@omega.js/desktop 0.50.0 → 0.51.0

package/dist/test/suites/build/build-verbs.test.js

@@ -1,10 +1,11 @@
 // Build-layer tests for the canonical build verbs (build / package / publish).
 // The synced projectScripts are thin `omega <verb>` aliases, so each verb must
-// run the pipeline ITSELF — clean, certs, gulp task — and never shell back to
+// run the pipeline ITSELF (clean, gulp task) and never shell back to
 // `npm run build` / `npm run publish` (that would recurse forever).
 //
 // There is no `setup` step (#675): the local scaffold runs inside the gulp
-// `defaults` task. `certs` delivers the Apple signing artifacts (#678).
+// `defaults` task. Nothing COPIES signing material any more (#891): the tree
+// is read in place and the env load derived the paths to it.
 
 const path = require('path');
 const fs   = require('fs');
@@ -26,14 +27,18 @@ function recorder(log) {
   const record = (type) => (options, step) => { log.push(step.task ? `${type}:${step.task}` : type); };
   return {
     clean: record('clean'),
-    certs: record('certs'),
+    'ship-keys': record('ship-keys'),
     'validate-certs': record('validate-certs'),
     gulp: record('gulp'),
   };
 }
 
 async function withEnv(run) {
-  const keys = ['OMEGA_BUILD_MODE', 'OMEGA_IS_PUBLISH'];
+  // OMEGA_ENVIRONMENT rides the list because it is the ONE environment input
+  // ([#817](https://github.com/Omega-JS-Stack/omega/issues/817)) and
+  // src/build.js WRITES it at load from the lane, so clearing a lane flag
+  // without clearing it leaves the previous lane's word in the process.
+  const keys = ['OMEGA_ENVIRONMENT', 'OMEGA_BUILD_MODE', 'OMEGA_IS_PUBLISH'];
   const previous = keys.map((key) => [key, process.env[key]]);
   keys.forEach((key) => delete process.env[key]);
   try {
@@ -51,21 +56,21 @@ module.exports = defineCases({
   description: 'build verbs — the CLI owns the pipeline and its env flags',
   tests: [
     {
-      name: 'build: OMEGA_BUILD_MODE + clean → certs → gulp build',
+      name: 'build: OMEGA_BUILD_MODE + clean → gulp build',
       run: (ctx) => {
         const plan = build.plan({});
         ctx.expect(plan.env.OMEGA_BUILD_MODE).toBe('true');
         ctx.expect(plan.steps.map((s) => (s.task ? `${s.type}:${s.task}` : s.type)))
-          .toEqual(['clean', 'certs', 'gulp:build']);
+          .toEqual(['clean', 'gulp:build']);
       },
     },
     {
-      name: 'package: OMEGA_BUILD_MODE + clean → certs → gulp packageBuild',
+      name: 'package: OMEGA_BUILD_MODE + clean → gulp packageBuild',
       run: (ctx) => {
         const plan = pkg.plan({});
         ctx.expect(plan.env.OMEGA_BUILD_MODE).toBe('true');
         ctx.expect(plan.steps.map((s) => (s.task ? `${s.type}:${s.task}` : s.type)))
-          .toEqual(['clean', 'certs', 'gulp:packageBuild']);
+          .toEqual(['clean', 'gulp:packageBuild']);
       },
     },
     {
@@ -73,26 +78,54 @@ module.exports = defineCases({
       run: (ctx) => {
         const plan = pkg.plan({ quick: true });
         ctx.expect(plan.steps.map((s) => (s.task ? `${s.type}:${s.task}` : s.type)))
-          .toEqual(['clean', 'certs', 'gulp:packageQuick']);
-        ctx.expect(pkg.plan({ q: true }).steps[2].task).toBe('packageQuick');
+          .toEqual(['clean', 'gulp:packageQuick']);
+        ctx.expect(pkg.plan({ q: true }).steps[1].task).toBe('packageQuick');
       },
     },
     {
-      name: 'publish: both flags + certs → validate-certs → gulp publish (no clean)',
+      name: 'publish: both flags + ship-keys → validate-certs → gulp publish (no clean)',
       run: (ctx) => {
         const plan = publish.plan({});
         ctx.expect(plan.env.OMEGA_BUILD_MODE).toBe('true');
         ctx.expect(plan.env.OMEGA_IS_PUBLISH).toBe('true');
         ctx.expect(plan.steps.map((s) => (s.task ? `${s.type}:${s.task}` : s.type)))
-          .toEqual(['certs', 'validate-certs', 'gulp:publish']);
+          .toEqual(['ship-keys', 'validate-certs', 'gulp:publish']);
       },
     },
     {
-      name: 'publish --local: clean → certs → validate-certs → gulp publish',
+      name: 'publish --local: clean → ship-keys → validate-certs → gulp publish',
       run: (ctx) => {
         const plan = publish.plan({ local: true });
         ctx.expect(plan.steps.map((s) => (s.task ? `${s.type}:${s.task}` : s.type)))
-          .toEqual(['clean', 'certs', 'validate-certs', 'gulp:publish']);
+          .toEqual(['clean', 'ship-keys', 'validate-certs', 'gulp:publish']);
+      },
+    },
+    // #867: a shipped format with no credential is a release that dies on a
+    // runner, so publish refuses FIRST, before a minute of build time, naming
+    // the key, the declaration that requires it, and the walk that collects it.
+    // The SAME JS runs in both lanes: CI's `npm run release:local` is this verb.
+    {
+      name: 'publish refuses a declared format with no ship credential, naming the key and the walk (#867)',
+      run: (ctx) => {
+        const { assertShipKeys } = require(path.join(__dirname, '..', '..', '..', 'utils', 'ship-keys.js'));
+        const config = { platforms: { linux: { formats: { snap: { channels: ['stable'] } } } } };
+
+        let message = '';
+        try {
+          assertShipKeys({ config, env: {} });
+        } catch (error) {
+          message = error.message;
+        }
+
+        ctx.expect(message).toContain('SNAPCRAFT_STORE_CREDENTIALS (required by platforms.linux.formats.snap)');
+        ctx.expect(message).toContain('omega manage --service publishing');
+
+        // With the credential, the same declaration ships
+        ctx.expect(assertShipKeys({ config, env: { SNAPCRAFT_STORE_CREDENTIALS: 'blob' } }).length > 0).toBe(true);
+
+        // And a brand that never mentions the snap owes nothing: the default
+        // format is on, but nothing in its config makes the credential due
+        ctx.expect(assertShipKeys({ config: {}, env: {} }).length > 0).toBe(true);
       },
     },
     {
@@ -104,7 +137,7 @@ module.exports = defineCases({
           ctx.expect(process.env.OMEGA_BUILD_MODE).toBe('true');
           ctx.expect(process.env.OMEGA_IS_PUBLISH).toBe('true');
         });
-        ctx.expect(log).toEqual(['clean', 'certs', 'validate-certs', 'gulp:publish']);
+        ctx.expect(log).toEqual(['clean', 'ship-keys', 'validate-certs', 'gulp:publish']);
       },
     },
     {

