@omega.js/desktop 0.1.0

package/dist/test/suites/build/sanitize-signing-env.test.js

@@ -0,0 +1,98 @@
+// sanitize-signing-env tests — empty-string signing placeholders read as
+// unset (app-builder-lib would otherwise path.resolve('') to the project root
+// and fail with "<projectRoot> not a file").
+
+const sanitizeSigningEnv = require('../../../utils/sanitize-signing-env.js');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+module.exports = defineCases({
+  type: 'group',
+  layer: 'build',
+  description: 'sanitize-signing-env',
+  tests: [
+    {
+      name: 'deletes empty-string signing keys and reports them',
+      run: (ctx) => {
+        const env = { CSC_LINK: '', CSC_KEY_PASSWORD: '', PATH: '/usr/bin' };
+        const removed = sanitizeSigningEnv(env);
+
+        ctx.expect(removed.sort()).toEqual(['CSC_KEY_PASSWORD', 'CSC_LINK']);
+        ctx.expect('CSC_LINK' in env).toBe(false);
+        ctx.expect('CSC_KEY_PASSWORD' in env).toBe(false);
+        ctx.expect(env.PATH).toBe('/usr/bin');
+      },
+    },
+    {
+      name: 'whitespace-only values count as empty',
+      run: (ctx) => {
+        const env = { WIN_CSC_LINK: '   ', APPLE_API_KEY: '\t' };
+        const removed = sanitizeSigningEnv(env);
+
+        ctx.expect(removed.sort()).toEqual(['APPLE_API_KEY', 'WIN_CSC_LINK']);
+        ctx.expect('WIN_CSC_LINK' in env).toBe(false);
+      },
+    },
+    {
+      name: 'the Windows signing keys are covered; the retired runner-logon keys are not',
+      run: (ctx) => {
+        // The self-hosted signer reads all of these; an empty placeholder on any
+        // of them used to survive into signtool's arguments as an empty string.
+        const env = {
+          WIN_EV_TOKEN_PATH:    '',
+          WIN_CSC_KEY_PASSWORD: '  ',
+          WIN_TIMESTAMP_URL:    '',
+          SIGNTOOL_PATH:        '',
+        };
+        const removed = sanitizeSigningEnv(env);
+
+        ctx.expect(removed.sort()).toEqual([
+          'SIGNTOOL_PATH',
+          'WIN_CSC_KEY_PASSWORD',
+          'WIN_EV_TOKEN_PATH',
+          'WIN_TIMESTAMP_URL',
+        ]);
+        ctx.expect(Object.keys(env).length).toBe(0);
+
+        // The runner logon keys are retired ([#337]) — the runner has no service
+        // and no task to hand an account to, so nothing reads them.
+        ctx.expect(sanitizeSigningEnv.SIGNING_ENV_KEYS).not.toContain('WIN_RUNNER_LOGON_ACCOUNT');
+        ctx.expect(sanitizeSigningEnv.SIGNING_ENV_KEYS).not.toContain('WIN_RUNNER_LOGON_PASSWORD');
+      },
+    },
+    {
+      name: 'real values are NEVER touched',
+      run: (ctx) => {
+        const env = {
+          CSC_LINK: 'config/certs/developer-id-application.p12',
+          CSC_KEY_PASSWORD: 'hunter2',
+          APPLE_TEAM_ID: 'ABCDE12345',
+        };
+        const removed = sanitizeSigningEnv(env);
+
+        ctx.expect(removed).toEqual([]);
+        ctx.expect(env.CSC_LINK).toBe('config/certs/developer-id-application.p12');
+        ctx.expect(env.CSC_KEY_PASSWORD).toBe('hunter2');
+        ctx.expect(env.APPLE_TEAM_ID).toBe('ABCDE12345');
+      },
+    },
+    {
+      name: 'unset keys stay unset (no accidental creation)',
+      run: (ctx) => {
+        const env = {};
+        const removed = sanitizeSigningEnv(env);
+
+        ctx.expect(removed).toEqual([]);
+        ctx.expect(Object.keys(env).length).toBe(0);
+      },
+    },
+    {
+      name: 'non-string values (paranoia) are left alone',
+      run: (ctx) => {
+        const env = { CSC_LINK: undefined };
+        sanitizeSigningEnv(env);
+        // The key exists with undefined — typeof undefined !== 'string', untouched.
+        ctx.expect('CSC_LINK' in env).toBe(true);
+      },
+    },
+  ],
+});

