@amg555/frameforge-mcp 2.7.6 → 2.7.8

package/.agent/skills/gstack-browse/test/file-drop.test.ts

@@ -1,271 +0,0 @@
-/**
- * Tests for the inbox meta-command handler (file drop relay).
- *
- * Tests the inbox display, --clear flag, and edge cases by creating
- * temp directories with test JSON files and calling handleMetaCommand.
- */
-
-import { describe, test, expect, beforeEach, afterEach } from 'bun:test';
-import * as fs from 'fs';
-import * as path from 'path';
-import * as os from 'os';
-import { handleMetaCommand } from '../src/meta-commands';
-import { BrowserManager } from '../src/browser-manager';
-
-let tmpDir: string;
-let bm: BrowserManager;
-
-// We need a BrowserManager instance for handleMetaCommand, but inbox
-// doesn't use it. We also need to mock git rev-parse to point to our
-// temp directory. We'll test the inbox logic directly by manipulating
-// the filesystem and using child_process.execSync override.
-
-// ─── Direct filesystem tests (bypassing handleMetaCommand) ──────
-// The inbox handler in meta-commands.ts calls `git rev-parse --show-toplevel`
-// to find the inbox directory. Since we can't easily mock that in unit tests,
-// we test the inbox parsing logic directly.
-
-interface InboxMessage {
-  timestamp: string;
-  url: string;
-  userMessage: string;
-}
-
-/** Replicate the inbox file reading logic from meta-commands.ts */
-function readInbox(inboxDir: string): InboxMessage[] {
-  if (!fs.existsSync(inboxDir)) return [];
-
-  const files = fs.readdirSync(inboxDir)
-    .filter(f => f.endsWith('.json') && !f.startsWith('.'))
-    .sort()
-    .reverse();
-
-  if (files.length === 0) return [];
-
-  const messages: InboxMessage[] = [];
-  for (const file of files) {
-    try {
-      const data = JSON.parse(fs.readFileSync(path.join(inboxDir, file), 'utf-8'));
-      messages.push({
-        timestamp: data.timestamp || '',
-        url: data.page?.url || 'unknown',
-        userMessage: data.userMessage || '',
-      });
-    } catch {
-      // Skip malformed files
-    }
-  }
-  return messages;
-}
-
-/** Replicate the inbox formatting logic from meta-commands.ts */
-function formatInbox(messages: InboxMessage[]): string {
-  if (messages.length === 0) return 'Inbox empty.';
-
-  const lines: string[] = [];
-  lines.push(`SIDEBAR INBOX (${messages.length} message${messages.length === 1 ? '' : 's'})`);
-  lines.push('────────────────────────────────');
-
-  for (const msg of messages) {
-    const ts = msg.timestamp ? `[${msg.timestamp}]` : '[unknown]';
-    lines.push(`${ts} ${msg.url}`);
-    lines.push(`  "${msg.userMessage}"`);
-    lines.push('');
-  }
-
-  lines.push('────────────────────────────────');
-  return lines.join('\n');
-}
-
-/** Replicate the --clear logic from meta-commands.ts */
-function clearInbox(inboxDir: string): number {
-  const files = fs.readdirSync(inboxDir)
-    .filter(f => f.endsWith('.json') && !f.startsWith('.'));
-  for (const file of files) {
-    try { fs.unlinkSync(path.join(inboxDir, file)); } catch {}
-  }
-  return files.length;
-}
-
-function writeTestInboxFile(
-  inboxDir: string,
-  message: string,
-  pageUrl: string,
-  timestamp: string,
-): string {
-  fs.mkdirSync(inboxDir, { recursive: true });
-  const filename = `${timestamp.replace(/:/g, '-')}-observation.json`;
-  const filePath = path.join(inboxDir, filename);
-  fs.writeFileSync(filePath, JSON.stringify({
-    type: 'observation',
-    timestamp,
-    page: { url: pageUrl, title: '' },
-    userMessage: message,
-    sidebarSessionId: 'test-session',