package/dist/test/suites/build/build-workflow-jobs.test.js

@@ -17,6 +17,7 @@ const jetpack = require('fs-jetpack');
 const yaml = require('js-yaml');
 
 const { copyDefaults } = require('../../../commands/lib/ensure-target.js');
+const { composeWorkflow } = require('../../../vendor/devkit/ci-workflows.js');
 const defineCases = require('../../../vendor/devkit/test/define-cases.js');
 
 // GitHub takes `needs` as a string or as a list; the graph question is the same.
@@ -51,5 +52,194 @@ module.exports = defineCases({
         ctx.expect(needsOf(jobs['windows-strategy'])).toContain('build');
       },
     },
+    // The Windows legs of this workflow force `shell: cmd`
+    // ([#872](https://github.com/Omega-JS-Stack/omega/issues/872)), and cmd cannot
+    // execute the extension-less `sfw` Socket's action caches on Windows: every
+    // windows job died on `'sfw' is not recognized`. devkit renders the shim that
+    // copies the binary to `sfw.exe` beside the action step, so the check is on the
+    // WRITTEN file, standalone and composed alike.
+    {
+      name: 'every job that runs sfw carries the Windows cmd shim, standalone and composed (#872)',
+      run: async (ctx) => {
+        const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-workflow-firewall-'));
+        await copyDefaults(tmp);
+        const scaffolded = jetpack.read(path.join(tmp, '.github', 'workflows', 'build.yml'));
+
+        for (const workflow of [scaffolded, composeWorkflow(scaffolded, { targetPath: 'targets/desktop', targetName: 'desktop' })]) {
+          // A step the shim broke would not parse at all, so the parse IS an assertion
+          const { jobs } = yaml.load(workflow);
+
+          for (const job of Object.values(jobs)) {
+            const steps = job.steps || [];
+            const install = steps.findIndex((step) => /\bsfw npm(?:\.cmd)? (ci|install)\b/.test(String(step.run || '')));
+            if (install === -1) {
+              continue;
+            }
+
+            const firewall = steps.findIndex((step) => String(step.uses || '').startsWith('SocketDev/action@'));
+            const shim = steps.findIndex((step) => String(step.run || '').includes('firewall-path-binary'));
+
+            ctx.expect(firewall).not.toBe(-1);
+            ctx.expect(shim).not.toBe(-1);
+            ctx.expect(firewall < shim && shim < install).toBe(true);
+            ctx.expect(steps[shim].shell).toBe('cmd');
+            ctx.expect(steps[shim].if).toContain('Windows');
+          }
+        }
+
+        fs.rmSync(tmp, { recursive: true, force: true });
+      },
+    },
+    // The workflow env carries the mac credentials as the base64 secrets themselves,
+    // and only the mac job decodes them to disk
+    // ([#872](https://github.com/Omega-JS-Stack/omega/issues/872)). A leg that never
+    // signs for mac must not hold them: electron-builder would sign with the cert,
+    // and the precheck would be handed a .p8 no filesystem can answer for.
+    {
+      name: 'the mac credentials are blanked on the linux and windows legs, and gated on mac (#872)',
+      run: async (ctx) => {
+        const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-workflow-creds-'));
+        await copyDefaults(tmp);
+        const { jobs } = yaml.load(jetpack.read(path.join(tmp, '.github', 'workflows', 'build.yml')));
+        const steps = jobs.build.steps;
+
+        const stepOn = (os_, command) => steps.find((step) => String(step.if || '').includes(os_) && String(step.run || '').includes(command));
+
+        const linux = stepOn('ubuntu-latest', 'npm run release:local');
+        ctx.expect(linux.env.CSC_LINK).toBe('');
+        ctx.expect(linux.env.APPLE_API_KEY).toBe('');
+
+        const windows = stepOn('windows-latest', 'npm run package');