package/dist/test/suites/build/sanitize-url.test.js

@@ -0,0 +1,78 @@
+// sanitize-url tests — zero-trust URL gate for shell.openExternal and friends.
+
+const sanitizeURL = require('../../../utils/sanitize-url.js');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+module.exports = defineCases({
+  type: 'group',
+  layer: 'build',
+  description: 'sanitize-url',
+  tests: [
+    {
+      name: 'passes http:// URLs through unchanged',
+      run: (ctx) => {
+        ctx.expect(sanitizeURL('http://example.com')).toBe('http://example.com');
+        ctx.expect(sanitizeURL('http://example.com/path?q=1#x')).toBe('http://example.com/path?q=1#x');
+      },
+    },
+    {
+      name: 'passes https:// URLs through unchanged',
+      run: (ctx) => {
+        ctx.expect(sanitizeURL('https://example.com')).toBe('https://example.com');
+        ctx.expect(sanitizeURL('https://localhost:4000/dashboard')).toBe('https://localhost:4000/dashboard');
+      },
+    },
+    {
+      name: 'blocks javascript: protocol',
+      run: (ctx) => {
+        ctx.expect(sanitizeURL('javascript:alert(1)')).toBe('');
+        ctx.expect(sanitizeURL('JAVASCRIPT:alert(1)')).toBe('');
+        ctx.expect(sanitizeURL('  javascript:alert(1)')).toBe('');
+      },
+    },
+    {
+      name: 'blocks data: protocol',
+      run: (ctx) => {
+        ctx.expect(sanitizeURL('data:text/html,<script>alert(1)</script>')).toBe('');
+      },
+    },
+    {
+      name: 'blocks file: protocol',
+      run: (ctx) => {
+        ctx.expect(sanitizeURL('file:///etc/passwd')).toBe('');
+      },
+    },
+    {
+      name: 'blocks vbscript: protocol',
+      run: (ctx) => {
+        ctx.expect(sanitizeURL('vbscript:msgbox(1)')).toBe('');
+      },
+    },
+    {
+      name: 'blocks custom schemes (mailto, restart-manager, chrome)',
+      run: (ctx) => {
+        ctx.expect(sanitizeURL('mailto:foo@bar.com')).toBe('');
+        ctx.expect(sanitizeURL('restart-manager://message?command=register')).toBe('');
+        ctx.expect(sanitizeURL('chrome://settings')).toBe('');
+      },
+    },
+    {
+      name: 'returns empty for non-string inputs',
+      run: (ctx) => {
+        ctx.expect(sanitizeURL(null)).toBe('');
+        ctx.expect(sanitizeURL(undefined)).toBe('');
+        ctx.expect(sanitizeURL('')).toBe('');
+        ctx.expect(sanitizeURL(123)).toBe('');
+        ctx.expect(sanitizeURL({})).toBe('');
+        ctx.expect(sanitizeURL([])).toBe('');
+      },
+    },
+    {
+      name: 'returns empty for malformed URLs',
+      run: (ctx) => {
+        ctx.expect(sanitizeURL('not a url')).toBe('');
+        ctx.expect(sanitizeURL('://no-protocol')).toBe('');
+      },
+    },
+  ],
+});

package/dist/test/suites/build/secure-remote-url.test.js

@@ -0,0 +1,42 @@
+// Build-layer unit tests for utils/secure-remote-url.js — the transport gate
+// shared by lib/remote-scripts.js and lib/remote-config.js.
+
+const { isSecureRemoteUrl } = require('../../../utils/secure-remote-url.js');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'secure-remote-url (build)',
+  tests: [
+    {
+      name: 'https URLs pass',
+      run: (ctx) => {
+        ctx.expect(isSecureRemoteUrl('https://brand.example/data/scripts/main.js')).toBe(true);
+      },
+    },
+    {
+      name: 'http URLs fail on non-loopback hosts',
+      run: (ctx) => {
+        ctx.expect(isSecureRemoteUrl('http://brand.example/data/scripts/main.js')).toBe(false);
+      },
+    },
+    {
+      name: 'http loopback allowed for dev (localhost, 127.0.0.1, ::1)',
+      run: (ctx) => {
+        ctx.expect(isSecureRemoteUrl('http://localhost:4000/main.js')).toBe(true);
+        ctx.expect(isSecureRemoteUrl('http://127.0.0.1/main.js')).toBe(true);
+        ctx.expect(isSecureRemoteUrl('http://[::1]:4000/main.js')).toBe(true);
+      },
+    },
+    {
+      name: 'non-http(s) schemes and unparseable URLs fail closed',
+      run: (ctx) => {
+        ctx.expect(isSecureRemoteUrl('file:///etc/hosts')).toBe(false);
+        ctx.expect(isSecureRemoteUrl('ftp://brand.example/x')).toBe(false);
+        ctx.expect(isSecureRemoteUrl('not a url')).toBe(false);
+        ctx.expect(isSecureRemoteUrl('')).toBe(false);
+      },
+    },
+  ],
+});