-  }, null, 2));
-  return filePath;
-}
-
-beforeEach(() => {
-  tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'file-drop-test-'));
-});
-
-afterEach(() => {
-  fs.rmSync(tmpDir, { recursive: true, force: true });
-});
-
-// ─── Empty Inbox ─────────────────────────────────────────────────
-
-describe('inbox — empty states', () => {
-  test('no .context/sidebar-inbox directory returns empty', () => {
-    const inboxDir = path.join(tmpDir, '.context', 'sidebar-inbox');
-    const messages = readInbox(inboxDir);
-    expect(messages.length).toBe(0);
-    expect(formatInbox(messages)).toBe('Inbox empty.');
-  });
-
-  test('empty inbox directory returns empty', () => {
-    const inboxDir = path.join(tmpDir, '.context', 'sidebar-inbox');
-    fs.mkdirSync(inboxDir, { recursive: true });
-    const messages = readInbox(inboxDir);
-    expect(messages.length).toBe(0);
-    expect(formatInbox(messages)).toBe('Inbox empty.');
-  });
-
-  test('directory with only dotfiles returns empty', () => {
-    const inboxDir = path.join(tmpDir, '.context', 'sidebar-inbox');
-    fs.mkdirSync(inboxDir, { recursive: true });
-    fs.writeFileSync(path.join(inboxDir, '.tmp-file.json'), '{}');
-    const messages = readInbox(inboxDir);
-    expect(messages.length).toBe(0);
-  });
-});
-
-// ─── Valid Messages ──────────────────────────────────────────────
-
-describe('inbox — valid messages', () => {
-  test('displays formatted output with timestamps and URLs', () => {
-    const inboxDir = path.join(tmpDir, '.context', 'sidebar-inbox');
-    writeTestInboxFile(inboxDir, 'This button is broken', 'https://example.com/page', '2024-06-15T10:30:00.000Z');
-    writeTestInboxFile(inboxDir, 'Login form fails', 'https://example.com/login', '2024-06-15T10:31:00.000Z');
-
-    const messages = readInbox(inboxDir);
-    expect(messages.length).toBe(2);
-
-    const output = formatInbox(messages);
-    expect(output).toContain('SIDEBAR INBOX (2 messages)');
-    expect(output).toContain('https://example.com/page');
-    expect(output).toContain('https://example.com/login');
-    expect(output).toContain('"This button is broken"');
-    expect(output).toContain('"Login form fails"');
-    expect(output).toContain('[2024-06-15T10:30:00.000Z]');
-    expect(output).toContain('[2024-06-15T10:31:00.000Z]');
-  });
-
-  test('single message uses singular form', () => {
-    const inboxDir = path.join(tmpDir, '.context', 'sidebar-inbox');
-    writeTestInboxFile(inboxDir, 'Just one', 'https://example.com', '2024-06-15T10:30:00.000Z');
-
-    const messages = readInbox(inboxDir);
-    const output = formatInbox(messages);
-    expect(output).toContain('1 message)');
-    expect(output).not.toContain('messages)');
-  });
-
-  test('messages sorted newest first', () => {
-    const inboxDir = path.join(tmpDir, '.context', 'sidebar-inbox');
-    writeTestInboxFile(inboxDir, 'older', 'https://example.com', '2024-06-15T10:00:00.000Z');
-    writeTestInboxFile(inboxDir, 'newer', 'https://example.com', '2024-06-15T11:00:00.000Z');
-
-    const messages = readInbox(inboxDir);
-    // Filenames sort lexicographically, reversed = newest first
-    expect(messages[0].userMessage).toBe('newer');
-    expect(messages[1].userMessage).toBe('older');
-  });
-});
-
-// ─── Malformed Files ─────────────────────────────────────────────
-
-describe('inbox — malformed files', () => {
-  test('malformed JSON files are skipped gracefully', () => {
-    const inboxDir = path.join(tmpDir, '.context', 'sidebar-inbox');