+        ctx.expect(windows.env.CSC_LINK).toBe('');
+        ctx.expect(windows.env.APPLE_API_KEY).toBe('');
+
+        // The mac leg is the one that decodes them, and it points at each file only
+        // when that secret EXISTS (#872): decoding an empty secret writes an empty
+        // file and `security import` of one dies with "parameters not valid".
+        // A MISSING one exits 1 (#891): a mac build this framework ships is signed
+        // and notarized, and the message names the command that fixes it.
+        const decode = stepOn('macos-latest', 'base64 --decode');
+        ctx.expect(decode.run).toContain('if [ -n "${{ secrets.CSC_LINK }}" ]; then');
+        ctx.expect(decode.run).toContain('if [ -n "${{ secrets.APPLE_API_KEY }}" ]; then');
+        // The standalone verb is gone (#891): the deploy precheck pushes them.
+        ctx.expect(decode.run).toContain('No CSC_LINK secret: run omega deploy from targets/desktop');
+        ctx.expect(decode.run).toContain('No APPLE_API_KEY secret: run omega deploy from targets/desktop');
+        ctx.expect(decode.run).not.toContain('push-secrets');
+        ctx.expect(decode.run.match(/exit 1/g).length).toBe(2);
+        ctx.expect(decode.run).not.toContain('this build will not be signed');
+
+        const mac = stepOn('macos-latest', 'npm run release:local');
+        ctx.expect(mac.env.CSC_LINK).toBe("${{ secrets.CSC_LINK != '' && 'config/certs/dev-id.p12' || '' }}");
+        ctx.expect(mac.env.APPLE_API_KEY).toBe("${{ secrets.APPLE_API_KEY != '' && 'config/certs/AuthKey.p8' || '' }}");
+
+        fs.rmSync(tmp, { recursive: true, force: true });
+      },
+    },
+    // The firewall spawns the command it is given LITERALLY on Windows, with no
+    // PATHEXT resolution, and the only `npm` on a Windows runner's PATH is
+    // `npm.cmd` (#872): under cmd, bare `npm` is "Command 'npm' not found in PATH".
+    {
+      name: 'every cmd-shelled install names npm.cmd, every other one stays bare npm (#872)',
+      run: async (ctx) => {
+        const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-workflow-npmcmd-'));
+        await copyDefaults(tmp);
+        const { jobs } = yaml.load(jetpack.read(path.join(tmp, '.github', 'workflows', 'build.yml')));
+
+        for (const job of Object.values(jobs)) {
+          const jobShell = job.defaults?.run?.shell;
+
+          for (const step of job.steps || []) {
+            const run = String(step.run || '');
+            if (!run.includes('sfw npm')) {
+              continue;
+            }
+
+            const underCmd = (step.shell || jobShell) === 'cmd';
+            ctx.expect(run.includes('sfw npm.cmd ')).toBe(underCmd);
+          }
+        }
+
+        // And the two legs that DO run under cmd are still there to be checked.
+        ctx.expect(jobs.build.steps.some((step) => step.shell === 'cmd' && String(step.run || '').includes('sfw npm.cmd ci'))).toBe(true);
+        ctx.expect(jobs['windows-sign'].defaults.run.shell).toBe('cmd');
+        // The self-hosted signer installs WITHOUT the firewall (#872): its network does
+        // not reach Socket's API and the firewall fails closed, while the lockfile it
+        // installs was screened by the hosted build jobs of the same run.
+        ctx.expect(jobs['windows-sign'].steps.some((step) => String(step.run || '').trim() === 'npm.cmd ci')).toBe(true);
+        ctx.expect(jobs['windows-sign'].steps.some((step) => String(step.run || '').includes('sfw '))).toBe(false);
+        ctx.expect(jobs['windows-sign'].steps.some((step) => String(step.uses || '').startsWith('SocketDev/action@'))).toBe(false);
+
+        fs.rmSync(tmp, { recursive: true, force: true });
+      },
+    },
+    // The trigger half of the signer guard
+    // ([#875](https://github.com/Omega-JS-Stack/omega/issues/875)): the box that