package/dist/test/suites/build/sentry.test.js

@@ -0,0 +1,89 @@
+// Build-layer tests for the desktop's error-reporting WIRING (#380).
+//
+// The policy itself — config gating, the dev/kill switches, user normalization,
+// release tagging — is @omega.js/monitoring's, proven by its own suite
+// (packages/monitoring/test/). What belongs here is the desktop half: the
+// package entry resolves in a main-process context, the manager's `sentry`
+// surface is the one every lib calls, and a brand with no DSN gets a silent
+// no-op instead of a crash.
+
+const path = require('path');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+const FRAMEWORK_ROOT = path.join(__dirname, '..', '..', '..', '..');
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'sentry — the @omega.js/monitoring wiring',
+  tests: [
+    {
+      name: 'the package entry resolves to the main-process module outside a renderer',
+      run: (ctx) => {
+        const sentry = require('../../../vendor/monitoring/index.js');
+        ctx.expect(sentry).toBe(require('../../../vendor/monitoring/main.js'));
+        ctx.expect(typeof sentry.initialize).toBe('function');
+        ctx.expect(typeof sentry.captureException).toBe('function');
+        ctx.expect(typeof sentry.captureMessage).toBe('function');
+        ctx.expect(typeof sentry.setUser).toBe('function');
+      },
+    },
+    {
+      name: 'a desktop config with no DSN initializes to disabled',
+      run: (ctx) => {
+        const main = require('../../../vendor/monitoring/main.js');
+        main.shutdown();
+        main.initialize({ config: { monitoring: { providers: { sentry: { dsn: '' } } } }, getVersion: () => '1.0.0' });
+        ctx.expect(main._initialized).toBe(true);
+        ctx.expect(main._enabled).toBe(false);
+      },
+    },
+    {
+      name: 'every call on a disabled sentry is a no-op, never a throw',
+      run: (ctx) => {
+        const main = require('../../../vendor/monitoring/main.js');
+        main.shutdown();
+        let threw;
+        try {
+          main.captureException(new Error('test'));
+          main.captureMessage('test');
+          // client-bridge calls this on every auth change — a documented no-op when off.
+          main.setUser({ uid: 'abc', email: 'user@example.com' });
+        } catch (e) {
+          threw = e;
+        }
+        ctx.expect(threw).toBeUndefined();
+      },
+    },
+    {
+      // The renderer's @omega.js/client tags every report `<brand.id>@<version>`
+      // and falls back to the build stamp with no version. The bake is the
+      // renderer's ONLY channel and it hands the client `buildJson.config`
+      // alone — so the app's version has to ride INSIDE that object, not only
+      // in the sibling `package` key.
+      name: 'the bundle bake folds the app version into the config the renderer hands the client',
+      run: (ctx) => {
+        const { composeBuildConfig } = require(path.join(FRAMEWORK_ROOT, 'src', 'gulp', 'tasks', 'bundle.js'));
+
+        const packaged = composeBuildConfig({ brand: { id: 'paperloom' } }, null, { version: '3.1.4' });
+        ctx.expect(packaged.version).toBe('3.1.4');
+        ctx.expect(packaged.brand.id).toBe('paperloom');
+        ctx.expect(packaged.dev).toBeUndefined();
+
+        // A dev build carries the resolved local-stack map beside it (#300).
+        const local = composeBuildConfig({ brand: { id: 'paperloom' } }, { ports: { auth: 9099 } }, { version: '3.1.4' });
+        ctx.expect(local.version).toBe('3.1.4');
+        ctx.expect(local.dev.ports.auth).toBe(9099);
+      },
+    },
+    {
+      name: 'the preload surface is reachable and silent when disabled',
+      run: (ctx) => {
+        const preload = require('../../../vendor/monitoring/preload.js');
+        preload.initialize({ config: { monitoring: { providers: { sentry: { dsn: '' } } } } });
+        ctx.expect(preload._enabled).toBe(false);
+        preload.captureException(new Error('test'));
+      },
+    },
+  ],
+});