-    fs.mkdirSync(inboxDir, { recursive: true });
-
-    // Write a valid message
-    writeTestInboxFile(inboxDir, 'valid message', 'https://example.com', '2024-06-15T10:30:00.000Z');
-
-    // Write a malformed JSON file
-    fs.writeFileSync(
-      path.join(inboxDir, '2024-06-15T10-35-00.000Z-observation.json'),
-      'this is not valid json {{{',
-    );
-
-    const messages = readInbox(inboxDir);
-    expect(messages.length).toBe(1);
-    expect(messages[0].userMessage).toBe('valid message');
-  });
-
-  test('JSON file missing fields uses defaults', () => {
-    const inboxDir = path.join(tmpDir, '.context', 'sidebar-inbox');
-    fs.mkdirSync(inboxDir, { recursive: true });
-
-    // Write a JSON file with missing fields
-    fs.writeFileSync(
-      path.join(inboxDir, '2024-06-15T10-30-00.000Z-observation.json'),
-      JSON.stringify({ type: 'observation' }),
-    );
-
-    const messages = readInbox(inboxDir);
-    expect(messages.length).toBe(1);
-    expect(messages[0].timestamp).toBe('');
-    expect(messages[0].url).toBe('unknown');
-    expect(messages[0].userMessage).toBe('');
-  });
-});
-
-// ─── Clear Flag ──────────────────────────────────────────────────
-
-describe('inbox — --clear flag', () => {
-  test('files deleted after clear', () => {
-    const inboxDir = path.join(tmpDir, '.context', 'sidebar-inbox');
-    writeTestInboxFile(inboxDir, 'message 1', 'https://example.com', '2024-06-15T10:30:00.000Z');
-    writeTestInboxFile(inboxDir, 'message 2', 'https://example.com', '2024-06-15T10:31:00.000Z');
-
-    // Verify files exist
-    const filesBefore = fs.readdirSync(inboxDir).filter(f => f.endsWith('.json') && !f.startsWith('.'));
-    expect(filesBefore.length).toBe(2);
-
-    // Clear
-    const cleared = clearInbox(inboxDir);
-    expect(cleared).toBe(2);
-
-    // Verify files deleted
-    const filesAfter = fs.readdirSync(inboxDir).filter(f => f.endsWith('.json') && !f.startsWith('.'));
-    expect(filesAfter.length).toBe(0);
-  });
-
-  test('clear on empty directory does nothing', () => {
-    const inboxDir = path.join(tmpDir, '.context', 'sidebar-inbox');
-    fs.mkdirSync(inboxDir, { recursive: true });
-
-    const cleared = clearInbox(inboxDir);
-    expect(cleared).toBe(0);
-  });
-
-  test('clear preserves dotfiles', () => {
-    const inboxDir = path.join(tmpDir, '.context', 'sidebar-inbox');
-    fs.mkdirSync(inboxDir, { recursive: true });
-
-    // Write a dotfile and a regular file
-    fs.writeFileSync(path.join(inboxDir, '.keep'), '');
-    writeTestInboxFile(inboxDir, 'to be cleared', 'https://example.com', '2024-06-15T10:30:00.000Z');
-
-    clearInbox(inboxDir);
-
-    // Dotfile should remain
-    expect(fs.existsSync(path.join(inboxDir, '.keep'))).toBe(true);
-    // Regular file should be gone
-    const jsonFiles = fs.readdirSync(inboxDir).filter(f => f.endsWith('.json') && !f.startsWith('.'));
-    expect(jsonFiles.length).toBe(0);
-  });
-});

package/.agent/skills/gstack-browse/test/file-permissions.test.ts

@@ -1,346 +0,0 @@
-/**
- * Unit tests for browse/src/file-permissions.ts
- *
- * Strategy:
- *   - POSIX assertions check fs.statSync.mode bits directly (cheap, reliable,
- *     runs on every CI config).
- *   - Windows assertions don't check ACLs (that'd require parsing icacls
- *     output, which is brittle across Windows versions / locales). Instead
- *     we verify the helper doesn't throw and the file ends up accessible
- *     to the current user — the "doesn't crash, file still usable"
- *     contract the callers rely on.