+    // holds the EV token is reachable by a DISPATCH and nothing else, so a
+    // `push` or `pull_request` trigger added to this file later has to SKIP the
+    // sign job rather than sign a stray build with it.
+    {
+      name: 'the sign job runs on a dispatch only, and a skipped sign job still reaches finalize (#875)',
+      run: async (ctx) => {
+        const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-workflow-signer-guard-'));
+        await copyDefaults(tmp);
+        const { jobs } = yaml.load(jetpack.read(path.join(tmp, '.github', 'workflows', 'build.yml')));
+
+        const gate = jobs['windows-sign'].if;
+        // The ONE trusted event (#923), ANDed onto the rest so the strategy and
+        // platform gates still hold on a dispatch.
+        ctx.expect(gate).toContain("&& github.event_name == 'workflow_dispatch'");
+        ctx.expect(gate).not.toContain('repository_dispatch');
+        ctx.expect(gate).toContain("needs.windows-strategy.outputs.strategy != 'local'");
+
+        // A SKIP, never a failure: finalize reaches its `if` through `always()`
+        // and gates on the BUILD's result, so the unsigned Windows artifact the
+        // build job uploaded still finishes the run.
+        ctx.expect(jobs.finalize.if).toContain('always()');
+        ctx.expect(jobs.finalize.if).toContain("needs.build.result == 'success'");
+        ctx.expect(jobs.finalize.if).not.toContain('needs.windows-sign.result');
+
+        fs.rmSync(tmp, { recursive: true, force: true });
+      },
+    },
+    // The template matches its three siblings in shape
+    // ([#880](https://github.com/Omega-JS-Stack/omega/issues/880)): the same
+    // header, the same one dispatch trigger, a version log, and a bound on
+    // every job. Read off the scaffolded render, like every case above.
+    {
+      name: 'the scaffolded workflow carries the sibling header, the one dispatch trigger, a version log and a timeout per job (#880)',
+      run: async (ctx) => {
+        const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-workflow-shape-'));
+        await copyDefaults(tmp);
+        const scaffolded = jetpack.read(path.join(tmp, '.github', 'workflows', 'build.yml'));
+        const doc = yaml.load(scaffolded);
+
+        // The header opens the file, above `name:`, the way backend's does.
+        ctx.expect(scaffolded.startsWith('# Deliberate deploys (D13):')).toBe(true);
+        ctx.expect(scaffolded).toContain("Regenerated by every verb's ensureTarget");
+
+        // The one dispatch trigger (#923), carrying the `platforms` input.
+        // js-yaml 4 keeps `on` a plain string key (YAML 1.2 drops the
+        // `on`/`off` booleans YAML 1.1 had), so `doc.on` is the trigger map.
+        ctx.expect(Object.keys(doc.on)).toEqual(['workflow_dispatch']);
+        ctx.expect(doc.on.workflow_dispatch.inputs).toHaveProperty('platforms');
+
+        // ONE version log for all three legs of the build matrix, under an
+        // explicit `shell: bash` (the cmd forcing is for npm, this step reads).
+        const log = doc.jobs.build.steps.find((step) => step.name === 'Log versions');
+        ctx.expect(log).toBeDefined();
+        ctx.expect(log.shell).toBe('bash');
+        for (const command of ['node -v', 'npm -v', 'node "${{ github.workspace }}/node_modules/@omega.js/desktop/bin/omega" version']) {
+          ctx.expect(log.run).toContain(command);
+        }
+
+        // No job holds a runner for GitHub's six-hour default.
+        const unbounded = Object.entries(doc.jobs)
+          .filter(([, job]) => typeof job['timeout-minutes'] !== 'number')
+          .map(([name]) => name);
+        ctx.expect(unbounded).toEqual([]);
+
+        fs.rmSync(tmp, { recursive: true, force: true });
+      },
+    },
   ],
 });

