@ashlr/stack-core 0.1.1 → 0.3.0

package/src/__tests__/phantom-contract.test.ts

@@ -0,0 +1,177 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, symlinkSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { isAbsolute, join } from "node:path";
+import { wirePhantomForRecipe } from "../ai/phantom-wire.ts";
+import { StackError } from "../errors.ts";
+import {
+  __resetPhantomCache,
+  addSecret,
+  isPhantomInstalled,
+  listSecrets,
+  removeSecret,
+  revealSecret,
+} from "../phantom.ts";
+import { takeRevealRefusals, tryRevealSecret } from "../providers/_helpers.ts";
+
+/**
+ * Producer/consumer contract: Stack's Phantom wrapper against a REAL
+ * `phantom` binary (Phantom Secrets 0.7.9 or newer).
+ *
+ * The fake in `_harness.ts` encodes what Stack assumes Phantom does; this
+ * suite checks those assumptions against the producer. It is opt-in because
+ * CI does not install Phantom:
+ *
+ *   STACK_PHANTOM_CONTRACT_BIN=/abs/path/to/phantom bun test phantom-contract
+ *
+ * The vault is an isolated encrypted-file vault under a temp HOME, unlocked
+ * with a throwaway passphrase. No keychain, network or real credential is used.
+ * Tests share that vault and run in order: later tests rely on names stored
+ * by earlier ones.
+ */
+
+const realBin = process.env.STACK_PHANTOM_CONTRACT_BIN;
+const enabled = Boolean(realBin && isAbsolute(realBin));
+
+const SYNTHETIC_VALUE = "stack-contract-synthetic-value-7f3e";
+
+describe.skipIf(!enabled)("phantom CLI contract (real binary)", () => {
+  let root = "";
+  let project = "";
+  const saved: Record<string, string | undefined> = {};
+  const cwd = process.cwd();
+
+  function phantom(args: string[], input?: string) {
+    return spawnSync("phantom", args, {
+      cwd: project,
+      input,
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"],
+    });
+  }
+
+  function vaultNames(): string[] {
+    const out = phantom(["list", "--json"]);
+    expect(out.status).toBe(0);
+    return (JSON.parse(out.stdout) as Array<{ name: string }>).map((e) => e.name).sort();
+  }
+
+  beforeAll(() => {
+    root = realpathSync(mkdtempSync(join(tmpdir(), "stack-phantom-contract-")));
+    const bin = join(root, "bin");
+    project = join(root, "project");
+    mkdirSync(bin);
+    mkdirSync(project);
+    mkdirSync(join(root, "home"));
+    symlinkSync(realBin as string, join(bin, "phantom"));
+    for (const k of ["PATH", "HOME", "PHANTOM_VAULT_PASSPHRASE", "RUST_BACKTRACE"]) {
+      saved[k] = process.env[k];
+    }
+    process.env.PATH = `${bin}:${process.env.PATH ?? ""}`;
+    process.env.HOME = join(root, "home");
+    process.env.PHANTOM_VAULT_PASSPHRASE = "stack-contract-throwaway-passphrase";
+    process.env.RUST_BACKTRACE = "0";
+    __resetPhantomCache();
+    spawnSync("git", ["init", "-q"], { cwd: project });
+    const init = phantom(["init", "--empty"]);
+    expect(init.status).toBe(0);
+    process.chdir(project);
+  });
+
+  afterAll(() => {
+    process.chdir(cwd);
+    for (const [k, v] of Object.entries(saved)) {
+      if (v === undefined) delete process.env[k];
+      else process.env[k] = v;
+    }
+    __resetPhantomCache();
+    if (root) rmSync(root, { recursive: true, force: true });
+  });
+
+  test("version probe detects the binary", async () => {
+    expect(await isPhantomInstalled()).toBe(true);
+  });
+
+  // Argv is asserted against the fake in phantom-harness.test.ts; the real
+  // binary rejects a positional value, so storing at all proves stdin.