package/dist/test/suites/build/serve-resolve-electron.test.js

@@ -0,0 +1,58 @@
+// Build-layer tests for gulp/serve's electron resolution.
+//
+// The launch used to require `<projectRoot>/node_modules/electron` by path, which never
+// exists in an npm-workspaces brand (electron hoists to the brand root). We stage that exact
+// shape in a temp dir — a hoisted electron, a target dir with none — and resolve from the app.
+
+const path    = require('path');
+const fs      = require('fs');
+const os      = require('os');
+const jetpack = require('fs-jetpack');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+const servePath = path.join(__dirname, '..', '..', '..', 'gulp', 'tasks', 'serve.js');
+
+const SENTINEL = '/staged/electron/binary';
+
+// Brand root with a hoisted electron; the target underneath carries none of its own.
+function stageHoistedBrand() {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-serve-'));
+  const pkg = path.join(tmp, 'node_modules', 'electron');
+
+  jetpack.write(path.join(pkg, 'package.json'), JSON.stringify({ name: 'electron', version: '0.0.0', main: 'index.js' }));
+  jetpack.write(path.join(pkg, 'index.js'), `module.exports = ${JSON.stringify(SENTINEL)};\n`);
+  jetpack.dir(path.join(tmp, 'targets', 'desktop'));
+
+  return { tmp, targetDir: path.join(tmp, 'targets', 'desktop') };
+}
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'gulp/serve — electron resolution',
+  tests: [
+    {
+      name: 'resolveElectron finds the brand-hoisted electron from a target with none',
+      run: (ctx) => {
+        const { targetDir } = stageHoistedBrand();
+        const { resolveElectron } = require(servePath);
+
+        ctx.expect(resolveElectron(targetDir)).toBe(SENTINEL);
+      },
+    },
+    {
+      name: 'the old app-local path join cannot see the hoisted copy',
+      run: (ctx) => {
+        const { targetDir } = stageHoistedBrand();
+
+        let error = null;
+        try {
+          require(path.join(targetDir, 'node_modules', 'electron'));
+        } catch (e) {
+          error = e;
+        }
+        ctx.expect(error && error.code).toBe('MODULE_NOT_FOUND');
+      },
+    },
+  ],
+});