package/dist/test/suites/build/cli.test.js

@@ -51,30 +51,52 @@ module.exports = defineCases({
       },
     },
     {
-      name: 'bin/omega-desktop exists',
+      name: 'bin/omega exists',
       run: (ctx) => {
-        const binFile = path.join(root, 'bin', 'omega-desktop');
+        const binFile = path.join(root, 'bin', 'omega');
         ctx.expect(fs.existsSync(binFile)).toBeTruthy();
       },
     },
     {
-      name: 'bin/omega-desktop is executable',
+      name: 'bin/omega is executable',
       run: (ctx) => {
         // NTFS has no execute bit, so the mode carries nothing to assert on a
         // Windows checkout — the existence case above still runs everywhere.
         if (process.platform === 'win32') ctx.skip('NTFS has no execute bit — `stat.mode & 0o100` is meaningless on Windows');
-        const stat = fs.statSync(path.join(root, 'bin', 'omega-desktop'));
+        const stat = fs.statSync(path.join(root, 'bin', 'omega'));
         ctx.expect((stat.mode & 0o100) !== 0).toBeTruthy();
       },
     },
     {
-      name: 'cli-run disables yargs built-in --help/--version (router owns both)',
+      name: 'cli-run declares its value-less flags and claims neither --help nor --version (the router owns both)',
       run: (ctx) => {
-        // The built-ins printed an empty stub and version "0.0.0" instead of
-        // reaching the alias table / the router's generated help (wave-6 D1).
-        const source = fs.readFileSync(path.join(root, 'dist', 'cli-run.js'), 'utf8');
-        ctx.expect(source.includes('.version(false)')).toBeTruthy();
-        ctx.expect(source.includes('.help(false)')).toBeTruthy();
+        // The parse the bin really performs (#920). The built-ins it replaced
+        // printed an empty stub and version "0.0.0" instead of reaching the
+        // alias table / the router's generated help (wave-6 D1).
+        const { BOOLEAN_FLAGS } = require(path.join(root, 'dist', 'cli-run.js'));
+        const { parseArgv } = require('../../../vendor/devkit/argv.js');
+        const parse = (args) => parseArgv(args, { booleans: BOOLEAN_FLAGS });
+
+        // A value-less flag never swallows the next positional.
+        const scoped = parse(['test', '--extended', 'mgr:build/cli']);
+        ctx.expect(scoped.extended).toBe(true);
+        ctx.expect(scoped._.join(' ')).toBe('test mgr:build/cli');
+
+        // A value flag keeps its value in the SPACE-separated form CI writes
+        // (src/defaults/.github/workflows/build.yml).
+        const signing = parse(['sign-windows', '--in', 'release', '--out', 'release/signed']);
+        ctx.expect(signing.in).toBe('release');
+        ctx.expect(signing.out).toBe('release/signed');
+        ctx.expect(parse(['finalize-release', '--signed-dir', 'release/signed']).signedDir).toBe('release/signed');
+
+        // Every value-LESS flag is declared, so none of them can eat the token
+        // after it: `omega logs --tail runtime` keeps the log name.
+        const tailed = parse(['logs', '--tail', 'runtime']);
+        ctx.expect(tailed.tail).toBe(true);
+        ctx.expect(tailed._.join(' ')).toBe('logs runtime');
+
+        // And --help reaches the router rather than a built-in.
+        ctx.expect(parse(['deploy', '--help']).help).toBe(true);
       },
     },
     {