+  test("addSecret stores a new name", async () => {
+    await addSecret("STACK_CONTRACT_A", SYNTHETIC_VALUE, project);
+    expect(vaultNames()).toContain("STACK_CONTRACT_A");
+  });
+
+  test("listSecrets returns exactly the stored names", async () => {
+    await addSecret("STACK_CONTRACT_B", SYNTHETIC_VALUE, project);
+    expect((await listSecrets(project)).sort()).toEqual(vaultNames());
+  });
+
+  test("completed identical creates refuse with typed errors and preserve the full name inventory", async () => {
+    await addSecret("STACK_CONTRACT_C", SYNTHETIC_VALUE, project);
+    const names = vaultNames();
+    expect(names).toContain("STACK_CONTRACT_C");
+    for (let repeat = 0; repeat < 2; repeat++) {
+      let caught: unknown;
+      try {
+        await addSecret("STACK_CONTRACT_C", SYNTHETIC_VALUE, project);
+      } catch (err) {
+        caught = err;
+      }
+      expect(caught).toBeInstanceOf(StackError);
+      if (!(caught instanceof StackError)) throw new Error("Expected a typed collision.");
+      expect(caught.code).toBe("PHANTOM_SECRET_EXISTS");
+      expect(caught.message).not.toContain(SYNTHETIC_VALUE);
+      expect(vaultNames()).toEqual(names);
+    }
+  });
+
+  // Phantom offers no headless read, so only the name's survival is observable.
+  test("addSecret on an existing name fails with a typed error and keeps the name", async () => {
+    let caught: unknown;
+    try {
+      await addSecret("STACK_CONTRACT_A", "replacement-value", project);
+    } catch (err) {
+      caught = err;
+    }
+    expect(caught).toBeInstanceOf(StackError);
+    expect((caught as StackError).code).toBe("PHANTOM_SECRET_EXISTS");
+    expect((caught as StackError).message).not.toContain("replacement-value");
+    expect(vaultNames()).toContain("STACK_CONTRACT_A");
+  });
+
+  test("revealSecret without a terminal fails closed with a typed error", async () => {
+    let caught: unknown;
+    try {
+      await revealSecret("STACK_CONTRACT_A", project);
+    } catch (err) {
+      caught = err;
+    }
+    expect((caught as StackError).code).toBe("PHANTOM_TRUSTED_TERMINAL_REQUIRED");
+    expect(String((caught as Error).message)).not.toContain(SYNTHETIC_VALUE);
+    takeRevealRefusals();
+    expect(await tryRevealSecret("STACK_CONTRACT_A")).toBeUndefined();
+    // Doctor relies on this to report "stored, unverified" instead of "missing".
+    expect(takeRevealRefusals()).toEqual(["STACK_CONTRACT_A"]);
+  });
+
+  test("removeSecret without a terminal reports that nothing was removed", async () => {
+    expect(await removeSecret("STACK_CONTRACT_B", project)).toBe(false);
+    expect(vaultNames()).toContain("STACK_CONTRACT_B");
+  });
+
+  test("recipe wiring never writes placeholder values into the vault", async () => {
+    const before = vaultNames();
+    const result = await wirePhantomForRecipe(
+      {
+        id: "contract",
+        query: "contract",
+        createdAt: new Date(0).toISOString(),
+        providers: [{ name: "openai" }],
+      },
+      { cwd: project },
+    );
+    expect(result.present).toEqual([]);
+    expect(result.missing).toContain("openai:OPENAI_API_KEY");
+    expect(result.skipped).toEqual([]);
+    expect(vaultNames()).toEqual(before);
+  });
+});

package/src/__tests__/phantom-harness.test.ts

@@ -1,12 +1,22 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import {
+  PhantomTimeoutError,
+  __resetPhantomCache,
   addSecret,
+  assertProjectInitialized,
+  completionForClose,
+  countSecrets,
+  exec,
   isPhantomInstalled,
   listSecrets,
+  probePhantomInstalled,
   removeSecret,
   revealSecret,
 } from "../phantom.ts";
-import { type Harness, setupFakePhantom } from "./_harness.ts";
+import { type Harness, readVault, setupFakePhantom } from "./_harness.ts";
 
 describe("phantom wrapper against the fake harness", () => {
   let h: Harness;
@@ -23,10 +33,170 @@ describe("phantom wrapper against the fake harness", () => {
     expect(await isPhantomInstalled()).toBe(true);
   });
 
-  test("addSecret writes to the fake vault", async () => {
+  test("exec excludes parent credentials and runtime injection variables", async () => {
+    const keys = ["STACK_TEST_PARENT_CREDENTIAL", "NODE_OPTIONS", "BASH_ENV", "LD_PRELOAD"];
+    const previous = keys.map((key) => process.env[key]);