package/dist/test/suites/build/setup-scripts.test.js

@@ -0,0 +1,172 @@
+// Build-layer tests for ensure-target's package.json write (#590, twin of #572).
+//
+// `jetpack.write(path, object)` serializes with no trailing newline, and the
+// write used to happen unconditionally — so every build re-stripped the newline
+// npm itself writes, and the consumer's lint hook or editor put it back, forever.
+// It matters more since #675: this write now runs on EVERY verb.
+//
+// setupScripts defaults to the cwd project, so each test stages a temp project,
+// chdirs into it, and requires the module fresh.
+
+const path = require('path');
+const fs   = require('fs');
+const os   = require('os');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+const SRC        = path.join(__dirname, '..', '..', '..');
+const SETUP_PATH = path.join(SRC, 'commands', 'lib', 'ensure-target.js');
+
+const CONSUMER_PKG = {
+  name: 'staged-app',
+  version: '3.1.4',
+  scripts: { start: 'echo consumer' },
+  devDependencies: { '@omega.js/desktop': '^0.1.0' },
+};
+
+// Stage a temp consumer project holding `pkg`, written the way npm writes it.
+function stageProject(pkg) {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-setup-scripts-'));
+  fs.writeFileSync(path.join(tmp, 'package.json'), `${JSON.stringify(pkg, null, 2)}\n`);
+  return tmp;
+}
+
+// Run `fn(setup)` with cwd pinned to `dir` and the command module loaded fresh.
+async function inProject(dir, fn) {
+  const oldCwd = process.cwd();
+  const flush = () => {
+    for (const key of Object.keys(require.cache)) {
+      if (key.startsWith(SRC + path.sep)) delete require.cache[key];
+    }
+  };
+
+  flush();
+  try {
+    process.chdir(dir);
+    return await fn(require(SETUP_PATH));
+  } finally {
+    process.chdir(oldCwd);
+    flush();
+  }
+}
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'ensure-target — the consumer package.json write',
+  tests: [
+    {
+      name: 'the written package.json ends with exactly one trailing newline (#590)',
+      run: async (ctx) => {
+        const tmp = stageProject(CONSUMER_PKG);
+        const pkgPath = path.join(tmp, 'package.json');
+
+        try {
+          await inProject(tmp, async (setup) => {
+            setup.setupScripts();
+
+            const contents = fs.readFileSync(pkgPath, 'utf8');
+            ctx.expect(contents.endsWith('}\n')).toBe(true);
+            ctx.expect(contents.endsWith('}\n\n')).toBe(false);
+
+            // The framework's project scripts landed, npm's own 2-space shape kept
+            const written = JSON.parse(contents);
+            ctx.expect(written.scripts.build).toBe('omega build');
+            ctx.expect(written.private).toBe(true);
+            ctx.expect(written.main).toBe('dist/main.bundle.js');
+            ctx.expect(contents).toContain('\n  "name": "staged-app"');
+          });
+        } finally {
+          fs.rmSync(tmp, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'an unchanged package.json is not rewritten (#590)',
+      run: async (ctx) => {
+        const tmp = stageProject(CONSUMER_PKG);
+        const pkgPath = path.join(tmp, 'package.json');
+
+        try {
+          await inProject(tmp, async (setup) => {
+            setup.setupScripts();
+            const afterFirst = fs.readFileSync(pkgPath, 'utf8');
+
+            // Backdate the file: a second setup that writes shows up as a new mtime
+            const past = new Date(Date.now() - 60000);
+            fs.utimesSync(pkgPath, past, past);
+
+            setup.setupScripts();
+
+            ctx.expect(Math.round(fs.statSync(pkgPath).mtimeMs)).toBe(Math.round(past.getTime()));
+            ctx.expect(fs.readFileSync(pkgPath, 'utf8')).toBe(afterFirst);
+          });
+        } finally {
+          fs.rmSync(tmp, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'a package.json that DID change is written (#590)',
+      run: async (ctx) => {
+        const tmp = stageProject(CONSUMER_PKG);
+        const pkgPath = path.join(tmp, 'package.json');
+
+        try {
+          await inProject(tmp, async (setup) => {
+            setup.setupScripts();
+
+            // A consumer edit setup has to heal — the skip is content-based, not a latch
+            const drifted = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+            drifted.scripts.build = 'echo hand-edited';
+            fs.writeFileSync(pkgPath, `${JSON.stringify(drifted, null, 2)}\n`);
+
+            setup.setupScripts();
+
+            const healed = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+            ctx.expect(healed.scripts.build).toBe('omega build');
+            ctx.expect(fs.readFileSync(pkgPath, 'utf8').endsWith('}\n')).toBe(true);
+          });
+        } finally {
+          fs.rmSync(tmp, { recursive: true, force: true });
+        }
+      },
+    },
+    {
+      name: 'a target still carrying the `npx omega` spelling heals to the bare verb (#748)',
+      run: async (ctx) => {
+        // Package scripts spell the verb bare, web's form — the `npx` prefix
+        // is redundant inside a script (npm puts node_modules/.bin on the
+        // path) and stays canonical only for docs and the terminal. Every
+        // framework-owned key is rewritten on the next verb's ensure pass.
+        const tmp = stageProject({
+          ...CONSUMER_PKG,
+          scripts: { ...CONSUMER_PKG.scripts, build: 'npx omega build', test: 'npx omega test', lint: 'npx eslint .' },
+        });
+        const pkgPath = path.join(tmp, 'package.json');
+
+        try {
+          await inProject(tmp, async (setup) => {
+            setup.setupScripts();
+
+            const healed = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+            ctx.expect(healed.scripts.build).toBe('omega build');
+            ctx.expect(healed.scripts.test).toBe('omega test');
+            ctx.expect(healed.scripts.lint).toBe('npx eslint .');
+
+            // Converged: the second pass writes nothing at all
+            const afterFirst = fs.readFileSync(pkgPath, 'utf8');
+            const past = new Date(Date.now() - 60000);
+            fs.utimesSync(pkgPath, past, past);
+
+            setup.setupScripts();
+
+            ctx.expect(Math.round(fs.statSync(pkgPath).mtimeMs)).toBe(Math.round(past.getTime()));
+            ctx.expect(fs.readFileSync(pkgPath, 'utf8')).toBe(afterFirst);
+          });
+        } finally {
+          fs.rmSync(tmp, { recursive: true, force: true });
+        }
+      },
+    },
+  ],
+});