package/dist/test/suites/build/config-schema.test.js

@@ -113,12 +113,12 @@ module.exports = defineCases({
       },
     },
     {
-      name: 'resolved: has platforms.win.signing block (Windows-specific signing config)',
+      name: 'resolved: has platforms.windows.signing block (Windows-specific signing config)',
       run: (ctx) => {
         ctx.expect(ctx.state.cfg.platforms).toBeTruthy();
-        ctx.expect(ctx.state.cfg.platforms.win).toBeTruthy();
-        ctx.expect(ctx.state.cfg.platforms.win.signing).toBeTruthy();
-        ctx.expect(['self-hosted', 'cloud', 'local']).toContain(ctx.state.cfg.platforms.win.signing.strategy);
+        ctx.expect(ctx.state.cfg.platforms.windows).toBeTruthy();
+        ctx.expect(ctx.state.cfg.platforms.windows.signing).toBeTruthy();
+        ctx.expect(['self-hosted', 'cloud', 'local']).toContain(ctx.state.cfg.platforms.windows.signing.strategy);
       },
     },
     {

package/dist/test/suites/build/console-lock.test.js

@@ -0,0 +1,51 @@
+// Build-layer tests for the locked-console refusal. The process list is
+// injected, so both verdicts are provable without a Windows box.
+
+const path = require('path');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+const lock = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'console-lock.js'));
+
+module.exports = defineCases({
+  type: 'group',
+  layer: 'build',
+  description: 'console-lock — LogonUI.exe in the process list is a locked console',
+  tests: [
+    {
+      name: "tasklist's CSV with the lock-screen process reads as locked, without it as not",
+      run: (ctx) => {
+        ctx.expect(lock.isConsoleLocked('"LogonUI.exe","2012","Console","1","71,284 K"\r\n')).toBe(true);
+        ctx.expect(lock.isConsoleLocked('INFO: No tasks are running which match the specified criteria.')).toBe(false);
+        ctx.expect(lock.isConsoleLocked('')).toBe(false);
+      },
+    },
+    {
+      name: 'a locked console is refused, naming LogonUI.exe and the fix',
+      run: async (ctx) => {
+        const ran = [];
+        const exec = (out) => async (cmd) => { ran.push(cmd); return out; };
+
+        let threw;
+        try {
+          await lock.assertConsoleUnlocked({ platform: 'win32', exec: exec('"LogonUI.exe","2012","Console","1","71,284 K"') });
+        } catch (e) { threw = e; }
+        ctx.expect(threw).toBeDefined();
+        ctx.expect(threw.message).toMatch(/console session is locked/);
+        ctx.expect(threw.message).toMatch(/LogonUI\.exe/);
+        ctx.expect(threw.message).toMatch(/Unlock the box/);
+        // The filter and the headerless CSV are what isConsoleLocked reads.
+        ctx.expect(ran).toEqual(['tasklist /fi "IMAGENAME eq LogonUI.exe" /fo csv /nh']);
+
+        await lock.assertConsoleUnlocked({ platform: 'win32', exec: exec('INFO: No tasks are running which match the specified criteria.') });
+      },
+    },
+    {
+      name: 'off Windows there is no lock screen and nothing is run',
+      run: async (ctx) => {
+        const ran = [];
+        await lock.assertConsoleUnlocked({ platform: 'darwin', exec: async (cmd) => { ran.push(cmd); return '"LogonUI.exe"'; } });
+        ctx.expect(ran).toEqual([]);
+      },
+    },
+  ],
+});