- *   - Every `mode & 0o777` bitmask assertion is platform-guarded: Windows
- *     fakes POSIX mode bits (chmod is ~a no-op; dirs stat as 0o777), so a
- *     bitmask expectation on win32 tests the runner, not our code. Symlink
- *     fixtures are created in try/catch — Windows runners without Developer
- *     Mode / admin can't create symlinks, and the test skips gracefully.
- */
-
-import { afterEach, beforeEach, describe, expect, spyOn, test } from 'bun:test';
-import * as fs from 'fs';
-import * as os from 'os';
-import * as path from 'path';
-
-import {
-  restrictFilePermissions,
-  restrictDirectoryPermissions,
-  writeSecureFile,
-  appendSecureFile,
-  mkdirSecure,
-  repairBrokenDacl,
-  __resetWarnedForTests,
-} from '../src/file-permissions';
-
-let tmpDir: string;
-
-beforeEach(() => {
-  tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'file-perms-'));
-  __resetWarnedForTests();
-});
-
-afterEach(() => {
-  try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch { /* best-effort */ }
-});
-
-describe('restrictFilePermissions', () => {
-  test('on POSIX, sets file mode to 0o600', () => {
-    if (process.platform === 'win32') return;
-    const p = path.join(tmpDir, 'secret');
-    fs.writeFileSync(p, 'token');
-    fs.chmodSync(p, 0o644); // start world-readable to prove the call mutates it
-    restrictFilePermissions(p);
-    expect(fs.statSync(p).mode & 0o777).toBe(0o600);
-  });
-
-  test('on Windows, does not throw on an existing file', () => {
-    if (process.platform !== 'win32') return;
-    const p = path.join(tmpDir, 'secret');
-    fs.writeFileSync(p, 'token');
-    expect(() => restrictFilePermissions(p)).not.toThrow();
-    // File remains readable by the caller — core contract.
-    expect(fs.readFileSync(p, 'utf8')).toBe('token');
-  });
-
-  test('on Windows, does not throw when icacls fails (bad path)', () => {
-    if (process.platform !== 'win32') return;
-    // icacls emits an error for a nonexistent path; helper must swallow.
-    expect(() => restrictFilePermissions(path.join(tmpDir, 'nonexistent'))).not.toThrow();
-  });
-});
-
-describe('restrictDirectoryPermissions', () => {
-  test('on POSIX, sets directory mode to 0o700', () => {
-    if (process.platform === 'win32') return;
-    const d = path.join(tmpDir, 'subdir');
-    fs.mkdirSync(d, { mode: 0o755 });
-    restrictDirectoryPermissions(d);
-    expect(fs.statSync(d).mode & 0o777).toBe(0o700);
-  });
-
-  test('on POSIX, leaves a shared sticky world-writable dir untouched', () => {
-    if (process.platform === 'win32') return;
-    // Simulates /tmp: sticky + world-writable. Hardening a shared dir to
-    // 0o700 locks every other user on the machine out of it, so the helper
-    // must refuse — even when the caller owns the dir (root / CAP_FOWNER
-    // hosts are where the chmod would actually succeed).
-    const d = path.join(tmpDir, 'shared-tmp');
-    fs.mkdirSync(d);
-    // System chmod, not fs.chmodSync: Bun masks the sticky bit off chmod/
-    // mkdir modes, so 0o1777 through the fs API lands as 0o777.
-    Bun.spawnSync(['chmod', '1777', d], { timeout: 30_000 });
-    expect(fs.statSync(d).mode & 0o7777).toBe(0o1777); // fixture took
-    restrictDirectoryPermissions(d);
-    expect(fs.statSync(d).mode & 0o7777).toBe(0o1777);
-  });
-
-  test('on POSIX, leaves a directory owned by another user untouched', () => {
-    if (process.platform === 'win32') return;
-    const d = path.join(tmpDir, 'foreign');
-    fs.mkdirSync(d, { mode: 0o755 });
-    // Only constructible where chown to a foreign uid succeeds (root /
-    // CAP_CHOWN — containers, CI sandboxes). Elsewhere the chown throws
-    // and there's nothing to assert; bail.