package/dist/test/suites/build/sign-events.test.js

@@ -0,0 +1,90 @@
+// Build-layer tests for the signing event log. Two things matter and neither
+// needs a Windows box: WHERE the file lands, and that a first write into a
+// directory nobody created yet actually lands instead of being dropped.
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+const eventsPath = path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'sign-events.js');
+const runner     = require(path.join(__dirname, '..', '..', '..', 'commands', 'runner.js'));
+const signEvents = require(eventsPath);
+
+module.exports = defineCases({
+  type: 'group',
+  layer: 'build',
+  description: 'sign-events — log path resolution + first write',
+  tests: [
+    {
+      name: 'OMEGA_SIGN_LOG wins over everything',
+      run: (ctx) => {
+        ctx.expect(signEvents.resolveLogPath({
+          OMEGA_SIGN_LOG:    '/tmp/explicit.log',
+          OMEGA_RUNNER_HOME: '/tmp/home',
+        }, 'win32')).toBe('/tmp/explicit.log');
+      },
+    },
+    {
+      name: 'OMEGA_RUNNER_HOME is next — the log sits beside the runner it belongs to',
+      run: (ctx) => {
+        ctx.expect(signEvents.resolveLogPath({ OMEGA_RUNNER_HOME: '/tmp/home' }, 'win32'))
+          .toBe(path.join('/tmp/home', 'omega-signing.log'));
+      },
+    },
+    {
+      name: 'the Windows default follows defaultRunnerHome(), not a hardcoded C:\\actions-runners',
+      run: (ctx) => {
+        // The regression: this used to return C:\actions-runners\omega-signing.log,
+        // a path the per-user install stopped creating in any version, so every
+        // event was dropped on a box that had not set OMEGA_RUNNER_HOME.
+        const env = { LOCALAPPDATA: path.join('C:', 'Users', 'ian', 'AppData', 'Local') };
+        ctx.expect(signEvents.resolveLogPath(env, 'win32'))
+          .toBe(path.join(runner.defaultRunnerHome('win32', env), 'omega-signing.log'));
+        ctx.expect(signEvents.resolveLogPath(env, 'win32')).not.toMatch(/actions-runners/);
+      },
+    },
+    {
+      name: 'off Windows: the CI root, then logs/signing.log',
+      run: (ctx) => {
+        ctx.expect(signEvents.resolveLogPath({ RUNNER_WORKSPACE: '/ci/work' }, 'darwin'))
+          .toBe(path.join('/ci/work', 'omega-signing.log'));
+        ctx.expect(signEvents.resolveLogPath({}, 'darwin'))
+          .toBe(path.join(process.cwd(), 'logs', 'signing.log'));
+      },
+    },
+    {
+      name: 'the first emit creates the parent directory instead of dropping the event',
+      run: (ctx) => {
+        const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'omega-sign-events-'));
+        const target  = path.join(scratch, 'never-created', 'omega-signing.log');
+        const origLog = process.env.OMEGA_SIGN_LOG;
+
+        // Re-require the module so it resolves against our scratch path — this
+        // exercises the real emit(), not a test-only seam.
+        const resolved = require.resolve(eventsPath);
+        delete require.cache[resolved];
+        process.env.OMEGA_SIGN_LOG = target;
+
+        try {
+          const fresh = require(resolved);
+          ctx.expect(fresh.getLogPath()).toBe(target);
+          fresh.emit('sign-start', { file: 'App.exe', mode: 'thumbprint' });
+
+          ctx.expect(fs.existsSync(target)).toBe(true);
+          const written = JSON.parse(fs.readFileSync(target, 'utf8').trim());
+          ctx.expect(written.event).toBe('sign-start');
+          ctx.expect(written.file).toBe('App.exe');
+          ctx.expect(written.mode).toBe('thumbprint');
+          ctx.expect(typeof written.ts).toBe('string');
+        } finally {
+          delete require.cache[resolved];
+          if (origLog === undefined) delete process.env.OMEGA_SIGN_LOG;
+          else process.env.OMEGA_SIGN_LOG = origLog;
+          require(resolved);   // restore the process-wide instance
+          fs.rmSync(scratch, { recursive: true, force: true });
+        }
+      },
+    },
+  ],
+});