+    try {
+      for (const key of keys) process.env[key] = "inert-regression-marker";
+      writeFileSync(
+        join(h.dir, "phantom"),
+        '#!/bin/sh\nfor key in STACK_TEST_PARENT_CREDENTIAL NODE_OPTIONS BASH_ENV LD_PRELOAD; do\n  if printenv "$key" >/dev/null; then exit 9; fi\ndone\ntest -n "$HOME" && test -n "$PATH"\n',
+      );
+      expect((await exec(["--version"], { allowFailure: true })).code).toBe(0);
+    } finally {
+      keys.forEach((key, i) => {
+        if (previous[i] === undefined) delete process.env[key];
+        else process.env[key] = previous[i];
+      });
+    }
+  });
+
+  test("exec forwards Phantom's explicit vault unlock input to the child", async () => {
+    const previous = process.env.PHANTOM_VAULT_PASSPHRASE;
+    try {
+      process.env.PHANTOM_VAULT_PASSPHRASE = "inert-regression-passphrase";
+      writeFileSync(
+        join(h.dir, "phantom"),
+        '#!/bin/sh\ntest "$PHANTOM_VAULT_PASSPHRASE" = "inert-regression-passphrase"\n',
+      );
+      expect((await exec(["--version"], { allowFailure: true })).code).toBe(0);
+    } finally {
+      if (previous === undefined) Reflect.deleteProperty(process.env, "PHANTOM_VAULT_PASSPHRASE");
+      else process.env.PHANTOM_VAULT_PASSPHRASE = previous;
+    }
+  });
+
+  test("exec resolves relative PATH entries before entering the project directory", async () => {
+    const previousPath = process.env.PATH;
+    try {
+      writeFileSync(join(h.dir, "phantom"), "#!/bin/sh\nexit 9\n");
+      // A relative entry must never be reinterpreted inside the requested cwd.
+      process.env.PATH = ".:/usr/bin:/bin";
+      await expect(exec(["--version"], { cwd: h.dir })).rejects.toMatchObject({
+        code: "PHANTOM_NOT_INSTALLED",
+      });
+    } finally {
+      process.env.PATH = previousPath;
+    }
+  });
+
+  test("addSecret writes to the fake vault over stdin, never argv", async () => {
     await addSecret("NEW_KEY", "new-value");
-    expect(await revealSecret("NEW_KEY")).toBe("new-value");
-    expect(h.callsTo("add").length).toBe(1);
+    expect((await readVault(h.dir)).NEW_KEY).toBe("new-value");
+    expect(h.callsTo("add")).toEqual([{ cmd: "add", args: ["NEW_KEY", "--stdin"] }]);
+  });
+
+  test.each(["one\ntwo", "one\rtwo", "one\r\ntwo", "one\n", "one\r"])(
+    "addSecret refuses unsupported CR/LF input before spawning (%j)",
+    async (value) => {
+      await expect(addSecret("NEW_KEY", value)).rejects.toMatchObject({
+        code: "PHANTOM_SECRET_VALUE_UNSUPPORTED",
+      });
+      expect(h.calls()).toEqual([]);
+      expect((await readVault(h.dir)).NEW_KEY).toBeUndefined();
+    },
+  );
+
+  test("the inert producer fixture matches 0.7.9 read_line and CR/LF stripping", async () => {
+    await exec(["add", "DIRECT_KEY", "--stdin"], { stdin: "first\r\nsecond" });
+    expect((await readVault(h.dir)).DIRECT_KEY).toBe("first");
+  });
+
+  test("signal-terminated add fails and never authorizes a later collision", async () => {
+    const bin = join(h.dir, "phantom");
+    const original = readFileSync(bin, "utf8");
+    writeFileSync(
+      bin,
+      '#!/bin/sh\ncase "$1" in --version) echo fixture;; *) kill -TERM $$;; esac\n',
+    );
+    await expect(addSecret("NEW_KEY", "same")).rejects.toMatchObject({
+      code: "PHANTOM_EXEC_FAILED",
+    });
+    writeFileSync(h.vaultPath, JSON.stringify({ NEW_KEY: "foreign" }));
+    writeFileSync(bin, original);
+    await expect(addSecret("NEW_KEY", "same")).rejects.toMatchObject({
+      code: "PHANTOM_SECRET_EXISTS",
+    });
+    expect((await readVault(h.dir)).NEW_KEY).toBe("foreign");
+  });
+
+  test("signal-terminated remove reports failure; subsequent collision still refuses", async () => {
+    await addSecret("NEW_KEY", "same");
+    const bin = join(h.dir, "phantom");
+    const original = readFileSync(bin, "utf8");
+    writeFileSync(bin, "#!/bin/sh\nkill -TERM $$\n");
+    const result = await exec(["remove", "NEW_KEY"], { allowFailure: true });
+    expect(result).toMatchObject({ code: 1, signal: "SIGTERM", completion: "signal" });
+    expect(await removeSecret("NEW_KEY")).toBe(false);
+    writeFileSync(bin, original);
+    await expect(addSecret("NEW_KEY", "same")).rejects.toMatchObject({
+      code: "PHANTOM_SECRET_EXISTS",