-    try { fs.chownSync(d, process.getuid!() + 1, fs.statSync(d).gid); } catch { return; }
-    restrictDirectoryPermissions(d);
-    expect(fs.statSync(d).mode & 0o777).toBe(0o755);
-  });
-
-  test('on Windows, does not throw on an existing directory', () => {
-    if (process.platform !== 'win32') return;
-    const d = path.join(tmpDir, 'subdir');
-    fs.mkdirSync(d);
-    expect(() => restrictDirectoryPermissions(d)).not.toThrow();
-  });
-
-  test('warns and skips a symlinked dir without throwing', () => {
-    const real = path.join(tmpDir, 'real-target');
-    fs.mkdirSync(real);
-    if (process.platform !== 'win32') {
-      // chmod, not mkdir({ mode }), so a restrictive umask can't skew the
-      // starting bits we later assert were left untouched.
-      fs.chmodSync(real, 0o755);
-    }
-    const link = path.join(tmpDir, 'linked');
-    try {
-      fs.symlinkSync(real, link, 'dir');
-    } catch {
-      // Windows runners without Developer Mode / admin can't create
-      // symlinks (house pattern: security-audit-r2.test.ts skips the same
-      // way). Nothing to test without the link.
-      // biome-ignore lint/suspicious/noConsole: test-skip diagnostics
-      console.warn('Skipping: symlink creation failed (no symlink privilege)');
-      return;
-    }
-
-    const warnings: string[] = [];
-    const originalWarn = console.warn;
-    console.warn = (...args: unknown[]) => { warnings.push(args.map(String).join(' ')); };
-    try {
-      expect(() => restrictDirectoryPermissions(link)).not.toThrow();
-    } finally {
-      console.warn = originalWarn;
-    }
-    expect(warnings.some((w) => w.includes('symlink'))).toBe(true);
-
-    // The skip must leave the link target untouched. Mode bits are only
-    // meaningful on POSIX — Windows fakes stat().mode (dirs report 0o777
-    // no matter what), so asserting 0o755 there fails on runner semantics,
-    // not on our behavior. The no-throw + warn + still-usable checks are
-    // the meaningful win32 contract.
-    if (process.platform !== 'win32') {
-      expect(fs.statSync(real).mode & 0o777).toBe(0o755);
-    }
-    expect(() => fs.readdirSync(real)).not.toThrow();
-  });
-
-  test('on Windows, the directory stays usable by the calling process', () => {
-    if (process.platform !== 'win32') return;
-    const d = path.join(tmpDir, 'still-usable');
-    fs.mkdirSync(d);
-    fs.writeFileSync(path.join(d, 'before'), 'x');
-
-    restrictDirectoryPermissions(d);
-
-    // Regression: an unqualified username passed to icacls can resolve to
-    // the machine SID rather than the user account. Combined with
-    // /inheritance:r that leaves a directory whose only ACE matches nobody,
-    // so the process that just "secured" it can no longer enumerate or
-    // write to it. icacls still reports success, so a not-toThrow assertion
-    // sails straight past it — hence these access checks.