package/dist/test/suites/build/defaults-scaffold.test.js

@@ -107,8 +107,77 @@ module.exports = defineCases({
         const gitignore = jetpack.read(path.join(tmp, '.gitignore'));
         const customPart = gitignore.slice(gitignore.indexOf(CUSTOM_MARKER));
         ctx.expect(customPart).toContain('my-secret-dir/');
-        // Not in @omega.js/desktop's defaults → migrated below the Custom marker.
-        ctx.expect(customPart).toContain('user-added-dir/');
+        // The framework block is completely managed ([#926](https://github.com/Omega-JS-Stack/omega/issues/926)):
+        // a line inside it that @omega.js/desktop's defaults no longer carry leaves the
+        // file. Lines the consumer owns go below the Custom marker.
+        ctx.expect(gitignore).not.toContain('user-added-dir/');
+      },
+    },
+    {
+      name: 'config/certs/: the target .gitignore hides the material and tracks the README (#913)',
+      run: async (ctx) => {
+        const { spawnSync } = require('child_process');
+
+        const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-defaults-'));
+        await copyDefaults(tmp);
+
+        const gitignore = jetpack.read(path.join(tmp, '.gitignore'));
+        const defaultPart = gitignore.slice(0, gitignore.indexOf(CUSTOM_MARKER));
+        ctx.expect(defaultPart).toContain('config/certs/*');
+        ctx.expect(defaultPart).toContain('!config/certs/README.md');
+        // The framework section is a file consumers edit, and the dotfiles emdash
+        // hook bounces one (built by code point so this file carries none either).
+        ctx.expect(defaultPart.includes(String.fromCharCode(0x2014))).toBe(false);
+
+        // The README the scaffold writes says the target .gitignore is what
+        // hides this directory, so no sibling .gitignore ships beside it.
+        ctx.expect(jetpack.exists(path.join(tmp, 'config', 'certs', 'README.md'))).toBe('file');
+        ctx.expect(jetpack.exists(path.join(tmp, 'config', 'certs', '.gitignore'))).toBe(false);
+
+        // git is the only authority on this: prove it against a real repo.
+        jetpack.write(path.join(tmp, 'config', 'certs', 'foo.p12'), 'not a real cert');
+        spawnSync('git', ['init', '-q'], { cwd: tmp });
+        const ignored = (file) => spawnSync('git', ['check-ignore', '-q', file], { cwd: tmp }).status === 0;
+
+        ctx.expect(ignored('config/certs/README.md')).toBe(false);
+        ctx.expect(ignored('config/certs/foo.p12')).toBe(true);
+      },
+    },
+    {
+      name: 'config/certs/: a target scaffolded before #913 converges on the next verb run',
+      run: async (ctx) => {
+        // Three leftovers each keep the README hidden on their own, so the next
+        // verb run heals all three: the old `config/certs/` line, which the
+        // marker merge now DROPS with the rest of the retired framework block
+        // ([#926](https://github.com/Omega-JS-Stack/omega/issues/926)), the
+        // sibling `.gitignore` (a nested ignore file beats the parent), and the
+        // README's own sentence, which cited that sibling.
+        const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'desktop-defaults-'));
+        const sibling = path.join(tmp, 'config', 'certs', '.gitignore');
+        const readme = path.join(tmp, 'config', 'certs', 'README.md');
+
+        jetpack.write(
+          path.join(tmp, '.gitignore'),
+          `${DEFAULT_MARKER}\n.env\nconfig/certs/\n*.p12\n\n${CUSTOM_MARKER}\nmy-secret-dir/\n`
+        );
+        jetpack.write(sibling, '*\n!.gitignore\n');
+        jetpack.write(readme, '# `config/certs/`\n\nThe `.gitignore` beside this file ignores everything it holds.\n');
+
+        await copyDefaults(tmp);
+
+        const gitignore = jetpack.read(path.join(tmp, '.gitignore'));
+        ctx.expect(gitignore.split('\n').some((line) => line.trim() === 'config/certs/')).toBe(false);
+        const defaultHalf = gitignore.slice(0, gitignore.indexOf(CUSTOM_MARKER));
+        ctx.expect(defaultHalf).toContain('config/certs/*');
+        ctx.expect(defaultHalf).toContain('!config/certs/README.md');
+        ctx.expect(gitignore).toContain('my-secret-dir/');
+        ctx.expect(jetpack.exists(sibling)).toBe(false);
+        ctx.expect(jetpack.read(readme)).toContain("The target's `.gitignore` ignores everything here except this file");
+
+        // Anything else in that sibling is the consumer's, and is never destroyed.
+        jetpack.write(sibling, '*\n!.gitignore\n!my-own-note.txt\n');
+        await copyDefaults(tmp);
+        ctx.expect(jetpack.exists(sibling)).toBe('file');
       },
     },
     {