+    });
+    expect((await readVault(h.dir)).NEW_KEY).toBe("same");
+  });
+
+  test("collision wording from a killed repeat never becomes confirmed success", async () => {
+    await addSecret("NEW_KEY", "same");
+    const bin = join(h.dir, "phantom");
+    const original = readFileSync(bin, "utf8");
+    writeFileSync(bin, "#!/bin/sh\necho 'already protected' >&2\nkill -TERM $$\n");
+    await expect(addSecret("NEW_KEY", "same")).rejects.toMatchObject({
+      code: "PHANTOM_EXEC_FAILED",
+      message: "Phantom add did not complete; secret storage is unconfirmed.",
+    });
+    writeFileSync(bin, original);
+    await expect(addSecret("NEW_KEY", "same")).rejects.toMatchObject({
+      code: "PHANTOM_SECRET_EXISTS",
+    });
+    expect((await readVault(h.dir)).NEW_KEY).toBe("same");
+  });
+
+  test("null close fields remain unknown without a signal; signals never attest completion", () => {
+    expect(completionForClose(null, null)).toBe("unknown");
+    expect(completionForClose(null, "SIGTERM")).toBe("signal");
+    expect(completionForClose(0, "SIGTERM")).toBe("signal");
+    expect(completionForClose(0, null)).toBe("exited");
+    expect(completionForClose(9, null)).toBe("exited");
+  });
+
+  test("initialization preflight consumes only metadata status", async () => {
+    await assertProjectInitialized(h.dir);
+    expect(h.callsTo("status")).toEqual([{ cmd: "status", args: ["--json"] }]);
+    expect(h.callsTo("list")).toEqual([]);
+    expect(h.callsTo("init")).toEqual([]);
+    expect(h.callsTo("reveal")).toEqual([]);
+    expect(h.callsTo("add")).toEqual([]);
+  });
+
+  test("failed inventory stays unknown instead of appearing empty", async () => {
+    writeFileSync(
+      join(h.dir, "phantom"),
+      '#!/bin/sh\ncase "$1" in --version) echo fixture;; *) exit 9;; esac\n',
+    );
+    await expect(listSecrets()).rejects.toMatchObject({ code: "PHANTOM_METADATA_UNAVAILABLE" });
+  });
+
+  test("addSecret of an existing name fails with PHANTOM_SECRET_EXISTS", async () => {
+    await expect(addSecret("EXISTING_KEY", "other")).rejects.toMatchObject({
+      code: "PHANTOM_SECRET_EXISTS",
+    });
+    expect((await readVault(h.dir)).EXISTING_KEY).toBe("preset-value");
+  });
+
+  test("addSecret refuses identical and different completed repeats", async () => {
+    await addSecret("NEW_KEY", "same");
+    await expect(addSecret("NEW_KEY", "same")).rejects.toMatchObject({
+      code: "PHANTOM_SECRET_EXISTS",
+    });
+    await expect(addSecret("NEW_KEY", "different")).rejects.toMatchObject({
+      code: "PHANTOM_SECRET_EXISTS",
+    });
+  });
+
+  test("revealSecret fails closed without a terminal", async () => {
+    await expect(revealSecret("EXISTING_KEY")).rejects.toMatchObject({
+      code: "PHANTOM_TRUSTED_TERMINAL_REQUIRED",
+    });
   });
 
   test("listSecrets returns vault keys", async () => {
@@ -36,9 +206,57 @@ describe("phantom wrapper against the fake harness", () => {
     expect(keys).toContain("ANOTHER");
   });
 
-  test("removeSecret deletes from the fake vault", async () => {
-    await removeSecret("EXISTING_KEY");
-    const keys = await listSecrets();
-    expect(keys).not.toContain("EXISTING_KEY");
+  test("removeSecret without a terminal reports false and keeps the secret", async () => {
+    expect(await removeSecret("EXISTING_KEY")).toBe(false);
+    expect(await listSecrets()).toContain("EXISTING_KEY");
+  });
+
+  test("countSecrets reports the vault size, including when the install probe is skipped", async () => {
+    expect(await countSecrets()).toBe(1);
+    expect(await countSecrets(undefined, { skipInstallCheck: true })).toBe(1);
+  });
+
+  test("exec timeout kills a hung phantom and the install probe reports not installed", async () => {
+    writeFileSync(join(h.dir, "phantom"), "#!/bin/sh\nexec sleep 5\n");
+    __resetPhantomCache();
+    const started = Date.now();
+    const result = await exec(["--version"], { allowFailure: true, timeoutMs: 200 });
+    expect(result.completion).toBe("signal");
+    expect(result.code).not.toBe(0);
+    expect(result.timedOut).toBe(true);
+    __resetPhantomCache();
+    expect(await probePhantomInstalled({ timeoutMs: 200 })).toBe("timeout");
+    // A timeout is not cached: once Phantom answers, it is installed.