-    expect(() => fs.readdirSync(d)).not.toThrow();
-    expect(fs.readdirSync(d)).toContain('before');
-    expect(() => fs.writeFileSync(path.join(d, 'after'), 'y')).not.toThrow();
-    expect(fs.readFileSync(path.join(d, 'after'), 'utf8')).toBe('y');
-  });
-});
-
-describe('writeSecureFile', () => {
-  test('writes the payload and restricts permissions atomically', () => {
-    const p = path.join(tmpDir, 'data');
-    writeSecureFile(p, 'hello');
-    expect(fs.readFileSync(p, 'utf8')).toBe('hello');
-    if (process.platform !== 'win32') {
-      expect(fs.statSync(p).mode & 0o777).toBe(0o600);
-    }
-  });
-
-  test('accepts Buffer payloads', () => {
-    const p = path.join(tmpDir, 'buffer');
-    writeSecureFile(p, Buffer.from([0xde, 0xad, 0xbe, 0xef]));
-    const out = fs.readFileSync(p);
-    expect(out.length).toBe(4);
-    expect(out[0]).toBe(0xde);
-  });
-
-  test('overwrites existing file', () => {
-    const p = path.join(tmpDir, 'existing');
-    fs.writeFileSync(p, 'old', { mode: 0o644 });
-    writeSecureFile(p, 'new');
-    expect(fs.readFileSync(p, 'utf8')).toBe('new');
-  });
-});
-
-describe('appendSecureFile', () => {
-  test('appends to a new file and sets owner-only permissions', () => {
-    const p = path.join(tmpDir, 'log');
-    appendSecureFile(p, 'line1\n');
-    expect(fs.readFileSync(p, 'utf8')).toBe('line1\n');
-    if (process.platform !== 'win32') {
-      expect(fs.statSync(p).mode & 0o777).toBe(0o600);
-    }
-  });
-
-  test('appends without re-applying ACL on subsequent writes', () => {
-    const p = path.join(tmpDir, 'log');
-    appendSecureFile(p, 'line1\n');
-    appendSecureFile(p, 'line2\n');
-    expect(fs.readFileSync(p, 'utf8')).toBe('line1\nline2\n');
-  });
-});
-
-describe('mkdirSecure', () => {
-  test('creates directory with owner-only mode (POSIX)', () => {
-    if (process.platform === 'win32') return;
-    const d = path.join(tmpDir, 'nested', 'deep');
-    mkdirSecure(d);
-    expect(fs.statSync(d).isDirectory()).toBe(true);
-    expect(fs.statSync(d).mode & 0o777).toBe(0o700);
-  });
-
-  test('is idempotent — safe to call on existing directory', () => {
-    const d = path.join(tmpDir, 'dir');
-    mkdirSecure(d);
-    expect(() => mkdirSecure(d)).not.toThrow();
-  });
-
-  test('does not chmod a pre-existing shared sticky dir (the /tmp state-dir case)', () => {
-    if (process.platform === 'win32') return;
-    // BROWSE_STATE_FILE=/tmp/foo.json derives stateDir=/tmp, and every
-    // daemon boot runs mkdirSecure(stateDir). The mkdir is a no-op on the
-    // existing dir; the permission re-apply must be one too — chmodding the
-    // real /tmp to 0o700 breaks fs.existsSync (access(2) → EACCES) for
-    // every process on the machine until something restores 1777.
-    const d = path.join(tmpDir, 'shared-tmp');
-    fs.mkdirSync(d);
-    // System chmod: Bun's fs API masks the sticky bit off modes (see the
-    // restrictDirectoryPermissions sticky-dir test).
-    Bun.spawnSync(['chmod', '1777', d], { timeout: 30_000 });
-    expect(fs.statSync(d).mode & 0o7777).toBe(0o1777); // fixture took
-    mkdirSecure(d);
-    expect(fs.statSync(d).mode & 0o7777).toBe(0o1777);
-  });
-
-  test('on Windows, the created directory stays usable by the caller', () => {
-    if (process.platform !== 'win32') return;
-    // The state-dir path that broke: mkdirSecure() creates .gstack/, hardens
-    // it, and the very next thing the daemon does is write a lockfile inside.
-    const d = path.join(tmpDir, 'state', '.gstack');
-    mkdirSecure(d);
-    expect(() => fs.writeFileSync(path.join(d, 'browse.json.lock'), '1')).not.toThrow();
-    expect(fs.readdirSync(d)).toContain('browse.json.lock');
-  });
-
-  // #2048: Bun on Windows threw EEXIST from a recursive mkdir of an existing
-  // .gstack, which made every browse command fatal. Simulated here so every
-  // platform proves the contract; a file at the path is still a conflict.
