const workspaceFileSystem = yield* WorkspaceFileSystem.WorkspaceFileSystem; + const fileSystem = yield* FileSystem.FileSystem; + const path = yield* Path.Path; + const cwd = yield* makeTempDir; + const outsideDir = yield* makeTempDir; + yield* writeTextFile(outsideDir, "secret.txt", "outside\n"); + yield* fileSystem.symlink( + path.join(outsideDir, "secret.txt"), + path.join(cwd, "linked-secret.txt"), + ); + const error = yield* workspaceFileSystem - const error = yield* workspaceFileSystem - .readFile({ cwd, relativePath: "linked-secret.txt" }) + .readFile({ cwd, relativePath: "linked-secret.txt" }) + .pipe(Effect.flip); - .pipe(Effect.flip); - const resolvedWorkspaceRoot = yield* fileSystem.realPath(cwd); - const resolvedPath = yield* fileSystem.realPath(path.join(outsideDir, "secret.txt")); + const resolvedWorkspaceRoot = yield* fileSystem.realPath(cwd); + const resolvedPath = yield* fileSystem.realPath(path.join(outsideDir, "secret.txt")); + expect(error).toBeInstanceOf(WorkspaceFileSystem.WorkspaceFilePathEscapeError); + expect(error).toMatchObject({ + workspaceRoot: cwd, + relativePath: "linked-secret.txt", + resolvedWorkspaceRoot, + resolvedPath, + }); + expect("cause" in error).toBe(false); + }), - expect(error).toBeInstanceOf(WorkspaceFileSystem.WorkspaceFilePathEscapeError); - expect(error).toMatchObject({ - workspaceRoot: cwd, - relativePath: "linked-secret.txt", - resolvedWorkspaceRoot, - resolvedPath, - }); - expect("cause" in error).toBe(false); - }), ); it.effect("rejects directories without manufacturing an I/O cause", () => ``` ## packages/shared/package.json Status: modified; +4; −0 ```diff @@ -223,6 +223,10 @@ "types": "./src/hostProcess.ts", "import": "./src/hostProcess.ts" }, + "./testing/symlinks": { + "types": "./src/testing/symlinks.ts", + "import": "./src/testing/symlinks.ts" + }, "./httpReadiness": { "types": "./src/httpReadiness.ts", "import": "./src/httpReadiness.ts" ``` ## packages/shared/src/testing/symlinks.ts Status: added; +29; −0 ```diff @@ -1,0 +1,29 @@ +// @effect-diagnostics nodeBuiltinImport:off - one synchronous probe at module load, outside any Effect runtime. +import * as NodeFS from "node:fs"; +import * as NodeOS from "node:os"; +import * as NodePath from "node:path"; + +/** + * Whether this host lets an unprivileged process create symlinks. Windows + * refuses without Developer Mode or elevation, so tests that plant a symlink + * to prove containment or escape detection should `skipIf(!symlinksSupported)` + * rather than fail at setup. Probed once per process. + */ +export const symlinksSupported: boolean = (() => { + let directory: string | undefined; + try { + directory = NodeFS.mkdtempSync(NodePath.join(NodeOS.tmpdir(), "t3-symlink-probe-")); + NodeFS.symlinkSync(NodePath.join(directory, "target"), NodePath.join(directory, "link")); + return true; + } catch { + return false; + } finally { + // Cleanup must not decide the answer: a transient EPERM/EBUSY on the + // probe directory would otherwise throw out of module initialisation. + try { + if (directory !== undefined) NodeFS.rmSync(directory, { recursive: true, force: true }); + } catch { + // Leave the probe directory behind rather than fail every importer. + } + } +})(); ``` ## scripts/build-desktop-artifact.test.ts Status: modified; +2; −1 ```diff @@ -87,6 +87,7 @@ } from "./build-desktop-artifact.ts"; import { BRAND_ASSET_PATHS } from "./lib/brand-assets.ts"; import { HostProcessArchitecture, HostProcessPlatform } from "@t3tools/shared/hostProcess"; +import { symlinksSupported } from "@t3tools/shared/testing/symlinks"; // A minimal stand-in for the staged sidecar roots packed into the WSL archive. const stageWslRuntimeTreeFixture = Effect.fn("stageWslRuntimeTreeFixture")(function* ( @@ -2191,7 +2192,7 @@ assert.deepStrictEqual(paths[0], "\\\\server\\share\\tmp\\node_modules"); }); +it.effect.skipIf(!symlinksSupported)("rebases packaged links into the isolated tree", () => -it.effect("rebases packaged links into the isolated tree", () => Effect.gen(function* () { const fs = yield* FileSystem.FileSystem; const path = yield* Path.Path; ``` ## scripts/mock-update-server.test.ts Status: modified; +30; −27 ```diff @@ -7,6 +7,7 @@ import { HttpClient, HttpRouter } from "effect/unstable/http"; import { makeMockUpdateRouteLayer } from "./mock-update-server.ts"; +import { symlinksSupported } from "@t3tools/shared/testing/symlinks"; const withMockUpdateServer = (rootRealPath: string, effect: Effect.Effect) => effect.pipe( @@ -72,35 +73,37 @@ }), ); + it.effect.skipIf(!symlinksSupported)( + "rejects symlinked files that escape the configured root", + () => + Effect.gen(function* () { + const fileSystem = yield* FileSystem.FileSystem; + const path = yield* Path.Path; + const root = yield* fileSystem.makeTempDirectoryScoped({ + prefix: "mock-update-server-root-", + }); + const outside = yield* fileSystem.makeTempDirectoryScoped({ + prefix: "mock-update-server-outside-", + }); + const rootRealPath = yield* fileSystem.realPath(root); + const outsideFile = path.join(outside, "outside.yml"); - it.effect("rejects symlinked files that escape the configured root", () => - Effect.gen(function* () { - const fileSystem = yield* FileSystem.FileSystem; - const path = yield* Path.Path; - const root = yield* fileSystem.makeTempDirectoryScoped({ - prefix: "mock-update-server-root-", - }); - const outside = yield* fileSystem.makeTempDirectoryScoped({ - prefix: "mock-update-server-outside-", + const linksDir = path.join(root, "links"); + const symlinkPath = path.join(linksDir, "outside.yml"); - }); - const rootRealPath = yield* fileSystem.realPath(root); - const outsideFile = path.join(outside, "outside.yml"); - const linksDir = path.join(root, "links"); - const symlinkPath = path.join(linksDir, "outside.yml"); + yield* fileSystem.writeFileString(outsideFile, "version: outside\n"); + yield* fileSystem.makeDirectory(linksDir, { recursive: true }); - yield* fileSystem.writeFileString(outsideFile, "version: outside\n"); - yield* fileSystem.makeDirectory(linksDir, { recursive: true }); - yield* fileSystem.symlink(outsideFile, symlinkPath); + yield* fileSystem.symlink(outsideFile, symlinkPath); - yield* withMockUpdateServer( - rootRealPath, + yield* withMockUpdateServer( - Effect.gen(function* () { - const client = yield* HttpClient.HttpClient; - const response = yield* client.get("/links/outside.yml"); + rootRealPath, + Effect.gen(function* () { + const client = yield* HttpClient.HttpClient; + const response = yield* client.get("/links/outside.yml"); - assert.equal(response.status, 404); - assert.equal(yield* response.text, "Not Found"); - }), + assert.equal(response.status, 404); + assert.equal(yield* response.text, "Not Found"); + }), + ); - ); + }), - }), ); }); ```