+    writeFileSync(join(h.dir, "phantom"), "#!/bin/sh\necho phantom 0.9.0\n");
+    expect(await probePhantomInstalled({ timeoutMs: 2_000 })).toBe("installed");
+    writeFileSync(join(h.dir, "phantom"), "#!/bin/sh\nexec sleep 5\n");
+    __resetPhantomCache();
+    expect(await isPhantomInstalled({ timeoutMs: 200 })).toBe(false);
+    __resetPhantomCache();
+    await expect(
+      listSecrets(undefined, { skipInstallCheck: true, timeoutMs: 200 }),
+    ).rejects.toBeInstanceOf(PhantomTimeoutError);
+    __resetPhantomCache();
+    expect(await countSecrets(undefined, { skipInstallCheck: true, timeoutMs: 200 })).toBeNull();
+    expect(Date.now() - started).toBeLessThan(2_000);
   });
+  test.skipIf(process.platform === "win32")(
+    "timeout kills a grandchild that holds stdio and settles within the cap",
+    async () => {
+      const pidFile = join(tmpdir(), `stack-grandchild-${process.pid}-${Date.now()}.pid`);
+      writeFileSync(
+        join(h.dir, "phantom"),
+        `#!/bin/sh\nsleep 30 &\necho $! > '${pidFile}'\nwait\n`,
+      );
+      const started = Date.now();
+      const result = await exec(["--version"], { allowFailure: true, timeoutMs: 300 });
+      expect(result.timedOut).toBe(true);
+      expect(Date.now() - started).toBeLessThan(2_500);
+      expect(existsSync(pidFile)).toBe(true);
+      const pid = Number(readFileSync(pidFile, "utf8").trim());
+      expect(pid).toBeGreaterThan(0);
+      await new Promise((r) => setTimeout(r, 100));
+      expect(() => process.kill(pid, 0)).toThrow();
+    },
+  );
 });

package/src/__tests__/phantom-process.test.ts

@@ -0,0 +1,135 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { spawnSync } from "node:child_process";
+import { chmodSync, mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { delimiter, join, resolve } from "node:path";
+import { PhantomNotInstalledError } from "../errors.ts";
+import { phantomEnv, resolvePhantomBinary } from "../phantom-process.ts";
+
+const dirs: string[] = [];
+function tmp(): string {
+  const dir = realpathSync(mkdtempSync(join(tmpdir(), "phantom-process-")));
+  dirs.push(dir);
+  return dir;
+}
+afterEach(() => {
+  for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true });
+});
+const name = process.platform === "win32" ? "phantom.exe" : "phantom";
+function binary(dir: string, script = "#!/bin/sh\nexit 0\n"): string {
+  const path = join(dir, name);
+  writeFileSync(path, script);
+  chmodSync(path, 0o755);
+  return path;
+}
+
+describe("Phantom process boundary", () => {
+  test("environment has an exact allowlist, including only the explicit vault unlock input", () => {
+    const pathEntry = join(tmpdir(), "phantom-env-path");
+    const allowed = {
+      PATH: pathEntry,
+      HOME: "/home/test",
+      USER: "test",
+      USERPROFILE: "C:\\test",
+      SystemRoot: "C:\\Windows",
+      APPDATA: "/app",
+      LOCALAPPDATA: "/local",
+      PATHEXT: ".EXE",
+      XDG_CONFIG_HOME: "/config",
+      XDG_DATA_HOME: "/data",
+      XDG_STATE_HOME: "/state",
+      XDG_RUNTIME_DIR: "/runtime",
+      TMPDIR: "/tmp",
+      TEMP: "/temp",
+      TMP: "/tmp",
+      LANG: "C",
+      LC_ALL: "C",
+      LC_CTYPE: "C",
+      TERM: "dumb",