-  test('tolerates a runtime EEXIST for an existing directory, never for a file (#2048)', () => {
-    const d = path.join(tmpDir, 'state', '.gstack');
-    mkdirSecure(d);
-    const file = path.join(tmpDir, 'not-a-dir');
-    fs.writeFileSync(file, 'x');
-    const original = fs.mkdirSync;
-    const eexist = spyOn(fs, 'mkdirSync').mockImplementation(((target: fs.PathLike, options?: any) => {
-      if (fs.existsSync(target)) throw Object.assign(new Error(`EEXIST: file already exists, mkdir '${target}'`), { code: 'EEXIST' });
-      return original(target, options);
-    }) as typeof fs.mkdirSync);
-    try {
-      expect(() => mkdirSecure(d)).not.toThrow();
-      expect(() => mkdirSecure(file)).toThrow('EEXIST');
-    } finally {
-      eexist.mockRestore();
-    }
-  });
-
-  test('recursive behavior: creates intermediate directories', () => {
-    const d = path.join(tmpDir, 'a', 'b', 'c');
-    mkdirSecure(d);
-    expect(fs.existsSync(path.join(tmpDir, 'a'))).toBe(true);
-    expect(fs.existsSync(path.join(tmpDir, 'a', 'b'))).toBe(true);
-    expect(fs.existsSync(d)).toBe(true);
-  });
-
-  test('created directory is listable by the creating process', () => {
-    // #1605 contract: whatever ACL hardening happens, the client must be
-    // able to read its own state dir immediately after creation.
-    const d = path.join(tmpDir, 'state');
-    mkdirSecure(d);
-    fs.writeFileSync(path.join(d, 'browse.json'), '{}');
-    expect(fs.readdirSync(d)).toContain('browse.json');
-  });
-});
-
-describe('repairBrokenDacl', () => {
-  test('is a no-op on non-Windows platforms', () => {
-    if (process.platform === 'win32') return;
-    const d = path.join(tmpDir, 'dir');
-    fs.mkdirSync(d);
-    expect(() => repairBrokenDacl(d)).not.toThrow();
-  });
-
-  test('on Windows, does not throw and directory stays listable', () => {
-    if (process.platform !== 'win32') return;
-    const d = path.join(tmpDir, 'dir');
-    fs.mkdirSync(d);
-    expect(() => repairBrokenDacl(d)).not.toThrow();
-    expect(() => fs.readdirSync(d)).not.toThrow();
-  });
-
-  test('on Windows, swallows icacls failure on a nonexistent path', () => {
-    if (process.platform !== 'win32') return;
-    expect(() => repairBrokenDacl(path.join(tmpDir, 'nonexistent'))).not.toThrow();
-  });
-});
-// Symlinked state dir (dotfiles-managed ~/.gstack via stow/chezmoi): the
-// fd-anchored path refuses to follow it (O_NOFOLLOW) — the refusal must warn,
-// never throw, and never chmod the symlink target. POSIX-branch behavior:
-// Windows takes the icacls branch and has no POSIX modes (stat reports 0o666),
-// so gate like the sibling tests above.
-test('restrictDirectoryPermissions warns and skips a symlinked dir without throwing', () => {
-  if (process.platform === 'win32') return;
-  const base = fs.mkdtempSync(path.join(os.tmpdir(), 'fp-symlink-'));
-  const target = path.join(base, 'real');
-  const link = path.join(base, 'link');
-  fs.mkdirSync(target, { mode: 0o755 });
-  fs.symlinkSync(target, link);
-  // Capture the actual post-umask mode rather than assuming 0o755 — a strict
-  // umask (077) would legitimately yield 0o700 at creation time.
-  const modeBefore = fs.statSync(target).mode & 0o777;
-  try {
-    expect(() => restrictDirectoryPermissions(link)).not.toThrow();
-    // Target permissions untouched — the link was never followed.
-    expect(fs.statSync(target).mode & 0o777).toBe(modeBefore);
-  } finally {
-    fs.rmSync(base, { recursive: true, force: true });
-  }
-});
-