+      NO_COLOR: "",
+      PHANTOM_VAULT_PASSPHRASE: "synthetic-test-input",
+    };
+    expect(
+      phantomEnv({
+        ...allowed,
+        OPENAI_API_KEY: "synthetic",
+        GITHUB_TOKEN: "synthetic",
+        NODE_OPTIONS: "--inspect",
+        LD_PRELOAD: "/untrusted",
+        DYLD_INSERT_LIBRARIES: "/untrusted",
+        BASH_ENV: "/untrusted",
+        PHANTOM_UNKNOWN: "synthetic",
+        LOCUS_CONTROL_CAPABILITY: "synthetic",
+      }),
+    ).toEqual(allowed);
+    expect(phantomEnv({ HOME: undefined })).toEqual({});
+  });
+
+  test("PATH is normalized: empty entries dropped, relative entries resolved in the caller's cwd", () => {
+    const abs = join(tmpdir(), "phantom-env-abs");
+    expect(phantomEnv({ PATH: `${delimiter}rel${delimiter}${abs}${delimiter}` })).toEqual({
+      PATH: `${resolve("rel")}${delimiter}${abs}`,
+    });
+    expect(phantomEnv({ PATH: delimiter })).toEqual({ PATH: "" });
+  });
+
+  test("resolves the first executable to an absolute path, including relative PATH entries", () => {
+    const root = tmp();
+    const bin = join(root, "bin");
+    mkdirSync(bin);
+    const expected = binary(bin);
+    expect(resolvePhantomBinary({ PATH: `missing${delimiter}bin` }, root)).toBe(expected);
+    expect(resolvePhantomBinary({ PATH: `${bin}${delimiter}${tmp()}` })).toBe(expected);
+  });
+
+  test("missing PATH, empty entries and directories fail closed", () => {
+    const root = tmp();
+    binary(root);
+    expect(() => resolvePhantomBinary({}, root)).toThrow(PhantomNotInstalledError);
+    expect(() => resolvePhantomBinary({ PATH: delimiter }, root)).toThrow(PhantomNotInstalledError);
+    const bin = tmp();
+    mkdirSync(join(bin, name));
+    expect(() => resolvePhantomBinary({ PATH: bin })).toThrow(PhantomNotInstalledError);
+  });
+
+  test.skipIf(process.platform === "win32")(
+    "non-executable files do not shadow an installation",
+    () => {
+      const first = tmp();
+      chmodSync(binary(first), 0o644);
+      const second = tmp();
+      const expected = binary(second);
+      expect(resolvePhantomBinary({ PATH: `${first}${delimiter}${second}` })).toBe(expected);
+    },
+  );
+
+  test.skipIf(process.platform === "win32")(
+    "exec uses the resolved path across cwd changes and filters the actual child env",
+    () => {
+      const root = tmp();
+      const bin = join(root, "bin");
+      mkdirSync(bin);
+      const childCwd = tmp();
+      const expected = binary(
+        bin,
+        `#!/bin/sh
+[ -z "\${OPENAI_API_KEY+x}" ] || exit 21
+[ -z "\${BASH_ENV+x}" ] || exit 22
+[ "$HOME" = "$1" ] || exit 23
+printf '%s' "$0"
+`,
+      );
+      const modulePath = new URL("../phantom.ts", import.meta.url).href;
+      const script = `import { exec } from ${JSON.stringify(modulePath)};
+const r = await exec([${JSON.stringify(root)}], { cwd: ${JSON.stringify(childCwd)} });
+process.stdout.write(r.stdout);`;
+      const r = spawnSync(process.execPath, ["--eval", script], {
+        cwd: root,
+        encoding: "utf8",
+        env: { HOME: root, PATH: "bin", OPENAI_API_KEY: "synthetic", BASH_ENV: "/nonexistent" },
+      });
+      expect(r.status).toBe(0);
+      expect(r.stdout).toBe(expected);
+    },
+  );
+});